API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 21st, 2017
92
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 12.41 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /****************************************************************\
  3. * Staff panel for the TBDEV source code                          *
  4. * -------------------------------------------------------------- *
  5. * An easy to config staff panel for different staff classes,     *
  6. * with different options for each class, like add, edit, delete  *
  7. * the pages and to log the actions.                              *
  8. * -------------------------------------------------------------- *
  9. * @author: Alex2005 for TBDEV.NET                                *
  10. * @Conversion: Bigjoos for TBDEV.NET 09                          *
  11. * @copyright: Alex2005                                           *
  12. * @package: Staff Panel                                          *
  13. * @category: Staff Tools                                         *
  14. * @version: v1.10 04/07/2008                                     *
  15. * @license: GNU General Public License                           *
  16. \****************************************************************/
  17. require_once("include/bittorrent.php");
  18. require_once("include/user_functions.php");
  19. require_once("include/html_functions.php");
  20. require_once("include/bbcode_functions.php");
  21. dbconn(false);
  22. loggedinorreturn();
  23.  
  24. $lang = array_merge( load_language('global') );
  25.  
  26. $HTMLOUT ='';
  27. /**
  28. * Staff classes config
  29. *
  30. * UC_XYZ  : integer -> the name of the defined class
  31. *
  32. * Options for a selected class
  33. ** add    : boolean -> enable/disable page adding
  34. ** edit   : boolean -> enable/disable page editing
  35. ** delete : boolean -> enable/disable page deletion
  36. ** log    : boolean -> enable/disable the loging of the actions
  37. *
  38. * @result $staff_classes array();
  39. */
  40. $staff_classes = array(
  41.                         UC_MODERATOR        => array('add' => false,    'edit' => false,    'delete' => false,      'log' => true),
  42.                         UC_ADMINISTRATOR    => array('add' => false,    'edit' => false,    'delete' => false,      'log' => true),
  43.                         UC_SYSOP            => array('add' => true,     'edit' => true,     'delete' => true,       'log' => false)
  44.                       );
  45.  
  46. if (!isset($staff_classes[$CURUSER['class']]))
  47. stderr('Error', 'Access Denied!');
  48. $action = (isset($_GET['action']) ? $_GET['action'] : (isset($_POST['action']) ? $_POST['action'] : NULL));
  49. $id = (isset($_GET['id']) ? (int)$_GET['id'] : (isset($_POST['id']) ? (int)$_POST['id'] : NULL));
  50. $class_color = (function_exists('get_user_class_color') ? true : false);
  51. if ($action == 'delete' && is_valid_id($id) && $staff_classes[$CURUSER['class']]['delete'])
  52. {
  53. $sure = ((isset($_GET['sure']) ? $_GET['sure'] : '') == 'yes');
  54. $res = mysql_query('SELECT av_class'.(!$sure || $staff_classes[$CURUSER['class']]['log'] ? ', page_name' : '').' FROM staffpanel WHERE id = '.sqlesc($id)) or sqlerr(__FILE__, __LINE__);
  55. $arr = mysql_fetch_assoc($res);
  56. if ($CURUSER['class'] < $arr['av_class'])
  57. stderr('Error', 'You are not allowed to delete this page.');   
  58. if (!$sure)
  59. stderr('Sanity check', 'Are you sure you want to delete this page: "'.htmlspecialchars($arr['page_name']).'"? Click <a href="'.$_SERVER['PHP_SELF'].'?action='.$action.'&id='.$id.'&sure=yes">here</a> to delete it or <a href="'.$_SERVER['PHP_SELF'].'">here</a> to go back.');
  60. mysql_query('DELETE FROM staffpanel WHERE id = '.sqlesc($id)) or sqlerr(__FILE__, __LINE__);
  61. if (mysql_affected_rows()){
  62. if ($staff_classes[$CURUSER['class']]['log'])
  63. write_log('Page "'.$arr['page_name'].'"('.($class_color ? '<font color="#'.get_user_class_color($arr['av_class']).'">' : '').get_user_class_name($arr['av_class']).($class_color ? '</font>' : '').') was deleted from the staff panel by <a href="/userdetails.php?id='.$CURUSER['id'].'">'.$CURUSER['username'].'</a>('.($class_color ? '<font color="#'.get_user_class_color($CURUSER['class']).'">' : '').get_user_class_name($CURUSER['class']).($class_color ? '</font>' : '').')');
  64. header('Location: '.$_SERVER['PHP_SELF']);
  65. exit();
  66. }
  67. else
  68. stderr('Error', 'There was a database error, please retry.');
  69. }else if (($action == 'add' && $staff_classes[$CURUSER['class']]['add']) || ($action == 'edit' && is_valid_id($id) && $staff_classes[$CURUSER['class']]['edit']))
  70. {
  71. $names = array('page_name', 'file_name', 'description', 'av_class','image');
  72. if ($action == 'edit')
  73. {
  74. $res = mysql_query('SELECT '.implode(', ', $names).' FROM staffpanel WHERE id = '.sqlesc($id)) or sqlerr(__FILE__, __LINE__);
  75. $arr = mysql_fetch_assoc($res);
  76. }
  77. foreach ($names as $name)
  78. $$name = htmlspecialchars((isset($_POST[$name]) ? $_POST[$name] : ($action == 'edit' ? $arr[$name] : '')));
  79. if ($action == 'edit' && $CURUSER['class'] < $av_class)
  80. stderr('Error', 'You are not allowed to edit this page.');
  81. if ($_SERVER['REQUEST_METHOD'] == 'POST')
  82. {
  83. $errors = array();
  84. if (empty($page_name))
  85. $errors[] = 'The page name cannot be empty.';
  86. if (empty($file_name))
  87. $errors[] = 'The filename cannot be empty.';
  88. if (empty($description))
  89. $errors[] = 'The description cannot be empty.';
  90. if (!isset($staff_classes[$av_class]))
  91. $errors[] = 'The selected class is not a valid staff class.';
  92. if (!is_file($file_name.'.php') && !empty($file_name) && !preg_match('/.php/', $file_name))
  93. $errors[] = 'Inexistent php file.';    
  94. if (strlen($page_name) < 4 && !empty($page_name))
  95. $errors[] = 'The page name is too short (min 4 chars).';       
  96. if (strlen($page_name) > 80)
  97. $errors[] = 'The page name is too long (max 30 chars).';
  98. if (strlen($file_name) > 80)
  99. $errors[] = 'The filename is too long (max 30 chars).';
  100. if (strlen($description) > 100)
  101. $errors[] = 'The description is too long (max 100 chars).';
  102. if (empty($image))
  103. $errors[] = 'empty image name.';
  104. if (empty($errors)){
  105. if ($action == 'add'){
  106. $res = mysql_query("INSERT INTO staffpanel (image,page_name, file_name, description, av_class, added_by, added) ".
  107. "VALUES (".implode(", ", array_map("sqlesc", array($image,$page_name, $file_name, $description, (int)$av_class, (int)$CURUSER['id'], time()))).")");
  108. if (!$res)
  109. {
  110. if (mysql_errno() == 1062)
  111. $errors[] = "This filename is already submited.";
  112. else
  113. $errors[] = "There was a database error, please retry.";
  114. }
  115. }else{
  116. $res = mysql_query("UPDATE staffpanel SET image = ".sqlesc($image)." , page_name = ".sqlesc($page_name).", file_name = ".sqlesc($file_name).", description = ".sqlesc($description).", av_class = ".sqlesc((int)$av_class)." WHERE id = ".sqlesc($id)) or sqlerr(__FILE__, __LINE__);
  117. if (!$res)
  118. $errors[] = "There was a database error, please retry.";
  119. }
  120. if (empty($errors)){
  121. if ($staff_classes[$CURUSER['class']]['log'])
  122. write_log('Page "'.$page_name.'"('.($class_color ? '<font color="#'.get_user_class_color($av_class).'">' : '').get_user_class_name($av_class).($class_color ? '</font>' : '').') in the staff panel was '.($action == 'add' ? 'added' : 'edited').' by <a href="/userdetails.php?id='.$CURUSER['id'].'">'.$CURUSER['username'].'</a>('.($class_color ? '<font color="#'.get_user_class_color($CURUSER['class']).'">' : '').get_user_class_name($CURUSER['class']).($class_color ? '</font>' : '').')');
  123. header('Location: '.$_SERVER['PHP_SELF']);
  124. exit();
  125. }
  126. }
  127. }
  128. $dh = opendir( $TBDEV['pic_base_url'].'admin' );
  129. $files = array();
  130. while ( FALSE !== ( $file = readdir( $dh ) ) )
  131. {
  132. if ( ($file != ".") && ($file != "..") )
  133. {
  134. if ( preg_match( "/^staff_[A-Za-z0-9_]+\.(?:gif|jpg|jpeg|png)$/i", $file ) )
  135. {
  136. $files[] = $file;
  137. }
  138. }
  139. }
  140. closedir( $dh );
  141. if( is_array($files) AND count($files) )
  142. {
  143. $select = "<select name='image'>\n<option value='0'>Select Image</option>\n";
  144. foreach ($files as $f)
  145. {
  146. $selected = ($f == $image) ? " selected='selected'" : "";
  147. $select .= "<option value='" . htmlentities($f, ENT_QUOTES) . "'$selected>" . htmlentities($f, ENT_QUOTES) . "</option>\n";      
  148. }
  149. $select .= "</select>\n";
  150. $check = "<tr><td align='right' width='50%'>Select a new image:<br /><span style='color:limegreen;font-weight:bold;'>Info: If you want a new image, you have to upload it to the /admin/ directory first.</span></td><td>$select</td></tr>";
  151. }else{
  152. $check = "<tr><td align='right' width='50%'>Select a new image:</td><td><span style='color:red;font-weight:bold;'>Warning: There are no images in the directory, please upload one.</span></td></tr>";
  153. }
  154. $HTMLOUT .= begin_main_frame();
  155. $HTMLOUT .= begin_frame("".($action == 'edit' ? 'Edit "'.$page_name.'"' : 'Add a new').' page'."",true);
  156. if (!empty($errors))
  157. {
  158. $HTMLOUT .= stdmsg('There '.(count($errors)>1?'are':'is').' '.count($errors).' error'.(count($errors)>1?'s':'').' in the form.', '<b>'.implode('<br />', $errors).'</b>');
  159. $HTMLOUT .="<br />";
  160. }
  161. $HTMLOUT .="<form name='form1' method='post' action='staffpanel.php'>
  162. <input type='hidden' name='action' value='{$action}' />";
  163. if ($action == 'edit')
  164. {
  165. $HTMLOUT .="<input type='hidden' name='id' value='{$id}' />";
  166. }
  167. $HTMLOUT .="<table cellpadding='5' width='100%' align='center'><tr>
  168. <td class='rowhead' width='1%'>Page name</td><td align='left'><input type='text' size='50' name='page_name' value='{$page_name}' /></td></tr>
  169. <tr><td class='rowhead'>Filename</td><td align='left'><input type='text' size='50' name='file_name' value='{$file_name}' /></td></tr>
  170. <tr><td class='rowhead'>Description</td><td align='left'><input type='text' size='50' name='description' value='{$description}' /></td></tr>
  171. {$check}<tr><td class='rowhead'><span style='white-space: nowrap;'>Available for</span></td>
  172. <td align='left'><select name='av_class'>";
  173. foreach ($staff_classes as $class => $value)
  174. {
  175. if ($CURUSER['class'] < $class)
  176. continue;
  177. $HTMLOUT .= '<option'.($class_color? ' style="background-color:#'.get_user_class_color($class).';"':'').' value="'.$class.'"'.($class == $av_class ? ' selected="selected"':'').'>'.get_user_class_name($class).'</option>';
  178. }
  179. $HTMLOUT .="</select></td></tr></table>
  180. <table><tr><td style='border:none;' align='center'><input type='submit' class='btn' value='Submit' /><input type='button' class='btn' value='Cancel' onclick=\"history.go(-1)\" /></td></tr></table></form>";
  181. $HTMLOUT .= end_frame();
  182. $HTMLOUT .= end_main_frame();
  183. print stdhead('Staff Panel :: '.($action == 'edit' ? 'Edit "'.$page_name.'"' : 'Add a new').' page') . $HTMLOUT . stdfoot();
  184. }else{
  185. $HTMLOUT .=begin_main_frame();
  186. if ($staff_classes[$CURUSER['class']]['add'])
  187. {
  188. $addpage = "<br /><a href='staffpanel.php?action=add' title='Add a new page'><font class='small'>[Add a new page]</font></a>";
  189. }else{
  190. $addpage = "";
  191. }
  192. $HTMLOUT .=begin_frame("Staff Tools $addpage",true);
  193.  
  194. $HTMLOUT .="<table width='900' cellpadding='0'>
  195. <tr><td style='border:none;'>";
  196. $res = mysql_query('SELECT staffpanel.*, users.username '.
  197. 'FROM staffpanel '.
  198. 'LEFT JOIN users ON users.id = staffpanel.added_by '.
  199. 'WHERE av_class <= '.sqlesc($CURUSER['class']).' '.
  200. 'ORDER BY av_class DESC, page_name ASC') or sqlerr(__FILE__, __LINE__);
  201. if (mysql_num_rows($res) == 0)
  202. {
  203. $HTMLOUT .= '<center><h2>Sorry Nothing found.</h2></center>';
  204. }else{
  205. if (mysql_num_rows($res) > 0)
  206. {
  207. $HTMLOUT .="<ul class='buttons-set'>";
  208. $db_classes = $unique_classes = $mysql_data = array();
  209. while ($arr = mysql_fetch_assoc($res))
  210. $mysql_data[] = $arr;
  211. foreach ($mysql_data as $key => $value)
  212. $db_classes[$value['av_class']][] = $value['av_class'];
  213. foreach ($mysql_data as $key => $arr)
  214. {
  215.  
  216. if ($staff_classes[$CURUSER['class']]['edit'])
  217. {
  218. $editb ="<a href='staffpanel.php?action=edit&id=".(int)$arr['id']."'><img src='pic/admin/edit.gif' border='0' alt='Edit !' title='Edit !' /></a>";
  219. }else{
  220. $editb = '';
  221. }              
  222. if ($staff_classes[$CURUSER['class']]['delete'])
  223. {
  224. $deleteb ="<a href='staffpanel.php?action=delete&id=".(int)$arr['id']."'><img src='pic/admin/delete.gif' border='0' alt='Delete !' title='Delete !' /></a>";
  225. }else{
  226. $deleteb = '';
  227. }
  228. $info = "<a href='userdetails.php?id=".(int)$arr['added_by']."'><img src='pic/admin/info.gif' border='0' alt='Added by ".$arr['username']."<br />on ".get_date($arr['added'], 'LONG',0,1)."' title='Added by ".$arr['username'].", ".get_date($arr['added'], 'LONG',0,1)."' /></a>";
  229.  
  230. if (!in_array($arr['av_class'], $unique_classes))
  231. $unique_classes[] = $arr['av_class'];
  232. $HTMLOUT .="<li><center>$editb $deleteb $info</center><a class='button1' href='".htmlspecialchars($arr['file_name'])."' title='".htmlspecialchars($arr['page_name'])."'><span><img width='32' height='32' src='pic/admin/".$arr['image']."' alt='".htmlspecialchars($arr['page_name'])."' title='".htmlspecialchars($arr['page_name'])."'/>
  233. <br /><font class='small'>".htmlspecialchars($arr['description'])."</font></span></a></li>";
  234. $i='';
  235. $i++;
  236. }  
  237. }
  238. $HTMLOUT .="</ul>";
  239. }
  240. $HTMLOUT .="</td></tr></table>";
  241. $HTMLOUT .= end_frame();
  242. $HTMLOUT .= end_main_frame();
  243. /////////////////output\\\\\\\\\\
  244. print stdhead("Staff Panel") . $HTMLOUT . stdfoot();
  245. }
  246. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!