0
+ − 1 <?php
+ − 2 /*
+ − 3 Plugin Name: Runt - the Enano administration panel
+ − 4 Plugin URI: http://enanocms.org/
+ − 5 Description: Provides the page Special:Administration, which is the AJAX frontend to the various Admin:
+ − 6 Author: Dan Fuhry
+ − 7 Version: 1.0
+ − 8 Author URI: http://enanocms.org/
+ − 9 */
+ − 10
+ − 11 /*
+ − 12 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 13 * Version 1.0 release candidate 3
0
+ − 14 * Copyright (C) 2006-2007 Dan Fuhry
+ − 15 *
+ − 16 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 17 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 18 *
+ − 19 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 20 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 21 */
+ − 22
+ − 23 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 24
+ − 25 $plugins->attachHook('base_classes_initted', '
+ − 26 global $paths;
+ − 27 $paths->add_page(Array(
+ − 28 \'name\'=>\'Administration\',
+ − 29 \'urlname\'=>\'Administration\',
+ − 30 \'namespace\'=>\'Special\',
+ − 31 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 32 ));
+ − 33
+ − 34 $paths->add_page(Array(
+ − 35 \'name\'=>\'Manage the Sidebar\',
+ − 36 \'urlname\'=>\'EditSidebar\',
+ − 37 \'namespace\'=>\'Special\',
+ − 38 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 39 ));
+ − 40 ');
+ − 41
+ − 42 // function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>
+ − 43
+ − 44 function page_Admin_Home() {
+ − 45 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 46 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 47 {
+ − 48 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 49 return;
+ − 50 }
+ − 51
+ − 52
+ − 53 // Basic information
+ − 54 echo RenderMan::render(
+ − 55 '== Welcome to Runt, the Enano administration panel. ==
+ − 56
+ − 57 Thank you for choosing Enano as your CMS. This screen allows you to see some information about your website, plus some details about how your site is doing statistically.
+ − 58
+ − 59 Using the links on the left you can control every aspect of your website\'s look and feel, plus you can manage users, work with pages, and install plugins to make your Enano installation even better.');
+ − 60
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 61 // Demo mode
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 62 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 63 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 64 echo '<h3>Enano is running in demo mode.</h3>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 65 <p>If you borked something up, or if you\'re done testing, you can <a href="' . makeUrlNS('Special', 'DemoReset', false, true) . '">reset this site</a>. The site is reset automatically once every two hours. When a reset is performed, all custom modifications to the site are lost and replaced with default values.</p>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 66 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 67
0
+ − 68 // Check for the installer scripts
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 69 if( ( file_exists(ENANO_ROOT.'/install.php') || file_exists(ENANO_ROOT.'/schema.sql') ) && !defined('ENANO_DEMO_MODE') )
0
+ − 70 {
+ − 71 echo '<div class="error-box"><b>NOTE:</b> It appears that your install.php and/or schema.sql files still exist. It is HIGHLY RECOMMENDED that you delete or rename these files, to prevent getting your server hacked.</div>';
+ − 72 }
+ − 73
+ − 74 // Inactive users
+ − 75 $q = $db->sql_query('SELECT * FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\';');
+ − 76 if($q)
+ − 77 if($db->numrows() > 0)
+ − 78 {
+ − 79 $n = $db->numrows();
+ − 80 if($n == 1) $s = $n . ' user is';
+ − 81 else $s = $n . ' users are';
+ − 82 echo '<div class="warning-box">It appears that '.$s.' awaiting account activation. You can activate those accounts by going to the <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'UserManager\'); return false;">User Manager</a>.</div>';
+ − 83 }
+ − 84 $db->free_result();
+ − 85 // Stats
+ − 86 if(getConfig('log_hits') == '1')
+ − 87 {
+ − 88 $stats = stats_top_pages(10);
+ − 89 $c = 0;
+ − 90 $cls = 'row2';
+ − 91 echo '<h3>Most requested pages</h3><div class="tblholder"><table style="width: 100%;" border="0" cellspacing="1" cellpadding="4"><tr><th>Page</th><th>Hits</th></tr>';
+ − 92 foreach($stats as $page => $count)
+ − 93 {
+ − 94 if(isset($paths->pages[$page]))
+ − 95 {
+ − 96 echo '<tr>';
+ − 97 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 98 echo '<td class="'.$cls.'"><a href="'.makeUrl($page).'">'.$paths->pages[$page]['name'].'</a></td><td style="text-align: center;" class="'.$cls.'">'.$count.'</td>';
+ − 99 echo '</tr>';
+ − 100 }
+ − 101 }
+ − 102 echo '</table></div>';
+ − 103 }
+ − 104
+ − 105 // Security log
+ − 106 echo '<h3>Security log</h3>';
+ − 107 echo '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">';
+ − 108 $cls = 'row2';
+ − 109 echo '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>';
+ − 110 if(isset($_GET['fulllog']))
+ − 111 {
+ − 112 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;';
+ − 113 }
+ − 114 else
+ − 115 {
+ − 116 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT 5';
+ − 117 }
+ − 118 $q = $db->sql_query($l);
+ − 119 while($r = $db->fetchrow())
+ − 120 {
+ − 121 if($cls == 'row2') $cls = 'row1';
+ − 122 else $cls = 'row2';
+ − 123 echo '<tr><td class="'.$cls.'">';
+ − 124 switch($r['action']) {
+ − 125 case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Authentication level: $level</small>"; } break;
15
ad5986a53197
Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability
Dan
diff
changeset
+ − 126 case "admin_auth_bad": echo 'Failed elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Attempted auth level: $level</small>"; } break;
0
+ − 127 case "activ_good": echo 'Successful account activation'; break;
+ − 128 case "auth_good": echo 'Successful regular user logon'; break;
+ − 129 case "activ_bad": echo 'Failed account activation'; break;
+ − 130 case "auth_bad": echo 'Failed regular user logon'; break;
+ − 131 case "sql_inject": echo 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break;
+ − 132 case "db_backup": echo 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break;
+ − 133 case "install_enano": echo "Installed Enano version {$r['page_text']}"; break;
+ − 134 }
+ − 135 echo '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>';
+ − 136 }
+ − 137 $db->free_result();
+ − 138 echo '</table></div>';
+ − 139 if(!isset($_GET['fulllog'])) echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'Home&fulllog\'); return false;">Full security log</a></p>';
+ − 140
+ − 141 }
+ − 142
+ − 143 function page_Admin_GeneralConfig() {
+ − 144 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 145 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 146 {
+ − 147 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 148 return;
+ − 149 }
+ − 150
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 151 if(isset($_POST['submit']) && !defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 152 {
0
+ − 153
+ − 154 // Global site options
+ − 155 setConfig('site_name', $_POST['site_name']);
+ − 156 setConfig('site_desc', $_POST['site_desc']);
+ − 157 setConfig('main_page', str_replace(' ', '_', $_POST['main_page']));
+ − 158 setConfig('copyright_notice', $_POST['copyright']);
+ − 159 setConfig('contact_email', $_POST['contact_email']);
+ − 160
+ − 161 // Wiki mode
+ − 162 if(isset($_POST['wikimode'])) setConfig('wiki_mode', '1');
+ − 163 else setConfig('wiki_mode', '0');
+ − 164 if(isset($_POST['wiki_mode_require_login'])) setConfig('wiki_mode_require_login', '1');
+ − 165 else setConfig('wiki_mode_require_login', '0');
+ − 166 if(isset($_POST['editmsg'])) setConfig('wiki_edit_notice', '1');
+ − 167 else setConfig('wiki_edit_notice', '0');
+ − 168 setConfig('wiki_edit_notice_text', $_POST['editmsg_text']);
+ − 169
+ − 170 // Stats
+ − 171 if(isset($_POST['log_hits'])) setConfig('log_hits', '1');
+ − 172 else setConfig('log_hits', '0');
+ − 173
+ − 174 // Disablement
+ − 175 if(isset($_POST['site_disabled'])) { setConfig('site_disabled', '1'); setConfig('site_disabled_notice', $_POST['site_disabled_notice']); }
+ − 176 else setConfig('site_disabled', '0');
+ − 177
+ − 178 // Account activation
+ − 179 setConfig('account_activation', $_POST['account_activation']);
+ − 180
+ − 181 // W3C compliance buttons
+ − 182 if(isset($_POST['w3c-vh32'])) setConfig("w3c_vh32", "1");
+ − 183 else setConfig("w3c_vh32", "0");
+ − 184 if(isset($_POST['w3c-vh40'])) setConfig("w3c_vh40", "1");
+ − 185 else setConfig("w3c_vh40", "0");
+ − 186 if(isset($_POST['w3c-vh401'])) setConfig("w3c_vh401", "1");
+ − 187 else setConfig("w3c_vh401", "0");
+ − 188 if(isset($_POST['w3c-vxhtml10'])) setConfig("w3c_vxhtml10", "1");
+ − 189 else setConfig("w3c_vxhtml10", "0");
+ − 190 if(isset($_POST['w3c-vxhtml11'])) setConfig("w3c_vxhtml11", "1");
+ − 191 else setConfig("w3c_vxhtml11", "0");
+ − 192 if(isset($_POST['w3c-vcss'])) setConfig("w3c_vcss", "1");
+ − 193 else setConfig("w3c_vcss", "0");
+ − 194
+ − 195 // SourceForge.net logo
+ − 196 if(isset($_POST['showsf'])) setConfig('sflogo_enabled', '1');
+ − 197 else setConfig('sflogo_enabled', '0');
+ − 198 setConfig('sflogo_groupid', $_POST['sfgroup']);
+ − 199 setConfig('sflogo_type', $_POST['sflogo']);
+ − 200
+ − 201 // Comment options
+ − 202 if(isset($_POST['comment-approval'])) setConfig('approve_comments', '1');
+ − 203 else setConfig('approve_comments', '0');
+ − 204 if(isset($_POST['enable-comments'])) setConfig('enable_comments', '1');
+ − 205 else setConfig('enable_comments', '0');
+ − 206 setConfig('comments_need_login', $_POST['comments_need_login']);
+ − 207
+ − 208 // Powered by link
+ − 209 if ( isset($_POST['enano_powered_link']) ) setConfig('powered_btn', '1');
+ − 210 else setConfig('powered_btn', '0');
+ − 211
+ − 212 if(isset($_POST['dbdbutton'])) setConfig('dbd_button', '1');
+ − 213 else setConfig('dbd_button', '0');
+ − 214
+ − 215 if($_POST['emailmethod'] == 'phpmail') setConfig('smtp_enabled', '0');
+ − 216 else setConfig('smtp_enabled', '1');
+ − 217
+ − 218 setConfig('smtp_server', $_POST['smtp_host']);
+ − 219 setConfig('smtp_user', $_POST['smtp_user']);
+ − 220 if($_POST['smtp_pass'] != 'XXXXXXXXXXXX') setConfig('smtp_password', $_POST['smtp_pass']);
+ − 221
+ − 222 echo '<div class="info-box">Your changes to the site configuration have been saved.</div><br />';
+ − 223
+ − 224 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 225 else if ( isset($_POST['submit']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 226 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 227 echo '<div class="error-box">Saving the general site configuration is blocked in the administration demo.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 228 }
0
+ − 229 echo('<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post" onsubmit="if(!submitAuthorized) return false;">');
+ − 230 ?>
+ − 231 <div class="tblholder">
+ − 232 <table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 233
+ − 234 <!-- Global options -->
+ − 235
+ − 236 <tr><th colspan="2">Global site options</th></tr>
+ − 237 <tr><th colspan="2" class="subhead">These options control the entire site.</th></tr>
+ − 238
+ − 239 <tr><td class="row1" style="width: 50%;">Site name:</td> <td class="row1" style="width: 50%;"><input name="site_name" size="30" value="<?php echo getConfig('site_name'); ?>" /></td></tr>
+ − 240 <tr><td class="row2">Site description:</td> <td class="row2"><input name="site_desc" size="30" value="<?php echo getConfig('site_desc'); ?>" /></td></tr>
+ − 241 <tr><td class="row1">Main page:</td> <td class="row1"><?php echo $template->pagename_field('main_page', str_replace('_', ' ', getConfig('main_page'))); ?></td></tr>
+ − 242 <tr><td class="row2">Copyright notice shown on pages:</td><td class="row2"><input name="copyright" size="30" value="<?php echo getConfig('copyright_notice'); ?>" /></td></tr>
+ − 243 <tr><td class="row1" colspan="2">Hint: If you're using Windows, you can make a "©" symbol by holding ALT and pressing 0169 on the numeric keypad.</td></tr>
+ − 244 <tr><td class="row2">Contact e-mail<br /><small>All e-mail sent from this site will appear to have come from the address shown here.</small></td><td class="row2"><input name="contact_email" type="text" size="40" value="<?php echo htmlspecialchars(getConfig('contact_email')); ?>" /></td></tr>
+ − 245
+ − 246 <!-- Wiki mode -->
+ − 247
+ − 248 <tr><th colspan="2">Wiki mode</th></tr>
+ − 249
+ − 250 <tr>
+ − 251 <td class="row3" rowspan="2">
+ − 252 Enano can also act as a wiki, meaning anyone can edit and create pages. To enable Wiki Mode, check the box to the right.<br /><br />
+ − 253 In Wiki Mode, certain HTML tags such as <script> and <object> are disabled, and all PHP code is disabled, except if the person editing the page is an administrator.<br /><br />
+ − 254 Also, Enano keeps complete page history, which makes restoring vandalized pages easy. You can also protect pages so that they cannot be edited.
+ − 255 </td>
+ − 256 <td class="row1">
+ − 257 <input type="checkbox" name="wikimode" id="wikimode" <?php if(getConfig('wiki_mode')=='1') echo('CHECKED '); ?> /><label for="wikimode">Enable Wiki Mode</label>
+ − 258 </td>
+ − 259 </tr>
+ − 260
+ − 261 <tr><td class="row2"><label><input type="checkbox" name="wiki_mode_require_login"<?php if(getConfig('wiki_mode_require_login')=='1') echo('CHECKED '); ?>/> Only for logged in users</label></td></tr>
+ − 262
+ − 263 <tr>
+ − 264 <td class="row3" rowspan="2">
+ − 265 <b>Edit page notice</b><br />
+ − 266 When Wiki Mode is enabled, anyone can edit pages. Check the box below and enter a message to display it whenever the page editor is opened.
+ − 267 </td>
+ − 268 <td class="row1">
+ − 269 <input onclick="if(this.checked) document.getElementById('editmsg_text').style.display='block'; else document.getElementById('editmsg_text').style.display='none';" type="checkbox" name="editmsg" id="editmsg" <?php if(getConfig('wiki_edit_notice')=='1') echo('CHECKED '); ?>/> <label for="editmsg">Show a message whenever pages are edited</label>
+ − 270 </td>
+ − 271 </tr>
+ − 272
+ − 273 <tr>
+ − 274 <td class="row2">
+ − 275 <textarea <?php if(getConfig('wiki_edit_notice')!='1') echo('style="display:none" '); ?>rows="5" cols="30" name="editmsg_text" id="editmsg_text"><?php echo getConfig('wiki_edit_notice_text'); ?></textarea>
+ − 276 </td>
+ − 277 </tr>
+ − 278
+ − 279 <!-- Site statistics -->
+ − 280
+ − 281 <tr><th colspan="2">Statistics and hit counting</th></tr>
+ − 282
+ − 283 <tr>
+ − 284 <td class="row1">Enano has the ability to show statistics for every page on the site. This allows you to keep very close track of who is visiting your site, and from where.<br /><br />Unfortunately, some users don't like being logged. For this reason, you should state clearly what is logged (usually the username or IP address, current time, page name, and referer URL) in your privacy policy. If your site is primarily geared towards children, and you are a United States citizen, you are required to have a privacy policy stating exactly what is being logged under the terms of the Childrens' Online Privacy Protection Act.</td>
+ − 285 <td class="row1"><label><input type="checkbox" name="log_hits" <?php if(getConfig('log_hits') == '1') echo 'checked="checked" '; ?>/> Log all page hits</label><br /><small>This excludes special and administration pages.</small></td>
+ − 286 </tr>
+ − 287
+ − 288 <!-- Comment options -->
+ − 289
+ − 290 <tr><th colspan="2">Comment system</th></tr>
+ − 291 <tr><td class="row1"><label for="enable-comments"><b>Enable the comment system</b></label> </td><td class="row1"><input name="enable-comments" id="enable-comments" type="checkbox" <?php if(getConfig('enable_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 292 <tr><td class="row2"><label for="comment-approval">Require approval before article comments can be shown</label></td><td class="row2"><input name="comment-approval" id="comment-approval" type="checkbox" <?php if(getConfig('approve_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 293 <tr><td class="row1">Guest comment posting allowed </td><td class="row1"><label><input name="comments_need_login" type="radio" value="0" <?php if(getConfig('comments_need_login')=='0') echo 'CHECKED '; ?>/> Yes</label>
+ − 294 <label><input name="comments_need_login" type="radio" value="1" <?php if(getConfig('comments_need_login')=='1') echo 'CHECKED '; ?>/> Require visual confirmation</label>
+ − 295 <!-- Default permissions --> <label><input name="comments_need_login" type="radio" value="2" <?php if(getConfig('comments_need_login')=='2') echo 'CHECKED '; ?>/> No (require login)</label></td></tr>
+ − 296
+ − 297 <!--
+ − 298
+ − 299 READ: Do not try to enable this, backend support for it has been disabled. To edit default
+ − 300 permissions, select The Entire Website in any permissions editor window.
+ − 301
+ − 302 <tr><th colspan="2">Default permissions for pages</th></tr>
+ − 303
+ − 304 <tr>
+ − 305 <td class="row1">You can edit the default set of permissions used when no other permissions are available. Permissions set here are used when no other permissions are available. As with other ACL rules, you can assign these defaults to every user or one specific user or group.</td>
+ − 306 <td class="row1"><a href="#" onclick="ajaxOpenACLManager('__DefaultPermissions', 'Special'); return false;">Manage default permissions</a></td>
+ − 307 </tr>
+ − 308
+ − 309 -->
+ − 310
+ − 311 <!-- enanocms.org link -->
+ − 312
+ − 313 <tr>
+ − 314 <th colspan="2">Promote Enano</th>
+ − 315 </tr>
+ − 316 <tr>
+ − 317 <td class="row3">
+ − 318 If you think Enano is nice, or if you want to show your support for the Enano team, you can do so by placing a link to the Enano
+ − 319 homepage in your Links sidebar block. You absolutely don't have to do this, and you won't get degraded support if you don't. Because
+ − 320 Enano is still relatively new in the CMS world, it needs all the attention it can get - and you can easily help to spread the word
+ − 321 using this link.
+ − 322 </td>
+ − 323 <td class="row1">
+ − 324 <label>
+ − 325 <input name="enano_powered_link" type="checkbox" <?php if(getConfig('powered_btn') == '1') echo 'checked="checked"'; ?> /> Place a link to www.enanocms.org on the sidebar
+ − 326 </label>
+ − 327 </td>
+ − 328 </tr>
+ − 329
+ − 330 <!-- Site disablement -->
+ − 331
+ − 332 <tr><th colspan="2">Disable all site access</th></tr>
+ − 333
+ − 334 <tr>
+ − 335 <td class="row3" rowspan="2">Disabling the site allows you to work on the site without letting non-administrators see or use it.</td>
+ − 336 <td class="row1"><label><input onclick="if(this.checked) document.getElementById('site_disabled_notice').style.display='block'; else document.getElementById('site_disabled_notice').style.display='none';" type="checkbox" name="site_disabled" <?php if(getConfig('site_disabled') == '1') echo 'checked="checked" '; ?>/> Disable this site</label></td>
+ − 337 </tr>
+ − 338 <tr>
+ − 339 <td class="row2">
+ − 340 <div id="site_disabled_notice">
+ − 341 Message to show to users:<br />
+ − 342 <textarea name="site_disabled_notice" rows="7" cols="30"><?php echo getConfig('site_disabled_notice'); ?></textarea>
+ − 343 </div>
+ − 344 </td>
+ − 345 </tr>
+ − 346
+ − 347 <!-- Account activation -->
+ − 348
+ − 349 <tr><th colspan="2">User account activation</th></tr>
+ − 350
+ − 351 <tr>
+ − 352 <td class="row3" colspan="2">
+ − 353 If you would like to require users to confirm their e-mail addresses by way of account activation, you can enable this behavior here. If this option is set to "None", users will be able to register and use this site without confirming their e-mail addresses. If this option is set to "User", users will automatically be sent e-mails upon registration with a link to activate their accounts. And lastly, if this option is set to "Admin", users' accounts will not be active until an administrator activates the account.<br /><br />
+ − 354 You may also disable registration completely if needed.<br /><br />
+ − 355 <b>Note: because of abuse by project administrators, sending account activation e-mails will not work on SourceForge.net servers.</b>
+ − 356 </td>
+ − 357 </tr>
+ − 358
+ − 359 <tr>
+ − 360 <td class="row1">Account activation:</td><td class="row1">
+ − 361 <?php
+ − 362 echo '<label><input'; if(getConfig('account_activation') == 'disable') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="disable" /> Disable registration</label><br />';
+ − 363 echo '<label><input'; if(getConfig('account_activation') != 'user' && getConfig('account_activation') != 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="none" /> None</label>';
+ − 364 echo '<label><input'; if(getConfig('account_activation') == 'user') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="user" /> User</label>';
+ − 365 echo '<label><input'; if(getConfig('account_activation') == 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="admin" /> Admin</label>';
+ − 366 ?>
+ − 367 </td>
+ − 368 </tr>
+ − 369
+ − 370 <!-- E-mail options -->
+ − 371
+ − 372 <tr><th colspan="2">E-mail sent from the site</th></tr>
+ − 373 <tr><td class="row1">E-mail sending method:<br /><small>Try using the built-in e-mail method first. If that doesn't work, you will need to enter valid SMTP information here.</small></td>
+ − 374 <td class="row1"><label><input <?php if(getConfig('smtp_enabled') != '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="phpmail" />PHP's built-in mail() function</label><br />
+ − 375 <label><input <?php if(getConfig('smtp_enabled') == '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="smtp" />Use an external SMTP server</label></td>
+ − 376 </tr>
+ − 377 <tr><td class="row2">SMTP hostname:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 378 <td class="row2"><input value="<?php echo getConfig('smtp_server'); ?>" name="smtp_host" type="text" size="30" /></td>
+ − 379 </tr>
+ − 380 <tr><td class="row1">SMTP credentials:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 381 <td class="row1">Username: <input value="<?php echo getConfig('smtp_user'); ?>" name="smtp_user" type="text" size="30" /><br />
+ − 382 Password: <input value="<?php if(getConfig('smtp_password') != false) echo 'XXXXXXXXXXXX'; ?>" name="smtp_pass" type="password" size="30" /></td>
+ − 383 </tr>
+ − 384
+ − 385 <!-- SourceForge.net logo -->
+ − 386
+ − 387 <tr><th colspan="2">SourceForge.net logo</th></tr>
+ − 388
+ − 389 <tr>
+ − 390 <td colspan="2" class="row3">
+ − 391 All projects hosted by SourceForge.net are required to display an official SourceForge.net logo on their pages. If you want
+ − 392 to display a SourceForge.net logo on the sidebar, check the box below, enter your group ID, and select an image type.
+ − 393 </td>
+ − 394 </tr>
+ − 395
+ − 396 <?php
+ − 397 if(getConfig("sflogo_enabled")=='1') $c='CHECKED ';
+ − 398 else $c='';
+ − 399 if(getConfig("sflogo_groupid")) $g=getConfig("sflogo_groupid");
+ − 400 else $g='';
+ − 401 if(getConfig("sflogo_type")) $t=getConfig("sflogo_type");
+ − 402 else $t='1';
+ − 403 ?>
+ − 404
+ − 405 <tr>
+ − 406 <td class="row1">Display the SourceForge.net logo on the right sidebar</td>
+ − 407 <td class="row1"><input type=checkbox name="showsf" id="showsf" <?php echo $c; ?> /></td>
+ − 408 </tr>
+ − 409
+ − 410 <tr>
+ − 411 <td class="row2">Group ID:</td>
+ − 412 <td class="row2"><input value="<?php echo $g; ?>" type=text size=15 name=sfgroup /></td>
+ − 413 </tr>
+ − 414
+ − 415 <tr>
+ − 416 <td class="row1">Logo style:</td>
+ − 417 <td class="row1">
+ − 418 <select name="sflogo">
+ − 419 <option <?php if($t=='1') echo('SELECTED '); ?>value=1>88x31px, white</option>
+ − 420 <option <?php if($t=='2') echo('SELECTED '); ?>value=2>125x37px, white</option>
+ − 421 <option <?php if($t=='3') echo('SELECTED '); ?>value=3>125x37px, black</option>
+ − 422 <option <?php if($t=='4') echo('SELECTED '); ?>value=4>125x37px, blue</option>
+ − 423 <option <?php if($t=='5') echo('SELECTED '); ?>value=5>210x62px, white</option>
+ − 424 <option <?php if($t=='6') echo('SELECTED '); ?>value=6>210x62px, black</option>
+ − 425 <option <?php if($t=='7') echo('SELECTED '); ?>value=7>210x62px, blue</option>
+ − 426 </select>
+ − 427 </td>
+ − 428 </tr>
+ − 429
+ − 430 <!-- W3C validator buttons -->
+ − 431
+ − 432 <tr><th colspan="2">W3C compliance logos</th></tr>
+ − 433 <tr><th colspan="2" class="subhead">Enano generates (by default) Valid XHTML 1.1 code, plus valid CSS. If you want to show this off, check the appropriate boxes below.</th></tr>
+ − 434
+ − 435 <tr><td class="row1"><label for="w3c-vh32">HTML 3.2</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh32')=='1') echo('CHECKED '); ?> id="w3c-vh32" name="w3c-vh32" /></td></tr>
+ − 436 <tr><td class="row2"><label for="w3c-vh40">HTML 4.0</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vh40')=='1') echo('CHECKED '); ?> id="w3c-vh40" name="w3c-vh40" /></td></tr>
+ − 437 <tr><td class="row1"><label for="w3c-vh401">HTML 4.01</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh401')=='1') echo('CHECKED '); ?> id="w3c-vh401" name="w3c-vh401" /></td></tr>
+ − 438 <tr><td class="row2"><label for="w3c-vxhtml10">XHTML 1.0</label></td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vxhtml10')=='1') echo('CHECKED '); ?> id="w3c-vxhtml10" name="w3c-vxhtml10" /></td></tr>
+ − 439 <tr><td class="row1"><label for="w3c-vxhtml11">XHTML 1.1</label></td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vxhtml11')=='1') echo('CHECKED '); ?> id="w3c-vxhtml11" name="w3c-vxhtml11" /></td></tr>
+ − 440 <tr><td class="row2"><label for="w3c-vcss">CSS</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vcss')=='1') echo('CHECKED '); ?> id="w3c-vcss" name="w3c-vcss" /></td></tr>
+ − 441
+ − 442 <!-- DefectiveByDesign.org ad -->
+ − 443
+ − 444 <tr><th colspan="2">Defective By Design Anti-DRM button</th></tr>
+ − 445 <tr><td colspan="2" class="row3"><b>The Enano project is strongly against Digital Restrictions Management.</b> DRM removes the freedoms that every consumer should have: to freely copy and use digital media items they legally purchased to their own devices. Showing your opposition to DRM is as easy as checking the box below to place a link to <a href="http://www.defectivebydesign.org">DefectiveByDesign.org</a> on your sidebar.</td></tr>
+ − 446 <tr><td class="row1"><label for="dbdbutton">Help stop DRM by placing a link to DBD on the sidebar!</label></td><td class="row1"><input type="checkbox" name="dbdbutton" id="dbdbutton" <?php if(getConfig('dbd_button')=='1') echo('checked="checked" '); ?>/></td></tr>
+ − 447
+ − 448 <!-- Save button -->
+ − 449
+ − 450 <tr><th style="text-align: right" class="subhead" colspan="2"><input type=submit name=submit value="Save changes" /></th></tr>
+ − 451
+ − 452 </table>
+ − 453 </div>
+ − 454 </form>
+ − 455 <?php
+ − 456 }
+ − 457
+ − 458 function page_Admin_UploadConfig()
+ − 459 {
+ − 460 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 461 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 462 {
+ − 463 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 464 return;
+ − 465 }
+ − 466
+ − 467 if(isset($_POST['save']))
+ − 468 {
+ − 469 if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0');
+ − 470 if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0');
+ − 471 if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0');
+ − 472 if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0');
+ − 473 if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']);
+ − 474 else echo '<span style="color: red"><b>Warning:</b> the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.</span>';
+ − 475 $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']);
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 476 if ( $max_upload > 1048576 && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 477 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 478 echo '<div class="error-box">Wouldn\'t want the server DoS\'ed now. Stick to under a megabyte for the demo, please.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 479 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 480 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 481 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 482 setConfig('max_file_size', $max_upload.'');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 483 }
0
+ − 484 }
+ − 485 echo '<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post">';
+ − 486 ?>
+ − 487 <h3>File upload configuration</h3>
+ − 488 <p>Enano supports the ability to upload files to your website and store the files in the database. This enables you to embed images
+ − 489 and such into pages without manually writing the HTML. However, the upload feature can sometimes pose a risk to your site, as viruses
+ − 490 and executable files can sometimes be uploaded.</p>
+ − 491 <p><label><input type="checkbox" name="enable_uploads" <?php if(getConfig('enable_uploads')=='1') echo 'checked="checked"'; ?> /> <b>Enable file uploads</b></label></p>
+ − 492 <p>Maximum file size: <input name="max_file_size" onkeyup="if(!this.value.match(/^([0-9\.]+)$/ig)) this.value = this.value.substr(0,this.value.length-1);" value="<?php echo getConfig('max_file_size'); ?>" /> <select name="fs_units"><option value="1" selected="selected">bytes</option><option value="1024">KB</option><option value="1048576">MB</option></select></p>
+ − 493 <p>You can allow Enano to generate thumbnails of images automatically. This feature requires ImageMagick to work properly. If your server
+ − 494 does not have ImageMagick on it, Enano will simply make your users' browsers scale the images. In most cases this is fine, but if you
+ − 495 are uploading large (>100KB) images and embedding them inside of pages, you should try to enable ImageMagick because transferring these
+ − 496 large images many times can cost you quite a lot of bandwidth.</p>
+ − 497 <p><label><input type="checkbox" name="enable_imagemagick" <?php if(getConfig('enable_imagemagick')=='1') echo 'checked="checked"'; ?> /> Use ImageMagick to scale images</label><br />
+ − 498 Path to ImageMagick: <input type="text" name="imagemagick_path" value="<?php if(getConfig('imagemagick_path')) echo getConfig('imagemagick_path'); else echo '/usr/bin/convert'; ?>" /><br />
+ − 499 On Linux and Unix servers, the most likely options here are /usr/bin/convert and /usr/local/bin/convert. If you server runs Windows, then
+ − 500 ImageMagick is most likely to be C:\Windows\Convert.exe or C:\Windows\System32\Convert.exe.
+ − 501 </p>
+ − 502 <p>If you use ImageMagick to scale images, your server will be very busy constantly scaling images if your website is busy, and your site
+ − 503 may experience slowdowns. You can dramatically speed up this scaling process if you use a directory to cache thumbnail images.</p>
+ − 504 <p><b>Please note:</b> the cache/ directory on your server <u>must</u> be writable by the server. While this is not usually a problem on
+ − 505 Windows servers, most Linux/Unix servers will require you to CHMOD the cache/ directory to 777. See your FTP client's user guide for
+ − 506 more information on how to do this.<?php if(!is_writable(ENANO_ROOT.'/cache/')) echo ' <b>At present, it seems that the cache directory
+ − 507 is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p>
+ − 508 <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p>
+ − 509 <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious
+ − 510 changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option
+ − 511 enabled unless you have less than 250MB of MySQL database space.</p>
+ − 512 <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p>
+ − 513 <hr style="margin-left: 1em;" />
+ − 514 <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p>
+ − 515 <?php
+ − 516 echo '</form>';
+ − 517 }
+ − 518
+ − 519 function page_Admin_PluginManager() {
+ − 520 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 521 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 522 {
+ − 523 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 524 return;
+ − 525 }
+ − 526
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 527 if(isset($_GET['action']))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 528 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 529 switch($_GET['action'])
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 530 {
0
+ − 531 case "enable":
+ − 532 setConfig('plugin_'.$_GET['plugin'], '1');
+ − 533 break;
+ − 534 case "disable":
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 535 if ( defined('ENANO_DEMO_MODE') && strstr($_GET['plugin'], 'Demo') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 536 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 537 echo('<h3>Error disabling plugin</h3><p>The demo lockdown plugin cannot be disabled in demo mode.</p>');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 538 break;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 539 }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 540 if ( $_GET['plugin'] != 'SpecialAdmin.php' )
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 541 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 542 setConfig('plugin_'.$_GET['plugin'], '0');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 543 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 544 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 545 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 546 echo('<h3>Error disabling plugin</h3><p>The administration panel plugin cannot be disabled.</p>');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 547 }
0
+ − 548 break;
+ − 549 }
+ − 550 }
+ − 551 $dir = './plugins/';
+ − 552 $plugin_list = Array();
+ − 553 $system = Array();
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 554
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 555 if (is_dir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 556 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 557 if ($dh = opendir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 558 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 559 while (($file = readdir($dh)) !== false)
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 560 {
0
+ − 561 if(preg_match('#^(.*?)\.php$#is', $file) && $file != 'index.php')
+ − 562 {
+ − 563 if ( in_array($file, $plugins->system_plugins) )
+ − 564 {
+ − 565 $thelist =& $system;
+ − 566 continue;
+ − 567 }
+ − 568 else
+ − 569 {
+ − 570 $thelist =& $plugin_list;
+ − 571 }
+ − 572 $f = file_get_contents($dir . $file);
+ − 573 $f = explode("\n", $f);
+ − 574 $f = array_slice($f, 2, 7);
+ − 575 $f[0] = substr($f[0], 13, strlen($f[0]));
+ − 576 $f[1] = substr($f[1], 12, strlen($f[1]));
+ − 577 $f[2] = substr($f[2], 13, strlen($f[2]));
+ − 578 $f[3] = substr($f[3], 8, strlen($f[3]));
+ − 579 $f[4] = substr($f[4], 9, strlen($f[4]));
+ − 580 $f[5] = substr($f[5], 12, strlen($f[5]));
+ − 581 $thelist[$file] = Array();
+ − 582 $thelist[$file]['name'] = $f[0];
+ − 583 $thelist[$file]['uri'] = $f[1];
+ − 584 $thelist[$file]['desc'] = $f[2];
+ − 585 $thelist[$file]['auth'] = $f[3];
+ − 586 $thelist[$file]['vers'] = $f[4];
+ − 587 $thelist[$file]['aweb'] = $f[5];
+ − 588 }
+ − 589 }
+ − 590 closedir($dh);
+ − 591 }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 592 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 593 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 594 echo '<div class="error-box">The plugins/ directory could not be opened.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 595 return;
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 596 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 597 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 598 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 599 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 600 echo '<div class="error-box">The plugins/ directory is missing from your Enano installation.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 601 return;
0
+ − 602 }
+ − 603 echo('<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 604 <tr><th>Plugin filename</th><th>Plugin name</th><th>Description</th><th>Author</th><th>Version</th><th></th></tr>');
+ − 605 $plugin_files = array_keys($plugin_list);
+ − 606 $cls = 'row2';
+ − 607 for ( $i = 0; $i < sizeof($plugin_files); $i++ )
+ − 608 {
+ − 609 $cls = ( $cls == 'row2' ) ? 'row3' : 'row2';
+ − 610 echo '<tr>
+ − 611 <td class="'.$cls.'">'.$plugin_files[$i].'</td>
+ − 612 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['uri'].'">'.$plugin_list[$plugin_files[$i]]['name'].'</a></td>
+ − 613 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['desc'].'</td>
+ − 614 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['aweb'].'">'.$plugin_list[$plugin_files[$i]]['auth'].'</a></td>
+ − 615 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['vers'].'</td>
+ − 616 <td class="'.$cls.'">';
+ − 617 if ( getConfig('plugin_'.$plugin_files[$i]) == '1' )
+ − 618 {
+ − 619 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=disable&plugin='.$plugin_files[$i].'">Disable</a>';
+ − 620 }
+ − 621 else
+ − 622 {
+ − 623 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=enable&plugin='.$plugin_files[$i].'">Enable</a>';
+ − 624 }
+ − 625 echo '</td></tr>';
+ − 626 }
+ − 627 echo '</table></div>';
+ − 628 }
+ − 629
+ − 630 function page_Admin_UploadAllowedMimeTypes()
+ − 631 {
+ − 632 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 633 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 634 {
+ − 635 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 636 return;
+ − 637 }
+ − 638
+ − 639 global $mime_types, $mimetype_exps, $mimetype_extlist;
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 640 if(isset($_POST['save']) && !defined('ENANO_DEMO_MODE'))
0
+ − 641 {
+ − 642 $bits = '';
+ − 643 $keys = array_keys($mime_types);
+ − 644 foreach($keys as $i => $k)
+ − 645 {
+ − 646 if(isset($_POST['ext_'.$k])) $bits .= '1';
+ − 647 else $bits .= '0';
+ − 648 }
+ − 649 $bits = compress_bitfield($bits);
+ − 650 setConfig('allowed_mime_types', $bits);
+ − 651 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 652 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 653 else if ( isset($_POST['save']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 654 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 655 echo '<div class="error-box">Hmm, enabling executables, are we? Tsk tsk. I\'d love to know what\'s in that EXE file you want to upload. OK, maybe you didn\'t enable EXEs. But nevertheless, changing allowed filetypes is disabled in the demo.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 656 }
0
+ − 657 $allowed = fetch_allowed_extensions();
+ − 658 ?>
+ − 659 <h3>Allowed file types</h3>
+ − 660 <p>Using the form below, you can decide which file types are allowed to be uploaded to this site.</p>
+ − 661 <?php
+ − 662 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', (( isset($_GET['sqldbg'])) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 663 $c = -1;
+ − 664 $t = -1;
+ − 665 $cl = 'row1';
+ − 666 echo "\n".' <div class="tblholder">'."\n".' <table cellspacing="1" cellpadding="2" style="margin: 0; padding: 0;" border="0">'."\n".' <tr>'."\n ";
+ − 667 foreach($mime_types as $e => $m)
+ − 668 {
+ − 669 $c++;
+ − 670 $t++;
+ − 671 if($c == 3)
+ − 672 {
+ − 673 $c = 0;
+ − 674 $cl = ( $cl == 'row1' ) ? 'row2' : 'row1';
+ − 675 echo '</tr>'."\n".' <tr>'."\n ";
+ − 676 }
+ − 677 $seed = "extchkbx_{$e}_".md5(microtime() . mt_rand());
+ − 678 $chk = (!empty($allowed[$e])) ? ' checked="checked"' : '';
+ − 679 echo " <td class='$cl'>\n <label><input id='{$seed}' type='checkbox' name='ext_{$e}'{$chk} />.{$e}\n ({$m})</label>\n </td>\n ";
+ − 680 }
+ − 681 while($c < 2)
+ − 682 {
+ − 683 $c++;
+ − 684 echo " <td class='{$cl}'></td>\n ";
+ − 685 }
+ − 686 echo '<tr><th class="subhead" colspan="3"><input type="submit" name="save" value="Save changes" /></th></tr>';
+ − 687 echo '</tr>'."\n".' </table>'."\n".' </div>';
+ − 688 echo '</form>';
+ − 689 ?>
+ − 690 <?php
+ − 691 }
+ − 692
+ − 693 function page_Admin_Sidebar()
+ − 694 {
+ − 695 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 696 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 697 {
+ − 698 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 699 return;
+ − 700 }
+ − 701
+ − 702 ?>
+ − 703 <h2>Editing and managing the Enano sidebar</h2>
+ − 704 <p>The Enano sidebar is a versatile tool when scripted correctly. You don't have to be a programmer to enjoy the features the Sidebar
+ − 705 provides; however, editing the sidebar requires a small bit of programming knowledge and an understanding of Enano's system message
+ − 706 markup language.
+ − 707 </p>
+ − 708 <p>The Enano system markup language is somewhat similar to HTML, in that it uses tags (<example>like this</example>) for the
+ − 709 main syntax. However, Enano uses curly brackets ({ and }) as opposed to less-than and greater-than signs (< and >).</p>
+ − 710 <p>Programming the Enano sidebar requires the use of two tags: {slider} and {if}. The {slider} tag is used to create a new heading
+ − 711 on the sidebar, and all text enclosed in that tag will be collapsed when the heading is clicked. To specify the text on the heading,
+ − 712 use an equals sign (=) after the "slider" text. Then insert any links (they should be wiki-formatted) to internal Enano pages and
+ − 713 external sites.</p>
+ − 714 <p>So here is what the language for the default sidebar's "Navigation" heading looks like:</p>
+ − 715 <pre>{slider=Navigation}
+ − 716 [[Main Page|Home]]
+ − 717 [[Enano:Sidebar|Edit the sidebar]]
+ − 718 {/slider}</pre>
+ − 719 <p>Pretty simple, huh? Good, now we're going to learn another common aspect of Enano programming: conditionals. The {if} tag allows you
+ − 720 to decide whether a portion of the sidebar will be displayed based on a template variable. Currently the only available conditions are
+ − 721 "user_logged_in" and "auth_admin", but more will be added soon. To use a conditional, enter {if conditional_name}, and then the
+ − 722 wiki-formatted text that you want to be under that condition, and then close the tag with {/if}. In the same way, you can reverse the
+ − 723 effect with {!if}. With {!if}, the closing tag is still {/if}, so keep that in mind. An {else} tag will be supported soon.</p>
+ − 724 <p>Now it's time for some real fun: variables. All template variables can be accessed from the sidebar. A variable is simply the
+ − 725 variable name, prefixed by a dollar sign ($). Some of the most common variables are $USERNAME, $SITE_NAME, $SITE_DESC, and $PAGE_NAME.
+ − 726 The sidebar also has some special variables that it uses for some of its links. The logout link can be added with $LOGOUT_LINK, and
+ − 727 the "change theme" button can be added with $STYLE_LINK.</p>
+ − 728 <p>So here is the Enano markup for the portion of the sidebar that contains the user tools:</p>
+ − 729 <pre>{slider=$USERNAME}
+ − 730 [[User:$USERNAME|User page]]
+ − 731 [[Special:Contributions?user=$USERNAME|My Contributions]]
+ − 732 {if user_logged_in}
+ − 733 [[Special:Preferences|Preferences]]
+ − 734 $THEME_LINK
+ − 735 {/if}
+ − 736 {if auth_admin}
+ − 737 [[Special:Administration|Administration]]
+ − 738 {/if}
+ − 739 {if user_logged_in}
+ − 740 $LOGOUT_LINK
+ − 741 {/if}
+ − 742 {!if user_logged_in}
+ − 743 Create an account
+ − 744 Log in
+ − 745 {/if}
+ − 746 {/slider}</pre>
+ − 747 <?php
+ − 748 }
+ − 749
+ − 750 function page_Admin_UserManager() {
+ − 751 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 752 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 753 {
+ − 754 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 755 return;
+ − 756 }
+ − 757
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 758 if(isset($_POST['go']))
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 759 {
0
+ − 760 // We need the user ID before we can do anything
+ − 761 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_POST['username']) . '\'');
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 762 if ( !$q )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 763 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 764 die('Error selecting user ID: '.mysql_error());
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 765 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 766 if ( $db->numrows() < 1 )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 767 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 768 echo('User does not exist, please enter another username.');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 769 return;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 770 }
0
+ − 771 $r = $db->fetchrow();
+ − 772 $db->free_result();
+ − 773 if(isset($_POST['save']))
+ − 774 {
+ − 775 $_POST['level'] = intval($_POST['level']);
+ − 776
+ − 777 $new_level = $_POST['level'];
+ − 778 $old_level = intval($r['user_level']);
+ − 779
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 780 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 781 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 782 echo '<div class="error-box">You cannot delete or modify user accounts in demo mode - they are cleaned up once every two hours.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 783 $re = Array('permission denied');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 784 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 785 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 786 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 787 $re = $session->update_user((int)$r['user_id'], $_POST['new_username'], false, $_POST['new_pass'], $_POST['email'], $_POST['real_name'], false, $_POST['level']);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 788 }
0
+ − 789
+ − 790 if($re == 'success')
+ − 791 {
+ − 792
+ − 793 if ( $new_level != $old_level )
+ − 794 {
+ − 795 $user_id = intval($r['user_id']);
+ − 796 // We need to update group memberships
+ − 797 if ( $old_level == USER_LEVEL_ADMIN )
+ − 798 {
+ − 799 $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);
+ − 800 }
+ − 801 else if ( $old_level == USER_LEVEL_MOD )
+ − 802 {
+ − 803 $session->remove_user_from_group($user_id, GROUP_ID_MOD);
+ − 804 }
+ − 805
+ − 806 if ( $new_level == USER_LEVEL_ADMIN )
+ − 807 {
+ − 808 $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);
+ − 809 }
+ − 810 else if ( $new_level == USER_LEVEL_MOD )
+ − 811 {
+ − 812 $session->add_user_to_group($user_id, GROUP_ID_MOD, false);
+ − 813 }
+ − 814 }
+ − 815
+ − 816 echo('<div class="info-box">Your changes have been saved.</div>');
+ − 817 }
+ − 818 else
+ − 819 {
+ − 820 echo('<div class="error-box">Error saving changes: '.implode('<br />', $re).'</div>');
+ − 821 }
+ − 822 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['username']).'\'');
+ − 823 if ( !$q )
+ − 824 {
+ − 825 die('Error selecting user ID: '.mysql_error());
+ − 826 }
+ − 827 if($db->numrows($q) < 1)
+ − 828 {
+ − 829 die('User does not exist, please enter another username.');
+ − 830 }
+ − 831 $r = mysql_fetch_object($q);
+ − 832 $db->free_result();
+ − 833 }
+ − 834 elseif(isset($_POST['deleteme']) && isset($_POST['delete_conf']))
+ − 835 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 836 if ( defined('ENANO_DEMO_MODE') )
0
+ − 837 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 838 echo '<div class="error-box">You cannot delete or modify user accounts in demo mode - they are cleaned up once every two hours.</div>';
0
+ − 839 }
+ − 840 else
+ − 841 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 842 $q = $db->sql_query('DELETE FROM users WHERE user_id='.$r['user_id'].';');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 843 if($q)
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 844 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 845 echo '<div class="error-box">The user account "'.$r['username'].'" was deleted.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 846 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 847 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 848 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 849 echo '<div class="error-box">The user account "'.$r['username'].'" could not be deleted due to a database error.<br /><br />'.$db->get_error().'</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 850 }
0
+ − 851 }
+ − 852 }
+ − 853 else
+ − 854 {
+ − 855 echo('
+ − 856 <h3>Edit User Info</h3>
+ − 857 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 858 <table border="0" style="margin-left: 0.2in;">
+ − 859 <tr><td>Username:</td><td><input type="text" name="new_username" value="'.$r['username'].'" /></td></tr>
+ − 860 <tr><td>New Password:</td><td><input type="password" name="new_pass" /></td></tr>
+ − 861 <tr><td>E-mail:</td><td><input type="text" name="email" value="'.$r['email'].'" /></td></tr>
+ − 862 <tr><td>Real Name:</td><td><input type="text" name="real_name" value="'.$r['real_name'].'" /></td></tr>
+ − 863 <tr><td>User level:</td><td><select name="level"><option '); if($r['user_level']==USER_LEVEL_CHPREF) echo('SELECTED'); echo(' value="'.USER_LEVEL_CHPREF.'">Regular User</option><option '); if($r['user_level']==USER_LEVEL_MOD) echo('SELECTED'); echo(' value="'.USER_LEVEL_MOD.'">Moderator</option><option '); if($r['user_level']==USER_LEVEL_ADMIN) echo('SELECTED'); echo(' value="'.USER_LEVEL_ADMIN.'">Administrator</option></select></td></tr>
+ − 864 <tr><td>Delete user:</td><td><input type="hidden" name="go" /><input type="hidden" name="username" value="'.$r['username'].'" /><input onclick="return confirm(\'This is your last warning.\n\nAre you sure you want to delete this user account? Even if you delete this user account, the username will be shown in page edit history, comments, and other areas of the site.\n\nDeleting a user account CANNOT BE UNDONE and should only be done in extreme circumstances.\n\nIf the user has violated the site policy, deleting the account will not prevent him from using the site, for that you need to add a new ban rule.\n\nContinue deleting this user account?\')" type="submit" name="deleteme" value="Delete this user" style="color: red;" /> <label><input type="checkbox" name="delete_conf" /> I\'m absolutely sure</label>
+ − 865 <tr><td align="center" colspan="2">
+ − 866 <input type="submit" name="save" value="Save Changes" /></td></tr>
+ − 867 </table>
+ − 868 </form>
+ − 869 ');
+ − 870 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 871 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 872 else if(isset($_POST['clearsessions']))
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 873 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 874 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 875 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 876 echo '<div class="error-box">Sorry Charlie, no can do. You might mess up other people logged into the demo site.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 877 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 878 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 879 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 880 // Get the current session information so the user doesn't get logged out
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 881 $aes = new AESCrypt();
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 882 $sk = md5($session->sid_super);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 883 $qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 884 if(!$qb) die('Error selecting session key info block B: '.$db->get_error());
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 885 if($db->numrows($qb) < 1) die('Error: cannot read admin session info block B, aborting table clear process');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 886 $qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 887 if(!$qa) die('Error selecting session key info block A: '.$db->get_error());
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 888 if($db->numrows($qa) < 1) die('Error: cannot read user session info block A, aborting table clear process');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 889 $ra = mysql_fetch_object($qa);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 890 $rb = mysql_fetch_object($qb);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 891 $db->free_result($qa);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 892 $db->free_result($qb);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 893 $db->sql_query('DELETE FROM '.table_prefix.'session_keys;');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 894 $db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra->session_key.'\', \''.$ra->salt.'\', \''.$session->user_id.'\', \''.$ra->auth_level.'\', \''.$ra->source_ip.'\', '.$ra->time.' ),( \''.$rb->session_key.'\', \''.$rb->salt.'\', \''.$session->user_id.'\', \''.$rb->auth_level.'\', \''.$rb->source_ip.'\', '.$rb->time.' )');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 895 echo('
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 896 <div class="info-box">The session key table has been cleared. Your database should be a little bit smaller now.</div>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 897 ');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 898 }
0
+ − 899 }
+ − 900 echo('
+ − 901 <h3>User Management</h3>
+ − 902 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;">
+ − 903 <p>Username: '.$template->username_field('username').' <input type="submit" name="go" value="Go" /></p>
+ − 904 <h3>Clear session keys table</h3>
+ − 905 <p>It\'s a good idea to clean out your session keys table every once in a while, since this helps to reduce database size. During this process you will be logged off and (hopefully) logged back on automatically. The side effects of this include all users except you being logged off.</p>
+ − 906 <p><input type="submit" name="clearsessions" value="Clear session keys table" /></p>
+ − 907 </form>
+ − 908 ');
+ − 909 if(isset($_GET['action']) && isset($_GET['user']))
+ − 910 {
+ − 911 switch($_GET['action'])
+ − 912 {
+ − 913 case "activate":
+ − 914 $e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');
+ − 915 if($e)
+ − 916 {
+ − 917 $row = $db->fetchrow();
+ − 918 $db->free_result();
+ − 919 if($session->activate_account($_GET['user'], $row['activation_key'])) { echo '<div class="info-box">The user account "'.$_GET['user'].'" has been activated.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 920 else echo '<div class="warning-box">The user account "'.$_GET['user'].'" has NOT been activated, possibly because the account is already active.</div>';
+ − 921 } else echo '<div class="error-box">Error activating account: '.mysql_error().'</div>';
+ − 922 break;
+ − 923 case "sendemail":
+ − 924 if($session->send_activation_mail($_GET['user'])) { echo '<div class="info-box">The user "'.$_GET['user'].'" has been sent an e-mail with an activation link.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 925 else echo '<div class="error-box">The user account "'.$_GET['user'].'" has not been activated, probably because of a bad SMTP configuration.</div>';
+ − 926 break;
+ − 927 case "deny":
+ − 928 $e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($_GET['user']) . '\';');
+ − 929 if(!$e) echo '<div class="error-box">Error during row deletion: '.mysql_error().'</div>';
+ − 930 else echo '<div class="info-box">All activation requests for the user "'.$_GET['user'].'" have been deleted.</div>';
+ − 931 break;
+ − 932 }
+ − 933 }
+ − 934 $q = $db->sql_query('SELECT log_type, action, time_id, date_string, author, edit_summary FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' ORDER BY time_id DESC;');
+ − 935 if($q)
+ − 936 {
+ − 937 if($db->numrows() > 0)
+ − 938 {
+ − 939 $n = $db->numrows();
+ − 940 if($n == 1) $s = $n . ' user is';
+ − 941 else $s = $n . ' users are';
+ − 942 echo '<h3>'.$s . ' awaiting account activation</h3>';
+ − 943 echo '<div class="tblholder">
+ − 944 <table border="0" cellspacing="1" cellpadding="4" width="100%">
+ − 945 <tr><th>Date of request</th><th>Requested by</th><th>Requested for</th><th colspan="3">Actions</th></tr>';
+ − 946 $cls = 'row2';
+ − 947 while($row = $db->fetchrow())
+ − 948 {
+ − 949 if($cls == 'row2') $cls = 'row1';
+ − 950 else $cls = 'row2';
+ − 951 echo '<tr><td class="'.$cls.'">'.date('F d, Y h:i a', $row['time_id']).'</td><td class="'.$cls.'">'.$row['author'].'</td><td class="'.$cls.'">'.$row['edit_summary'].'</td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=activate&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Activate now</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=sendemail&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Send activation e-mail</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=deny&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Deny request</a></td></tr>';
+ − 952 }
+ − 953 echo '</table>';
+ − 954 }
+ − 955 $db->free_result();
+ − 956 }
+ − 957 }
+ − 958
+ − 959 function page_Admin_GroupManager()
+ − 960 {
+ − 961 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 962 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 963 {
+ − 964 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 965 return;
+ − 966 }
+ − 967
+ − 968 if(isset($_POST['do_create_stage1']))
+ − 969 {
+ − 970 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 971 {
+ − 972 echo '<p>The group name you chose is invalid.</p>';
+ − 973 return;
+ − 974 }
+ − 975 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 976 echo '<div class="tblholder">
+ − 977 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 978 <tr><th colspan="2">Creating group: '.$_POST['create_group_name'].'</th></tr>
+ − 979 <tr>
+ − 980 <td class="row1">Group moderator</td><td class="row1">' . $template->username_field('group_mod') . '</td>
+ − 981 </tr>
+ − 982 <tr><td class="row2">Group status</td><td class="row2">
+ − 983 <label><input type="radio" name="group_status" value="'.GROUP_CLOSED.'" checked="checked" /> Closed to new members</label><br />
+ − 984 <label><input type="radio" name="group_status" value="'.GROUP_REQUEST.'" /> Members can ask to be added</label><br />
+ − 985 <label><input type="radio" name="group_status" value="'.GROUP_OPEN.'" /> Members can join freely</label><br />
+ − 986 <label><input type="radio" name="group_status" value="'.GROUP_HIDDEN.'" /> Group is hidden</label>
+ − 987 </td></tr>
+ − 988 <tr>
+ − 989 <th class="subhead" colspan="2">
+ − 990 <input type="hidden" name="create_group_name" value="'.$_POST['create_group_name'].'" />
+ − 991 <input type="submit" name="do_create_stage2" value="Create group" />
+ − 992 </th>
+ − 993 </tr>
+ − 994 </table>
+ − 995 </div>';
+ − 996 echo '</form>';
+ − 997 return;
+ − 998 }
+ − 999 elseif(isset($_POST['do_create_stage2']))
+ − 1000 {
+ − 1001 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 1002 {
+ − 1003 echo '<p>The group name you chose is invalid.</p>';
+ − 1004 return;
+ − 1005 }
+ − 1006 if(!in_array(intval($_POST['group_status']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST)))
+ − 1007 {
+ − 1008 echo '<p>Hacking attempt</p>';
+ − 1009 return;
+ − 1010 }
+ − 1011 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 1012 if(!$e)
+ − 1013 {
+ − 1014 echo $db->get_error();
+ − 1015 return;
+ − 1016 }
+ − 1017 if($db->numrows() > 0)
+ − 1018 {
+ − 1019 echo '<p>The group name you entered already exists.</p>';
+ − 1020 return;
+ − 1021 }
+ − 1022 $db->free_result();
+ − 1023 $q = $db->sql_query('INSERT INTO '.table_prefix.'groups(group_name,group_type) VALUES( \''.$db->escape($_POST['create_group_name']).'\', ' . intval($_POST['group_status']) . ' )');
+ − 1024 if(!$q)
+ − 1025 {
+ − 1026 echo $db->get_error();
+ − 1027 return;
+ − 1028 }
+ − 1029 $e = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['group_mod']).'\';');
+ − 1030 if(!$e)
+ − 1031 {
+ − 1032 echo $db->get_error();
+ − 1033 return;
+ − 1034 }
+ − 1035 if($db->numrows() < 1)
+ − 1036 {
+ − 1037 echo '<p>The username you entered could not be found.</p>';
+ − 1038 return;
+ − 1039 }
+ − 1040 $row = $db->fetchrow();
+ − 1041 $id = $row['user_id'];
+ − 1042 $db->free_result();
+ − 1043 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 1044 if(!$e)
+ − 1045 {
+ − 1046 echo $db->get_error();
+ − 1047 return;
+ − 1048 }
+ − 1049 if($db->numrows() < 1)
+ − 1050 {
+ − 1051 echo '<p>The group ID could not be looked up.</p>';
+ − 1052 return;
+ − 1053 }
+ − 1054 $row = $db->fetchrow();
+ − 1055 $gid = $row['group_id'];
+ − 1056 $db->free_result();
+ − 1057 $e = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.$gid.', '.$id.', 1);');
+ − 1058 if(!$e)
+ − 1059 {
+ − 1060 echo $db->get_error();
+ − 1061 return;
+ − 1062 }
+ − 1063 echo "<div class='info-box'>
+ − 1064 <b>Information</b><br />
+ − 1065 The group {$_POST['create_group_name']} has been created successfully.
+ − 1066 </div>";
+ − 1067 }
+ − 1068 if(isset($_POST['do_edit']) || isset($_POST['edit_do']))
+ − 1069 {
+ − 1070 // Fetch the group name
+ − 1071 $q = $db->sql_query('SELECT group_name,system_group FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1072 if(!$q)
+ − 1073 {
+ − 1074 echo $db->get_error();
+ − 1075 return;
+ − 1076 }
+ − 1077 if($db->numrows() < 1)
+ − 1078 {
+ − 1079 echo '<p>Error: couldn\'t look up group name</p>';
+ − 1080 }
+ − 1081 $row = $db->fetchrow();
+ − 1082 $name = $row['group_name'];
+ − 1083 $db->free_result();
+ − 1084 if(isset($_POST['edit_do']))
+ − 1085 {
+ − 1086 if(isset($_POST['edit_do']['del_group']))
+ − 1087 {
+ − 1088 if ( $row['system_group'] == 1 )
+ − 1089 {
+ − 1090 echo '<div class="error-box">The group "' . $name . '" could not be deleted because it is a system group required for site functionality.</div>';
+ − 1091 }
+ − 1092 else
+ − 1093 {
+ − 1094 $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1095 if(!$q)
+ − 1096 {
+ − 1097 echo $db->get_error();
+ − 1098 return;
+ − 1099 }
+ − 1100 $q = $db->sql_query('DELETE FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1101 if(!$q)
+ − 1102 {
+ − 1103 echo $db->get_error();
+ − 1104 return;
+ − 1105 }
+ − 1106 echo '<div class="info-box">The group "'.$name.'" has been deleted. Return to the <a href="javascript:ajaxPage(\'Admin:GroupManager\');">group manager</a>.</div>';
+ − 1107 return;
+ − 1108 }
+ − 1109 }
+ − 1110 if(isset($_POST['edit_do']['save_name']))
+ − 1111 {
+ − 1112 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['group_name']))
+ − 1113 {
+ − 1114 echo '<p>The group name you chose is invalid.</p>';
+ − 1115 return;
+ − 1116 }
+ − 1117 $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_name=\''.$db->escape($_POST['group_name']).'\'
+ − 1118 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1119 if(!$q)
+ − 1120 {
+ − 1121 echo $db->get_error();
+ − 1122 return;
+ − 1123 }
+ − 1124 else
+ − 1125 {
+ − 1126 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1127 The group name has been updated.
+ − 1128 </div>';
+ − 1129 }
+ − 1130 $name = $_POST['group_name'];
+ − 1131
+ − 1132 }
+ − 1133 $q = $db->sql_query('SELECT member_id FROM '.table_prefix.'group_members
+ − 1134 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1135 if(!$q)
+ − 1136 {
+ − 1137 echo $db->get_error();
+ − 1138 return;
+ − 1139 }
+ − 1140 if($db->numrows() > 0)
+ − 1141 {
+ − 1142 while($row = $db->fetchrow($q))
+ − 1143 {
+ − 1144 if(isset($_POST['edit_do']['del_' . $row['member_id']]))
+ − 1145 {
+ − 1146 $e = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id='.$row['member_id']);
+ − 1147 if(!$e)
+ − 1148 {
+ − 1149 echo $db->get_error();
+ − 1150 return;
+ − 1151 }
+ − 1152 }
+ − 1153 }
+ − 1154 }
+ − 1155 $db->free_result();
+ − 1156 if(isset($_POST['edit_do']['add_member']))
+ − 1157 {
+ − 1158 $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['edit_add_username']).'\';');
+ − 1159 if(!$q)
+ − 1160 {
+ − 1161 echo $db->get_error();
+ − 1162 return;
+ − 1163 }
+ − 1164 if($db->numrows() > 0)
+ − 1165 {
+ − 1166 $row = $db->fetchrow();
+ − 1167 $user_id = $row['user_id'];
+ − 1168 $is_mod = ( isset( $_POST['add_mod'] ) ) ? '1' : '0';
+ − 1169 $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.intval($_POST['group_edit_id']).','.$user_id.','.$is_mod.');');
+ − 1170 if(!$q)
+ − 1171 {
+ − 1172 echo $db->get_error();
+ − 1173 return;
+ − 1174 }
+ − 1175 else
+ − 1176 {
+ − 1177 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1178 The user "'.$_POST['edit_add_username'].'" has been added to this usergroup.
+ − 1179 </div>';
+ − 1180 }
+ − 1181 }
+ − 1182 else
+ − 1183 echo '<div class="warning-box"><b>The user "'.$_POST['edit_add_username'].'" could not be added.</b><br />This username does not exist.</div>';
+ − 1184 }
+ − 1185 }
+ − 1186 $sg_disabled = ( $row['system_group'] == 1 ) ? ' value="Can\'t delete system group" disabled="disabled" style="color: #FF9773" ' : ' value="Delete this group" style="color: #FF3713" ';
+ − 1187 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1188 echo '<div class="tblholder">
+ − 1189 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1190 <tr><th>Edit group name</th></tr>
+ − 1191 <tr>
+ − 1192 <td class="row1">
+ − 1193 Group name: <input type="text" name="group_name" value="'.$name.'" />
+ − 1194 </td>
+ − 1195 </tr>
+ − 1196 <tr>
+ − 1197 <th class="subhead">
+ − 1198 <input type="submit" name="edit_do[save_name]" value="Save name" />
+ − 1199 <input type="submit" name="edit_do[del_group]" '.$sg_disabled.' />
+ − 1200 </th>
+ − 1201 </tr>
+ − 1202 </table>
+ − 1203 </div>
+ − 1204 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1205 echo '</form>';
+ − 1206 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1207 echo '<div class="tblholder">
+ − 1208 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1209 <tr><th colspan="3">Edit group members</th></tr>';
+ − 1210 $q = $db->sql_query('SELECT m.member_id,m.is_mod,u.username FROM '.table_prefix.'group_members AS m
+ − 1211 LEFT JOIN '.table_prefix.'users AS u
+ − 1212 ON u.user_id=m.user_id
+ − 1213 WHERE m.group_id='.intval($_POST['group_edit_id']).'
+ − 1214 ORDER BY m.is_mod DESC, u.username ASC;');
+ − 1215 if(!$q)
+ − 1216 {
+ − 1217 echo $db->get_error();
+ − 1218 return;
+ − 1219 }
+ − 1220 if($db->numrows() < 1)
+ − 1221 {
+ − 1222 echo '<tr><td colspan="3" class="row1">This group has no members.</td></tr>';
+ − 1223 }
+ − 1224 else
+ − 1225 {
+ − 1226 $cls = 'row2';
+ − 1227 while($row = $db->fetchrow())
+ − 1228 {
+ − 1229 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 1230 $mod = ( $row['is_mod'] == 1 ) ? 'Mod' : '';
+ − 1231 echo '<tr>
+ − 1232 <td class="'.$cls.'" style="width: 100%;">
+ − 1233 ' . $row['username'] . '
+ − 1234 </td>
+ − 1235 <td class="'.$cls.'">
+ − 1236 '.$mod.'
+ − 1237 </td>
+ − 1238 <td class="'.$cls.'">
+ − 1239 <input type="submit" name="edit_do[del_'.$row['member_id'].']" value="Remove member" />
+ − 1240 </td>
+ − 1241 </tr>';
+ − 1242 }
+ − 1243 }
+ − 1244 $db->free_result();
+ − 1245 echo '</table>
+ − 1246 </div>
+ − 1247 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1248 echo '</form>';
+ − 1249 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1250 echo '<div class="tblholder">
+ − 1251 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1252 <tr>
+ − 1253 <th>Add a new member</th>
+ − 1254 </tr>
+ − 1255 <tr>
+ − 1256 <td class="row1">
+ − 1257 Username: ' . $template->username_field('edit_add_username') . '
+ − 1258 </td>
+ − 1259 </tr>
+ − 1260 <tr>
+ − 1261 <td class="row2">
+ − 1262 <label><input type="checkbox" name="add_mod" /> Is a group moderator</label> (can add and delete other members)
+ − 1263 </td>
+ − 1264 </tr>
+ − 1265 <tr>
+ − 1266 <th class="subhead">
+ − 1267 <input type="submit" name="edit_do[add_member]" value="Add user to group" />
+ − 1268 </th>
+ − 1269 </tr>
+ − 1270 </table>
+ − 1271 </div>
+ − 1272 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1273 echo '</form>';
+ − 1274 return;
+ − 1275 }
+ − 1276 echo '<h3>Manage Usergroups</h3>';
+ − 1277 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1278 $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 1279 if(!$q)
+ − 1280 {
+ − 1281 echo $db->get_error();
+ − 1282 }
+ − 1283 else
+ − 1284 {
+ − 1285 echo '<div class="tblholder">
+ − 1286 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1287 <tr>
+ − 1288 <th>Edit an existing group</th>
+ − 1289 </tr>';
+ − 1290 echo '<tr><td class="row2"><select name="group_edit_id">';
+ − 1291 while ( $row = $db->fetchrow() )
+ − 1292 {
+ − 1293 if ( $row['group_name'] != 'Everyone' )
+ − 1294 {
+ − 1295 echo '<option value="' . $row['group_id'] . '">' . htmlspecialchars( $row['group_name'] ) . '</option>';
+ − 1296 }
+ − 1297 }
+ − 1298 $db->free_result();
+ − 1299 echo '</select></td></tr>';
+ − 1300 echo '<tr><td class="row1" style="text-align: center;"><input type="submit" name="do_edit" value="Edit group" /></td></tr>
+ − 1301 </table>
+ − 1302 </div>
+ − 1303 </form><br />';
+ − 1304 }
+ − 1305 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1306 echo '<div class="tblholder">
+ − 1307 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1308 <tr>
+ − 1309 <th colspan="2">Create a new group</th>
+ − 1310 </tr>';
+ − 1311 echo '<tr><td class="row2">Group name:</td><td class="row2"><input type="text" name="create_group_name" /></td></tr>';
+ − 1312 echo '<tr><td colspan="2" class="row1" style="text-align: center;"><input type="submit" name="do_create_stage1" value="Continue >" /></td></tr>
+ − 1313 </table>
+ − 1314 </div>';
+ − 1315 echo '</form>';
+ − 1316 }
+ − 1317
+ − 1318 function page_Admin_PageManager()
+ − 1319 {
+ − 1320 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1321 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1322 {
+ − 1323 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1324 return;
+ − 1325 }
+ − 1326
+ − 1327
+ − 1328 echo '<h2>Page management</h2>';
+ − 1329
+ − 1330 if(isset($_POST['search']) || isset($_POST['select']) || ( isset($_GET['source']) && $_GET['source'] == 'ajax' )) {
+ − 1331 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1332 $source = ( isset($_GET['source']) ) ? $_GET['source'] : false;
+ − 1333 if ( $source == 'ajax' )
+ − 1334 {
+ − 1335 $_POST['search'] = true;
+ − 1336 $_POST['page_url'] = $_GET['page_id'];
+ − 1337 }
+ − 1338 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1339 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1340 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1341 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1342 $k = array_keys($paths->nslist);
+ − 1343 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1344 {
+ − 1345 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1346 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1347 {
+ − 1348 $ns = $k[$i];
+ − 1349 $page_id = substr($pid, $ln, strlen($pid));
+ − 1350 }
+ − 1351 }
+ − 1352 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1353 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1354 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1355 {
+ − 1356 if(!isset($final_pid))
+ − 1357 {
+ − 1358 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1359 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1360 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1361 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1362 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1363 }
+ − 1364 }
+ − 1365 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1366 $_POST['namespace'] = $ns;
+ − 1367 $_POST['old_namespace'] = $ns;
+ − 1368 $_POST['page_id'] = $final_pid;
+ − 1369 $_POST['old_page_id'] = $final_pid;
+ − 1370 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1371 }
+ − 1372
+ − 1373 if(isset($_POST['page_id']) && isset($_POST['namespace']) && !isset($_POST['cancel']))
+ − 1374 {
+ − 1375 $cpage = $paths->pages[$paths->nslist[$_POST['namespace']].$_POST['old_page_id']];
+ − 1376 if(isset($_POST['submit']))
+ − 1377 {
+ − 1378 // Create a list of things to update
+ − 1379 $page_info = Array(
+ − 1380 'name'=>$_POST['name'],
+ − 1381 'urlname'=>$_POST['page_id'],
+ − 1382 'namespace'=>$_POST['namespace'],
+ − 1383 'special'=>isset($_POST['special']) ? '1' : '0',
+ − 1384 'visible'=>isset($_POST['visible']) ? '1' : '0',
+ − 1385 'comments_on'=>isset($_POST['comments_on']) ? '1' : '0',
+ − 1386 'protected'=>isset($_POST['protected']) ? '1' : '0'
+ − 1387 );
+ − 1388 // Build the query
+ − 1389 $q = 'UPDATE '.table_prefix.'pages SET ';
+ − 1390 $k = array_keys($page_info);
+ − 1391 foreach($k as $c)
+ − 1392 {
+ − 1393 $q .= $c.'=\''.$db->escape($page_info[$c]).'\',';
+ − 1394 }
+ − 1395 $q = substr($q, 0, strlen($q)-1);
+ − 1396 // Build the WHERE statements
+ − 1397 $q .= ' WHERE ';
+ − 1398 $k = array_keys($cpage);
+ − 1399 foreach($k as $c)
+ − 1400 {
+ − 1401 if($c != 'urlname_nons' && $c != 'urlname' && $c != 'really_protected') $q .= $c.'=\''.$cpage[$c].'\' AND ';
+ − 1402 elseif($c == 'urlname') $q .= $c.'=\''.$cpage['urlname_nons'].'\' AND ';
+ − 1403 }
+ − 1404 $q = substr($q, 0, strlen($q)-5) . ';';
+ − 1405 // Send the completed query to MySQL
+ − 1406 $e = $db->sql_query($q);
+ − 1407 if(!$e) $db->_die('The page data could not be updated.');
+ − 1408 // Update any additional tables
+ − 1409 $q = Array(
+ − 1410 'UPDATE '.table_prefix.'categories SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1411 'UPDATE '.table_prefix.'comments SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1412 'UPDATE '.table_prefix.'logs SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1413 'UPDATE '.table_prefix.'page_text SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1414 );
+ − 1415 foreach($q as $cq)
+ − 1416 {
+ − 1417 $e = $db->sql_query($cq);
+ − 1418 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1419 }
+ − 1420 // Update $cpage
+ − 1421 $cpage = $page_info;
+ − 1422 $cpage['urlname_nons'] = $cpage['urlname'];
+ − 1423 $cpage['urlname'] = $paths->nslist[$cpage['namespace']].$cpage['urlname'];
+ − 1424 $_POST['old_page_id'] = $page_info['urlname'];
+ − 1425 $_POST['old_namespace'] = $page_info['namespace'];
+ − 1426 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 1427 } elseif(isset($_POST['delete'])) {
+ − 1428 $q = Array(
+ − 1429 'DELETE FROM '.table_prefix.'categories WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1430 'DELETE FROM '.table_prefix.'comments WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1431 'DELETE FROM '.table_prefix.'logs WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1432 'DELETE FROM '.table_prefix.'page_text WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1433 );
+ − 1434 foreach($q as $cq)
+ − 1435 {
+ − 1436 $e = $db->sql_query($cq);
+ − 1437 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1438 }
+ − 1439
+ − 1440 if(!$db->sql_query(
+ − 1441 'DELETE FROM '.table_prefix.'pages WHERE urlname="'.$db->escape($_POST['old_page_id']).'" AND namespace="'.$db->escape($_POST['old_namespace']).'";'
+ − 1442 )) $db->_die('The page could not be deleted.');
+ − 1443 echo '<div class="info-box">This page has been deleted.</p><p><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'PageManager\');">Return to Page manager</a><br /><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'Home\');">Admin home</a></div>';
+ − 1444 return;
+ − 1445 }
+ − 1446 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration'.htmlspecialchars(urlSeparator).(( isset($_GET['sqldbg']) ) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 1447 ?>
+ − 1448 <h3>Modify page: <?php echo $_POST['name']; ?></h3>
+ − 1449 <table border="0">
+ − 1450 <tr><td>Namespace:</td><td><select name="namespace"><?php $nm = array_keys($paths->nslist); foreach($nm as $ns) { if($ns != 'Special' && $ns != 'Admin') { echo '<option '; if($_POST['namespace']==$ns) echo 'selected="selected" '; echo 'value="'.$ns.'">'; if($paths->nslist[$ns] == '') echo '[No prefix]'; else echo $paths->nslist[$ns]; echo '</option>'; } } ?></select></td></tr>
+ − 1451 <tr><td>Page title:</td><td><input type="text" name="name" value="<?php echo $cpage['name']; ?>" /></td></tr>
+ − 1452 <tr><td>Page URL string:<br /><small>No spaces, and don't enter the namespace prefix (e.g. User:).<br />Changing this value is usually not a good idea, especially for templates and project pages.</small></td><td><input type="text" name="page_id" value="<?php echo $cpage['urlname_nons']; ?>" /></td></tr>
+ − 1453 <tr><td></td><td><input <?php if($cpage['comments_on']) echo 'checked="checked"'; ?> name="comments_on" type="checkbox" id="cmt" /> <label for="cmt">Enable comments for this page</label></td></tr>
+ − 1454 <tr><td></td><td><input <?php if($cpage['special']) echo 'checked="checked"'; ?> name="special" type="checkbox" id="spc" /> <label for="spc">Bypass the template engine for this page</label><br /><small>This option enables you to use your own HTML headers and other code. It is recommended that only advanced users enable this feature. As with other Enano pages, you may use PHP code in your pages, meaning you can use Enano's API on the page.</small></td></tr>
+ − 1455 <tr><td></td><td><input <?php if($cpage['visible']) echo 'checked="checked"'; ?> name="visible" type="checkbox" id="vis" /> <label for="vis">Allow this page to be shown in page lists</label><br /><small>Unchecking this checkbox prevents the page for being indexed for searching. The index is rebuilt each time a page is saved, and you can force an index rebuild by going to the page <?php echo $paths->nslist['Special']; ?>SearchRebuild.</small></td></tr>
+ − 1456 <tr><td></td><td><input <?php if($cpage['protected']) echo 'checked="checked"'; ?> name="protected" type="checkbox" id="prt" /> <label for="prt">Prevent non-administrators from editing this page</label><br /><small>This option only has an effect when Wiki Mode is enabled.</small></td></tr>
+ − 1457 <tr><td></td><td><input type="submit" name="delete" value="Delete page" style="color: red" onclick="return confirm('Do you REALLY want to delete this page?')" /></td></tr>
+ − 1458 <tr><td colspan="2" style="text-align: center;"><hr /></td></tr>
+ − 1459 <tr><td colspan="2" style="text-align: right;">
+ − 1460 <input type="hidden" name="old_page_id" value="<?php echo $_POST['old_page_id']; ?>" />
+ − 1461 <input type="hidden" name="old_namespace" value="<?php echo $_POST['old_namespace']; ?>" />
+ − 1462 <input type="Submit" name="submit" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="cancel" value="Cancel changes" /></td></tr>
+ − 1463 </table>
+ − 1464 <?php
+ − 1465 echo '</form>';
+ − 1466 } else {
+ − 1467 echo '<h3>Please select a page</h3>';
+ − 1468 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1469 ?>
+ − 1470 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1471 <p>Select page title from a list: <select name="page_force_url">
+ − 1472 <?php
+ − 1473 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1474 {
+ − 1475 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1476 }
+ − 1477 ?>
+ − 1478 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1479 <?php
+ − 1480 echo '</form>';
+ − 1481
+ − 1482 }
+ − 1483 }
+ − 1484
+ − 1485 function page_Admin_PageEditor()
+ − 1486 {
+ − 1487 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1488 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1489 {
+ − 1490 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1491 return;
+ − 1492 }
+ − 1493
+ − 1494
+ − 1495 echo '<h2>Edit page content</h2>';
+ − 1496
+ − 1497 if(isset($_POST['search']) || isset($_POST['select'])) {
+ − 1498 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1499 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1500 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1501 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1502 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1503 $k = array_keys($paths->nslist);
+ − 1504 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1505 {
+ − 1506 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1507 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1508 {
+ − 1509 $ns = $k[$i];
+ − 1510 $page_id = substr($pid, $ln, strlen($pid));
+ − 1511 }
+ − 1512 }
+ − 1513 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1514 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1515 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1516 {
+ − 1517 if(!isset($final_pid))
+ − 1518 {
+ − 1519 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1520 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1521 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1522 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1523 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1524 }
+ − 1525 }
+ − 1526 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1527 $_POST['namespace'] = $ns;
+ − 1528 $_POST['page_id'] = $final_pid;
+ − 1529 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1530 }
+ − 1531
+ − 1532 if(isset($_POST['page_id']) && !isset($_POST['cancel']))
+ − 1533 {
+ − 1534 echo '<form name="main" action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1535 if(!isset($_POST['content']) || isset($_POST['revert'])) $content = RenderMan::getPage($_POST['page_id'], $_POST['namespace'], 0, false, false, false, false);
+ − 1536 else $content = $_POST['content'];
+ − 1537 if(isset($_POST['save']))
+ − 1538 {
+ − 1539 $data = $content;
+ − 1540 $id = md5( microtime() . mt_rand() );
+ − 1541
+ − 1542 $minor = isset($_POST['minor']) ? 'true' : 'false';
+ − 1543 $q='INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \'' . $db->escape($_POST['page_id']) . '\', \'' . $db->escape($_POST['namespace']) . '\', \''.$data.'\', \''.$id.'\', \''.$session->username.'\', \''.$db->escape(htmlspecialchars($_POST['summary'])).'\', '.$minor.');';
+ − 1544 if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
+ − 1545
+ − 1546 $query = 'UPDATE '.table_prefix.'page_text SET page_text=\''.$db->escape($data).'\',char_tag=\''.$id.'\' WHERE page_id=\'' . $db->escape($_POST['page_id']) . '\' AND namespace=\'' . $db->escape($_POST['namespace']) . '\';';
+ − 1547 $e = $db->sql_query($query);
+ − 1548 if(!$e) echo '<div class="warning-box">The page data could not be saved. MySQL said: '.mysql_error().'<br /><br />Query:<br /><pre>'.$query.'</pre></div>';
+ − 1549 else echo '<div class="info-box">Your page has been saved. <a href="'.makeUrlNS($_POST['namespace'], $_POST['page_id']).'">View page...</a></div>';
+ − 1550 } elseif(isset($_POST['preview'])) {
+ − 1551 echo '<h3>Preview</h3><p><b>Reminder:</b> This is only a preview; your changes to this page have not yet been saved.</p><div style="margin: 1em; padding: 10px; border: 1px dashed #606060; background-color: #F8F8F8; max-height: 200px; overflow: auto;">'.RenderMan::render($content).'</div>';
+ − 1552 }
+ − 1553 ?>
+ − 1554 <p>
+ − 1555 <textarea name="content" rows="20" cols="60" style="width: 100%;"><?php echo htmlspecialchars($content); ?></textarea><br />
+ − 1556 Edit summary: <input name="summary" value="<?php if(isset($_POST['summary'])) echo $_POST['summary']; ?>" size="40" /><br />
+ − 1557 <label><input type="checkbox" name="minor" <?php if(isset($_POST['minor'])) echo 'checked="checked" '; ?>/> This is a minor edit</label>
+ − 1558 </p>
+ − 1559 <p>
+ − 1560 <input type="hidden" name="page_id" value="<?php echo $_POST['page_id']; ?>" />
+ − 1561 <input type="hidden" name="namespace" value="<?php echo $_POST['namespace']; ?>" />
+ − 1562 <input type="submit" name="save" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="preview" value="Show preview" /> <input type="submit" name="revert" value="Revert changes" onclick="return confirm('Do you really want to revert your changes?');" /> <input type="submit" name="cancel" value="Cancel" onclick="return confirm('Do you really want to cancel your changes?');" />
+ − 1563 </p>
+ − 1564 <?php
+ − 1565 echo '</form>';
+ − 1566 } else {
+ − 1567 echo '<h3>Please select a page</h3>';
+ − 1568 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1569 ?>
+ − 1570 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1571 <p>Select page title from a list: <select name="page_force_url">
+ − 1572 <?php
+ − 1573 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1574 {
+ − 1575 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1576 }
+ − 1577 ?>
+ − 1578 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1579 <?php
+ − 1580 echo '</form>';
+ − 1581 }
+ − 1582 }
+ − 1583
+ − 1584 function page_Admin_ThemeManager()
+ − 1585 {
+ − 1586
+ − 1587 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1588 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1589 {
+ − 1590 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1591 return;
+ − 1592 }
+ − 1593
+ − 1594
+ − 1595 // Get the list of styles in the themes/ dir
+ − 1596 $h = opendir('./themes');
+ − 1597 $l = Array();
+ − 1598 if(!$h) die('Error opening directory "./themes" for reading.');
+ − 1599 while(false !== ($n = readdir($h))) {
+ − 1600 if($n != '.' && $n != '..' && is_dir('./themes/'.$n))
+ − 1601 $l[] = $n;
+ − 1602 }
+ − 1603 closedir($h);
+ − 1604 echo('
+ − 1605 <h3>Theme Management</h3>
+ − 1606 <p>Install, uninstall, and manage Enano themes.</p>
+ − 1607 ');
+ − 1608 if(isset($_POST['disenable'])) {
+ − 1609 $q = 'SELECT enabled FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1610 $s = $db->sql_query($q);
+ − 1611 if(!$s) die('Error selecting enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1612 $r = $db->fetchrow_num($s);
+ − 1613 $db->free_result();
+ − 1614 if($r[0] == 1) $e = 0;
+ − 1615 else $e = 1;
+ − 1616 $s=true;
+ − 1617 if($e==0)
+ − 1618 {
+ − 1619 $c = $db->sql_query('SELECT * FROM '.table_prefix.'themes WHERE enabled=1');
+ − 1620 if(!$c) $db->_die('The backup check for having at least on theme enabled failed.');
+ − 1621 if($db->numrows() <= 1) { echo '<div class="warning-box">You cannot disable the last remaining theme.</div>'; $s=false; }
+ − 1622 }
+ − 1623 $db->free_result();
+ − 1624 if($s) {
+ − 1625 $q = 'UPDATE '.table_prefix.'themes SET enabled='.$e.' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1626 $a = $db->sql_query($q);
+ − 1627 if(!$a) die('Error updating enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1628 else echo('<div class="info-box">The theme "'.$_POST['theme_id'].'" has been '. ( ( $e == '1' ) ? 'enabled' : 'disabled' ).'.</div>');
+ − 1629 }
+ − 1630 }
+ − 1631 elseif(isset($_POST['edit'])) {
+ − 1632
+ − 1633 $dir = './themes/'.$_POST['theme_id'].'/css/';
+ − 1634 $list = Array();
+ − 1635 // Open a known directory, and proceed to read its contents
+ − 1636 if (is_dir($dir)) {
+ − 1637 if ($dh = opendir($dir)) {
+ − 1638 while (($file = readdir($dh)) !== false) {
+ − 1639 if(preg_match('#^(.*?)\.css$#is', $file) && $file != '_printable.css') {
+ − 1640 $list[$file] = capitalize_first_letter(substr($file, 0, strlen($file)-4));
+ − 1641 }
+ − 1642 }
+ − 1643 closedir($dh);
+ − 1644 }
+ − 1645 }
+ − 1646 $lk = array_keys($list);
+ − 1647
+ − 1648 $q = 'SELECT theme_name,default_style FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1649 $s = $db->sql_query($q);
+ − 1650 if(!$s) die('Error selecting name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1651 $r = $db->fetchrow_num($s);
+ − 1652 $db->free_result();
+ − 1653 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">');
+ − 1654 echo('<div class="question-box">
+ − 1655 Theme name displayed to users: <input type="text" name="name" value="'.$r[0].'" /><br /><br />
+ − 1656 Default stylesheet: <select name="defaultcss">');
+ − 1657 foreach ($lk as $l)
+ − 1658 {
+ − 1659 if($r[1] == $l) $v = ' selected="selected"';
+ − 1660 else $v = '';
+ − 1661 echo "<option value='{$l}'$v>{$list[$l]}</option>";
+ − 1662 }
+ − 1663 echo('</select><br /><br />
+ − 1664 <input type="submit" name="editsave" value="OK" /><input type="hidden" name="theme_id" value="'.$_POST['theme_id'].'" />
+ − 1665 </div>');
+ − 1666 echo('</form>');
+ − 1667 }
+ − 1668 elseif(isset($_POST['editsave'])) {
+ − 1669 $q = 'UPDATE '.table_prefix.'themes SET theme_name=\'' . $db->escape($_POST['name']) . '\',default_style=\''.$db->escape($_POST['defaultcss']).'\' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1670 $s = $db->sql_query($q);
+ − 1671 if(!$s) die('Error updating name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1672 else echo('<div class="info-box">Theme data updated.</div>');
+ − 1673 }
+ − 1674 elseif(isset($_POST['up'])) {
+ − 1675 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1676 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1677 $s = $db->sql_query($q);
+ − 1678 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1679 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1680 $sn = $db->sql_query($q);
+ − 1681 if(!$sn) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1682 $r = $db->fetchrow_num($sn);
+ − 1683 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == 1 /* ...and check if this theme is already at the top */ ) { echo('<div class="warning-box">This theme is already at the top of the list, or there is only one theme installed.</div>'); } else {
+ − 1684 // Get the order IDs of the selected theme and the theme before it
+ − 1685 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1686 $s = $db->sql_query($q);
+ − 1687 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1688 $r = $db->fetchrow_num($s);
+ − 1689 $r = $r[0];
+ − 1690 $rb = $r - 1;
+ − 1691 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1692 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1693 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1694 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1695 echo('<div class="info-box">Theme moved up.</div>');
+ − 1696 }
+ − 1697 $db->free_result($s);
+ − 1698 $db->free_result($sn);
+ − 1699 }
+ − 1700 elseif(isset($_POST['down'])) {
+ − 1701 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1702 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1703 $s = $db->sql_query($q);
+ − 1704 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1705 $r = $db->fetchrow_num($s);
+ − 1706 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == $db->numrows($s) /* ...and check if this theme is already at the bottom */ ) { echo('<div class="warning-box">This theme is already at the bottom of the list, or there is only one theme installed.</div>'); } else {
+ − 1707 // Get the order IDs of the selected theme and the theme before it
+ − 1708 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1709 $s = $db->sql_query($q);
+ − 1710 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1711 $r = $db->fetchrow_num($s);
+ − 1712 $r = $r[0];
+ − 1713 $rb = $r + 1;
+ − 1714 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1715 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1716 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1717 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1718 echo('<div class="info-box">Theme moved down.</div>');
+ − 1719 }
+ − 1720 }
+ − 1721 else if(isset($_POST['uninstall']))
+ − 1722 {
+ − 1723 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1724 $s = $db->sql_query($q);
+ − 1725 if ( !$s )
+ − 1726 {
+ − 1727 die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1728 }
+ − 1729 $n = $db->numrows($s);
+ − 1730 $db->free_result();
+ − 1731
+ − 1732 if ( $_POST['theme_id'] == 'oxygen' )
+ − 1733 {
+ − 1734 echo '<div class="error-box">The Oxygen theme is used by Enano for installation, upgrades, and error messages, and cannot be uninstalled.</div>';
+ − 1735 }
+ − 1736 else
+ − 1737 {
+ − 1738 if($n < 2)
+ − 1739 {
+ − 1740 echo '<div class="error-box">The theme could not be uninstalled because it is the only theme left.</div>';
+ − 1741 }
+ − 1742 else
+ − 1743 {
+ − 1744 $q = 'DELETE FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\' LIMIT 1;';
+ − 1745 $s = $db->sql_query($q);
+ − 1746 if ( !$s )
+ − 1747 {
+ − 1748 die('Error deleting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1749 }
+ − 1750 else
+ − 1751 {
+ − 1752 echo('<div class="info-box">Theme uninstalled.</div>');
+ − 1753 }
+ − 1754 }
+ − 1755 }
+ − 1756 }
+ − 1757 elseif(isset($_POST['install'])) {
+ − 1758 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1759 $s = $db->sql_query($q);
+ − 1760 if(!$s) die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1761 $n = $db->numrows($s);
+ − 1762 $n++;
+ − 1763 $theme_id = $_POST['theme_id'];
+ − 1764 $theme = Array();
+ − 1765 include('./themes/'.$theme_id.'/theme.cfg');
+ − 1766 $q = 'INSERT INTO '.table_prefix.'themes(theme_id,theme_name,theme_order,enabled) VALUES(\''.$theme['theme_id'].'\', \''.$theme['theme_name'].'\', '.$n.', 1)';
+ − 1767 $s = $db->sql_query($q);
+ − 1768 if(!$s) die('Error inserting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1769 else echo('<div class="info-box">Theme "'.$theme['theme_name'].'" installed.</div>');
+ − 1770 }
+ − 1771 echo('
+ − 1772 <h3>Currently installed themes</h3>
+ − 1773 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 1774 <p>
+ − 1775 <select name="theme_id">
+ − 1776 ');
+ − 1777 $q = 'SELECT theme_id,theme_name,enabled FROM '.table_prefix.'themes ORDER BY theme_order';
+ − 1778 $s = $db->sql_query($q);
+ − 1779 if(!$s) die('Error selecting theme data: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1780 while ( $r = $db->fetchrow_num($s) ) {
+ − 1781 if($r[2] < 1) $r[1] .= ' (disabled)';
+ − 1782 echo('<option value="'.$r[0].'">'.$r[1].'</option>');
+ − 1783 }
+ − 1784 $db->free_result();
+ − 1785 echo('
+ − 1786 </select> <input type="submit" name="disenable" value="Enable/Disable" /> <input type="submit" name="edit" value="Change settings" /> <input type="submit" name="up" value="Move up" /> <input type="submit" name="down" value="Move down" /> <input type="submit" name="uninstall" value="Uninstall" style="color: #DD3300; font-weight: bold;" />
+ − 1787 </p>
+ − 1788 </form>
+ − 1789 <h3>Install a new theme</h3>
+ − 1790 ');
+ − 1791 $theme = Array();
+ − 1792 $obb = '';
+ − 1793 for($i=0;$i<sizeof($l);$i++) {
+ − 1794 if(is_file('./themes/'.$l[$i].'/theme.cfg') && file_exists('./themes/'.$l[$i].'/theme.cfg')) {
+ − 1795 include('./themes/'.$l[$i].'/theme.cfg');
+ − 1796 $q = 'SELECT * FROM '.table_prefix.'themes WHERE theme_id=\''.$theme['theme_id'].'\'';
+ − 1797 $s = $db->sql_query($q);
+ − 1798 if(!$s) die('Error selecting list of currently installed themes: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1799 if($db->numrows($s) < 1) {
+ − 1800 $obb .= '<option value="'.$theme['theme_id'].'">'.$theme['theme_name'].'</option>';
+ − 1801 }
+ − 1802 $db->free_result();
+ − 1803 }
+ − 1804 }
+ − 1805 if($obb != '') {
+ − 1806 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post"><p>');
+ − 1807 echo('<select name="theme_id">');
+ − 1808 echo($obb);
+ − 1809 echo('</select>');
+ − 1810 echo('
+ − 1811 <input type="submit" name="install" value="Install this theme" />
+ − 1812 </p></form>');
+ − 1813 } else echo('<p>All themes are currently installed.</p>');
+ − 1814 }
+ − 1815
+ − 1816 function page_Admin_BanControl()
+ − 1817 {
+ − 1818 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1819 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1820 {
+ − 1821 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1822 return;
+ − 1823 }
+ − 1824
+ − 1825 if(isset($_GET['action']) && $_GET['action'] == 'delete' && isset($_GET['id']) && $_GET['id'] != '')
+ − 1826 {
+ − 1827 $e = $db->sql_query('DELETE FROM '.table_prefix.'banlist WHERE ban_id=' . $db->escape($_GET['id']) . '');
+ − 1828 if(!$e) $db->_die('The ban list entry was not deleted.');
+ − 1829 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1830 if(isset($_POST['create']) && !defined('ENANO_DEMO_MODE'))
0
+ − 1831 {
+ − 1832 $q = 'INSERT INTO '.table_prefix.'banlist(ban_type,ban_value,reason,is_regex) VALUES( ' . $db->escape($_POST['type']) . ', \'' . $db->escape($_POST['value']) . '\', \''.$db->escape($_POST['reason']).'\'';
+ − 1833 if(isset($_POST['regex'])) $q .= ', 1';
+ − 1834 else $q .= ', 0';
+ − 1835 $q .= ');';
+ − 1836 $e = $db->sql_query($q);
+ − 1837 if(!$e) $db->_die('The banlist could not be updated.');
+ − 1838 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1839 else if ( isset($_POST['create']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1840 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1841 echo '<div class="error-box">This function is disabled in the demo. Just because <i>you</i> don\'t like ' . htmlspecialchars($_POST['value']) . ' doesn\'t mean <i>we</i> don\'t like ' . htmlspecialchars($_POST['value']) . '.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1842 }
0
+ − 1843 $q = $db->sql_query('SELECT ban_id,ban_type,ban_value,is_regex FROM '.table_prefix.'banlist ORDER BY ban_type;');
+ − 1844 if(!$q) $db->_die('The banlist data could not be selected.');
+ − 1845 echo '<table border="0" cellspacing="1" cellpadding="4">';
+ − 1846 echo '<tr><th>Type</th><th>Value</th><th>Regular Expression</th><th></th></tr>';
+ − 1847 if($db->numrows() < 1) echo '<td colspan="4">No ban rules yet.</td>';
+ − 1848 while($r = $db->fetchrow())
+ − 1849 {
+ − 1850 if($r['ban_type']==BAN_IP) $t = 'IP address';
+ − 1851 elseif($r['ban_type']==BAN_USER) $t = 'Username';
+ − 1852 elseif($r['ban_type']==BAN_EMAIL) $t = 'E-mail address';
+ − 1853 if($r['is_regex']) $g = 'Yes'; else $g = 'No';
+ − 1854 echo '<tr><td>'.$t.'</td><td>'.$r['ban_value'].'</td><td>'.$g.'</td><td><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'BanControl&action=delete&id='.$r['ban_id']).'">Delete</a></td></tr>';
+ − 1855 }
+ − 1856 $db->free_result();
+ − 1857 echo '</table>';
+ − 1858 echo '<h3>Create new ban rule</h3>';
+ − 1859 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1860 ?>
+ − 1861 Type: <select name="type"><option value="<?php echo BAN_IP; ?>">IP address</option><option value="<?php echo BAN_USER; ?>">Username</option><option value="<?php echo BAN_EMAIL; ?>">E-mail address</option></select><br />
+ − 1862 Rule: <input type="text" name="value" size="30" /><br />
+ − 1863 Reason to show to the banned user: <textarea name="reason" rows="7" cols="20"></textarea><br />
+ − 1864 <input type="checkbox" name="regex" id="regex" /> <label for="regex">This rule is a regular expression</label> (advanced users only)<br />
+ − 1865 <input type="submit" style="font-weight: bold;" name="create" value="Create new ban rule" />
+ − 1866 <?php
+ − 1867 echo '</form>';
+ − 1868 }
+ − 1869
+ − 1870 function page_Admin_MassEmail()
+ − 1871 {
+ − 1872 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1873 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1874 {
+ − 1875 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1876 return;
+ − 1877 }
+ − 1878
+ − 1879 global $enano_config;
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1880 if ( isset($_POST['do_send']) && !defined('ENANO_DEMO_MODE') )
0
+ − 1881 {
+ − 1882 $use_smtp = getConfig('smtp_enabled') == '1';
+ − 1883
+ − 1884 //
+ − 1885 // Let's do some checking to make sure that mass mail functions
+ − 1886 // are working in win32 versions of php. (copied from phpBB)
+ − 1887 //
+ − 1888 if ( preg_match('/[c-z]:\\\.*/i', getenv('PATH')) && !$use_smtp)
+ − 1889 {
+ − 1890 $ini_val = ( @phpversion() >= '4.0.0' ) ? 'ini_get' : 'get_cfg_var';
+ − 1891
+ − 1892 // We are running on windows, force delivery to use our smtp functions
+ − 1893 // since php's are broken by default
+ − 1894 $use_smtp = true;
+ − 1895 $enano_config['smtp_server'] = @$ini_val('SMTP');
+ − 1896 }
+ − 1897
+ − 1898 $mail = new emailer( !empty($use_smtp) );
+ − 1899
+ − 1900 // Validate subject/message body
+ − 1901 $subject = stripslashes(trim($_POST['subject']));
+ − 1902 $message = stripslashes(trim($_POST['message']));
+ − 1903
+ − 1904 if ( empty($subject) )
+ − 1905 $errors[] = 'Please enter a subject.';
+ − 1906 if ( empty($message) )
+ − 1907 $errors[] = 'Please enter a message.';
+ − 1908
+ − 1909 // Get list of members
+ − 1910 if ( !empty($_POST['userlist']) )
+ − 1911 {
+ − 1912 $userlist = str_replace(', ', ',', $_POST['userlist']);
+ − 1913 $userlist = explode(',', $userlist);
+ − 1914 foreach ( $userlist as $k => $u )
+ − 1915 {
+ − 1916 if ( $u == $session->username )
+ − 1917 {
+ − 1918 // Message is automatically sent to the sender
+ − 1919 unset($userlist[$k]);
+ − 1920 }
+ − 1921 else
+ − 1922 {
+ − 1923 $userlist[$k] = $db->escape($u);
+ − 1924 }
+ − 1925 }
+ − 1926 $userlist = 'WHERE username=\'' . implode('\' OR username=\'', $userlist) . '\'';
+ − 1927
+ − 1928 $q = $db->sql_query('SELECT email FROM '.table_prefix.'users ' . $userlist . ';');
+ − 1929 if ( !$q )
+ − 1930 $db->_die();
+ − 1931
+ − 1932 if ( $row = $db->fetchrow() )
+ − 1933 {
+ − 1934 do {
+ − 1935 $mail->cc($row['email']);
+ − 1936 } while ( $row = $db->fetchrow() );
+ − 1937 }
+ − 1938
+ − 1939 $db->free_result();
+ − 1940
+ − 1941 }
+ − 1942 else
+ − 1943 {
+ − 1944 // Sending to a usergroup
+ − 1945
+ − 1946 $group_id = intval($_POST['group_id']);
+ − 1947 if ( $group_id < 1 )
+ − 1948 {
+ − 1949 $errors[] = 'Invalid group ID';
+ − 1950 }
+ − 1951 else
+ − 1952 {
+ − 1953 $q = $db->sql_query('SELECT u.email FROM '.table_prefix.'group_members AS g
+ − 1954 LEFT JOIN '.table_prefix.'users AS u
+ − 1955 ON (u.user_id=g.user_id)
+ − 1956 WHERE g.group_id=' . $group_id . ';');
+ − 1957 if ( !$q )
+ − 1958 $db->_die();
+ − 1959
+ − 1960 if ( $row = $db->fetchrow() )
+ − 1961 {
+ − 1962 do {
+ − 1963 $mail->cc($row['email']);
+ − 1964 } while ( $row = $db->fetchrow() );
+ − 1965 }
+ − 1966
+ − 1967 $db->free_result();
+ − 1968 }
+ − 1969 }
+ − 1970
+ − 1971 if ( sizeof($errors) < 1 )
+ − 1972 {
+ − 1973
+ − 1974 $mail->from(getConfig('contact_email'));
+ − 1975 $mail->replyto(getConfig('contact_email'));
+ − 1976 $mail->set_subject($subject);
+ − 1977 $mail->email_address(getConfig('contact_email'));
+ − 1978
+ − 1979 // Copied/modified from phpBB
+ − 1980 $email_headers = 'X-AntiAbuse: Website server name - ' . $_SERVER['SERVER_NAME'] . "\n";
+ − 1981 $email_headers .= 'X-AntiAbuse: User_id - ' . $session->user_id . "\n";
+ − 1982 $email_headers .= 'X-AntiAbuse: Username - ' . $session->username . "\n";
+ − 1983 $email_headers .= 'X-AntiAbuse: User IP - ' . $_SERVER['REMOTE_ADDR'] . "\n";
+ − 1984
+ − 1985 $mail->extra_headers($email_headers);
+ − 1986
+ − 1987 $tpl = 'The following message was mass-mailed by {SENDER}, one of the administrators from {SITE_NAME}. If this message contains spam or any comments which you find abusive or offensive, please contact the administration team at:
+ − 1988
+ − 1989 {CONTACT_EMAIL}
+ − 1990
+ − 1991 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ − 1992 {MESSAGE}
+ − 1993 ';
+ − 1994
+ − 1995 $mail->use_template($tpl);
+ − 1996
+ − 1997 $mail->assign_vars(array(
+ − 1998 'SENDER' => $session->username,
+ − 1999 'SITE_NAME' => getConfig('site_name'),
+ − 2000 'CONTACT_EMAIL' => getConfig('contact_email'),
+ − 2001 'MESSAGE' => $message
+ − 2002 ));
+ − 2003
+ − 2004 //echo '<pre>'.print_r($mail,true).'</pre>';
+ − 2005
+ − 2006 // All done
+ − 2007 $mail->send();
+ − 2008 $mail->reset();
+ − 2009
+ − 2010 echo '<div class="info-box">Your message has been sent.</div>';
+ − 2011
+ − 2012 }
+ − 2013 else
+ − 2014 {
+ − 2015 echo '<div class="warning-box">Could not send message for the following reason(s):<ul><li>' . implode('</li><li>', $errors) . '</li></ul></div>';
+ − 2016 }
+ − 2017
+ − 2018 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2019 else if ( isset($_POST['do_send']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2020 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2021 echo '<div class="error-box">This function is disabled in the demo. You think demo@enanocms.org likes getting "test" mass e-mails?</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2022 }
0
+ − 2023 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 2024 ?>
+ − 2025 <div class="tblholder">
+ − 2026 <table border="0" cellspacing="1" cellpadding="4">
+ − 2027 <tr>
+ − 2028 <th colspan="2">Send mass e-mail</th>
+ − 2029 </tr>
+ − 2030 <tr>
+ − 2031 <td class="row2" rowspan="2" style="width: 30%; min-width: 200px;">
+ − 2032 Send message to:<br />
+ − 2033 <small>
+ − 2034 By default, this message will be sent to the group selected here. You may instead send the message to a specific
+ − 2035 list of users by entering them in the second row, with usernames separated by a single comma (no space).
+ − 2036 </small>
+ − 2037 </td>
+ − 2038 <td class="row1">
+ − 2039 <select name="group_id">
+ − 2040 <?php
+ − 2041 $q = $db->sql_query('SELECT group_name,group_id FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 2042 if ( !$q )
+ − 2043 $db->_die();
+ − 2044 while ( $row = $db->fetchrow() )
+ − 2045 {
+ − 2046 echo '<option value="' . $row['group_id'] . '">' . $row['group_name'] . '</option>';
+ − 2047 }
+ − 2048 ?>
+ − 2049 </select>
+ − 2050 </td>
+ − 2051 </tr>
+ − 2052 <tr>
+ − 2053 <td class="row1">
+ − 2054 Usernames: <input type="text" name="userlist" size="50" />
+ − 2055 </td>
+ − 2056 </tr>
+ − 2057 <tr>
+ − 2058 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 2059 Subject:
+ − 2060 </td>
+ − 2061 <td class="row1">
+ − 2062 <input name="subject" type="text" size="50" />
+ − 2063 </td>
+ − 2064 </tr>
+ − 2065 <tr>
+ − 2066 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 2067 Message:
+ − 2068 </td>
+ − 2069 <td class="row1">
+ − 2070 <textarea name="message" rows="30" cols="60" style="width: 100%;"></textarea>
+ − 2071 </td>
+ − 2072 </tr>
+ − 2073 <tr>
+ − 2074 <th class="subhead" colspan="2" style="text-align: left;" valign="middle">
+ − 2075 <div style="float: right;"><input type="submit" name="do_send" value="Send message" /></div>
+ − 2076 <small style="font-weight: normal;">Please be warned: it may take a LONG time to send this message. <b>Please do not stop the script until the process is finished.</b></small>
+ − 2077 </th>
+ − 2078 </tr>
+ − 2079
+ − 2080 </table>
+ − 2081 </div>
+ − 2082 <?php
+ − 2083 echo '</form>';
+ − 2084 }
+ − 2085
+ − 2086 function page_Admin_DBBackup()
+ − 2087 {
+ − 2088 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2089 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2090 {
+ − 2091 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2092 return;
+ − 2093 }
+ − 2094
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2095 if(isset($_GET['submitting']) && $_GET['submitting'] == 'yes' && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2096 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2097 redirect(makeUrlComplete('Special', 'Administration'), 'Access denied', 'You\'ve got to be kidding me. Forget it, kid.', 4 );
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2098 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2099
0
+ − 2100 global $system_table_list;
+ − 2101 if(isset($_GET['submitting']) && $_GET['submitting'] == 'yes')
+ − 2102 {
+ − 2103
+ − 2104 if(defined('SQL_BACKUP_CRYPT'))
+ − 2105 // Try to increase our time limit
+ − 2106 @set_time_limit(300); // five minutes
+ − 2107 // Do the actual export
+ − 2108 $aesext = ( defined('SQL_BACKUP_CRYPT') ) ? '.tea' : '';
+ − 2109 $filename = 'enano_backup_' . date('dmy') . '.sql' . $aesext;
+ − 2110 ob_start();
+ − 2111 header('Content-disposition: attachment, filename="'.$filename.'";');
+ − 2112 header('Content-type: application/transact-sql');
+ − 2113 // Spew some headers
+ − 2114 $headdate = date('F d, Y \a\t h:i a');
+ − 2115 echo <<<HEADER
+ − 2116 -- Enano CMS SQL backup
+ − 2117 -- Generated on {$headdate} by {$session->username}
+ − 2118
+ − 2119 HEADER;
+ − 2120 // build the table list
+ − 2121 $base = ( isset($_POST['do_system_tables']) ) ? $system_table_list : Array();
+ − 2122 $add = ( isset($_POST['additional_tables'])) ? $_POST['additional_tables'] : Array();
+ − 2123 $tables = array_merge($base, $add);
+ − 2124
+ − 2125 // Log it!
+ − 2126 $e = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'db_backup\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($session->username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', \'' . $db->escape(implode(', ', $tables)) . '\')');
+ − 2127 if ( !$e )
+ − 2128 $db->_die();
+ − 2129
+ − 2130 foreach($tables as $i => $t)
+ − 2131 {
+ − 2132 if(!preg_match('#^([a-z0-9_]+)$#i', $t))
+ − 2133 die('Hacking attempt');
+ − 2134 // if($t == table_prefix.'files' && isset($_POST['do_data']))
+ − 2135 // unset($tables[$i]);
+ − 2136 }
+ − 2137 foreach($tables as $t)
+ − 2138 {
+ − 2139 // Sorry folks - this script CAN'T backup enano_files, enano_search_index, and enano_search_cache due to the sheer size of the tables.
+ − 2140 // If encryption is enabled the log data will be excluded too.
+ − 2141 echo export_table(
+ − 2142 $t,
+ − 2143 isset($_POST['do_struct']),
+ − 2144 ( isset($_POST['do_data']) /* && $t != table_prefix.'files' && $t != table_prefix.'search_index' && $t != table_prefix.'search_cache' && ( !defined('SQL_BACKUP_CRYPT') || ( defined('SQL_BACKUP_CRYPT') && $t != table_prefix.'logs' ) ) */ ),
+ − 2145 false
+ − 2146 ) . "\n";
+ − 2147 }
+ − 2148 $data = ob_get_contents();
+ − 2149 ob_end_clean();
+ − 2150 if(defined('SQL_BACKUP_CRYPT'))
+ − 2151 {
+ − 2152 // Free some memory, we don't need this stuff any more
+ − 2153 $db->close();
+ − 2154 unset($paths, $db, $template, $plugins);
+ − 2155 $tea = new TEACrypt();
+ − 2156 $data = $tea->encrypt($data, $session->private_key);
+ − 2157 }
+ − 2158 header('Content-length: '.strlen($data));
+ − 2159 echo $data;
+ − 2160 exit;
+ − 2161 }
+ − 2162 else
+ − 2163 {
+ − 2164 // Show the UI
+ − 2165 echo '<form action="'.makeUrlNS('Admin', 'DBBackup', 'submitting=yes', true).'" method="post" enctype="multipart/form-data">';
+ − 2166 ?>
+ − 2167 <p>This page allows you to back up your Enano database should something go miserably wrong.</p>
+ − 2168 <p><label><input type="checkbox" name="do_system_tables" checked="checked" /> Export tables that are part of the Enano core</label><p>
+ − 2169 <p>Additional tables to export:</p>
+ − 2170 <p><select name="additional_tables[]" multiple="multiple">
+ − 2171 <?php
+ − 2172 $q = $db->sql_query('SHOW TABLES;') or $db->_die('Somehow we were denied the request to get the list of tables.');
+ − 2173 while($row = $db->fetchrow_num())
+ − 2174 {
+ − 2175 if(!in_array($row[0], $system_table_list)) echo '<option value="'.$row[0].'">'.$row[0].'</option>';
+ − 2176 }
+ − 2177 ?>
+ − 2178 </select>
+ − 2179 </p>
+ − 2180 <p><label><input type="checkbox" name="do_struct" checked="checked" /> Include table structure</label><br />
+ − 2181 <label><input type="checkbox" name="do_data" checked="checked" /> Include table data</label>
+ − 2182 </p>
+ − 2183 <p><input type="submit" value="Create backup" /></p>
+ − 2184 <?php
+ − 2185 echo '</form>';
+ − 2186 }
+ − 2187 }
+ − 2188
+ − 2189 function page_Admin_AdminLogout()
+ − 2190 {
+ − 2191 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2192 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2193 {
+ − 2194 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2195 return;
+ − 2196 }
+ − 2197
+ − 2198 $session->logout(USER_LEVEL_ADMIN);
+ − 2199 echo '<h3>You have now been logged out of the administration panel.</h3><p>You will continue to be logged into the website, but you will need to re-authenticate before you can access the administration panel again.</p><p>Return to the <a href="'.makeUrl(getConfig('main_page')).'">Main Page</a>.</p>';
+ − 2200 }
+ − 2201
+ − 2202 function page_Special_Administration()
+ − 2203 {
+ − 2204 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2205
+ − 2206 if($session->auth_level < USER_LEVEL_ADMIN) {
+ − 2207 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), 'Not authorized', 'You need an authorization level of '.USER_LEVEL_ADMIN.' to use this page, your auth level is: ' . $session->auth_level, 0);
+ − 2208 exit;
+ − 2209 }
+ − 2210 else
+ − 2211 {
+ − 2212 $template->load_theme('admin', 'default');
+ − 2213 $template->init_vars();
+ − 2214 if( !isset( $_GET['noheaders'] ) )
+ − 2215 {
+ − 2216 $template->header();
+ − 2217 }
+ − 2218 echo 'Administer your Enano website.';
+ − 2219 ?>
+ − 2220 <script type="text/javascript">
+ − 2221 function ajaxPage(t)
+ − 2222 {
+ − 2223 if ( t == namespace_list.Admin + 'AdminLogout' )
+ − 2224 {
+ − 2225 var mb = new messagebox(MB_YESNO|MB_ICONQUESTION, 'Are you sure you want to de-authenticate?', 'If you de-authenticate, you will no longer be able to use the administration panel until you re-authenticate again. You may do so at any time using the Administration button on the sidebar.');
+ − 2226 mb.onclick['Yes'] = function() {
+ − 2227 var tigraentry = document.getElementById('i_div0_0').parentNode;
+ − 2228 var tigraobj = $(tigraentry);
+ − 2229 var div = document.createElement('div');
+ − 2230 div.style.backgroundColor = '#FFFFFF';
+ − 2231 domObjChangeOpac(70, div);
+ − 2232 div.style.position = 'absolute';
+ − 2233 var top = tigraobj.Top();
+ − 2234 var left = tigraobj.Left();
+ − 2235 var width = tigraobj.Width();
+ − 2236 var height = tigraobj.Height();
+ − 2237 div.style.top = top + 'px';
+ − 2238 div.style.left = left + 'px';
+ − 2239 div.style.width = width + 'px';
+ − 2240 div.style.height = height + 'px';
+ − 2241 var body = document.getElementsByTagName('body')[0];
+ − 2242 enlighten(true);
+ − 2243 body.appendChild(div);
+ − 2244 ajaxPageBin(namespace_list.Admin + 'AdminLogout');
+ − 2245 }
+ − 2246 return;
+ − 2247 }
+ − 2248 ajaxPageBin(t);
+ − 2249 }
+ − 2250 function ajaxPageBin(t)
+ − 2251 {
+ − 2252 document.getElementById('ajaxPageContainer').innerHTML = '<div class="wait-box">Loading page...</div>';
+ − 2253 ajaxGet('<?php echo scriptPath; ?>/ajax.php?title='+t+'&_mode=getpage&noheaders&auth=<?php echo $session->sid_super; ?>', function() {
+ − 2254 if(ajax.readyState == 4) {
+ − 2255 document.getElementById('ajaxPageContainer').innerHTML = ajax.responseText;
+ − 2256 fadeInfoBoxes();
+ − 2257 }
+ − 2258 });
+ − 2259 }
+ − 2260 function _enanoAdminOnload() { ajaxPage('<?php echo $paths->nslist['Admin']; ?>Home'); }
+ − 2261 var TREE_TPL = {
+ − 2262 'target' : '_self', // name of the frame links will be opened in
+ − 2263 // other possible values are: _blank, _parent, _search, _self and _top
+ − 2264
+ − 2265 'icon_e' : '<?php echo scriptPath; ?>/images/icons/empty.gif', // empty image
+ − 2266 'icon_l' : '<?php echo scriptPath; ?>/images/icons/line.gif', // vertical line
+ − 2267 'icon_32' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon normal
+ − 2268 'icon_36' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon selected
+ − 2269 'icon_48' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon normal
+ − 2270 'icon_52' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2271 'icon_56' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon opened
+ − 2272 'icon_60' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2273 'icon_16' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon normal
+ − 2274 'icon_20' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected
+ − 2275 'icon_24' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon opened
+ − 2276 'icon_28' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected opened
+ − 2277 'icon_0' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon normal
+ − 2278 'icon_4' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2279 'icon_8' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon opened
+ − 2280 'icon_12' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2281 'icon_2' : '<?php echo scriptPath; ?>/images/icons/joinbottom.gif', // junction for leaf
+ − 2282 'icon_3' : '<?php echo scriptPath; ?>/images/icons/join.gif', // junction for last leaf
+ − 2283 'icon_18' : '<?php echo scriptPath; ?>/images/icons/plusbottom.gif', // junction for closed node
+ − 2284 'icon_19' : '<?php echo scriptPath; ?>/images/icons/plus.gif', // junction for last closed node
+ − 2285 'icon_26' : '<?php echo scriptPath; ?>/images/icons/minusbottom.gif',// junction for opened node
+ − 2286 'icon_27' : '<?php echo scriptPath; ?>/images/icons/minus.gif' // junction for last opended node
+ − 2287 };
+ − 2288 <?php
+ − 2289 echo $paths->parseAdminTree(); // Make a Javascript array that defines the tree
+ − 2290 if(!isset($_GET['module'])) { echo 'addOnloadHook(_enanoAdminOnload);'; } ?>
+ − 2291 </script>
+ − 2292 <table border="0" width="100%">
+ − 2293 <tr>
+ − 2294 <td class="holder" valign="top">
+ − 2295 <div class="pad" style="padding-right: 20px;">
+ − 2296 <script type="text/javascript">
+ − 2297 new tree(TREE_ITEMS, TREE_TPL);
+ − 2298 </script>
+ − 2299 </div>
+ − 2300 </td>
+ − 2301 <td width="100%" valign="top">
+ − 2302 <div class="pad" id="ajaxPageContainer">
+ − 2303 <?php
+ − 2304 if(isset($_GET['module']))
+ − 2305 {
+ − 2306 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 2307 $k = array_keys($paths->nslist);
+ − 2308 for ( $i = 0; $i < sizeof($paths->nslist); $i++ )
+ − 2309 {
+ − 2310 $ln = strlen( $paths->nslist[ $k[ $i ] ] );
+ − 2311 if ( substr($_GET['module'], 0, $ln) == $paths->nslist[$k[$i]] )
+ − 2312 {
+ − 2313 $ns = $k[$i];
+ − 2314 $nm = substr($_GET['module'], $ln, strlen($_GET['module']));
+ − 2315 }
+ − 2316 }
+ − 2317 $fname = 'page_'.$ns.'_'.$nm;
+ − 2318 $s = strpos($fname, '?noheaders');
+ − 2319 if($s) $fname = substr($fname, 0, $s);
+ − 2320 $paths->cpage['module'] = $_GET['module'];
+ − 2321 if ( function_exists($fname) && $_GET['module'] != $paths->nslist['Special'] . 'Administration' )
+ − 2322 {
+ − 2323 eval($fname.'();');
+ − 2324 }
+ − 2325 }
+ − 2326 else
+ − 2327 {
+ − 2328 echo '<div class="wait-box">Please wait while the administration panel loads. You need to be using a recent browser with AJAX support in order to use Runt.</div>';
+ − 2329 }
+ − 2330 ?>
+ − 2331 </div>
+ − 2332 </td>
+ − 2333 </tr>
+ − 2334 </table>
+ − 2335
+ − 2336 <?php
+ − 2337 }
+ − 2338 if(!isset($_GET['noheaders']))
+ − 2339 {
+ − 2340 $template->footer();
+ − 2341 }
+ − 2342 }
+ − 2343
+ − 2344 function page_Special_EditSidebar()
+ − 2345 {
+ − 2346 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2347
+ − 2348 if($session->auth_level < USER_LEVEL_ADMIN)
+ − 2349 {
+ − 2350 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), '', '', false);
+ − 2351 exit;
+ − 2352 }
+ − 2353 else
+ − 2354 {
+ − 2355
+ − 2356 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx.js"></script>');
+ − 2357 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx-key.js"></script>');
+ − 2358 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/sbedit.js"></script>');
+ − 2359 $template->add_header('<link rel="stylesheet" type="text/css" href="'.scriptPath.'/includes/clientside/dbx.css" />');
+ − 2360
+ − 2361 // Knock the sidebars dead to keep javascript in plugins from interfering
+ − 2362 $template->tpl_strings['SIDEBAR_LEFT'] = '';
+ − 2363 $template->tpl_strings['SIDEBAR_RIGHT'] = '';
+ − 2364
+ − 2365 $template->load_theme('oxygen', 'bleu');
+ − 2366 $template->init_vars();
+ − 2367
+ − 2368 $template->header();
+ − 2369
+ − 2370 if(isset($_POST['save']))
+ − 2371 {
+ − 2372 // Write the new block order to the database
+ − 2373 // The only way to do this is with tons of queries (one per block + one select query at the start to count everything) but afaik its safe...
+ − 2374 // Anyone know a better way to do this?
+ − 2375 $q = $db->sql_query('SELECT item_order,item_id,sidebar_id FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2376 if ( !$q )
+ − 2377 {
+ − 2378 $db->_die('The sidebar order data could not be selected.');
+ − 2379 }
+ − 2380 $orders = Array();
+ − 2381 while($row = $db->fetchrow())
+ − 2382 {
+ − 2383 $orders[] = Array(
+ − 2384 count($orders),
+ − 2385 $row['item_id'],
+ − 2386 $row['sidebar_id'],
+ − 2387 );
+ − 2388 }
+ − 2389 $db->free_result();
+ − 2390
+ − 2391 // We now have an array with each sidebar ID in its respective order. Explode the order string in $_POST['order_(left|right)'] and use it to build a set of queries.
+ − 2392 $ol = explode(',', $_POST['order_left']);
+ − 2393 $odr = explode(',', $_POST['order_right']);
+ − 2394 $om = array_merge($ol, $odr);
+ − 2395 unset($ol, $odr);
+ − 2396 $queries = Array();
+ − 2397 foreach($orders as $k => $v)
+ − 2398 {
+ − 2399 $queries[] = 'UPDATE '.table_prefix.'sidebar SET item_order='.$om[$k].' WHERE item_id='.$v[1].';';
+ − 2400 }
+ − 2401 foreach($queries as $sql)
+ − 2402 {
+ − 2403 $q = $db->sql_query($sql);
+ − 2404 if(!$q)
+ − 2405 {
+ − 2406 $t = $db->get_error();
+ − 2407 echo $t;
+ − 2408 $template->footer();
+ − 2409 exit;
+ − 2410 }
+ − 2411 }
+ − 2412 echo '<div class="info-box" style="margin: 10px 0;">The sidebar order information was updated successfully.</div>';
+ − 2413 }
+ − 2414 elseif(isset($_POST['create']))
+ − 2415 {
+ − 2416 switch((int)$_POST['type'])
+ − 2417 {
+ − 2418 case BLOCK_WIKIFORMAT:
+ − 2419 $content = $_POST['wikiformat_content'];
+ − 2420 break;
+ − 2421 case BLOCK_TEMPLATEFORMAT:
+ − 2422 $content = $_POST['templateformat_content'];
+ − 2423 break;
+ − 2424 case BLOCK_HTML:
+ − 2425 $content = $_POST['html_content'];
+ − 2426 break;
+ − 2427 case BLOCK_PHP:
+ − 2428 $content = $_POST['php_content'];
+ − 2429 break;
+ − 2430 case BLOCK_PLUGIN:
+ − 2431 $content = $_POST['plugin_id'];
+ − 2432 break;
+ − 2433 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2434
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2435 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2436 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2437 // Sanitize the HTML
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2438 $content = sanitize_html($content, true);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2439 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2440
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2441 if ( defined('ENANO_DEMO_MODE') && intval($_POST['type']) == BLOCK_PHP )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2442 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2443 echo '<div class="error-box" style="margin: 10px 0 10px 0;">Adding PHP code blocks in the Enano administration demo has been disabled for security reasons.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2444 $_POST['php_content'] = '?><Nulled>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2445 $content = $_POST['php_content'];
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2446 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2447
0
+ − 2448 // Get the value of item_order
+ − 2449
+ − 2450 $q = $db->sql_query('SELECT * FROM '.table_prefix.'sidebar WHERE sidebar_id='.$db->escape($_POST['sidebar_id']).';');
+ − 2451 if(!$q) $db->_die('The order number could not be selected');
+ − 2452 $io = $db->numrows();
+ − 2453
+ − 2454 $db->free_result();
+ − 2455
+ − 2456 $q = 'INSERT INTO '.table_prefix.'sidebar(block_name, block_type, sidebar_id, block_content, item_order) VALUES ( \''.$db->escape($_POST['title']).'\', \''.$db->escape($_POST['type']).'\', \''.$db->escape($_POST['sidebar_id']).'\', \''.$db->escape($content).'\', '.$io.' );';
+ − 2457 $result = $db->sql_query($q);
+ − 2458 if(!$result)
+ − 2459 {
+ − 2460 echo $db->get_error();
+ − 2461 $template->footer();
+ − 2462 exit;
+ − 2463 }
+ − 2464
+ − 2465 echo '<div class="info-box" style="margin: 10px 0;">The item was added.</div>';
+ − 2466
+ − 2467 }
+ − 2468
+ − 2469 if(isset($_GET['action']) && isset($_GET['id']))
+ − 2470 {
+ − 2471 if(preg_match('#^([0-9]*)$#', $_GET['id']))
+ − 2472 {
+ − 2473 } else {
+ − 2474 echo '<div class="warning-box">Error with action: $_GET["id"] was not an integer, aborting to prevent SQL injection</div>';
+ − 2475 }
+ − 2476 switch($_GET['action'])
+ − 2477 {
+ − 2478 case 'new':
+ − 2479 ?>
+ − 2480 <script type="text/javascript">
+ − 2481 function setType(input)
+ − 2482 {
+ − 2483 val = input.value;
+ − 2484 if(!val)
+ − 2485 {
+ − 2486 return false;
+ − 2487 }
+ − 2488 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2489 for(var i in divs)
+ − 2490 {
+ − 2491 if(divs[i].id == 'blocktype_'+val) divs[i].style.display = 'block';
+ − 2492 else divs[i].style.display = 'none';
+ − 2493 }
+ − 2494 }
+ − 2495 </script>
+ − 2496
+ − 2497 <form action="<?php echo makeUrl($paths->page); ?>" method="post">
+ − 2498
+ − 2499 <p>
+ − 2500 What type of block should this be?
+ − 2501 </p>
+ − 2502 <p>
+ − 2503 <select name="type" onchange="setType(this)"> <?php /* (NOT WORKING, at least in firefox 2) onload="var thingy = this; setTimeout('setType(thingy)', 500);" */ ?>
+ − 2504 <option value="<?php echo BLOCK_WIKIFORMAT; ?>">Wiki-formatted block</option>
+ − 2505 <option value="<?php echo BLOCK_TEMPLATEFORMAT; ?>">Template-formatted block (old pre-beta 3 behavior)</option>
+ − 2506 <option value="<?php echo BLOCK_HTML; ?>">Raw HTML block</option>
+ − 2507 <option value="<?php echo BLOCK_PHP; ?>">PHP code block (danger, Will Robinson!)</option>
+ − 2508 <option value="<?php echo BLOCK_PLUGIN; ?>">Use code from a plugin</option>
+ − 2509 </select>
+ − 2510 </p>
+ − 2511
+ − 2512 <p>
+ − 2513
+ − 2514 Block title: <input name="title" type="text" size="40" /><br />
+ − 2515 Which sidebar: <select name="sidebar_id"><option value="<?php echo SIDEBAR_LEFT; ?>">Left</option><option value="<?php echo SIDEBAR_RIGHT; ?>">Right</option></select>
+ − 2516
+ − 2517 </p>
+ − 2518
+ − 2519 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_WIKIFORMAT; ?>">
+ − 2520 <p>
+ − 2521 Wikitext:
+ − 2522 </p>
+ − 2523 <p>
+ − 2524 <textarea style="width: 98%;" name="wikiformat_content" rows="15" cols="50"></textarea>
+ − 2525 </p>
+ − 2526 </div>
+ − 2527
+ − 2528 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_TEMPLATEFORMAT; ?>">
+ − 2529 <p>
+ − 2530 Template code:
+ − 2531 </p>
+ − 2532 <p>
+ − 2533 <textarea style="width: 98%;" name="templateformat_content" rows="15" cols="50"></textarea>
+ − 2534 </p>
+ − 2535 </div>
+ − 2536
+ − 2537 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_HTML; ?>">
+ − 2538 <p>
+ − 2539 HTML to place inside the sidebar:
+ − 2540 </p>
+ − 2541 <p>
+ − 2542 <textarea style="width: 98%;" name="html_content" rows="15" cols="50"></textarea>
+ − 2543 </p>
+ − 2544 </div>
+ − 2545
+ − 2546 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PHP; ?>">
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2547 <?php if ( defined('ENANO_DEMO_MODE') ) { ?>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2548 <p>Creating PHP blocks in demo mode is disabled for security reasons.</p>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2549 <?php } else { ?>
0
+ − 2550 <p>
+ − 2551 <b>WARNING:</b> If you don't know what you're doing, or if you are not fluent in PHP, stop now and choose a different block type. You will brick your Enano installation if you are not careful here.
+ − 2552 ALWAYS remember to write secure code! The Enano team is not responsible if someone drops all your tables because of an SQL injection vulnerability in your sidebar code. You are probably better off using the template-formatted block type.
+ − 2553 </p>
+ − 2554 <p>
+ − 2555 <span style="color: red;">
+ − 2556 It is especially important to note that this code is NOT checked for errors! If there is a syntax error in your code here, it will prevent any pages from loading AT ALL. So you need to use an external PHP editor (like <a href="http://www.jedit.org">jEdit</a>) to check your syntax before you hit save.
+ − 2557 </span> You have been warned.
+ − 2558 </p>
+ − 2559 <p>
+ − 2560 Also, you should avoid using output buffering functions (ob_[start|end|get_contents|clean]) here, because Enano uses those to track output from this script.
+ − 2561 </p>
+ − 2562 <p>
+ − 2563 The standard <?php and ?> tags work here. Don't use an initial "<?php" or it will cause a parse error.
+ − 2564 </p>
+ − 2565 <p>
+ − 2566 PHP code:
+ − 2567 </p>
+ − 2568 <p>
+ − 2569 <textarea style="width: 98%;" name="php_content" rows="15" cols="50"></textarea>
+ − 2570 </p>
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2571 <?php } ?>
0
+ − 2572 </div>
+ − 2573
+ − 2574 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PLUGIN; ?>">
+ − 2575 <p>
+ − 2576 Plugin:
+ − 2577 </p>
+ − 2578 <p>
+ − 2579 <select name="plugin_id">
+ − 2580 <?php
+ − 2581 foreach($template->plugin_blocks as $k => $c)
+ − 2582 {
+ − 2583 echo '<option value="'.$k.'">'.$k.'</option>';
+ − 2584 }
+ − 2585 ?>
+ − 2586 </select>
+ − 2587 </p>
+ − 2588 </div>
+ − 2589
+ − 2590 <p>
+ − 2591
+ − 2592 <input type="submit" name="create" value="Create new block" style="font-weight: bold;" />
+ − 2593 <input type="submit" name="cancel" value="Cancel" />
+ − 2594
+ − 2595 </p>
+ − 2596
+ − 2597 </form>
+ − 2598
+ − 2599 <script type="text/javascript">
+ − 2600 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2601 for(var i in divs)
+ − 2602 {
+ − 2603 if(divs[i].id != 'blocktype_<?php echo BLOCK_WIKIFORMAT; ?>') setTimeout("document.getElementById('"+divs[i].id+"').style.display = 'none';", 500);
+ − 2604 }
+ − 2605 </script>
+ − 2606
+ − 2607 <?php
+ − 2608 $template->footer();
+ − 2609 return;
+ − 2610 break;
+ − 2611 case 'move':
+ − 2612 if( !isset($_GET['side']) || ( isset($_GET['side']) && !preg_match('#^([0-9]+)$#', $_GET['side']) ) )
+ − 2613 {
+ − 2614 echo '<div class="warning-box" style="margin: 10px 0;">$_GET[\'side\'] contained an SQL injection attempt</div>';
+ − 2615 break;
+ − 2616 }
+ − 2617 $query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2618 if(!$query)
+ − 2619 {
+ − 2620 echo $db->get_error();
+ − 2621 $template->footer();
+ − 2622 exit;
+ − 2623 }
+ − 2624 echo '<div class="info-box" style="margin: 10px 0;">Item moved.</div>';
+ − 2625 break;
+ − 2626 case 'delete':
+ − 2627 $query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); // Already checked for injection attempts ;-)
+ − 2628 if(!$query)
+ − 2629 {
+ − 2630 echo $db->get_error();
+ − 2631 $template->footer();
+ − 2632 exit;
+ − 2633 }
+ − 2634 if(isset($_GET['ajax']))
+ − 2635 {
+ − 2636 ob_end_clean();
+ − 2637 die('GOOD');
+ − 2638 }
+ − 2639 echo '<div class="error-box" style="margin: 10px 0;">Item deleted.</div>';
+ − 2640 break;
+ − 2641 case 'disenable';
+ − 2642 $q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2643 if(!$q)
+ − 2644 {
+ − 2645 echo $db->get_error();
+ − 2646 $template->footer();
+ − 2647 exit;
+ − 2648 }
+ − 2649 $r = $db->fetchrow();
+ − 2650 $db->free_result();
+ − 2651 $e = ( $r['item_enabled'] == 1 ) ? '0' : '1';
+ − 2652 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2653 if(!$q)
+ − 2654 {
+ − 2655 echo $db->get_error();
+ − 2656 $template->footer();
+ − 2657 exit;
+ − 2658 }
+ − 2659 if(isset($_GET['ajax']))
+ − 2660 {
+ − 2661 ob_end_clean();
+ − 2662 die('GOOD');
+ − 2663 }
+ − 2664 break;
+ − 2665 case 'getsource':
+ − 2666 $q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2667 if(!$q)
+ − 2668 {
+ − 2669 echo $db->get_error();
+ − 2670 $template->footer();
+ − 2671 exit;
+ − 2672 }
+ − 2673 ob_end_clean();
+ − 2674 $r = $db->fetchrow();
+ − 2675 $db->free_result();
+ − 2676 if($r['block_type'] == BLOCK_PLUGIN) die('HOUSTON_WE_HAVE_A_PLUGIN');
+ − 2677 die($r['block_content']);
+ − 2678 break;
+ − 2679 case 'save':
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2680 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2681 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2682 $q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2683 if(!$q)
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2684 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2685 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2686 exit;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2687 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2688 $row = $db->fetchrow();
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2689 if ( $row['block_type'] == BLOCK_PHP )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2690 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2691 $_POST['content'] = '?><Nulled>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2692 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2693 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2694 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2695 $_POST['content'] = sanitize_html($_POST['content'], true);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2696 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2697 }
0
+ − 2698 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2699 if(!$q)
+ − 2700 {
+ − 2701 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2702 exit;
+ − 2703 }
+ − 2704 $q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2705 if(!$q)
+ − 2706 {
+ − 2707 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2708 exit;
+ − 2709 }
+ − 2710 $row = $db->fetchrow();
+ − 2711 $db->free_result();
+ − 2712 switch($row['block_type'])
+ − 2713 {
+ − 2714 case BLOCK_WIKIFORMAT:
+ − 2715 default:
+ − 2716 $c = RenderMan::render($row['block_content']);
+ − 2717 break;
+ − 2718 case BLOCK_TEMPLATEFORMAT:
+ − 2719 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2720 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2721 break;
+ − 2722 case BLOCK_HTML:
+ − 2723 $c = $row['block_content'];
+ − 2724 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2725 break;
+ − 2726 case BLOCK_PHP:
+ − 2727 ob_start();
+ − 2728 eval($row['block_content']);
+ − 2729 $c = ob_get_contents();
+ − 2730 ob_end_clean();
+ − 2731 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2732 break;
+ − 2733 case BLOCK_PLUGIN:
+ − 2734 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2735 break;
+ − 2736 }
+ − 2737 die('var status = \'GOOD\'; var content = unescape(\''.hexencode($c).'\');');
+ − 2738 break;
+ − 2739 }
+ − 2740 }
+ − 2741
+ − 2742 $q = $db->sql_query('SELECT item_id,sidebar_id,item_enabled,block_name,block_type,block_content FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2743 if(!$q) $db->_die('The sidebar text data could not be selected.');
+ − 2744
+ − 2745 $vars = $template->extract_vars('sidebar-editor.tpl');
+ − 2746
+ − 2747 $parser = $template->makeParserText($vars['sidebar_button']);
+ − 2748 $parser->assign_vars(Array(
+ − 2749 'HREF'=>'#',
+ − 2750 'FLAGS'=>'onclick="return false;"',
+ − 2751 'TEXT'=>'Change theme'
+ − 2752 ));
+ − 2753 $template->tpl_strings['THEME_LINK'] = $parser->run();
+ − 2754 $parser->assign_vars(Array(
+ − 2755 'TEXT'=>'Log out',
+ − 2756 ));
+ − 2757 $template->tpl_strings['LOGOUT_LINK'] = $parser->run();
+ − 2758
+ − 2759 $n1 = Array();
+ − 2760 $n2 = Array();
+ − 2761 $n =& $n1;
+ − 2762
+ − 2763 echo '<table border="0"><tr><td valign="top"><div class="dbx-group" id="sbedit_left">';
+ − 2764 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2765
+ − 2766 // Time for the loop
+ − 2767 // what this loop does is fetch the row data, then send it out to the appropriate parser for formatting,
+ − 2768 // then puts the result into $c, which is then sent to the template compiler for insertion into the TPL code.
+ − 2769 while($row = $db->fetchrow())
+ − 2770 {
+ − 2771 if(isset($current_side))
+ − 2772 {
+ − 2773 if($current_side != $row['sidebar_id'])
+ − 2774 {
+ − 2775 // Time to switch!
+ − 2776 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2777 echo '</div></td><td valign="top"><div class="dbx-group" id="sbedit_right">';
+ − 2778 //echo '</td><td valign="top">';
+ − 2779 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2780 $n =& $n2;
+ − 2781 }
+ − 2782 }
+ − 2783 $n[] = count($n);
+ − 2784 $current_side = $row['sidebar_id'];
+ − 2785 switch($row['block_type'])
+ − 2786 {
+ − 2787 case BLOCK_WIKIFORMAT:
+ − 2788 default:
+ − 2789 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2790 $c = RenderMan::render($row['block_content']);
+ − 2791 break;
+ − 2792 case BLOCK_TEMPLATEFORMAT:
+ − 2793 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2794 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2795 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2796 break;
+ − 2797 case BLOCK_HTML:
+ − 2798 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2799 $c = $row['block_content'];
+ − 2800 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2801 break;
+ − 2802 case BLOCK_PHP:
+ − 2803 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2804 ob_start();
+ − 2805 eval($row['block_content']);
+ − 2806 $c = ob_get_contents();
+ − 2807 ob_end_clean();
+ − 2808 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2809 break;
+ − 2810 case BLOCK_PLUGIN:
+ − 2811 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2812 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2813 break;
+ − 2814 }
+ − 2815 $t = $template->tplWikiFormat($row['block_name']);
+ − 2816 if($row['item_enabled'] == 0) $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red;">(disabled)</span>';
+ − 2817 else $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red; display: none;">(disabled)</span>';
+ − 2818 $side = ( $row['sidebar_id'] == SIDEBAR_LEFT ) ? SIDEBAR_RIGHT : SIDEBAR_LEFT;
+ − 2819 $tb = '<a title="Enable or disable this block" href="'.makeUrl($paths->page, 'action=disenable&id='.$row['item_id'].'' , true).'" onclick="ajaxDisenableBlock(\''.$row['item_id'].'\'); return false;" ><img alt="Enable/disable this block" style="border-width: 0;" src="'.scriptPath.'/images/disenable.png" /></a>
+ − 2820 <a title="Edit the contents of this block" href="'.makeUrl($paths->page, 'action=edit&id='.$row['item_id'].'' , true).'" onclick="ajaxEditBlock(\''.$row['item_id'].'\', this); return false;"><img alt="Edit this block" style="border-width: 0;" src="'.scriptPath.'/images/edit.png" /></a>
+ − 2821 <a title="Permanently delete this block" href="'.makeUrl($paths->page, 'action=delete&id='.$row['item_id'].'' , true).'" onclick="if(confirm(\'Do you really want to delete this block?\')) { ajaxDeleteBlock(\''.$row['item_id'].'\', this); } return false;"><img alt="Delete this block" style="border-width: 0;" src="'.scriptPath.'/images/delete.png" /></a>
+ − 2822 <a title="Move this block to the other sidebar" href="'.makeUrl($paths->page, 'action=move&id='.$row['item_id'].'&side='.$side, true).'"><img alt="Move this block" style="border-width: 0;" src="'.scriptPath.'/images/move.png" /></a>';
+ − 2823 $as = '';
+ − 2824 $ae = ' '.$tb;
+ − 2825 $parser->assign_vars(Array('CONTENT'=>$c,'TITLE'=>$t,'ADMIN_START'=>$as,'ADMIN_END'=>$ae));
+ − 2826 echo $parser->run();
+ − 2827 unset($parser);
+ − 2828
+ − 2829 }
+ − 2830 $db->free_result();
+ − 2831 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2832 echo '</div></td></tr></table>';
+ − 2833 echo '<form action="'.makeUrl($paths->page).'" method="post">';
+ − 2834 $order = implode(',', $n1);
+ − 2835 echo "<input type='hidden' id='divOrder_Left' name='order_left' value='{$order}' />";
+ − 2836 $order = implode(',', $n2);
+ − 2837 echo "<input type='hidden' id='divOrder_Right' name='order_right' value='{$order}' />";
+ − 2838 echo '
+ − 2839 <div style="margin: 0 auto 0 auto; text-align: center;">
+ − 2840 <input type="submit" name="save" style="font-weight: bold;" value="Save changes" />
+ − 2841 <input type="submit" name="revert" style="font-weight: normal;" value="Revert" onclick="return confirm(\'Do you really want to revert your changes?\nNote: this does not revert edits or deletions, those are saved as soon as you confirm the action.\')" />
+ − 2842 <br />
+ − 2843 <a href="'.makeUrl($paths->page, 'action=new&id=0', true).'">Create new block</a> | <a href="'.makeUrl(getConfig('main_page'), false, true).'">Main Page</a>
+ − 2844 </div>
+ − 2845 </form>
+ − 2846 ';
+ − 2847 }
+ − 2848
+ − 2849 $template->footer();
+ − 2850 }
+ − 2851
+ − 2852 ?>