Added a copy of Firebug Lite for debugging purposes. License is uncertain but being treated as MPL. (If is is not MPL then it is under something more permissive that permits relicensing anyway)
<?php
/*
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
* Version 1.1.3 (Caoineag alpha 3)
* Copyright (C) 2006-2007 Dan Fuhry
*
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
*/
function page_Admin_UserManager()
{
global $db, $session, $paths, $template, $plugins; // Common objects
global $lang;
if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )
{
$login_link = makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true);
echo '<h3>' . $lang->get('adm_err_not_auth_title') . '</h3>';
echo '<p>' . $lang->get('adm_err_not_auth_body', array( 'login_link' => $login_link )) . '</p>';
return;
}
//die('<pre>' . htmlspecialchars(print_r($_POST, true)) . '</pre>');
if ( isset($_POST['action']['save']) )
{
#
# BEGIN VALIDATION
#
$errors = array();
if ( defined('ENANO_DEMO_MODE') )
{
$errors[] = $lang->get('acpum_err_nosave_demo');
}
$user_id = intval($_POST['user_id']);
if ( empty($user_id) || $user_id == 1 )
$errors[] = 'Invalid user ID.';
if ( isset($_POST['delete_account']) && count($errors) < 1 )
{
$q = $db->sql_query('DELETE FROM '.table_prefix."users_extra WHERE user_id=$user_id;");
if ( !$q )
$db->_die();
$q = $db->sql_query('DELETE FROM '.table_prefix."users WHERE user_id=$user_id;");
if ( !$q )
$db->_die();
echo '<div class="info-box">' . $lang->get('acpum_msg_delete_success') . '</div>';
}
else
{
if ( $session->user_id == $user_id )
{
$username = $session->username;
$password = false;
$email = $session->email;
$real_name = $session->real_name;
}
else
{
$username = $_POST['username'];
if ( !preg_match('#^'.$session->valid_username.'$#', $username) )
$errors[] = $lang->get('acpum_err_illegal_username');
$password = false;
if ( $_POST['changing_pw'] == 'yes' )
{
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
$key_hex_md5 = $_POST['crypt_key'];
$key_hex = $session->fetch_public_key($key_hex_md5);
if ( $key_hex )
{
$key_bin = hexdecode($key_hex);
$data_hex = $_POST['crypt_data'];
$password = $aes->decrypt($data_hex, $key_bin, ENC_HEX);
}
else
{
$errors[] = $lang->get('acpum_err_no_aes_key');
}
}
$email = $_POST['email'];
if ( !preg_match('/^(?:[\w\d]+\.?)+@((?:(?:[\w\d]\-?)+\.)+\w{2,4}|localhost)$/', $email) )
$errors[] = $lang->get('acpum_err_illegal_email');
$real_name = $_POST['real_name'];
}
$signature = RenderMan::preprocess_text($_POST['signature'], true, true);
$user_level = intval($_POST['user_level']);
if ( $user_level < USER_LEVEL_MEMBER || $user_level > USER_LEVEL_ADMIN )
$errors[] = 'Invalid user level';
$imaddr_aim = htmlspecialchars($_POST['imaddr_aim']);
$imaddr_msn = htmlspecialchars($_POST['imaddr_msn']);
$imaddr_yahoo = htmlspecialchars($_POST['imaddr_yahoo']);
$imaddr_xmpp = htmlspecialchars($_POST['imaddr_xmpp']);
$homepage = htmlspecialchars($_POST['homepage']);
$location = htmlspecialchars($_POST['location']);
$occupation = htmlspecialchars($_POST['occupation']);
$hobbies = htmlspecialchars($_POST['hobbies']);
$email_public = ( isset($_POST['email_public']) ) ? '1' : '0';
if ( !preg_match('/@([a-z0-9-]+)(\.([a-z0-9-\.]+))?/', $imaddr_msn) && !empty($imaddr_msn) )
{
$imaddr_msn = "$imaddr_msn@hotmail.com";
}
if ( substr($homepage, 0, 7) != 'http://' )
{
$homepage = "http://$homepage";
}
if ( !preg_match('/^http:\/\/([a-z0-9-.]+)([A-z0-9@#\$%\&:;<>,\.\?=\+\(\)\[\]_\/\\\\]*?)$/i', $homepage) )
{
$homepage = '';
}
if ( count($errors) < 1 )
{
$q = $db->sql_query('SELECT u.user_level, u.user_has_avatar, u.avatar_type FROM '.table_prefix.'users AS u WHERE u.user_id = ' . $user_id . ';');
if ( !$q )
$db->_die();
if ( $db->numrows() < 1 )
{
echo 'Couldn\'t select user data: no rows returned';
}
$row = $db->fetchrow();
$existing_level =& $row['user_level'];
$avi_type =& $row['avatar_type'];
$has_avi = ( $row['user_has_avatar'] == 1 );
$db->free_result();
$to_update_users = array();
if ( $user_id != $session->user_id )
{
$to_update_users['username'] = $username;
if ( $password )
{
$password = $aes->encrypt($password, $session->private_key, ENC_HEX);
$to_update_users['password'] = $password;
}
$to_update_users['email'] = $email;
$to_update_users['real_name'] = $real_name;
}
$to_update_users['signature'] = $signature;
$to_update_users['user_level'] = $user_level;
if ( isset($_POST['account_active']) )
{
$to_update_users['account_active'] = "1";
}
else
{
$to_update_users['account_active'] = "0";
$to_update_users['activation_key'] = sha1($session->dss_rand());
}
// Avatar validation
$action = ( isset($_POST['avatar_action']) ) ? $_POST['avatar_action'] : 'keep';
$avi_path = ENANO_ROOT . '/' . getConfig('avatar_directory') . '/' . $user_id . '.' . $avi_type;
switch($action)
{
case 'keep':
default:
break;
case 'remove':
if ( $has_avi )
{
// First switch the avatar off
$to_update_users['user_has_avatar'] = '0';
@unlink($avi_path);
}
break;
case 'set_http':
case 'set_file':
// Hackish way to preserve the UNIX philosophy of reusing as much code as possible
if ( $action == 'set_http' )
{
// Check if this action is enabled
if ( getConfig('avatar_upload_http') !== '1' )
{
// non-localized, only appears on hack attempt
$errors[] = 'Uploads over HTTP are disabled.';
break;
}
// Download the file
require_once( ENANO_ROOT . '/includes/http.php' );
if ( !preg_match('/^http:\/\/([a-z0-9-\.]+)(:([0-9]+))?\/(.+)$/', $_POST['avatar_http_url'], $match) )
{
$errors[] = $lang->get('usercp_avatar_invalid_url');
break;
}
$hostname = $match[1];
$uri = '/' . $match[4];
$port = ( $match[3] ) ? intval($match[3]) : 80;
$max_size = intval(getConfig('avatar_max_size'));
// Get temporary file
$tempfile = tempnam(false, "enanoavatar_{$user_id}");
if ( !$tempfile )
$errors[] = 'Error getting temp file.';
@unlink($tempfile);
$request = new Request_HTTP($hostname, $uri, 'GET', $port);
$result = $request->write_response_to_file($tempfile, 50, $max_size);
if ( !$result || $request->response_code != HTTP_OK )
{
@unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_bad_write');
break;
}
// Response written. Proceed to validation...
}
else
{
// Check if this action is enabled
if ( getConfig('avatar_upload_file') !== '1' )
{
// non-localized, only appears on hack attempt
$errors[] = 'Uploads from the browser are disabled.';
break;
}
$max_size = intval(getConfig('avatar_max_size'));
$file =& $_FILES['avatar_file'];
$tempfile =& $file['tmp_name'];
if ( filesize($tempfile) > $max_size )
{
@unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_file_too_large');
break;
}
}
$file_type = get_image_filetype($tempfile);
if ( !$file_type )
{
unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_bad_filetype');
break;
}
$avi_path_new = ENANO_ROOT . '/' . getConfig('avatar_directory') . '/' . $user_id . '.' . $file_type;
// The file type is good - validate dimensions and animation
switch($file_type)
{
case 'png':
$is_animated = is_png_animated($tempfile);
$dimensions = png_get_dimensions($tempfile);
break;
case 'gif':
$is_animated = is_gif_animated($tempfile);
$dimensions = gif_get_dimensions($tempfile);
break;
case 'jpg':
$is_animated = false;
$dimensions = jpg_get_dimensions($tempfile);
break;
default:
$errors[] = 'API mismatch';
break 2;
}
// Did we get invalid size data? If so the image is probably corrupt.
if ( !$dimensions )
{
@unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_corrupt_image');
break;
}
// Is the image animated?
if ( $is_animated && getConfig('avatar_enable_anim') !== '1' )
{
@unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_disallowed_animation');
break;
}
// Check image dimensions
list($image_x, $image_y) = $dimensions;
$max_x = intval(getConfig('avatar_max_width'));
$max_y = intval(getConfig('avatar_max_height'));
if ( $image_x > $max_x || $image_y > $max_y )
{
@unlink($tempfile);
$errors[] = $lang->get('usercp_avatar_too_large');
break;
}
// All good!
@unlink($avi_path);
if ( rename($tempfile, $avi_path_new) )
{
$to_update_users['user_has_avatar'] = '1';
$to_update_users['avatar_type'] = $file_type;
}
else
{
// move failed - turn avatar off
$to_update_users['user_has_avatar'] = '0';
}
break;
}
if ( count($errors) < 1 )
{
$to_update_users_extra = array();
$to_update_users_extra['user_aim'] = $imaddr_aim;
$to_update_users_extra['user_msn'] = $imaddr_msn;
$to_update_users_extra['user_yahoo'] = $imaddr_yahoo;
$to_update_users_extra['user_xmpp'] = $imaddr_xmpp;
$to_update_users_extra['user_homepage'] = $homepage;
$to_update_users_extra['user_location'] = $location;
$to_update_users_extra['user_job'] = $occupation;
$to_update_users_extra['user_hobbies'] = $hobbies;
$to_update_users_extra['email_public'] = ( $email_public ) ? '1' : '0';
$update_sql = '';
foreach ( $to_update_users as $key => $unused_crap )
{
$value =& $to_update_users[$key];
$value = $db->escape($value);
$update_sql .= ( empty($update_sql) ? '' : ',' ) . "$key='$value'";
}
$update_sql = 'UPDATE '.table_prefix."users SET $update_sql WHERE user_id=$user_id;";
$update_sql_extra = '';
foreach ( $to_update_users_extra as $key => $unused_crap )
{
$value =& $to_update_users_extra[$key];
$value = $db->escape($value);
$update_sql_extra .= ( empty($update_sql_extra) ? '' : ',' ) . "$key='$value'";
}
$update_sql_extra = 'UPDATE '.table_prefix."users_extra SET $update_sql_extra WHERE user_id=$user_id;";
if ( !$db->sql_query($update_sql) )
$db->_die();
if ( !$db->sql_query($update_sql_extra) )
$db->_die();
if ( $existing_level != $user_level )
{
// We need to update group memberships
if ( $existing_level == USER_LEVEL_ADMIN )
{
$q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_from_admin\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');
if ( !$q )
$db->_die();
$session->remove_user_from_group($user_id, GROUP_ID_ADMIN);
}
else if ( $existing_level == USER_LEVEL_MOD )
{
$q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_from_mod\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');
if ( !$q )
$db->_die();
$session->remove_user_from_group($user_id, GROUP_ID_MOD);
}
if ( $user_level == USER_LEVEL_ADMIN )
{
$q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_to_admin\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');
if ( !$q )
$db->_die();
$session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);
}
else if ( $user_level == USER_LEVEL_MOD )
{
$q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES(\'security\',\'u_to_mod\',' . time() . ',"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($username) . '");');
if ( !$q )
$db->_die();
$session->add_user_to_group($user_id, GROUP_ID_MOD, false);
}
}
echo '<div class="info-box">' . $lang->get('acpum_msg_save_success') . '</div>';
}
}
}
if ( count($errors) > 0 )
{
echo '<div class="error-box">
<b>' . $lang->get('acpum_err_validation_fail') . '</b>
<ul>
<li>' . implode("</li>\n <li>", $errors) . '</li>
</ul>
</div>';
$form = new Admin_UserManager_SmartForm();
$form->user_id = $user_id;
$form->username = $username;
$form->email = $email;
$form->real_name = $real_name;
$form->signature = $signature;
$form->user_level = $user_level;
$form->im = array(
'aim' => $imaddr_aim,
'yahoo' => $imaddr_yahoo,
'msn' => $imaddr_msn,
'xmpp' => $imaddr_xmpp
);
$form->contact = array(
'homepage' => $homepage,
'location' => $location,
'job' => $occupation,
'hobbies' => $hobbies
);
$form->email_public = ( isset($_POST['email_public']) );
$form->account_active = ( isset($_POST['account_active']) );
// This is SAFE. The smartform calls is_valid_ip() on this value, thus preventing XSS
// attempts from making it into the form HTML. Badly coded templates may still be
// affected, but if have_reg_ip is checked for, then you're fine.
$form->reg_ip_addr = $_POST['user_registration_ip'];
echo $form->render();
return false;
}
#
# END VALIDATION
#
}
else if ( isset($_POST['action']['go']) || ( isset($_GET['src']) && $_GET['src'] == 'get' ) )
{
if ( isset($_GET['user']) )
{
$username =& $_GET['user'];
}
else if ( isset($_POST['username']) )
{
$username =& $_POST['username'];
}
else
{
echo 'No username provided';
return false;
}
$q = $db->sql_query('SELECT u.user_id AS authoritative_uid, u.username, u.email, u.real_name, u.signature, u.account_active, u.user_level, u.user_has_avatar, u.avatar_type, u.user_registration_ip, x.* FROM '.table_prefix.'users AS u
LEFT JOIN '.table_prefix.'users_extra AS x
ON ( u.user_id = x.user_id OR x.user_id IS NULL )
WHERE ( ' . ENANO_SQLFUNC_LOWERCASE . '(u.username) = \'' . $db->escape(strtolower($username)) . '\' OR u.username = \'' . $db->escape($username) . '\' ) AND u.user_id != 1;');
if ( !$q )
$db->_die();
if ( $db->numrows() < 1 )
{
echo '<div class="error-box">' . $lang->get('acpum_err_bad_username') . '</div>';
}
else
{
$row = $db->fetchrow();
$row['user_id'] = $row['authoritative_uid'];
$form = new Admin_UserManager_SmartForm();
$form->user_id = $row['user_id'];
$form->username = $row['username'];
$form->email = $row['email'];
$form->real_name = $row['real_name'];
$form->signature = $row['signature'];
$form->user_level= $row['user_level'];
$form->account_active = ( $row['account_active'] == 1 );
$form->email_public = ( $row['email_public'] == 1 );
$form->has_avatar = ( $row['user_has_avatar'] == 1 );
$form->avi_type = $row['avatar_type'];
$form->im = array(
'aim' => $row['user_aim'],
'yahoo' => $row['user_yahoo'],
'msn' => $row['user_msn'],
'xmpp' => $row['user_xmpp']
);
$form->contact = array(
'homepage' => $row['user_homepage'],
'location' => $row['user_location'],
'job' => $row['user_job'],
'hobbies' => $row['user_hobbies'],
);
$form->email_public = ( $row['email_public'] == 1 );
$form->reg_ip_addr = ( $row['user_registration_ip'] ) ? $row['user_registration_ip'] : '';
$html = $form->render();
if ( !$html )
{
echo 'Internal error: form processor returned false';
}
else
{
echo $html;
}
return true;
}
}
else if ( isset($_POST['action']['clear_sessions']) )
{
if ( defined('ENANO_DEMO_MODE') )
{
echo '<div class="error-box">' . $lang->get('acpum_err_sessionclear_demo') . '</div>';
}
else
{
// Get the current session information so the user doesn't get logged out
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
$sk = md5(strrev($session->sid_super));
$qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);
if ( !$qb )
{
die('Error selecting session key info block B: '.$db->get_error());
}
if ( $db->numrows($qb) < 1 )
{
die('Error: cannot read admin session info block B, aborting table clear process');
}
$qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);
if ( !$qa )
{
die('Error selecting session key info block A: '.$db->get_error());
}
if ( $db->numrows($qa) < 1 )
{
die('Error: cannot read user session info block A, aborting table clear process');
}
$ra = $db->fetchrow($qa);
$rb = $db->fetchrow($qb);
$db->free_result($qa);
$db->free_result($qb);
$db->sql_query('DELETE FROM '.table_prefix.'session_keys;');
$db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra['session_key'].'\', \''.$ra['salt'].'\', \''.$session->user_id.'\', \''.$ra['auth_level'].'\', \''.$ra['source_ip'].'\', '.$ra['time'].' ),( \''.$rb['session_key'].'\', \''.$rb['salt'].'\', \''.$session->user_id.'\', \''.$rb['auth_level'].'\', \''.$rb['source_ip'].'\', '.$rb['time'].' )');
echo '<div class="info-box">' . $lang->get('acpum_msg_sessionclear_success') . '</div>';
}
}
echo '<form action="' . makeUrlNS('Special', 'Administration', 'module=' . $paths->cpage['module'], true) . '" method="post" enctype="multipart/form-data" onsubmit="if ( !submitAuthorized ) return false;">';
echo '<h3>' . $lang->get('acpum_heading_main') . '</h3>';
echo '<p>' . $lang->get('acpum_hint_intro') . '</p>';
echo '<table border="0">
<tr>
<td><b>' . $lang->get('acpum_field_search_user') . '</b><br />
<small>' . $lang->get('acpum_field_search_user_hint') . '</small>
</td>
<td style="width: 10px;"></td>
<td>' . $template->username_field('username') . '</td>
<td>
<input type="submit" name="action[go]" value="' . $lang->get('acpum_btn_search_user_go') . ' »" />
</td>
</tr>
</table>';
echo '<h3>' . $lang->get('acpum_heading_clear_sessions') . '</h3>';
echo '<p>' . $lang->get('acpum_hint_clear_sessions') . '</p>';
echo '<p><input type="submit" name="action[clear_sessions]" value="' . $lang->get('acpum_btn_clear_sessions') . '" /></p>';
echo '</form>';
if(isset($_GET['action']) && isset($_GET['user']))
{
switch($_GET['action'])
{
case "activate":
$e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');
if ( $e )
{
// attempt to activate the account
$row = $db->fetchrow();
$db->free_result();
if ( $session->activate_account($_GET['user'], $row['activation_key']) )
{
echo '<div class="info-box">' . $lang->get('acpum_msg_activate_success', array('username' => htmlspecialchars($_GET['user']))) . '</div>';
$db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid']));
}
else
{
echo '<div class="warning-box">' . $lang->get('acpum_err_activate_fail', array('username' => htmlspecialchars($_GET['user']))) . '</div>';
}
}
else
{
echo '<div class="error-box">Error activating account: '.$db->get_error().'</div>';
}
break;
case "sendemail":
if ( $session->send_activation_mail($_GET['user'] ) )
{
echo '<div class="info-box">' . $lang->get('acpum_msg_activate_email_success', array('username' => htmlspecialchars($_GET['user']))) . '</div>';
$db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid']));
}
else
{
echo '<div class="error-box">' . $lang->get('acpum_err_activate_email_fail', array('username' => htmlspecialchars($_GET['user']))) . '</div>';
}
break;
case "deny":
$e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND time_id=\'' . $db->escape($_GET['logid']) . '\';');
if ( !$e )
{
echo '<div class="error-box">Error during row deletion: '.$db->get_error().'</div>';
}
else
{
echo '<div class="info-box">' . $lang->get('acpum_msg_activate_deny_success', array('username' => htmlspecialchars($_GET['user']))) . '</div>';
}
break;
}
}
$q = $db->sql_query('SELECT l.log_type, l.action, l.time_id, l.date_string, l.author, l.edit_summary, u.user_coppa FROM '.table_prefix.'logs AS l
LEFT JOIN '.table_prefix.'users AS u
ON ( u.username = l.edit_summary OR u.username IS NULL )
WHERE log_type=\'admin\' AND action=\'activ_req\' ORDER BY time_id DESC;');
if($q)
{
if($db->numrows() > 0)
{
$n = $db->numrows();
$str = ( $n == 1 ) ?
$lang->get('acpum_heading_activation_one') :
$lang->get('acpum_heading_activation_plural', array('count' => strval($n)));
echo '<h3>' . $str . '</h3>';
echo '<div class="tblholder">
<table border="0" cellspacing="1" cellpadding="4" width="100%">
<tr>
<th>' . $lang->get('acpum_col_activate_timestamp') . '</th>
<th>' . $lang->get('acpum_col_activate_requestedby') . '</th>
<th>' . $lang->get('acpum_col_activate_requestedfor') . '</th>
<th>' . $lang->get('acpum_col_activate_coppauser') . '</th>
<th colspan="3">' . $lang->get('acpum_col_activate_actions') . '</th>
</tr>';
$cls = 'row2';
while($row = $db->fetchrow())
{
if($cls == 'row2') $cls = 'row1';
else $cls = 'row2';
$coppa = ( $row['user_coppa'] == '1' ) ? '<b>' . $lang->get('acpum_coppauser_yes') . '</b>' : $lang->get('acpum_coppauser_no');
echo '<tr>
<td class="'.$cls.'">'.enano_date('F d, Y h:i a', $row['time_id']).'</td>
<td class="'.$cls.'">'.$row['author'].'</td>
<td class="'.$cls.'">'.$row['edit_summary'].'</td>
<td style="text-align: center;" class="' . $cls . '">' . $coppa . '</td>
<td class="'.$cls.'" style="text-align: center;">
<a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=activate&user='.rawurlencode($row['edit_summary']).'&logid='.$row['time_id'], true).'">' . $lang->get('acpum_btn_activate_now') . '</a>
</td>
<td class="'.$cls.'" style="text-align: center;">
<a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=sendemail&user='.rawurlencode($row['edit_summary']).'&logid='.$row['time_id'], true).'">' . $lang->get('acpum_btn_send_email') . '</a>
</td>
<td class="'.$cls.'" style="text-align: center;">
<a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&action=deny&user='.rawurlencode($row['edit_summary']).'&logid='.$row['time_id'], true).'">' . $lang->get('acpum_btn_activate_deny') . '</a>
</td>
</tr>';
}
echo '</table>';
}
$db->free_result();
}
}
/**
* Smart form class for the user manager.
* @package Enano
* @subpackage Administration
*/
class Admin_UserManager_SmartForm
{
/**
* Universally Unique Identifier (UUID) for this editor instance. Used to unique-itize Javascript functions and whatnot.
* @var string
*/
var $uuid = '';
/**
* User ID that we're editing.
* @var int
*/
var $user_id = 0;
/**
* Username
* @var string
*/
var $username = '';
/**
* E-mail address
* @var string
*/
var $email = '';
/**
* Real name
* @var string
*/
var $real_name = '';
/**
* Signature
* @var string
*/
var $signature = '';
/**
* IM contact information
* @var array
*/
var $im = array();
/**
* Real-life contact info
* @var array
*/
var $contact = array();
/**
* User level
* @var int
*/
var $user_level = USER_LEVEL_MEMBER;
/**
* Account activated
* @var bool
*/
var $account_active = true;
/**
* Email public switch
* @var bool
*/
var $email_public = false;
/**
* Whether the user has an avatar or not.
* @var bool
*/
var $has_avatar = false;
/**
* The type of avatar the user has. One of "jpg", "png", or "gif".
* @var string
*/
var $avi_type = 'png';
/**
* The IP address of the user during registration
* @var string
*/
var $reg_ip_addr = '';
/**
* Constructor.
*/
function Admin_UserManager_SmartForm()
{
$this->uuid = md5( mt_rand() . microtime() );
}
/**
* Renders and returns the finished form.
* @return string
*/
function render()
{
global $db, $session, $paths, $template, $plugins; // Common objects
global $lang;
if ( file_exists( ENANO_ROOT . "/themes/$template->theme/admin_usermanager_form.tpl" ) )
{
$parser = $template->makeParser('admin_usermanager_form.tpl');
}
else
{
$tpl_code = <<<EOF
<!-- Start of user edit form -->
<script type="text/javascript">
function userform_{UUID}_chpasswd()
{
var link = document.getElementById('userform_{UUID}_pwlink');
var form = document.getElementById('userform_{UUID}_pwform');
domOpacity(link, 100, 0, 500);
domObjChangeOpac(0, form);
setTimeout("var link = document.getElementById('userform_{UUID}_pwlink'); var form = document.getElementById('userform_{UUID}_pwform'); link.style.display = 'none'; form.style.display = 'block'; domOpacity(form, 0, 100, 500);", 550);
<!-- BEGINNOT same_user -->document.forms['useredit_{UUID}'].changing_pw.value = 'yes';<!-- END same_user -->
}
function userform_{UUID}_chpasswd_cancel()
{
var link = document.getElementById('userform_{UUID}_pwlink');
var form = document.getElementById('userform_{UUID}_pwform');
domOpacity(form, 100, 0, 500);
domObjChangeOpac(0, link);
setTimeout("var link = document.getElementById('userform_{UUID}_pwlink'); var form = document.getElementById('userform_{UUID}_pwform'); form.style.display = 'none'; link.style.display = 'block'; domOpacity(link, 0, 100, 500);", 550);
<!-- BEGINNOT same_user -->document.forms['useredit_{UUID}'].changing_pw.value = 'no';<!-- END same_user -->
}
function userform_{UUID}_validate()
{
var form = document.forms['useredit_{UUID}'];
<!-- BEGINNOT same_user -->
if ( form.changing_pw.value == 'yes' )
{
if ( form.new_password.value != form.new_password_confirm.value )
{
alert(\$lang.get('user_reg_err_alert_password_nomatch'));
return false;
}
form.new_password_confirm.value = '';
runEncryption();
}
<!-- END same_user -->
return true;
}
</script>
<form action="{FORM_ACTION}" method="post" name="useredit_{UUID}" enctype="multipart/form-data" onsubmit="return userform_{UUID}_validate();">
<input name="user_id" value="{USER_ID}" type="hidden" />
<div class="tblholder">
<table border="0" cellspacing="1" cellpadding="4">
<!-- Heading -->
<tr>
<th colspan="2">
{lang:acpum_heading_editing_user} {USERNAME}
</th>
</tr>
<!-- Basic options (stored in enano_users) -->
<tr>
<th colspan="2" class="subhead">
{lang:acpum_heading_basic_options}
</th>
</tr>
<tr>
<td class="row2" style="width: 25%;">
{lang:acpum_field_username}<br />
<small>{lang:acpum_field_username_hint}</small>
</td>
<td class="row1" style="width: 75%;">
<input type="text" name="username" value="{USERNAME}" size="40" <!-- BEGIN same_user -->disabled="disabled" <!-- END same_user -->/>
<!-- BEGIN same_user --><small>{lang:acpum_msg_same_user_username}</small><!-- END same_user -->
</td>
</tr>
<tr>
<td class="row2">
{lang:acpum_field_password}
<!-- BEGIN password_meter -->
<br />
<small>{lang:acpum_field_password_hint}</small>
<!-- END password_meter -->
</td>
<td class="row1">
<div id="userform_{UUID}_pwlink">
<b>{lang:acpum_msg_password_unchanged}</b> <a href="#" onclick="userform_{UUID}_chpasswd(); return false;">{lang:acpum_btn_reset_password}</a>
</div>
<div id="userform_{UUID}_pwform" style="display: none;">
<!-- BEGIN same_user -->
{lang:acpum_msg_same_user_password} <a href="#" onclick="userform_{UUID}_chpasswd_cancel(); return false;">{lang:etc_cancel}</a>
<!-- BEGINELSE same_user -->
<input type="hidden" name="changing_pw" value="no" />
<input type="hidden" name="challenge_data" value="{MD5_CHALLENGE}" />
<input type="hidden" name="use_crypt" value="no" />
<input type="hidden" name="crypt_key" value="{PUBLIC_KEY}" />
<input type="hidden" name="crypt_data" value="" />
<table border="0" style="background-color: transparent;" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2">
<b>{lang:acpum_field_password_title}</b>
</td>
</tr>
<tr>
<td>{lang:acpum_field_newpassword}</td>
<td><input type="password" name="new_password" value="" <!-- BEGIN password_meter -->onkeyup="password_score_field(this);" /><span class="password-checker" style="font-weight: bold; color: #A0A0A0"> Waiting for l10n init</span><!-- BEGINELSE password_meter --> /><!-- END password_meter -->
<!-- BEGIN password_meter -->
<div id="pwmeter" style="margin: 4px 0; height: 8px;"></div>
<!-- END password_meter -->
</td>
</tr>
<tr>
<td>{lang:acpum_field_newpassword_confirm}</td>
<td><input type="password" name="new_password_confirm" value="" /></td>
</tr>
<tr>
<td colspan="2">
<a href="#" onclick="userform_{UUID}_chpasswd_cancel(); return false;">{lang:etc_cancel}</a>
</td>
</tr>
</table>
<!-- END same_user -->
</div>
</td>
</tr>
<tr>
<td class="row2" style="width: 25%;">
{lang:acpum_field_email}
</td>
<td class="row1" style="width: 75%;">
<input type="text" name="email" value="{EMAIL}" size="40" <!-- BEGIN same_user -->disabled="disabled" <!-- END same_user -->/>
<!-- BEGIN same_user --><small>{lang:acpum_msg_same_user_email}</small><!-- END same_user -->
</td>
</tr>
<tr>
<td class="row2" style="width: 25%;">
{lang:acpum_field_realname}
</td>
<td class="row1" style="width: 75%;">
<input type="text" name="real_name" value="{REAL_NAME}" size="40" <!-- BEGIN same_user -->disabled="disabled" <!-- END same_user -->/>
<!-- BEGIN same_user --><small>{lang:acpum_msg_same_user_realname}</small><!-- END same_user -->
</td>
</tr>
<tr>
<td class="row2" style="width: 25%;">
{lang:acpum_field_signature}
</td>
<td class="row1" style="width: 75%;">
{SIGNATURE_FIELD}
</td>
</tr>
<!-- / Basic options -->
<!-- Extended options (anything in enano_users_extra) -->
<tr>
<th class="subhead" colspan="2">
{lang:acpum_heading_imcontact}
</th>
<tr>
<td class="row2">{lang:acpum_field_aim}</td>
<td class="row1"><input type="text" name="imaddr_aim" value="{IM_AIM}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_wlm}<br /><small>{lang:acpum_field_wlm_hint}</small></td>
<td class="row1"><input type="text" name="imaddr_msn" value="{IM_WLM}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_yim}</td>
<td class="row1"><input type="text" name="imaddr_yahoo" value="{IM_YAHOO}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_xmpp}</td>
<td class="row1"><input type="text" name="imaddr_xmpp" value="{IM_XMPP}" size="30" /></td>
</tr>
<tr>
<th class="subhead" colspan="2">
{lang:acpum_heading_contact_extra}
</th>
</tr>
<tr>
<td class="row2">{lang:acpum_field_homepage}<br /><small>{lang:acpum_field_homepage_hint}</small></td>
<td class="row1"><input type="text" name="homepage" value="{HOMEPAGE}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_location}</td>
<td class="row1"><input type="text" name="location" value="{LOCATION}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_job}</td>
<td class="row1"><input type="text" name="occupation" value="{JOB}" size="30" /></td>
</tr>
<tr>
<td class="row2">{lang:acpum_field_hobbies}</td>
<td class="row1"><input type="text" name="hobbies" value="{HOBBIES}" size="30" /></td>
</tr>
<tr>
<td class="row2"><label for="chk_email_public_{UUID}">{lang:acpum_field_email_public}</label><br /><small>{lang:acpum_field_email_public_hint}</small></td>
<td class="row1"><input type="checkbox" id="chk_email_public_{UUID}" name="email_public" <!-- BEGIN email_public -->checked="checked" <!-- END email_public -->size="30" /></td>
</tr>
<!-- / Extended options -->
<!-- Avatar settings -->
<tr>
<th class="subhead" colspan="2">
{lang:acpum_avatar_heading}
</th>
</tr>
<tr>
<td class="row2">
{lang:usercp_avatar_label_current}
</td>
<td class="row1">
<!-- BEGIN user_has_avatar -->
<img alt="{AVATAR_ALT}" src="{AVATAR_SRC}" />
<!-- BEGINELSE user_has_avatar -->
{lang:acpum_avatar_image_none}
<!-- END user_has_avatar -->
</td>
</tr>
<tr>
<td class="row2">
{lang:acpum_avatar_lbl_change}
</td>
<td class="row1">
<script type="text/javascript">
function admincp_users_avatar_set_{UUID}(obj)
{
switch(obj.value)
{
case 'keep':
case 'remove':
$('avatar_upload_http_{UUID}').object.style.display = 'none';
$('avatar_upload_file_{UUID}').object.style.display = 'none';
break;
case 'set_http':
$('avatar_upload_http_{UUID}').object.style.display = 'block';
$('avatar_upload_file_{UUID}').object.style.display = 'none';
break;
case 'set_file':
$('avatar_upload_http_{UUID}').object.style.display = 'none';
$('avatar_upload_file_{UUID}').object.style.display = 'block';
break;
}
}
</script>
<label><input onclick="admincp_users_avatar_set_{UUID}(this);" type="radio" name="avatar_action" value="keep" checked="checked" /> {lang:acpum_avatar_lbl_keep}</label><br />
<label><input onclick="admincp_users_avatar_set_{UUID}(this);" type="radio" name="avatar_action" value="remove" /> {lang:acpum_avatar_lbl_remove}</label><br />
<label><input onclick="admincp_users_avatar_set_{UUID}(this);" type="radio" name="avatar_action" value="set_http" /> {lang:acpum_avatar_lbl_set_http}</label><br />
<div id="avatar_upload_http_{UUID}" style="display: none; margin: 10px 0 0 2.2em;">
{lang:usercp_avatar_lbl_url} <input type="text" name="avatar_http_url" size="40" value="http://" /><br />
<small>{lang:usercp_avatar_lbl_url_desc} {lang:usercp_avatar_limits}</small>
</div>
<label><input onclick="admincp_users_avatar_set_{UUID}(this);" type="radio" name="avatar_action" value="set_file" /> {lang:acpum_avatar_lbl_set_file}</label>
<div id="avatar_upload_file_{UUID}" style="display: none; margin: 10px 0 0 2.2em;">
{lang:usercp_avatar_lbl_file} <input type="file" name="avatar_file" size="40" value="http://" /><br />
<small>{lang:usercp_avatar_lbl_file_desc} {lang:usercp_avatar_limits}</small>
</div>
</td>
</tr>
<!-- / Avatar settings -->
<!-- Administrator-only options -->
<tr>
<th class="subhead" colspan="2">
{lang:acpum_heading_adminonly}
</th>
</tr>
<tr>
<td class="row2">{lang:acpum_field_active_title}<br />
<small>{lang:acpum_field_active_hint}</small>
</td>
<td class="row1"><label><input type="checkbox" name="account_active" <!-- BEGIN account_active -->checked="checked" <!-- END account_active -->/> {lang:acpum_field_active}</label></td>
</tr>
<tr>
<td class="row2">
{lang:acpum_field_userlevel}<br />
<small>{lang:acpum_field_userlevel_hint}</small>
</td>
<td class="row1">
<select name="user_level">
<option value="{USER_LEVEL_MEMBER}"<!-- BEGIN ul_member --> selected="selected"<!-- END ul_member -->>{lang:userfuncs_ml_level_member}</option>
<option value="{USER_LEVEL_MOD}"<!-- BEGIN ul_mod --> selected="selected"<!-- END ul_mod -->>{lang:userfuncs_ml_level_mod}</option>
<option value="{USER_LEVEL_ADMIN}"<!-- BEGIN ul_admin --> selected="selected"<!-- END ul_admin -->>{lang:userfuncs_ml_level_admin}</option>
</select>
</td>
</tr>
<!-- BEGIN have_reg_ip -->
<tr>
<td class="row2">
{lang:acpum_field_reg_ip}
</td>
<td class="row1">
{REG_IP_ADDR}
<input type="hidden" name="user_registration_ip" value="{REG_IP_ADDR}" />
</td>
</tr>
<!-- BEGINELSE have_reg_ip -->
<input type="hidden" name="user_registration_ip" value="" />
<!-- END have_reg_ip -->
<tr>
<td class="row2">
{lang:acpum_field_deleteaccount_title}
</td>
<td class="row1">
<label><input type="checkbox" name="delete_account" onclick="var d = (this.checked) ? 'block' : 'none'; document.getElementById('delete_blurb_{UUID}').style.display = d;" /> {lang:acpum_field_deleteaccount}</label>
<div id="delete_blurb_{UUID}" style="display: none;">
<!-- BEGIN same_user -->
<!-- Obnoxious I know, but it's needed. -->
<p><b>{lang:acpum_msg_delete_own_account}</b></p>
<!-- END same_user -->
<p><small>{lang:acpum_field_deleteaccount_hint}</small></p>
</div>
</td>
</tr>
</tr>
<!-- Save button -->
<tr>
<th colspan="2">
<input type="submit" name="action[save]" value="{lang:acpum_btn_save}" style="font-weight: bold;" />
<input type="submit" name="action[noop]" value="{lang:etc_cancel}" style="font-weight: normal;" />
</th>
</tr>
</table>
</div>
</form>
<script type="text/javascript">
password_score_field(document.forms['useredit_{UUID}'].new_password);
</script>
{AES_JAVASCRIPT}
<!-- Conclusion of user edit form -->
EOF;
$parser = $template->makeParserText($tpl_code);
}
$this->username = htmlspecialchars($this->username);
$this->email = htmlspecialchars($this->email);
$this->user_id = intval($this->user_id);
$this->real_name = htmlspecialchars($this->real_name);
$this->signature = htmlspecialchars($this->signature);
$this->user_level = intval($this->user_level);
$im_aim = ( isset($this->im['aim']) ) ? $this->im['aim'] : false;
$im_yahoo = ( isset($this->im['yahoo']) ) ? $this->im['yahoo'] : false;
$im_msn = ( isset($this->im['msn']) ) ? $this->im['msn'] : false;
$im_xmpp = ( isset($this->im['xmpp']) ) ? $this->im['xmpp'] : false;
$homepage = ( isset($this->contact['homepage']) ) ? $this->contact['homepage'] : false;
$location = ( isset($this->contact['location']) ) ? $this->contact['location'] : false;
$job = ( isset($this->contact['job']) ) ? $this->contact['job'] : false;
$hobbies = ( isset($this->contact['hobbies']) ) ? $this->contact['hobbies'] : false;
if ( empty($this->username) )
{
// @error One or more required parameters not set
return 'Admin_UserManager_SmartForm::render: Invalid parameter ($form->username)';
}
if ( empty($this->user_id) )
{
// @error One or more required parameters not set
return 'Admin_UserManager_SmartForm::render: Invalid parameter ($form->user_id)';
}
if ( empty($this->email) )
{
// @error One or more required parameters not set
return 'Admin_UserManager_SmartForm::render: Invalid parameter ($form->email)';
}
$form_action = makeUrlNS('Special', 'Administration', 'module=' . $paths->cpage['module'], true);
$aes_javascript = $session->aes_javascript("useredit_$this->uuid", 'new_password', 'use_crypt', 'crypt_key', 'crypt_data', 'challenge_data');
$parser->assign_vars(array(
'UUID' => $this->uuid,
'USERNAME' => $this->username,
'EMAIL' => $this->email,
'USER_ID' => $this->user_id,
'MD5_CHALLENGE' => $session->dss_rand(),
'PUBLIC_KEY' => $session->rijndael_genkey(),
'REAL_NAME' => $this->real_name,
'SIGNATURE_FIELD' => $template->tinymce_textarea('signature', $this->signature, 10, 50),
'USER_LEVEL_MEMBER' => USER_LEVEL_CHPREF,
'USER_LEVEL_MOD' => USER_LEVEL_MOD,
'USER_LEVEL_ADMIN' => USER_LEVEL_ADMIN,
'AES_JAVASCRIPT' => $aes_javascript,
'IM_AIM' => $im_aim,
'IM_YAHOO' => $im_yahoo,
'IM_WLM' => $im_msn,
'IM_XMPP' => $im_xmpp,
'HOMEPAGE' => $homepage,
'LOCATION' => $location,
'JOB' => $job,
'HOBBIES' => $hobbies,
'FORM_ACTION' => $form_action,
'REG_IP_ADDR' => $this->reg_ip_addr
));
if ( $this->has_avatar )
{
$parser->assign_vars(array(
'AVATAR_SRC' => make_avatar_url($this->user_id, $this->avi_type),
'AVATAR_ALT' => $lang->get('usercp_avatar_image_alt', array('username' => $this->username))
));
}
$parser->assign_bool(array(
'password_meter' => ( getConfig('pw_strength_enable') == '1' ),
'ul_member' => ( $this->user_level == USER_LEVEL_CHPREF ),
'ul_mod' => ( $this->user_level == USER_LEVEL_MOD ),
'ul_admin' => ( $this->user_level == USER_LEVEL_ADMIN ),
'account_active' => ( $this->account_active === true ),
'email_public' => ( $this->email_public === true ),
'same_user' => ( $this->user_id == $session->user_id ),
'user_has_avatar' => ( $this->has_avatar ),
'have_reg_ip' => ( intval(@strlen($this->reg_ip_addr)) > 0 && is_valid_ip($this->reg_ip_addr) )
));
$parsed = $parser->run();
return $parsed;
}
}
?>