<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

function page_Admin_UserManager()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $lang;

  if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN )

  {

    $login_link = makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true);

    echo '<h3>' . $lang->get('adm_err_not_auth_title') . '</h3>';

    echo '<p>' . $lang->get('adm_err_not_auth_body', array( 'login_link' => $login_link )) . '</p>';

    return;

  }

  require_once(ENANO_ROOT . '/includes/math.php');

  require_once(ENANO_ROOT . '/includes/diffiehellman.php');

  $GLOBALS['dh_supported'] = $dh_supported;

  //die('<pre>' . htmlspecialchars(print_r($_POST, true)) . '</pre>');

  if ( isset($_POST['action']['save']) )

  {

    #

    # BEGIN VALIDATION

    #

    $errors = array();

    if ( defined('ENANO_DEMO_MODE') )

    {

      $errors[] = $lang->get('acpum_err_nosave_demo');

    }

    $user_id = intval($_POST['user_id']);

    if ( empty($user_id) || $user_id == 1 )

      $errors[] = 'Invalid user ID.';

    if ( isset($_POST['delete_account']) && count($errors) < 1 )

    {

      $q = $db->sql_query('DELETE FROM '.table_prefix."users_extra WHERE user_id=$user_id;");

      if ( !$q )

        $db->_die();

      $q = $db->sql_query('DELETE FROM '.table_prefix."users WHERE user_id=$user_id;");

      if ( !$q )

        $db->_die();

      $q = $db->sql_query('DELETE FROM '.table_prefix."session_keys WHERE user_id=$user_id;");

      if ( !$q )

        $db->_die();

      echo '<div class="info-box">' . $lang->get('acpum_msg_delete_success') . '</div>';

      // deleting own account?

      if ( $user_id === $session->user_id )

      {

        // cute little hack to boot them out of the admin panel

        echo '<script type="text/javascript">

          addOnloadHook(function()

          {

            setTimeout(function()

            {

              eraseCookie("sid");

              ENANO_SID = false;

              auth_level = USER_LEVEL_MEMBER;

              window.location = makeUrlNS("Special", "Login");

            }, 3000);

          });

        </script>';

      }

    }

    else

    {

      if ( $session->user_id == $user_id )

      {

        $username = $session->username;

        $password = false;

        $email = $session->email;

        $real_name = $session->real_name;

      }

      else

      {

        $username = $_POST['username'];

        if ( !preg_match('#^'.$session->valid_username.'$#', $username) )

          $errors[] = $lang->get('acpum_err_illegal_username');

        $password = false;

        if ( $_POST['changing_pw'] == 'yes' )

        {

          $password = $session->get_aes_post('new_password');

        }

        $email = $_POST['email'];

        if ( !preg_match('/^(?:[\w\d]+\.?)+@((?:(?:[\w\d]\-?)+\.)+\w{2,4}|localhost)$/', $email) )

          $errors[] = $lang->get('acpum_err_illegal_email');

        $real_name = $_POST['real_name'];

      }

      $signature = RenderMan::preprocess_text($_POST['signature'], true, false);

      $user_level = intval($_POST['user_level']);

      if ( $user_level < USER_LEVEL_MEMBER || $user_level > USER_LEVEL_ADMIN )

        $errors[] = 'Invalid user level';

      $user_rank = $_POST['user_rank'];

      if ( $user_rank !== 'NULL' )

      {

        $user_rank = intval($user_rank);

        if ( !$user_rank )

          $errors[] = 'Invalid user rank';

      }

      $imaddr_aim = htmlspecialchars($_POST['imaddr_aim']);

      $imaddr_msn = htmlspecialchars($_POST['imaddr_msn']);

      $imaddr_yahoo = htmlspecialchars($_POST['imaddr_yahoo']);

      $imaddr_xmpp = htmlspecialchars($_POST['imaddr_xmpp']);

      $homepage = htmlspecialchars($_POST['homepage']);

      $location = htmlspecialchars($_POST['location']);

      $occupation = htmlspecialchars($_POST['occupation']);

      $hobbies = htmlspecialchars($_POST['hobbies']);

      $email_public = ( isset($_POST['email_public']) ) ? '1' : '0';

      $user_title = htmlspecialchars($_POST['user_title']);

      if ( !preg_match('/@([a-z0-9-]+)(\.([a-z0-9-\.]+))?/', $imaddr_msn) && !empty($imaddr_msn) )

      {

        $imaddr_msn = "$imaddr_msn@hotmail.com";

      }

      if ( !preg_match('#^https?://#', $homepage) )

      {

        $homepage = "http://$homepage";

      }

      if ( !preg_match('/^http:\/\/([a-z0-9-.]+)([A-z0-9@#\$%\&:;<>,\.\?=\+\(\)\[\]_\/\\\\]*?)$/i', $homepage) )

      {

        $homepage = '';

      }

      // true for quiet operation

      list(, , $avatar_post_fail) = avatar_post($user_id, true);

      if ( count($errors) < 1 && !$avatar_post_fail )

      {

        $q = $db->sql_query('SELECT u.user_level, u.user_has_avatar, u.avatar_type, u.username FROM '.table_prefix.'users AS u WHERE u.user_id = ' . $user_id . ';');

        if ( !$q )

          $db->_die();

        if ( $db->numrows() < 1 )

        {

          echo 'Couldn\'t select user data: no rows returned';

        }

        $row = $db->fetchrow();

        $existing_level =& $row['user_level'];

        $avi_type =& $row['avatar_type'];

        $has_avi = ( $row['user_has_avatar'] == 1 );

        $old_username = $row['username'];

        $db->free_result();

        $to_update_users = array();

        if ( $user_id != $session->user_id )

        {

          $to_update_users['username'] = $username;

          if ( $password )

          {

            $session->set_password($user_id, $password);

          }

          $to_update_users['email'] = $email;

          $to_update_users['real_name'] = $real_name;

        }

        $to_update_users['signature'] = $signature;

        $to_update_users['user_level'] = $user_level;

        $to_update_users['user_rank'] = $user_rank;

        $to_update_users['user_title'] = $user_title;

        if ( $user_rank > 0 )

        {

          $to_update_users['user_rank_userset'] = '0';

        }

        if ( isset($_POST['account_active']) )

        {

          $to_update_users['account_active'] = "1";

        }

        else

        {

          $to_update_users['account_active'] = "0";

          $to_update_users['activation_key'] = sha1($session->dss_rand());

        }

        if ( count($errors) < 1 )

        {

          $to_update_users_extra = array();

          $to_update_users_extra['user_aim'] = $imaddr_aim;

          $to_update_users_extra['user_msn'] = $imaddr_msn;

          $to_update_users_extra['user_yahoo'] = $imaddr_yahoo;

          $to_update_users_extra['user_xmpp'] = $imaddr_xmpp;

          $to_update_users_extra['user_homepage'] = $homepage;

          $to_update_users_extra['user_location'] = $location;

          $to_update_users_extra['user_job'] = $occupation;

          $to_update_users_extra['user_hobbies'] = $hobbies;

          $to_update_users_extra['email_public'] = ( $email_public ) ? '1' : '0';

          $update_sql = '';

          foreach ( $to_update_users as $key => $unused_crap )

          {

            $value =& $to_update_users[$key];

            if ( $value !== 'NULL' )

              $value = "'" . $db->escape($value) . "'";

            $update_sql .= ( empty($update_sql) ? '' : ',' ) . "$key=$value";

          }

          $update_sql = 'UPDATE ' . table_prefix . "users SET $update_sql WHERE user_id=$user_id;";

          $update_sql_extra = '';

          foreach ( $to_update_users_extra as $key => $unused_crap )

          {

            $value =& $to_update_users_extra[$key];

            $value = $db->escape($value);

            $update_sql_extra .= ( empty($update_sql_extra) ? '' : ',' ) . "$key='$value'";

          }

          $update_sql_extra = 'UPDATE '.table_prefix."users_extra SET $update_sql_extra WHERE user_id=$user_id;";

          if ( !$db->sql_query($update_sql) )

            $db->_die();

          if ( !$db->sql_query($update_sql_extra) )

            $db->_die();

          // If the username was changed, we need to update their user page as well

          if ( $old_username != $username )

          {

            $page = new PageProcessor($old_username, 'User');

            if ( $page->exists() )

            {

              // they have a user page, rename it

              $old_urlname = $db->escape(sanitize_page_id($old_username));

              $new_urlname = $db->escape(sanitize_page_id($username));

              $sql = array(

                      'UPDATE ' . table_prefix . "pages      SET urlname = '$new_urlname' WHERE urlname = '$old_urlname' AND namespace = 'User';",

                      // Change the page's title ONLY if it exactly matches the old username

                      'UPDATE ' . table_prefix . "pages      SET name = '" . $db->escape($username) . "' WHERE urlname = '$new_urlname' AND name = '" . $db->escape($old_username) . "' AND namespace = 'User';",

                      'UPDATE ' . table_prefix . "logs       SET page_id = '$new_urlname' WHERE page_id = '$old_urlname' AND namespace = 'User';",

                      'UPDATE ' . table_prefix . "tags       SET page_id = '$new_urlname' WHERE page_id = '$old_urlname' AND namespace = 'User';",

                      'UPDATE ' . table_prefix . "comments   SET page_id = '$new_urlname' WHERE page_id = '$old_urlname' AND namespace = 'User';",

                      'UPDATE ' . table_prefix . "page_text  SET page_id = '$new_urlname' WHERE page_id = '$old_urlname' AND namespace = 'User';",

                      'UPDATE ' . table_prefix . "categories SET page_id = '$new_urlname' WHERE page_id = '$old_urlname' AND namespace = 'User';"

                    );

              foreach ( $sql as $q )

              {

                if ( !$db->sql_query($q) )

                  $db->_die('UserManager renaming user page post-username change');

              }

            }

          }

          if ( $existing_level != $user_level )

          {

            // We need to update group memberships

            if ( $existing_level == USER_LEVEL_ADMIN ) 

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,author_uid,page_text) VALUES(\'security\',\'u_from_admin\',' . time() . ', \'' . $db->escape($_SERVER['REMOTE_ADDR']) . '\', ' . $session->user_id . ', \'' . $db->escape($session->username) . '\', \'' . $db->escape($username) . '\');');

              if ( !$q )

                $db->_die();

              $session->remove_user_from_group($user_id, GROUP_ID_ADMIN);

            }

            else if ( $existing_level == USER_LEVEL_MOD ) 

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,author_uid,page_text) VALUES(\'security\',\'u_from_mod\',' . time() . ', \'' . $db->escape($_SERVER['REMOTE_ADDR']) . '\', ' . $session->user_id . ', \'' . $db->escape($session->username) . '\', \'' . $db->escape($username) . '\');');

              if ( !$q )

                $db->_die();

              $session->remove_user_from_group($user_id, GROUP_ID_MOD);

            }

            if ( $user_level == USER_LEVEL_ADMIN )

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,author_uid,page_text) VALUES(\'security\',\'u_to_admin\',' . time() . ', \'' . $db->escape($_SERVER['REMOTE_ADDR']) . '\', ' . $session->user_id . ', \'' . $db->escape($session->username) . '\', \'' . $db->escape($username) . '\');');

              if ( !$q )

                $db->_die();

              $session->add_user_to_group($user_id, GROUP_ID_ADMIN, false);

            }

            else if ( $user_level == USER_LEVEL_MOD )

            {

              $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,author_uid,page_text) VALUES(\'security\',\'u_to_mod\',' . time() . ', \'' . $db->escape($_SERVER['REMOTE_ADDR']) . '\', ' . $session->user_id . ', \'' . $db->escape($session->username) . '\', \'' . $db->escape($username) . '\');');

              if ( !$q )

                $db->_die();

              $session->add_user_to_group($user_id, GROUP_ID_MOD, false);

            }

          }

          // user level updated, regenerate the ranks cache

          generate_cache_userranks();

          echo '<div class="info-box">' . $lang->get('acpum_msg_save_success') . '</div>';

        }

      }

    }

    if ( count($errors) > 0 || @$avatar_post_fail )

    {

      if ( count($errors) > 0 )

      {

        echo '<div class="error-box">

                <b>' . $lang->get('acpum_err_validation_fail') . '</b>

                <ul>

                  <li>' . implode("</li>\n        <li>", $errors) . '</li>

                </ul>

              </div>';

      }

      $form = new Admin_UserManager_SmartForm();

      $form->user_id = $user_id;

      $form->username = $username;

      $form->email = $email;

      $form->real_name = $real_name;

      $form->signature = $signature;

      $form->user_level = $user_level;

      $form->user_rank = $user_rank;

      $form->user_title = $user_title;

      $form->im = array(

          'aim' => $imaddr_aim,

          'yahoo' => $imaddr_yahoo,

          'msn' => $imaddr_msn,

          'xmpp' => $imaddr_xmpp

        );

      $form->contact = array(

          'homepage' => $homepage,

          'location' => $location,

          'job' => $occupation,

          'hobbies' => $hobbies

        );

      $form->email_public = ( isset($_POST['email_public']) );

      $form->account_active = ( isset($_POST['account_active']) );

      // This is SAFE. The smartform calls is_valid_ip() on this value, thus preventing XSS

      // attempts from making it into the form HTML. Badly coded templates may still be

      // affected, but if have_reg_ip is checked for, then you're fine.

      $form->reg_ip_addr = $_POST['user_registration_ip'];

      echo $form->render();

      return false;

    }

    #

    # END VALIDATION

    #

  }

  else if ( isset($_POST['action']['go']) || ( isset($_GET['src']) && $_GET['src'] == 'get' ) || ($pathsuser = $paths->getParam(0)) )

  {

    if ( isset($_GET['user']) )

    {

      $username =& $_GET['user'];

    }

    else if ( isset($_GET['username']) )

    {

      $username =& $_GET['username'];

    }

    else if ( isset($_POST['username']) )

    {

      $username =& $_POST['username'];

    }

    else if ( $pathsuser )

    {

      $username = str_replace('_', ' ', dirtify_page_id($pathsuser));

    }

    else

    {

      echo 'No username provided';

      return false;

    }

    $q = $db->sql_query('SELECT u.user_id AS authoritative_uid, u.username, u.email, u.real_name, u.signature, u.account_active, u.user_level, u.user_rank, u.user_title, u.user_has_avatar, u.avatar_type, u.user_registration_ip, x.* FROM '.table_prefix.'users AS u

                           LEFT JOIN '.table_prefix.'users_extra AS x

                             ON ( u.user_id = x.user_id OR x.user_id IS NULL )

                           WHERE ( ' . ENANO_SQLFUNC_LOWERCASE . '(u.username) = \'' . $db->escape(strtolower($username)) . '\' OR u.username = \'' . $db->escape($username) . '\' ) AND u.user_id != 1;');

    if ( !$q )

      $db->_die();

    if ( $db->numrows() < 1 )

    {

      echo '<div class="error-box">' . $lang->get('acpum_err_bad_username') . '</div>';

    }

    else

    {

      $row = $db->fetchrow();

      $row['user_id'] = $row['authoritative_uid'];

      $form = new Admin_UserManager_SmartForm();

      $form->user_id   = $row['user_id'];

      $form->username  = $row['username'];

      $form->email     = $row['email'];

      $form->real_name = $row['real_name'];

      $form->signature = $row['signature'];

      $form->user_level= $row['user_level'];

      $form->user_rank = $row['user_rank'];

      $form->user_title= $row['user_title'];

      $form->account_active = ( $row['account_active'] == 1 );

      $form->email_public   = ( $row['email_public'] == 1 );

      $form->has_avatar     = ( $row['user_has_avatar'] == 1 );

      $form->avi_type       = $row['avatar_type'];

      $form->im = array(

          'aim' => $row['user_aim'],

          'yahoo' => $row['user_yahoo'],

          'msn' => $row['user_msn'],

          'xmpp' => $row['user_xmpp']

        );

      $form->contact = array(

          'homepage' => $row['user_homepage'],

          'location' => $row['user_location'],

          'job'      => $row['user_job'],

          'hobbies'  => $row['user_hobbies'],

        );

      $form->email_public = ( $row['email_public'] == 1 );

      $form->reg_ip_addr = ( $row['user_registration_ip'] ) ? $row['user_registration_ip'] : '';

      $html = $form->render();

      if ( !$html )

      {

        echo 'Internal error: form processor returned false';

      }

      else

      {

        echo $html;

      }

      return true;

    }

  }

  else if ( isset($_POST['action']['clear_sessions']) )

  {

    if ( defined('ENANO_DEMO_MODE') )

    {

      echo '<div class="error-box">' . $lang->get('acpum_err_sessionclear_demo') . '</div>';

    }

    else

    {

      // Get the current session information so the user doesn't get logged out

      $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

      $sk = md5($session->sid_super);

      $qb = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.$sk.'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_ADMIN);

      if ( !$qb )

      {

        die('Error selecting session key info block B: '.$db->get_error());

      }

      if ( $db->numrows($qb) < 1 )

      {

        die('Error: cannot read admin session info block B, aborting table clear process');

      }

      $qa = $db->sql_query('SELECT session_key,salt,auth_level,source_ip,time FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($session->sid).'\' AND user_id='.$session->user_id.' AND auth_level='.USER_LEVEL_MEMBER);

      if ( !$qa )

      {

        die('Error selecting session key info block A: '.$db->get_error());

      }

      if ( $db->numrows($qa) < 1 )

      {

        die('Error: cannot read user session info block A, aborting table clear process');

      }

      $ra = $db->fetchrow($qa);

      $rb = $db->fetchrow($qb);

      $db->free_result($qa);

      $db->free_result($qb);

      $db->sql_query('DELETE FROM '.table_prefix.'session_keys;');

      $db->sql_query('INSERT INTO '.table_prefix.'session_keys( session_key,salt,user_id,auth_level,source_ip,time ) VALUES( \''.$ra['session_key'].'\', \'' . $db->escape($ra['salt']) . '\', \''.$session->user_id.'\', \''.$ra['auth_level'].'\', \''.$ra['source_ip'].'\', '.$ra['time'].' ),( \''.$rb['session_key'].'\', \'' . $db->escape($rb['salt']) . '\', \''.$session->user_id.'\', \''.$rb['auth_level'].'\', \''.$rb['source_ip'].'\', '.$rb['time'].' )');

      echo '<div class="info-box">' . $lang->get('acpum_msg_sessionclear_success') . '</div>';

    }

  }

  echo '<form action="' . makeUrlNS('Special', 'Administration', 'module=' . $paths->cpage['module'], true) . '" method="post" enctype="multipart/form-data" onsubmit="if ( !submitAuthorized ) return false;">';

  echo '<h3>' . $lang->get('acpum_heading_main') . '</h3>';

  echo '<p>' . $lang->get('acpum_hint_intro') . '</p>';

  echo '<table border="0">

          <tr>

            <td><b>' . $lang->get('acpum_field_search_user') . '</b><br />

                <small>' . $lang->get('acpum_field_search_user_hint') . '</small>

                </td>

            <td style="width: 10px;"></td>

            <td>' . $template->username_field('username') . '</td>

            <td>

              <input type="submit" name="action[go]" value="' . $lang->get('acpum_btn_search_user_go') . ' &raquo;" />

            </td>

          </tr>

        </table>';

  echo '<h3>' . $lang->get('acpum_heading_clear_sessions') . '</h3>';

  echo '<p>' . $lang->get('acpum_hint_clear_sessions') . '</p>';

  echo '<p><input type="submit" name="action[clear_sessions]" value="' . $lang->get('acpum_btn_clear_sessions') . '" /></p>';

  echo '</form>';

  if(isset($_GET['action']) && isset($_GET['user']))

  {

    switch($_GET['action'])

    {

      case "activate":

        $e = $db->sql_query('SELECT activation_key FROM '.table_prefix.'users WHERE username=\'' . $db->escape($_GET['user']) . '\'');

        if ( $e )

        {