/**
* Return HTML widget
*
* @return string
*/
public function display()
{
global $_CONF, $_TABLES, $LANG_SX00;
$action = $this->getAction();
$entry = $this->getEntry();
if (!empty($action) && SEC_checkToken()) {
switch ($action) {
case 'delete':
$this->deleteEntry($entry);
break;
case $LANG_SX00['addentry']:
$this->addEntry($entry, true);
break;
case $LANG_SX00['addcen']:
foreach ($_CONF['censorlist'] as $entry) {
$this->addEntry($entry, true);
}
break;
case 'mass_delete':
if (isset($_POST['delitem'])) {
$this->deleteSelectedEntries($_POST['delitem']);
}
break;
}
}
return $this->getWidget();
}
/**
* Constructor
*/
function display()
{
global $_CONF, $_TABLES, $LANG_SX00;
$action = '';
if (isset($_GET['action'])) {
$action = $_GET['action'];
} elseif (isset($_POST['paction'])) {
$action = $_POST['paction'];
}
if ($action == 'delete' && SEC_checkToken()) {
$entry = $_GET['entry'];
if (!empty($entry)) {
$dbentry = addslashes($entry);
DB_delete($_TABLES['spamx'], array('name', 'value'), array('HTTPHeader', $dbentry));
}
} elseif ($action == $LANG_SX00['addentry'] && SEC_checkToken()) {
$entry = '';
$name = COM_applyFilter($_REQUEST['header-name']);
$n = explode(':', $name);
$name = $n[0];
$value = $_REQUEST['header-value'];
if (!empty($name) && !empty($value)) {
$entry = $name . ': ' . $value;
}
$dbentry = addslashes($entry);
if (!empty($entry)) {
$result = DB_query("INSERT INTO {$_TABLES['spamx']} VALUES ('HTTPHeader','{$dbentry}')");
}
}
$token = SEC_createToken();
$display = '<hr' . XHTML . '>' . LB . '<p><b>';
$display .= $LANG_SX00['headerblack'];
$display .= '</b></p>' . LB . '<ul>' . LB;
$result = DB_query("SELECT value FROM {$_TABLES['spamx']} WHERE name='HTTPHeader' ORDER BY value");
$nrows = DB_numRows($result);
for ($i = 0; $i < $nrows; $i++) {
list($e) = DB_fetchArray($result);
$display .= '<li>' . COM_createLink(htmlspecialchars($e), $_CONF['site_admin_url'] . '/plugins/spamx/index.php?command=EditHeader&action=delete&entry=' . urlencode($e) . '&' . CSRF_TOKEN . '=' . $token) . '</li>' . LB;
}
$display .= '</ul>' . LB . '<p>' . $LANG_SX00['e1'] . '</p>' . LB;
$display .= '<p>' . $LANG_SX00['e2'] . '</p>' . LB;
$display .= '<form method="post" action="' . $_CONF['site_admin_url'] . '/plugins/spamx/index.php?command=EditHeader">' . LB;
$display .= '<table border="0" width="100%">' . LB;
$display .= '<tr><td align="right"><b>Header:</b></td>' . LB;
$display .= '<td><input type="text" size="40" name="header-name"' . XHTML . '> e.g. <tt>User-Agent</tt></td></tr>' . LB;
$display .= '<tr><td align="right"><b>Content:</b></td>' . LB;
$display .= '<td><input type="text" size="40" name="header-value"' . XHTML . '> e.g. <tt>Mozilla</tt></td></tr>' . LB;
$display .= '</table>' . LB;
$display .= '<p><input type="submit" name="paction" value="' . $LANG_SX00['addentry'] . '"' . XHTML . '>';
$display .= '<input type="hidden" name="' . CSRF_TOKEN . "\" value=\"{$token}\"" . XHTML . '></p>' . LB;
$display .= '</form>' . LB;
return $display;
}
/**
* Constructor
*/
function display()
{
global $_CONF, $_TABLES, $LANG_SX00;
$action = '';
if (isset($_GET['action'])) {
$action = $_GET['action'];
} elseif (isset($_POST['paction'])) {
$action = $_POST['paction'];
}
$entry = '';
if (isset($_GET['entry'])) {
$entry = COM_stripslashes($_GET['entry']);
} elseif (isset($_POST['pentry'])) {
$entry = COM_stripslashes($_POST['pentry']);
}
if ($action == 'delete' && SEC_checkToken()) {
$entry = DB_escapeString($entry);
DB_delete($_TABLES['spamx'], array('name', 'value'), array('Personal', $entry));
} elseif ($action == $LANG_SX00['addentry'] && SEC_checkToken()) {
if (!empty($entry)) {
$entry = DB_escapeString($entry);
$result = DB_query("INSERT INTO {$_TABLES['spamx']} VALUES ('Personal', '{$entry}')");
}
} elseif ($action == $LANG_SX00['addcen'] && SEC_checkToken()) {
foreach ($_CONF['censorlist'] as $entry) {
$entry = DB_escapeString($entry);
$result = DB_query("INSERT INTO {$_TABLES['spamx']} VALUES ('Personal', '{$entry}')");
}
}
$token = SEC_createToken();
$display = '<hr' . XHTML . '>' . LB . '<p><b>';
$display .= $LANG_SX00['pblack'];
$display .= '</b></p>' . LB . '<ul>' . LB;
$result = DB_query("SELECT value FROM {$_TABLES['spamx']} WHERE name = 'Personal'");
$nrows = DB_numRows($result);
for ($i = 0; $i < $nrows; $i++) {
$A = DB_fetchArray($result);
$e = $A['value'];
$display .= '<li>' . COM_createLink(htmlspecialchars($e), $_CONF['site_admin_url'] . '/plugins/spamx/index.php?command=EditBlackList&action=delete&entry=' . urlencode($e) . '&' . CSRF_TOKEN . '=' . $token) . '</li>' . LB;
}
$display .= '</ul>' . LB . '<p>' . $LANG_SX00['e1'] . '</p>' . LB;
$display .= '<p>' . $LANG_SX00['e2'] . '</p>' . LB;
$display .= '<form method="post" action="' . $_CONF['site_admin_url'] . '/plugins/spamx/index.php?command=EditBlackList">' . LB;
$display .= '<div><input type="text" size="30" name="pentry"' . XHTML . '> ';
$display .= '<input type="submit" name="paction" value="' . $LANG_SX00['addentry'] . '"' . XHTML . '>' . LB;
$display .= '<p>' . $LANG_SX00['e3'] . '</p> ';
$display .= '<input type="submit" name="paction" value="' . $LANG_SX00['addcen'] . '"' . XHTML . '>' . LB;
$display .= '<input type="hidden" name="' . CSRF_TOKEN . "\" value=\"{$token}\"" . XHTML . '>' . LB;
$display .= '</div></form>' . LB;
return $display;
}
/**
* Return HTML widget
*
* @return string
*/
public function display()
{
global $LANG_SX00;
$action = $this->getAction();
$entry = $this->getEntry();
if ($action === 'delete' && SEC_checkToken()) {
$this->deleteEntry($entry);
} elseif ($action === $LANG_SX00['addentry'] && SEC_checkToken()) {
$entry = '';
$name = COM_applyFilter($_REQUEST['header-name']);
$n = explode(':', $name);
$name = $n[0];
$value = $_REQUEST['header-value'];
if (!empty($name) && !empty($value)) {
$entry = $name . ': ' . $value;
}
$this->addEntry($entry);
}
return $this->getWidget();
}
function security_check_reminder()
{
global $_CONF, $_TABLES, $_IMAGE_TYPE, $MESSAGE;
$retval = '';
if (!SEC_inGroup('Root')) {
return $retval;
}
$done = DB_getItem($_TABLES['vars'], 'value', "name = 'security_check'");
if ($done != 1) {
$retval .= COM_showMessage(92);
}
return $retval;
}
// MAIN
$display = '';
if (isset($_POST['mode']) && $_POST['mode'] == 'moderation' && SEC_checkToken()) {
$action = array();
if (isset($_POST['action'])) {
$action = $_POST['action'];
}
if ($_POST['type'] == 'user') {
$mod_result = moderateusers($_POST['id'], $action, COM_applyFilter($_POST['count'], true));
} else {
$mod_result = moderation($_POST['id'], $action, $_POST['type'], COM_applyFilter($_POST['count'], true));
}
$display .= COM_siteHeader('menu', $LANG29[34]) . COM_showMessageFromParameter() . $mod_result;
} else {
$display .= COM_siteHeader('menu', $LANG29[34]) . COM_showMessageFromParameter() . security_check_reminder() . commandcontrol(SEC_createToken());
}
$display .= COM_siteFooter();
COM_output($display);
}
/**
* Main
*/
$display = '';
$mode = '';
if (isset($_POST['save'])) {
$mode = 'save';
}
if (isset($_POST['cancel'])) {
$mode = 'cancel';
}
$T = new Template($_MG_CONF['template_path'] . '/admin');
$T->set_file('admin', 'administration.thtml');
$T->set_var(array('site_admin_url' => $_CONF['site_admin_url'], 'site_url' => $_MG_CONF['site_url'], 'mg_navigation' => MG_navigation(), 'lang_admin' => $LANG_MG00['admin'], 'version' => $_MG_CONF['pi_version']));
if ($mode == 'save' && SEC_checkToken()) {
$T->set_var(array('admin_body' => MG_saveConfig(), 'mg_navigation' => MG_navigation()));
} elseif ($mode == 'cancel') {
echo COM_refresh($_MG_CONF['admin_url'] . 'index.php');
exit;
} elseif ($mode == $LANG_MG01['continue']) {
COM_setMessage(2);
echo COM_refresh($_MG_CONF['admin_url'] . 'index.php');
exit;
} else {
$T->set_var(array('admin_body' => MG_editConfig(), 'title' => $LANG_MG01['system_options'], 'lang_help' => '<img src="' . MG_getImageFile('button_help.png') . '" style="border:none;" alt="?" />', 'help_url' => $_MG_CONF['site_url'] . '/docs/usage.html#System_Options'));
}
$T->parse('output', 'admin');
$display = COM_siteHeader('menu', '');
$display .= $T->finish($T->get_var('output'));
$display .= COM_siteFooter();
$old = trim($_GET['prevorder']);
$sorting = "?order={$ord}&direction={$dir}&prevorder={$old}";
}
$display = COM_refresh($_CONF['site_admin_url'] . '/plugins.php' . $sorting);
} elseif ($mode == 'change_load_order' && SEC_checkToken()) {
change_load_order(COM_applyFilter($_GET['pi_name']), COM_applyFilter($_GET['where']));
$display = COM_refresh($_CONF['site_admin_url'] . '/plugins.php');
} elseif ($mode == 'autoinstall' && SEC_checkToken()) {
if (SEC_hasRights('plugin.install')) {
$plugin = '';
if (isset($_GET['plugin'])) {
$plugin = COM_applyFilter($_GET['plugin']);
}
if (plugin_autoinstall($plugin)) {
PLG_pluginStateChange($plugin, 'installed');
$display .= COM_refresh($_CONF['site_admin_url'] . '/plugins.php?msg=44');
} else {
$display .= COM_refresh($_CONF['site_admin_url'] . '/plugins.php?msg=72');
}
} else {
$display = COM_refresh($_CONF['site_admin_url'] . '/plugins.php');
}
} elseif ($mode == 'continue_upgrade') {
$display .= continue_upgrade(COM_sanitizeFilename($_GET['plugin']), $_GET['piversion'], $_GET['codeversion']);
} elseif (isset($_FILES['plugin']) && SEC_checkToken() && SEC_hasRights('plugin.install,plugin.upload')) {
$display .= plugin_upload();
} else {
// 'cancel' or no mode at all
$display .= plugin_main();
}
COM_output($display);
case 'download':
$file = '';
if (isset($_GET['file'])) {
$file = preg_replace('/[^a-zA-Z0-9\\-_\\.]/', '', COM_applyFilter($_GET['file']));
$file = str_replace('..', '', $file);
if (!file_exists($_CONF['backup_path'] . $file)) {
$file = '';
}
}
if (!empty($file)) {
DBADMIN_download($file);
exit;
}
break;
case 'delete':
if (isset($_POST['delitem']) && SEC_checkToken()) {
foreach ($_POST['delitem'] as $delfile) {
$file = preg_replace('/[^a-zA-Z0-9\\-_\\.]/', '', COM_applyFilter($delfile));
$file = str_replace('..', '', $file);
if (!@unlink($_CONF['backup_path'] . $file)) {
COM_errorLog('Unable to remove backup file "' . $file . '"');
}
}
} else {
COM_accessLog("User {$_USER['username']} tried to illegally delete database backup(s) and failed CSRF checks.");
echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
}
break;
case 'config':
$view = 'config';
break;
}
} else {
$display = COM_refresh($_CONF['site_url'] . '/index.php');
}
break;
case $LANG_CALJP_1[45]:
// save edited personal event
if (!empty($LANG_CALJP_1[45]) && $_CAJP_CONF['personalcalendars'] == 1 && !COM_isAnonUser() && (isset($_POST['calendar_type']) && $_POST['calendar_type'] == 'personal') && SEC_checkToken()) {
$display = plugin_savesubmission_calendarjp($_POST);
} else {
$display = COM_refresh($_CONF['site_url'] . '/index.php');
}
break;
case 'deleteevent':
case $LANG_CALJP_1[51]:
if ($_CAJP_CONF['personalcalendars'] == 1 && SEC_checkToken()) {
$eid = COM_applyFilter($_REQUEST['eid']);
if (!empty($eid) && !COM_isAnonUser()) {
DB_query("DELETE FROM {$_TABLES['personal_eventsjp']} WHERE uid={$_USER['uid']} AND eid='{$eid}'");
$display .= COM_refresh($_CONF['site_url'] . '/calendarjp/index.php?mode=personal&msg=26');
} else {
$display = COM_refresh($_CONF['site_url'] . '/index.php');
}
} else {
$display = COM_refresh($_CONF['site_url'] . '/index.php');
}
break;
case 'edit':
if ($_CAJP_CONF['personalcalendars'] == 1) {
$eid = COM_applyFilter($_GET['eid']);
if (!empty($eid) && !COM_isAnonUser()) {
/**
* Saves a poll
*
* Saves a poll topic and potential answers to the database
*
* @param string $pid Poll topic ID
* @param string $old_pid Previous poll topic ID
* @param array $Q Array of poll questions
* @param string $mainpage Checkbox: poll appears on homepage
* @param string $topic The text for the topic
* @param string $meta_description
* @param string $meta_keywords
* @param int $statuscode (unused)
* @param string $open Checkbox: poll open for voting
* @param string $hideresults Checkbox: hide results until closed
* @param int $commentcode Indicates if users can comment on poll
* @param array $A Array of possible answers
* @param array $V Array of vote per each answer
* @param array $R Array of remark per each answer
* @param int $owner_id ID of poll owner
* @param int $group_id ID of group poll belongs to
* @param int $perm_owner Permissions the owner has on poll
* @param int $perm_grup Permissions the group has on poll
* @param int $perm_members Permissions logged in members have on poll
* @param int $perm_anon Permissions anonymous users have on poll
* @return string HTML redirect or error message
*
*/
function savepoll($pid, $old_pid, $Q, $mainpage, $topic, $meta_description, $meta_keywords, $statuscode, $open, $hideresults, $commentcode, $A, $V, $R, $owner_id, $group_id, $perm_owner, $perm_group, $perm_members, $perm_anon)
{
global $_CONF, $_TABLES, $_USER, $LANG21, $LANG25, $MESSAGE, $_POLL_VERBOSE, $_PO_CONF;
$retval = '';
// Convert array values to numeric permission values
list($perm_owner, $perm_group, $perm_members, $perm_anon) = SEC_getPermissionValues($perm_owner, $perm_group, $perm_members, $perm_anon);
$topic = COM_stripslashes($topic);
$meta_description = strip_tags(COM_stripslashes($meta_description));
$meta_keywords = strip_tags(COM_stripslashes($meta_keywords));
$pid = COM_sanitizeID($pid);
$old_pid = COM_sanitizeID($old_pid);
if (empty($pid)) {
if (empty($old_pid)) {
$pid = COM_makeSid();
} else {
$pid = $old_pid;
}
}
// check if any question was entered
if (empty($topic) or count($Q) == 0 or strlen($Q[0]) == 0 or strlen($A[0][0]) == 0) {
$retval .= COM_siteHeader('menu', $LANG25[5]);
$retval .= COM_startBlock($LANG21[32], '', COM_getBlockTemplate('_msg_block', 'header'));
$retval .= $LANG25[2];
$retval .= COM_endBlock(COM_getBlockTemplate('_msg_block', 'footer'));
$retval .= COM_siteFooter();
return $retval;
}
if (!SEC_checkToken()) {
COM_accessLog("User {$_USER['username']} tried to save poll {$pid} and failed CSRF checks.");
return COM_refresh($_CONF['site_admin_url'] . '/plugins/polls/index.php');
}
// check for poll id change
if (!empty($old_pid) && $pid != $old_pid) {
// check if new pid is already in use
if (DB_count($_TABLES['polltopics'], 'pid', $pid) > 0) {
// TBD: abort, display editor with all content intact again
$pid = $old_pid;
// for now ...
}
}
// start processing the poll topic
if ($_POLL_VERBOSE) {
COM_errorLog('**** Inside savepoll() in ' . $_CONF['site_admin_url'] . '/plugins/polls/index.php ***');
}
$access = 0;
if (DB_count($_TABLES['polltopics'], 'pid', $pid) > 0) {
$result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group,perm_members,perm_anon FROM {$_TABLES['polltopics']} WHERE pid = '{$pid}'");
$P = DB_fetchArray($result);
$access = SEC_hasAccess($P['owner_id'], $P['group_id'], $P['perm_owner'], $P['perm_group'], $P['perm_members'], $P['perm_anon']);
} else {
$access = SEC_hasAccess($owner_id, $group_id, $perm_owner, $perm_group, $perm_members, $perm_anon);
}
if ($access < 3 || !SEC_inGroup($group_id)) {
$display .= COM_siteHeader('menu', $MESSAGE[30]) . COM_showMessageText($MESSAGE[29], $MESSAGE[30]) . COM_siteFooter();
COM_accessLog("User {$_USER['username']} tried to illegally submit or edit poll {$pid}.");
COM_output($display);
exit;
}
if (empty($voters)) {
$voters = 0;
}
if ($_POLL_VERBOSE) {
COM_errorLog('owner permissions: ' . $perm_owner, 1);
COM_errorLog('group permissions: ' . $perm_group, 1);
COM_errorLog('member permissions: ' . $perm_members, 1);
COM_errorLog('anonymous permissions: ' . $perm_anon, 1);
}
// we delete everything and re-create it with the input from the form
$del_pid = $pid;
if (!empty($old_pid) && $pid != $old_pid) {
$del_pid = $old_pid;
// delete by old pid, create using new pid below
}
DB_delete($_TABLES['polltopics'], 'pid', $del_pid);
DB_delete($_TABLES['pollanswers'], 'pid', $del_pid);
DB_delete($_TABLES['pollquestions'], 'pid', $del_pid);
$topic = addslashes($topic);
$meta_description = addslashes($meta_description);
$meta_keywords = addslashes($meta_keywords);
$k = 0;
// set up a counter to make sure we do assign a straight line of question id's
$v = 0;
// re-count votes sine they might have been changed
// first dimension of array are the questions
$num_questions = count($Q);
for ($i = 0; $i < $num_questions; $i++) {
$Q[$i] = COM_stripslashes($Q[$i]);
if (strlen($Q[$i]) > 0) {
// only insert questions that exist
$Q[$i] = addslashes($Q[$i]);
DB_save($_TABLES['pollquestions'], 'qid, pid, question', "'{$k}', '{$pid}', '{$Q[$i]}'");
// within the questions, we have another dimensions with answers,
// votes and remarks
$num_answers = count($A[$i]);
for ($j = 0; $j < $num_answers; $j++) {
$A[$i][$j] = COM_stripslashes($A[$i][$j]);
if (strlen($A[$i][$j]) > 0) {
// only insert answers etc that exist
if (!is_numeric($V[$i][$j])) {
$V[$i][$j] = "0";
}
$A[$i][$j] = addslashes($A[$i][$j]);
$R[$i][$j] = addslashes($R[$i][$j]);
$sql = "INSERT INTO {$_TABLES['pollanswers']} (pid, qid, aid, answer, votes, remark) VALUES " . "('{$pid}', '{$k}', " . ($j + 1) . ", '{$A[$i][$j]}', {$V[$i][$j]}, '{$R[$i][$j]}');";
DB_query($sql);
$v = $v + $V[$i][$j];
}
}
$k++;
}
}
// save topics after the questions so we can include question count into table
$sql = "'{$pid}','{$topic}','{$meta_description}','{$meta_keywords}',{$v}, {$k}, '" . date('Y-m-d H:i:s');
if ($mainpage == 'on') {
$sql .= "',1";
} else {
$sql .= "',0";
}
if ($open == 'on') {
$sql .= ",1";
} else {
$sql .= ",0";
}
if ($hideresults == 'on') {
$sql .= ",1";
} else {
$sql .= ",0";
}
$sql .= ",'{$statuscode}','{$commentcode}',{$owner_id},{$group_id},{$perm_owner},{$perm_group},{$perm_members},{$perm_anon}";
// Save poll topic
DB_save($_TABLES['polltopics'], "pid, topic, meta_description, meta_keywords, voters, questions, date, display, is_open, hideresults, statuscode, commentcode, owner_id, group_id, perm_owner, perm_group, perm_members, perm_anon", $sql);
if (empty($old_pid) || $old_pid == $pid) {
PLG_itemSaved($pid, 'polls');
} else {
DB_change($_TABLES['comments'], 'sid', addslashes($pid), array('sid', 'type'), array(addslashes($old_pid), 'polls'));
PLG_itemSaved($pid, 'polls', $old_pid);
}
if ($_POLL_VERBOSE) {
COM_errorLog('**** Leaving savepoll() in ' . $_CONF['site_admin_url'] . '/plugins/polls/index.php ***');
}
return PLG_afterSaveSwitch($_PO_CONF['aftersave'], $_CONF['site_url'] . '/polls/index.php?pid=' . $pid, 'polls', 19);
return COM_refresh($_CONF['site_admin_url'] . '/plugins/polls/index.php?msg=19');
}
$myts = new MyTextSanitizer();
// MyTextSanitizer object
$eh = new ErrorHandler();
//ErrorHandler object
$mytree = new XoopsTree($_DB_name, $_TABLES['filemgmt_cat'], "cid", "pid");
$mytree->setGroupAccessFilter($_GROUPS);
$groupsql = filemgmt_buildAccessSql();
$sql = "SELECT COUNT(*) FROM {$_TABLES['filemgmt_cat']} WHERE pid=0 ";
$sql .= $groupsql;
list($catAccessCnt) = DB_fetchArray(DB_query($sql));
if ($catAccessCnt < 1) {
COM_errorLOG("Submit.php => FileMgmt Plugin Access denied. Attempted user upload of a file, Remote address is:{$_SERVER['REMOTE_ADDR']}");
redirect_header($_CONF['site_url'] . "/index.php", 1, _GL_ERRORNOUPLOAD);
exit;
}
if (isset($_POST['submit']) && SEC_checkToken()) {
if (!COM_isAnonUser()) {
$submitter = (int) $_USER['uid'];
} else {
$submitter = 1;
}
// Check if Title entered
if (!isset($_POST['title']) || $_POST["title"] == '') {
$eh->show("1001");
}
// Check if filename entered
if ($_FILES['newfile']['name'] != '') {
$name = $_FILES['newfile']['name'];
$url = rawurlencode($name);
$name = $myts->makeTboxData4Save($name);
$url = $myts->makeTboxData4Save($url);
$boards_delforum->set_var('gltoken_name', CSRF_TOKEN);
$boards_delforum->set_var('gltoken', SEC_createToken());
$boards_delforum->parse('output', 'boards_delforum');
$display .= $boards_delforum->finish($boards_delforum->get_var('output'));
$display .= COM_endBlock();
$display = COM_createHTMLDocument($display);
COM_output($display);
exit;
}
} elseif ($mode == $LANG_GF01['EDIT'] && isset($_POST['what']) && COM_applyFilter($_POST['what']) == 'order' && SEC_checkToken()) {
$order = COM_applyFilter($_POST['order'], true);
DB_query("UPDATE {$_TABLES['forum_forums']} SET forum_order='{$order}' WHERE forum_id='{$id}'");
$display = COM_refresh($_CONF['site_admin_url'] . '/plugins/forum/boards.php?msg=7');
COM_output($display);
exit;
} elseif ($mode == 'save' && SEC_checkToken() && $submit != $LANG_GF01['CANCEL']) {
$category = isset($_REQUEST['category']) ? COM_applyFilter($_POST['category'], true) : 0;
$order = isset($_POST['order']) ? COM_applyFilter($_POST['order'], true) : 0;
$name = gf_preparefordb($_POST['name'], 'text');
$dscp = gf_preparefordb($_POST['dscp'], 'text');
$is_hidden = isset($_POST['is_hidden']) ? COM_applyFilter($_POST['is_hidden'], true) : 0;
$is_readonly = isset($_POST['is_readonly']) ? COM_applyFilter($_POST['is_readonly'], true) : 0;
$no_newposts = isset($_POST['no_newposts']) ? COM_applyFilter($_POST['no_newposts'], true) : 0;
$privgroup = isset($_POST['privgroup']) ? COM_applyFilter($_POST['privgroup'], true) : 0;
if ($privgroup == 0) {
$privgroup = 2;
}
DB_query("UPDATE {$_TABLES['forum_forums']} SET forum_cat={$category},forum_name='{$name}', forum_order={$order},forum_dscp='{$dscp}', grp_id={$privgroup},\n is_hidden='{$is_hidden}', is_readonly='{$is_readonly}', no_newposts='{$no_newposts}' WHERE forum_id='{$id}'");
$display = COM_refresh($_CONF['site_admin_url'] . '/plugins/forum/boards.php?msg=8');
COM_output($display);
exit;
exit;
}
}
$conf_group = array_key_exists('conf_group', $_POST) ? COM_applyFilter($_POST['conf_group']) : $default_conf_group;
if (array_key_exists('set_action', $_POST) && SEC_checkToken()) {
if ($_POST['set_action'] == 'restore') {
$config->restore_param($_POST['name'], $conf_group, $_POST['subgroup'], $_POST['tab']);
} elseif ($_POST['set_action'] == 'unset') {
$config->unset_param($_POST['name'], $conf_group, $_POST['subgroup'], $_POST['tab']);
}
// notify plugins when config item enabled or disabled
$config_item[] = $_POST['name'];
PLG_configChange($conf_group, $config_item);
$subgroup = array_key_exists('subgroup', $_POST) ? COM_applyFilter($_POST['subgroup']) : null;
$display = $config->get_ui($conf_group, $subgroup);
} elseif (array_key_exists('form_submit', $_POST) && SEC_checkToken()) {
$result = null;
if (!array_key_exists('form_reset', $_POST)) {
if ($conf_group == 'Core') {
require_once 'configuration_validation.php';
} else {
// Retrieve plugin config validation if found
$filename = $_CONF['path'] . 'plugins/' . $conf_group . '/configuration_validation.php';
if (file_exists($filename)) {
require_once $filename;
}
}
$result = $config->updateConfig($_POST, $conf_group);
// notify plugins
if (is_array($result) && count($result) > 0) {
PLG_configChange($conf_group, array_keys($result));
$mailresult = str_replace('<successcount>', $successcount, $LANG31[20]);
$retval .= str_replace('<failcount>', $failcount, $mailresult);
$retval .= '<h2>' . $LANG31[21] . '</h2>';
for ($i = 0; $i < count($failures); $i++) {
$retval .= current($failures) . '<br' . XHTML . '>';
next($failures);
}
if (count($failures) == 0) {
$retval .= $LANG31[23];
}
$retval .= '<h2>' . $LANG31[22] . '</h2>';
for ($i = 0; $i < count($successes); $i++) {
$retval .= current($successes) . '<br' . XHTML . '>';
next($successes);
}
if (count($successes) == 0) {
$retval .= $LANG31[24];
}
$retval .= COM_endBlock();
return $retval;
}
// MAIN
$display .= COM_siteHeader('menu', $LANG31[1]);
if (isset($_POST['mail']) && $_POST['mail'] == 'mail' && SEC_checkToken()) {
$display .= send_messages($_POST);
} else {
$display .= COM_showMessageFromParameter();
$display .= display_mailform();
}
$display .= COM_siteFooter();
COM_output($display);
/**
* Saves an event to the database
*
* (parameters should be obvious - old list was incomplete anyway)
* @return string HTML redirect or error message
*
*/
function CALENDAR_saveEvent($eid, $title, $event_type, $url, $allday, $start_month, $start_day, $start_year, $start_hour, $start_minute, $start_ampm, $end_month, $end_day, $end_year, $end_hour, $end_minute, $end_ampm, $location, $address1, $address2, $city, $state, $zipcode, $description, $postmode, $owner_id, $group_id, $perm_owner, $perm_group, $perm_members, $perm_anon, $hour_mode)
{
global $_CONF, $_TABLES, $_USER, $LANG_CAL_ADMIN, $MESSAGE, $_CA_CONF;
$retval = '';
// Convert array values to numeric permission values
list($perm_owner, $perm_group, $perm_members, $perm_anon) = SEC_getPermissionValues($perm_owner, $perm_group, $perm_members, $perm_anon);
$access = 0;
if (DB_count($_TABLES['events'], 'eid', $eid) > 0) {
$result = DB_query("SELECT owner_id,group_id,perm_owner,perm_group," . "perm_members,perm_anon FROM {$_TABLES['events']} " . "WHERE eid = '{$eid}'");
$A = DB_fetchArray($result);
$access = SEC_hasAccess($A['owner_id'], $A['group_id'], $A['perm_owner'], $A['perm_group'], $A['perm_members'], $A['perm_anon']);
} else {
$access = SEC_hasAccess($owner_id, $group_id, $perm_owner, $perm_group, $perm_members, $perm_anon);
}
if ($access < 3 || !SEC_inGroup($group_id)) {
$retval .= COM_showMessageText($MESSAGE[29], $MESSAGE[30]);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $MESSAGE[30]));
COM_accessLog("User {$_USER['username']} tried to illegally submit or edit event {$eid}.");
return $retval;
}
if ($hour_mode == 24) {
// to avoid having to mess with the tried and tested code below, map
// the 24-hour values onto their 12-hour counterparts and use those
if ($start_hour >= 12) {
$start_ampm = 'pm';
$start_hour = $start_hour - 12;
} else {
$start_ampm = 'am';
$start_hour = $start_hour;
}
if ($start_hour == 0) {
$start_hour = 12;
}
if ($end_hour >= 12) {
$end_ampm = 'pm';
$end_hour = $end_hour - 12;
} else {
$end_ampm = 'am';
$end_hour = $end_hour;
}
if ($end_hour == 0) {
$end_hour = 12;
}
}
if ($allday == 'on') {
$allday = 1;
} else {
$allday = 0;
}
// Make sure start date is before end date
if (checkdate($start_month, $start_day, $start_year)) {
$datestart = sprintf('%4d-%02d-%02d', $start_year, $start_month, $start_day);
$timestart = $start_hour . ':' . $start_minute . ':00';
} else {
$retval .= COM_showMessageText($LANG_CAL_ADMIN[23], $LANG_CAL_ADMIN[2]);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG_CAL_ADMIN[2]));
return $retval;
}
if (checkdate($end_month, $end_day, $end_year)) {
$dateend = sprintf('%4d-%02d-%02d', $end_year, $end_month, $end_day);
$timeend = $end_hour . ':' . $end_minute . ':00';
} else {
$retval .= COM_showMessageText($LANG_CAL_ADMIN[24], $LANG_CAL_ADMIN[2]);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG_CAL_ADMIN[2]));
return $retval;
}
if ($allday == 0) {
if ($dateend < $datestart) {
$retval .= COM_showMessageText($LANG_CAL_ADMIN[25], $LANG_CAL_ADMIN[2]);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG_CAL_ADMIN[2]));
return $retval;
}
} else {
if ($dateend < $datestart) {
// Force end date to be same as start date
$dateend = $datestart;
}
}
// Remove any autotags the user doesn't have permission to use
$description = PLG_replaceTags($description, '', true);
// clean 'em up
if ($postmode == 'html') {
$description = COM_checkHTML(COM_checkWords($description), 'calendar.edit');
} else {
$postmode = 'plaintext';
$description = htmlspecialchars(COM_checkWords($description));
}
$description = DB_escapeString($description);
$title = DB_escapeString(strip_tags(COM_checkWords($title)));
$location = DB_escapeString(COM_checkHTML(COM_checkWords($location), 'calendar.edit'));
$address1 = DB_escapeString(strip_tags(COM_checkWords($address1)));
$address2 = DB_escapeString(strip_tags(COM_checkWords($address2)));
$city = DB_escapeString(strip_tags(COM_checkWords($city)));
$zipcode = DB_escapeString(strip_tags(COM_checkWords($zipcode)));
$event_type = DB_escapeString(strip_tags(COM_checkWords($event_type)));
$url = DB_escapeString(strip_tags($url));
if ($allday == 0) {
// Add 12 to make time on 24 hour clock if needed
if ($start_ampm == 'pm' and $start_hour != 12) {
$start_hour = $start_hour + 12;
}
// If 12AM set hour to 00
if ($start_ampm == 'am' and $start_hour == 12) {
$start_hour = '00';
}
// Add 12 to make time on 24 hour clock if needed
if ($end_ampm == 'pm' and $end_hour != 12) {
$end_hour = $end_hour + 12;
}
// If 12AM set hour to 00
if ($end_ampm == 'am' and $end_hour == 12) {
$end_hour = '00';
}
$timestart = $start_hour . ':' . $start_minute . ':00';
$timeend = $end_hour . ':' . $end_minute . ':00';
}
if (!empty($eid) and !empty($description) and !empty($title)) {
if (!SEC_checkToken()) {
COM_accessLog("User {$_USER['username']} tried to save event {$eid} and failed CSRF checks.");
COM_redirect($_CONF['site_admin_url'] . '/plugins/calendar/index.php');
}
$hits = DB_getItem($_TABLES['events'], 'hits', "eid = '{$eid}'");
if (empty($hits)) {
$hits = 0;
}
DB_delete($_TABLES['eventsubmission'], 'eid', $eid);
DB_save($_TABLES['events'], 'eid,title,event_type,url,allday,datestart,dateend,timestart,' . 'timeend,location,address1,address2,city,state,zipcode,description,' . 'postmode,owner_id,group_id,perm_owner,perm_group,perm_members,' . 'perm_anon,hits', "'{$eid}','{$title}','{$event_type}','{$url}',{$allday},'{$datestart}'," . "'{$dateend}','{$timestart}','{$timeend}','{$location}','{$address1}'," . "'{$address2}','{$city}','{$state}','{$zipcode}','{$description}','{$postmode}'," . "{$owner_id},{$group_id},{$perm_owner},{$perm_group},{$perm_members},{$perm_anon},{$hits}");
if (DB_count($_TABLES['personal_events'], 'eid', $eid) > 0) {
$result = DB_query("SELECT uid FROM {$_TABLES['personal_events']} " . "WHERE eid = '{$eid}'");
$numrows = DB_numRows($result);
for ($i = 1; $i <= $numrows; $i++) {
$P = DB_fetchArray($result);
DB_save($_TABLES['personal_events'], 'eid,title,event_type,datestart,dateend,address1,address2,' . 'city,state,zipcode,allday,url,description,postmode,' . 'group_id,owner_id,perm_owner,perm_group,perm_members,' . 'perm_anon,uid,location,timestart,timeend', "'{$eid}','{$title}','{$event_type}','{$datestart}','{$dateend}'," . "'{$address1}','{$address2}','{$city}','{$state}','{$zipcode}'," . "{$allday},'{$url}','{$description}','{$postmode}',{$group_id}," . "{$owner_id},{$perm_owner},{$perm_group},{$perm_members}," . "{$perm_anon},{$P['uid']},'{$location}','{$timestart}','{$timeend}'");
}
}
PLG_itemSaved($eid, 'calendar');
COM_rdfUpToDateCheck('calendar', $event_type, $eid);
return PLG_afterSaveSwitch($_CA_CONF['aftersave'], $_CONF['site_url'] . '/calendar/event.php?eid=' . $eid, 'calendar', 17);
} else {
$retval .= COM_showMessageText($LANG_CAL_ADMIN[10], $LANG_CAL_ADMIN[2]);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG_CAL_ADMIN[2]));
return $retval;
}
}
/**
* Handles comment processing
*
* @param string $mode Mode of comment processing
* @param string $type Type of item (article, polls, etc.)
* @param string $title Title of item
* @param string $sid ID for item to show comments for
* @param string $format 'threaded', 'nested', or 'flat'
* @return string HTML formated
*/
function CMT_handleComment($mode = '', $type = '', $title = '', $sid = '', $format = '')
{
global $_CONF, $_TABLES, $_USER, $LANG03, $LANG_ADMIN, $topic, $_PLUGINS;
$commentmode = '';
if (!empty($_REQUEST[CMT_MODE])) {
$commentmode = COM_applyFilter($_REQUEST[CMT_MODE]);
}
if (empty($mode)) {
$mode = COM_applyFilter(COM_getArgument(CMT_MODE));
}
if (empty($commentmode) && !empty($mode)) {
$commentmode = $mode;
}
if (empty($sid) && !empty($_REQUEST[CMT_SID])) {
$sid = COM_applyFilter($_REQUEST[CMT_SID]);
}
$pid = 0;
if (!empty($_REQUEST[CMT_PID])) {
$pid = COM_applyFilter($_REQUEST[CMT_PID], true);
}
if (empty($type) && !empty($_REQUEST[CMT_TYPE])) {
$type = COM_applyFilter($_REQUEST[CMT_TYPE]);
}
if (!empty($_REQUEST['title'])) {
$title = $_REQUEST['title'];
// apply filters later in CMT_commentForm or CMT_saveComment
}
if (!empty($_REQUEST[CMT_UID])) {
$uid = COM_applyFilter($_REQUEST[CMT_UID]);
} else {
$uid = 1;
if (!empty($_USER['uid'])) {
$uid = $_USER['uid'];
}
}
$postmode = $_CONF['postmode'];
if (isset($_REQUEST['postmode'])) {
$postmode = COM_applyFilter($_REQUEST['postmode']);
}
$formtype = '';
if (!empty($_REQUEST['formtype'])) {
$formtype = COM_applyFilter($_REQUEST['formtype']);
}
// Get comment id, may not be there...will handle in function
$cid = 0;
if (isset($_REQUEST[CMT_CID])) {
$cid = COM_applyFilter($_REQUEST[CMT_CID], true);
}
TOPIC_getTopic('comment', $cid);
if (empty($format) && isset($_REQUEST['format'])) {
$format = COM_applyFilter($_REQUEST['format']);
}
if (!in_array($format, array('threaded', 'nested', 'flat', 'nocomment'))) {
if (COM_isAnonUser()) {
$format = $_CONF['comment_mode'];
} else {
$format = DB_getItem($_TABLES['usercomment'], 'commentmode', "uid = {$_USER['uid']}");
}
}
$order = '';
if (isset($_REQUEST['order'])) {
$order = COM_applyFilter($_REQUEST['order']);
}
$cpage = 1;
if (!empty($_REQUEST['cpage'])) {
$cpage = COM_applyFilter($_REQUEST['cpage'], true);
if (empty($cpage)) {
$cpage = 1;
}
}
$is_comment_page = CMT_isCommentPage();
$retval = '';
if ($_CONF['show_comments_at_replying'] && $is_comment_page && !empty($sid) && !empty($type) && in_array($commentmode, array('', $LANG03[28], $LANG03[34], $LANG03[14], 'edit'))) {
if ($commentmode == 'edit') {
$cid = 0;
if (isset($_REQUEST[CMT_CID])) {
$cid = COM_applyFilter($_REQUEST[CMT_CID], true);
}
if ($cid <= 0) {
COM_errorLog("CMT_handleComment(): {$_USER['uid']} from {$_SERVER['REMOTE_ADDR']} tried " . 'to edit a comment with one or more missing/bad values.');
return COM_refresh($_CONF['site_url'] . '/index.php');
}
$pid = $cid;
}
if ($pid > 0 && empty($title)) {
$atype = DB_escapeString($type);
$title = DB_getItem($_TABLES['comments'], 'title', "(cid = {$pid}) AND (type = '{$atype}')");
}
if (empty($title)) {
$title = PLG_getItemInfo($type, $sid, 'title');
$title = str_replace('$', '$', $title);
// CMT_userComments expects non-htmlspecial chars for title...
$title = str_replace('&', '&', $title);
$title = str_replace('"', '"', $title);
$title = str_replace('<', '<', $title);
$title = str_replace('>', '>', $title);
}
$retval .= CMT_userComments($sid, $title, $type, $order, $format, $pid, $cpage, $pid > 0, false, 0);
}
switch ($commentmode) {
case $LANG03[28]:
// Preview Changes (for edit)
// Preview Changes (for edit)
case $LANG03[34]:
// Preview Submission changes (for edit)
// Preview Submission changes (for edit)
case $LANG03[14]:
// Preview
$retval .= CMT_commentForm($title, $_POST['comment'], $sid, $pid, $type, $commentmode, $postmode, $format, $order, $cpage);
if ($is_comment_page) {
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG03[14]));
}
break;
case $LANG03[35]:
// Submit Changes to Moderation table
// Submit Changes to Moderation table
case $LANG03[29]:
// Submit Changes
if (SEC_checkToken()) {
$retval .= CMT_handleEditSubmit($commentmode);
} else {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
break;
case $LANG03[11]:
// Submit comment
$retval .= CMT_handleSubmit($title, $sid, $pid, $type, $postmode, $uid);
break;
case $LANG_ADMIN['delete']:
case 'delete':
// Delete comment
if (SEC_checkToken()) {
$retval .= CMT_handleDelete($sid, $type, $formtype);
} else {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
break;
case 'view':
// View comment by $cid
$retval .= CMT_handleView($format, $order, $cpage, true);
break;
case 'display':
// View comment by $pid
$retval .= CMT_handleView($format, $order, $cpage, false);
break;
case 'report':
if ($is_comment_page) {
$cid = 0;
if (isset($_GET[CMT_CID])) {
$cid = COM_applyFilter($_GET[CMT_CID], true);
}
$type = '';
if (isset($_GET[CMT_TYPE])) {
$type = COM_applyFilter($_GET[CMT_TYPE]);
}
if ($cid <= 0 || empty($type)) {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
$retval .= CMT_reportAbusiveComment($cid, $type);
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG03[27]));
}
break;
case 'sendreport':
if (SEC_checkToken()) {
$cid = 0;
if (isset($_POST[CMT_CID])) {
$cid = COM_applyFilter($_POST[CMT_CID], true);
}
$type = '';
if (isset($_POST[CMT_TYPE])) {
$type = COM_applyFilter($_POST[CMT_TYPE]);
}
if ($cid <= 0 || empty($type)) {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
$retval .= CMT_sendReport($cid, $type);
} else {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
break;
case 'editsubmission':
if (!SEC_hasRights('comment.moderate')) {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
// deliberate fall-through
// deliberate fall-through
case 'edit':
$retval .= CMT_handleEdit($commentmode, $postmode, $format, $order, $cpage);
if ($is_comment_page) {
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG03[1]));
}
break;
case 'unsubscribe':
$cid = 0;
$key = COM_applyFilter($_GET['key']);
if (!empty($key)) {
$key = DB_escapeString($key);
$cid = DB_getItem($_TABLES['commentnotifications'], 'cid', "deletehash = '{$key}'");
if (!empty($cid)) {
$redirecturl = $_CONF['site_url'] . '/comment.php?mode=view&cid=' . $cid . '&format=nested&msg=16';
DB_delete($_TABLES['commentnotifications'], 'deletehash', $key, $redirecturl);
exit;
}
}
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
break;
case $LANG_ADMIN['cancel']:
if ($formtype == 'editsubmission') {
echo COM_refresh($_CONF['site_admin_url'] . '/moderation.php');
exit;
} else {
$retval .= CMT_handleCancel();
// moved to function for readibility
}
break;
default:
// New Comment or Reply Comment
$abort = false;
// Check to make sure comment type exists
if ($type != 'article' && !in_array($type, $_PLUGINS)) {
$abort = true;
}
// Check article permissions
if (!$abort && $type == 'article' && !empty($sid)) {
$dbTitle = DB_getItem($_TABLES['stories'], 'title', "(sid = '{$sid}') AND (draft_flag = 0) AND (date <= NOW()) AND (commentcode = 0)" . COM_getPermSQL('AND'));
// if ($dbTitle === null || TOPIC_hasMultiTopicAccess('article', $sid) < 2) { // Make sure have at least read access to topics to post comment
if ($dbTitle === null || TOPIC_hasMultiTopicAccess('article', $sid, $topic) < 2) {
// Make sure have at least read access to current topic of article to post comment
// no permissions, or no story of that title
$abort = true;
}
}
if (!$abort && !empty($sid) && !empty($type)) {
if ($pid > 0 && empty($title)) {
$atype = DB_escapeString($type);
$title = DB_getItem($_TABLES['comments'], 'title', "(cid = {$pid}) AND (type = '{$atype}')");
}
if (empty($title)) {
$title = PLG_getItemInfo($type, $sid, 'title');
// Check title, if for some reason blank assume no access allowed to plugin item (therefore cannot add comment) so return to homepage
if (is_array($title) || empty($title) || $title == false) {
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
$title = str_replace('$', '$', $title);
// CMT_commentForm expects non-htmlspecial chars for title...
$title = str_replace('&', '&', $title);
$title = str_replace('"', '"', $title);
$title = str_replace('<', '<', $title);
$title = str_replace('>', '>', $title);
}
$retval .= CMT_commentForm($title, '', $sid, $pid, $type, $commentmode, $postmode, $format, $order, $cpage);
} else {
if (COMMENT_ON_SAME_PAGE) {
// Do nothing and do not show comment form (happens most likely when admin viewing draft article)
} else {
// For comments not displayed on same page (probably owner pushed the post comment button on a draft article)
echo COM_refresh($_CONF['site_url'] . '/index.php');
exit;
}
}
if ($is_comment_page) {
$noindex = '<meta name="robots" content="noindex"' . XHTML . '>';
$retval = COM_createHTMLDocument($retval, array('pagetitle' => $LANG03[1], 'headercode' => $noindex));
}
break;
}
return $retval;
}
} else {
$_POST['sp_centerblock'] = 0;
}
if ($sp_inblock == 'on') {
$_POST['sp_inblock'] = 1;
} else {
$_POST['sp_inblock'] = 0;
}
$display .= PAGE_edit($sp_id, '', $editor);
$display .= COM_siteFooter();
}
break;
case 'delete':
if (empty($sp_id) || is_numeric($sp_id) && $sp_id == 0) {
COM_errorLog('Attempted to delete staticpage, sp_id empty or null, value =' . $sp_id);
$display .= COM_refresh($_CONF['site_admin_url'] . '/plugins/staticpages/index.php');
} elseif (SEC_checkToken()) {
$args = array('sp_id' => $sp_id);
PLG_invokeService('staticpages', 'delete', $args, $display, $svc_msg);
} else {
COM_accessLog("User {$_USER['username']} tried to illegally delete staticpage {$sp_id} and failed CSRF checks.");
echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
}
break;
default:
$display .= COM_siteHeader('menu', $LANG_STATIC['staticpagelist']);
$display .= PAGE_list();
$display .= COM_siteFooter();
break;
}
echo $display;
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
// | GNU General Public License for more details. |
// | |
// | You should have received a copy of the GNU General Public License |
// | along with this program; if not, write to the Free Software Foundation, |
// | Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
// +---------------------------------------------------------------------------+
require_once 'gf_functions.php';
require_once $_CONF['path_system'] . 'lib-story.php';
$page = isset($_GET['page']) ? COM_applyFilter($_GET['page'], true) : '';
$show = isset($_GET['show']) ? COM_applyFilter($_GET['show'], true) : '';
$migrate = isset($_POST['migrate']) ? COM_applyFilter($_POST['migrate']) : '';
$selforum = isset($_POST['selforum']) ? COM_applyFilter($_POST['selforum']) : '';
$curtopic = isset($_POST['seltopic']) ? COM_applyFilter($_POST['seltopic']) : '';
$dpm = isset($_POST['delPostMigrate']) ? COM_applyFilter($_POST['delPostMigrate'], true) : '';
if ($migrate == $LANG_GF01['MIGRATE_NOW'] && $selforum != "select" && !empty($_POST['chk_record_delete']) && SEC_checkToken()) {
$num_stories = 0;
$num_posts = 0;
foreach ($_POST['chk_record_delete'] as $sid) {
if ($curtopic == 'submissions') {
$sql = "SELECT sid,date,uid,title,introtext " . "FROM {$_TABLES['storysubmission']} WHERE sid='{$sid}'";
$result = DB_query($sql);
list($sid, $storydate, $uid, $subject, $introtext) = DB_fetchArray($result);
$num_posts = migratetopic($selforum, $sid, $storydate, $uid, $subject, $introtext, '', '0') + $num_posts;
$num_stories++;
if ($dpm == 1) {
PLG_deleteSubmission('story', $sid);
}
} else {
$sql = "SELECT sid,date,uid,title,introtext,bodytext,hits " . "FROM {$_TABLES['stories']} WHERE sid='{$sid}'";
$result = DB_query($sql);
}
} else {
$page .= COM_showMessageText($LANG_DB_BACKUP['no_innodb'], '', true, 'error');
}
break;
case 'optimize':
$pagetitle = $LANG_DB_BACKUP['optimize_title'];
$page .= DBADMIN_optimize();
break;
case 'dooptimize':
$startwith = '';
if (isset($_GET['startwith'])) {
$startwith = COM_applyFilter($_GET['startwith']);
}
$pagetitle = $LANG_DB_BACKUP['optimize_title'];
if (!empty($startwith) || SEC_checkToken()) {
$failures = 0;
if (isset($_GET['failures'])) {
$failures = COM_applyFilter($_GET['failures'], true);
}
$num_errors = DBADMIN_dooptimize($startwith, $failures);
if ($num_errors == 0) {
$page .= COM_showMessageText($LANG_DB_BACKUP['optimize_success']);
} else {
$page .= COM_showMessageText($LANG_DB_BACKUP['optimize_success'] . ' ' . $LANG_DB_BACKUP['table_issues'], '', true, 'error');
}
$page .= DBADMIN_list();
}
break;
case 'saveconfig':
$items = array();
public function display()
{
global $_CONF, $_TABLES, $LANG_SX00;
$display = $LANG_SX00['masshead'];
$act = '';
if (isset($_POST['action'])) {
$act = COM_applyFilter($_POST['action']);
}
$lmt = 0;
if (isset($_POST['limit'])) {
$lmt = COM_applyFilter($_POST['limit'], true);
}
if ($act === $LANG_SX00['deletespam'] && $lmt > 0 && SEC_checkToken()) {
$numc = 0;
$spamx_path = $_CONF['path'] . 'plugins/spamx/';
if ($dir = @opendir($spamx_path)) {
while (($file = readdir($dir)) !== false) {
if (is_file($spamx_path . $file)) {
if (substr($file, -18) == '.Examine.class.php') {
$tmp = str_replace('.Examine.class.php', '', $file);
$Spamx_Examine[] = $tmp;
require_once $spamx_path . $file;
}
}
}
closedir($dir);
}
$result = DB_query("SELECT comment,cid,sid,type,UNIX_TIMESTAMP(date) as date,ipaddress FROM {$_TABLES['comments']} ORDER BY date DESC LIMIT {$lmt}");
$nrows = DB_numRows($result);
for ($i = 0; $i < $nrows; $i++) {
$A = DB_fetchArray($result);
foreach ($Spamx_Examine as $Examine) {
$EX = new $Examine();
if (method_exists($EX, 'reexecute')) {
$res = $EX->reexecute($A['comment'], $A['date'], $A['ipaddress'], $A['type']);
} else {
$res = $EX->execute($A['comment']);
}
if ($res == PLG_SPAM_FOUND) {
break;
}
}
if ($res == PLG_SPAM_FOUND) {
$this->delcomment($A['cid'], $A['sid'], $A['type']);
$numc++;
}
}
$display .= '<p>' . $numc . $LANG_SX00['comdel'] . '</p>' . LB;
} else {
$token = SEC_createToken();
$display .= '<form class="uk-form" method="post" action="' . $_CONF['site_admin_url'] . '/plugins/spamx/index.php?command=MassDelete"><div>';
$display .= $LANG_SX00['numtocheck'] . ' ' . ' <select name="limit">' . LB;
$display .= '<option value="10">10</option>' . LB . '<option value="50">50</option>' . LB . '<option value="100" selected="selected">100</option>' . LB . '<option value="200">200</option>' . LB . '<option value="300">300</option>' . LB . '<option value="400">400</option>' . LB;
$display .= '</select>' . LB;
$display .= $LANG_SX00['note1'];
$display .= $LANG_SX00['note2'];
$display .= $LANG_SX00['note3'];
$display .= $LANG_SX00['note4'];
$display .= $LANG_SX00['note5'];
$display .= $LANG_SX00['note6'] . LB;
$display .= '<button type="submit" name="action" value="' . $LANG_SX00['deletespam'] . '" class="uk-button">' . $LANG_SX00['deletespam'] . '</button>' . LB;
$display .= '<input type="hidden" name="' . CSRF_TOKEN . "\" value=\"{$token}\"" . XHTML . '>' . LB;
$display .= '</div></form>' . LB;
}
return $display;
}
}
if (empty($cid)) {
COM_errorLog('Attempted to delete empty category');
$display .= COM_refresh($_CONF['site_admin_url'] . '/plugins/links/category.php');
} elseif (SEC_checkToken()) {
$msg = links_delete_category($cid);
$display .= COM_siteHeader('menu', $LANG_LINKS_ADMIN[11]);
$display .= COM_showMessage($msg, 'links');
$display .= links_list_categories($root);
$display .= COM_siteFooter();
} else {
COM_accessLog("User {$_USER['username']} tried to illegally delete link category {$cid} and failed CSRF checks.");
echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
}
// save category
} elseif ($mode == $LANG_ADMIN['save'] && !empty($LANG_ADMIN['save']) && SEC_checkToken()) {
$msg = links_save_category($_POST['cid'], $_POST['old_cid'], $_POST['pid'], $_POST['category'], $_POST['description'], COM_applyFilter($_POST['tid']), COM_applyFilter($_POST['owner_id'], true), COM_applyFilter($_POST['group_id'], true), $_POST['perm_owner'], $_POST['perm_group'], $_POST['perm_members'], $_POST['perm_anon']);
$display .= COM_siteHeader('menu', $LANG_LINKS_ADMIN[11]);
$display .= COM_showMessage($msg, 'links');
$display .= links_list_categories($root);
$display .= COM_siteFooter();
// edit category
} else {
if ($mode == 'edit') {
$display .= COM_siteHeader('menu', $LANG_LINKS_ADMIN[56]);
$pid = '';
if (isset($_GET['pid'])) {
$pid = strip_tags(COM_stripslashes($_GET['pid']));
}
$cid = '';
if (isset($_GET['cid'])) {
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
// | GNU General Public License for more details. |
// | |
// | You should have received a copy of the GNU General Public License |
// | along with this program; if not, write to the Free Software Foundation, |
// | Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
// +---------------------------------------------------------------------------+
require_once 'gf_functions.php';
require_once $_CONF['path_system'] . 'lib-story.php';
$page = isset($_GET['page']) ? COM_applyFilter($_GET['page'], true) : '';
$show = isset($_GET['show']) ? COM_applyFilter($_GET['show'], true) : '';
$migrate = isset($_POST['migrate']) ? COM_applyFilter($_POST['migrate']) : '';
$selforum = isset($_POST['selforum']) ? COM_applyFilter($_POST['selforum']) : '';
$curtopic = isset($_POST['seltopic']) ? COM_applyFilter($_POST['seltopic']) : '';
$dpm = isset($_POST['delPostMigrate']) ? COM_applyFilter($_POST['delPostMigrate'], true) : '';
if ($migrate == $LANG_GF01['MIGRATE_NOW'] && $selforum != "select" && !empty($_POST['cb_chkentry']) && SEC_checkToken()) {
$num_stories = 0;
$num_posts = 0;
foreach ($_POST['cb_chkentry'] as $sid) {
if ($curtopic == 'submissions') {
$sql = "SELECT sid,date,uid,title,introtext " . "FROM {$_TABLES['storysubmission']} WHERE sid='{$sid}'";
$result = DB_query($sql);
list($sid, $storydate, $uid, $subject, $introtext) = DB_fetchArray($result);
$num_posts = migratetopic($selforum, $sid, $storydate, $uid, $subject, $introtext, '', '0') + $num_posts;
$num_stories++;
if ($dpm == 1) {
PLG_deleteSubmission('story', $sid);
}
} else {
$sql = "SELECT sid,date,uid,title,introtext,bodytext,hits " . "FROM {$_TABLES['stories']} WHERE sid='{$sid}'";
$result = DB_query($sql);
if (isset($_GET['uid'])) {
$uid = COM_applyFilter($_GET['uid'], true);
}
if ($uid == 1) {
echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
exit;
}
$display .= edituser($uid, $msg);
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG28[1]));
} elseif ($mode == 'import' && SEC_checkToken()) {
$display .= importusers();
} elseif ($mode == 'importform') {
$display .= display_batchAddform();
} elseif ($mode == 'batchdelete') {
$display .= batchdelete();
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG28[54]));
} elseif ($mode == $LANG28[78] && !empty($LANG28[78]) && SEC_checkToken()) {
$msg = batchreminders();
$display .= COM_showMessage($msg) . batchdelete();
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG28[11]));
} elseif ($mode == 'batchdeleteexec' && SEC_checkToken()) {
$msg = batchdeleteexec();
$display .= COM_showMessage($msg) . batchdelete();
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG28[11]));
} else {
// 'cancel' or no mode at all
$display .= COM_showMessageFromParameter();
$display .= listusers();
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG28[11]));
}
COM_output($display);
break;
}
}
}
}
//===================================================================
// Main
//===================================================================
$cl = new Nmoxtopicown();
if (isset($_POST['mode'])) {
$mode = COM_applyFilter($_POST['mode']);
} else {
$mode = '';
}
if ($mode === 'dbset') {
if (is_callable('SEC_checkToken') and !SEC_checkToken()) {
exit($LANG_NMOXTOPICOWN['invalid_token']);
} else {
$html = $cl->dbset();
header('Location: ' . $_CONF['site_admin_url'] . '/plugins/nmoxtopicown/index.php?msg=done');
exit;
}
} else {
$html = $cl->listup();
}
if (is_callable('COM_createHTMLDocument')) {
$display = COM_createHTMLDocument($html);
} else {
$display = COM_siteHeader() . $html . COM_siteFooter();
}
if (is_callable('COM_output')) {
if (isset($_POST['hidden'])) {
$hidden = COM_applyFilter($_POST['hidden'], true);
}
$parent_id = '';
if (isset($_POST['parent_id'])) {
$parent_id = COM_applyFilter($_POST['parent_id']);
}
$sortnum = 0;
if (isset($_POST['sortnum'])) {
$sortnum = COM_applyFilter($_POST['sortnum'], true);
}
$display .= savetopic(COM_applyFilter($_POST['tid']), $_POST['topic_name'], $inherit, $hidden, $parent_id, $imageurl, $_POST['meta_description'], $_POST['meta_keywords'], $sortnum, COM_applyFilter($_POST['limitnews'], true), COM_applyFilter($_POST['owner_id'], true), COM_applyFilter($_POST['group_id'], true), $_POST['perm_owner'], $_POST['perm_group'], $_POST['perm_members'], $_POST['perm_anon'], $is_default, $is_archive);
} elseif ($mode == 'edit') {
$tid = '';
if (isset($_GET['tid'])) {
$tid = COM_applyFilter($_GET['tid']);
}
$display .= edittopic($tid);
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG27[1]));
} elseif ($mode == 'change_sortnum' && SEC_checkToken()) {
$display .= COM_showMessageFromParameter();
moveTopics(COM_applyFilter($_GET['tid']), COM_applyFilter($_GET['where']));
$display .= listTopics(SEC_createToken());
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG27[8]));
} else {
// 'cancel' or no mode at all
$display .= COM_showMessageFromParameter();
$display .= listTopics(SEC_createToken());
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG27[8]));
}
COM_output($display);
$grp_applydefault = 1;
}
$chk_grpadmin = '';
if (isset($_POST['chk_grpadmin'])) {
$chk_grpadmin = COM_applyFilter($_POST['chk_grpadmin']);
}
$features = array();
if (isset($_POST['features'])) {
$features = $_POST['features'];
}
$groups = array();
if (isset($_POST['groups'])) {
$groups = $_POST['groups'];
}
$display .= savegroup(COM_applyFilter($_POST['grp_id'], true), COM_applyFilter($_POST['grp_name']), $_POST['grp_descr'], $chk_grpadmin, $grp_gl_core, $grp_default, $grp_applydefault, $features, $groups);
} elseif ($mode == 'savegroupusers' && SEC_checkToken()) {
$grp_id = COM_applyFilter($_REQUEST['grp_id'], true);
$display .= savegroupusers($grp_id, $_POST['groupmembers']);
} elseif ($mode == 'edit') {
$grp_id = 0;
if (isset($_REQUEST['grp_id'])) {
$grp_id = COM_applyFilter($_REQUEST['grp_id'], true);
}
$display .= editgroup($grp_id);
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG_ACCESS['groupeditor']));
} elseif ($mode == 'listusers') {
$grp_id = COM_applyFilter($_REQUEST['grp_id'], true);
$display .= listusers($grp_id);
$display = COM_createHTMLDocument($display, array('pagetitle' => $LANG_ACCESS['groupmembers']));
} elseif ($mode == 'editusers') {
$grp_id = COM_applyFilter($_REQUEST['grp_id'], true);
// | |
// +--------------------------------------------------------------------------+
require_once '../../../lib-common.php';
require_once $_CONF['path'] . '/plugins/calendar/autoinstall.php';
USES_lib_install();
if (!SEC_inGroup('Root')) {
// Someone is trying to illegally access this page
COM_errorLog("Someone has tried to illegally access the Calendar install/uninstall page. User id: {$_USER['uid']}, Username: {$_USER['username']}, IP: {$REMOTE_ADDR}", 1);
$display = COM_siteHeader('menu', $LANG_ACCESS['accessdenied']) . COM_startBlock($LANG_ACCESS['accessdenied']) . $LANG_ACCESS['plugin_access_denied_msg'] . COM_endBlock() . COM_siteFooter();
echo $display;
exit;
}
/**
* Main Function
*/
if (SEC_checkToken()) {
$action = COM_applyFilter($_GET['action']);
if ($action == 'install') {
if (plugin_install_calendar()) {
// Redirects to the plugin editor
echo COM_refresh($_CONF['site_admin_url'] . '/plugins.php?msg=44');
exit;
} else {
echo COM_refresh($_CONF['site_admin_url'] . '/plugins.php?msg=72');
exit;
}
} else {
if ($action == 'uninstall') {
if (plugin_uninstall_calendar('installed')) {
/**
* Redirects to the plugin editor
if (isset($_POST['execute']) && $_POST['execute'] === JAPANIZE_str('execute') && isset($_POST['A']) && is_array($_POST['A'])) {
$A = 0;
$needChange = true;
foreach ($_POST['A'] as $value) {
$A += (int) COM_applyFilter($value, true);
}
} else {
$A = $current;
}
}
}
$checked = array(1 => ($A & 1) === 1, 2 => ($A & 2) === 2, 3 => ($A & 4) === 4, 4 => ($A & 8) === 8, 5 => ($A & 16) === 16, 6 => ($A & 32) === 32);
$japanized = array(1 => ($current & 1) === 1, 2 => ($current & 2) === 2, 3 => ($current & 4) === 4, 4 => ($current & 8) === 8, 5 => ($current & 16) === 16, 6 => ($current & 32) === 32);
$new = 0;
$msgs = array();
if ($needChange && SEC_checkToken()) {
for ($type = 1; $type <= 6; $type++) {
if ($checked[$type]) {
$new += pow(2, $type - 1);
}
if ($checked[$type] !== $japanized[$type]) {
$lang = $checked[$type] ? 'ja' : 'en';
JAPANIZE_execute($type, $lang);
$msgs[] = JAPANIZE_str('msg_' . $lang . '_' . $type);
}
}
} else {
$new = $current;
}
if (count($msgs) > 0) {
$li_style = ' style="margin: 0 0 0 2em; padding: 0;"';
if ($mode == $LANG_ADMIN['save'] && !empty($LANG_ADMIN['save'])) {
// save
$mode = "save";
} else {
if ($mode == $LANG_ADMIN['delete'] && !empty($LANG_ADMIN['delete'])) {
$mode = "delete";
}
}
if ($action == $LANG_ADMIN['cancel']) {
// cancel
$mode = "";
}
//echo "mode=".$mode."<br>";
if ($mode == "" or $mode == "edit" or $mode == "new" or $mode == "export" or $mode == "sampleimport" or $mode == "copy") {
} else {
if (!SEC_checkToken()) {
// if (SEC_checkToken()){//テスト用
COM_accessLog("User {$_USER['username']} tried to illegally and failed CSRF checks.");
echo COM_refresh($_CONF['site_admin_url'] . '/index.php');
exit;
}
}
if ($mode == "exportexec") {
LIB_export($pi_name);
exit;
}
if ($mode == "sampleimportexec") {
LIB_sampleimport($pi_name);
}
//
$menuno = 51;
return $selectHTML;
}
/* Check to see if user has checked multiple records to delete */
if (strcasecmp($_SERVER['REQUEST_METHOD'], 'POST') === 0 and $op == 'delchecked' and SEC_checkToken()) {
$chk_record_delete = array();
if (isset($_POST['chk_record_delete'])) {
$chk_record_delete = $_POST['chk_record_delete'];
}
foreach ($chk_record_delete as $id) {
$id = COM_applyFilter($id, true);
DB_query("DELETE FROM {$_TABLES['forum_topic']} WHERE id='{$id}'");
PLG_itemDeleted($id, 'forum');
}
COM_rdfUpToDateCheck('forum');
// forum rss feeds update
} elseif ($op == 'delrecord' and SEC_checkToken()) {
DB_query("DELETE FROM {$_TABLES['forum_topic']} WHERE id='{$id}'");
PLG_itemDeleted($id, 'forum');
COM_rdfUpToDateCheck('forum');
// forum rss feeds update
}
// Page Navigation Logic
if (empty($show)) {
$show = $CONF_FORUM['show_messages_perpage'];
}
// Check if this is the first page.
if (empty($page)) {
$page = 1;
}
$whereSQL = '';
$forumname = '';