Fixes for 'empty version'

[mailer.git] / inc / modules / admin / admin-inc.php

diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php
index 22b09b64e0cdc2bd530582d019e21d3e5773de18..c43101826b69b249db598a5e4fd66fa428a6d43c 100644 (file)
--- a/inc/modules/admin/admin-inc.php
+++ b/inc/modules/admin/admin-inc.php
@@ -1,7 +1,7 @@
 <?php
 /************************************************************************
 <?php
 /************************************************************************

- * MXChange v0.2.1                                    Start: 08/31/2003 *
- * ===============                              Last change: 11/23/2004 *
+ * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
+ * ===================                          Last change: 11/23/2004 *

  *                                                                      *
  * -------------------------------------------------------------------- *
  * File              : admin-inc.php                                    *
  *                                                                      *
  * -------------------------------------------------------------------- *
  * File              : admin-inc.php                                    *


@@ -51,7 +51,7 @@ function addAdminAccount ($user, $md5, $email) {
                array($user), __FUNCTION__, __LINE__);
 
        // Is the entry there?
                array($user), __FUNCTION__, __LINE__);
 
        // Is the entry there?

-       if (SQL_NUMROWS($result) == 0) {
+       if (SQL_NUMROWS($result) == '0') {

                // Ok, let's create the admin login
                SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')",
                        array(
                // Ok, let's create the admin login
                SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')",
                        array(


@@ -59,6 +59,8 @@ function addAdminAccount ($user, $md5, $email) {
                                $md5,
                                $email
                        ), __FUNCTION__, __LINE__);
                                $md5,
                                $email
                        ), __FUNCTION__, __LINE__);

+
+               // All done

                $ret = 'done';
        } // END - if
 
                $ret = 'done';
        } // END - if
 


@@ -114,12 +116,13 @@ function ifAdminLoginDataIsValid ($admin, $password) {
                SQL_FREERESULT($result);
        }
 
                SQL_FREERESULT($result);
        }
 

-       //* DEBUG: */ outputHtml("*".$data['password'].'/'.md5($password).'/'.$ret."<br />");
+       //* DEBUG: */ outputHtml('*' . $data['password'] . '/' . md5($password) .'/' . $ret . '*<br />');

        if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) {
                // Generate new hash
                $data['password'] = generateHash($password);
 
                // Is the sql_patches not installed, than we cannot have a valid hashed password here!
        if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) {
                // Generate new hash
                $data['password'] = generateHash($password);
 
                // Is the sql_patches not installed, than we cannot have a valid hashed password here!

+               //* DEBUG: */ outputHtml($ret . ',' . intval(isExtensionInstalledAndOlder('sql_patches', '0.3.6')) . '/' . intval(!isExtensionInstalled('sql_patches')).'<br />');

                if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done';
        } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) {
                // Old hashing way
                if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done';
        } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) {
                // Old hashing way


@@ -133,8 +136,8 @@ function ifAdminLoginDataIsValid ($admin, $password) {
        $salt = substr($data['password'], 0, -40);
 
        // Check if password is same
        $salt = substr($data['password'], 0, -40);
 
        // Check if password is same

-       //* DEBUG: */ outputHtml("*".$ret.','.$data['password'].','.$password.','.$salt."*<br />");
-       if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) {
+       //* DEBUG: */ outputHtml('*' . $ret . ',' . $data['password'] . ',' . $password . ',' . $salt . '*<br />');
+       if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == md5($password))) {

                // Re-hash the plain passord with new random salt
                $data['password'] = generateHash($password);
 
                // Re-hash the plain passord with new random salt
                $data['password'] = generateHash($password);
 


@@ -210,8 +213,6 @@ function doAdminLogin ($adminLogin, $passHash) {
                setSession('admin_login', $adminLogin)
        ) && (
                setSession('admin_last', time())
                setSession('admin_login', $adminLogin)
        ) && (
                setSession('admin_last', time())

-       ) && (
-               setSession('admin_to', bigintval(postRequestElement('timeout')))

        ));
 }
 
        ));
 }
 


@@ -249,8 +250,8 @@ function doAdminAction () {
                // Default admin action is the overview page
                $what = 'overview';
        } else {
                // Default admin action is the overview page
                $what = 'overview';
        } else {

-               // Compile out some chars
-               $what = compileCode($what, false, false, false);
+               // Secure it
+               $what = secureString($what);

        }
 
        // Get action value
        }
 
        // Get action value


@@ -272,12 +273,6 @@ function doAdminAction () {
        // Tableset header
        loadTemplate('admin_main_header', false, $content);
 
        // Tableset header
        loadTemplate('admin_main_header', false, $content);
 

-       // Is sql_patches not yet installed?
-       if (!isExtensionInstalled('sql_patches')) {
-               // Output warning
-               loadTemplate('admin_settings_saved', false, getMessage('ADMIN_WARNING_SQL_PATCHES_MISSING'));
-       } // END - if
-

        // Check if action/what pair is valid
        $result_action = SQL_QUERY_ESC("SELECT
        `id`
        // Check if action/what pair is valid
        $result_action = SQL_QUERY_ESC("SELECT
        `id`


@@ -297,7 +292,13 @@ WHERE
                )
        )
 LIMIT 1",
                )
        )
 LIMIT 1",

-               array($action, $what, $what), __FUNCTION__, __LINE__);
+               array(
+                       $action,
+                       $what,
+                       $what
+               ), __FUNCTION__, __LINE__);
+
+       // Do we have an entry?

        if (SQL_NUMROWS($result_action) == 1) {
                // Is valid but does the inlcude file exists?
                $inc = sprintf("inc/modules/admin/action-%s.php", $action);
        if (SQL_NUMROWS($result_action) == 1) {
                // Is valid but does the inlcude file exists?
                $inc = sprintf("inc/modules/admin/action-%s.php", $action);


@@ -313,7 +314,7 @@ LIMIT 1",
                }
        } else {
                // Invalid action/what pair found!
                }
        } else {
                // Invalid action/what pair found!

-               loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $action.'/'.$what));
+               loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $action . '/' . $what));

        }
 
        // Free memory
        }
 
        // Free memory


@@ -343,6 +344,8 @@ WHERE
 ORDER BY
        `sort` ASC,
        `id` DESC", __FUNCTION__, __LINE__);
 ORDER BY
        `sort` ASC,
        `id` DESC", __FUNCTION__, __LINE__);

+
+       // Do we have entries?

        if (SQL_NUMROWS($result_main) > 0) {
                $OUT = "<div style=\"height:7px\" class=\"seperator\">&nbsp;</div>\n";
                $OUT .= "<ul class=\"admin_menu_main\">\n";
        if (SQL_NUMROWS($result_main) > 0) {
                $OUT = "<div style=\"height:7px\" class=\"seperator\">&nbsp;</div>\n";
                $OUT .= "<ul class=\"admin_menu_main\">\n";


@@ -355,6 +358,12 @@ ORDER BY
                                $ACL = true;
                        }
 
                                $ACL = true;
                        }
 

+                       // Filename
+                       $inc = sprintf("inc/modules/admin/action-%s.php", $menu);
+
+                       // Is the file readable?
+                       $readable = isIncludeReadable($inc);
+

                        if ($ACL === true) {
                                if ($SUB === false) {
                                        // Insert compiled menu title and description
                        if ($ACL === true) {
                                if ($SUB === false) {
                                        // Insert compiled menu title and description


@@ -364,18 +373,26 @@ ORDER BY
                                $OUT .= "<li class=\"admin_menu\">
 <div class=\"nobr\"><strong>&middot;</strong>&nbsp;";
 
                                $OUT .= "<li class=\"admin_menu\">
 <div class=\"nobr\"><strong>&middot;</strong>&nbsp;";
 

-                               if (($menu == $action) && (empty($what))) {
-                                       $OUT .= "<strong>";
+                               if ($readable === true) {
+                                       if (($menu == $action) && (empty($what))) {
+                                               $OUT .= "<strong>";
+                                       } else {
+                                               $OUT .= "[<a href=\"{?URL?}/modules.php?module=admin&amp;action=".$menu."\">";
+                                       }

                                } else {
                                } else {

-                                       $OUT .= "[<a href=\"{?URL?}/modules.php?module=admin&amp;action=".$menu."\">";
+                                       $OUT .= "<em style=\"cursor:help\" class=\"admin_note\" title=\"{--MENU_ACTION_404--}\">";

                                }
 
                                $OUT .= $title;
 
                                }
 
                                $OUT .= $title;
 

-                               if (($menu == $action) && (empty($what))) {
-                                       $OUT .= "</strong>";
+                               if ($readable === true) {
+                                       if (($menu == $action) && (empty($what))) {
+                                               $OUT .= "</strong>";
+                                       } else {
+                                               $OUT .= "</a>]";
+                                       }

                                } else {
                                } else {

-                                       $OUT .= "</a>]";
+                                       $OUT .= "</em>";

                                }
 
                                $OUT .= "</div>
                                }
 
                                $OUT .= "</div>


@@ -516,12 +533,12 @@ function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=fal
 function adminMenuSelectionBox_DEPRECATED ($mode, $default = '', $defid = '') {
        $what = "`what` != ''";
        if ($mode == 'action') $what = "(`what`='' OR `what` IS NULL) AND action !='login'";
 function adminMenuSelectionBox_DEPRECATED ($mode, $default = '', $defid = '') {
        $what = "`what` != ''";
        if ($mode == 'action') $what = "(`what`='' OR `what` IS NULL) AND action !='login'";

-       $result = SQL_QUERY_ESC("SELECT %s, title FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE ".$what." ORDER BY `sort`",
+       $result = SQL_QUERY_ESC("SELECT %s, `title` FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE ".$what." ORDER BY `sort` ASC",

                array($mode), __FUNCTION__, __LINE__);
        if (SQL_NUMROWS($result) > 0) {
                // Load menu as selection
                $OUT = "<select name=\"".$mode."_menu";
                array($mode), __FUNCTION__, __LINE__);
        if (SQL_NUMROWS($result) > 0) {
                // Load menu as selection
                $OUT = "<select name=\"".$mode."_menu";

-               if ((!empty($defid)) || ($defid == 0)) $OUT .= "[".$defid."]";
+               if ((!empty($defid)) || ($defid == '0')) $OUT .= "[".$defid."]";

                $OUT .= "\" size=\"1\" class=\"admin_select\">
        <option value=\"\">{--SELECT_NONE--}</option>\n";
                // @TODO Try to rewrite this to $content = SQL_FETCHARRAY(). Please look some lines above for the dynamic query
                $OUT .= "\" size=\"1\" class=\"admin_select\">
        <option value=\"\">{--SELECT_NONE--}</option>\n";
                // @TODO Try to rewrite this to $content = SQL_FETCHARRAY(). Please look some lines above for the dynamic query


@@ -567,9 +584,6 @@ function adminSaveSettings (&$postData, $tableName = '_config', $whereStatement
 
                        // Shall we process this id? It muss not be empty, of course
                        if (($skip === false) && (!empty($id)) && (!isset($GLOBALS['skip_config'][$id]))) {
 
                        // Shall we process this id? It muss not be empty, of course
                        if (($skip === false) && (!empty($id)) && (!isset($GLOBALS['skip_config'][$id]))) {

-                               // Save this entry
-                               $val = compileCode($val);
-

                                // Translate the value? (comma to dot!)
                                if ((is_array($translateComma)) && (in_array($id, $translateComma))) {
                                        // Then do it here... :)
                                // Translate the value? (comma to dot!)
                                if ((is_array($translateComma)) && (in_array($id, $translateComma))) {
                                        // Then do it here... :)


@@ -695,7 +709,7 @@ function generateUserProfileLink ($userid, $title = '', $what = 'list_user') {
                $title = $userid;
        } // END - if
 
                $title = $userid;
        } // END - if
 

-       if (($title == 0) && ($what == 'list_refs')) {
+       if (($title == '0') && ($what == 'list_refs')) {

                // Return title again
                return $title;
        } elseif (isExtensionActive('nickname')) {
                // Return title again
                return $title;
        } elseif (isExtensionActive('nickname')) {


@@ -746,7 +760,7 @@ function adminGetMenuMode () {
 
 // Change activation status
 function adminChangeActivationStatus ($IDs, $table, $row, $idRow = 'id') {
 
 // Change activation status
 function adminChangeActivationStatus ($IDs, $table, $row, $idRow = 'id') {

-       $cnt = 0; $newStatus = 'Y';
+       $cnt = '0'; $newStatus = 'Y';

        if ((is_array($IDs)) && (count($IDs) > 0)) {
                // "Walk" all through and count them
                foreach ($IDs as $id => $selected) {
        if ((is_array($IDs)) && (count($IDs) > 0)) {
                // "Walk" all through and count them
                foreach ($IDs as $id => $selected) {


@@ -1024,7 +1038,7 @@ function adminEditEntriesConfirm ($IDs, $table, $columns=array(), $filterFunctio
                // Shall we change here or list for editing?
                if ($editNow === true) {
                        // Change them all
                // Shall we change here or list for editing?
                if ($editNow === true) {
                        // Change them all

-                       $affected = 0;
+                       $affected = '0';

                        foreach ($IDs as $id => $sel) {
                                // Prepare content array (new values)
                                $content = array();
                        foreach ($IDs as $id => $sel) {
                                // Prepare content array (new values)
                                $content = array();


@@ -1156,15 +1170,12 @@ function sendAdminPasswordResetLink ($email) {
        // Init output
        $OUT = '';
 
        // Init output
        $OUT = '';
 

-       // Compile out security characters (must be for looking up!)
-       $email = compileCode($email);
-

        // Look up administator login
        $result = SQL_QUERY_ESC("SELECT `id`, `login`, `password` FROM `{?_MYSQL_PREFIX?}_admins` WHERE `email`='%s' LIMIT 1",
                array($email), __FUNCTION__, __LINE__);
 
        // Is there an account?
        // Look up administator login
        $result = SQL_QUERY_ESC("SELECT `id`, `login`, `password` FROM `{?_MYSQL_PREFIX?}_admins` WHERE `email`='%s' LIMIT 1",
                array($email), __FUNCTION__, __LINE__);
 
        // Is there an account?

-       if (SQL_NUMROWS($result) == 0) {
+       if (SQL_NUMROWS($result) == '0') {

                // No account found!
                return getMessage('ADMIN_NO_LOGIN_WITH_EMAIL');
        } // END - if
                // No account found!
                return getMessage('ADMIN_NO_LOGIN_WITH_EMAIL');
        } // END - if


@@ -1197,12 +1208,9 @@ function adminResetValidateHashLogin ($hash, $login) {
        // By default nothing validates... ;)
        $valid = false;
 
        // By default nothing validates... ;)
        $valid = false;
 

-       // Compile the login for lookup
-       $login = compileCode($login);
-

        // Then try to find that user
        $result = SQL_QUERY_ESC("SELECT `id`, `password`, `email` FROM `{?_MYSQL_PREFIX?}_admins` WHERE `login`='%s' LIMIT 1",
        // Then try to find that user
        $result = SQL_QUERY_ESC("SELECT `id`, `password`, `email` FROM `{?_MYSQL_PREFIX?}_admins` WHERE `login`='%s' LIMIT 1",

-       array($login), __FUNCTION__, __LINE__);
+               array($login), __FUNCTION__, __LINE__);

 
        // Is an account here?
        if (SQL_NUMROWS($result) == 1) {
 
        // Is an account here?
        if (SQL_NUMROWS($result) == 1) {


@@ -1210,7 +1218,7 @@ function adminResetValidateHashLogin ($hash, $login) {
                $content = SQL_FETCHARRAY($result);
 
                // Generate hash again
                $content = SQL_FETCHARRAY($result);
 
                // Generate hash again

-               $hashFromData = generateHash(getConfig('URL').':'.$content['id'].':'.$login.':'.$content['password'], substr($content['password'], 10));
+               $hashFromData = generateHash(getConfig('URL') . ':' . $content['id'] . ':' . $login . ':' . $content['password'], substr($content['password'], 10));

 
                // Does both match?
                $valid = ($hash == $hashFromData);
 
                // Does both match?
                $valid = ($hash == $hashFromData);


@@ -1313,5 +1321,35 @@ function adminCreateUserLink ($userid) {
        return '{?URL?}/modules.php?module=admin&amp;what=list_user';
 }
 
        return '{?URL?}/modules.php?module=admin&amp;what=list_user';
 }
 

+// Generate a "link" for the given admin id (admin_id)
+function generateAdminLink ($adminId) {
+       // No assigned admin is default
+       $adminLink = "<span class=\"admin_note\">{--ADMIN_NO_ADMIN_ASSIGNED--}</span>";
+
+       // Zero? = Not assigned
+       if (bigintval($adminId) > 0) {
+               // Load admin's login
+               $login = getAdminLogin($adminId);
+
+               // Is the login valid?
+               if ($login != '***') {
+                       // Is the extension there?
+                       if (isExtensionActive('admins')) {
+                               // Admin found
+                               $adminLink = "<a href=\"".generateEmailLink(getAdminEmail($adminId), 'admins')."\">" . $login."</a>";
+                       } else {
+                               // Extension not found
+                               $adminLink = sprintf(getMessage('EXTENSION_PROBLEM_NOT_INSTALLED'), 'admins');
+                       }
+               } else {
+                       // Maybe deleted?
+                       $adminLink = "<div class=\"admin_note\">".sprintf(getMessage('ADMIN_ID_404'), $adminId)."</div>";
+               }
+       } // END - if
+
+       // Return result
+       return $adminLink;
+}
+

 // [EOF]
 ?>
 // [EOF]
 ?>