1 <?php

     2 /*

     3 Plugin Name: Runt - the Enano administration panel

     4 Plugin URI: http://enanocms.org/

     5 Description: Provides the page Special:Administration, which is the AJAX frontend to the various Admin:

     6 Author: Dan Fuhry

     7 Version: 1.0

     8 Author URI: http://enanocms.org/

     9 */

    10 

    11 /*

    12  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

    13  * Version 1.0 release candidate 2

    14  * Copyright (C) 2006-2007 Dan Fuhry

    15  *

    16  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

    17  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

    18  *

    19  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

    20  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

    21  */

    22  

    23 global $db, $session, $paths, $template, $plugins; // Common objects

    24 

    25 $plugins->attachHook('base_classes_initted', '

    26   global $paths;

    27     $paths->add_page(Array(

    28       \'name\'=>\'Administration\',

    29       \'urlname\'=>\'Administration\',

    30       \'namespace\'=>\'Special\',

    31       \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

    32       ));

    33     

    34     $paths->add_page(Array(

    35       \'name\'=>\'Manage the Sidebar\',

    36       \'urlname\'=>\'EditSidebar\',

    37       \'namespace\'=>\'Special\',

    38       \'special\'=>0,\'visible\'=>0,\'comments_on\'=>0,\'protected\'=>1,\'delvotes\'=>0,\'delvote_ips\'=>\'\',

    39       ));

    40   ');

    41 

    42 // function names are IMPORTANT!!! The name pattern is: page_<namespace ID>_<page URLname, without namespace>

    43 

    44 function page_Admin_Home() {

    45   global $db, $session, $paths, $template, $plugins; // Common objects

    46   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

    47   {

    48     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

    49     return;

    50   }

    51   

    52   

    53   // Basic information

    54   echo RenderMan::render(

    55 '== Welcome to Runt, the Enano administration panel. ==

    56 

    57 Thank you for choosing Enano as your CMS. This screen allows you to see some information about your website, plus some details about how your site is doing statistically.

    58 

    59 Using the links on the left you can control every aspect of your website\'s look and feel, plus you can manage users, work with pages, and install plugins to make your Enano installation even better.');

    60   

    61   // Check for the installer scripts

    62   if(file_exists(ENANO_ROOT.'/install.php') || file_exists(ENANO_ROOT.'/schema.sql'))

    63   {

    64     echo '<div class="error-box"><b>NOTE:</b> It appears that your install.php and/or schema.sql files still exist. It is HIGHLY RECOMMENDED that you delete or rename these files, to prevent getting your server hacked.</div>';

    65   }

    66   

    67   // Inactive users

    68   $q = $db->sql_query('SELECT * FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\';');

    69   if($q)

    70     if($db->numrows() > 0)

    71     {

    72       $n = $db->numrows();

    73       if($n == 1) $s = $n . ' user is';

    74       else $s = $n . ' users are';

    75       echo '<div class="warning-box">It appears that '.$s.' awaiting account activation. You can activate those accounts by going to the <a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'UserManager\'); return false;">User Manager</a>.</div>';

    76     }

    77   $db->free_result();

    78   // Stats

    79   if(getConfig('log_hits') == '1')

    80   {

    81     $stats = stats_top_pages(10);

    82     $c = 0;

    83     $cls = 'row2';

    84     echo '<h3>Most requested pages</h3><div class="tblholder"><table style="width: 100%;" border="0" cellspacing="1" cellpadding="4"><tr><th>Page</th><th>Hits</th></tr>';

    85     foreach($stats as $page => $count)

    86     {

    87       if(isset($paths->pages[$page]))

    88       {

    89         echo '<tr>';

    90         $cls = ( $cls == 'row1' ) ? 'row2' : 'row1';

    91         echo '<td class="'.$cls.'"><a href="'.makeUrl($page).'">'.$paths->pages[$page]['name'].'</a></td><td style="text-align: center;" class="'.$cls.'">'.$count.'</td>';

    92         echo '</tr>';

    93       }

    94     }

    95     echo '</table></div>';

    96   }

    97   

    98   // Security log

    99   echo '<h3>Security log</h3>';

   100   echo '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">';

   101   $cls = 'row2';                                                                                               

   102   echo '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>';

   103   if(isset($_GET['fulllog']))

   104   {

   105     $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;';

   106   }

   107   else

   108   {

   109     $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT 5';

   110   }

   111   $q = $db->sql_query($l);

   112   while($r = $db->fetchrow())

   113   {

   114     if($cls == 'row2') $cls = 'row1';

   115     else $cls = 'row2';

   116     echo '<tr><td class="'.$cls.'">';

   117     switch($r['action']) {

   118       case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Authentication level: $level</small>"; } break;

   119       case "admin_auth_bad":  echo 'Failed administration logon'; break;

   120       case "activ_good": echo 'Successful account activation'; break;

   121       case "auth_good": echo 'Successful regular user logon'; break;

   122       case "activ_bad": echo 'Failed account activation'; break;

   123       case "auth_bad": echo 'Failed regular user logon'; break;

   124       case "sql_inject": echo 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break;

   125       case "db_backup": echo 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break;

   126       case "install_enano": echo "Installed Enano version {$r['page_text']}"; break;

   127     }

   128     echo '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>';

   129   }

   130   $db->free_result();

   131   echo '</table></div>';

   132   if(!isset($_GET['fulllog'])) echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'Home&amp;fulllog\'); return false;">Full security log</a></p>';

   133   

   134 }

   135 

   136 function page_Admin_GeneralConfig() {

   137   global $db, $session, $paths, $template, $plugins; // Common objects

   138   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   139   {

   140     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   141     return;

   142   }

   143   

   144   if(isset($_POST['submit'])) {

   145     

   146     // Global site options

   147     setConfig('site_name', $_POST['site_name']);

   148     setConfig('site_desc', $_POST['site_desc']);

   149     setConfig('main_page', str_replace(' ', '_', $_POST['main_page']));

   150     setConfig('copyright_notice', $_POST['copyright']);

   151     setConfig('contact_email', $_POST['contact_email']);

   152     

   153     // Wiki mode

   154     if(isset($_POST['wikimode']))                setConfig('wiki_mode', '1');

   155     else                                         setConfig('wiki_mode', '0');

   156     if(isset($_POST['wiki_mode_require_login'])) setConfig('wiki_mode_require_login', '1');

   157     else                                         setConfig('wiki_mode_require_login', '0');

   158     if(isset($_POST['editmsg']))                 setConfig('wiki_edit_notice', '1');

   159     else                                         setConfig('wiki_edit_notice', '0');

   160     setConfig('wiki_edit_notice_text', $_POST['editmsg_text']);

   161     

   162     // Stats

   163     if(isset($_POST['log_hits']))                setConfig('log_hits', '1');

   164     else                                         setConfig('log_hits', '0');

   165     

   166     // Disablement

   167     if(isset($_POST['site_disabled'])) {         setConfig('site_disabled', '1'); setConfig('site_disabled_notice', $_POST['site_disabled_notice']); }

   168     else                                         setConfig('site_disabled', '0');

   169     

   170     // Account activation

   171     setConfig('account_activation', $_POST['account_activation']);

   172     

   173     // W3C compliance buttons

   174     if(isset($_POST['w3c-vh32']))     setConfig("w3c_vh32", "1");

   175     else                              setConfig("w3c_vh32", "0");

   176     if(isset($_POST['w3c-vh40']))     setConfig("w3c_vh40", "1");

   177     else                              setConfig("w3c_vh40", "0");

   178     if(isset($_POST['w3c-vh401']))    setConfig("w3c_vh401", "1");

   179     else                              setConfig("w3c_vh401", "0");

   180     if(isset($_POST['w3c-vxhtml10'])) setConfig("w3c_vxhtml10", "1");

   181     else                              setConfig("w3c_vxhtml10", "0");

   182     if(isset($_POST['w3c-vxhtml11'])) setConfig("w3c_vxhtml11", "1");

   183     else                              setConfig("w3c_vxhtml11", "0");

   184     if(isset($_POST['w3c-vcss']))     setConfig("w3c_vcss", "1");

   185     else                              setConfig("w3c_vcss", "0");

   186     

   187     // SourceForge.net logo

   188     if(isset($_POST['showsf'])) setConfig('sflogo_enabled', '1');

   189     else                        setConfig('sflogo_enabled', '0');

   190     setConfig('sflogo_groupid', $_POST['sfgroup']);

   191     setConfig('sflogo_type', $_POST['sflogo']);

   192     

   193     // Comment options

   194     if(isset($_POST['comment-approval'])) setConfig('approve_comments', '1');

   195     else                                  setConfig('approve_comments', '0');

   196     if(isset($_POST['enable-comments']))  setConfig('enable_comments', '1');

   197     else                                  setConfig('enable_comments', '0');

   198     setConfig('comments_need_login', $_POST['comments_need_login']);

   199     

   200     // Powered by link

   201     if ( isset($_POST['enano_powered_link']) ) setConfig('powered_btn', '1');

   202     else                                       setConfig('powered_btn', '0');    

   203     

   204     if(isset($_POST['dbdbutton']))        setConfig('dbd_button', '1');

   205     else                                  setConfig('dbd_button', '0');

   206     

   207     if($_POST['emailmethod'] == 'phpmail') setConfig('smtp_enabled', '0');

   208     else                                   setConfig('smtp_enabled', '1');

   209     

   210     setConfig('smtp_server', $_POST['smtp_host']);

   211     setConfig('smtp_user', $_POST['smtp_user']);

   212     if($_POST['smtp_pass'] != 'XXXXXXXXXXXX') setConfig('smtp_password', $_POST['smtp_pass']);

   213     

   214     echo '<div class="info-box">Your changes to the site configuration have been saved.</div><br />';

   215     

   216   }

   217   echo('<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post" onsubmit="if(!submitAuthorized) return false;">');

   218   ?>

   219   <div class="tblholder">

   220     <table border="0" width="100%" cellspacing="1" cellpadding="4">

   221       

   222     <!-- Global options -->

   223     

   224       <tr><th colspan="2">Global site options</th></tr>

   225       <tr><th colspan="2" class="subhead">These options control the entire site.</th></tr>

   226       

   227       <tr><td class="row1" style="width: 50%;">Site name:</td>                      <td class="row1" style="width: 50%;"><input name="site_name" size="30" value="<?php echo getConfig('site_name'); ?>" /></td></tr>

   228       <tr><td class="row2">Site description:</td>               <td class="row2"><input name="site_desc" size="30" value="<?php echo getConfig('site_desc'); ?>" /></td></tr>

   229       <tr><td class="row1">Main page:</td>                      <td class="row1"><?php echo $template->pagename_field('main_page', str_replace('_', ' ', getConfig('main_page'))); ?></td></tr>

   230       <tr><td class="row2">Copyright notice shown on pages:</td><td class="row2"><input name="copyright" size="30" value="<?php echo getConfig('copyright_notice'); ?>" /></td></tr>

   231       <tr><td class="row1" colspan="2">Hint: If you're using Windows, you can make a "&copy;" symbol by holding ALT and pressing 0169 on the numeric keypad.</td></tr>

   232       <tr><td class="row2">Contact e-mail<br /><small>All e-mail sent from this site will appear to have come from the address shown here.</small></td><td class="row2"><input name="contact_email" type="text" size="40" value="<?php echo htmlspecialchars(getConfig('contact_email')); ?>" /></td></tr>

   233       

   234     <!-- Wiki mode -->

   235       

   236       <tr><th colspan="2">Wiki mode</th></tr>

   237       

   238       <tr>

   239         <td class="row3" rowspan="2">

   240           Enano can also act as a wiki, meaning anyone can edit and create pages. To enable Wiki Mode, check the box to the right.<br /><br />

   241           In Wiki Mode, certain HTML tags such as &lt;script&gt; and &lt;object&gt; are disabled, and all PHP code is disabled, except if the person editing the page is an administrator.<br /><br />

   242           Also, Enano keeps complete page history, which makes restoring vandalized pages easy. You can also protect pages so that they cannot be edited.

   243         </td>

   244         <td class="row1">

   245           <input type="checkbox" name="wikimode" id="wikimode" <?php if(getConfig('wiki_mode')=='1') echo('CHECKED '); ?> /><label for="wikimode">Enable Wiki Mode</label>

   246         </td>

   247       </tr>

   248       

   249       <tr><td class="row2"><label><input type="checkbox" name="wiki_mode_require_login"<?php if(getConfig('wiki_mode_require_login')=='1') echo('CHECKED '); ?>/> Only for logged in users</label></td></tr>

   250       

   251       <tr>

   252         <td class="row3" rowspan="2">

   253           <b>Edit page notice</b><br />

   254           When Wiki Mode is enabled, anyone can edit pages. Check the box below and enter a message to display it whenever the page editor is opened.

   255         </td>

   256         <td class="row1">

   257           <input onclick="if(this.checked) document.getElementById('editmsg_text').style.display='block'; else document.getElementById('editmsg_text').style.display='none';" type="checkbox" name="editmsg" id="editmsg" <?php if(getConfig('wiki_edit_notice')=='1') echo('CHECKED '); ?>/> <label for="editmsg">Show a message whenever pages are edited</label>

   258         </td>

   259       </tr>

   260       

   261       <tr>

   262         <td class="row2">

   263           <textarea <?php if(getConfig('wiki_edit_notice')!='1') echo('style="display:none" '); ?>rows="5" cols="30" name="editmsg_text" id="editmsg_text"><?php echo getConfig('wiki_edit_notice_text'); ?></textarea>

   264         </td>

   265       </tr>

   266       

   267     <!-- Site statistics -->

   268     

   269       <tr><th colspan="2">Statistics and hit counting</th></tr>

   270       

   271       <tr>

   272         <td class="row1">Enano has the ability to show statistics for every page on the site. This allows you to keep very close track of who is visiting your site, and from where.<br /><br />Unfortunately, some users don't like being logged. For this reason, you should state clearly what is logged (usually the username or IP address, current time, page name, and referer URL) in your privacy policy. If your site is primarily geared towards children, and you are a United States citizen, you are required to have a privacy policy stating exactly what is being logged under the terms of the Childrens' Online Privacy Protection Act.</td>

   273         <td class="row1"><label><input type="checkbox" name="log_hits" <?php if(getConfig('log_hits') == '1') echo 'checked="checked" '; ?>/>  Log all page hits</label><br /><small>This excludes special and administration pages.</small></td>

   274       </tr>

   275       

   276     <!-- Comment options -->

   277       

   278       <tr><th colspan="2">Comment system</th></tr>

   279       <tr><td class="row1"><label for="enable-comments"><b>Enable the comment system</b></label>                      </td><td class="row1"><input name="enable-comments"  id="enable-comments"  type="checkbox" <?php if(getConfig('enable_comments')=='1')  echo('CHECKED '); ?>/></td></tr>

   280       <tr><td class="row2"><label for="comment-approval">Require approval before article comments can be shown</label></td><td class="row2"><input name="comment-approval" id="comment-approval" type="checkbox" <?php if(getConfig('approve_comments')=='1') echo('CHECKED '); ?>/></td></tr>

   281       <tr><td class="row1">Guest comment posting allowed                                                              </td><td class="row1"><label><input name="comments_need_login" type="radio" value="0" <?php if(getConfig('comments_need_login')=='0') echo 'CHECKED '; ?>/> Yes</label>

   282                                                                                                                                             <label><input name="comments_need_login" type="radio" value="1" <?php if(getConfig('comments_need_login')=='1') echo 'CHECKED '; ?>/> Require visual confirmation</label>

   283     <!-- Default permissions -->                                                                                                            <label><input name="comments_need_login" type="radio" value="2" <?php if(getConfig('comments_need_login')=='2') echo 'CHECKED '; ?>/> No (require login)</label></td></tr>

   284     

   285     <!--

   286     

   287     READ: Do not try to enable this, backend support for it has been disabled. To edit default

   288           permissions, select The Entire Website in any permissions editor window.

   289     

   290       <tr><th colspan="2">Default permissions for pages</th></tr>

   291       

   292       <tr>

   293         <td class="row1">You can edit the default set of permissions used when no other permissions are available. Permissions set here are used when no other permissions are available. As with other ACL rules, you can assign these defaults to every user or one specific user or group.</td>

   294         <td class="row1"><a href="#" onclick="ajaxOpenACLManager('__DefaultPermissions', 'Special'); return false;">Manage default permissions</a></td>

   295       </tr>

   296       

   297       -->

   298       

   299     <!-- enanocms.org link -->

   300     

   301     <tr>

   302       <th colspan="2">Promote Enano</th>

   303     </tr>

   304     <tr>

   305       <td class="row3">

   306         If you think Enano is nice, or if you want to show your support for the Enano team, you can do so by placing a link to the Enano

   307         homepage in your Links sidebar block. You absolutely don't have to do this, and you won't get degraded support if you don't. Because

   308         Enano is still relatively new in the CMS world, it needs all the attention it can get - and you can easily help to spread the word

   309         using this link.

   310       </td>

   311       <td class="row1">

   312         <label>

   313           <input name="enano_powered_link" type="checkbox" <?php if(getConfig('powered_btn') == '1') echo 'checked="checked"'; ?> />&nbsp;&nbsp;Place a link to www.enanocms.org on the sidebar

   314         </label>

   315       </td>

   316     </tr>

   317       

   318     <!-- Site disablement -->

   319     

   320       <tr><th colspan="2">Disable all site access</th></tr>

   321       

   322       <tr>

   323         <td class="row3" rowspan="2">Disabling the site allows you to work on the site without letting non-administrators see or use it.</td>

   324         <td class="row1"><label><input onclick="if(this.checked) document.getElementById('site_disabled_notice').style.display='block'; else document.getElementById('site_disabled_notice').style.display='none';" type="checkbox" name="site_disabled" <?php if(getConfig('site_disabled') == '1') echo 'checked="checked" '; ?>/>  Disable this site</label></td>

   325       </tr>

   326       <tr>

   327         <td class="row2">

   328           <div id="site_disabled_notice">

   329             Message to show to users:<br />

   330             <textarea name="site_disabled_notice" rows="7" cols="30"><?php echo getConfig('site_disabled_notice'); ?></textarea>

   331           </div>

   332         </td>

   333       </tr>

   334     

   335     <!-- Account activation -->

   336       

   337       <tr><th colspan="2">User account activation</th></tr>

   338       

   339       <tr>

   340         <td class="row3" colspan="2">

   341           If you would like to require users to confirm their e-mail addresses by way of account activation, you can enable this behavior here. If this option is set to "None", users will be able to register and use this site without confirming their e-mail addresses. If this option is set to "User", users will automatically be sent e-mails upon registration with a link to activate their accounts. And lastly, if this option is set to "Admin", users' accounts will not be active until an administrator activates the account.<br /><br />

   342           You may also disable registration completely if needed.<br /><br />

   343           <b>Note: because of abuse by project administrators, sending account activation e-mails will not work on SourceForge.net servers.</b>

   344         </td>

   345       </tr>

   346       

   347       <tr>

   348         <td class="row1">Account activation:</td><td class="row1">

   349           <?php

   350           echo '<label><input'; if(getConfig('account_activation') == 'disable') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="disable" /> Disable registration</label><br />';

   351           echo '<label><input'; if(getConfig('account_activation') != 'user' && getConfig('account_activation') != 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="none" /> None</label>';

   352           echo '<label><input'; if(getConfig('account_activation') == 'user') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="user" /> User</label>';

   353           echo '<label><input'; if(getConfig('account_activation') == 'admin') echo ' checked="checked"'; echo ' type="radio" name="account_activation" value="admin" /> Admin</label>';

   354           ?>

   355         </td>

   356       </tr>

   357       

   358     <!-- E-mail options -->

   359     

   360     <tr><th colspan="2">E-mail sent from the site</th></tr>

   361     <tr><td class="row1">E-mail sending method:<br /><small>Try using the built-in e-mail method first. If that doesn't work, you will need to enter valid SMTP information here.</small></td>

   362         <td class="row1"><label><input <?php if(getConfig('smtp_enabled') != '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="phpmail" />PHP's built-in mail() function</label><br />

   363                          <label><input <?php if(getConfig('smtp_enabled') == '1') echo 'checked="checked"'; ?> type="radio" name="emailmethod" value="smtp" />Use an external SMTP server</label></td>

   364         </tr>

   365     <tr><td class="row2">SMTP hostname:<br /><small>This option only applies to the external SMTP mode.</small></td>

   366         <td class="row2"><input value="<?php echo getConfig('smtp_server'); ?>" name="smtp_host" type="text" size="30" /></td>

   367         </tr>

   368     <tr><td class="row1">SMTP credentials:<br /><small>This option only applies to the external SMTP mode.</small></td>

   369         <td class="row1">Username: <input value="<?php echo getConfig('smtp_user'); ?>" name="smtp_user" type="text" size="30" /><br />

   370             Password: <input value="<?php if(getConfig('smtp_password') != false) echo 'XXXXXXXXXXXX'; ?>" name="smtp_pass" type="password" size="30" /></td>

   371         </tr>

   372       

   373     <!-- SourceForge.net logo -->

   374       

   375       <tr><th colspan="2">SourceForge.net logo</th></tr>

   376       

   377       <tr>

   378         <td colspan="2" class="row3">

   379           All projects hosted by SourceForge.net are required to display an official SourceForge.net logo on their pages.  If you want

   380           to display a SourceForge.net logo on the sidebar, check the box below, enter your group ID, and select an image type.

   381         </td>

   382       </tr>

   383       

   384       <?php

   385       if(getConfig("sflogo_enabled")=='1') $c='CHECKED ';

   386       else $c='';

   387       if(getConfig("sflogo_groupid")) $g=getConfig("sflogo_groupid");

   388       else $g='';

   389       if(getConfig("sflogo_type")) $t=getConfig("sflogo_type");

   390       else $t='1';

   391       ?>

   392       

   393       <tr>

   394         <td class="row1">Display the SourceForge.net logo on the right sidebar</td>

   395         <td class="row1"><input type=checkbox name="showsf" id="showsf" <?php echo $c; ?> /></td>

   396       </tr>

   397       

   398       <tr>

   399         <td class="row2">Group ID:</td>

   400         <td class="row2"><input value="<?php echo $g; ?>" type=text size=15 name=sfgroup /></td>

   401       </tr>

   402       

   403       <tr>

   404         <td class="row1">Logo style:</td>

   405         <td class="row1">

   406           <select name="sflogo">

   407             <option <?php if($t=='1') echo('SELECTED '); ?>value=1>88x31px, white</option>

   408             <option <?php if($t=='2') echo('SELECTED '); ?>value=2>125x37px, white</option>

   409             <option <?php if($t=='3') echo('SELECTED '); ?>value=3>125x37px, black</option>

   410             <option <?php if($t=='4') echo('SELECTED '); ?>value=4>125x37px, blue</option>

   411             <option <?php if($t=='5') echo('SELECTED '); ?>value=5>210x62px, white</option>

   412             <option <?php if($t=='6') echo('SELECTED '); ?>value=6>210x62px, black</option>

   413             <option <?php if($t=='7') echo('SELECTED '); ?>value=7>210x62px, blue</option>

   414           </select>

   415         </td>

   416       </tr>

   417       

   418     <!-- W3C validator buttons -->

   419       

   420       <tr><th colspan="2">W3C compliance logos</th></tr>

   421       <tr><th colspan="2" class="subhead">Enano generates (by default) Valid XHTML 1.1 code, plus valid CSS.  If you want to show this off, check the appropriate boxes below.</th></tr>

   422       

   423       <tr><td class="row1"><label for="w3c-vh32">HTML 3.2</label>     </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh32')=='1')     echo('CHECKED '); ?> id="w3c-vh32"     name="w3c-vh32"     /></td></tr>

   424       <tr><td class="row2"><label for="w3c-vh40">HTML 4.0</label>     </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vh40')=='1')     echo('CHECKED '); ?> id="w3c-vh40"     name="w3c-vh40"     /></td></tr>

   425       <tr><td class="row1"><label for="w3c-vh401">HTML 4.01</label>   </td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vh401')=='1')    echo('CHECKED '); ?> id="w3c-vh401"    name="w3c-vh401"    /></td></tr>

   426       <tr><td class="row2"><label for="w3c-vxhtml10">XHTML 1.0</label></td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vxhtml10')=='1') echo('CHECKED '); ?> id="w3c-vxhtml10" name="w3c-vxhtml10" /></td></tr>

   427       <tr><td class="row1"><label for="w3c-vxhtml11">XHTML 1.1</label></td><td class="row1"><input type="checkbox" <?php if(getConfig('w3c_vxhtml11')=='1') echo('CHECKED '); ?> id="w3c-vxhtml11" name="w3c-vxhtml11" /></td></tr>

   428       <tr><td class="row2"><label for="w3c-vcss">CSS</label>          </td><td class="row2"><input type="checkbox" <?php if(getConfig('w3c_vcss')=='1')     echo('CHECKED '); ?> id="w3c-vcss"     name="w3c-vcss"     /></td></tr>

   429 

   430     <!-- DefectiveByDesign.org ad -->      

   431       

   432       <tr><th colspan="2">Defective By Design Anti-DRM button</th></tr>

   433       <tr><td colspan="2" class="row3"><b>The Enano project is strongly against Digital Restrictions Management.</b> DRM removes the freedoms that every consumer should have: to freely copy and use digital media items they legally purchased to their own devices. Showing your opposition to DRM is as easy as checking the box below to place a link to <a href="http://www.defectivebydesign.org">DefectiveByDesign.org</a> on your sidebar.</td></tr>

   434       <tr><td class="row1"><label for="dbdbutton">Help stop DRM by placing a link to DBD on the sidebar!</label></td><td class="row1"><input type="checkbox" name="dbdbutton" id="dbdbutton" <?php if(getConfig('dbd_button')=='1')  echo('checked="checked" '); ?>/></td></tr>

   435       

   436     <!-- Save button -->

   437       

   438       <tr><th style="text-align: right" class="subhead" colspan="2"><input type=submit name=submit value="Save changes" /></th></tr>

   439       

   440     </table>

   441   </div>

   442 </form>

   443   <?php

   444 }

   445 

   446 function page_Admin_UploadConfig()

   447 {

   448   global $db, $session, $paths, $template, $plugins; // Common objects

   449   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   450   {

   451     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   452     return;

   453   }

   454   

   455   if(isset($_POST['save']))

   456   {

   457     if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0');

   458     if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0');

   459     if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0');

   460     if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0');

   461     if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']);

   462     else echo '<span style="color: red"><b>Warning:</b> the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.</span>';

   463     $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']);

   464     setConfig('max_file_size', $max_upload.'');

   465   }

   466   echo '<form name="main" action="'.htmlspecialchars(makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module'])).'" method="post">';

   467   ?>

   468   <h3>File upload configuration</h3>

   469   <p>Enano supports the ability to upload files to your website and store the files in the database. This enables you to embed images

   470      and such into pages without manually writing the HTML. However, the upload feature can sometimes pose a risk to your site, as viruses

   471      and executable files can sometimes be uploaded.</p>

   472   <p><label><input type="checkbox" name="enable_uploads" <?php if(getConfig('enable_uploads')=='1') echo 'checked="checked"'; ?> /> <b>Enable file uploads</b></label></p>

   473   <p>Maximum file size: <input name="max_file_size" onkeyup="if(!this.value.match(/^([0-9\.]+)$/ig)) this.value = this.value.substr(0,this.value.length-1);" value="<?php echo getConfig('max_file_size'); ?>" /> <select name="fs_units"><option value="1" selected="selected">bytes</option><option value="1024">KB</option><option value="1048576">MB</option></select></p>

   474   <p>You can allow Enano to generate thumbnails of images automatically. This feature requires ImageMagick to work properly. If your server

   475      does not have ImageMagick on it, Enano will simply make your users' browsers scale the images. In most cases this is fine, but if you

   476      are uploading large (>100KB) images and embedding them inside of pages, you should try to enable ImageMagick because transferring these

   477      large images many times can cost you quite a lot of bandwidth.</p>

   478   <p><label><input type="checkbox" name="enable_imagemagick" <?php if(getConfig('enable_imagemagick')=='1') echo 'checked="checked"'; ?> /> Use ImageMagick to scale images</label><br />

   479      Path to ImageMagick: <input type="text" name="imagemagick_path" value="<?php if(getConfig('imagemagick_path')) echo getConfig('imagemagick_path'); else echo '/usr/bin/convert'; ?>" /><br />

   480      On Linux and Unix servers, the most likely options here are /usr/bin/convert and /usr/local/bin/convert. If you server runs Windows, then

   481      ImageMagick is most likely to be C:\Windows\Convert.exe or C:\Windows\System32\Convert.exe.

   482      </p>

   483   <p>If you use ImageMagick to scale images, your server will be very busy constantly scaling images if your website is busy, and your site

   484      may experience slowdowns. You can dramatically speed up this scaling process if you use a directory to cache thumbnail images.</p>

   485   <p><b>Please note:</b> the cache/ directory on your server <u>must</u> be writable by the server. While this is not usually a problem on

   486      Windows servers, most Linux/Unix servers will require you to CHMOD the cache/ directory to 777. See your FTP client's user guide for

   487      more information on how to do this.<?php if(!is_writable(ENANO_ROOT.'/cache/')) echo ' <b>At present, it seems that the cache directory

   488      is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p>

   489   <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p>

   490   <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious

   491      changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option

   492      enabled unless you have less than 250MB of MySQL database space.</p>

   493   <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p>

   494   <hr style="margin-left: 1em;" />

   495   <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p>

   496   <?php

   497   echo '</form>';

   498 }

   499 

   500 function page_Admin_PluginManager() {

   501   global $db, $session, $paths, $template, $plugins; // Common objects

   502   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   503   {

   504     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   505     return;

   506   }

   507   

   508   

   509   if(isset($_GET['action'])) {

   510     switch($_GET['action']) {

   511       case "enable":

   512         setConfig('plugin_'.$_GET['plugin'], '1');

   513         break;

   514       case "disable":

   515         if($_GET['plugin']!='admin.php') setConfig('plugin_'.$_GET['plugin'], '0');

   516         else echo('<h3>Error disabling plugin</h3><p>The administration panel plugin cannot be disabled.</p>');

   517         break;

   518     }

   519   }

   520   $dir = './plugins/';

   521   $plugin_list = Array();

   522   $system = Array();

   523   if (is_dir($dir)) {

   524     if ($dh = opendir($dir)) {

   525       while (($file = readdir($dh)) !== false) {

   526         if(preg_match('#^(.*?)\.php$#is', $file) && $file != 'index.php')

   527         {

   528           if ( in_array($file, $plugins->system_plugins) )

   529           {

   530             $thelist =& $system;

   531             continue;

   532           }

   533           else

   534           {

   535             $thelist =& $plugin_list;

   536           }

   537           $f = file_get_contents($dir . $file);

   538           $f = explode("\n", $f);

   539           $f = array_slice($f, 2, 7);

   540           $f[0] = substr($f[0], 13, strlen($f[0]));

   541           $f[1] = substr($f[1], 12, strlen($f[1]));

   542           $f[2] = substr($f[2], 13, strlen($f[2]));

   543           $f[3] = substr($f[3], 8,  strlen($f[3]));

   544           $f[4] = substr($f[4], 9,  strlen($f[4]));

   545           $f[5] = substr($f[5], 12, strlen($f[5]));

   546           $thelist[$file] = Array();

   547           $thelist[$file]['name'] = $f[0];

   548           $thelist[$file]['uri']  = $f[1];

   549           $thelist[$file]['desc'] = $f[2];

   550           $thelist[$file]['auth'] = $f[3];

   551           $thelist[$file]['vers'] = $f[4];

   552           $thelist[$file]['aweb'] = $f[5];

   553         }

   554       }

   555       closedir($dh);

   556     }

   557   }

   558   echo('<div class="tblholder"><table border="0" width="100%" cellspacing="1" cellpadding="4">

   559       <tr><th>Plugin filename</th><th>Plugin name</th><th>Description</th><th>Author</th><th>Version</th><th></th></tr>');

   560     $plugin_files = array_keys($plugin_list);

   561     $cls = 'row2';

   562     for ( $i = 0; $i < sizeof($plugin_files); $i++ )

   563     {

   564       $cls = ( $cls == 'row2' ) ? 'row3' : 'row2';

   565       echo '<tr>

   566               <td class="'.$cls.'">'.$plugin_files[$i].'</td>

   567               <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['uri'].'">'.$plugin_list[$plugin_files[$i]]['name'].'</a></td>

   568               <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['desc'].'</td>

   569               <td class="'.$cls.'"><a href="'.$plugin_list[$plugin_files[$i]]['aweb'].'">'.$plugin_list[$plugin_files[$i]]['auth'].'</a></td>

   570               <td class="'.$cls.'">'.$plugin_list[$plugin_files[$i]]['vers'].'</td>

   571               <td class="'.$cls.'">';

   572       if ( getConfig('plugin_'.$plugin_files[$i]) == '1' )

   573       {

   574         echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&amp;action=disable&amp;plugin='.$plugin_files[$i].'">Disable</a>';

   575       }

   576       else

   577       {

   578         echo '<a href="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'&amp;action=enable&amp;plugin='.$plugin_files[$i].'">Enable</a>';

   579       }

   580       echo '</td></tr>';

   581     }

   582     echo '</table></div>';

   583 }

   584 

   585 function page_Admin_UploadAllowedMimeTypes()

   586 {

   587   global $db, $session, $paths, $template, $plugins; // Common objects

   588   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   589   {

   590     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   591     return;

   592   }

   593   

   594   global $mime_types, $mimetype_exps, $mimetype_extlist;

   595   if(isset($_POST['save']))

   596   {

   597     $bits = '';

   598     $keys = array_keys($mime_types);

   599     foreach($keys as $i => $k)

   600     {

   601       if(isset($_POST['ext_'.$k])) $bits .= '1';

   602       else $bits .= '0';

   603     }

   604     $bits = compress_bitfield($bits);

   605     setConfig('allowed_mime_types', $bits);

   606     echo '<div class="info-box">Your changes have been saved.</div>';

   607   }

   608   $allowed = fetch_allowed_extensions();

   609   ?>

   610   <h3>Allowed file types</h3>

   611    <p>Using the form below, you can decide which file types are allowed to be uploaded to this site.</p>

   612   <?php

   613   echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', (( isset($_GET['sqldbg'])) ? 'sqldbg&amp;' : '') .'module='.$paths->cpage['module']).'" method="post">';

   614     $c = -1;

   615     $t = -1;

   616     $cl = 'row1';

   617     echo "\n".'    <div class="tblholder">'."\n".'      <table cellspacing="1" cellpadding="2" style="margin: 0; padding: 0;" border="0">'."\n".'        <tr>'."\n        ";

   618     foreach($mime_types as $e => $m)

   619     {

   620       $c++;

   621       $t++;

   622       if($c == 3)

   623       {

   624         $c = 0;

   625         $cl = ( $cl == 'row1' ) ? 'row2' : 'row1';

   626         echo '</tr>'."\n".'        <tr>'."\n        ";

   627       }

   628       $seed = "extchkbx_{$e}_".md5(microtime() . mt_rand());

   629       $chk = (!empty($allowed[$e])) ? ' checked="checked"' : '';

   630       echo "  <td class='$cl'>\n            <label><input id='{$seed}' type='checkbox' name='ext_{$e}'{$chk} />.{$e}\n            ({$m})</label>\n          </td>\n        ";

   631     }

   632     while($c < 2)

   633     {

   634       $c++;

   635       echo "  <td class='{$cl}'></td>\n        ";

   636     }

   637     echo '<tr><th class="subhead" colspan="3"><input type="submit" name="save" value="Save changes" /></th></tr>';

   638     echo '</tr>'."\n".'      </table>'."\n".'    </div>';

   639     echo '</form>';

   640   ?>

   641   <?php

   642 }

   643 

   644 function page_Admin_Sidebar()

   645 {

   646   global $db, $session, $paths, $template, $plugins; // Common objects

   647   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   648   {

   649     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   650     return;

   651   }

   652   

   653   ?>

   654   <h2>Editing and managing the Enano sidebar</h2>

   655    <p>The Enano sidebar is a versatile tool when scripted correctly. You don't have to be a programmer to enjoy the features the Sidebar

   656       provides; however, editing the sidebar requires a small bit of programming knowledge and an understanding of Enano's system message

   657       markup language.

   658       </p>

   659    <p>The Enano system markup language is somewhat similar to HTML, in that it uses tags (&lt;example&gt;like this&lt;/example&gt;) for the

   660       main syntax. However, Enano uses curly brackets ({ and }) as opposed to less-than and greater-than signs (&lt; and &gt;).</p>

   661    <p>Programming the Enano sidebar requires the use of two tags: {slider} and {if}. The {slider} tag is used to create a new heading

   662       on the sidebar, and all text enclosed in that tag will be collapsed when the heading is clicked. To specify the text on the heading,

   663       use an equals sign (=) after the "slider" text. Then insert any links (they should be wiki-formatted) to internal Enano pages and

   664       external sites.</p>

   665    <p>So here is what the language for the default sidebar's "Navigation" heading looks like:</p>

   666    <pre>{slider=Navigation}

   667   [[Main Page|Home]]

   668   [[Enano:Sidebar|Edit the sidebar]]

   669 {/slider}</pre>

   670    <p>Pretty simple, huh? Good, now we're going to learn another common aspect of Enano programming: conditionals. The {if} tag allows you

   671       to decide whether a portion of the sidebar will be displayed based on a template variable. Currently the only available conditions are

   672       "user_logged_in" and "auth_admin", but more will be added soon. To use a conditional, enter {if conditional_name}, and then the

   673       wiki-formatted text that you want to be under that condition, and then close the tag with {/if}. In the same way, you can reverse the

   674       effect with {!if}. With {!if}, the closing tag is still {/if}, so keep that in mind. An {else} tag will be supported soon.</p>

   675    <p>Now it's time for some real fun: variables. All template variables can be accessed from the sidebar. A variable is simply the

   676       variable name, prefixed by a dollar sign ($). Some of the most common variables are $USERNAME, $SITE_NAME, $SITE_DESC, and $PAGE_NAME.

   677       The sidebar also has some special variables that it uses for some of its links. The logout link can be added with $LOGOUT_LINK, and

   678       the "change theme" button can be added with $STYLE_LINK.</p>

   679    <p>So here is the Enano markup for the portion of the sidebar that contains the user tools:</p>

   680    <pre>{slider=$USERNAME}

   681   [[User:$USERNAME|User page]]

   682   [[Special:Contributions?user=$USERNAME|My Contributions]]

   683   {if user_logged_in}

   684     [[Special:Preferences|Preferences]]

   685     $THEME_LINK

   686   {/if}

   687   {if auth_admin}

   688     [[Special:Administration|Administration]]

   689   {/if}

   690   {if user_logged_in}

   691     $LOGOUT_LINK

   692   {/if}

   693   {!if user_logged_in}

   694     Create an account

   695     Log in

   696   {/if}

   697 {/slider}</pre>

   698   <?php

   699 }

   700 

   701 function page_Admin_UserManager() {

   702   global $db, $session, $paths, $template, $plugins; // Common objects

   703   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   704   {

   705     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   706     return;

   707   }

   708   

   709   if(isset($_POST['go'])) {

   710     // We need the user ID before we can do anything

   711     $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_POST['username']) . '\'');

   712     if(!$q) die('Error selecting user ID: '.mysql_error());

   713     if($db->numrows() < 1) { echo('User does not exist, please enter another username.'); return; }

   714     $r = $db->fetchrow();

   715     $db->free_result();

   716     if(isset($_POST['save']))

   717     {

   718       $_POST['level'] = intval($_POST['level']);

   719       

   720       $new_level = $_POST['level'];

   721       $old_level = intval($r['user_level']);

   722       

   723       $re = $session->update_user((int)$r['user_id'], $_POST['new_username'], false, $_POST['new_pass'], $_POST['email'], $_POST['real_name'], false, $_POST['level']);

   724       

   725       if($re == 'success')

   726       {

   727         

   728         if ( $new_level != $old_level )

   729         {

   730           $user_id = intval($r['user_id']);

   731           // We need to update group memberships

   732           if ( $old_level == USER_LEVEL_ADMIN ) 

   733           {

   734             $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);

   735           }

   736           else if ( $old_level == USER_LEVEL_MOD ) 

   737           {

   738             $session->remove_user_from_group($user_id, GROUP_ID_MOD);

   739           }

   740           

   741           if ( $new_level == USER_LEVEL_ADMIN )

   742           {

   743             $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);

   744           }

   745           else if ( $new_level == USER_LEVEL_MOD )

   746           {

   747             $session->add_user_to_group($user_id, GROUP_ID_MOD, false);

   748           }

   749         }

   750         

   751         echo('<div class="info-box">Your changes have been saved.</div>');

   752       }

   753       else

   754       {

   755         echo('<div class="error-box">Error saving changes: '.implode('<br />', $re).'</div>');

   756       }

   757       $q = $db->sql_query('SELECT user_id,username,email,real_name,style,user_level FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['username']).'\'');

   758       if ( !$q )

   759       {

   760         die('Error selecting user ID: '.mysql_error());

   761       }

   762       if($db->numrows($q) < 1)

   763       {

   764         die('User does not exist, please enter another username.');

   765       }

   766       $r = mysql_fetch_object($q);

   767       $db->free_result();

   768     }

   769     elseif(isset($_POST['deleteme']) && isset($_POST['delete_conf']))

   770     {

   771       $q = $db->sql_query('DELETE FROM users WHERE user_id='.$r['user_id'].';');

   772       if($q)

   773       {

   774         echo '<div class="error-box">The user account "'.$r['username'].'" was deleted.</div>';

   775       }

   776       else

   777       {

   778         echo '<div class="error-box">The user account "'.$r['username'].'" could not be deleted due to a database error.<br /><br />'.$db->get_error().'</div>';

   779       }

   780     }

   781     else

   782     {

   783       echo('

   784       <h3>Edit User Info</h3>

   785       <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post">

   786         <table border="0" style="margin-left: 0.2in;">   

   787           <tr><td>Username:</td><td><input type="text" name="new_username" value="'.$r['username'].'" /></td></tr>

   788           <tr><td>New Password:</td><td><input type="password" name="new_pass" /></td></tr>

   789           <tr><td>E-mail:</td><td><input type="text" name="email" value="'.$r['email'].'" /></td></tr>

   790           <tr><td>Real Name:</td><td><input type="text" name="real_name" value="'.$r['real_name'].'" /></td></tr>

   791           <tr><td>User level:</td><td><select name="level"><option '); if($r['user_level']==USER_LEVEL_CHPREF) echo('SELECTED'); echo(' value="'.USER_LEVEL_CHPREF.'">Regular User</option><option '); if($r['user_level']==USER_LEVEL_MOD) echo('SELECTED'); echo(' value="'.USER_LEVEL_MOD.'">Moderator</option><option '); if($r['user_level']==USER_LEVEL_ADMIN) echo('SELECTED'); echo(' value="'.USER_LEVEL_ADMIN.'">Administrator</option></select></td></tr>

   792           <tr><td>Delete user:</td><td><input type="hidden" name="go" /><input type="hidden" name="username" value="'.$r['username'].'" /><input onclick="return confirm(\'This is your last warning.\n\nAre you sure you want to delete this user account? Even if you delete this user account, the username will be shown in page edit history, comments, and other areas of the site.\n\nDeleting a user account CANNOT BE UNDONE and should only be done in extreme circumstances.\n\nIf the user has violated the site policy, deleting the account will not prevent him from using the site, for that you need to add a new ban rule.\n\nContinue deleting this user account?\')" type="submit" name="deleteme" value="Delete this user" style="color: red;" /> <label><input type="checkbox" name="delete_conf" /> I\'m absolutely sure</label>

   793           <tr><td align="center" colspan="2">

   794           <input type="submit" name="save" value="Save Changes" /></td></tr>

   795         </table>

   796       </form>

   797       ');

   798     }

   799   } elseif(isset($_POST['clearsessions'])) {

   800     // Get the current session information so the user doesn't get logged out

   801     $aes = new AESCrypt();

   802     $sk = md5($session->sid_super);

   803     $qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);

   804     if(!$qb) die('Error selecting session key info block B: '.$db->get_error());

   805     if($db->numrows($qb) < 1) die('Error: cannot read admin session info block B, aborting table clear process');

   806     $qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);

   807     if(!$qa) die('Error selecting session key info block A: '.$db->get_error());

   808     if($db->numrows($qa) < 1) die('Error: cannot read user session info block A, aborting table clear process');

   809     $ra = mysql_fetch_object($qa);

   810     $rb = mysql_fetch_object($qb);

   811     $db->free_result($qa);

   812     $db->free_result($qb);

   813     $db->sql_query('DELETE FROM '.table_prefix.'session_keys;');

   814     $db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra->session_key.'\', \''.$ra->salt.'\', \''.$session->user_id.'\', \''.$ra->auth_level.'\', \''.$ra->source_ip.'\', '.$ra->time.' ),( \''.$rb->session_key.'\', \''.$rb->salt.'\', \''.$session->user_id.'\', \''.$rb->auth_level.'\', \''.$rb->source_ip.'\', '.$rb->time.' )');

   815     echo('

   816       <div class="info-box">The session key table has been cleared. Your database should be a little bit smaller now.</div>

   817     ');

   818   }   

   819   echo('

   820   <h3>User Management</h3>

   821   <form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;">

   822     <p>Username: '.$template->username_field('username').' <input type="submit" name="go" value="Go" /></p>

   823     <h3>Clear session keys table</h3>

   824      <p>It\'s a good idea to clean out your session keys table every once in a while, since this helps to reduce database size. During this process you will be logged off and (hopefully) logged back on automatically. The side effects of this include all users except you being logged off.</p>

   825      <p><input type="submit" name="clearsessions" value="Clear session keys table" /></p>

   826   </form>

   827   ');

   828   if(isset($_GET['action']) && isset($_GET['user']))

   829   {

   830     switch($_GET['action'])

   831     {

   832       case "activate":

   833         $e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');

   834         if($e)

   835         {

   836           $row = $db->fetchrow();

   837           $db->free_result();

   838           if($session->activate_account($_GET['user'], $row['activation_key'])) { echo '<div class="info-box">The user account "'.$_GET['user'].'" has been activated.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }

   839           else echo '<div class="warning-box">The user account "'.$_GET['user'].'" has NOT been activated, possibly because the account is already active.</div>';

   840         } else echo '<div class="error-box">Error activating account: '.mysql_error().'</div>';

   841         break;

   842       case "sendemail":

   843         if($session->send_activation_mail($_GET['user'])) { echo '<div class="info-box">The user "'.$_GET['user'].'" has been sent an e-mail with an activation link.</div>'; $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE time_id=' . $db->escape($_GET['logid'])); }

   844         else echo '<div class="error-box">The user account "'.$_GET['user'].'" has not been activated, probably because of a bad SMTP configuration.</div>';

   845         break;

   846       case "deny":

   847         $e = $db->sql_query('DELETE FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($_GET['user']) . '\';');

   848         if(!$e) echo '<div class="error-box">Error during row deletion: '.mysql_error().'</div>';

   849         else echo '<div class="info-box">All activation requests for the user "'.$_GET['user'].'" have been deleted.</div>';

   850         break;

   851     }

   852   }

   853   $q = $db->sql_query('SELECT log_type, action, time_id, date_string, author, edit_summary FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' ORDER BY time_id DESC;');

   854   if($q)

   855   {

   856     if($db->numrows() > 0)

   857     {

   858       $n = $db->numrows();

   859       if($n == 1) $s = $n . ' user is';

   860       else $s = $n . ' users are';

   861       echo '<h3>'.$s . ' awaiting account activation</h3>';

   862       echo '<div class="tblholder">

   863             <table border="0" cellspacing="1" cellpadding="4" width="100%">

   864             <tr><th>Date of request</th><th>Requested by</th><th>Requested for</th><th colspan="3">Actions</th></tr>';

   865       $cls = 'row2';

   866       while($row = $db->fetchrow())

   867       {

   868         if($cls == 'row2') $cls = 'row1';

   869         else $cls = 'row2';

   870         echo '<tr><td class="'.$cls.'">'.date('F d, Y h:i a', $row['time_id']).'</td><td class="'.$cls.'">'.$row['author'].'</td><td class="'.$cls.'">'.$row['edit_summary'].'</td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&amp;action=activate&amp;user='.$row['edit_summary'].'&amp;logid='.$row['time_id']).'">Activate now</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&amp;action=sendemail&amp;user='.$row['edit_summary'].'&amp;logid='.$row['time_id']).'">Send activation e-mail</a></td><td class="'.$cls.'" style="text-align: center;"><a href="'.makeUrlNS('Special', 'Administration', 'module='.$paths->nslist['Admin'].'UserManager&amp;action=deny&amp;user='.$row['edit_summary'].'&amp;logid='.$row['time_id']).'">Deny request</a></td></tr>';

   871       }

   872       echo '</table>';

   873     }

   874     $db->free_result();

   875   }

   876 }

   877 

   878 function page_Admin_GroupManager()

   879 {

   880   global $db, $session, $paths, $template, $plugins; // Common objects

   881   if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

   882   {

   883     echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>';

   884     return;

   885   }

   886   

   887   if(isset($_POST['do_create_stage1']))

   888   {

   889     if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))

   890     {

   891       echo '<p>The group name you chose is invalid.</p>';

   892       return;

   893     }

   894     echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';

   895     echo '<div class="tblholder">

   896           <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">

   897           <tr><th colspan="2">Creating group: '.$_POST['create_group_name'].'</th></tr>

   898           <tr>

   899             <td class="row1">Group moderator</td><td class="row1">' . $template->username_field('group_mod') . '</td>

   900           </tr>

   901           <tr><td class="row2">Group status</td><td class="row2">

   902             <label><input type="radio" name="group_status" value="'.GROUP_CLOSED.'" checked="checked" /> Closed to new members</label><br />

   903             <label><input type="radio" name="group_status" value="'.GROUP_REQUEST.'" /> Members can ask to be added</label><br />

   904             <label><input type="radio" name="group_status" value="'.GROUP_OPEN.'" /> Members can join freely</label><br />

   905             <label><input type="radio" name="group_status" value="'.GROUP_HIDDEN.'" /> Group is hidden</label>

   906           </td></tr>

   907           <tr>

   908             <th class="subhead" colspan="2">

   909               <input type="hidden" name="create_group_name" value="'.$_POST['create_group_name'].'" />

   910               <input type="submit" name="do_create_stage2" value="Create group" />

   911             </th>

   912           </tr>

   913           </table>

   914           </div>';

   915     echo '</form>';

   916     return;

   917   }

   918   elseif(isset($_POST['do_create_stage2']))

   919   {

   920     if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['create_group_name']))

   921     {

   922       echo '<p>The group name you chose is invalid.</p>';

   923       return;

   924     }

   925     if(!in_array(intval($_POST['group_status']), Array(GROUP_CLOSED, GROUP_OPEN, GROUP_HIDDEN, GROUP_REQUEST)))

   926     {

   927       echo '<p>Hacking attempt</p>';

   928       return;

   929     }

   930     $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');

   931     if(!$e)

   932     {

   933       echo $db->get_error();

   934       return;

   935     }

   936     if($db->numrows() > 0)

   937     {

   938       echo '<p>The group name you entered already exists.</p>';

   939       return;

   940     }

   941     $db->free_result();

   942     $q = $db->sql_query('INSERT INTO '.table_prefix.'groups(group_name,group_type) VALUES( \''.$db->escape($_POST['create_group_name']).'\', ' . intval($_POST['group_status']) . ' )');

   943     if(!$q)

   944     {

   945       echo $db->get_error();

   946       return;

   947     }

   948     $e = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['group_mod']).'\';');

   949     if(!$e)

   950     {

   951       echo $db->get_error();

   952       return;

   953     }

   954     if($db->numrows() < 1)

   955     {

   956       echo '<p>The username you entered could not be found.</p>';

   957       return;

   958     }

   959     $row = $db->fetchrow();

   960     $id = $row['user_id'];

   961     $db->free_result();

   962     $e = $db->sql_query('SELECT group_id FROM '.table_prefix.'groups WHERE group_name=\''.$db->escape($_POST['create_group_name']).'\';');

   963     if(!$e)

   964     {

   965       echo $db->get_error();

   966       return;

   967     }

   968     if($db->numrows() < 1)

   969     {

   970       echo '<p>The group ID could not be looked up.</p>';

   971       return;

   972     }

   973     $row = $db->fetchrow();

   974     $gid = $row['group_id'];

   975     $db->free_result();

   976     $e = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.$gid.', '.$id.', 1);');

   977     if(!$e)

   978     {

   979       echo $db->get_error();

   980       return;

   981     }

   982     echo "<div class='info-box'>

   983             <b>Information</b><br />

   984             The group {$_POST['create_group_name']} has been created successfully.

   985           </div>";

   986   }

   987   if(isset($_POST['do_edit']) || isset($_POST['edit_do']))

   988   {

   989     // Fetch the group name

   990     $q = $db->sql_query('SELECT group_name,system_group FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');

   991     if(!$q)

   992     {

   993       echo $db->get_error();

   994       return;

   995     }

   996     if($db->numrows() < 1)

   997     {

   998       echo '<p>Error: couldn\'t look up group name</p>';

   999     }

  1000     $row = $db->fetchrow();

  1001     $name = $row['group_name'];

  1002     $db->free_result();

  1003     if(isset($_POST['edit_do']))

  1004     {

  1005       if(isset($_POST['edit_do']['del_group']))

  1006       {

  1007         if ( $row['system_group'] == 1 )

  1008         {

  1009           echo '<div class="error-box">The group "' . $name . '" could not be deleted because it is a system group required for site functionality.</div>';

  1010         }

  1011         else

  1012         {

  1013           $q = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE group_id='.intval($_POST['group_edit_id']).';');

  1014           if(!$q)

  1015           {

  1016             echo $db->get_error();

  1017             return;

  1018           }

  1019           $q = $db->sql_query('DELETE FROM '.table_prefix.'groups WHERE group_id='.intval($_POST['group_edit_id']).';');

  1020           if(!$q)

  1021           {

  1022             echo $db->get_error();

  1023             return;

  1024           }

  1025           echo '<div class="info-box">The group "'.$name.'" has been deleted. Return to the <a href="javascript:ajaxPage(\'Admin:GroupManager\');">group manager</a>.</div>';

  1026           return;

  1027         }

  1028       }

  1029       if(isset($_POST['edit_do']['save_name']))

  1030       {

  1031         if(!preg_match('/^([A-z0-9 -]+)$/', $_POST['group_name']))

  1032         {

  1033           echo '<p>The group name you chose is invalid.</p>';

  1034           return;

  1035         }

  1036         $q = $db->sql_query('UPDATE '.table_prefix.'groups SET group_name=\''.$db->escape($_POST['group_name']).'\'

  1037             WHERE group_id='.intval($_POST['group_edit_id']).';');

  1038         if(!$q)

  1039         {

  1040           echo $db->get_error();

  1041           return;

  1042         }

  1043         else

  1044         {

  1045           echo '<div class="info-box" style="margin: 0 0 10px 0;"">

  1046                   The group name has been updated.

  1047                 </div>';

  1048         }

  1049         $name = $_POST['group_name'];

  1050         

  1051       }

  1052       $q = $db->sql_query('SELECT member_id FROM '.table_prefix.'group_members

  1053                              WHERE group_id='.intval($_POST['group_edit_id']).';');

  1054       if(!$q)

  1055       {

  1056         echo $db->get_error();

  1057         return;

  1058       }

  1059       if($db->numrows() > 0)

  1060       {

  1061         while($row = $db->fetchrow($q))

  1062         {

  1063           if(isset($_POST['edit_do']['del_' . $row['member_id']]))

  1064           {

  1065             $e = $db->sql_query('DELETE FROM '.table_prefix.'group_members WHERE member_id='.$row['member_id']);

  1066             if(!$e)

  1067             {

  1068               echo $db->get_error();

  1069               return;

  1070             }

  1071           }

  1072         }

  1073       }

  1074       $db->free_result();

  1075       if(isset($_POST['edit_do']['add_member']))

  1076       {

  1077         $q = $db->sql_query('SELECT user_id FROM '.table_prefix.'users WHERE username=\''.$db->escape($_POST['edit_add_username']).'\';');

  1078         if(!$q)

  1079         {

  1080           echo $db->get_error();

  1081           return;

  1082         }

  1083         if($db->numrows() > 0)

  1084         {

  1085           $row = $db->fetchrow();

  1086           $user_id = $row['user_id'];

  1087           $is_mod = ( isset( $_POST['add_mod'] ) ) ? '1' : '0';

  1088           $q = $db->sql_query('INSERT INTO '.table_prefix.'group_members(group_id,user_id,is_mod) VALUES('.intval($_POST['group_edit_id']).','.$user_id.','.$is_mod.');');

  1089           if(!$q)

  1090           {

  1091             echo $db->get_error();

  1092             return;

  1093           }

  1094           else

  1095           {

  1096             echo '<div class="info-box" style="margin: 0 0 10px 0;"">

  1097                     The user "'.$_POST['edit_add_username'].'" has been added to this usergroup.

  1098                   </div>';

  1099           }

  1100         }

  1101         else

  1102           echo '<div class="warning-box"><b>The user "'.$_POST['edit_add_username'].'" could not be added.</b><br />This username does not exist.</div>';

  1103       }

  1104     }

  1105     $sg_disabled = ( $row['system_group'] == 1 ) ? ' value="Can\'t delete system group" disabled="disabled" style="color: #FF9773" ' : ' value="Delete this group" style="color: #FF3713" ';

  1106     echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';

  1107     echo '<div class="tblholder">

  1108           <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">

  1109           <tr><th>Edit group name</th></tr>

  1110           <tr>

  1111             <td class="row1">

  1112               Group name: <input type="text" name="group_name" value="'.$name.'" />

  1113             </td>

  1114           </tr>

  1115           <tr>

  1116             <th class="subhead">

  1117               <input type="submit" name="edit_do[save_name]" value="Save name" />

  1118               <input type="submit" name="edit_do[del_group]" '.$sg_disabled.' />

  1119             </th>

  1120           </tr>

  1121           </table>

  1122           </div>

  1123           <input type="hidden" name="group_edit_id" value="'.$_POST['group_edit_id'].'" />';

  1124     echo '</form>';

  1125     echo '<form action="'.makeUrl($paths->nslist['Special'].'Administration', 'module='.$paths->cpage['module']).'" method="post" onsubmit="if(!submitAuthorized) return false;" enctype="multipart/form-data">';

  1126     echo '<div class="tblholder">

  1127           <table border="0" style="width:100%;" cellspacing="1" cellpadding="4">

  1128           <tr><th colspan="3">Edit group members</th></tr>';

  1129     $q = $db->sql_query('SELECT m.member_id,m.is_mod,u.username FROM '.table_prefix.'group_members AS m

  1130                            LEFT JOIN '.table_prefix.'users AS u

  1131                              ON u.user_id=m.user_id

  1132                              WHERE m.group_id='.intval($_POST['group_edit_id']).'

  1133                            ORDER BY m.is_mod DESC, u.username ASC;');

  1134     if(!$q)

  1135     {