<?php

require_once 'init.php';

// automatic moderation bydlocode

$auto_moderate = $API->getval('auto_moderate', 'int');

if (!$auto_moderate) {

$API->auth(array('access_acp' => 1));

$API->httpauth();

$action = $API->getval('action');

$trackid = $API->getval('trackid', 'int');

$confirm = $API->getval('confirm', 'int');

$from = $API->getval('from');

$to = $API->getval('to');

$id = $API->getval('id', 'int');

} else {

$no_ajax = $API->getval('no_ajax', 'int');

if (!$API->auth(array('upload_auto_moderate' => 1), true)) {

if (!$no_ajax) {

$API->error($API->LANG->_('Automatic action result') . ': ' . $API->LANG->_('Uploaded, but not published, no permissions'));

}

die('<span style="color:orange;">SUCCESS: Uploaded, but NOT PUBLISHED - NO PERMISSIONS</span>');

}

$action = 'auto_moderate';

$id = $auto_moderate;

}

// dirty fix

if (!$trackid)

$trackid = $id;

if ($action == 'edit') {

$API->auth(array('is_moderator' => 1));

$curlink = $API->DB->query_row("SELECT * FROM links WHERE id=$id");

if (!$curlink) {

$API->error("Error: Invalid link");

}

if ($curlink['state'] == 'pending') {

$check = $API->DB->query_row("SELECT 1 FROM links WHERE added<{$curlink['added']} AND state='pending'");

if ($check) {

$API->error("Error: Please make a decision about all links before this one");

}

}

$link = htmlspecialchars($API->getval('link'));

$state = $API->getval('state');

$reason = htmlspecialchars($API->getval('reason'));

$version = htmlspecialchars($API->getval('version'));

$cracker = htmlspecialchars($API->getval('cracker'));

$protected = ($API->getval('protected','int')?1:0);

if (!in_array($state, explode(',', 'pending,archived,accepted,rejected,reported,dead'))) {

$API->error('Error: Invalid state defined');

}

$to_links['state'] = $state;

$to_links['link'] = $link;

$to_links['editor_id'] = $API->account['id'];

$to_links['version'] = $version;

$to_links['cracker'] = $cracker;

$to_links['protected'] = $protected;

if ($state != 'dead') {

$to_links['state_reason'] = $reason;

} else {

$to_links['state_reason'] = 'Set as dead by moderator';

}

$API->write_log("{$API->account['name']} edited link $link", 'links', $id, var_export($curlink, true), var_export($to_links, true));

if ($state == 'accepted') {

$linkscountversion = $API->DB->get_row_count("links", "WHERE trackid={$curlink['trackid']} AND version={$API->DB->sqlesc($version)} AND state='accepted'");

// check need to update twitter or not

$linkscountarchive = $API->DB->get_row_count("links", "WHERE trackid={$curlink['trackid']} AND state='archived'");

$appdata = $API->DB->query_row("SELECT * FROM apps WHERE trackid={$curlink['trackid']}");

if (!$linkscountversion) {

send_twitter("New App/Book {$appdata['name']} only on AppAddict " . generate_short_link($API->SEO->make_link('view', 'trackid', $curlink['trackid'])), 'updates');

} elseif ($linkscountarchive) {

send_twitter("App/Book {$appdata['name']} has been updated to {$version} " . generate_short_link($API->SEO->make_link('view', 'trackid', $curlink['trackid'])), 'updates');

$appdata['version'] = $version;

send_tracks($appdata);

}

$API->DB->query("UPDATE apps SET added=" . TIME . " WHERE trackid={$curlink['trackid']}");

}

$API->DB->query("UPDATE links SET {$API->DB->build_update_query($to_links)} WHERE id=$id");

$API->CACHE->clearGroupCache('lists_caches');

$API->message('Updated successfully');

} elseif ($action == 'auto_moderate') {

$API->DB->query("UPDATE links SET state='accepted' WHERE trackid=$auto_moderate AND uploader_id={$API->account['id']}");

$API->CACHE->clearGroupCache('lists_caches');

$API->message('Auto moderated successfully');

} elseif ($action == 'loginas') {

$API->auth(array('can_loginas' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$name = $API->getval('aname');

$account = $API->DB->query_row("SELECT * FROM accounts WHERE name={$API->DB->sqlesc($name)} OR email={$API->DB->sqlesc($name)}");

if (!$account)

$API->error('No account with such id or email');

$protected = $API->DB->get_row_count("accounts_configuration", "WHERE account_id={$account['id']} AND name='protected_account'");

if ($protected)

$API->error('You can not log in as protected account');

setcookie('id', $account['id'], $CONFIG['TIME'] + 86400 * 365 * 10);

setcookie('hash', $account['pass_hash'], $CONFIG['TIME'] + 86400 * 365 * 10);

$API->safe_redirect('/', 3);

$API->message("Logged in as ID {$account['id']}: {$account['name']}. Redirecting in 3 seconds");

die();

} else {

$API->TPL->display('acp-loginas.tpl');

}

} elseif ($action == 'filehostings') {

$API->auth(array('manage_filehostings' => 1));

$API->error('Under construction');

} elseif ($action == 'bitcoin') {

$API->auth(array('bitcoin' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$_BTC_PURCHASE_SALT = 'fsfhi3o2hof_BTC_AA';

$mode = $API->getval('mode');

if ($mode == 'check') {

if ($API->DB->get_row_count("premium_purchases", "WHERE uuid={$API->DB->sqlesc(md5($_BTC_PURCHASE_SALT . $API->getval('txid') . $_BTC_PURCHASE_SALT))}")) {

$API->message('THERE IS SUCH TRANSACTION', 'DO NOT PROVIDE PREMIUM TO USER');

} else {

$API->message("There is no such transaction", "It's okay to add premium to user");

}

} elseif ($mode == 'register') {

$name = $API->getval('aname');

$id = $API->getval('id', 'int');

if (!$name)

$API->error('Account name or email required');

$account = $API->DB->query_row("SELECT id,premium_expired FROM accounts WHERE " . ($id ? "id=$id" : "name={$API->DB->sqlesc($name)} OR email={$API->DB->sqlesc($name)}"));

if (!$account)

$API->error('No account with such username or email');

$to_db['uuid'] = md5($_BTC_PURCHASE_SALT . $API->getval('txid') . $_BTC_PURCHASE_SALT);

$to_db['account_id'] = $account['id'];

$to_db['status'] = 'ok';

$days = $API->getval('days', 'int');

$time_to_add = $days * 86400;

$to_db['time_purchased'] = $time_to_add;

$to_db['added'] = TIME;

$API->DB->query("INSERT INTO premium_purchases {$API->DB->build_insert_query($to_db)}");

$result = $API->DB->mysql_insert_id();

if ($result) {

if ($account['premium_expired'] > TIME) {

$current_premium = $account['premium_expired'];

} else {

$account['premium_expired'] = TIME;

}

$time_to_add = $account['premium_expired'] + $time_to_add;

$API->DB->query("UPDATE accounts SET premium_expired={$time_to_add} WHERE id={$account['id']}");

$API->message("Transaction registered successfully", "User has been granted premium access for $days days");

} else {

$API->error('Error: transaction not registered (maybe it was registered before?)');

}

}

}

$API->message('Check/register BTC transaction:<form method="post"><input type="text" name="txid" placeholder="TXID" size="40"/><br/><input type="text" name="aname" placeholder="user name or email (required only for registration)" size="40"/> or id <input name="id" type="text"/><br/>days paid (required only for registration):<input type="text" name="days" size="3"/><br/><input type="submit" name="mode" value="check"/> or <input type="submit" name="mode" value="register"/></form>');

} elseif ($action == 'bans') {

$mode = $API->getval('mode');

if (!$mode) {

$API->auth(array('view_bans' => 1));

} elseif ($mode == 'ban') {

$API->auth(array('can_ban' => 1));

$name = $API->getval('aname');

$id = $API->getval('id', 'int');

$reason = htmlspecialchars($API->getval('reason'));

if (!$reason)

$API->error('No reason provided');

$account = $API->DB->query_row("SELECT id FROM accounts WHERE " . ($id ? "id=$id" : "name={$API->DB->sqlesc($name)} OR email={$API->DB->sqlesc($name)}"));

if (!$account)

$API->error('No account with such username or email');

$protected = $API->DB->get_row_count("accounts_configuration", "WHERE account_id={$account['id']} AND name='protected_account'");

if ($protected)

$API->error('You can not ban protected account');

$to_accounts['ban_reason'] = $reason;

$API->DB->query("UPDATE accounts SET {$API->DB->build_update_query($to_accounts)} WHERE id={$account['id']}");

$API->write_log("{$API->account['name']} banned $name for $reason", 'admincp_bans', $account['id']);

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'bans'), 1);

$API->message('Account was successfully banned');

} elseif ($mode == 'unban') {

$API->auth(array('can_unban' => 1));

$API->DB->query("UPDATE accounts SET ban_reason=NULL WHERE id=$id");

$API->write_log("{$API->account['name']} unbanned user with id $id", 'admincp_bans', $id);

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'bans'), 1);

$API->message('Account was successfully enabled');

}

$bans = $API->DB->query_return("SELECT id,name,email,ban_reason FROM accounts WHERE ban_reason!=''");

$API->TPL->assign('bans', $bans);

$API->TPL->display('acp-bans.tpl');

die();

} elseif ($action == 'resetpassword') {

$API->auth(array('manage_passwords' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$name = $API->getval('aname');

$account = $API->DB->query_row("SELECT id,name FROM accounts WHERE name={$API->DB->sqlesc($name)} OR email={$API->DB->sqlesc($name)}");

if (!$account)

$API->error('No account with such username or email');

$protected = $API->DB->get_row_count("accounts_configuration", "WHERE account_id={$account['id']} AND name='protected_account'");

if ($protected)

$API->error('You can not reset password for protected account');

$password = $API->mkpassword();

$to_db['pass_salt'] = $API->mksecret();

$to_db['reset_hash'] = $API->mkpasshash($password, $to_db['pass_salt']);

$API->DB->query("UPDATE accounts SET " . $API->DB->build_update_query($to_db) . " WHERE id={$account['id']}");

$API->TPL->assign('reset_password', "Please email user this password <u>$password</u> and this activation link: <u>{$API->SEO->make_link('iforgot', 'activate', $to_db['reset_hash'])}</u>");

$API->write_log("{$API->account['name']} generated new password for {$account['name']} ({$account['email']})", 'admincp_passwords', $account['id']);

}

$API->TPL->display('acp-resetpassword.tpl');

die();

} elseif ($action == 'privs') {

$API->auth(array('manage_privs' => 1));

$mode = $API->getval('mode');

if ($mode == 'delete') {

$API->DB->query("DELETE FROM accounts_configuration WHERE account_id=$id");

$API->TPL->assign('message', 'Privileges revoked');

$API->write_log("{$API->account['name']} revoked all priveleges from account with id $id", 'admincp_privs', $id);

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'privs'), 1);

$API->TPL->display('message.tpl');

die();

} elseif ($mode == 'add') {

$name = $API->getval('aname');

$check = $API->DB->query_row("SELECT id,name FROM accounts WHERE name=" . $API->DB->sqlesc($name));

if (!$check)

$API->error('No account with such username');

$to_privs['name'] = htmlspecialchars(trim($API->getval('name')));

$to_privs['value'] = $API->getval('value', 'int');

if (!$to_privs['name'] || !$to_privs['value'])

$API->error('Missing form data');

$to_privs['account_id'] = $check['id'];

$API->DB->query("INSERT INTO accounts_configuration {$API->DB->build_insert_query($to_privs)} ON DUPLICATE KEY UPDATE {$API->DB->build_update_query($to_privs)}");

$API->write_log("{$API->account['name']} added privelege {$to_privs['name']}={$to_privs['value']} to account with id {$to_privs['account_id']}", 'admincp_privs', $to_privs['account_id']);

$API->TPL->assign('message', 'Privilege added');

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'privs'), 1);

$API->TPL->display('message.tpl');

die();

} elseif ($mode == 'save') {

$data = json_decode($API->getval('data'), true);

if (!$data)

die('Failed to set priveleges');

$API->DB->query("DELETE FROM accounts_configuration WHERE account_id=$id");

foreach ($data as $p) {

$to_privs['name'] = htmlspecialchars((string) $p['name']);

$to_privs['value'] = intval($p['value']);

$to_privs['account_id'] = $id;

$API->DB->query("INSERT INTO accounts_configuration {$API->DB->build_insert_query($to_privs)} ON DUPLICATE KEY UPDATE {$API->DB->build_update_query($to_privs)}");

}

$before = $API->DB->query_return("SELECT * FROM accounts_configuration WHERE account_id=$id");

$API->write_log("{$API->account['name']} edited privileges for account with id $id", 'admincp_privs', $id, $before, $data);

die('priveleges saved');

}

$privs = $API->DB->query_return("SELECT accounts_configuration.*,accounts.name AS aname,accounts.email FROM accounts_configuration LEFT JOIN accounts ON accounts_configuration.account_id=accounts.id");

if ($privs) {

foreach ($privs as $p) {

$pd[$p['account_id']]['name'] = $p['aname'];

$pd[$p['account_id']]['email'] = $p['email'];

$pd[$p['account_id']]['privs'][] = array('name' => $p['name'], 'value' => $p['value']);

}

$API->TPL->assign('privs', $pd);

}

$API->TPL->display('acp-privs.tpl');

die();

} elseif ($action == 'lang') {

$API->auth(array('manage_langs' => 1));

$mode = htmlspecialchars($API->getval('mode'));

$API->TPL->assign('mode', $mode);

if ($mode == 'export') {

$lang_export = substr(trim($API->getval('lang_export')), 0, 2);

$API->TPL->assign('lang_export', $lang_export);

if ($lang_export) {

$check = $API->DB->get_row_count('languages', 'WHERE ltranslate=' . $API->DB->sqlesc($lang_export));

if (!$check)

$API->error("No language with this code");

$API->LANG->export_langfile($lang_export, $API->getval('as_php'));

die();

} else {

$langs = $API->DB->query_return('SELECT ltranslate FROM languages GROUP BY ltranslate');

$API->TPL->assign('langs', $langs);

//$API->TPL->display('acp-language.tpl');

//die();

}

} elseif ($mode == 'import') {

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$lang = htmlspecialchars(substr(trim($API->getval('language')), 0, 2));

$f = $_FILES["langfile"];

if (!is_uploaded_file($f["tmp_name"]) || !filesize($f["tmp_name"])) {

$API->error('File upload error or file size 0 bytes');

}

$result = $API->LANG->import_langfile($f["tmp_name"], $lang, $_POST['override']);

if ($result['errors']) {

$status['errors'] = implode('<br/>', $result['errors']);

}

if ($result['words']) {

$status['ok'] = implode('<br/>', $result['words']);

}

$API->TPL->assign('result', $result);

$API->CACHE->clearCache('languages', $lang);

}

} elseif ($mode == 'editor') {

$langs = $API->DB->query_return("SELECT ltranslate FROM languages GROUP BY ltranslate");

$API->TPL->assign('langs', $langs);

$do = $API->getval('do');

if (!$do) {

$query = array();

$searchkey = $API->getval('searchkey');

$searchvalue = $API->getval('searchvalue');

if ($searchkey)

$query[] = "lkey LIKE " . $API->DB->sqlwildcardesc($searchkey);

if ($searchvalue)

$query[] = "lvalue LIKE " . $API->DB->sqlwildcardesc($searchvalue);

$searchkey = htmlspecialchars($searchkey);

$searchvalue = htmlspecialchars($searchvalue);

$API->TPL->assign('searchkey', $searchkey);

$API->TPL->assign('searchvalue', $searchvalue);

if ($query)

$query = ' WHERE ' . implode(' AND ', $query);

else

$query = NULL;

//$count = $API->DB->get_row_count('languages', $query);

list($limit, $pagercode) = $API->generate_pagination($count, array('acp', 'action', 'lang', 'mode', 'editor', 'searchkey', $searchkey, 'searchvalue', $searchvalue), 25);

$API->TPL->assign('pagercode', $pagercode);

$API->TPL->assign('data', $API->DB->query_return("SELECT * FROM languages$query ORDER BY lkey DESC $limit"));

} elseif ($do == 'saveadd') {

$lang = array_map("strval", $API->getval('word', 'array'));

$key = trim($API->getval('key'));

if (!$lang || !$key) {

$API->error('Missing form data');

}

foreach ($lang as $l => $word) {

$word = (trim((string) $word));

if ($word) {

$l = substr($l, 0, 2);

$API->DB->query("INSERT INTO languages (lkey,ltranslate,lvalue) VALUES (" . $API->DB->sqlesc($key) . "," . $API->DB->sqlesc($l) . "," . $API->DB->sqlesc($word) . ")");

if ($API->DB->mysql_errno() == 1062) {

$errors .= 'REDECLARATED KEY:"' . $key . '"<br/>';

}

$okays .= "$l: $key : $word<br/>";

}

}

$API->CACHE->clearGroupCache('languages');

//$API->safe_redirect($API->SEO->make_link('acp', 'action', 'lang', 'mode', 'editor'), );

$API->TPL->assign('message', "Added: $okays");

$API->TPL->assign('warning', "Errors: $errors");

$API->TPL->display('message.tpl');

die();

} elseif ($do == 'gensave') {

$keys = $API->getval('key', 'array');

$vals = $API->getval('val', 'array');

foreach ($keys as $key => $chkey) {

if (is_array($chkey)) {

foreach ($chkey as $lang => $keyvalue) {

$lang = substr(trim($lang), 0, 2);

$query_result = $API->DB->query("UPDATE languages SET lkey=" . $API->DB->sqlesc($keyvalue) . ", lvalue=" . $API->DB->sqlesc($vals[$key][$lang]) . " WHERE lkey=" . $API->DB->sqlesc($key) . " AND ltranslate = " . $API->DB->sqlesc($lang));

$error_info = $query_result->errorInfo();

if ($error_info[1] == 1062)

$fail[] = ($key <> $keyvalue ? "{$key}-&gt;{$keyvalue}" : $key) . " : {$vals[$key][$lang]}";

else

$success[] = ($key <> $keyvalue ? "{$key}-&gt;{$keyvalue}" : $key) . " : {$vals[$key][$lang]}";

}

}

}

if ($fail)

$errors = implode("<br/>", $fail);

if ($success)

$okays = implode("<br/>", $success);

$API->CACHE->clearGroupCache('languages');

$API->TPL->assign('message', "Okays: $okays");

$API->TPL->assign('warning', "Errors: $errors");

$API->TPL->display('message.tpl');

die();

} elseif ($do == 'delete') {

$lang = $API->DB->sqlesc(substr(trim($API->getval('language')), 0, 2));

$key = $API->DB->sqlesc((trim($API->getval('key'))));

$API->DB->query("DELETE FROM languages WHERE lkey=$key AND ltranslate=$lang");

$API->CACHE->clearCache('languages', $lang);

die('Successfully deleted');

}

} elseif ($mode == 'clearcache') {

$API->CACHE->clearGroupCache('languages');

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'lang'), 1);

$API->TPL->assign('message', "Language cache cleared. Redirecting you back in 1 second");

$API->TPL->display('message.tpl');

die();

}

$API->TPL->display('acp-language.tpl');

die();

} elseif ($action == 'reparse_itunes_errors') {

$API->auth(array('reparse_itunes_errors' => 1));

if (!$trackid) {

$API->TPL->assign('progress_image', $API->DB->query_return("SELECT trackid FROM apps WHERE itunes_parse_error=1"));

$API->TPL->display('acp-reparse-itunes-errors.tpl');

die();

} else {

//header('Content-Type: image/png');

$app = $API->DB->query_row("SELECT trackid,type,store FROM apps WHERE trackid=$trackid");

if (!$app) {

die('<span style="color:red;">ERROR: Missing app with trackid $trackid</span>');

}

require_once 'itgw.inc.php';

$data = get_itunes_info($app['trackid'], $app['type'], $app['store']);

if (!$data) {

die("<span style=\"color:red;\">ERROR: Can not find app with trackid {$app['trackid']} on store {$app['store']}");

}

$to_app['last_parse_itunes'] = json_encode($data);

$to_app['itunes_parse_error'] = '0';

$API->DB->query("UPDATE apps SET " . $API->DB->build_update_query($to_app) . " WHERE trackid={$app['trackid']}");

die("<span style=\"color:green;\">SUCCESS: '{$data['name']}' reparsed");

}

} elseif ($action == 'crackers') {

$API->auth(array('manage_crackers' => 1));

$section = $API->getval('section');

if (!in_array($section, explode(',', 'verified,proposed')))

$section = 'verified';

$mode = $API->getval('mode');

if ($mode == 'move') {

$to = $API->getval('to');

$from = $API->getval('from');

if (!in_array($to, explode(',', 'verified,proposed')) || !in_array($from, explode(',', 'verified,proposed')) || $to == $from)

$API->error('Invalid "to/from" arguments');

$check = $API->DB->query_row("SELECT {$from}_crackers.*,accounts.email FROM {$from}_crackers LEFT JOIN accounts ON {$from}_crackers.account_id=accounts.id WHERE account_id=$id");

if (!$check)

$API->error('No user with this ID');

$email = $check['email'];

unset($check['email']);

$pushes = $API->DB->query_row("SELECT GROUP_CONCAT(udid) AS udids FROM push WHERE account_id=$id");

if ($from == 'proposed') {

send_push_safari($API->LANG->_to($id, "Notification"), $API->LANG->_to($id, "Your verification proposal has been accepted"), $CONFIG['defaultbaseurl'], $id);

if ($pushes['udids']) {

send_push($API->LANG->_to($id, "Your verification proposal has been accepted"), 0, '', $pushes['udids']);

}

$body = "{$API->LANG->_to($id, 'Hello')}!<br/>

<strong>{$API->LANG->_to($id, 'Congratulations! Now you are verified cracker!')}</strong>

<br/><br/>

{$API->LANG->_to($id, 'You can view your public profile by visiting this link')}: {$API->SEO->make_link('crackers', 'id', $id)}<br/><br/>

<br/>

--<br/>

{$API->LANG->_to($id, 'Best regards, team of')} {$CONFIG['sitename']}.";

$API->send_mail($email, $CONFIG['sitename'], $CONFIG['siteemail'], $API->LANG->_to($id, "Your verification proposal has been accepted"), $body, true);

} elseif ($from == 'verified') {

$reason = htmlspecialchars($API->getval('reason'));

if (!$reason) {

$API->error('No reason - can not move');

}

send_push_safari($API->LANG->_to($id, "Notification"), $API->LANG->_to($id, "Your verified cracker status has been revoked"), $CONFIG['defaultbaseurl'], $id);

if ($pushes['udids']) {

send_push($API->LANG->_to($id, "Your verified cracker status has been revoked"), 0, '', $pushes['udids']);

}

$body = "{$API->LANG->_to($id, 'Hello')}!<br/>

<strong>{$API->LANG->_to($id, 'Your verified cracker status has been revoked')}</strong><br/>

{$API->LANG->_to($id, 'Moderator provided the following reason')}:<br/>

<strong>{$reason}</strong>

<br/><br/>

{$API->LANG->_to($id, 'CONTACT_ADMIN_TO_RESOLVE', $CONFIG['adminemail'])}<br/><br/>

--<br/>

{$API->LANG->_to($id, 'Best regards, team of')} {$CONFIG['sitename']}.";

$API->send_mail($email, $CONFIG['sitename'], $CONFIG['siteemail'], $API->LANG->_to($id, "Your verified cracker status has been revoked"), $body, true);

}

$API->DB->query("INSERT INTO {$to}_crackers " . $API->DB->build_insert_query($check) . " ON DUPLICATE KEY UPDATE " . $API->DB->build_update_query($check));

$API->DB->query("DELETE FROM {$from}_crackers WHERE account_id=$id");

$API->write_log("{$API->account['name']} moved cracker with account id $id from $from to $to", 'admincp_crackers', $id);

$API->TPL->assign('message', "Cracker moved from $from to $to");

$API->TPL->display('message.tpl');

die();

} elseif ($mode == 'check') {

$name = htmlspecialchars($API->getval('name'));

$check = $API->DB->query_row("SELECT id,name FROM accounts WHERE name=" . $API->DB->sqlesc($name));

if (!$check)

die('No account with such name');

$data = $API->DB->query_row("SELECT (SELECT COUNT(DISTINCT trackid) FROM links WHERE uploader_id={$check['id']}) AS uploaded, (SELECT COUNT(DISTINCT trackid) FROM links WHERE uploader_id={$check['id']} AND cracker={$API->DB->sqlesc($check['name'])}) AS cracked");

$uploaded = $data['uploaded'];

$cracked = $data['cracked'];

die("Uploaded $uploaded apps, cracked $cracked apps!");

} elseif ($mode == 'delete') {

$reason = htmlspecialchars($API->getval('reason'));

if (!$reason)

$API->error('No reason - can not delete');

$check = $API->DB->query_row("SELECT {$section}_crackers.*,accounts.email FROM {$section}_crackers LEFT JOIN accounts ON {$section}_crackers.account_id=accounts.id WHERE account_id=$id");

if (!$check)

$API->error('No user with this ID');

$email = $check['email'];

unset($check['email']);

$pushes = $API->DB->query_row("SELECT GROUP_CONCAT(udid) AS udids FROM push WHERE account_id=$id");

send_push_safari($API->LANG->_to($id, "Notification"), $API->LANG->_to($id, "Your verification has been rejected"), $CONFIG['defaultbaseurl'], $id);

if ($pushes['udids']) {

send_push("{$API->LANG->_to($id, "Your verification has been rejected")}, {$API->LANG->_to($id, "check your email")}", 0, '', $pushes['udids']);

}

$body = "{$API->LANG->_to($id, 'Hello')}!<br/>

<strong>{$API->LANG->_to($id, 'Your verification has been rejected')}</strong><br/>

{$API->LANG->_to($id, 'Moderator provided the following reason')}:<br/>

<strong>{$reason}</strong>

<br/><br/>

{$API->LANG->_to($id, 'Please fix the issue and submit your proposal again')}<br/><br/>

--<br/>

{$API->LANG->_to($id, 'Best regards, team of')} {$CONFIG['sitename']}.";

$API->send_mail($email, $CONFIG['sitename'], $CONFIG['siteemail'], $API->LANG->_to($id, "Your verification has been rejected"), $body, true);

$API->DB->query("DELETE FROM {$section}_crackers WHERE account_id=$id");

$API->write_log("{$API->account['name']} deleted cracker with account id $id from $section (rejected proposal if from proposed)", 'admincp_crackers', $id);

$API->TPL->assign('message', 'Cracker deleted from ' . $section);

$API->TPL->display('message.tpl');

die();

}

$API->TPL->assign('section', $section);

$crackers = $API->DB->query_return("SELECT {$section}_crackers.*,accounts.name, COUNT(DISTINCT trackid) AS numapps FROM {$section}_crackers LEFT JOIN accounts ON {$section}_crackers.account_id=accounts.id LEFT JOIN links ON {$section}_crackers.account_id=links.uploader_id AND accounts.name=links.cracker GROUP BY {$section}_crackers.account_id ORDER BY numapps DESC");

$API->TPL->assign('crackers', $crackers);

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$name = htmlspecialchars($API->getval('name'));

$check = $API->DB->query_row("SELECT id FROM accounts WHERE name=" . $API->DB->sqlesc($name));

if (!$check)

$API->error('No account with such name');

$id = $check['id'];

$to_db = array('account_id' => $id,

'avatar' => htmlspecialchars(trim($API->getval('avatar'))),

'background' => htmlspecialchars(trim($API->getval('background'))),

'slogan' => htmlspecialchars(trim($API->getval('slogan'))),

'story' => trim($API->getval('story')));

$before = $API->DB->query_row("SELECT account_id,avatar,background,slogan,story FROM {$section}_crackers WHERE account_id=$id");

$API->DB->query("INSERT INTO {$section}_crackers " . $API->DB->build_insert_query($to_db) . " ON DUPLICATE KEY UPDATE " . $API->DB->build_update_query($to_db));

if ($before != $to_db)

$API->write_log("{$API->account['name']} edited cracker with account id $id", 'admincp_crackers', $id, $before, $to_db);

$API->TPL->assign('message', 'Changes saved');

$API->TPL->display('message.tpl');

die();

}

if ($id) {

$API->TPL->assign('cracker', $API->DB->query_row("SELECT verified_crackers.*, accounts.name FROM verified_crackers LEFT JOIN accounts ON verified_crackers.account_id=accounts.id WHERE account_id=$id"));

}

$API->TPL->display('acp-crackers.tpl');

die();

} elseif ($action == 'clearcache') {

$API->auth(array('clear_cache' => 1));

$API->CACHE->clearAllCache();

$API->TPL->assign('message', 'Caches cleared. You wil be redirected in 1 second.');

$API->safe_redirect($API->SEO->make_link('acp'), 1);

$API->TPL->display('message.tpl');

die();

} elseif ($action == 'news') {

$API->auth(array('manage_news' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$to_news['title'] = htmlspecialchars($API->getval('title'));

$to_news['text'] = $API->cleanhtml($API->getval('text'));

if (!$id) {

$to_news['added'] = $CONFIG['TIME'];

$API->DB->query("INSERT INTO news " . $API->DB->build_insert_query($to_news));

$newid = $API->DB->mysql_insert_id();

$API->write_log("{$API->account['name']} created news with title {$to_news['title']}", 'admincp_news', $newid);

$link = $API->SEO->make_link('news', 'id', $newid);

$link = generate_short_link($link);

send_push_safari("Hot news!", $to_news['title'], $link, '', 'news');

send_push("Hot news: {$to_news['title']}", 1, json_encode(array('id' => $newid)), '', 0, 'news');

send_twitter("RT Hot News: {$to_news['title']} " . $link);

} else {

$before = $API->DB->query_row("SELECT title,text FROM news WHERE id=$id");

if ($before != $to_news)

$API->write_log("{$API->account['name']} editen news with title {$to_news['title']}", 'admincp_news', $id);

$API->DB->query("UPDATE news SET " . $API->DB->build_update_query($to_news) . " WHERE id=$id");

}

$API->CACHE->clearGroupCache('news');

$API->TPL->assign('message', 'News successfully edited/added. You wil be redirected in 1 second.');

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'news'), 1);

$API->TPL->display('message.tpl');

die();

}

if ($id) {

$news = $API->DB->query_row("SELECT * FROM news WHERE id=$id");

$API->TPL->assign('news', $news);

}

$newsdata = $API->DB->query_return("SELECT * FROM news ORDER BY added DESC");

$API->TPL->assign('newsdata', $newsdata);

$API->TPL->display('acp-news.tpl');

die();

} elseif ($action == 'delete-news') {

$API->auth(array('manage_news' => 1));

$API->DB->query("DELETE FROM news WHERE id=$id");

$API->write_log("{$API->account['name']} deleted news with id=$id", 'admincp_news', $id);

$API->CACHE->clearGroupCache('news');

$API->TPL->assign('message', 'News deleted.');

$API->safe_redirect($API->SEO->make_link('acp', 'action', 'news'), 1);

$API->TPL->display('message.tpl');

die();

} elseif ($action == 'push-safari') {

$API->auth(array('send_pushes' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$names = array_map('strval', $API->getval('anames', 'array'));

if ($names) {

$ids = $API->DB->query_return("SELECT GROUP_CONCAT(accounts.id) AS ids FROM accounts WHERE accounts.name IN (" . implode(',', array_map(array($API->DB, 'sqlesc'), $names)) . ") OR accounts.email IN (" . implode(',', array_map(array($API->DB, 'sqlesc'), $names)) . ")");

if ($ids) {

$ids = $ids['ids'];

} else {

$API->error('No one found for your input');

}

} else {

$ids = '';

}

$title = $API->getval('title');

$body = $API->getval('body');

$url = $API->getval('url');

if (!$title | !$body || !$url) {

$API->error('Missing body or/and title, url');

}

$notification_type = htmlspecialchars($API->getval('notification_type'));

send_push_safari($title, $body, $url, $ids,$notification_type);

$API->TPL->assign('message', 'SAFARI Push messages scheduled to be sent.');

$API->TPL->display('message.tpl');

die();

} else {

$API->TPL->display('acp-push-safari.tpl');

die();

}

} elseif ($action == 'push') {

$API->auth(array('send_pushes' => 1));

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

$udids = $API->getval('udids', 'array');

if ($udids) {

$udids = array_map('htmlspecialchars', $udids);

$udids = array_map('trim', $udids);

$udids = array_map('strtoupper', $udids);

$udids = implode(',', $udids);

} else

$udids = null;

//die($udids);

$custom_prop_names = $API->getval('cusom_prop_names', 'array');

$custom_prop_vals = $API->getval('custom_prop_vals', 'array');

if ($custom_prop_names) {

foreach ($custom_prop_names as $k => $v) {

if ($v != 'type')

$custom_props[$v] = $custom_prop_vals[$k];

}

$custom_props = json_encode($custom_props);

} else

$custom_props = '';

$content_available = $API->getval('content_available', 'int');

$silent = $API->getval('is_silent', 'int');

$notification_type = htmlspecialchars($API->getval('notification_type'));

send_push($API->getval('message'), $API->getval('type', 'int'), $custom_props, $udids, $content_available, $silent,$notification_type);

$API->TPL->assign('message', 'Push messages scheduled to be sent.');

$API->TPL->display('message.tpl');

die();

} else {

$API->TPL->display('acp-push.tpl');

die();

}

} elseif ($action == 'message') {

$API->auth(array('is_moderator' => 1));

$msg = htmlspecialchars($API->getval('msg'));

$a = $API->DB->query_row("SELECT accounts.email, accounts.id,accounts.safari_push_notifications,accounts.email_notifications,accounts.push_notifications FROM accounts WHERE accounts.id={$id}");

if ($a) {

$email_notifications = explode(',', $a['email_notifications']);

$safari_push_notificaions = explode(',', $a['safari_push_notifications']);

$push_notificaions = explode(',', $a['push_notifications']);

if ($push_notificaions[0] != 'none' || !$push_notificaions[0] || in_array('moderator', $push_notificaions)) {

$pushes = $API->DB->query_row("SELECT GROUP_CONCAT(udid) AS udids FROM push RIGHT JOIN accounts ON push.account_id=accounts.id WHERE account_id={$id}");

if ($pushes['udids']) {

send_push($API->LANG->_to($a['id'], "You received message from moderator, check your email"), 0, '', $pushes['udids']);

}

}

if ($email_notifications[0] != 'none' || !$email_notifications[0] || in_array('moderator', $email_notifications)) {

$body = "{$API->LANG->_to($a['id'], 'Hello')}!<br/>

{$API->LANG->_to($a['id'], 'Moderator has useful short message for you, that can speed up approving your apps in future')}:<br/>

<strong>{$msg}</strong><br/>

{$API->LANG->_to($a['id'], 'Please review this message and take appropriate action')}.

<br/><br/>

--<br/>

{$API->LANG->_to($a['id'], 'Best regards, team of')} {$CONFIG['sitename']}";

$API->send_mail($a['email'], $CONFIG['sitename'], $CONFIG['siteemail'], $API->LANG->_to($a['id'], "Important message from moderator"), $body);

}

if ($safari_push_notificaions[0] != 'none' || !$safari_push_notificaions[0] || in_array('moderator', $safari_push_notificaions)) {

send_push_safari($API->LANG->_to($id, "Notification"), "You received message from moderator, check your email", $CONFIG['defaultbaseurl'], $id);

}

die('Message sent');

} else

die('Error: no such account');

} elseif ($action == 'logs') {

$API->auth(array('view_logs' => 1));

$log_types = $API->DB->query_return("SELECT type FROM logs GROUP BY type");

//$log_types = explode(',',$log_types['lt']);

$API->TPL->assign('log_types', $log_types);

$type = htmlspecialchars(trim($API->getval('type')));

if ($type) {

$q[] = "type = " . $API->DB->sqlesc($type);

}

$API->TPL->assign('type', $type);

$object_id = $API->getval('object_id', 'int');

if ($object_id) {

$q[] = "object_id = $object_id";

}

$API->TPL->assign('object_id', $object_id);

if ($q)

$query = "WHERE " . implode(' AND ', $q);

else

$query = '';

//$count = $API->DB->get_row_count("logs", $query);

list($limit, $pagercode) = $API->generate_pagination($count, array('acp', 'action', 'logs', 'type', $type), 100);

$API->TPL->assign('pagercode', $pagercode);

$logs = $API->DB->query_return("SELECT logs.*, accounts.name,accounts.email FROM logs LEFT JOIN accounts ON accounts.id=logs.account_id $query ORDER BY added DESC $limit");

$API->TPL->assign('logs', $logs);

$API->TPL->display('acp-logs.tpl');

die();

}

$s = $API->getval('q', 'array');

$s_to_tpl = array_map('htmlspecialchars', $s);

$API->TPL->assign('s', $s_to_tpl);

if ($s['cracker']) {

if (strlen($s['cracker']) < 3) {

$API->error('search by cracker only from 3 sybmols');

}

$q[] = "links.cracker LIKE {$API->DB->sqlwildcardesc($s['cracker'])}";

}

if ($s['name']) {

if (strlen($s['name']) < 3) {

$API->error('search by name only from 3 sybmols');

}

$q[] = "apps.name LIKE {$API->DB->sqlwildcardesc($s['name'])}";

}

if ($s['bid']) {

if (strlen($s['bid']) < 3) {

$API->error('search by bundle_id only from 3 sybmols');

}

$q[] = "apps.bundle_id LIKE {$API->DB->sqlwildcardesc($s['bid'])}";

}

if ($s['link']) {

if (strlen($s['link']) < 3) {

$API->error('search by link only from 3 sybmols');

}

$q[] = "links.link LIKE {$API->DB->sqlwildcardesc($s['link'])}";

}

if ($s['uploader']) {

if (strlen($s['uploader']) < 3) {

$API->error('search by uploader only from 3 sybmols');

}

$uploader_ids = $API->DB->query_row("SELECT GROUP_CONCAT(id) AS ids FROM accounts WHERE (name LIKE {$API->DB->sqlwildcardesc($s['uploader'])} OR email LIKE {$API->DB->sqlwildcardesc($s['uploader'])})");

if ($uploader_ids['ids']) {

$q[] = "uploader_id IN ({$uploader_ids['ids']})";

}

}

if ($s['editor']) {

if (strlen($s['editor']) < 3) {

$API->error('search by editor only from 3 sybmols');

}

$editor_ids = $API->DB->query_row("SELECT GROUP_CONCAT(id) AS ids FROM accounts WHERE (name LIKE {$API->DB->sqlwildcardesc($s['editor'])} OR email LIKE {$API->DB->sqlwildcardesc($s['editor'])})");

if ($editor_ids['ids']) {

$q[] = "editor_id IN ({$editor_ids['ids']})";

}

}

$state = $API->getval('state');

if (!in_array($state, explode(',', 'pending,archived,accepted,rejected,reported,dead'))) {

$state = 'pending';

}

if ($state == 'pending') {

$order = 'ASC';

} else {

$order = 'DESC';

}

$q[] = "state={$API->DB->sqlesc($state)}";

if ($q) {

$query = " WHERE " . implode(" AND ", $q);

}

//$linkscount = $API->DB->query_row("SELECT COUNT(*) AS total FROM links LEFT JOIN apps ON links.trackid=apps.trackid $where");

//$linkscount = $linkscount['total'];

list($limit, $pagercode) = $API->generate_pagination($linkscount, array('acp', 'state', $state, 'q[bid]', $s_to_tpl['bid'], 'q[cracker]', $s_to_tpl['cracker'], 'q[uploader]', $s_to_tpl['uploader'], 'q[link]', $s_to_tpl['link'], 'q[editor]', $s_to_tpl['editor'], 'q[name]', $s_to_tpl['name']));

$links = $API->DB->query("SELECT links.*, apps.name, apps.version AS itversion, apps.store, apps.image, artists.name AS aname, accounts.name AS uname,accounts.email AS uemail, e.name AS ename,e.email AS eemail, e.id AS eid, genres.name AS gname, IF(verified_crackers.account_id=accounts.id AND accounts.name=links.cracker,1,0) AS cverified FROM links LEFT JOIN accounts AS e ON links.editor_id=e.id LEFT JOIN verified_crackers ON uploader_id=verified_crackers.account_id LEFT JOIN apps ON links.trackid=apps.trackid LEFT JOIN artists ON apps.artist_id=artists.id LEFT JOIN genres ON apps.genre_id=genres.id LEFT JOIN accounts ON links.uploader_id=accounts.id $query ORDER BY links.added $order $limit");

$API->TPL->assign('reports', $API->DB->get_row_count("links", "WHERE state='reported'"));

$API->TPL->assign('cracker_proposals', $API->DB->get_row_count("proposed_crackers"));

$API->TPL->assign('itunes_parse_errors', $API->DB->get_row_count("apps", "WHERE itunes_parse_error=1"));

$API->TPL->assign('state', $state);

$API->TPL->assign('links', $links);

$API->TPL->assign('pagercode', $pagercode);

$API->TPL->display('acp.tpl');

die();