Security line in all includes changed
[mailer.git] / inc / modules / admin / overview-inc.php
index 2a3ac6f0deb56013459eec945a89e37cd31a80d7..57d77aa258da85f4a968e68bec8cbfd5971a6e8e 100644 (file)
  ************************************************************************/
 
 // Some security stuff...
-if ((ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) || (!IS_ADMIN()))
-{
+if ((!defined('__SECURITY')) || (!IS_ADMIN())) {
        $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
        require($INC);
 }
 
 function OUTPUT_STANDARD_OVERVIEW(&$result_tasks)
 {
-       global $EXTENSIONS, $KEEP_ACTIVE;
+       global $cacheArray, $cacheArray;
 
        // First check for solved and not assigned tasks and assign them to current admin
        $result_task = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='%s' WHERE assigned_admin < 1 AND status != 'NEW'",
-        array(GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
+        array(GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
 
        // We currently don't want to install an extension so let's find out if we need...
-       $EXT_LOAD_MODE = "register"; $JOBS_DONE = true;
+       $EXT_LOAD_MODE = "register";
+       $JOBS_DONE = true;
 
        // Open the extension directory
        $handle = opendir(PATH."inc/extensions/") or mxchange_die("Cannot read extension directory!");
@@ -58,17 +58,16 @@ function OUTPUT_STANDARD_OVERVIEW(&$result_tasks)
                        // Possible newly installed extension found so we extract extension's name
                        $ext = strtolower(substr($file, 4, -4)); // Keep always extension names on lower case!!!
 
-                       // Check if extension is installed or not
+                       // Init variables
                        $ext_ver = "";
-                       if ((!is_array($EXTENSIONS['ext_version'])) || (empty($EXTENSIONS['ext_version'][$ext]))) {
-                               // Load data from database
-                               $result = SQL_QUERY_ESC("SELECT id, ext_version FROM "._MYSQL_PREFIX."_extensions WHERE ext_name='%s' LIMIT 1",
-                                array($ext), __FILE__, __LINE__);
-                       } else {
+                       $result = false;
+
+                       // Check if extension is installed or not
+                       if ((is_array($cacheArray['extensions']['ext_version'])) && (isset($cacheArray['extensions']['ext_version'][$ext]))) {
                                // Load version from cache
-                               if (!empty($EXTENSIONS['ext_version'][$ext])) {
+                               if (!empty($cacheArray['extensions']['ext_version'][$ext])) {
                                        // Extension is installed so we can get it's version number
-                                       $ext_ver = $EXTENSIONS['ext_version'][$ext];
+                                       $ext_ver = $cacheArray['extensions']['ext_version'][$ext];
                                } else {
                                        // Extension is not installed so no version number was found
                                        $ext_ver = "";
@@ -76,58 +75,25 @@ function OUTPUT_STANDARD_OVERVIEW(&$result_tasks)
 
                                // Disable load from database
                                $result = false;
+                       } elseif (!EXT_IS_ACTIVE("cache")) {
+                               // Load data from database
+                               $result = SQL_QUERY_ESC("SELECT id, ext_version FROM "._MYSQL_PREFIX."_extensions WHERE ext_name='%s' LIMIT 1",
+                                array($ext), __FILE__, __LINE__);
                        }
 
                        // Is the extension not yet installed?
                        if ((SQL_NUMROWS($result) == 0) && (empty($ext_ver))) {
-                               // Not installed and do we have created a task for the admin?
-                               $ext_subj = "[".$ext.":] ".ADMIN_NEW_EXT_SUBJ;
-                               //* DEBUG: */ echo $ext.":".$ext_ver."=";
-                               $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_task_system WHERE subject='%s' LIMIT 1",
-                                array($ext_subj), __FILE__, __LINE__);
-                               //* DEBUG: */ echo SQL_NUMROWS($result)."<br />\n";
-                               if ((SQL_NUMROWS($result) == 0) && (GET_EXT_VERSION($ext) == ""))
-                               {
-                                       // Template file
-                                       $tpl = sprintf("%stemplates/%s/html/ext/ext_%s.tpl",
-                                               PATH,
-                                               GET_LANGUAGE(),
-                                               $ext
-                                       );
-
-                                       // Load text for task
-                                       if ((file_exists($tpl)) && (is_readable($tpl)))
-                                       {
-                                               // Load extension's own text template (HTML!)
-                                               $MSG = LOAD_TEMPLATE("ext_".$ext, true);
-                                       }
-                                        else
-                                       {
-                                               // Load default message
-                                               $MSG = LOAD_EMAIL_TEMPLATE("admin_new_ext","", 0);
-                                       }
-
-                                       // Task not created so it's a brand-new extension which we need to register and create a task for!
-                                       $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_task_system (assigned_admin, userid, status, task_type, subject, text, task_created)
-VALUES ('%s', '0', 'NEW', 'EXTENSION', '%s', '%s', UNIX_TIMESTAMP())",
- array(
-       GET_ADMIN_ID($_COOKIE['admin_login']),
-       $ext_subj,
-       addslashes($MSG),
-),  __FILE__, __LINE__, true, false);
-                               }
+                               // Generate subject line
+                               $ext_subj = sprintf("[%s:]", $ext);
 
-                               // Free memory
-                               SQL_FREERESULT($result);
+                               // Create a task for newly installed extension
+                               CREATE_NEW_EXTENSION_TASK(GET_ADMIN_ID(get_session('admin_login')), $ext_subj, $ext);
 
                                // We maybe want to install an extension so let's test-drive it...
                                include(PATH."inc/extensions/".$file);
-                       }
-                        else
-                       {
+                       } else {
                                // Maybe we want to update?
-                               if ((empty($EXTENSIONS['ext_version'][$ext])) && (SQL_NUMROWS($result) == 1))
-                               {
+                               if ((empty($cacheArray['extensions']['ext_version'][$ext])) && (SQL_NUMROWS($result) == 1)) {
                                        list($dummy, $ext_ver) = SQL_FETCHROW($result);
                                        SQL_FREERESULT($result);
                                }
@@ -135,16 +101,19 @@ VALUES ('%s', '0', 'NEW', 'EXTENSION', '%s', '%s', UNIX_TIMESTAMP())",
                                // Update extension
                                if (!empty($ext_ver)) EXTENSION_UPDATE($file, $ext, $ext_ver);
 
-                               if (!empty($KEEP_ACTIVE[$ext]))
-                               {
+                               if (!empty($cacheArray['active_extensions'][$ext])) {
                                        // Maybe we want to keept the current extension active?
-                                       if (($KEEP_ACTIVE[$ext] == 'Y') && (!EXT_IS_ACTIVE($ext, true, true)))
-                                       {
+                                       if (($cacheArray['active_extensions'][$ext] == "Y") && (!EXT_IS_ACTIVE($ext))) {
                                                // Reactivate this extension!
                                                $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_extensions SET ext_active='Y' WHERE ext_name='%s' LIMIT 1",
                                                 array($ext), __FILE__, __LINE__);
-                                               EXTENSION_RUN_SQLS(GET_EXT_ID($ext), "activate");
-                                       }
+
+                                               // Extension has been activated?
+                                               if (SQL_AFFECTEDROWS() == 1) {
+                                                       // Then run all queries
+                                                       EXTENSION_RUN_SQLS(GET_EXT_ID($ext), "activate");
+                                               } // END - if
+                                       } // END - if
                                }
                        }
                }
@@ -158,54 +127,55 @@ VALUES ('%s', '0', 'NEW', 'EXTENSION', '%s', '%s', UNIX_TIMESTAMP())",
 FROM "._MYSQL_PREFIX."_task_system
 WHERE assigned_admin='%s' OR (assigned_admin='0' AND status='NEW')
 ORDER BY userid DESC, task_type DESC, subject, task_created DESC",
-        array(GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
-       if (SQL_NUMROWS($result_tasks) > 0)
-       {
+        array(GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
+
+       if (SQL_NUMROWS($result_tasks) > 0) {
                // New jobs found!
                $JOBS_DONE = false;
        }
 
+       // Free the result
+       SQL_FREERESULT($result);
+
+       // Return status
        return $JOBS_DONE;
 }
+
 //
-function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
-{
-       global $CONFIG, $NOTES;
-       if ((isset($_POST['assign'])) && (count($_POST['task']) > 0))
-       {
+function OUTPUT_SELECTED_TASKS($_POST, $result_tasks) {
+       global $_CONFIG, $NOTES;
+       if ((isset($_POST['assign'])) && (count($_POST['task']) > 0)) {
                // Assign / do tasks
                $OUT = ""; $SW = 2;
-               foreach ($_POST['task'] as $id=>$sel)
-               {
-                       $result_task = SQL_QUERY_ESC("SELECT id, userid, task_type, subject, text, task_created, status, assigned_admin FROM "._MYSQL_PREFIX."_task_system WHERE id=%d AND (assigned_admin='%s' OR (assigned_admin='0' AND status='NEW')) LIMIT 1",
-                        array(bigintval($id), GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
-                       if (SQL_NUMROWS($result_task) == 1)
-                       {
+               foreach ($_POST['task'] as $id => $sel) {
+                       $result_task = SQL_QUERY_ESC("SELECT id, userid, task_type, subject, text, task_created, status, assigned_admin FROM "._MYSQL_PREFIX."_task_system WHERE id=%s AND (assigned_admin='%s' OR (assigned_admin='0' AND status='NEW')) LIMIT 1",
+                        array(bigintval($id), GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
+                       if (SQL_NUMROWS($result_task) == 1) {
                                // Task is valid...
                                list($tid, $uid, $type, $subj, $text, $created, $status, $aid) = SQL_FETCHROW($result_task);
                                SQL_FREERESULT($result_task);
-                               if ($aid == "0")
-                               {
+
+                               if ($aid == "0") {
                                        // Assgin current admin to unassgigned task
-                                       $result_assign = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='%s' WHERE id=%d LIMIT 1",
-                                        array(GET_ADMIN_ID($_COOKIE['admin_login']), bigintval($tid)), __FILE__, __LINE__);
+                                       $result_assign = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='%s' WHERE id=%s LIMIT 1",
+                                        array(GET_ADMIN_ID(get_session('admin_login')), bigintval($tid)), __FILE__, __LINE__);
                                }
+
                                $ADD = "";
-                               if ($type == "SUPPORT_MEMBER")
-                               {
+                               if ($type == "SUPPORT_MEMBER") {
                                        $mode = substr($text, 0, strpos($text, ":"));
                                        $text = substr($text, strpos($text, ":") + 1);
                                        $ADD = "<LI>".ADMIN_TASK_SUPPORT_MODE.": <STRONG>".$mode."</STRONG></LI>";
                                }
-                               if ($uid > 0)
-                               {
-                                       $result_user = SQL_QUERY_ESC("SELECT sex, surname, family, email FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1",
+
+                               if ($uid > 0) {
+                                       $result_user = SQL_QUERY_ESC("SELECT gender, surname, family, email FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
                                         array(bigintval($uid)), __FILE__, __LINE__);
                                        if (SQL_NUMROWS($result_user) == 1)
                                        {
-                                               list($sex, $sname, $fname, $email) = SQL_FETCHROW($result_user);
+                                               list($gender, $sname, $fname, $email) = SQL_FETCHROW($result_user);
                                                SQL_FREERESULT($result_user);
-                                               $ADD = "<LI>".ADMIN_MEMBER_UID.": <STRONG>".ADMIN_USER_PROFILE_LINK($uid)." (<A href=\"".CREATE_EMAIL_LINK($email, "user_data")."\">".TRANSLATE_SEX($sex)." ".$sname." ".$fname."</A>)</STRONG></LI>";
+                                               $ADD = "<LI>".ADMIN_MEMBER_UID.": <STRONG>".ADMIN_USER_PROFILE_LINK($uid)." (<A href=\"".CREATE_EMAIL_LINK($email, "user_data")."\">".TRANSLATE_GENDER($gender)." ".$sname." ".$fname."</A>)</STRONG></LI>";
                                        }
                                }
 
@@ -217,11 +187,9 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                $title = TASK_NO_TITLE;
 
                                // Shall I list SQL commands assigned to an extension installation or update task?
-                               if (((GET_EXT_VERSION("sql_patches") != "") && ($CONFIG['verbose_sql'] == 'Y')) || (!EXT_IS_ACTIVE("sql_patches")))
-                               {
+                               if (((GET_EXT_VERSION("sql_patches") != '') && ($_CONFIG['verbose_sql'] == "Y")) || (!EXT_IS_ACTIVE("sql_patches"))) {
                                        $ext_name = substr($subj, 1, strpos($subj, ":") - 1);
-                                       if ($type == "EXTENSION")
-                                       {
+                                       if ($type == "EXTENSION") {
                                                // Load SQL commands for registering
                                                $SQLs = EXTENSION_REGISTER($ext_name, $id, true);
 
@@ -230,9 +198,7 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
 
                                                // Set title
                                                $title = ADMIN_SQLS_EXECUTED_ON_REGISTER;
-                                       }
-                                        elseif ($type == "EXTENSION_UPDATE")
-                                       {
+                                       } elseif ($type == "EXTENSION_UPDATE") {
                                                // Load SQL commands for update (already done!)
                                                $ext_name = substr($ext_name, 7);
                                                $ext_name = substr($ext_name, 0, strpos($ext_name, "-"));
@@ -248,9 +214,7 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
 
                                                // Set title
                                                $title = ADMIN_SQLS_EXECUTED_ON_UPDATE;
-                                       }
-                                        else
-                                       {
+                                       } else {
                                                // Remove extension's name
                                                $ext_name = "";
                                        }
@@ -258,13 +222,11 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                        // Add SQLs to a table
                                        if (empty($SQLs)) $SQLs = array();
                                        if (empty($title)) $title = "";
-                                       if ((!empty($ext_name)) && (GET_EXT_VERSION("sql_patches")) && ($CONFIG['verbose_sql'] == 'Y')) {
+                                       if ((!empty($ext_name)) && (GET_EXT_VERSION("sql_patches")) && ($_CONFIG['verbose_sql'] == "Y")) {
                                                // Add verbose SQL table
-                                               $text .= EXTENSION_VERBOSE_TABLE($SQLs, $title, " class=\"admin_table top2 left2 right2\"", true, "100%")."<BR>\n";
+                                               $text .= EXTENSION_VERBOSE_TABLE($SQLs, $title, " class=\"admin_table top2 left2 right2\"", true, "100%")."<br />\n";
                                        }
-                               }
-                                else
-                               {
+                               } else {
                                        // Run SQL commands in dry mode but only return the notes
                                        $SQLs = EXTENSION_UPDATE("ext-".$ext_name.".php", $ext_name, $ext_ver, true);
                                        $text .= $NOTES;
@@ -292,24 +254,19 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                         array($ext_name), __FILE__, __LINE__);
                                        $lines = SQL_NUMROWS($result_lines);
                                        SQL_FREERESULT($result_lines);
-                                       if ($lines == "0")
-                                       {
+                                       if ($lines == "0") {
                                                // New extension found
                                                $OUT .= LOAD_TEMPLATE("admin_ext_reg_form", true, array(
                                                        'id'       => bigintval($id),
                                                        'ext_name' => $ext_name
                                                ));
-                                       }
-                                        else
-                                       {
+                                       } else {
                                                // Task is closed so nothing is todo
                                                $OUT .= "<FONT class=\"admin_failed\">".ADMIN_EXT_ALREADY_REGISTERED."</FONT>\n";
 
                                                // Close task but not already closes or deleted or update tasks
-                                               if (($status != "CLOSED") && ($status != "DELETED") && ($type != "EXTENSION_UPDATE"))
-                                               {
-                                                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET status='SOLVED' WHERE id=%d LIMIT 1",
-                                                        array(bigintval($tid)), __FILE__, __LINE__);
+                                               if (($status != "CLOSED") && ($status != "DELETED") && ($type != "EXTENSION_UPDATE")) {
+                                                       ADMIN_SOLVE_TASK($tid);
                                                }
                                        }
                                        break;
@@ -319,10 +276,9 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                        $OUT .= "<FONT class=\"admin_failed medium\">".ADMIN_EXTENSION_UPDATED."</FONT>\n";
 
                                        // Close task
-                                       if (($status != "CLOSED") && ($status != "DELETED"))
-                                       {
-                                               $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET status='SOLVED' WHERE id=%d LIMIT 1",
-                                                array(bigintval($tid)), __FILE__, __LINE__);
+                                       if (($status != "CLOSED") && ($status != "DELETED")) {
+                                               // Solve the task
+                                               ADMIN_SOLVE_TASK($tid);
                                        }
                                        break;
 
@@ -339,7 +295,7 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                        if (EXT_IS_ACTIVE("payout"))
                                        {
                                                // Extension is installed so let him send a notification to the user
-                                               $result_pay = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_payouts WHERE userid=%d AND payout_timestamp=%d LIMIT 1",
+                                               $result_pay = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_payouts WHERE userid=%s AND payout_timestamp=%s LIMIT 1",
                                                 array(bigintval($uid), bigintval($created)), __FILE__, __LINE__);
                                                list($pid) = SQL_FETCHROW($result_pay);
                                                SQL_FREERESULT($result_pay);
@@ -370,7 +326,7 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                        if (EXT_IS_ACTIVE("wernis"))
                                        {
                                                // Extension is installed so let him send a notification to the user
-                                               $result_pay = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_wernis WHERE userid=%d AND wernis_timestamp=%d LIMIT 1",
+                                               $result_pay = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_user_wernis WHERE userid=%s AND wernis_timestamp=%s LIMIT 1",
                                                 array(bigintval($uid), bigintval($created)), __FILE__, __LINE__);
                                                list($pid) = SQL_FETCHROW($result_pay);
                                                SQL_FREERESULT($result_pay);
@@ -402,7 +358,7 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                                        break;
 
                                case "NL_UNSUBSCRIBE": // Newsletter unsubscriptions
-                                       $result = SQL_QUERY_ESC("SELECT nl_timespan FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1",
+                                       $result = SQL_QUERY_ESC("SELECT nl_timespan FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
                                         array(bigintval($uid)), __FILE__, __LINE__);
                                        list($span) = SQL_FETCHROW($result);
                                        SQL_FREERESULT($result);
@@ -446,25 +402,25 @@ function OUTPUT_SELECTED_TASKS($_POST, $result_tasks)
                        if (!empty($_POST['unassign']))
                        {
                                // Unassign from tasks
-                               foreach ($_POST['task'] as $id=>$sel)
+                               foreach ($_POST['task'] as $id => $sel)
                                {
-                                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='0' WHERE id=%d AND assigned_admin='%s' LIMIT 1",
-                                        array(bigintval($id), GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
+                                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin=0 WHERE id=%s AND assigned_admin=%s LIMIT 1",
+                                        array(bigintval($id), GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
                                }
                        }
                         elseif (isset($_POST['del']))
                        {
                                // Delete tasks
-                               foreach ($_POST['task'] as $id=>$sel)
+                               foreach ($_POST['task'] as $id => $sel)
                                {
-                                       $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_task_system WHERE id=%d AND (assigned_admin='%s' OR assigned_admin='0') LIMIT 1",
-                                        array(bigintval($id), GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
+                                       $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_task_system WHERE id=%s AND assigned_admin IN (%s,0) LIMIT 1",
+                                        array(bigintval($id), GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
                                }
                        }
 
                        // Update query
-                       $result_tasks = SQL_QUERY_ESC("SELECT id, assigned_admin, userid, task_type, subject, text, task_created FROM "._MYSQL_PREFIX."_task_system WHERE assigned_admin='%s' OR (assigned_admin='0' AND status='NEW') ORDER BY task_created DESC",
-                        array(GET_ADMIN_ID($_COOKIE['admin_login'])), __FILE__, __LINE__);
+                       $result_tasks = SQL_QUERY_ESC("SELECT id, assigned_admin, userid, task_type, subject, text, task_created FROM "._MYSQL_PREFIX."_task_system WHERE assigned_admin=%s OR (assigned_admin=0 AND status='NEW') ORDER BY task_created DESC",
+                        array(GET_ADMIN_ID(get_session('admin_login'))), __FILE__, __LINE__);
                }
 
                // There are uncompleted jobs!