X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=af3e0ab424fe5be2d47a080a647e2a8936e36278;hp=a0700817fe6433c6cfa8c992365c5ae040afe28e;hb=c6418c3240dd6f50413c35b4bcf21405a939bb90;hpb=89edd713e330fd16e8da1edeadfd5046296ff0d2 diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index a0700817fe..f5a70264af 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -1,7 +1,7 @@ = "0.7.0") { - // Load them here - $data['login_failtures'] = $cacheArray['admins']['login_failtures'][$admin_login]; - $data['last_failture'] = $cacheArray['admins']['last_failture'][$admin_login]; - } // END - if - } elseif (GET_EXT_VERSION("cache") == "") { - $ADD = ""; - if (GET_EXT_VERSION("admins") >= "0.7.0") { - // Load them here - $ADD = ", login_failtures, UNIX_TIMESTAMP(last_failture) AS last_failture"; - } // END - if - - // Get password from DB - $result = SQL_QUERY_ESC("SELECT password".$ADD." FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", - array($admin_login), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) { - // Login password found - $ret = "pass"; + // Is the entry there? + if (SQL_HASZERONUMS($result)) { + // Ok, let's create the admin login + SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')", + array( + $adminLogin, + $passHash, + $adminEmail + ), __FUNCTION__, __LINE__); + + // All done + $ret = 'done'; + } // END - if - // Fetch data - $data = SQL_FETCHARRAY($result); - } // END - if + // Free memory + SQL_FREERESULT($result); - // Free result - SQL_FREERESULT($result); - } + // Return result + return $ret; +} - //* DEBUG: */ echo "*".$data['password']."/".md5($password)."/".$ret."
"; - if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { - // Generate new hash - $data['password'] = generateHash($password); - - // Is the sql_patches not installed, than we cannot have a valid hashed password here! - if (($ret == "pass") && ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == ""))) $ret = "done"; - } elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) { - // Old hashing way - return $ret; - } elseif (!isset($data['password'])) { - // Password not found, so no valid login! - return $ret; - } +// This function will be executed when the admin is not logged in and has submitted his login data +function ifAdminLoginDataIsValid ($adminLogin, $adminPassword) { + // First of all, no admin login is found, so the admin hash is null + $ret = '404'; + $adminHash = null; - // Generate salt of password - define('__SALT', substr($data['password'], 0, -40)); - $salt = __SALT; - - // Check if password is same - //* DEBUG: */ echo "*".$ret.",".$data['password'].",".$password.",".$salt."*
\n"; - if (($ret == "pass") && ($data['password'] == generateHash($password, $salt)) && (!empty($salt))) { - // Re-hash the plain passord with new random salt - $data['password'] = generateHash($password); - - // Do we have 0.7.0 of admins or later? - // Remmeber login failtures if available - if (GET_EXT_VERSION("admins") >= "0.7.0") { - // Store it in session - set_session('mxchange_admin_failtures', $data['login_failtures']); - set_session('mxchange_admin_last_fail', $data['last_failture']); - } // END - if + // Get admin id from login + $adminId = getAdminId($adminLogin); - // Update password - $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s',login_failtures=0,last_failture='0000-00-00 00:00:00' WHERE login='%s' LIMIT 1", - array($data['password'], $admin_login), __FILE__, __LINE__); + // Continue only with found admin ids + if ($adminId > 0) { + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminId); - // Rebuild cache - REBUILD_CACHE("admins", "admin"); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Get admin id and set it as current + setCurrentAdminId($adminId); - // Login has failed by default... ;-) - $ret = "failed"; + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = generateHash($adminPassword, $adminHash); - // Password matches so login here - if (LOGIN_ADMIN($admin_login, $data['password'])) { - // All done now - $ret = "done"; - } // END - if - } elseif ((empty($salt)) && ($ret == "pass")) { - // Something bad went wrong - $ret = "failed"; - } elseif ($ret == "done") { - // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!LOGIN_ADMIN($admin_login, $data['password'])) { - // Something went wrong - $ret = "failed"; + // If they both match, the login data is valid + if ($testHash == $adminHash) { + // All fine + $ret = 'done'; + } else { + // Set status + $ret = 'password'; + } } // END - if - } - - // Count login failture if admins extension version is 0.7.0+ - if (($ret == "pass") && (GET_EXT_VERSION("admins") >= "0.7.0")) { - // Update counter - SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET login_failtures=login_failtures+1,last_failture=NOW() WHERE login='%s' LIMIT 1", - array($admin_login), __FILE__, __LINE__); - - // Rebuild cache - REBUILD_CACHE("admins", "admin"); } // END - if - // Return the result - //* DEBUG: */ die("RETURN=".$ret); - return $ret; -} - -// Try to login the admin by setting some session/cookie variables -function LOGIN_ADMIN ($adminLogin, $passHash) { - global $cacheInstance; - - // Reset failture counter on matching admins version - if ((GET_EXT_VERSION("admins") >= "0.7.0") && ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == ""))) { - // Reset counter on out-dated sql_patches version - SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET login_failtures=0,last_failture='0000-00-00 00:00:00' WHERE login='%s' LIMIT 1", - array($adminLogin), __FILE__, __LINE__); + // Prepare data array + $data = array( + 'id' => $adminId, + 'login' => $adminLogin, + 'plain_pass' => $adminPassword, + 'pass_hash' => $adminHash + ); - // Rebuild cache - REBUILD_CACHE("admins", "admin"); - } // END - if + // Run a special filter + runFilterChain('do_admin_login_' . $ret, $data); - // Now set all session variables and return the result - return ( - ( - set_session("admin_md5", generatePassString($passHash)) - ) && ( - set_session("admin_login", $adminLogin) - ) && ( - set_session("admin_last", time()) - ) && ( - set_session("admin_to", bigintval($_POST['timeout'])) - ) - ); + // Return status + return $ret; } // Only be executed on cookie checking -function CHECK_ADMIN_COOKIES ($admin_login, $password) { - global $cacheArray, $_CONFIG; - $ret = "404"; $pass = ""; - if (!empty($cacheArray['admins']['aid'][$admin_login])) { - // Get password from cache - $pass = $cacheArray['admins']['password'][$admin_login]; - $ret = "pass"; - $_CONFIG['cache_hits']++; - } elseif (GET_EXT_VERSION("cache") == "") { - // Get password from DB - $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", - array($admin_login), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) { - // Entry found - $ret = "pass"; - - // Fetch password - list($pass) = SQL_FETCHROW($result); +function ifAdminCookiesAreValid ($adminLogin, $passHash) { + // First of all, no admin login is found + $ret = '404'; + + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminLogin); + + // If this is fine, we can continue + if ($adminHash != '-1') { + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = encodeHashForCookie($adminHash); + //* DEBUG: */ debugOutput('adminLogin=' . $adminLogin . ',passHash='.$passHash.',adminHash='.$adminHash.',testHash='.$testHash); + + // If they both match, the login data is valid + if ($testHash == $passHash) { + // All fine + $ret = 'done'; + } else { + // Set status + $ret = 'password'; } + } // END - if - // Free result - SQL_FREERESULT($result); - } - - //* DEBUG: */ echo __FUNCTION__.":".$pass."(".strlen($pass).")/".$password."(".strlen($password).")
\n"; - - // Check if password matches - if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { - // Passwords matches! - $ret = "done"; - } - - // Return result + // Return status + //* DEBUG: */ debugOutput('ret='.$ret); return $ret; } -// -function admin_WriteData ($file, $comment, $prefix, $suffix, $DATA, $seek=0) { - // Initialize some variables - $done = false; - $seek++; - $found = false; - - // Is the file there and read-/write-able? - if ((FILE_READABLE($file)) && (is_writeable($file))) { - $search = "CFG: ".$comment; - $tmp = $file.".tmp"; - - // Open the source file - $fp = @fopen($file, 'r') or OUTPUT_HTML("READ: ".$file."
"); - - // Is the resource valid? - if (is_resource($fp)) { - // Open temporary file - $fp_tmp = @fopen($tmp, 'w') or OUTPUT_HTML("WRITE: ".$tmp."
"); - - // Is the resource again valid? - if (is_resource($fp_tmp)) { - while (!feof($fp)) { - // Read from source file - $line = fgets ($fp, 1024); - - if (strpos($line, $search) > -1) { $next = 0; $found = true; } - - if ($next > -1) { - if ($next == $seek) { - $next = -1; - $line = $prefix . $DATA . $suffix."\n"; - } else { - $next++; - } - } - - // Write to temp file - fputs($fp_tmp, $line); - } - - // Close temp file - fclose($fp_tmp); - // Finished writing tmp file - $done = true; - } +// Do an admin action +function doAdminAction () { + // Get default what + $what = getWhat(); - // Close source file - fclose($fp); - - if (($done) && ($found)) { - // Copy back tmp file and delete tmp :-) - @copy($tmp, $file); - @unlink($tmp); - define('_FATAL', false); - } elseif (!$found) { - OUTPUT_HTML("CHANGE: 404!"); - define('_FATAL', true); - } else { - OUTPUT_HTML("TMP: UNDONE!"); - define('_FATAL', true); - } - } - } else { - // File not found, not readable or writeable - OUTPUT_HTML("404: ".$file."
"); - } -} - -// -function ADMIN_DO_ACTION($wht) -{ - global $menuDesription, $menuTitle, $_CONFIG, $cacheArray, $DATA, $DEPTH; - //* DEBUG: */ echo __LINE__."*".$wht."/".$GLOBALS['module']."/".$GLOBALS['action']."/".$GLOBALS['what']."*
\n"; - if (EXT_IS_ACTIVE("cache")) - { - // Include cache instance - global $cacheInstance; - } + //* DEBUG: */ debugOutput(__LINE__.'*'.$what.'/'.getModule().'/'.getAction().'/'.getWhat().'*'); // Remove any spaces from variable - if (empty($wht)) - { + if (empty($what)) { // Default admin action is the overview page - $wht = "overview"; - } - else - { - // Compile out some chars - $wht = COMPILE_CODE($wht, false, false, false); + $what = 'overview'; + } else { + // Secure it + $what = secureString($what); } // Get action value - $act = GET_ACTION($GLOBALS['module'], $wht); - - // Define admin login name and ID number - define('__ADMIN_LOGIN', get_session('admin_login')); - define('__ADMIN_ID' , GET_ADMIN_ID(get_session('admin_login'))); + $action = getActionFromModuleWhat(getModule(), $what); - // Preload templates - if (EXT_IS_ACTIVE("admins")) { - define('__ADMIN_WELCOME', LOAD_TEMPLATE("admin_welcome_admins", true)); + // Load welcome template + if (isExtensionActive('admins')) { + // @TODO This and the next getCurrentAdminId() call might be moved into the templates? + $content['welcome'] = loadTemplate('admin_welcome_admins', true, getCurrentAdminId()); } else { - define('__ADMIN_WELCOME', LOAD_TEMPLATE("admin_welcome", true)); + $content['welcome'] = loadTemplate('admin_welcome', true, getCurrentAdminId()); } - define('__ADMIN_FOOTER' , LOAD_TEMPLATE("admin_footer" , true)); - define('__ADMIN_MENU' , ADD_ADMIN_MENU($act, $wht, true)); + + // Load header, footer, render menu + $content['header'] = loadTemplate('admin_header' , true, $content); + $content['footer'] = loadTemplate('admin_footer' , true, $content); + $content['menu'] = addAdminMenu($action, $what, true); // Tableset header - LOAD_TEMPLATE("admin_main_header"); + loadTemplate('admin_main_header', false, $content); // Check if action/what pair is valid - $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admin_menu -WHERE action='%s' AND ((what='%s' AND what != 'overview') OR ((what='' OR what IS NULL) AND '%s'='overview')) -LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { - // Free memory - SQL_FREERESULT($result); - + $result_action = SQL_QUERY_ESC("SELECT + `id` +FROM + `{?_MYSQL_PREFIX?}_admin_menu` +WHERE + `action`='%s' AND + ( + ( + `what`='%s' AND `what` != 'overview' + ) OR ( + ( + `what`='' OR `what` IS NULL + ) AND ( + '%s'='overview' + ) + ) + ) +LIMIT 1", + array( + $action, + $what, + $what + ), __FUNCTION__, __LINE__); + + // Do we have an entry? + if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? - $INC = sprintf("%sinc/modules/admin/action-%s.php", PATH, $act); - if ((FILE_READABLE($INC)) && (VALIDATE_MENU_ACTION("admin", $act, $wht)) && (__ACL_ALLOW == true)) - { + $inc = sprintf("inc/modules/admin/action-%s.php", $action); + if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === true)) { // Ok, we finally load the admin action module - include($INC); - } - elseif (__ACL_ALLOW == false) - { + loadInclude($inc); + } elseif ($GLOBALS['acl_allow'] === false) { // Access denied - LOAD_TEMPLATE("admin_menu_failed", false, ADMINS_ACCESS_DENIED); - ADD_FATAL(ADMINS_ACCESS_DENIED); - } - else - { - // Include file not found! :-( - LOAD_TEMPLATE("admin_menu_failed", false, ADMIN_404_ACTION); - ADD_FATAL(ADMIN_404_ACTION_1.$act.ADMIN_404_ACTION_2); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACCESS_DENIED', $what)); + } else { + // Include file not found :-( + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_404', $action)); } } else { - // Invalid action/what pair found! - LOAD_TEMPLATE("admin_menu_failed", false, ADMIN_INVALID_ACTION); - ADD_FATAL(ADMIN_INVALID_ACTION_1.$act."/".$wht.ADMIN_INVALID_ACTION_2); + // Invalid action/what pair found + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_INVALID', $action . '/' . $what)); } + // Free memory + SQL_FREERESULT($result_action); + // Tableset footer - LOAD_TEMPLATE("admin_main_footer"); + loadTemplate('admin_main_footer', false, $content); } -// -function ADD_ADMIN_MENU($act, $wht,$return=false) -{ - global $menuDesription, $menuTitle; + +// Checks wether current admin is allowed to access given action/what combination +// (only one is allowed to be null!) +function isAdminAllowedAccessMenu ($action, $what = null) { + // Do we have cache? + if (!isset($GLOBALS[__FUNCTION__][$action][$what])) { + // ACL is always 'allow' when no ext-admins is installed + // @TODO This can be rewritten into a filter + $GLOBALS[__FUNCTION__][$action][$what] = ((!isExtensionInstalledAndNewer('admins', '0.2.0')) || (adminsCheckAdminAcl($action, $what))); + } // END - if + + // Return the cached value + return $GLOBALS[__FUNCTION__][$action][$what]; +} + +// Adds an admin menu +function addAdminMenu ($action, $what, $return = false) { + // Init variables $SUB = false; + $OUT = ''; // Menu descriptions - $menuDesription = array(); - $menuTitle = array(); + $GLOBALS['menu']['description'] = array(); + $GLOBALS['menu']['title'] = array(); // Build main menu - $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE (what='' OR what IS NULL) ORDER BY sort, id DESC", __FILE__, __LINE__); - $OUT = ""; - if (SQL_NUMROWS($result_main) > 0) - { - $OUT = " -\n"; - while (list($menu, $title, $descr) = SQL_FETCHROW($result_main)) - { - if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) - { - $ACL = ADMINS_CHECK_ACL($menu, ""); - } - else - { - // ACL is "allow"... hmmm - $ACL = true; - } - if ($ACL) - { - if (!$SUB) - { + $result_main = SQL_QUERY("SELECT + `action`, `title`, `descr` +FROM + `{?_MYSQL_PREFIX?}_admin_menu` +WHERE + (`what`='' OR `what` IS NULL) +ORDER BY + `sort` ASC, + `id` DESC", __FUNCTION__, __LINE__); + + // Do we have entries? + if (!SQL_HASZERONUMS($result_main)) { + $OUT .= ' - -\n"; - $result_what = SQL_QUERY_ESC("SELECT what, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE action='%s' AND what != '' AND what IS NOT NULL ORDER BY sort, id DESC", - array($menu), __FILE__, __LINE__); - if ((SQL_NUMROWS($result_what) > 0) && ($act == $menu)) - { - $menuDesription = array(); - $menuTitle = array(); $SUB = true; - $OUT .= " - - -\n"; - } - $OUT .= "\n"; - } - } + $OUT .= ' +'; + } // END - if + } // END - if + } // END - while // Free memory SQL_FREERESULT($result_main); - $OUT .= "
 
-  · "; - if (($menu == $act) && (empty($wht))) - { - $OUT .= ""; - } - else - { - $OUT .= "["; + $GLOBALS['menu']['title'][$menu] = $title; + $GLOBALS['menu']['description'][$menu] = $descr; + } // END - if + $OUT .= '
  • +
    · '; + + if ($readable === true) { + if (($menu == $action) && (empty($what))) { + $OUT .= ''; + } else { + $OUT .= '['; + } + } else { + $OUT .= ''; } + $OUT .= $title; - if (($menu == $act) && (empty($wht))) - { - $OUT .= ""; - } - else - { - $OUT .= "]"; + + if ($readable === true) { + if (($menu == $action) && (empty($what))) { + $OUT .= ''; + } else { + $OUT .= ']'; + } + } else { + $OUT .= ''; } - $OUT .= "
    •   - \n"; - while (list($wht_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) - { + + $OUT .= ' +'; + + // Check for menu entries + $result_what = SQL_QUERY_ESC("SELECT + `what`, `title`, `descr` +FROM + `{?_MYSQL_PREFIX?}_admin_menu` +WHERE + `action`='%s' AND + `what` != '' AND + `what` IS NOT NULL +ORDER BY + `sort` ASC, + `id` DESC", + array($menu), __FUNCTION__, __LINE__); + + // Remember the count for later checks + setAdminMenuHasEntries($menu, ((!SQL_HASZERONUMS($result_what)) && ($action == $menu))); + + // Do we have entries? + if ((ifAdminMenuHasEntries($menu)) && (!SQL_HASZERONUMS($result_what))) { + $GLOBALS['menu']['description'] = array(); + $GLOBALS['menu']['title'] = array(); $SUB = true; + $OUT .= '
    • '; + // @TODO Rewrite this to $content = SQL_FETCHARRAY() + while (list($what_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) { // Filename - $INC = sprintf("%sinc/modules/admin/what-%s.php", PATH, $wht_sub); - if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) - { - $ACL = ADMINS_CHECK_ACL("", $wht_sub); - } - else - { - // ACL is "allow"... hmmm - $ACL = true; - } - $readable = FILE_READABLE($INC); - if ($ACL) - { + $inc = sprintf("inc/modules/admin/what-%s.php", $what_sub); + + // Is the file readable? + $readable = isIncludeReadable($inc); + + // Is the current admin allowed to access this 'what' menu? + if (isAdminAllowedAccessMenu(null, $what_sub)) { // Insert compiled title and description - $menuTitle[$wht_sub] = $title_what; - $menuDesription[$wht_sub] = $desc_what; - $OUT .= "
    • - -\n"; - } - } + $OUT .= ' +'; + } // END - if + } // END - while // Free memory SQL_FREERESULT($result_what); - $OUT .= "
    -  --> "; - if ($readable) - { - if ($wht == $wht_sub) - { - $OUT .= ""; - } - else - { - $OUT .= "["; + $GLOBALS['menu']['title'][$what_sub] = $title_what; + $GLOBALS['menu']['description'][$what_sub] = $desc_what; + $OUT .= '
  • +
    --> '; + if ($readable === true) { + if ($what == $what_sub) { + $OUT .= ''; + } else { + $OUT .= '['; } + } else { + $OUT .= ''; } - else - { - $OUT .= ""; - } + $OUT .= $title_what; - if ($readable) - { - if ($wht == $wht_sub) - { - $OUT .= ""; - } - else - { - $OUT .= "]"; + + if ($readable === true) { + if ($what == $what_sub) { + $OUT .= ''; + } else { + $OUT .= ']'; } + } else { + $OUT .= ''; } - else - { - $OUT .= ""; - } - $OUT .= "
    • -
    \n"; + $OUT .= ''; } - // Compile and run the code here. This inserts all constants into the - // HTML output. Costs me some time to figure this out... *sigh* Quix0r - $eval = "\$OUT = \"".COMPILE_CODE(addslashes($OUT))."\";"; - eval($eval); - + // Is there a cache instance again? // Return or output content? - if ($return) { + if ($return === true) { return $OUT; } else { - OUTPUT_HTML($OUT); + outputHtml($OUT); } } -// -function ADD_MEMBER_SELECTION_BOX ($def="0", $add_all=false, $return=false, $none=false) -{ + +// Create member selection box +function addMemberSelectionBox ($def = 0, $add_all = false, $return = false, $none = false, $field = 'userid') { // Output selection form with all confirmed user accounts listed - $result = SQL_QUERY("SELECT userid, surname, family FROM "._MYSQL_PREFIX."_user_data ORDER BY userid", __FILE__, __LINE__); - $OUT = ""; + $result = SQL_QUERY("SELECT `userid`, `surname`, `family` FROM `{?_MYSQL_PREFIX?}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__); + + // Default output + $OUT = ''; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) - if ($add_all) $OUT = " \n"; - elseif ($none) $OUT = " \n"; - while (list($id, $sname, $fname) = SQL_FETCHROW($result)) - { - $OUT .= " '; + elseif ($none === true) $OUT = ' '; + + while ($content = SQL_FETCHARRAY($result)) { + $OUT .= ''; + // Load all entries + while ($content = SQL_FETCHARRAY($result)) { + $OUT .= ''; // Walk through all files - while ($file = readdir($handle)) { + foreach ($menuArray as $file) { // Is this a PHP script? - if (($file != ".") && ($file != "..") && ($file != "lost+found") && (strpos($file, "".$type."-") > -1) && (strpos($file, ".php") > 0)) { + if ((!isDirectory($file)) && (strpos($file, '' . $type . '-') > -1) && (strpos($file, '.php') > 0)) { // Then test if the file is readable - $test = sprintf("%sinc/modules/%s/%s", PATH, $menu, $file); - if ((is_file($test)) && (is_readable($test))) { + $test = sprintf("inc/modules/%s/%s", $menu, $file); + + // Is the file there? + if (isIncludeReadable($test)) { // Extract the value for what=xxx $part = substr($file, (strlen($type) + 1)); $part = substr($part, 0, -4); // Is that part different from the overview? - if ($part != "overview") { - $OUT .= "