0
+ − 1 <?php
+ − 2 /*
+ − 3 Plugin Name: Runt - the Enano administration panel
+ − 4 Plugin URI: http://enanocms.org/
+ − 5 Description: Provides the page Special:Administration, which is the AJAX frontend to the various Admin:
+ − 6 Author: Dan Fuhry
+ − 7 Version: 1.0
+ − 8 Author URI: http://enanocms.org/
+ − 9 */
+ − 10
+ − 11 /*
+ − 12 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
27
dd659f6ba891
Converting all tables on new installations to UTF-8; this may break MySQL 4.0 compatibility; several minor cosmetic fixes; set Powered button under Links to "on" by default
Dan
diff
changeset
+ − 13 * Version 1.0 (Banshee)
0
+ − 14 * Copyright (C) 2006-2007 Dan Fuhry
+ − 15 *
+ − 16 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 17 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 18 *
+ − 19 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 20 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 21 */
+ − 22
+ − 23 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 24
+ − 25 $plugins->attachHook('base_classes_initted', '
+ − 26 global $paths;
+ − 27 $paths->add_page(Array(
+ − 28 \'name\'=>\'Administration\',
+ − 29 \'urlname\'=>\'Administration\',
+ − 30 \'namespace\'=>\'Special\',
+ − 31 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 32 ));
+ − 33
+ − 34 $paths->add_page(Array(
+ − 35 \'name\'=>\'Manage the Sidebar\',
+ − 36 \'urlname\'=>\'EditSidebar\',
+ − 37 \'namespace\'=>\'Special\',
+ − 38 \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',
+ − 39 ));
+ − 40 ');
+ − 41
+ − 42 // function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>
+ − 43
+ − 44 function page_Admin_Home() {
+ − 45 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 46 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 47 {
+ − 48 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 49 return;
+ − 50 }
+ − 51
+ − 52
+ − 53 // Basic information
+ − 54 echo RenderMan::render(
+ − 55 '== Welcome to Runt, the Enano administration panel. ==
+ − 56
+ − 57 Thank you for choosing Enano as your CMS. This screen allows you to see some information about your website, plus some details about how your site is doing statistically.
+ − 58
+ − 59 Using the links on the left you can control every aspect of your website\'s look and feel, plus you can manage users, work with pages, and install plugins to make your Enano installation even better.');
+ − 60
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 61 // Demo mode
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 62 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 63 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 64 echo '<h3>Enano is running in demo mode.</h3>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 65 <p>If you borked something up, or if you\'re done testing, you can <a href="' . makeUrlNS('Special', 'DemoReset', false, true) . '">reset this site</a>. The site is reset automatically once every two hours. When a reset is performed, all custom modifications to the site are lost and replaced with default values.</p>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 66 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 67
0
+ − 68 // Check for the installer scripts
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 69 if( ( file_exists(ENANO_ROOT.'/install.php') || file_exists(ENANO_ROOT.'/schema.sql') ) && !defined('ENANO_DEMO_MODE') )
0
+ − 70 {
+ − 71 echo '<div class="error-box"><b>NOTE:</b> It appears that your install.php and/or schema.sql files still exist. It is HIGHLY RECOMMENDED that you delete or rename these files, to prevent getting your server hacked.</div>';
+ − 72 }
+ − 73
+ − 74 // Inactive users
+ − 75 $q = $db->sql_query('SELECT * FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\';');
+ − 76 if($q)
+ − 77 if($db->numrows() > 0)
+ − 78 {
+ − 79 $n = $db->numrows();
+ − 80 if($n == 1) $s = $n . ' user is';
+ − 81 else $s = $n . ' users are';
+ − 82 echo '<div class="warning-box">It appears that '.$s.' awaiting account activation. You can activate those accounts by going to the <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'UserManager\'); return false;">User Manager</a>.</div>';
+ − 83 }
+ − 84 $db->free_result();
+ − 85 // Stats
+ − 86 if(getConfig('log_hits') == '1')
+ − 87 {
+ − 88 $stats = stats_top_pages(10);
+ − 89 $c = 0;
+ − 90 $cls = 'row2';
+ − 91 echo '<h3>Most requested pages</h3><div class="tblholder"><table style="width: 100%;" border="0" cellspacing="1" cellpadding="4"><tr><th>Page</th><th>Hits</th></tr>';
+ − 92 foreach($stats as $page => $count)
+ − 93 {
+ − 94 if(isset($paths->pages[$page]))
+ − 95 {
+ − 96 echo '<tr>';
+ − 97 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 98 echo '<td class="'.$cls.'"><a href="'.makeUrl($page).'">'.$paths->pages[$page]['name'].'</a></td><td style="text-align: center;" class="'.$cls.'">'.$count.'</td>';
+ − 99 echo '</tr>';
+ − 100 }
+ − 101 }
+ − 102 echo '</table></div>';
+ − 103 }
+ − 104
+ − 105 // Security log
+ − 106 echo '<h3>Security log</h3>';
+ − 107 echo '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">';
+ − 108 $cls = 'row2';
+ − 109 echo '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>';
20
+ − 110 require('config.php');
+ − 111 $hash = md5($dbpasswd);
+ − 112 unset($dbname, $dbhost, $dbuser, $dbpasswd);
+ − 113 unset($dbname, $dbhost, $dbuser, $dbpasswd); // PHP5 Zend bug
+ − 114 if ( defined('ENANO_DEMO_MODE') && !isset($_GET[ $hash ]) )
0
+ − 115 {
20
+ − 116 echo '<tr><td class="row1" colspan="4">Logs are recorded but not displayed for privacy purposes in the demo.</td></tr>';
0
+ − 117 }
+ − 118 else
+ − 119 {
20
+ − 120 if(isset($_GET['fulllog']))
+ − 121 {
+ − 122 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;';
+ − 123 }
+ − 124 else
+ − 125 {
+ − 126 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT 5';
+ − 127 }
+ − 128 $q = $db->sql_query($l);
+ − 129 while($r = $db->fetchrow())
+ − 130 {
+ − 131 if($cls == 'row2') $cls = 'row1';
+ − 132 else $cls = 'row2';
+ − 133 echo '<tr><td class="'.$cls.'">';
+ − 134 switch($r['action']) {
+ − 135 case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Authentication level: $level</small>"; } break;
+ − 136 case "admin_auth_bad": echo 'Failed elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Attempted auth level: $level</small>"; } break;
+ − 137 case "activ_good": echo 'Successful account activation'; break;
+ − 138 case "auth_good": echo 'Successful regular user logon'; break;
+ − 139 case "activ_bad": echo 'Failed account activation'; break;
+ − 140 case "auth_bad": echo 'Failed regular user logon'; break;
+ − 141 case "sql_inject": echo 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break;
+ − 142 case "db_backup": echo 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break;
+ − 143 case "install_enano": echo "Installed Enano version {$r['page_text']}"; break;
+ − 144 }
+ − 145 echo '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>';
+ − 146 }
+ − 147 $db->free_result();
0
+ − 148 }
+ − 149 echo '</table></div>';
+ − 150 if(!isset($_GET['fulllog'])) echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'Home&fulllog\'); return false;">Full security log</a></p>';
+ − 151
+ − 152 }
+ − 153
+ − 154 function page_Admin_GeneralConfig() {
+ − 155 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 156 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 157 {
+ − 158 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 159 return;
+ − 160 }
+ − 161
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 162 if(isset($_POST['submit']) && !defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 163 {
0
+ − 164
+ − 165 // Global site options
+ − 166 setConfig('site_name', $_POST['site_name']);
+ − 167 setConfig('site_desc', $_POST['site_desc']);
+ − 168 setConfig('main_page', str_replace(' ', '_', $_POST['main_page']));
+ − 169 setConfig('copyright_notice', $_POST['copyright']);
+ − 170 setConfig('contact_email', $_POST['contact_email']);
+ − 171
+ − 172 // Wiki mode
+ − 173 if(isset($_POST['wikimode'])) setConfig('wiki_mode', '1');
+ − 174 else setConfig('wiki_mode', '0');
+ − 175 if(isset($_POST['wiki_mode_require_login'])) setConfig('wiki_mode_require_login', '1');
+ − 176 else setConfig('wiki_mode_require_login', '0');
+ − 177 if(isset($_POST['editmsg'])) setConfig('wiki_edit_notice', '1');
+ − 178 else setConfig('wiki_edit_notice', '0');
+ − 179 setConfig('wiki_edit_notice_text', $_POST['editmsg_text']);
+ − 180
+ − 181 // Stats
+ − 182 if(isset($_POST['log_hits'])) setConfig('log_hits', '1');
+ − 183 else setConfig('log_hits', '0');
+ − 184
+ − 185 // Disablement
+ − 186 if(isset($_POST['site_disabled'])) { setConfig('site_disabled', '1'); setConfig('site_disabled_notice', $_POST['site_disabled_notice']); }
+ − 187 else setConfig('site_disabled', '0');
+ − 188
+ − 189 // Account activation
+ − 190 setConfig('account_activation', $_POST['account_activation']);
+ − 191
+ − 192 // W3C compliance buttons
+ − 193 if(isset($_POST['w3c-vh32'])) setConfig("w3c_vh32", "1");
+ − 194 else setConfig("w3c_vh32", "0");
+ − 195 if(isset($_POST['w3c-vh40'])) setConfig("w3c_vh40", "1");
+ − 196 else setConfig("w3c_vh40", "0");
+ − 197 if(isset($_POST['w3c-vh401'])) setConfig("w3c_vh401", "1");
+ − 198 else setConfig("w3c_vh401", "0");
+ − 199 if(isset($_POST['w3c-vxhtml10'])) setConfig("w3c_vxhtml10", "1");
+ − 200 else setConfig("w3c_vxhtml10", "0");
+ − 201 if(isset($_POST['w3c-vxhtml11'])) setConfig("w3c_vxhtml11", "1");
+ − 202 else setConfig("w3c_vxhtml11", "0");
+ − 203 if(isset($_POST['w3c-vcss'])) setConfig("w3c_vcss", "1");
+ − 204 else setConfig("w3c_vcss", "0");
+ − 205
+ − 206 // SourceForge.net logo
+ − 207 if(isset($_POST['showsf'])) setConfig('sflogo_enabled', '1');
+ − 208 else setConfig('sflogo_enabled', '0');
+ − 209 setConfig('sflogo_groupid', $_POST['sfgroup']);
+ − 210 setConfig('sflogo_type', $_POST['sflogo']);
+ − 211
+ − 212 // Comment options
+ − 213 if(isset($_POST['comment-approval'])) setConfig('approve_comments', '1');
+ − 214 else setConfig('approve_comments', '0');
+ − 215 if(isset($_POST['enable-comments'])) setConfig('enable_comments', '1');
+ − 216 else setConfig('enable_comments', '0');
+ − 217 setConfig('comments_need_login', $_POST['comments_need_login']);
+ − 218
+ − 219 // Powered by link
+ − 220 if ( isset($_POST['enano_powered_link']) ) setConfig('powered_btn', '1');
+ − 221 else setConfig('powered_btn', '0');
+ − 222
+ − 223 if(isset($_POST['dbdbutton'])) setConfig('dbd_button', '1');
+ − 224 else setConfig('dbd_button', '0');
+ − 225
+ − 226 if($_POST['emailmethod'] == 'phpmail') setConfig('smtp_enabled', '0');
+ − 227 else setConfig('smtp_enabled', '1');
+ − 228
+ − 229 setConfig('smtp_server', $_POST['smtp_host']);
+ − 230 setConfig('smtp_user', $_POST['smtp_user']);
+ − 231 if($_POST['smtp_pass'] != 'XXXXXXXXXXXX') setConfig('smtp_password', $_POST['smtp_pass']);
+ − 232
+ − 233 echo '<div class="info-box">Your changes to the site configuration have been saved.</div><br />';
+ − 234
+ − 235 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 236 else if ( isset($_POST['submit']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 237 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 238 echo '<div class="error-box">Saving the general site configuration is blocked in the administration demo.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 239 }
0
+ − 240 echo('<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post" onsubmit="if(!submitAuthorized) return false;">');
+ − 241 ?>
+ − 242 <div class="tblholder">
+ − 243 <table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 244
+ − 245 <!-- Global options -->
+ − 246
+ − 247 <tr><th colspan="2">Global site options</th></tr>
+ − 248 <tr><th colspan="2" class="subhead">These options control the entire site.</th></tr>
+ − 249
30
+ − 250 <tr><td class="row1" style="width: 50%;">Site name:</td> <td class="row1" style="width: 50%;"><input type="text" name="site_name" size="30" value="<?php echo getConfig('site_name'); ?>" /></td></tr>
+ − 251 <tr><td class="row2">Site description:</td> <td class="row2"><input type="text" name="site_desc" size="30" value="<?php echo getConfig('site_desc'); ?>" /></td></tr>
0
+ − 252 <tr><td class="row1">Main page:</td> <td class="row1"><?php echo $template->pagename_field('main_page', str_replace('_', ' ', getConfig('main_page'))); ?></td></tr>
30
+ − 253 <tr><td class="row2">Copyright notice shown on pages:</td><td class="row2"><input type="text" name="copyright" size="30" value="<?php echo getConfig('copyright_notice'); ?>" /></td></tr>
0
+ − 254 <tr><td class="row1" colspan="2">Hint: If you're using Windows, you can make a "©" symbol by holding ALT and pressing 0169 on the numeric keypad.</td></tr>
+ − 255 <tr><td class="row2">Contact e-mail<br /><small>All e-mail sent from this site will appear to have come from the address shown here.</small></td><td class="row2"><input name="contact_email" type="text" size="40" value="<?php echo htmlspecialchars(getConfig('contact_email')); ?>" /></td></tr>
+ − 256
+ − 257 <!-- Wiki mode -->
+ − 258
+ − 259 <tr><th colspan="2">Wiki mode</th></tr>
+ − 260
+ − 261 <tr>
+ − 262 <td class="row3" rowspan="2">
+ − 263 Enano can also act as a wiki, meaning anyone can edit and create pages. To enable Wiki Mode, check the box to the right.<br /><br />
+ − 264 In Wiki Mode, certain HTML tags such as <script> and <object> are disabled, and all PHP code is disabled, except if the person editing the page is an administrator.<br /><br />
+ − 265 Also, Enano keeps complete page history, which makes restoring vandalized pages easy. You can also protect pages so that they cannot be edited.
+ − 266 </td>
+ − 267 <td class="row1">
+ − 268 <input type="checkbox" name="wikimode" id="wikimode" <?php if(getConfig('wiki_mode')=='1') echo('CHECKED '); ?> /><label for="wikimode">Enable Wiki Mode</label>
+ − 269 </td>
+ − 270 </tr>
+ − 271
+ − 272 <tr><td class="row2"><label><input type="checkbox" name="wiki_mode_require_login"<?php if(getConfig('wiki_mode_require_login')=='1') echo('CHECKED '); ?>/> Only for logged in users</label></td></tr>
+ − 273
+ − 274 <tr>
+ − 275 <td class="row3" rowspan="2">
+ − 276 <b>Edit page notice</b><br />
+ − 277 When Wiki Mode is enabled, anyone can edit pages. Check the box below and enter a message to display it whenever the page editor is opened.
+ − 278 </td>
+ − 279 <td class="row1">
+ − 280 <input onclick="if(this.checked) document.getElementById('editmsg_text').style.display='block'; else document.getElementById('editmsg_text').style.display='none';" type="checkbox" name="editmsg" id="editmsg" <?php if(getConfig('wiki_edit_notice')=='1') echo('CHECKED '); ?>/> <label for="editmsg">Show a message whenever pages are edited</label>
+ − 281 </td>
+ − 282 </tr>
+ − 283
+ − 284 <tr>
+ − 285 <td class="row2">
+ − 286 <textarea <?php if(getConfig('wiki_edit_notice')!='1') echo('style="display:none" '); ?>rows="5" cols="30" name="editmsg_text" id="editmsg_text"><?php echo getConfig('wiki_edit_notice_text'); ?></textarea>
+ − 287 </td>
+ − 288 </tr>
+ − 289
+ − 290 <!-- Site statistics -->
+ − 291
+ − 292 <tr><th colspan="2">Statistics and hit counting</th></tr>
+ − 293
+ − 294 <tr>
+ − 295 <td class="row1">Enano has the ability to show statistics for every page on the site. This allows you to keep very close track of who is visiting your site, and from where.<br /><br />Unfortunately, some users don't like being logged. For this reason, you should state clearly what is logged (usually the username or IP address, current time, page name, and referer URL) in your privacy policy. If your site is primarily geared towards children, and you are a United States citizen, you are required to have a privacy policy stating exactly what is being logged under the terms of the Childrens' Online Privacy Protection Act.</td>
+ − 296 <td class="row1"><label><input type="checkbox" name="log_hits" <?php if(getConfig('log_hits') == '1') echo 'checked="checked" '; ?>/> Log all page hits</label><br /><small>This excludes special and administration pages.</small></td>
+ − 297 </tr>
+ − 298
+ − 299 <!-- Comment options -->
+ − 300
+ − 301 <tr><th colspan="2">Comment system</th></tr>
+ − 302 <tr><td class="row1"><label for="enable-comments"><b>Enable the comment system</b></label> </td><td class="row1"><input name="enable-comments" id="enable-comments" type="checkbox" <?php if(getConfig('enable_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 303 <tr><td class="row2"><label for="comment-approval">Require approval before article comments can be shown</label></td><td class="row2"><input name="comment-approval" id="comment-approval" type="checkbox" <?php if(getConfig('approve_comments')=='1') echo('CHECKED '); ?>/></td></tr>
+ − 304 <tr><td class="row1">Guest comment posting allowed </td><td class="row1"><label><input name="comments_need_login" type="radio" value="0" <?php if(getConfig('comments_need_login')=='0') echo 'CHECKED '; ?>/> Yes</label>
+ − 305 <label><input name="comments_need_login" type="radio" value="1" <?php if(getConfig('comments_need_login')=='1') echo 'CHECKED '; ?>/> Require visual confirmation</label>
+ − 306 <!-- Default permissions --> <label><input name="comments_need_login" type="radio" value="2" <?php if(getConfig('comments_need_login')=='2') echo 'CHECKED '; ?>/> No (require login)</label></td></tr>
+ − 307
+ − 308 <!--
+ − 309
+ − 310 READ: Do not try to enable this, backend support for it has been disabled. To edit default
+ − 311 permissions, select The Entire Website in any permissions editor window.
+ − 312
+ − 313 <tr><th colspan="2">Default permissions for pages</th></tr>
+ − 314
+ − 315 <tr>
+ − 316 <td class="row1">You can edit the default set of permissions used when no other permissions are available. Permissions set here are used when no other permissions are available. As with other ACL rules, you can assign these defaults to every user or one specific user or group.</td>
+ − 317 <td class="row1"><a href="#" onclick="ajaxOpenACLManager('__DefaultPermissions', 'Special'); return false;">Manage default permissions</a></td>
+ − 318 </tr>
+ − 319
+ − 320 -->
+ − 321
+ − 322 <!-- enanocms.org link -->
+ − 323
+ − 324 <tr>
+ − 325 <th colspan="2">Promote Enano</th>
+ − 326 </tr>
+ − 327 <tr>
+ − 328 <td class="row3">
+ − 329 If you think Enano is nice, or if you want to show your support for the Enano team, you can do so by placing a link to the Enano
+ − 330 homepage in your Links sidebar block. You absolutely don't have to do this, and you won't get degraded support if you don't. Because
+ − 331 Enano is still relatively new in the CMS world, it needs all the attention it can get - and you can easily help to spread the word
+ − 332 using this link.
+ − 333 </td>
+ − 334 <td class="row1">
+ − 335 <label>
+ − 336 <input name="enano_powered_link" type="checkbox" <?php if(getConfig('powered_btn') == '1') echo 'checked="checked"'; ?> /> Place a link to www.enanocms.org on the sidebar
+ − 337 </label>
+ − 338 </td>
+ − 339 </tr>
+ − 340
+ − 341 <!-- Site disablement -->
+ − 342
+ − 343 <tr><th colspan="2">Disable all site access</th></tr>
+ − 344
+ − 345 <tr>
+ − 346 <td class="row3" rowspan="2">Disabling the site allows you to work on the site without letting non-administrators see or use it.</td>
+ − 347 <td class="row1"><label><input onclick="if(this.checked) document.getElementById('site_disabled_notice').style.display='block'; else document.getElementById('site_disabled_notice').style.display='none';" type="checkbox" name="site_disabled" <?php if(getConfig('site_disabled') == '1') echo 'checked="checked" '; ?>/> Disable this site</label></td>
+ − 348 </tr>
+ − 349 <tr>
+ − 350 <td class="row2">
30
+ − 351 <div id="site_disabled_notice"<?php if(getConfig('site_disabled')!='1') echo(' style="display:none"'); ?>>
0
+ − 352 Message to show to users:<br />
+ − 353 <textarea name="site_disabled_notice" rows="7" cols="30"><?php echo getConfig('site_disabled_notice'); ?></textarea>
+ − 354 </div>
+ − 355 </td>
+ − 356 </tr>
+ − 357
+ − 358 <!-- Account activation -->
+ − 359
+ − 360 <tr><th colspan="2">User account activation</th></tr>
+ − 361
+ − 362 <tr>
+ − 363 <td class="row3" colspan="2">
+ − 364 If you would like to require users to confirm their e-mail addresses by way of account activation, you can enable this behavior here. If this option is set to "None", users will be able to register and use this site without confirming their e-mail addresses. If this option is set to "User", users will automatically be sent e-mails upon registration with a link to activate their accounts. And lastly, if this option is set to "Admin", users' accounts will not be active until an administrator activates the account.<br /><br />
+ − 365 You may also disable registration completely if needed.<br /><br />
+ − 366 <b>Note: because of abuse by project administrators, sending account activation e-mails will not work on SourceForge.net servers.</b>
+ − 367 </td>
+ − 368 </tr>
+ − 369
+ − 370 <tr>
+ − 371 <td class="row1">Account activation:</td><td class="row1">
+ − 372 <?php
+ − 373 echo '<label><input'; if(getConfig('account_activation') == 'disable') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="disable" /> Disable registration</label><br />';
+ − 374 echo '<label><input'; if(getConfig('account_activation') != 'user' && getConfig('account_activation') != 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="none" /> None</label>';
+ − 375 echo '<label><input'; if(getConfig('account_activation') == 'user') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="user" /> User</label>';
+ − 376 echo '<label><input'; if(getConfig('account_activation') == 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="admin" /> Admin</label>';
+ − 377 ?>
+ − 378 </td>
+ − 379 </tr>
+ − 380
+ − 381 <!-- E-mail options -->
+ − 382
+ − 383 <tr><th colspan="2">E-mail sent from the site</th></tr>
+ − 384 <tr><td class="row1">E-mail sending method:<br /><small>Try using the built-in e-mail method first. If that doesn't work, you will need to enter valid SMTP information here.</small></td>
+ − 385 <td class="row1"><label><input <?php if(getConfig('smtp_enabled') != '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="phpmail" />PHP's built-in mail() function</label><br />
+ − 386 <label><input <?php if(getConfig('smtp_enabled') == '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="smtp" />Use an external SMTP server</label></td>
+ − 387 </tr>
+ − 388 <tr><td class="row2">SMTP hostname:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 389 <td class="row2"><input value="<?php echo getConfig('smtp_server'); ?>" name="smtp_host" type="text" size="30" /></td>
+ − 390 </tr>
+ − 391 <tr><td class="row1">SMTP credentials:<br /><small>This option only applies to the external SMTP mode.</small></td>
+ − 392 <td class="row1">Username: <input value="<?php echo getConfig('smtp_user'); ?>" name="smtp_user" type="text" size="30" /><br />
+ − 393 Password: <input value="<?php if(getConfig('smtp_password') != false) echo 'XXXXXXXXXXXX'; ?>" name="smtp_pass" type="password" size="30" /></td>
+ − 394 </tr>
+ − 395
+ − 396 <!-- SourceForge.net logo -->
+ − 397
+ − 398 <tr><th colspan="2">SourceForge.net logo</th></tr>
+ − 399
+ − 400 <tr>
+ − 401 <td colspan="2" class="row3">
+ − 402 All projects hosted by SourceForge.net are required to display an official SourceForge.net logo on their pages. If you want
+ − 403 to display a SourceForge.net logo on the sidebar, check the box below, enter your group ID, and select an image type.
+ − 404 </td>
+ − 405 </tr>
+ − 406
+ − 407 <?php
+ − 408 if(getConfig("sflogo_enabled")=='1') $c='CHECKED ';
+ − 409 else $c='';
+ − 410 if(getConfig("sflogo_groupid")) $g=getConfig("sflogo_groupid");
+ − 411 else $g='';
+ − 412 if(getConfig("sflogo_type")) $t=getConfig("sflogo_type");
+ − 413 else $t='1';
+ − 414 ?>
+ − 415
+ − 416 <tr>
+ − 417 <td class="row1">Display the SourceForge.net logo on the right sidebar</td>
+ − 418 <td class="row1"><input type=checkbox name="showsf" id="showsf" <?php echo $c; ?> /></td>
+ − 419 </tr>
+ − 420
+ − 421 <tr>
+ − 422 <td class="row2">Group ID:</td>
+ − 423 <td class="row2"><input value="<?php echo $g; ?>" type=text size=15 name=sfgroup /></td>
+ − 424 </tr>
+ − 425
+ − 426 <tr>
+ − 427 <td class="row1">Logo style:</td>
+ − 428 <td class="row1">
+ − 429 <select name="sflogo">
+ − 430 <option <?php if($t=='1') echo('SELECTED '); ?>value=1>88x31px, white</option>
+ − 431 <option <?php if($t=='2') echo('SELECTED '); ?>value=2>125x37px, white</option>
+ − 432 <option <?php if($t=='3') echo('SELECTED '); ?>value=3>125x37px, black</option>
+ − 433 <option <?php if($t=='4') echo('SELECTED '); ?>value=4>125x37px, blue</option>
+ − 434 <option <?php if($t=='5') echo('SELECTED '); ?>value=5>210x62px, white</option>
+ − 435 <option <?php if($t=='6') echo('SELECTED '); ?>value=6>210x62px, black</option>
+ − 436 <option <?php if($t=='7') echo('SELECTED '); ?>value=7>210x62px, blue</option>
+ − 437 </select>
+ − 438 </td>
+ − 439 </tr>
+ − 440
+ − 441 <!-- W3C validator buttons -->
+ − 442
+ − 443 <tr><th colspan="2">W3C compliance logos</th></tr>
+ − 444 <tr><th colspan="2" class="subhead">Enano generates (by default) Valid XHTML 1.1 code, plus valid CSS. If you want to show this off, check the appropriate boxes below.</th></tr>
+ − 445
+ − 446 <tr><td class="row1"><label for="w3c-vh32">HTML 3.2</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh32')=='1') echo('CHECKED '); ?> id="w3c-vh32" name="w3c-vh32" /></td></tr>
+ − 447 <tr><td class="row2"><label for="w3c-vh40">HTML 4.0</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vh40')=='1') echo('CHECKED '); ?> id="w3c-vh40" name="w3c-vh40" /></td></tr>
+ − 448 <tr><td class="row1"><label for="w3c-vh401">HTML 4.01</label> </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh401')=='1') echo('CHECKED '); ?> id="w3c-vh401" name="w3c-vh401" /></td></tr>
+ − 449 <tr><td class="row2"><label for="w3c-vxhtml10">XHTML 1.0</label></td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vxhtml10')=='1') echo('CHECKED '); ?> id="w3c-vxhtml10" name="w3c-vxhtml10" /></td></tr>
+ − 450 <tr><td class="row1"><label for="w3c-vxhtml11">XHTML 1.1</label></td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vxhtml11')=='1') echo('CHECKED '); ?> id="w3c-vxhtml11" name="w3c-vxhtml11" /></td></tr>
+ − 451 <tr><td class="row2"><label for="w3c-vcss">CSS</label> </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vcss')=='1') echo('CHECKED '); ?> id="w3c-vcss" name="w3c-vcss" /></td></tr>
+ − 452
+ − 453 <!-- DefectiveByDesign.org ad -->
+ − 454
+ − 455 <tr><th colspan="2">Defective By Design Anti-DRM button</th></tr>
+ − 456 <tr><td colspan="2" class="row3"><b>The Enano project is strongly against Digital Restrictions Management.</b> DRM removes the freedoms that every consumer should have: to freely copy and use digital media items they legally purchased to their own devices. Showing your opposition to DRM is as easy as checking the box below to place a link to <a href="http://www.defectivebydesign.org">DefectiveByDesign.org</a> on your sidebar.</td></tr>
+ − 457 <tr><td class="row1"><label for="dbdbutton">Help stop DRM by placing a link to DBD on the sidebar!</label></td><td class="row1"><input type="checkbox" name="dbdbutton" id="dbdbutton" <?php if(getConfig('dbd_button')=='1') echo('checked="checked" '); ?>/></td></tr>
+ − 458
+ − 459 <!-- Save button -->
+ − 460
+ − 461 <tr><th style="text-align: right" class="subhead" colspan="2"><input type=submit name=submit value="Save changes" /></th></tr>
+ − 462
+ − 463 </table>
+ − 464 </div>
+ − 465 </form>
+ − 466 <?php
+ − 467 }
+ − 468
+ − 469 function page_Admin_UploadConfig()
+ − 470 {
+ − 471 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 472 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 473 {
+ − 474 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 475 return;
+ − 476 }
+ − 477
+ − 478 if(isset($_POST['save']))
+ − 479 {
+ − 480 if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0');
+ − 481 if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0');
+ − 482 if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0');
+ − 483 if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0');
+ − 484 if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']);
+ − 485 else echo '<span style="color: red"><b>Warning:</b> the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.</span>';
+ − 486 $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']);
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 487 if ( $max_upload > 1048576 && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 488 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 489 echo '<div class="error-box">Wouldn\'t want the server DoS\'ed now. Stick to under a megabyte for the demo, please.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 490 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 491 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 492 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 493 setConfig('max_file_size', $max_upload.'');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 494 }
0
+ − 495 }
+ − 496 echo '<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post">';
+ − 497 ?>
+ − 498 <h3>File upload configuration</h3>
+ − 499 <p>Enano supports the ability to upload files to your website and store the files in the database. This enables you to embed images
+ − 500 and such into pages without manually writing the HTML. However, the upload feature can sometimes pose a risk to your site, as viruses
+ − 501 and executable files can sometimes be uploaded.</p>
+ − 502 <p><label><input type="checkbox" name="enable_uploads" <?php if(getConfig('enable_uploads')=='1') echo 'checked="checked"'; ?> /> <b>Enable file uploads</b></label></p>
+ − 503 <p>Maximum file size: <input name="max_file_size" onkeyup="if(!this.value.match(/^([0-9\.]+)$/ig)) this.value = this.value.substr(0,this.value.length-1);" value="<?php echo getConfig('max_file_size'); ?>" /> <select name="fs_units"><option value="1" selected="selected">bytes</option><option value="1024">KB</option><option value="1048576">MB</option></select></p>
+ − 504 <p>You can allow Enano to generate thumbnails of images automatically. This feature requires ImageMagick to work properly. If your server
+ − 505 does not have ImageMagick on it, Enano will simply make your users' browsers scale the images. In most cases this is fine, but if you
+ − 506 are uploading large (>100KB) images and embedding them inside of pages, you should try to enable ImageMagick because transferring these
+ − 507 large images many times can cost you quite a lot of bandwidth.</p>
+ − 508 <p><label><input type="checkbox" name="enable_imagemagick" <?php if(getConfig('enable_imagemagick')=='1') echo 'checked="checked"'; ?> /> Use ImageMagick to scale images</label><br />
+ − 509 Path to ImageMagick: <input type="text" name="imagemagick_path" value="<?php if(getConfig('imagemagick_path')) echo getConfig('imagemagick_path'); else echo '/usr/bin/convert'; ?>" /><br />
+ − 510 On Linux and Unix servers, the most likely options here are /usr/bin/convert and /usr/local/bin/convert. If you server runs Windows, then
+ − 511 ImageMagick is most likely to be C:\Windows\Convert.exe or C:\Windows\System32\Convert.exe.
+ − 512 </p>
+ − 513 <p>If you use ImageMagick to scale images, your server will be very busy constantly scaling images if your website is busy, and your site
+ − 514 may experience slowdowns. You can dramatically speed up this scaling process if you use a directory to cache thumbnail images.</p>
+ − 515 <p><b>Please note:</b> the cache/ directory on your server <u>must</u> be writable by the server. While this is not usually a problem on
+ − 516 Windows servers, most Linux/Unix servers will require you to CHMOD the cache/ directory to 777. See your FTP client's user guide for
+ − 517 more information on how to do this.<?php if(!is_writable(ENANO_ROOT.'/cache/')) echo ' <b>At present, it seems that the cache directory
+ − 518 is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p>
+ − 519 <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p>
+ − 520 <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious
+ − 521 changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option
+ − 522 enabled unless you have less than 250MB of MySQL database space.</p>
+ − 523 <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p>
+ − 524 <hr style="margin-left: 1em;" />
+ − 525 <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p>
+ − 526 <?php
+ − 527 echo '</form>';
+ − 528 }
+ − 529
+ − 530 function page_Admin_PluginManager() {
+ − 531 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 532 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 533 {
+ − 534 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 535 return;
+ − 536 }
+ − 537
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 538 if(isset($_GET['action']))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 539 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 540 switch($_GET['action'])
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 541 {
0
+ − 542 case "enable":
+ − 543 setConfig('plugin_'.$_GET['plugin'], '1');
+ − 544 break;
+ − 545 case "disable":
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 546 if ( defined('ENANO_DEMO_MODE') && strstr($_GET['plugin'], 'Demo') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 547 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 548 echo('<h3>Error disabling plugin</h3><p>The demo lockdown plugin cannot be disabled in demo mode.</p>');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 549 break;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 550 }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 551 if ( $_GET['plugin'] != 'SpecialAdmin.php' )
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 552 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 553 setConfig('plugin_'.$_GET['plugin'], '0');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 554 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 555 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 556 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 557 echo('<h3>Error disabling plugin</h3><p>The administration panel plugin cannot be disabled.</p>');
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 558 }
0
+ − 559 break;
+ − 560 }
+ − 561 }
+ − 562 $dir = './plugins/';
+ − 563 $plugin_list = Array();
+ − 564 $system = Array();
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 565
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 566 if (is_dir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 567 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 568 if ($dh = opendir($dir))
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 569 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 570 while (($file = readdir($dh)) !== false)
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 571 {
0
+ − 572 if(preg_match('#^(.*?)\.php$#is', $file) && $file != 'index.php')
+ − 573 {
+ − 574 if ( in_array($file, $plugins->system_plugins) )
+ − 575 {
+ − 576 $thelist =& $system;
+ − 577 continue;
+ − 578 }
+ − 579 else
+ − 580 {
+ − 581 $thelist =& $plugin_list;
+ − 582 }
+ − 583 $f = file_get_contents($dir . $file);
+ − 584 $f = explode("\n", $f);
+ − 585 $f = array_slice($f, 2, 7);
+ − 586 $f[0] = substr($f[0], 13, strlen($f[0]));
+ − 587 $f[1] = substr($f[1], 12, strlen($f[1]));
+ − 588 $f[2] = substr($f[2], 13, strlen($f[2]));
+ − 589 $f[3] = substr($f[3], 8, strlen($f[3]));
+ − 590 $f[4] = substr($f[4], 9, strlen($f[4]));
+ − 591 $f[5] = substr($f[5], 12, strlen($f[5]));
+ − 592 $thelist[$file] = Array();
+ − 593 $thelist[$file]['name'] = $f[0];
+ − 594 $thelist[$file]['uri'] = $f[1];
+ − 595 $thelist[$file]['desc'] = $f[2];
+ − 596 $thelist[$file]['auth'] = $f[3];
+ − 597 $thelist[$file]['vers'] = $f[4];
+ − 598 $thelist[$file]['aweb'] = $f[5];
+ − 599 }
+ − 600 }
+ − 601 closedir($dh);
+ − 602 }
9
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 603 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 604 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 605 echo '<div class="error-box">The plugins/ directory could not be opened.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 606 return;
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 607 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 608 }
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 609 else
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 610 {
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 611 echo '<div class="error-box">The plugins/ directory is missing from your Enano installation.</div>';
1e61232606d6
Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled
dan@fuhry
diff
changeset
+ − 612 return;
0
+ − 613 }
+ − 614 echo('<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">
+ − 615 <tr><th>Plugin filename</th><th>Plugin name</th><th>Description</th><th>Author</th><th>Version</th><th></th></tr>');
+ − 616 $plugin_files = array_keys($plugin_list);
+ − 617 $cls = 'row2';
+ − 618 for ( $i = 0; $i < sizeof($plugin_files); $i++ )
+ − 619 {
+ − 620 $cls = ( $cls == 'row2' ) ? 'row3' : 'row2';
+ − 621 echo '<tr>
+ − 622 <td class="'.$cls.'">'.$plugin_files[$i].'</td>
+ − 623 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['uri'].'">'.$plugin_list[$plugin_files[$i]]['name'].'</a></td>
+ − 624 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['desc'].'</td>
+ − 625 <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['aweb'].'">'.$plugin_list[$plugin_files[$i]]['auth'].'</a></td>
+ − 626 <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['vers'].'</td>
+ − 627 <td class="'.$cls.'">';
+ − 628 if ( getConfig('plugin_'.$plugin_files[$i]) == '1' )
+ − 629 {
+ − 630 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=disable&plugin='.$plugin_files[$i].'">Disable</a>';
+ − 631 }
+ − 632 else
+ − 633 {
+ − 634 echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&action=enable&plugin='.$plugin_files[$i].'">Enable</a>';
+ − 635 }
+ − 636 echo '</td></tr>';
+ − 637 }
+ − 638 echo '</table></div>';
+ − 639 }
+ − 640
+ − 641 function page_Admin_UploadAllowedMimeTypes()
+ − 642 {
+ − 643 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 644 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 645 {
+ − 646 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 647 return;
+ − 648 }
+ − 649
+ − 650 global $mime_types, $mimetype_exps, $mimetype_extlist;
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 651 if(isset($_POST['save']) && !defined('ENANO_DEMO_MODE'))
0
+ − 652 {
+ − 653 $bits = '';
+ − 654 $keys = array_keys($mime_types);
+ − 655 foreach($keys as $i => $k)
+ − 656 {
+ − 657 if(isset($_POST['ext_'.$k])) $bits .= '1';
+ − 658 else $bits .= '0';
+ − 659 }
+ − 660 $bits = compress_bitfield($bits);
+ − 661 setConfig('allowed_mime_types', $bits);
+ − 662 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 663 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 664 else if ( isset($_POST['save']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 665 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 666 echo '<div class="error-box">Hmm, enabling executables, are we? Tsk tsk. I\'d love to know what\'s in that EXE file you want to upload. OK, maybe you didn\'t enable EXEs. But nevertheless, changing allowed filetypes is disabled in the demo.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 667 }
0
+ − 668 $allowed = fetch_allowed_extensions();
+ − 669 ?>
+ − 670 <h3>Allowed file types</h3>
+ − 671 <p>Using the form below, you can decide which file types are allowed to be uploaded to this site.</p>
+ − 672 <?php
+ − 673 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', (( isset($_GET['sqldbg'])) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 674 $c = -1;
+ − 675 $t = -1;
+ − 676 $cl = 'row1';
+ − 677 echo "\n".' <div class="tblholder">'."\n".' <table cellspacing="1" cellpadding="2" style="margin: 0; padding: 0;" border="0">'."\n".' <tr>'."\n ";
+ − 678 foreach($mime_types as $e => $m)
+ − 679 {
+ − 680 $c++;
+ − 681 $t++;
+ − 682 if($c == 3)
+ − 683 {
+ − 684 $c = 0;
+ − 685 $cl = ( $cl == 'row1' ) ? 'row2' : 'row1';
+ − 686 echo '</tr>'."\n".' <tr>'."\n ";
+ − 687 }
+ − 688 $seed = "extchkbx_{$e}_".md5(microtime() . mt_rand());
+ − 689 $chk = (!empty($allowed[$e])) ? ' checked="checked"' : '';
+ − 690 echo " <td class='$cl'>\n <label><input id='{$seed}' type='checkbox' name='ext_{$e}'{$chk} />.{$e}\n ({$m})</label>\n </td>\n ";
+ − 691 }
+ − 692 while($c < 2)
+ − 693 {
+ − 694 $c++;
+ − 695 echo " <td class='{$cl}'></td>\n ";
+ − 696 }
+ − 697 echo '<tr><th class="subhead" colspan="3"><input type="submit" name="save" value="Save changes" /></th></tr>';
+ − 698 echo '</tr>'."\n".' </table>'."\n".' </div>';
+ − 699 echo '</form>';
+ − 700 ?>
+ − 701 <?php
+ − 702 }
+ − 703
+ − 704 function page_Admin_Sidebar()
+ − 705 {
+ − 706 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 707 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 708 {
+ − 709 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 710 return;
+ − 711 }
+ − 712
+ − 713 ?>
+ − 714 <h2>Editing and managing the Enano sidebar</h2>
+ − 715 <p>The Enano sidebar is a versatile tool when scripted correctly. You don't have to be a programmer to enjoy the features the Sidebar
+ − 716 provides; however, editing the sidebar requires a small bit of programming knowledge and an understanding of Enano's system message
+ − 717 markup language.
+ − 718 </p>
+ − 719 <p>The Enano system markup language is somewhat similar to HTML, in that it uses tags (<example>like this</example>) for the
+ − 720 main syntax. However, Enano uses curly brackets ({ and }) as opposed to less-than and greater-than signs (< and >).</p>
+ − 721 <p>Programming the Enano sidebar requires the use of two tags: {slider} and {if}. The {slider} tag is used to create a new heading
+ − 722 on the sidebar, and all text enclosed in that tag will be collapsed when the heading is clicked. To specify the text on the heading,
+ − 723 use an equals sign (=) after the "slider" text. Then insert any links (they should be wiki-formatted) to internal Enano pages and
+ − 724 external sites.</p>
+ − 725 <p>So here is what the language for the default sidebar's "Navigation" heading looks like:</p>
+ − 726 <pre>{slider=Navigation}
+ − 727 [[Main Page|Home]]
+ − 728 [[Enano:Sidebar|Edit the sidebar]]
+ − 729 {/slider}</pre>
+ − 730 <p>Pretty simple, huh? Good, now we're going to learn another common aspect of Enano programming: conditionals. The {if} tag allows you
+ − 731 to decide whether a portion of the sidebar will be displayed based on a template variable. Currently the only available conditions are
+ − 732 "user_logged_in" and "auth_admin", but more will be added soon. To use a conditional, enter {if conditional_name}, and then the
+ − 733 wiki-formatted text that you want to be under that condition, and then close the tag with {/if}. In the same way, you can reverse the
+ − 734 effect with {!if}. With {!if}, the closing tag is still {/if}, so keep that in mind. An {else} tag will be supported soon.</p>
+ − 735 <p>Now it's time for some real fun: variables. All template variables can be accessed from the sidebar. A variable is simply the
+ − 736 variable name, prefixed by a dollar sign ($). Some of the most common variables are $USERNAME, $SITE_NAME, $SITE_DESC, and $PAGE_NAME.
+ − 737 The sidebar also has some special variables that it uses for some of its links. The logout link can be added with $LOGOUT_LINK, and
+ − 738 the "change theme" button can be added with $STYLE_LINK.</p>
+ − 739 <p>So here is the Enano markup for the portion of the sidebar that contains the user tools:</p>
+ − 740 <pre>{slider=$USERNAME}
+ − 741 [[User:$USERNAME|User page]]
+ − 742 [[Special:Contributions?user=$USERNAME|My Contributions]]
+ − 743 {if user_logged_in}
+ − 744 [[Special:Preferences|Preferences]]
+ − 745 $THEME_LINK
+ − 746 {/if}
+ − 747 {if auth_admin}
+ − 748 [[Special:Administration|Administration]]
+ − 749 {/if}
+ − 750 {if user_logged_in}
+ − 751 $LOGOUT_LINK
+ − 752 {/if}
+ − 753 {!if user_logged_in}
+ − 754 Create an account
+ − 755 Log in
+ − 756 {/if}
+ − 757 {/slider}</pre>
+ − 758 <?php
+ − 759 }
+ − 760
+ − 761 function page_Admin_UserManager() {
+ − 762 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 763 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 764 {
+ − 765 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 766 return;
+ − 767 }
+ − 768
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 769 if(isset($_POST['go']))
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 770 {
0
+ − 771 // We need the user ID before we can do anything
+ − 772 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_POST['username']) . '\'');
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 773 if ( !$q )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 774 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 775 die('Error selecting user ID: '.mysql_error());
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 776 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 777 if ( $db->numrows() < 1 )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 778 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 779 echo('User does not exist, please enter another username.');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 780 return;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 781 }
0
+ − 782 $r = $db->fetchrow();
+ − 783 $db->free_result();
+ − 784 if(isset($_POST['save']))
+ − 785 {
+ − 786 $_POST['level'] = intval($_POST['level']);
+ − 787
+ − 788 $new_level = $_POST['level'];
+ − 789 $old_level = intval($r['user_level']);
+ − 790
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 791 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 792 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 793 echo '<div class="error-box">You cannot delete or modify user accounts in demo mode - they are cleaned up once every two hours.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 794 $re = Array('permission denied');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 795 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 796 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 797 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 798 $re = $session->update_user((int)$r['user_id'], $_POST['new_username'], false, $_POST['new_pass'], $_POST['email'], $_POST['real_name'], false, $_POST['level']);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 799 }
0
+ − 800
+ − 801 if($re == 'success')
+ − 802 {
+ − 803
+ − 804 if ( $new_level != $old_level )
+ − 805 {
+ − 806 $user_id = intval($r['user_id']);
+ − 807 // We need to update group memberships
+ − 808 if ( $old_level == USER_LEVEL_ADMIN )
+ − 809 {
+ − 810 $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);
+ − 811 }
+ − 812 else if ( $old_level == USER_LEVEL_MOD )
+ − 813 {
+ − 814 $session->remove_user_from_group($user_id, GROUP_ID_MOD);
+ − 815 }
+ − 816
+ − 817 if ( $new_level == USER_LEVEL_ADMIN )
+ − 818 {
+ − 819 $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);
+ − 820 }
+ − 821 else if ( $new_level == USER_LEVEL_MOD )
+ − 822 {
+ − 823 $session->add_user_to_group($user_id, GROUP_ID_MOD, false);
+ − 824 }
+ − 825 }
+ − 826
+ − 827 echo('<div class="info-box">Your changes have been saved.</div>');
+ − 828 }
+ − 829 else
+ − 830 {
+ − 831 echo('<div class="error-box">Error saving changes: '.implode('<br />', $re).'</div>');
+ − 832 }
+ − 833 $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['username']).'\'');
+ − 834 if ( !$q )
+ − 835 {
+ − 836 die('Error selecting user ID: '.mysql_error());
+ − 837 }
+ − 838 if($db->numrows($q) < 1)
+ − 839 {
+ − 840 die('User does not exist, please enter another username.');
+ − 841 }
+ − 842 $r = mysql_fetch_object($q);
+ − 843 $db->free_result();
+ − 844 }
+ − 845 elseif(isset($_POST['deleteme']) && isset($_POST['delete_conf']))
+ − 846 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 847 if ( defined('ENANO_DEMO_MODE') )
0
+ − 848 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 849 echo '<div class="error-box">You cannot delete or modify user accounts in demo mode - they are cleaned up once every two hours.</div>';
0
+ − 850 }
+ − 851 else
+ − 852 {
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 853 $q = $db->sql_query('DELETE FROM users WHERE user_id='.$r['user_id'].';');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 854 if($q)
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 855 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 856 echo '<div class="error-box">The user account "'.$r['username'].'" was deleted.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 857 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 858 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 859 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 860 echo '<div class="error-box">The user account "'.$r['username'].'" could not be deleted due to a database error.<br /><br />'.$db->get_error().'</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 861 }
0
+ − 862 }
+ − 863 }
+ − 864 else
+ − 865 {
22
+ − 866 $disabled = ( $r['user_id'] == $session->user_id ) ? ' disabled="disabled" ' : '';
0
+ − 867 echo('
+ − 868 <h3>Edit User Info</h3>
+ − 869 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 870 <table border="0" style="margin-left: 0.2in;">
+ − 871 <tr><td>Username:</td><td><input type="text" name="new_username" value="'.$r['username'].'" /></td></tr>
22
+ − 872 <tr><td>New Password:</td><td><input ' . $disabled . ' type="password" name="new_pass" /></td></tr>
+ − 873 <tr><td>E-mail:</td><td><input ' . $disabled . ' type="text" name="email" value="'.$r['email'].'" /></td></tr>
+ − 874 <tr><td>Real Name:</td><td><input ' . $disabled . ' type="text" name="real_name" value="'.$r['real_name'].'" /></td></tr>
+ − 875 ' . ( ( !empty($disabled) ) ? '<tr><td colspan="2"><small>To change your e-mail address, password, or real name, please use the user control panel.</small></td></tr>' : '' ) . '
0
+ − 876 <tr><td>User level:</td><td><select name="level"><option '); if($r['user_level']==USER_LEVEL_CHPREF) echo('SELECTED'); echo(' value="'.USER_LEVEL_CHPREF.'">Regular User</option><option '); if($r['user_level']==USER_LEVEL_MOD) echo('SELECTED'); echo(' value="'.USER_LEVEL_MOD.'">Moderator</option><option '); if($r['user_level']==USER_LEVEL_ADMIN) echo('SELECTED'); echo(' value="'.USER_LEVEL_ADMIN.'">Administrator</option></select></td></tr>
+ − 877 <tr><td>Delete user:</td><td><input type="hidden" name="go" /><input type="hidden" name="username" value="'.$r['username'].'" /><input onclick="return confirm(\'This is your last warning.\n\nAre you sure you want to delete this user account? Even if you delete this user account, the username will be shown in page edit history, comments, and other areas of the site.\n\nDeleting a user account CANNOT BE UNDONE and should only be done in extreme circumstances.\n\nIf the user has violated the site policy, deleting the account will not prevent him from using the site, for that you need to add a new ban rule.\n\nContinue deleting this user account?\')" type="submit" name="deleteme" value="Delete this user" style="color: red;" /> <label><input type="checkbox" name="delete_conf" /> I\'m absolutely sure</label>
+ − 878 <tr><td align="center" colspan="2">
+ − 879 <input type="submit" name="save" value="Save Changes" /></td></tr>
+ − 880 </table>
+ − 881 </form>
+ − 882 ');
+ − 883 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 884 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 885 else if(isset($_POST['clearsessions']))
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 886 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 887 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 888 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 889 echo '<div class="error-box">Sorry Charlie, no can do. You might mess up other people logged into the demo site.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 890 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 891 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 892 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 893 // Get the current session information so the user doesn't get logged out
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 894 $aes = new AESCrypt();
22
+ − 895 $sk = md5(strrev($session->sid_super));
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 896 $qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);
22
+ − 897 if ( !$qb )
+ − 898 {
+ − 899 die('Error selecting session key info block B: '.$db->get_error());
+ − 900 }
+ − 901 if ( $db->numrows($qb) < 1 )
+ − 902 {
+ − 903 die('Error: cannot read admin session info block B, aborting table clear process');
+ − 904 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 905 $qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);
22
+ − 906 if ( !$qa )
+ − 907 {
+ − 908 die('Error selecting session key info block A: '.$db->get_error());
+ − 909 }
+ − 910 if ( $db->numrows($qa) < 1 )
+ − 911 {
+ − 912 die('Error: cannot read user session info block A, aborting table clear process');
+ − 913 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 914 $ra = mysql_fetch_object($qa);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 915 $rb = mysql_fetch_object($qb);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 916 $db->free_result($qa);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 917 $db->free_result($qb);
22
+ − 918
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 919 $db->sql_query('DELETE FROM '.table_prefix.'session_keys;');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 920 $db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra->session_key.'\', \''.$ra->salt.'\', \''.$session->user_id.'\', \''.$ra->auth_level.'\', \''.$ra->source_ip.'\', '.$ra->time.' ),( \''.$rb->session_key.'\', \''.$rb->salt.'\', \''.$session->user_id.'\', \''.$rb->auth_level.'\', \''.$rb->source_ip.'\', '.$rb->time.' )');
22
+ − 921
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 922 echo('
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 923 <div class="info-box">The session key table has been cleared. Your database should be a little bit smaller now.</div>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 924 ');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 925 }
0
+ − 926 }
+ − 927 echo('
+ − 928 <h3>User Management</h3>
+ − 929 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;">
+ − 930 <p>Username: '.$template->username_field('username').' <input type="submit" name="go" value="Go" /></p>
+ − 931 <h3>Clear session keys table</h3>
+ − 932 <p>It\'s a good idea to clean out your session keys table every once in a while, since this helps to reduce database size. During this process you will be logged off and (hopefully) logged back on automatically. The side effects of this include all users except you being logged off.</p>
+ − 933 <p><input type="submit" name="clearsessions" value="Clear session keys table" /></p>
+ − 934 </form>
+ − 935 ');
+ − 936 if(isset($_GET['action']) && isset($_GET['user']))
+ − 937 {
+ − 938 switch($_GET['action'])
+ − 939 {
+ − 940 case "activate":
+ − 941 $e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');
+ − 942 if($e)
+ − 943 {
+ − 944 $row = $db->fetchrow();
+ − 945 $db->free_result();
+ − 946 if($session->activate_account($_GET['user'], $row['activation_key'])) { echo '<div class="info-box">The user account "'.$_GET['user'].'" has been activated.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 947 else echo '<div class="warning-box">The user account "'.$_GET['user'].'" has NOT been activated, possibly because the account is already active.</div>';
+ − 948 } else echo '<div class="error-box">Error activating account: '.mysql_error().'</div>';
+ − 949 break;
+ − 950 case "sendemail":
+ − 951 if($session->send_activation_mail($_GET['user'])) { echo '<div class="info-box">The user "'.$_GET['user'].'" has been sent an e-mail with an activation link.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }
+ − 952 else echo '<div class="error-box">The user account "'.$_GET['user'].'" has not been activated, probably because of a bad SMTP configuration.</div>';
+ − 953 break;
+ − 954 case "deny":
+ − 955 $e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($_GET['user']) . '\';');
+ − 956 if(!$e) echo '<div class="error-box">Error during row deletion: '.mysql_error().'</div>';
+ − 957 else echo '<div class="info-box">All activation requests for the user "'.$_GET['user'].'" have been deleted.</div>';
+ − 958 break;
+ − 959 }
+ − 960 }
30
+ − 961 $q = $db->sql_query('SELECT l.log_type, l.action, l.time_id, l.date_string, l.author, l.edit_summary, u.user_coppa FROM '.table_prefix.'logs AS l
+ − 962 LEFT JOIN '.table_prefix.'users AS u
+ − 963 ON ( u.username = l.edit_summary OR u.username IS NULL )
+ − 964 WHERE log_type=\'admin\' AND action=\'activ_req\' ORDER BY time_id DESC;');
0
+ − 965 if($q)
+ − 966 {
+ − 967 if($db->numrows() > 0)
+ − 968 {
+ − 969 $n = $db->numrows();
+ − 970 if($n == 1) $s = $n . ' user is';
+ − 971 else $s = $n . ' users are';
+ − 972 echo '<h3>'.$s . ' awaiting account activation</h3>';
+ − 973 echo '<div class="tblholder">
+ − 974 <table border="0" cellspacing="1" cellpadding="4" width="100%">
30
+ − 975 <tr><th>Date of request</th><th>Requested by</th><th>Requested for</th><th>COPPA user</th><th colspan="3">Actions</th></tr>';
0
+ − 976 $cls = 'row2';
+ − 977 while($row = $db->fetchrow())
+ − 978 {
+ − 979 if($cls == 'row2') $cls = 'row1';
+ − 980 else $cls = 'row2';
30
+ − 981 $coppa = ( $row['user_coppa'] == '1' ) ? '<b>Yes</b>' : 'No';
+ − 982 echo '<tr><td class="'.$cls.'">'.date('F d, Y h:i a', $row['time_id']).'</td><td class="'.$cls.'">'.$row['author'].'</td><td class="'.$cls.'">'.$row['edit_summary'].'</td><td style="text-align: center;" class="' . $cls . '">' . $coppa . '</td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=activate&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Activate now</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=sendemail&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Send activation e-mail</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=deny&user='.$row['edit_summary'].'&logid='.$row['time_id']).'">Deny request</a></td></tr>';
0
+ − 983 }
+ − 984 echo '</table>';
+ − 985 }
+ − 986 $db->free_result();
+ − 987 }
+ − 988 }
+ − 989
+ − 990 function page_Admin_GroupManager()
+ − 991 {
+ − 992 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 993 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 994 {
+ − 995 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 996 return;
+ − 997 }
+ − 998
+ − 999 if(isset($_POST['do_create_stage1']))
+ − 1000 {
+ − 1001 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 1002 {
+ − 1003 echo '<p>The group name you chose is invalid.</p>';
+ − 1004 return;
+ − 1005 }
+ − 1006 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1007 echo '<div class="tblholder">
+ − 1008 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1009 <tr><th colspan="2">Creating group: '.$_POST['create_group_name'].'</th></tr>
+ − 1010 <tr>
+ − 1011 <td class="row1">Group moderator</td><td class="row1">' . $template->username_field('group_mod') . '</td>
+ − 1012 </tr>
+ − 1013 <tr><td class="row2">Group status</td><td class="row2">
+ − 1014 <label><input type="radio" name="group_status" value="'.GROUP_CLOSED.'" checked="checked" /> Closed to new members</label><br />
+ − 1015 <label><input type="radio" name="group_status" value="'.GROUP_REQUEST.'" /> Members can ask to be added</label><br />
+ − 1016 <label><input type="radio" name="group_status" value="'.GROUP_OPEN.'" /> Members can join freely</label><br />
+ − 1017 <label><input type="radio" name="group_status" value="'.GROUP_HIDDEN.'" /> Group is hidden</label>
+ − 1018 </td></tr>
+ − 1019 <tr>
+ − 1020 <th class="subhead" colspan="2">
+ − 1021 <input type="hidden" name="create_group_name" value="'.$_POST['create_group_name'].'" />
+ − 1022 <input type="submit" name="do_create_stage2" value="Create group" />
+ − 1023 </th>
+ − 1024 </tr>
+ − 1025 </table>
+ − 1026 </div>';
+ − 1027 echo '</form>';
+ − 1028 return;
+ − 1029 }
+ − 1030 elseif(isset($_POST['do_create_stage2']))
+ − 1031 {
+ − 1032 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))
+ − 1033 {
+ − 1034 echo '<p>The group name you chose is invalid.</p>';
+ − 1035 return;
+ − 1036 }
+ − 1037 if(!in_array(intval($_POST['group_status']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST)))
+ − 1038 {
+ − 1039 echo '<p>Hacking attempt</p>';
+ − 1040 return;
+ − 1041 }
+ − 1042 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 1043 if(!$e)
+ − 1044 {
+ − 1045 echo $db->get_error();
+ − 1046 return;
+ − 1047 }
+ − 1048 if($db->numrows() > 0)
+ − 1049 {
+ − 1050 echo '<p>The group name you entered already exists.</p>';
+ − 1051 return;
+ − 1052 }
+ − 1053 $db->free_result();
+ − 1054 $q = $db->sql_query('INSERT INTO '.table_prefix.'groups(group_name,group_type) VALUES( \''.$db->escape($_POST['create_group_name']).'\', ' . intval($_POST['group_status']) . ' )');
+ − 1055 if(!$q)
+ − 1056 {
+ − 1057 echo $db->get_error();
+ − 1058 return;
+ − 1059 }
+ − 1060 $e = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['group_mod']).'\';');
+ − 1061 if(!$e)
+ − 1062 {
+ − 1063 echo $db->get_error();
+ − 1064 return;
+ − 1065 }
+ − 1066 if($db->numrows() < 1)
+ − 1067 {
+ − 1068 echo '<p>The username you entered could not be found.</p>';
+ − 1069 return;
+ − 1070 }
+ − 1071 $row = $db->fetchrow();
+ − 1072 $id = $row['user_id'];
+ − 1073 $db->free_result();
+ − 1074 $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');
+ − 1075 if(!$e)
+ − 1076 {
+ − 1077 echo $db->get_error();
+ − 1078 return;
+ − 1079 }
+ − 1080 if($db->numrows() < 1)
+ − 1081 {
+ − 1082 echo '<p>The group ID could not be looked up.</p>';
+ − 1083 return;
+ − 1084 }
+ − 1085 $row = $db->fetchrow();
+ − 1086 $gid = $row['group_id'];
+ − 1087 $db->free_result();
+ − 1088 $e = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.$gid.', '.$id.', 1);');
+ − 1089 if(!$e)
+ − 1090 {
+ − 1091 echo $db->get_error();
+ − 1092 return;
+ − 1093 }
+ − 1094 echo "<div class='info-box'>
+ − 1095 <b>Information</b><br />
+ − 1096 The group {$_POST['create_group_name']} has been created successfully.
+ − 1097 </div>";
+ − 1098 }
+ − 1099 if(isset($_POST['do_edit']) || isset($_POST['edit_do']))
+ − 1100 {
+ − 1101 // Fetch the group name
+ − 1102 $q = $db->sql_query('SELECT group_name,system_group FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1103 if(!$q)
+ − 1104 {
+ − 1105 echo $db->get_error();
+ − 1106 return;
+ − 1107 }
+ − 1108 if($db->numrows() < 1)
+ − 1109 {
+ − 1110 echo '<p>Error: couldn\'t look up group name</p>';
+ − 1111 }
+ − 1112 $row = $db->fetchrow();
+ − 1113 $name = $row['group_name'];
+ − 1114 $db->free_result();
+ − 1115 if(isset($_POST['edit_do']))
+ − 1116 {
+ − 1117 if(isset($_POST['edit_do']['del_group']))
+ − 1118 {
+ − 1119 if ( $row['system_group'] == 1 )
+ − 1120 {
+ − 1121 echo '<div class="error-box">The group "' . $name . '" could not be deleted because it is a system group required for site functionality.</div>';
+ − 1122 }
+ − 1123 else
+ − 1124 {
+ − 1125 $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1126 if(!$q)
+ − 1127 {
+ − 1128 echo $db->get_error();
+ − 1129 return;
+ − 1130 }
+ − 1131 $q = $db->sql_query('DELETE FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1132 if(!$q)
+ − 1133 {
+ − 1134 echo $db->get_error();
+ − 1135 return;
+ − 1136 }
+ − 1137 echo '<div class="info-box">The group "'.$name.'" has been deleted. Return to the <a href="javascript:ajaxPage(\'Admin:GroupManager\');">group manager</a>.</div>';
+ − 1138 return;
+ − 1139 }
+ − 1140 }
+ − 1141 if(isset($_POST['edit_do']['save_name']))
+ − 1142 {
+ − 1143 if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['group_name']))
+ − 1144 {
+ − 1145 echo '<p>The group name you chose is invalid.</p>';
+ − 1146 return;
+ − 1147 }
+ − 1148 $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_name=\''.$db->escape($_POST['group_name']).'\'
+ − 1149 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1150 if(!$q)
+ − 1151 {
+ − 1152 echo $db->get_error();
+ − 1153 return;
+ − 1154 }
+ − 1155 else
+ − 1156 {
+ − 1157 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1158 The group name has been updated.
+ − 1159 </div>';
+ − 1160 }
+ − 1161 $name = $_POST['group_name'];
+ − 1162
+ − 1163 }
+ − 1164 $q = $db->sql_query('SELECT member_id FROM '.table_prefix.'group_members
+ − 1165 WHERE group_id='.intval($_POST['group_edit_id']).';');
+ − 1166 if(!$q)
+ − 1167 {
+ − 1168 echo $db->get_error();
+ − 1169 return;
+ − 1170 }
+ − 1171 if($db->numrows() > 0)
+ − 1172 {
+ − 1173 while($row = $db->fetchrow($q))
+ − 1174 {
+ − 1175 if(isset($_POST['edit_do']['del_' . $row['member_id']]))
+ − 1176 {
+ − 1177 $e = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id='.$row['member_id']);
+ − 1178 if(!$e)
+ − 1179 {
+ − 1180 echo $db->get_error();
+ − 1181 return;
+ − 1182 }
+ − 1183 }
+ − 1184 }
+ − 1185 }
+ − 1186 $db->free_result();
+ − 1187 if(isset($_POST['edit_do']['add_member']))
+ − 1188 {
+ − 1189 $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['edit_add_username']).'\';');
+ − 1190 if(!$q)
+ − 1191 {
+ − 1192 echo $db->get_error();
+ − 1193 return;
+ − 1194 }
+ − 1195 if($db->numrows() > 0)
+ − 1196 {
+ − 1197 $row = $db->fetchrow();
+ − 1198 $user_id = $row['user_id'];
+ − 1199 $is_mod = ( isset( $_POST['add_mod'] ) ) ? '1' : '0';
+ − 1200 $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.intval($_POST['group_edit_id']).','.$user_id.','.$is_mod.');');
+ − 1201 if(!$q)
+ − 1202 {
+ − 1203 echo $db->get_error();
+ − 1204 return;
+ − 1205 }
+ − 1206 else
+ − 1207 {
+ − 1208 echo '<div class="info-box" style="margin: 0 0 10px 0;"">
+ − 1209 The user "'.$_POST['edit_add_username'].'" has been added to this usergroup.
+ − 1210 </div>';
+ − 1211 }
+ − 1212 }
+ − 1213 else
+ − 1214 echo '<div class="warning-box"><b>The user "'.$_POST['edit_add_username'].'" could not be added.</b><br />This username does not exist.</div>';
+ − 1215 }
+ − 1216 }
+ − 1217 $sg_disabled = ( $row['system_group'] == 1 ) ? ' value="Can\'t delete system group" disabled="disabled" style="color: #FF9773" ' : ' value="Delete this group" style="color: #FF3713" ';
+ − 1218 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1219 echo '<div class="tblholder">
+ − 1220 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1221 <tr><th>Edit group name</th></tr>
+ − 1222 <tr>
+ − 1223 <td class="row1">
+ − 1224 Group name: <input type="text" name="group_name" value="'.$name.'" />
+ − 1225 </td>
+ − 1226 </tr>
+ − 1227 <tr>
+ − 1228 <th class="subhead">
+ − 1229 <input type="submit" name="edit_do[save_name]" value="Save name" />
+ − 1230 <input type="submit" name="edit_do[del_group]" '.$sg_disabled.' />
+ − 1231 </th>
+ − 1232 </tr>
+ − 1233 </table>
+ − 1234 </div>
+ − 1235 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1236 echo '</form>';
+ − 1237 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1238 echo '<div class="tblholder">
+ − 1239 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1240 <tr><th colspan="3">Edit group members</th></tr>';
+ − 1241 $q = $db->sql_query('SELECT m.member_id,m.is_mod,u.username FROM '.table_prefix.'group_members AS m
+ − 1242 LEFT JOIN '.table_prefix.'users AS u
+ − 1243 ON u.user_id=m.user_id
+ − 1244 WHERE m.group_id='.intval($_POST['group_edit_id']).'
+ − 1245 ORDER BY m.is_mod DESC, u.username ASC;');
+ − 1246 if(!$q)
+ − 1247 {
+ − 1248 echo $db->get_error();
+ − 1249 return;
+ − 1250 }
+ − 1251 if($db->numrows() < 1)
+ − 1252 {
+ − 1253 echo '<tr><td colspan="3" class="row1">This group has no members.</td></tr>';
+ − 1254 }
+ − 1255 else
+ − 1256 {
+ − 1257 $cls = 'row2';
+ − 1258 while($row = $db->fetchrow())
+ − 1259 {
+ − 1260 $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';
+ − 1261 $mod = ( $row['is_mod'] == 1 ) ? 'Mod' : '';
+ − 1262 echo '<tr>
+ − 1263 <td class="'.$cls.'" style="width: 100%;">
+ − 1264 ' . $row['username'] . '
+ − 1265 </td>
+ − 1266 <td class="'.$cls.'">
+ − 1267 '.$mod.'
+ − 1268 </td>
+ − 1269 <td class="'.$cls.'">
+ − 1270 <input type="submit" name="edit_do[del_'.$row['member_id'].']" value="Remove member" />
+ − 1271 </td>
+ − 1272 </tr>';
+ − 1273 }
+ − 1274 }
+ − 1275 $db->free_result();
+ − 1276 echo '</table>
+ − 1277 </div>
+ − 1278 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1279 echo '</form>';
+ − 1280 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1281 echo '<div class="tblholder">
+ − 1282 <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">
+ − 1283 <tr>
+ − 1284 <th>Add a new member</th>
+ − 1285 </tr>
+ − 1286 <tr>
+ − 1287 <td class="row1">
+ − 1288 Username: ' . $template->username_field('edit_add_username') . '
+ − 1289 </td>
+ − 1290 </tr>
+ − 1291 <tr>
+ − 1292 <td class="row2">
+ − 1293 <label><input type="checkbox" name="add_mod" /> Is a group moderator</label> (can add and delete other members)
+ − 1294 </td>
+ − 1295 </tr>
+ − 1296 <tr>
+ − 1297 <th class="subhead">
+ − 1298 <input type="submit" name="edit_do[add_member]" value="Add user to group" />
+ − 1299 </th>
+ − 1300 </tr>
+ − 1301 </table>
+ − 1302 </div>
+ − 1303 <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';
+ − 1304 echo '</form>';
+ − 1305 return;
+ − 1306 }
+ − 1307 echo '<h3>Manage Usergroups</h3>';
+ − 1308 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1309 $q = $db->sql_query('SELECT group_id,group_name FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 1310 if(!$q)
+ − 1311 {
+ − 1312 echo $db->get_error();
+ − 1313 }
+ − 1314 else
+ − 1315 {
+ − 1316 echo '<div class="tblholder">
+ − 1317 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1318 <tr>
+ − 1319 <th>Edit an existing group</th>
+ − 1320 </tr>';
+ − 1321 echo '<tr><td class="row2"><select name="group_edit_id">';
+ − 1322 while ( $row = $db->fetchrow() )
+ − 1323 {
+ − 1324 if ( $row['group_name'] != 'Everyone' )
+ − 1325 {
+ − 1326 echo '<option value="' . $row['group_id'] . '">' . htmlspecialchars( $row['group_name'] ) . '</option>';
+ − 1327 }
+ − 1328 }
+ − 1329 $db->free_result();
+ − 1330 echo '</select></td></tr>';
+ − 1331 echo '<tr><td class="row1" style="text-align: center;"><input type="submit" name="do_edit" value="Edit group" /></td></tr>
+ − 1332 </table>
+ − 1333 </div>
+ − 1334 </form><br />';
+ − 1335 }
+ − 1336 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1337 echo '<div class="tblholder">
+ − 1338 <table border="0" cellspacing="1" cellpadding="4" style="width: 100%;">
+ − 1339 <tr>
+ − 1340 <th colspan="2">Create a new group</th>
+ − 1341 </tr>';
+ − 1342 echo '<tr><td class="row2">Group name:</td><td class="row2"><input type="text" name="create_group_name" /></td></tr>';
+ − 1343 echo '<tr><td colspan="2" class="row1" style="text-align: center;"><input type="submit" name="do_create_stage1" value="Continue >" /></td></tr>
+ − 1344 </table>
+ − 1345 </div>';
+ − 1346 echo '</form>';
+ − 1347 }
+ − 1348
30
+ − 1349 function page_Admin_COPPA()
+ − 1350 {
+ − 1351 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1352 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1353 {
+ − 1354 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1355 return;
+ − 1356 }
+ − 1357
+ − 1358 echo '<h2>Background information</h2>';
+ − 1359 echo '<p>
+ − 1360 The United States Childrens\' Online Privacy Protection Act (COPPA) was a law passed in 2001 that requires sites oriented towards
+ − 1361 children under 13 years old or with a significant amount of under-13 children clearly state what information is being collected
+ − 1362 in a privacy policy and obtain authorization from a parent or legal guardian before allowing children to use the site. Enano
+ − 1363 provides an easy way to allow you, as the website administrator, to obtain this authorization.
+ − 1364 </p>';
+ − 1365
+ − 1366 // Start form
+ − 1367
+ − 1368 if ( isset($_POST['coppa_address']) )
+ − 1369 {
+ − 1370 // Saving changes
+ − 1371 $enable_coppa = ( isset($_POST['enable_coppa']) ) ? '1' : '0';
+ − 1372 setConfig('enable_coppa', $enable_coppa);
+ − 1373
+ − 1374 $address = $_POST['coppa_address']; // RenderMan::preprocess_text($_POST['coppa_address'], true, false);
+ − 1375 setConfig('coppa_address', $address);
+ − 1376
+ − 1377 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 1378 }
+ − 1379
+ − 1380 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', (( isset($_GET['sqldbg'])) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 1381
+ − 1382 echo '<div class="tblholder">';
+ − 1383 echo '<table border="0" cellspacing="1" cellpadding="4">';
+ − 1384 echo '<tr>
+ − 1385 <th colspan="2">
+ − 1386 COPPA support
+ − 1387 </th>
+ − 1388 </tr>';
+ − 1389
+ − 1390 echo '<tr>
+ − 1391 <td class="row1">
+ − 1392 Enable COPPA support:
+ − 1393 </td>
+ − 1394 <td class="row2">
+ − 1395 <label><input type="checkbox" name="enable_coppa" ' . ( ( getConfig('enable_coppa') == '1' ) ? 'checked="checked"' : '' ) . ' /> COPPA enabled</label><br />
+ − 1396 <small>If this is checked, users will be asked if they are under 13 years of age before registering</small>
+ − 1397 </td>
+ − 1398 </tr>';
+ − 1399
+ − 1400 echo '<tr>
+ − 1401 <td class="row1">
+ − 1402 Your mailing address:<br />
+ − 1403 <small>This is the address to which parents will send authorization forms.</small>
+ − 1404 </td>
+ − 1405 <td class="row2">
+ − 1406 <textarea name="coppa_address" rows="7" cols="40">' . getConfig('coppa_address') . '</textarea>
+ − 1407 </td>
+ − 1408 </tr>';
+ − 1409
+ − 1410 echo '<tr>
+ − 1411 <th colspan="2" class="subhead">
+ − 1412 <input type="submit" value="Save changes" />
+ − 1413 </th>
+ − 1414 </tr>';
+ − 1415
+ − 1416 echo '</table>';
+ − 1417
+ − 1418 echo '</form>';
+ − 1419
+ − 1420 }
+ − 1421
0
+ − 1422 function page_Admin_PageManager()
+ − 1423 {
+ − 1424 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1425 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1426 {
+ − 1427 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1428 return;
+ − 1429 }
+ − 1430
+ − 1431
+ − 1432 echo '<h2>Page management</h2>';
+ − 1433
+ − 1434 if(isset($_POST['search']) || isset($_POST['select']) || ( isset($_GET['source']) && $_GET['source'] == 'ajax' )) {
+ − 1435 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1436 $source = ( isset($_GET['source']) ) ? $_GET['source'] : false;
+ − 1437 if ( $source == 'ajax' )
+ − 1438 {
+ − 1439 $_POST['search'] = true;
+ − 1440 $_POST['page_url'] = $_GET['page_id'];
+ − 1441 }
+ − 1442 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1443 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1444 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1445 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1446 $k = array_keys($paths->nslist);
+ − 1447 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1448 {
+ − 1449 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1450 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1451 {
+ − 1452 $ns = $k[$i];
+ − 1453 $page_id = substr($pid, $ln, strlen($pid));
+ − 1454 }
+ − 1455 }
+ − 1456 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1457 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1458 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1459 {
+ − 1460 if(!isset($final_pid))
+ − 1461 {
+ − 1462 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1463 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1464 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1465 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1466 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1467 }
+ − 1468 }
+ − 1469 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1470 $_POST['namespace'] = $ns;
+ − 1471 $_POST['old_namespace'] = $ns;
+ − 1472 $_POST['page_id'] = $final_pid;
+ − 1473 $_POST['old_page_id'] = $final_pid;
+ − 1474 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1475 }
+ − 1476
+ − 1477 if(isset($_POST['page_id']) && isset($_POST['namespace']) && !isset($_POST['cancel']))
+ − 1478 {
+ − 1479 $cpage = $paths->pages[$paths->nslist[$_POST['namespace']].$_POST['old_page_id']];
+ − 1480 if(isset($_POST['submit']))
+ − 1481 {
22
+ − 1482 switch(true)
0
+ − 1483 {
22
+ − 1484 case true:
+ − 1485 // Create a list of things to update
+ − 1486 $page_info = Array(
+ − 1487 'name'=>$_POST['name'],
+ − 1488 'urlname'=>sanitize_page_id($_POST['page_id']),
+ − 1489 'namespace'=>$_POST['namespace'],
+ − 1490 'special'=>isset($_POST['special']) ? '1' : '0',
+ − 1491 'visible'=>isset($_POST['visible']) ? '1' : '0',
+ − 1492 'comments_on'=>isset($_POST['comments_on']) ? '1' : '0',
+ − 1493 'protected'=>isset($_POST['protected']) ? '1' : '0'
+ − 1494 );
+ − 1495
+ − 1496 $updating_urlname_or_namespace = ( $page_info['namespace'] != $cpage['namespace'] || $page_info['urlname'] != $cpage['urlname'] );
+ − 1497
+ − 1498 if ( !isset($paths->nslist[ $page_info['namespace'] ]) )
+ − 1499 {
+ − 1500 echo '<div class="error-box">The namespace you selected is not properly registered.</div>';
+ − 1501 break;
+ − 1502 }
+ − 1503 if ( isset($paths->pages[ $paths->nslist[$page_info['namespace']] . $page_info[ 'urlname' ] ]) && $updating_urlname_or_namespace )
+ − 1504 {
+ − 1505 echo '<div class="error-box">There is already a page that exists with that URL string and namespace.</div>';
+ − 1506 break;
+ − 1507 }
+ − 1508 // Build the query
+ − 1509 $q = 'UPDATE '.table_prefix.'pages SET ';
+ − 1510 $k = array_keys($page_info);
+ − 1511 foreach($k as $c)
+ − 1512 {
+ − 1513 $q .= $c.'=\''.$db->escape($page_info[$c]).'\',';
+ − 1514 }
+ − 1515 $q = substr($q, 0, strlen($q)-1);
+ − 1516 // Build the WHERE statements
+ − 1517 $q .= ' WHERE ';
+ − 1518 $k = array_keys($cpage);
+ − 1519 foreach($k as $c)
+ − 1520 {
+ − 1521 if($c != 'urlname_nons' && $c != 'urlname' && $c != 'really_protected')
+ − 1522 {
+ − 1523 $q .= $c.'=\''.$db->escape($cpage[$c]).'\' AND ';
+ − 1524 }
+ − 1525 else if($c == 'urlname')
+ − 1526 {
+ − 1527 $q .= $c.'=\''.$db->escape($cpage['urlname_nons']).'\' AND ';
+ − 1528 }
+ − 1529 }
+ − 1530 // Trim off the last " AND " and append a semicolon
+ − 1531 $q = substr($q, 0, strlen($q)-5) . ';';
+ − 1532 // Send the completed query to MySQL
+ − 1533 $e = $db->sql_query($q);
+ − 1534 if(!$e) $db->_die('The page data could not be updated.');
+ − 1535 // Update any additional tables
+ − 1536 $q = Array(
+ − 1537 'UPDATE '.table_prefix.'categories SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1538 'UPDATE '.table_prefix.'comments SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1539 'UPDATE '.table_prefix.'logs SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1540 'UPDATE '.table_prefix.'page_text SET page_id=\''.$page_info['urlname'].'\',namespace=\''.$page_info['namespace'].'\' WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1541 );
+ − 1542 foreach($q as $cq)
+ − 1543 {
+ − 1544 $e = $db->sql_query($cq);
+ − 1545 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1546 }
+ − 1547 // Update $cpage
+ − 1548 $cpage = $page_info;
+ − 1549 $cpage['urlname_nons'] = $cpage['urlname'];
+ − 1550 $cpage['urlname'] = $paths->nslist[$cpage['namespace']].$cpage['urlname'];
+ − 1551 $_POST['old_page_id'] = $page_info['urlname'];
+ − 1552 $_POST['old_namespace'] = $page_info['namespace'];
+ − 1553 echo '<div class="info-box">Your changes have been saved.</div>';
+ − 1554 break;
0
+ − 1555 }
+ − 1556 } elseif(isset($_POST['delete'])) {
+ − 1557 $q = Array(
+ − 1558 'DELETE FROM '.table_prefix.'categories WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1559 'DELETE FROM '.table_prefix.'comments WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1560 'DELETE FROM '.table_prefix.'logs WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1561 'DELETE FROM '.table_prefix.'page_text WHERE page_id=\'' . $db->escape($_POST['old_page_id']) . '\' AND namespace=\'' . $db->escape($_POST['old_namespace']) . '\';',
+ − 1562 );
+ − 1563 foreach($q as $cq)
+ − 1564 {
+ − 1565 $e = $db->sql_query($cq);
+ − 1566 if(!$e) $db->_die('Some of the additional tables containing page information could not be updated.');
+ − 1567 }
+ − 1568
+ − 1569 if(!$db->sql_query(
+ − 1570 'DELETE FROM '.table_prefix.'pages WHERE urlname="'.$db->escape($_POST['old_page_id']).'" AND namespace="'.$db->escape($_POST['old_namespace']).'";'
+ − 1571 )) $db->_die('The page could not be deleted.');
+ − 1572 echo '<div class="info-box">This page has been deleted.</p><p><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'PageManager\');">Return to Page manager</a><br /><a href="javascript:ajaxPage(\''.$paths->nslist['Admin'].'Home\');">Admin home</a></div>';
+ − 1573 return;
+ − 1574 }
+ − 1575 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration'.htmlspecialchars(urlSeparator).(( isset($_GET['sqldbg']) ) ? 'sqldbg&' : '') .'module='.$paths->cpage['module']).'" method="post">';
+ − 1576 ?>
+ − 1577 <h3>Modify page: <?php echo $_POST['name']; ?></h3>
+ − 1578 <table border="0">
+ − 1579 <tr><td>Namespace:</td><td><select name="namespace"><?php $nm = array_keys($paths->nslist); foreach($nm as $ns) { if($ns != 'Special' && $ns != 'Admin') { echo '<option '; if($_POST['namespace']==$ns) echo 'selected="selected" '; echo 'value="'.$ns.'">'; if($paths->nslist[$ns] == '') echo '[No prefix]'; else echo $paths->nslist[$ns]; echo '</option>'; } } ?></select></td></tr>
+ − 1580 <tr><td>Page title:</td><td><input type="text" name="name" value="<?php echo $cpage['name']; ?>" /></td></tr>
22
+ − 1581 <tr><td>Page URL string:<br /><small>No spaces, and don't enter the namespace prefix (e.g. User:).<br />Changing this value is usually not a good idea, especially for templates and project pages.</small></td><td><input type="text" name="page_id" value="<?php echo htmlspecialchars(dirtify_page_id($cpage['urlname_nons'])); ?>" /></td></tr>
0
+ − 1582 <tr><td></td><td><input <?php if($cpage['comments_on']) echo 'checked="checked"'; ?> name="comments_on" type="checkbox" id="cmt" /> <label for="cmt">Enable comments for this page</label></td></tr>
+ − 1583 <tr><td></td><td><input <?php if($cpage['special']) echo 'checked="checked"'; ?> name="special" type="checkbox" id="spc" /> <label for="spc">Bypass the template engine for this page</label><br /><small>This option enables you to use your own HTML headers and other code. It is recommended that only advanced users enable this feature. As with other Enano pages, you may use PHP code in your pages, meaning you can use Enano's API on the page.</small></td></tr>
+ − 1584 <tr><td></td><td><input <?php if($cpage['visible']) echo 'checked="checked"'; ?> name="visible" type="checkbox" id="vis" /> <label for="vis">Allow this page to be shown in page lists</label><br /><small>Unchecking this checkbox prevents the page for being indexed for searching. The index is rebuilt each time a page is saved, and you can force an index rebuild by going to the page <?php echo $paths->nslist['Special']; ?>SearchRebuild.</small></td></tr>
+ − 1585 <tr><td></td><td><input <?php if($cpage['protected']) echo 'checked="checked"'; ?> name="protected" type="checkbox" id="prt" /> <label for="prt">Prevent non-administrators from editing this page</label><br /><small>This option only has an effect when Wiki Mode is enabled.</small></td></tr>
+ − 1586 <tr><td></td><td><input type="submit" name="delete" value="Delete page" style="color: red" onclick="return confirm('Do you REALLY want to delete this page?')" /></td></tr>
+ − 1587 <tr><td colspan="2" style="text-align: center;"><hr /></td></tr>
+ − 1588 <tr><td colspan="2" style="text-align: right;">
+ − 1589 <input type="hidden" name="old_page_id" value="<?php echo $_POST['old_page_id']; ?>" />
+ − 1590 <input type="hidden" name="old_namespace" value="<?php echo $_POST['old_namespace']; ?>" />
+ − 1591 <input type="Submit" name="submit" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="cancel" value="Cancel changes" /></td></tr>
+ − 1592 </table>
+ − 1593 <?php
+ − 1594 echo '</form>';
+ − 1595 } else {
+ − 1596 echo '<h3>Please select a page</h3>';
+ − 1597 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1598 ?>
+ − 1599 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1600 <p>Select page title from a list: <select name="page_force_url">
+ − 1601 <?php
+ − 1602 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1603 {
+ − 1604 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1605 }
+ − 1606 ?>
+ − 1607 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1608 <?php
+ − 1609 echo '</form>';
+ − 1610
+ − 1611 }
+ − 1612 }
+ − 1613
+ − 1614 function page_Admin_PageEditor()
+ − 1615 {
+ − 1616 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1617 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1618 {
+ − 1619 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1620 return;
+ − 1621 }
+ − 1622
+ − 1623
+ − 1624 echo '<h2>Edit page content</h2>';
+ − 1625
+ − 1626 if(isset($_POST['search']) || isset($_POST['select'])) {
+ − 1627 // The object of the game: using only the text a user entered, guess the page ID and namespace. *sigh* I HATE writing search algorithms...
+ − 1628 if(isset($_POST['search'])) $pid = $_POST['page_url'];
+ − 1629 elseif(isset($_POST['select'])) $pid = $_POST['page_force_url'];
+ − 1630 else { echo 'Internal error selecting page search terms'; return false; }
+ − 1631 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 1632 $k = array_keys($paths->nslist);
+ − 1633 for($i=0;$i<sizeof($paths->nslist);$i++)
+ − 1634 {
+ − 1635 $ln = strlen($paths->nslist[$k[$i]]);
+ − 1636 if(substr($pid, 0, $ln) == $paths->nslist[$k[$i]])
+ − 1637 {
+ − 1638 $ns = $k[$i];
+ − 1639 $page_id = substr($pid, $ln, strlen($pid));
+ − 1640 }
+ − 1641 }
+ − 1642 // The namespace is in $ns and the page name or ID (we don't know which yet) is in $page_id
+ − 1643 // Now, iterate through $paths->pages searching for a page with this name or ID
+ − 1644 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1645 {
+ − 1646 if(!isset($final_pid))
+ − 1647 {
+ − 1648 if ($paths->pages[$i]['urlname_nons'] == str_replace(' ', '_', $page_id)) $final_pid = str_replace(' ', '_', $page_id);
+ − 1649 elseif($paths->pages[$i]['name'] == $page_id) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1650 elseif(strtolower($paths->pages[$i]['urlname_nons']) == strtolower(str_replace(' ', '_', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1651 elseif(strtolower($paths->pages[$i]['name']) == strtolower(str_replace('_', ' ', $page_id))) $final_pid = $paths->pages[$i]['urlname_nons'];
+ − 1652 if(isset($final_pid)) { $_POST['name'] = $paths->pages[$i]['name']; $_POST['urlname'] = $paths->pages[$i]['urlname_nons']; }
+ − 1653 }
+ − 1654 }
+ − 1655 if(!isset($final_pid)) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1656 $_POST['namespace'] = $ns;
+ − 1657 $_POST['page_id'] = $final_pid;
+ − 1658 if(!isset($paths->pages[$paths->nslist[$_POST['namespace']].$_POST['urlname']])) { echo 'The page you searched for cannot be found. <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'PageManager\'); return false;">Back</a>'; return false; }
+ − 1659 }
+ − 1660
+ − 1661 if(isset($_POST['page_id']) && !isset($_POST['cancel']))
+ − 1662 {
+ − 1663 echo '<form name="main" action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1664 if(!isset($_POST['content']) || isset($_POST['revert'])) $content = RenderMan::getPage($_POST['page_id'], $_POST['namespace'], 0, false, false, false, false);
+ − 1665 else $content = $_POST['content'];
+ − 1666 if(isset($_POST['save']))
+ − 1667 {
+ − 1668 $data = $content;
+ − 1669 $id = md5( microtime() . mt_rand() );
+ − 1670
+ − 1671 $minor = isset($_POST['minor']) ? 'true' : 'false';
+ − 1672 $q='INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,page_id,namespace,page_text,char_tag,author,edit_summary,minor_edit) VALUES(\'page\', \'edit\', '.time().', \''.date('d M Y h:i a').'\', \'' . $db->escape($_POST['page_id']) . '\', \'' . $db->escape($_POST['namespace']) . '\', \''.$data.'\', \''.$id.'\', \''.$session->username.'\', \''.$db->escape(htmlspecialchars($_POST['summary'])).'\', '.$minor.');';
+ − 1673 if(!$db->sql_query($q)) $db->_die('The history (log) entry could not be inserted into the logs table.');
+ − 1674
+ − 1675 $query = 'UPDATE '.table_prefix.'page_text SET page_text=\''.$db->escape($data).'\',char_tag=\''.$id.'\' WHERE page_id=\'' . $db->escape($_POST['page_id']) . '\' AND namespace=\'' . $db->escape($_POST['namespace']) . '\';';
+ − 1676 $e = $db->sql_query($query);
+ − 1677 if(!$e) echo '<div class="warning-box">The page data could not be saved. MySQL said: '.mysql_error().'<br /><br />Query:<br /><pre>'.$query.'</pre></div>';
+ − 1678 else echo '<div class="info-box">Your page has been saved. <a href="'.makeUrlNS($_POST['namespace'], $_POST['page_id']).'">View page...</a></div>';
+ − 1679 } elseif(isset($_POST['preview'])) {
+ − 1680 echo '<h3>Preview</h3><p><b>Reminder:</b> This is only a preview; your changes to this page have not yet been saved.</p><div style="margin: 1em; padding: 10px; border: 1px dashed #606060; background-color: #F8F8F8; max-height: 200px; overflow: auto;">'.RenderMan::render($content).'</div>';
+ − 1681 }
+ − 1682 ?>
+ − 1683 <p>
+ − 1684 <textarea name="content" rows="20" cols="60" style="width: 100%;"><?php echo htmlspecialchars($content); ?></textarea><br />
+ − 1685 Edit summary: <input name="summary" value="<?php if(isset($_POST['summary'])) echo $_POST['summary']; ?>" size="40" /><br />
+ − 1686 <label><input type="checkbox" name="minor" <?php if(isset($_POST['minor'])) echo 'checked="checked" '; ?>/> This is a minor edit</label>
+ − 1687 </p>
+ − 1688 <p>
+ − 1689 <input type="hidden" name="page_id" value="<?php echo $_POST['page_id']; ?>" />
+ − 1690 <input type="hidden" name="namespace" value="<?php echo $_POST['namespace']; ?>" />
+ − 1691 <input type="submit" name="save" value="Save changes" style="font-weight: bold;" /> <input type="submit" name="preview" value="Show preview" /> <input type="submit" name="revert" value="Revert changes" onclick="return confirm('Do you really want to revert your changes?');" /> <input type="submit" name="cancel" value="Cancel" onclick="return confirm('Do you really want to cancel your changes?');" />
+ − 1692 </p>
+ − 1693 <?php
+ − 1694 echo '</form>';
+ − 1695 } else {
+ − 1696 echo '<h3>Please select a page</h3>';
+ − 1697 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';
+ − 1698 ?>
+ − 1699 <p>Search for page title (remember prefixes like User: and File:) <?php echo $template->pagename_field('page_url'); ?> <input type="submit" style="font-weight: bold;" name="search" value="Search" /></p>
+ − 1700 <p>Select page title from a list: <select name="page_force_url">
+ − 1701 <?php
+ − 1702 for($i=0;$i<sizeof($paths->pages)/2;$i++)
+ − 1703 {
+ − 1704 if($paths->pages[$i]['namespace'] != 'Admin' && $paths->pages[$i]['namespace'] != 'Special') echo '<option value="'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['urlname_nons'].'">'.$paths->nslist[$paths->pages[$i]['namespace']].$paths->pages[$i]['name'].'</option>'."\n";
+ − 1705 }
+ − 1706 ?>
+ − 1707 </select> <input type="submit" name="select" value="Select" /></p>
+ − 1708 <?php
+ − 1709 echo '</form>';
+ − 1710 }
+ − 1711 }
+ − 1712
+ − 1713 function page_Admin_ThemeManager()
+ − 1714 {
+ − 1715
+ − 1716 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1717 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1718 {
+ − 1719 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1720 return;
+ − 1721 }
+ − 1722
+ − 1723
+ − 1724 // Get the list of styles in the themes/ dir
+ − 1725 $h = opendir('./themes');
+ − 1726 $l = Array();
+ − 1727 if(!$h) die('Error opening directory "./themes" for reading.');
+ − 1728 while(false !== ($n = readdir($h))) {
+ − 1729 if($n != '.' && $n != '..' && is_dir('./themes/'.$n))
+ − 1730 $l[] = $n;
+ − 1731 }
+ − 1732 closedir($h);
+ − 1733 echo('
+ − 1734 <h3>Theme Management</h3>
+ − 1735 <p>Install, uninstall, and manage Enano themes.</p>
+ − 1736 ');
+ − 1737 if(isset($_POST['disenable'])) {
+ − 1738 $q = 'SELECT enabled FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1739 $s = $db->sql_query($q);
+ − 1740 if(!$s) die('Error selecting enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1741 $r = $db->fetchrow_num($s);
+ − 1742 $db->free_result();
+ − 1743 if($r[0] == 1) $e = 0;
+ − 1744 else $e = 1;
+ − 1745 $s=true;
+ − 1746 if($e==0)
+ − 1747 {
+ − 1748 $c = $db->sql_query('SELECT * FROM '.table_prefix.'themes WHERE enabled=1');
+ − 1749 if(!$c) $db->_die('The backup check for having at least on theme enabled failed.');
+ − 1750 if($db->numrows() <= 1) { echo '<div class="warning-box">You cannot disable the last remaining theme.</div>'; $s=false; }
+ − 1751 }
+ − 1752 $db->free_result();
+ − 1753 if($s) {
+ − 1754 $q = 'UPDATE '.table_prefix.'themes SET enabled='.$e.' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1755 $a = $db->sql_query($q);
+ − 1756 if(!$a) die('Error updating enabled/disabled state value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1757 else echo('<div class="info-box">The theme "'.$_POST['theme_id'].'" has been '. ( ( $e == '1' ) ? 'enabled' : 'disabled' ).'.</div>');
+ − 1758 }
+ − 1759 }
+ − 1760 elseif(isset($_POST['edit'])) {
+ − 1761
+ − 1762 $dir = './themes/'.$_POST['theme_id'].'/css/';
+ − 1763 $list = Array();
+ − 1764 // Open a known directory, and proceed to read its contents
+ − 1765 if (is_dir($dir)) {
+ − 1766 if ($dh = opendir($dir)) {
+ − 1767 while (($file = readdir($dh)) !== false) {
+ − 1768 if(preg_match('#^(.*?)\.css$#is', $file) && $file != '_printable.css') {
+ − 1769 $list[$file] = capitalize_first_letter(substr($file, 0, strlen($file)-4));
+ − 1770 }
+ − 1771 }
+ − 1772 closedir($dh);
+ − 1773 }
+ − 1774 }
+ − 1775 $lk = array_keys($list);
+ − 1776
+ − 1777 $q = 'SELECT theme_name,default_style FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1778 $s = $db->sql_query($q);
+ − 1779 if(!$s) die('Error selecting name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1780 $r = $db->fetchrow_num($s);
+ − 1781 $db->free_result();
+ − 1782 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">');
+ − 1783 echo('<div class="question-box">
+ − 1784 Theme name displayed to users: <input type="text" name="name" value="'.$r[0].'" /><br /><br />
+ − 1785 Default stylesheet: <select name="defaultcss">');
+ − 1786 foreach ($lk as $l)
+ − 1787 {
+ − 1788 if($r[1] == $l) $v = ' selected="selected"';
+ − 1789 else $v = '';
+ − 1790 echo "<option value='{$l}'$v>{$list[$l]}</option>";
+ − 1791 }
+ − 1792 echo('</select><br /><br />
+ − 1793 <input type="submit" name="editsave" value="OK" /><input type="hidden" name="theme_id" value="'.$_POST['theme_id'].'" />
+ − 1794 </div>');
+ − 1795 echo('</form>');
+ − 1796 }
+ − 1797 elseif(isset($_POST['editsave'])) {
+ − 1798 $q = 'UPDATE '.table_prefix.'themes SET theme_name=\'' . $db->escape($_POST['name']) . '\',default_style=\''.$db->escape($_POST['defaultcss']).'\' WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1799 $s = $db->sql_query($q);
+ − 1800 if(!$s) die('Error updating name value: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1801 else echo('<div class="info-box">Theme data updated.</div>');
+ − 1802 }
+ − 1803 elseif(isset($_POST['up'])) {
+ − 1804 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1805 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1806 $s = $db->sql_query($q);
+ − 1807 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1808 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1809 $sn = $db->sql_query($q);
+ − 1810 if(!$sn) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1811 $r = $db->fetchrow_num($sn);
+ − 1812 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == 1 /* ...and check if this theme is already at the top */ ) { echo('<div class="warning-box">This theme is already at the top of the list, or there is only one theme installed.</div>'); } else {
+ − 1813 // Get the order IDs of the selected theme and the theme before it
+ − 1814 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\'' . $db->escape($_POST['theme_id']) . '\'';
+ − 1815 $s = $db->sql_query($q);
+ − 1816 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1817 $r = $db->fetchrow_num($s);
+ − 1818 $r = $r[0];
+ − 1819 $rb = $r - 1;
+ − 1820 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1821 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1822 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1823 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1824 echo('<div class="info-box">Theme moved up.</div>');
+ − 1825 }
+ − 1826 $db->free_result($s);
+ − 1827 $db->free_result($sn);
+ − 1828 }
+ − 1829 elseif(isset($_POST['down'])) {
+ − 1830 // If there is only one theme or if the selected theme is already at the top, do nothing
+ − 1831 $q = 'SELECT theme_order FROM '.table_prefix.'themes ORDER BY theme_order;';
+ − 1832 $s = $db->sql_query($q);
+ − 1833 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1834 $r = $db->fetchrow_num($s);
+ − 1835 if( /* check for only one theme... */ $db->numrows($s) < 2 || $r[0] == $db->numrows($s) /* ...and check if this theme is already at the bottom */ ) { echo('<div class="warning-box">This theme is already at the bottom of the list, or there is only one theme installed.</div>'); } else {
+ − 1836 // Get the order IDs of the selected theme and the theme before it
+ − 1837 $q = 'SELECT theme_order FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\'';
+ − 1838 $s = $db->sql_query($q);
+ − 1839 if(!$s) die('Error selecting order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1840 $r = $db->fetchrow_num($s);
+ − 1841 $r = $r[0];
+ − 1842 $rb = $r + 1;
+ − 1843 // Thank God for jEdit's rectangular selection and the ablity to edit multiple lines at the same time ;)
+ − 1844 $q = 'UPDATE '.table_prefix.'themes SET theme_order=0 WHERE theme_order='.$rb.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1845 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$rb.' WHERE theme_order='.$r.''; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1846 $q = 'UPDATE '.table_prefix.'themes SET theme_order='.$r.' WHERE theme_order=0'; /* Check for errors... <sigh> */ $s = $db->sql_query($q); if(!$s) die('Error updating order information: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1847 echo('<div class="info-box">Theme moved down.</div>');
+ − 1848 }
+ − 1849 }
+ − 1850 else if(isset($_POST['uninstall']))
+ − 1851 {
+ − 1852 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1853 $s = $db->sql_query($q);
+ − 1854 if ( !$s )
+ − 1855 {
+ − 1856 die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1857 }
+ − 1858 $n = $db->numrows($s);
+ − 1859 $db->free_result();
+ − 1860
+ − 1861 if ( $_POST['theme_id'] == 'oxygen' )
+ − 1862 {
+ − 1863 echo '<div class="error-box">The Oxygen theme is used by Enano for installation, upgrades, and error messages, and cannot be uninstalled.</div>';
+ − 1864 }
+ − 1865 else
+ − 1866 {
+ − 1867 if($n < 2)
+ − 1868 {
+ − 1869 echo '<div class="error-box">The theme could not be uninstalled because it is the only theme left.</div>';
+ − 1870 }
+ − 1871 else
+ − 1872 {
+ − 1873 $q = 'DELETE FROM '.table_prefix.'themes WHERE theme_id=\''.$db->escape($_POST['theme_id']).'\' LIMIT 1;';
+ − 1874 $s = $db->sql_query($q);
+ − 1875 if ( !$s )
+ − 1876 {
+ − 1877 die('Error deleting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1878 }
+ − 1879 else
+ − 1880 {
+ − 1881 echo('<div class="info-box">Theme uninstalled.</div>');
+ − 1882 }
+ − 1883 }
+ − 1884 }
+ − 1885 }
+ − 1886 elseif(isset($_POST['install'])) {
+ − 1887 $q = 'SELECT * FROM '.table_prefix.'themes;';
+ − 1888 $s = $db->sql_query($q);
+ − 1889 if(!$s) die('Error getting theme count: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1890 $n = $db->numrows($s);
+ − 1891 $n++;
+ − 1892 $theme_id = $_POST['theme_id'];
+ − 1893 $theme = Array();
+ − 1894 include('./themes/'.$theme_id.'/theme.cfg');
+ − 1895 $q = 'INSERT INTO '.table_prefix.'themes(theme_id,theme_name,theme_order,enabled) VALUES(\''.$theme['theme_id'].'\', \''.$theme['theme_name'].'\', '.$n.', 1)';
+ − 1896 $s = $db->sql_query($q);
+ − 1897 if(!$s) die('Error inserting theme data: '.mysql_error().'<br /><u>SQL:</u><br />'.$q);
+ − 1898 else echo('<div class="info-box">Theme "'.$theme['theme_name'].'" installed.</div>');
+ − 1899 }
+ − 1900 echo('
+ − 1901 <h3>Currently installed themes</h3>
+ − 1902 <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">
+ − 1903 <p>
+ − 1904 <select name="theme_id">
+ − 1905 ');
+ − 1906 $q = 'SELECT theme_id,theme_name,enabled FROM '.table_prefix.'themes ORDER BY theme_order';
+ − 1907 $s = $db->sql_query($q);
+ − 1908 if(!$s) die('Error selecting theme data: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1909 while ( $r = $db->fetchrow_num($s) ) {
+ − 1910 if($r[2] < 1) $r[1] .= ' (disabled)';
+ − 1911 echo('<option value="'.$r[0].'">'.$r[1].'</option>');
+ − 1912 }
+ − 1913 $db->free_result();
+ − 1914 echo('
+ − 1915 </select> <input type="submit" name="disenable" value="Enable/Disable" /> <input type="submit" name="edit" value="Change settings" /> <input type="submit" name="up" value="Move up" /> <input type="submit" name="down" value="Move down" /> <input type="submit" name="uninstall" value="Uninstall" style="color: #DD3300; font-weight: bold;" />
+ − 1916 </p>
+ − 1917 </form>
+ − 1918 <h3>Install a new theme</h3>
+ − 1919 ');
+ − 1920 $theme = Array();
+ − 1921 $obb = '';
+ − 1922 for($i=0;$i<sizeof($l);$i++) {
+ − 1923 if(is_file('./themes/'.$l[$i].'/theme.cfg') && file_exists('./themes/'.$l[$i].'/theme.cfg')) {
+ − 1924 include('./themes/'.$l[$i].'/theme.cfg');
+ − 1925 $q = 'SELECT * FROM '.table_prefix.'themes WHERE theme_id=\''.$theme['theme_id'].'\'';
+ − 1926 $s = $db->sql_query($q);
+ − 1927 if(!$s) die('Error selecting list of currently installed themes: '.mysql_error().'<br /><u>Attempted SQL:</u><br />'.$q);
+ − 1928 if($db->numrows($s) < 1) {
+ − 1929 $obb .= '<option value="'.$theme['theme_id'].'">'.$theme['theme_name'].'</option>';
+ − 1930 }
+ − 1931 $db->free_result();
+ − 1932 }
+ − 1933 }
+ − 1934 if($obb != '') {
+ − 1935 echo('<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post"><p>');
+ − 1936 echo('<select name="theme_id">');
+ − 1937 echo($obb);
+ − 1938 echo('</select>');
+ − 1939 echo('
+ − 1940 <input type="submit" name="install" value="Install this theme" />
+ − 1941 </p></form>');
+ − 1942 } else echo('<p>All themes are currently installed.</p>');
+ − 1943 }
+ − 1944
+ − 1945 function page_Admin_BanControl()
+ − 1946 {
+ − 1947 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1948 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 1949 {
+ − 1950 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 1951 return;
+ − 1952 }
+ − 1953
+ − 1954 if(isset($_GET['action']) && $_GET['action'] == 'delete' && isset($_GET['id']) && $_GET['id'] != '')
+ − 1955 {
+ − 1956 $e = $db->sql_query('DELETE FROM '.table_prefix.'banlist WHERE ban_id=' . $db->escape($_GET['id']) . '');
+ − 1957 if(!$e) $db->_die('The ban list entry was not deleted.');
+ − 1958 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1959 if(isset($_POST['create']) && !defined('ENANO_DEMO_MODE'))
0
+ − 1960 {
+ − 1961 $q = 'INSERT INTO '.table_prefix.'banlist(ban_type,ban_value,reason,is_regex) VALUES( ' . $db->escape($_POST['type']) . ', \'' . $db->escape($_POST['value']) . '\', \''.$db->escape($_POST['reason']).'\'';
+ − 1962 if(isset($_POST['regex'])) $q .= ', 1';
+ − 1963 else $q .= ', 0';
+ − 1964 $q .= ');';
+ − 1965 $e = $db->sql_query($q);
+ − 1966 if(!$e) $db->_die('The banlist could not be updated.');
+ − 1967 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1968 else if ( isset($_POST['create']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1969 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1970 echo '<div class="error-box">This function is disabled in the demo. Just because <i>you</i> don\'t like ' . htmlspecialchars($_POST['value']) . ' doesn\'t mean <i>we</i> don\'t like ' . htmlspecialchars($_POST['value']) . '.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 1971 }
0
+ − 1972 $q = $db->sql_query('SELECT ban_id,ban_type,ban_value,is_regex FROM '.table_prefix.'banlist ORDER BY ban_type;');
+ − 1973 if(!$q) $db->_die('The banlist data could not be selected.');
+ − 1974 echo '<table border="0" cellspacing="1" cellpadding="4">';
+ − 1975 echo '<tr><th>Type</th><th>Value</th><th>Regular Expression</th><th></th></tr>';
+ − 1976 if($db->numrows() < 1) echo '<td colspan="4">No ban rules yet.</td>';
+ − 1977 while($r = $db->fetchrow())
+ − 1978 {
+ − 1979 if($r['ban_type']==BAN_IP) $t = 'IP address';
+ − 1980 elseif($r['ban_type']==BAN_USER) $t = 'Username';
+ − 1981 elseif($r['ban_type']==BAN_EMAIL) $t = 'E-mail address';
+ − 1982 if($r['is_regex']) $g = 'Yes'; else $g = 'No';
+ − 1983 echo '<tr><td>'.$t.'</td><td>'.$r['ban_value'].'</td><td>'.$g.'</td><td><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'BanControl&action=delete&id='.$r['ban_id']).'">Delete</a></td></tr>';
+ − 1984 }
+ − 1985 $db->free_result();
+ − 1986 echo '</table>';
+ − 1987 echo '<h3>Create new ban rule</h3>';
+ − 1988 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 1989 ?>
+ − 1990 Type: <select name="type"><option value="<?php echo BAN_IP; ?>">IP address</option><option value="<?php echo BAN_USER; ?>">Username</option><option value="<?php echo BAN_EMAIL; ?>">E-mail address</option></select><br />
+ − 1991 Rule: <input type="text" name="value" size="30" /><br />
+ − 1992 Reason to show to the banned user: <textarea name="reason" rows="7" cols="20"></textarea><br />
+ − 1993 <input type="checkbox" name="regex" id="regex" /> <label for="regex">This rule is a regular expression</label> (advanced users only)<br />
+ − 1994 <input type="submit" style="font-weight: bold;" name="create" value="Create new ban rule" />
+ − 1995 <?php
+ − 1996 echo '</form>';
+ − 1997 }
+ − 1998
+ − 1999 function page_Admin_MassEmail()
+ − 2000 {
+ − 2001 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2002 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2003 {
+ − 2004 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2005 return;
+ − 2006 }
+ − 2007
+ − 2008 global $enano_config;
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2009 if ( isset($_POST['do_send']) && !defined('ENANO_DEMO_MODE') )
0
+ − 2010 {
+ − 2011 $use_smtp = getConfig('smtp_enabled') == '1';
+ − 2012
+ − 2013 //
+ − 2014 // Let's do some checking to make sure that mass mail functions
+ − 2015 // are working in win32 versions of php. (copied from phpBB)
+ − 2016 //
+ − 2017 if ( preg_match('/[c-z]:\\\.*/i', getenv('PATH')) && !$use_smtp)
+ − 2018 {
+ − 2019 $ini_val = ( @phpversion() >= '4.0.0' ) ? 'ini_get' : 'get_cfg_var';
+ − 2020
+ − 2021 // We are running on windows, force delivery to use our smtp functions
+ − 2022 // since php's are broken by default
+ − 2023 $use_smtp = true;
+ − 2024 $enano_config['smtp_server'] = @$ini_val('SMTP');
+ − 2025 }
+ − 2026
+ − 2027 $mail = new emailer( !empty($use_smtp) );
+ − 2028
+ − 2029 // Validate subject/message body
+ − 2030 $subject = stripslashes(trim($_POST['subject']));
+ − 2031 $message = stripslashes(trim($_POST['message']));
+ − 2032
+ − 2033 if ( empty($subject) )
+ − 2034 $errors[] = 'Please enter a subject.';
+ − 2035 if ( empty($message) )
+ − 2036 $errors[] = 'Please enter a message.';
+ − 2037
+ − 2038 // Get list of members
+ − 2039 if ( !empty($_POST['userlist']) )
+ − 2040 {
+ − 2041 $userlist = str_replace(', ', ',', $_POST['userlist']);
+ − 2042 $userlist = explode(',', $userlist);
+ − 2043 foreach ( $userlist as $k => $u )
+ − 2044 {
+ − 2045 if ( $u == $session->username )
+ − 2046 {
+ − 2047 // Message is automatically sent to the sender
+ − 2048 unset($userlist[$k]);
+ − 2049 }
+ − 2050 else
+ − 2051 {
+ − 2052 $userlist[$k] = $db->escape($u);
+ − 2053 }
+ − 2054 }
+ − 2055 $userlist = 'WHERE username=\'' . implode('\' OR username=\'', $userlist) . '\'';
+ − 2056
+ − 2057 $q = $db->sql_query('SELECT email FROM '.table_prefix.'users ' . $userlist . ';');
+ − 2058 if ( !$q )
+ − 2059 $db->_die();
+ − 2060
+ − 2061 if ( $row = $db->fetchrow() )
+ − 2062 {
+ − 2063 do {
+ − 2064 $mail->cc($row['email']);
+ − 2065 } while ( $row = $db->fetchrow() );
+ − 2066 }
+ − 2067
+ − 2068 $db->free_result();
+ − 2069
+ − 2070 }
+ − 2071 else
+ − 2072 {
+ − 2073 // Sending to a usergroup
+ − 2074
+ − 2075 $group_id = intval($_POST['group_id']);
+ − 2076 if ( $group_id < 1 )
+ − 2077 {
+ − 2078 $errors[] = 'Invalid group ID';
+ − 2079 }
+ − 2080 else
+ − 2081 {
+ − 2082 $q = $db->sql_query('SELECT u.email FROM '.table_prefix.'group_members AS g
+ − 2083 LEFT JOIN '.table_prefix.'users AS u
+ − 2084 ON (u.user_id=g.user_id)
+ − 2085 WHERE g.group_id=' . $group_id . ';');
+ − 2086 if ( !$q )
+ − 2087 $db->_die();
+ − 2088
+ − 2089 if ( $row = $db->fetchrow() )
+ − 2090 {
+ − 2091 do {
+ − 2092 $mail->cc($row['email']);
+ − 2093 } while ( $row = $db->fetchrow() );
+ − 2094 }
+ − 2095
+ − 2096 $db->free_result();
+ − 2097 }
+ − 2098 }
+ − 2099
+ − 2100 if ( sizeof($errors) < 1 )
+ − 2101 {
+ − 2102
+ − 2103 $mail->from(getConfig('contact_email'));
+ − 2104 $mail->replyto(getConfig('contact_email'));
+ − 2105 $mail->set_subject($subject);
+ − 2106 $mail->email_address(getConfig('contact_email'));
+ − 2107
+ − 2108 // Copied/modified from phpBB
+ − 2109 $email_headers = 'X-AntiAbuse: Website server name - ' . $_SERVER['SERVER_NAME'] . "\n";
+ − 2110 $email_headers .= 'X-AntiAbuse: User_id - ' . $session->user_id . "\n";
+ − 2111 $email_headers .= 'X-AntiAbuse: Username - ' . $session->username . "\n";
+ − 2112 $email_headers .= 'X-AntiAbuse: User IP - ' . $_SERVER['REMOTE_ADDR'] . "\n";
+ − 2113
+ − 2114 $mail->extra_headers($email_headers);
+ − 2115
+ − 2116 $tpl = 'The following message was mass-mailed by {SENDER}, one of the administrators from {SITE_NAME}. If this message contains spam or any comments which you find abusive or offensive, please contact the administration team at:
+ − 2117
+ − 2118 {CONTACT_EMAIL}
+ − 2119
+ − 2120 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ − 2121 {MESSAGE}
+ − 2122 ';
+ − 2123
+ − 2124 $mail->use_template($tpl);
+ − 2125
+ − 2126 $mail->assign_vars(array(
+ − 2127 'SENDER' => $session->username,
+ − 2128 'SITE_NAME' => getConfig('site_name'),
+ − 2129 'CONTACT_EMAIL' => getConfig('contact_email'),
+ − 2130 'MESSAGE' => $message
+ − 2131 ));
+ − 2132
+ − 2133 //echo '<pre>'.print_r($mail,true).'</pre>';
+ − 2134
+ − 2135 // All done
+ − 2136 $mail->send();
+ − 2137 $mail->reset();
+ − 2138
+ − 2139 echo '<div class="info-box">Your message has been sent.</div>';
+ − 2140
+ − 2141 }
+ − 2142 else
+ − 2143 {
+ − 2144 echo '<div class="warning-box">Could not send message for the following reason(s):<ul><li>' . implode('</li><li>', $errors) . '</li></ul></div>';
+ − 2145 }
+ − 2146
+ − 2147 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2148 else if ( isset($_POST['do_send']) && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2149 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2150 echo '<div class="error-box">This function is disabled in the demo. You think demo@enanocms.org likes getting "test" mass e-mails?</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2151 }
0
+ − 2152 echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">';
+ − 2153 ?>
+ − 2154 <div class="tblholder">
+ − 2155 <table border="0" cellspacing="1" cellpadding="4">
+ − 2156 <tr>
+ − 2157 <th colspan="2">Send mass e-mail</th>
+ − 2158 </tr>
+ − 2159 <tr>
+ − 2160 <td class="row2" rowspan="2" style="width: 30%; min-width: 200px;">
+ − 2161 Send message to:<br />
+ − 2162 <small>
+ − 2163 By default, this message will be sent to the group selected here. You may instead send the message to a specific
+ − 2164 list of users by entering them in the second row, with usernames separated by a single comma (no space).
+ − 2165 </small>
+ − 2166 </td>
+ − 2167 <td class="row1">
+ − 2168 <select name="group_id">
+ − 2169 <?php
+ − 2170 $q = $db->sql_query('SELECT group_name,group_id FROM '.table_prefix.'groups ORDER BY group_name ASC;');
+ − 2171 if ( !$q )
+ − 2172 $db->_die();
+ − 2173 while ( $row = $db->fetchrow() )
+ − 2174 {
+ − 2175 echo '<option value="' . $row['group_id'] . '">' . $row['group_name'] . '</option>';
+ − 2176 }
+ − 2177 ?>
+ − 2178 </select>
+ − 2179 </td>
+ − 2180 </tr>
+ − 2181 <tr>
+ − 2182 <td class="row1">
+ − 2183 Usernames: <input type="text" name="userlist" size="50" />
+ − 2184 </td>
+ − 2185 </tr>
+ − 2186 <tr>
+ − 2187 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 2188 Subject:
+ − 2189 </td>
+ − 2190 <td class="row1">
+ − 2191 <input name="subject" type="text" size="50" />
+ − 2192 </td>
+ − 2193 </tr>
+ − 2194 <tr>
+ − 2195 <td class="row2" style="width: 30%; min-width: 200px;">
+ − 2196 Message:
+ − 2197 </td>
+ − 2198 <td class="row1">
+ − 2199 <textarea name="message" rows="30" cols="60" style="width: 100%;"></textarea>
+ − 2200 </td>
+ − 2201 </tr>
+ − 2202 <tr>
+ − 2203 <th class="subhead" colspan="2" style="text-align: left;" valign="middle">
+ − 2204 <div style="float: right;"><input type="submit" name="do_send" value="Send message" /></div>
+ − 2205 <small style="font-weight: normal;">Please be warned: it may take a LONG time to send this message. <b>Please do not stop the script until the process is finished.</b></small>
+ − 2206 </th>
+ − 2207 </tr>
+ − 2208
+ − 2209 </table>
+ − 2210 </div>
+ − 2211 <?php
+ − 2212 echo '</form>';
+ − 2213 }
+ − 2214
+ − 2215 function page_Admin_DBBackup()
+ − 2216 {
+ − 2217 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2218 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2219 {
+ − 2220 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2221 return;
+ − 2222 }
+ − 2223
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2224 if(isset($_GET['submitting']) && $_GET['submitting'] == 'yes' && defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2225 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2226 redirect(makeUrlComplete('Special', 'Administration'), 'Access denied', 'You\'ve got to be kidding me. Forget it, kid.', 4 );
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2227 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2228
0
+ − 2229 global $system_table_list;
+ − 2230 if(isset($_GET['submitting']) && $_GET['submitting'] == 'yes')
+ − 2231 {
+ − 2232
+ − 2233 if(defined('SQL_BACKUP_CRYPT'))
+ − 2234 // Try to increase our time limit
+ − 2235 @set_time_limit(300); // five minutes
+ − 2236 // Do the actual export
+ − 2237 $aesext = ( defined('SQL_BACKUP_CRYPT') ) ? '.tea' : '';
+ − 2238 $filename = 'enano_backup_' . date('dmy') . '.sql' . $aesext;
+ − 2239 ob_start();
+ − 2240 header('Content-disposition: attachment, filename="'.$filename.'";');
+ − 2241 header('Content-type: application/transact-sql');
+ − 2242 // Spew some headers
+ − 2243 $headdate = date('F d, Y \a\t h:i a');
+ − 2244 echo <<<HEADER
+ − 2245 -- Enano CMS SQL backup
+ − 2246 -- Generated on {$headdate} by {$session->username}
+ − 2247
+ − 2248 HEADER;
+ − 2249 // build the table list
+ − 2250 $base = ( isset($_POST['do_system_tables']) ) ? $system_table_list : Array();
+ − 2251 $add = ( isset($_POST['additional_tables'])) ? $_POST['additional_tables'] : Array();
+ − 2252 $tables = array_merge($base, $add);
+ − 2253
+ − 2254 // Log it!
+ − 2255 $e = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'db_backup\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($session->username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', \'' . $db->escape(implode(', ', $tables)) . '\')');
+ − 2256 if ( !$e )
+ − 2257 $db->_die();
+ − 2258
+ − 2259 foreach($tables as $i => $t)
+ − 2260 {
+ − 2261 if(!preg_match('#^([a-z0-9_]+)$#i', $t))
+ − 2262 die('Hacking attempt');
+ − 2263 // if($t == table_prefix.'files' && isset($_POST['do_data']))
+ − 2264 // unset($tables[$i]);
+ − 2265 }
+ − 2266 foreach($tables as $t)
+ − 2267 {
+ − 2268 // Sorry folks - this script CAN'T backup enano_files, enano_search_index, and enano_search_cache due to the sheer size of the tables.
+ − 2269 // If encryption is enabled the log data will be excluded too.
+ − 2270 echo export_table(
+ − 2271 $t,
+ − 2272 isset($_POST['do_struct']),
+ − 2273 ( isset($_POST['do_data']) /* && $t != table_prefix.'files' && $t != table_prefix.'search_index' && $t != table_prefix.'search_cache' && ( !defined('SQL_BACKUP_CRYPT') || ( defined('SQL_BACKUP_CRYPT') && $t != table_prefix.'logs' ) ) */ ),
+ − 2274 false
+ − 2275 ) . "\n";
+ − 2276 }
+ − 2277 $data = ob_get_contents();
+ − 2278 ob_end_clean();
+ − 2279 if(defined('SQL_BACKUP_CRYPT'))
+ − 2280 {
+ − 2281 // Free some memory, we don't need this stuff any more
+ − 2282 $db->close();
+ − 2283 unset($paths, $db, $template, $plugins);
+ − 2284 $tea = new TEACrypt();
+ − 2285 $data = $tea->encrypt($data, $session->private_key);
+ − 2286 }
+ − 2287 header('Content-length: '.strlen($data));
+ − 2288 echo $data;
+ − 2289 exit;
+ − 2290 }
+ − 2291 else
+ − 2292 {
+ − 2293 // Show the UI
+ − 2294 echo '<form action="'.makeUrlNS('Admin', 'DBBackup', 'submitting=yes', true).'" method="post" enctype="multipart/form-data">';
+ − 2295 ?>
+ − 2296 <p>This page allows you to back up your Enano database should something go miserably wrong.</p>
+ − 2297 <p><label><input type="checkbox" name="do_system_tables" checked="checked" /> Export tables that are part of the Enano core</label><p>
+ − 2298 <p>Additional tables to export:</p>
+ − 2299 <p><select name="additional_tables[]" multiple="multiple">
+ − 2300 <?php
+ − 2301 $q = $db->sql_query('SHOW TABLES;') or $db->_die('Somehow we were denied the request to get the list of tables.');
+ − 2302 while($row = $db->fetchrow_num())
+ − 2303 {
+ − 2304 if(!in_array($row[0], $system_table_list)) echo '<option value="'.$row[0].'">'.$row[0].'</option>';
+ − 2305 }
+ − 2306 ?>
+ − 2307 </select>
+ − 2308 </p>
+ − 2309 <p><label><input type="checkbox" name="do_struct" checked="checked" /> Include table structure</label><br />
+ − 2310 <label><input type="checkbox" name="do_data" checked="checked" /> Include table data</label>
+ − 2311 </p>
+ − 2312 <p><input type="submit" value="Create backup" /></p>
+ − 2313 <?php
+ − 2314 echo '</form>';
+ − 2315 }
+ − 2316 }
+ − 2317
+ − 2318 function page_Admin_AdminLogout()
+ − 2319 {
+ − 2320 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2321 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
+ − 2322 {
+ − 2323 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';
+ − 2324 return;
+ − 2325 }
+ − 2326
+ − 2327 $session->logout(USER_LEVEL_ADMIN);
+ − 2328 echo '<h3>You have now been logged out of the administration panel.</h3><p>You will continue to be logged into the website, but you will need to re-authenticate before you can access the administration panel again.</p><p>Return to the <a href="'.makeUrl(getConfig('main_page')).'">Main Page</a>.</p>';
+ − 2329 }
+ − 2330
+ − 2331 function page_Special_Administration()
+ − 2332 {
+ − 2333 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2334
+ − 2335 if($session->auth_level < USER_LEVEL_ADMIN) {
+ − 2336 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), 'Not authorized', 'You need an authorization level of '.USER_LEVEL_ADMIN.' to use this page, your auth level is: ' . $session->auth_level, 0);
+ − 2337 exit;
+ − 2338 }
+ − 2339 else
+ − 2340 {
+ − 2341 $template->load_theme('admin', 'default');
+ − 2342 $template->init_vars();
+ − 2343 if( !isset( $_GET['noheaders'] ) )
+ − 2344 {
+ − 2345 $template->header();
+ − 2346 }
+ − 2347 echo 'Administer your Enano website.';
+ − 2348 ?>
+ − 2349 <script type="text/javascript">
+ − 2350 function ajaxPage(t)
+ − 2351 {
+ − 2352 if ( t == namespace_list.Admin + 'AdminLogout' )
+ − 2353 {
+ − 2354 var mb = new messagebox(MB_YESNO|MB_ICONQUESTION, 'Are you sure you want to de-authenticate?', 'If you de-authenticate, you will no longer be able to use the administration panel until you re-authenticate again. You may do so at any time using the Administration button on the sidebar.');
+ − 2355 mb.onclick['Yes'] = function() {
+ − 2356 var tigraentry = document.getElementById('i_div0_0').parentNode;
+ − 2357 var tigraobj = $(tigraentry);
+ − 2358 var div = document.createElement('div');
+ − 2359 div.style.backgroundColor = '#FFFFFF';
+ − 2360 domObjChangeOpac(70, div);
+ − 2361 div.style.position = 'absolute';
+ − 2362 var top = tigraobj.Top();
+ − 2363 var left = tigraobj.Left();
+ − 2364 var width = tigraobj.Width();
+ − 2365 var height = tigraobj.Height();
+ − 2366 div.style.top = top + 'px';
+ − 2367 div.style.left = left + 'px';
+ − 2368 div.style.width = width + 'px';
+ − 2369 div.style.height = height + 'px';
+ − 2370 var body = document.getElementsByTagName('body')[0];
+ − 2371 enlighten(true);
+ − 2372 body.appendChild(div);
+ − 2373 ajaxPageBin(namespace_list.Admin + 'AdminLogout');
+ − 2374 }
+ − 2375 return;
+ − 2376 }
+ − 2377 ajaxPageBin(t);
+ − 2378 }
+ − 2379 function ajaxPageBin(t)
+ − 2380 {
+ − 2381 document.getElementById('ajaxPageContainer').innerHTML = '<div class="wait-box">Loading page...</div>';
+ − 2382 ajaxGet('<?php echo scriptPath; ?>/ajax.php?title='+t+'&_mode=getpage&noheaders&auth=<?php echo $session->sid_super; ?>', function() {
+ − 2383 if(ajax.readyState == 4) {
+ − 2384 document.getElementById('ajaxPageContainer').innerHTML = ajax.responseText;
+ − 2385 fadeInfoBoxes();
+ − 2386 }
+ − 2387 });
+ − 2388 }
+ − 2389 function _enanoAdminOnload() { ajaxPage('<?php echo $paths->nslist['Admin']; ?>Home'); }
+ − 2390 var TREE_TPL = {
+ − 2391 'target' : '_self', // name of the frame links will be opened in
+ − 2392 // other possible values are: _blank, _parent, _search, _self and _top
+ − 2393
+ − 2394 'icon_e' : '<?php echo scriptPath; ?>/images/icons/empty.gif', // empty image
+ − 2395 'icon_l' : '<?php echo scriptPath; ?>/images/icons/line.gif', // vertical line
+ − 2396 'icon_32' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon normal
+ − 2397 'icon_36' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root leaf icon selected
+ − 2398 'icon_48' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon normal
+ − 2399 'icon_52' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2400 'icon_56' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon opened
+ − 2401 'icon_60' : '<?php echo scriptPath; ?>/images/icons/base.gif', // root icon selected
+ − 2402 'icon_16' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon normal
+ − 2403 'icon_20' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected
+ − 2404 'icon_24' : '<?php echo scriptPath; ?>/images/icons/folder.gif', // node icon opened
+ − 2405 'icon_28' : '<?php echo scriptPath; ?>/images/icons/folderopen.gif', // node icon selected opened
+ − 2406 'icon_0' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon normal
+ − 2407 'icon_4' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2408 'icon_8' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon opened
+ − 2409 'icon_12' : '<?php echo scriptPath; ?>/images/icons/page.gif', // leaf icon selected
+ − 2410 'icon_2' : '<?php echo scriptPath; ?>/images/icons/joinbottom.gif', // junction for leaf
+ − 2411 'icon_3' : '<?php echo scriptPath; ?>/images/icons/join.gif', // junction for last leaf
+ − 2412 'icon_18' : '<?php echo scriptPath; ?>/images/icons/plusbottom.gif', // junction for closed node
+ − 2413 'icon_19' : '<?php echo scriptPath; ?>/images/icons/plus.gif', // junction for last closed node
+ − 2414 'icon_26' : '<?php echo scriptPath; ?>/images/icons/minusbottom.gif',// junction for opened node
+ − 2415 'icon_27' : '<?php echo scriptPath; ?>/images/icons/minus.gif' // junction for last opended node
+ − 2416 };
+ − 2417 <?php
+ − 2418 echo $paths->parseAdminTree(); // Make a Javascript array that defines the tree
+ − 2419 if(!isset($_GET['module'])) { echo 'addOnloadHook(_enanoAdminOnload);'; } ?>
+ − 2420 </script>
+ − 2421 <table border="0" width="100%">
+ − 2422 <tr>
+ − 2423 <td class="holder" valign="top">
+ − 2424 <div class="pad" style="padding-right: 20px;">
+ − 2425 <script type="text/javascript">
+ − 2426 new tree(TREE_ITEMS, TREE_TPL);
+ − 2427 </script>
+ − 2428 </div>
+ − 2429 </td>
+ − 2430 <td width="100%" valign="top">
+ − 2431 <div class="pad" id="ajaxPageContainer">
+ − 2432 <?php
+ − 2433 if(isset($_GET['module']))
+ − 2434 {
+ − 2435 // Look for a namespace prefix in the urlname, and assign a different namespace, if necessary
+ − 2436 $k = array_keys($paths->nslist);
+ − 2437 for ( $i = 0; $i < sizeof($paths->nslist); $i++ )
+ − 2438 {
+ − 2439 $ln = strlen( $paths->nslist[ $k[ $i ] ] );
+ − 2440 if ( substr($_GET['module'], 0, $ln) == $paths->nslist[$k[$i]] )
+ − 2441 {
+ − 2442 $ns = $k[$i];
+ − 2443 $nm = substr($_GET['module'], $ln, strlen($_GET['module']));
+ − 2444 }
+ − 2445 }
+ − 2446 $fname = 'page_'.$ns.'_'.$nm;
+ − 2447 $s = strpos($fname, '?noheaders');
+ − 2448 if($s) $fname = substr($fname, 0, $s);
+ − 2449 $paths->cpage['module'] = $_GET['module'];
+ − 2450 if ( function_exists($fname) && $_GET['module'] != $paths->nslist['Special'] . 'Administration' )
+ − 2451 {
+ − 2452 eval($fname.'();');
+ − 2453 }
+ − 2454 }
+ − 2455 else
+ − 2456 {
+ − 2457 echo '<div class="wait-box">Please wait while the administration panel loads. You need to be using a recent browser with AJAX support in order to use Runt.</div>';
+ − 2458 }
+ − 2459 ?>
+ − 2460 </div>
+ − 2461 </td>
+ − 2462 </tr>
+ − 2463 </table>
+ − 2464
+ − 2465 <?php
+ − 2466 }
+ − 2467 if(!isset($_GET['noheaders']))
+ − 2468 {
+ − 2469 $template->footer();
+ − 2470 }
+ − 2471 }
+ − 2472
+ − 2473 function page_Special_EditSidebar()
+ − 2474 {
+ − 2475 global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2476
+ − 2477 if($session->auth_level < USER_LEVEL_ADMIN)
+ − 2478 {
+ − 2479 redirect(makeUrlNS('Special', 'Login/'.$paths->page, 'level='.USER_LEVEL_ADMIN), '', '', false);
+ − 2480 exit;
+ − 2481 }
+ − 2482 else
+ − 2483 {
+ − 2484
+ − 2485 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx.js"></script>');
+ − 2486 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/dbx-key.js"></script>');
+ − 2487 $template->add_header('<script type="text/javascript" src="'.scriptPath.'/includes/clientside/sbedit.js"></script>');
+ − 2488 $template->add_header('<link rel="stylesheet" type="text/css" href="'.scriptPath.'/includes/clientside/dbx.css" />');
+ − 2489
+ − 2490 // Knock the sidebars dead to keep javascript in plugins from interfering
+ − 2491 $template->tpl_strings['SIDEBAR_LEFT'] = '';
+ − 2492 $template->tpl_strings['SIDEBAR_RIGHT'] = '';
+ − 2493
+ − 2494 $template->load_theme('oxygen', 'bleu');
+ − 2495 $template->init_vars();
+ − 2496
+ − 2497 $template->header();
+ − 2498
+ − 2499 if(isset($_POST['save']))
+ − 2500 {
+ − 2501 // Write the new block order to the database
+ − 2502 // The only way to do this is with tons of queries (one per block + one select query at the start to count everything) but afaik its safe...
+ − 2503 // Anyone know a better way to do this?
+ − 2504 $q = $db->sql_query('SELECT item_order,item_id,sidebar_id FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2505 if ( !$q )
+ − 2506 {
+ − 2507 $db->_die('The sidebar order data could not be selected.');
+ − 2508 }
+ − 2509 $orders = Array();
+ − 2510 while($row = $db->fetchrow())
+ − 2511 {
+ − 2512 $orders[] = Array(
+ − 2513 count($orders),
+ − 2514 $row['item_id'],
+ − 2515 $row['sidebar_id'],
+ − 2516 );
+ − 2517 }
+ − 2518 $db->free_result();
+ − 2519
+ − 2520 // We now have an array with each sidebar ID in its respective order. Explode the order string in $_POST['order_(left|right)'] and use it to build a set of queries.
+ − 2521 $ol = explode(',', $_POST['order_left']);
+ − 2522 $odr = explode(',', $_POST['order_right']);
+ − 2523 $om = array_merge($ol, $odr);
+ − 2524 unset($ol, $odr);
+ − 2525 $queries = Array();
+ − 2526 foreach($orders as $k => $v)
+ − 2527 {
+ − 2528 $queries[] = 'UPDATE '.table_prefix.'sidebar SET item_order='.$om[$k].' WHERE item_id='.$v[1].';';
+ − 2529 }
+ − 2530 foreach($queries as $sql)
+ − 2531 {
+ − 2532 $q = $db->sql_query($sql);
+ − 2533 if(!$q)
+ − 2534 {
+ − 2535 $t = $db->get_error();
+ − 2536 echo $t;
+ − 2537 $template->footer();
+ − 2538 exit;
+ − 2539 }
+ − 2540 }
+ − 2541 echo '<div class="info-box" style="margin: 10px 0;">The sidebar order information was updated successfully.</div>';
+ − 2542 }
+ − 2543 elseif(isset($_POST['create']))
+ − 2544 {
+ − 2545 switch((int)$_POST['type'])
+ − 2546 {
+ − 2547 case BLOCK_WIKIFORMAT:
+ − 2548 $content = $_POST['wikiformat_content'];
+ − 2549 break;
+ − 2550 case BLOCK_TEMPLATEFORMAT:
+ − 2551 $content = $_POST['templateformat_content'];
+ − 2552 break;
+ − 2553 case BLOCK_HTML:
+ − 2554 $content = $_POST['html_content'];
+ − 2555 break;
+ − 2556 case BLOCK_PHP:
+ − 2557 $content = $_POST['php_content'];
+ − 2558 break;
+ − 2559 case BLOCK_PLUGIN:
+ − 2560 $content = $_POST['plugin_id'];
+ − 2561 break;
+ − 2562 }
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2563
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2564 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2565 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2566 // Sanitize the HTML
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2567 $content = sanitize_html($content, true);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2568 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2569
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2570 if ( defined('ENANO_DEMO_MODE') && intval($_POST['type']) == BLOCK_PHP )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2571 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2572 echo '<div class="error-box" style="margin: 10px 0 10px 0;">Adding PHP code blocks in the Enano administration demo has been disabled for security reasons.</div>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2573 $_POST['php_content'] = '?><Nulled>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2574 $content = $_POST['php_content'];
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2575 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2576
0
+ − 2577 // Get the value of item_order
+ − 2578
+ − 2579 $q = $db->sql_query('SELECT * FROM '.table_prefix.'sidebar WHERE sidebar_id='.$db->escape($_POST['sidebar_id']).';');
+ − 2580 if(!$q) $db->_die('The order number could not be selected');
+ − 2581 $io = $db->numrows();
+ − 2582
+ − 2583 $db->free_result();
+ − 2584
+ − 2585 $q = 'INSERT INTO '.table_prefix.'sidebar(block_name, block_type, sidebar_id, block_content, item_order) VALUES ( \''.$db->escape($_POST['title']).'\', \''.$db->escape($_POST['type']).'\', \''.$db->escape($_POST['sidebar_id']).'\', \''.$db->escape($content).'\', '.$io.' );';
+ − 2586 $result = $db->sql_query($q);
+ − 2587 if(!$result)
+ − 2588 {
+ − 2589 echo $db->get_error();
+ − 2590 $template->footer();
+ − 2591 exit;
+ − 2592 }
+ − 2593
+ − 2594 echo '<div class="info-box" style="margin: 10px 0;">The item was added.</div>';
+ − 2595
+ − 2596 }
+ − 2597
+ − 2598 if(isset($_GET['action']) && isset($_GET['id']))
+ − 2599 {
+ − 2600 if(preg_match('#^([0-9]*)$#', $_GET['id']))
+ − 2601 {
+ − 2602 } else {
+ − 2603 echo '<div class="warning-box">Error with action: $_GET["id"] was not an integer, aborting to prevent SQL injection</div>';
+ − 2604 }
+ − 2605 switch($_GET['action'])
+ − 2606 {
+ − 2607 case 'new':
+ − 2608 ?>
+ − 2609 <script type="text/javascript">
+ − 2610 function setType(input)
+ − 2611 {
+ − 2612 val = input.value;
+ − 2613 if(!val)
+ − 2614 {
+ − 2615 return false;
+ − 2616 }
+ − 2617 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2618 for(var i in divs)
+ − 2619 {
+ − 2620 if(divs[i].id == 'blocktype_'+val) divs[i].style.display = 'block';
+ − 2621 else divs[i].style.display = 'none';
+ − 2622 }
+ − 2623 }
+ − 2624 </script>
+ − 2625
+ − 2626 <form action="<?php echo makeUrl($paths->page); ?>" method="post">
+ − 2627
+ − 2628 <p>
+ − 2629 What type of block should this be?
+ − 2630 </p>
+ − 2631 <p>
+ − 2632 <select name="type" onchange="setType(this)"> <?php /* (NOT WORKING, at least in firefox 2) onload="var thingy = this; setTimeout('setType(thingy)', 500);" */ ?>
+ − 2633 <option value="<?php echo BLOCK_WIKIFORMAT; ?>">Wiki-formatted block</option>
+ − 2634 <option value="<?php echo BLOCK_TEMPLATEFORMAT; ?>">Template-formatted block (old pre-beta 3 behavior)</option>
+ − 2635 <option value="<?php echo BLOCK_HTML; ?>">Raw HTML block</option>
+ − 2636 <option value="<?php echo BLOCK_PHP; ?>">PHP code block (danger, Will Robinson!)</option>
+ − 2637 <option value="<?php echo BLOCK_PLUGIN; ?>">Use code from a plugin</option>
+ − 2638 </select>
+ − 2639 </p>
+ − 2640
+ − 2641 <p>
+ − 2642
+ − 2643 Block title: <input name="title" type="text" size="40" /><br />
+ − 2644 Which sidebar: <select name="sidebar_id"><option value="<?php echo SIDEBAR_LEFT; ?>">Left</option><option value="<?php echo SIDEBAR_RIGHT; ?>">Right</option></select>
+ − 2645
+ − 2646 </p>
+ − 2647
+ − 2648 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_WIKIFORMAT; ?>">
+ − 2649 <p>
+ − 2650 Wikitext:
+ − 2651 </p>
+ − 2652 <p>
+ − 2653 <textarea style="width: 98%;" name="wikiformat_content" rows="15" cols="50"></textarea>
+ − 2654 </p>
+ − 2655 </div>
+ − 2656
+ − 2657 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_TEMPLATEFORMAT; ?>">
+ − 2658 <p>
+ − 2659 Template code:
+ − 2660 </p>
+ − 2661 <p>
+ − 2662 <textarea style="width: 98%;" name="templateformat_content" rows="15" cols="50"></textarea>
+ − 2663 </p>
+ − 2664 </div>
+ − 2665
+ − 2666 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_HTML; ?>">
+ − 2667 <p>
+ − 2668 HTML to place inside the sidebar:
+ − 2669 </p>
+ − 2670 <p>
+ − 2671 <textarea style="width: 98%;" name="html_content" rows="15" cols="50"></textarea>
+ − 2672 </p>
+ − 2673 </div>
+ − 2674
+ − 2675 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PHP; ?>">
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2676 <?php if ( defined('ENANO_DEMO_MODE') ) { ?>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2677 <p>Creating PHP blocks in demo mode is disabled for security reasons.</p>
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2678 <?php } else { ?>
0
+ − 2679 <p>
+ − 2680 <b>WARNING:</b> If you don't know what you're doing, or if you are not fluent in PHP, stop now and choose a different block type. You will brick your Enano installation if you are not careful here.
+ − 2681 ALWAYS remember to write secure code! The Enano team is not responsible if someone drops all your tables because of an SQL injection vulnerability in your sidebar code. You are probably better off using the template-formatted block type.
+ − 2682 </p>
+ − 2683 <p>
+ − 2684 <span style="color: red;">
+ − 2685 It is especially important to note that this code is NOT checked for errors! If there is a syntax error in your code here, it will prevent any pages from loading AT ALL. So you need to use an external PHP editor (like <a href="http://www.jedit.org">jEdit</a>) to check your syntax before you hit save.
+ − 2686 </span> You have been warned.
+ − 2687 </p>
+ − 2688 <p>
+ − 2689 Also, you should avoid using output buffering functions (ob_[start|end|get_contents|clean]) here, because Enano uses those to track output from this script.
+ − 2690 </p>
+ − 2691 <p>
+ − 2692 The standard <?php and ?> tags work here. Don't use an initial "<?php" or it will cause a parse error.
+ − 2693 </p>
+ − 2694 <p>
+ − 2695 PHP code:
+ − 2696 </p>
+ − 2697 <p>
+ − 2698 <textarea style="width: 98%;" name="php_content" rows="15" cols="50"></textarea>
+ − 2699 </p>
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2700 <?php } ?>
0
+ − 2701 </div>
+ − 2702
+ − 2703 <div class="sbadd_block" id="blocktype_<?php echo BLOCK_PLUGIN; ?>">
+ − 2704 <p>
+ − 2705 Plugin:
+ − 2706 </p>
+ − 2707 <p>
+ − 2708 <select name="plugin_id">
+ − 2709 <?php
+ − 2710 foreach($template->plugin_blocks as $k => $c)
+ − 2711 {
+ − 2712 echo '<option value="'.$k.'">'.$k.'</option>';
+ − 2713 }
+ − 2714 ?>
+ − 2715 </select>
+ − 2716 </p>
+ − 2717 </div>
+ − 2718
+ − 2719 <p>
+ − 2720
+ − 2721 <input type="submit" name="create" value="Create new block" style="font-weight: bold;" />
+ − 2722 <input type="submit" name="cancel" value="Cancel" />
+ − 2723
+ − 2724 </p>
+ − 2725
+ − 2726 </form>
+ − 2727
+ − 2728 <script type="text/javascript">
+ − 2729 var divs = getElementsByClassName(document, 'div', 'sbadd_block');
+ − 2730 for(var i in divs)
+ − 2731 {
+ − 2732 if(divs[i].id != 'blocktype_<?php echo BLOCK_WIKIFORMAT; ?>') setTimeout("document.getElementById('"+divs[i].id+"').style.display = 'none';", 500);
+ − 2733 }
+ − 2734 </script>
+ − 2735
+ − 2736 <?php
+ − 2737 $template->footer();
+ − 2738 return;
+ − 2739 break;
+ − 2740 case 'move':
+ − 2741 if( !isset($_GET['side']) || ( isset($_GET['side']) && !preg_match('#^([0-9]+)$#', $_GET['side']) ) )
+ − 2742 {
+ − 2743 echo '<div class="warning-box" style="margin: 10px 0;">$_GET[\'side\'] contained an SQL injection attempt</div>';
+ − 2744 break;
+ − 2745 }
+ − 2746 $query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2747 if(!$query)
+ − 2748 {
+ − 2749 echo $db->get_error();
+ − 2750 $template->footer();
+ − 2751 exit;
+ − 2752 }
+ − 2753 echo '<div class="info-box" style="margin: 10px 0;">Item moved.</div>';
+ − 2754 break;
+ − 2755 case 'delete':
+ − 2756 $query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); // Already checked for injection attempts ;-)
+ − 2757 if(!$query)
+ − 2758 {
+ − 2759 echo $db->get_error();
+ − 2760 $template->footer();
+ − 2761 exit;
+ − 2762 }
+ − 2763 if(isset($_GET['ajax']))
+ − 2764 {
+ − 2765 ob_end_clean();
+ − 2766 die('GOOD');
+ − 2767 }
+ − 2768 echo '<div class="error-box" style="margin: 10px 0;">Item deleted.</div>';
+ − 2769 break;
+ − 2770 case 'disenable';
+ − 2771 $q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2772 if(!$q)
+ − 2773 {
+ − 2774 echo $db->get_error();
+ − 2775 $template->footer();
+ − 2776 exit;
+ − 2777 }
+ − 2778 $r = $db->fetchrow();
+ − 2779 $db->free_result();
+ − 2780 $e = ( $r['item_enabled'] == 1 ) ? '0' : '1';
+ − 2781 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2782 if(!$q)
+ − 2783 {
+ − 2784 echo $db->get_error();
+ − 2785 $template->footer();
+ − 2786 exit;
+ − 2787 }
+ − 2788 if(isset($_GET['ajax']))
+ − 2789 {
+ − 2790 ob_end_clean();
+ − 2791 die('GOOD');
+ − 2792 }
+ − 2793 break;
+ − 2794 case 'getsource':
+ − 2795 $q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2796 if(!$q)
+ − 2797 {
+ − 2798 echo $db->get_error();
+ − 2799 $template->footer();
+ − 2800 exit;
+ − 2801 }
+ − 2802 ob_end_clean();
+ − 2803 $r = $db->fetchrow();
+ − 2804 $db->free_result();
+ − 2805 if($r['block_type'] == BLOCK_PLUGIN) die('HOUSTON_WE_HAVE_A_PLUGIN');
+ − 2806 die($r['block_content']);
+ − 2807 break;
+ − 2808 case 'save':
19
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2809 if ( defined('ENANO_DEMO_MODE') )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2810 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2811 $q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2812 if(!$q)
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2813 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2814 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2815 exit;
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2816 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2817 $row = $db->fetchrow();
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2818 if ( $row['block_type'] == BLOCK_PHP )
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2819 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2820 $_POST['content'] = '?><Nulled>';
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2821 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2822 else
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2823 {
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2824 $_POST['content'] = sanitize_html($_POST['content'], true);
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2825 }
5d003b6c9e89
Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table
Dan
diff
changeset
+ − 2826 }
0
+ − 2827 $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2828 if(!$q)
+ − 2829 {
+ − 2830 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2831 exit;
+ − 2832 }
+ − 2833 $q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';');
+ − 2834 if(!$q)
+ − 2835 {
+ − 2836 echo 'var status=unescape(\''.hexencode($db->get_error()).'\');';
+ − 2837 exit;
+ − 2838 }
+ − 2839 $row = $db->fetchrow();
+ − 2840 $db->free_result();
+ − 2841 switch($row['block_type'])
+ − 2842 {
+ − 2843 case BLOCK_WIKIFORMAT:
+ − 2844 default:
+ − 2845 $c = RenderMan::render($row['block_content']);
+ − 2846 break;
+ − 2847 case BLOCK_TEMPLATEFORMAT:
+ − 2848 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2849 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2850 break;
+ − 2851 case BLOCK_HTML:
+ − 2852 $c = $row['block_content'];
+ − 2853 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2854 break;
+ − 2855 case BLOCK_PHP:
+ − 2856 ob_start();
+ − 2857 eval($row['block_content']);
+ − 2858 $c = ob_get_contents();
+ − 2859 ob_end_clean();
+ − 2860 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2861 break;
+ − 2862 case BLOCK_PLUGIN:
+ − 2863 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2864 break;
+ − 2865 }
+ − 2866 die('var status = \'GOOD\'; var content = unescape(\''.hexencode($c).'\');');
+ − 2867 break;
+ − 2868 }
+ − 2869 }
+ − 2870
+ − 2871 $q = $db->sql_query('SELECT item_id,sidebar_id,item_enabled,block_name,block_type,block_content FROM '.table_prefix.'sidebar ORDER BY sidebar_id ASC, item_order ASC;');
+ − 2872 if(!$q) $db->_die('The sidebar text data could not be selected.');
+ − 2873
+ − 2874 $vars = $template->extract_vars('sidebar-editor.tpl');
+ − 2875
+ − 2876 $parser = $template->makeParserText($vars['sidebar_button']);
+ − 2877 $parser->assign_vars(Array(
+ − 2878 'HREF'=>'#',
+ − 2879 'FLAGS'=>'onclick="return false;"',
+ − 2880 'TEXT'=>'Change theme'
+ − 2881 ));
+ − 2882 $template->tpl_strings['THEME_LINK'] = $parser->run();
+ − 2883 $parser->assign_vars(Array(
+ − 2884 'TEXT'=>'Log out',
+ − 2885 ));
+ − 2886 $template->tpl_strings['LOGOUT_LINK'] = $parser->run();
+ − 2887
+ − 2888 $n1 = Array();
+ − 2889 $n2 = Array();
+ − 2890 $n =& $n1;
+ − 2891
+ − 2892 echo '<table border="0"><tr><td valign="top"><div class="dbx-group" id="sbedit_left">';
+ − 2893 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2894
+ − 2895 // Time for the loop
+ − 2896 // what this loop does is fetch the row data, then send it out to the appropriate parser for formatting,
+ − 2897 // then puts the result into $c, which is then sent to the template compiler for insertion into the TPL code.
+ − 2898 while($row = $db->fetchrow())
+ − 2899 {
+ − 2900 if(isset($current_side))
+ − 2901 {
+ − 2902 if($current_side != $row['sidebar_id'])
+ − 2903 {
+ − 2904 // Time to switch!
+ − 2905 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2906 echo '</div></td><td valign="top"><div class="dbx-group" id="sbedit_right">';
+ − 2907 //echo '</td><td valign="top">';
+ − 2908 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_top']);
+ − 2909 $n =& $n2;
+ − 2910 }
+ − 2911 }
+ − 2912 $n[] = count($n);
+ − 2913 $current_side = $row['sidebar_id'];
+ − 2914 switch($row['block_type'])
+ − 2915 {
+ − 2916 case BLOCK_WIKIFORMAT:
+ − 2917 default:
+ − 2918 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2919 $c = RenderMan::render($row['block_content']);
+ − 2920 break;
+ − 2921 case BLOCK_TEMPLATEFORMAT:
+ − 2922 $parser = $template->makeParserText($vars['sidebar_section']);
+ − 2923 $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl');
+ − 2924 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2925 break;
+ − 2926 case BLOCK_HTML:
+ − 2927 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2928 $c = $row['block_content'];
+ − 2929 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2930 break;
+ − 2931 case BLOCK_PHP:
+ − 2932 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2933 ob_start();
+ − 2934 eval($row['block_content']);
+ − 2935 $c = ob_get_contents();
+ − 2936 ob_end_clean();
+ − 2937 $c = preg_replace('#<a (.*?)>(.*?)</a>#is', '<a href="#" onclick="return false;">\\2</a>', $c);
+ − 2938 break;
+ − 2939 case BLOCK_PLUGIN:
+ − 2940 $parser = $template->makeParserText($vars['sidebar_section_raw']);
+ − 2941 $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block';
+ − 2942 break;
+ − 2943 }
+ − 2944 $t = $template->tplWikiFormat($row['block_name']);
+ − 2945 if($row['item_enabled'] == 0) $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red;">(disabled)</span>';
+ − 2946 else $t .= ' <span id="disabled_'.$row['item_id'].'" style="color: red; display: none;">(disabled)</span>';
+ − 2947 $side = ( $row['sidebar_id'] == SIDEBAR_LEFT ) ? SIDEBAR_RIGHT : SIDEBAR_LEFT;
+ − 2948 $tb = '<a title="Enable or disable this block" href="'.makeUrl($paths->page, 'action=disenable&id='.$row['item_id'].'' , true).'" onclick="ajaxDisenableBlock(\''.$row['item_id'].'\'); return false;" ><img alt="Enable/disable this block" style="border-width: 0;" src="'.scriptPath.'/images/disenable.png" /></a>
+ − 2949 <a title="Edit the contents of this block" href="'.makeUrl($paths->page, 'action=edit&id='.$row['item_id'].'' , true).'" onclick="ajaxEditBlock(\''.$row['item_id'].'\', this); return false;"><img alt="Edit this block" style="border-width: 0;" src="'.scriptPath.'/images/edit.png" /></a>
+ − 2950 <a title="Permanently delete this block" href="'.makeUrl($paths->page, 'action=delete&id='.$row['item_id'].'' , true).'" onclick="if(confirm(\'Do you really want to delete this block?\')) { ajaxDeleteBlock(\''.$row['item_id'].'\', this); } return false;"><img alt="Delete this block" style="border-width: 0;" src="'.scriptPath.'/images/delete.png" /></a>
+ − 2951 <a title="Move this block to the other sidebar" href="'.makeUrl($paths->page, 'action=move&id='.$row['item_id'].'&side='.$side, true).'"><img alt="Move this block" style="border-width: 0;" src="'.scriptPath.'/images/move.png" /></a>';
+ − 2952 $as = '';
+ − 2953 $ae = ' '.$tb;
+ − 2954 $parser->assign_vars(Array('CONTENT'=>$c,'TITLE'=>$t,'ADMIN_START'=>$as,'ADMIN_END'=>$ae));
+ − 2955 echo $parser->run();
+ − 2956 unset($parser);
+ − 2957
+ − 2958 }
+ − 2959 $db->free_result();
+ − 2960 //if(isset($vars['sidebar_top'])) echo $template->parse($vars['sidebar_bottom']);
+ − 2961 echo '</div></td></tr></table>';
+ − 2962 echo '<form action="'.makeUrl($paths->page).'" method="post">';
+ − 2963 $order = implode(',', $n1);
+ − 2964 echo "<input type='hidden' id='divOrder_Left' name='order_left' value='{$order}' />";
+ − 2965 $order = implode(',', $n2);
+ − 2966 echo "<input type='hidden' id='divOrder_Right' name='order_right' value='{$order}' />";
+ − 2967 echo '
+ − 2968 <div style="margin: 0 auto 0 auto; text-align: center;">
+ − 2969 <input type="submit" name="save" style="font-weight: bold;" value="Save changes" />
+ − 2970 <input type="submit" name="revert" style="font-weight: normal;" value="Revert" onclick="return confirm(\'Do you really want to revert your changes?\nNote: this does not revert edits or deletions, those are saved as soon as you confirm the action.\')" />
+ − 2971 <br />
+ − 2972 <a href="'.makeUrl($paths->page, 'action=new&id=0', true).'">Create new block</a> | <a href="'.makeUrl(getConfig('main_page'), false, true).'">Main Page</a>
+ − 2973 </div>
+ − 2974 </form>
+ − 2975 ';
+ − 2976 }
+ − 2977
+ − 2978 $template->footer();
+ − 2979 }
+ − 2980
+ − 2981 ?>