<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: contactbook.php,v 1.9.2.4 2004/08/01 17:04:16 kirilt Exp $



/*************************************************************************/
 #  Mailbox 0.9.2a   by Sivaprasad R.L (http://netlogger.net)             #
 #                                                                        #
 #          --  A pop3 client addon for phpnuked websites --              #
 #                                                                        #
 # This program is distributed in the hope that it will be useful,        #
 # but WITHOUT ANY WARRANTY; without even the implied warranty of         #
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          #
 # GNU General Public License for more details.                           #
 #                                                                        #
 # You should have received a copy of the GNU General Public License      #
 # along with this program; if not, write to the Free Software            #
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.              #
 #                                                                        #
 #             Copyright (C) by Sivaprasad R.L                            #
 #                                                                        #
/*************************************************************************/


    if( ! _MPN_USER )
    {
        header ("Location: user.php");
        exit();
    }

    $userdata = cookiedecode();
    $userid = $userdata[0];

    if ( ! isset( $op ) )
    {
        $temp = mysql_query( "SELECT count(uid) FROM ". $mpnTables['contactbook']." WHERE uid = '$userid'");
        $rows = mysql_fetch_row( $temp );

        if ( $rows[0] < 1 )
        {
            $op = 'addnew';
        }
        else
        {
            $op = '';
        }
    }


    if(  $op != "view")
    {
        include "header.php";

        echo "<script language=javascript>
            function open_w(file) {
                newwind = window.open(file,'View','width=500, height=500, scrollbars=yes, toolbars=no');
            }
            </script>";
        include "mailheader.php";
    }


    global $domain, $footermsgtxt;
    global $bgcolor1, $bgcolor2, $bgcolor3, $imgpath;

    $index = 2;

    if($op != "view") echo "<br><table width=50% border=0 align=center><tr><td align=center width=50%><a href=contactbook.php?op=listall>" . translate("list all") . "</a></td><td align=center width=50%><a href=contactbook.php?op=addnew>" . translate("Add new") . "</a></td></tr></table><br><br>";

    switch( $op )
    {
        case 'addnew':
            addnew();
            break;

        case 'view':
            view();
            break;

        case 'delete':
            del();
            break;

        case 'edit':
            edit();
            break;

        default:
            if (!isset( $from ))
            {
                $from = null;
            }

            if (!isset( $searchfield ))
            {
                $searchfield = null;
            }

            if (!isset( $q ))
            {
                $q = null;
            }

            listall($from, $searchfield, $q);
            break;
    }

    if($op != "view") {
        echo "<br><table width=50% border=0 align=center><tr><td align=center width=50%><a href=contactbook.php?op=listall>" . translate("list all") . "</a></td><td align=center width=50%><a href=contactbook.php?op=addnew>" . translate("Add new") . "</a></td></tr></table><br><br>";
        include "mailfooter.php";
    }
?>

<?php
function listall($from = '', $searchfield = '', $q = '')
{
   global $userid, $index, $imgpath, $mpnTables;
   global $bgcolor1, $bgcolor2, $bgcolor3, $show_user;

echo "<form method=post action=contactbook.php>
      <table align=center><tr><Td>" . translate("Search:") . " </td><td><input type=text name=q value='$q'></td>
      <td> " . translate("in") . " </td><td>
      <select name=searchfield>
      <option value='all'>" . translate("All") . "</option>
      <option value='firstname'>" . translate("First name") . "</option>
      <option value='lastname'>" . translate("Last name") . "</option>
      <option value='email'>" . translate("Email") . "</option>
      <option value='homeaddress'>" . translate("Address") . "</option>
      <option value='city'>" . translate("City") . "</option>
      <option value='company'>" . translate("Events") . "</option>
      <option value='notes'>" . translate("Notes") . "</option>
      </select>
      </tr>
      </table>
      <center><input class='button' type=submit value='" . translate("Search") . "'>
      </form>";



if ($q != "")
{
    if($searchfield != "all")
    {
        $query = stripslashes($q);
        $types = "AND $searchfield LIKE '%$query%'";
    }
    else
    {
        $suite = "all";
        $types .= "AND";
        $searchfield = array( "firstname", "lastname", "email", "homeaddress", "city", "company", "notes" );
        foreach($searchfield as $sf)
        {
            $words = explode(" ",$q);

            foreach($words as $w)
            {
                $types .= " ($sf like '%$w%') ||";
            }
        }

        $types  = substr($types,0,-2);
    }
}
else
{
    $types = '';
}

$temp = mysql_query("Select * from ". $mpnTables['contactbook']." where uid = '$userid' $types");
$row = mysql_num_rows($temp);
if ($from == "") $from = 0;
if ($row < $show_user) $to = $row;
$to = $show_user;

if ($q != "") {
    echo "<center>" . sprintf(translate("Your search returned %s rows"), $row) . "</center><P>";
}

   $query = "Select * from ". $mpnTables['contactbook']." where uid = $userid $types order by firstname LIMIT $from, $to";
   $res = mysql_query($query);

echo "<table width=100% border=0 cellspacing=1 cellpadding=2>";

$next = $row / $show_user;
$modnext = $row / $show_user;

echo "<tr><td align=center> [";
$h = 0;
if ($modnext != "0") $next++;
for ($count = 1; $count < $next; $count++) {
    if ($h == $from) echo " <B>$count</B> ";
    else echo " <a href=contactbook.php?op=listall&from=$h&searchfield=$suite&q=$q>$count</a> ";
    $h += $show_user;
}
echo " ]</td></tr></table>";


   echo "<form name=listform method=post action=contactbook.php>
   <input type=hidden name=op value=delete>";

   echo "<table width=100% align=center border=0 bgcolor=\"$bgcolor3\" CELLPADDING=3 CELLSPACING=1><tr bgcolor=$bgcolor2><td width=3%>&nbsp;</td><td width=3%>&nbsp;</td><td width=3%>&nbsp;</td><td width=28%>" . translate("Name") . "</td><td width=30%>" . translate("Email") . "</td></tr>";
   $numrows = mysql_num_rows($res);
   if($numrows == 0) {
       echo "<tr bgcolor=\"$bgcolor1\"><td colspan=5 align=center>" . translate("No records found") . "</td></tr>";
   }

   $color = $bgcolor1;

   while($row = mysql_fetch_assoc($res))
   {
//       $_SERVER['SAN'] -> slashIT( $res );
//       extract( $res );

       $contactid = $row["contactid"];
       $firstname = $row["firstname"];
       $lastname = $row["lastname"];
       $email = $row["email"];

       echo "<tr bgcolor=$color><td><a href=\"Javascript:open_w('contactbook.php?op=view&cid=$contactid');\"><img src=\"$imgpath/view.gif\" alt='" . translate("View Profile") . "' border=0 width=16 height=12></a></td><td><a href='contactbook.php?op=edit&cid=$contactid' ><img src=\"$imgpath/edit.gif\" border=0 alt='" . translate("Edit Contact") . "' width=16 height=16></a></td><td><input type=checkbox name=del[] value=$contactid></td><td>$firstname, $lastname</td><td><a href=compose.php?to=$email>$email</a></td></tr>";
       if($color == $bgcolor1) $color = $bgcolor3;
       else $color = $bgcolor1;
       $count++;
   }
   echo "</table><P><input class='button' type=submit name=deleteall value='" . translate("Delete Selected") . "'></form>";

  echo "<center>";


$h = 0;
echo "<table width=100% border=0 cellspacing=1 cellpadding=2>";
echo "<tr><td colspan=9 align=center>[ ";
for ($count = 1; $count < $next; $count++) {
    if ($h == $from) { echo " <B>$count</B> "; }
    else {
   echo " <a href=contactbook.php?op=listall&from=$h&searchfield=$suite&q=$q>$count</a> ";
    }
    $h += $show_user;
}

echo " ]</td></tr></table>";

}

function addnew() {
   global $userid,$save,$userid,$firstname,$lastname,$email,$company,$homeaddress,$homepage,$city,
       $homephone,$workphone,$IM,$events,$reminders,$notes,$imgpath, $mpnTables;

   global $bgcolor1, $bgcolor2, $bgcolor3;

   if(isset($save))
   {
        // Check For Empty

        $check_ary = array( $_POST['firstname'], $_POST['lastname'], $_POST['email'] );

        $verify_check_ary = $_SERVER['SAN'] -> verifyContent( $check_ary, 3 );

        if ( in_array( (bool)FALSE, $verify_check_ary ) )
        {
            goBack( translate( 'You Failed To Include Required Information' ) );
            exit;
        }

        // Check URL

//        if ( ! $_SERVER['SAN'] -> verifyContent( $_POST['homepage'], 1 ) )
//        {
//            goBack( translate( 'Invalid URL' ) );
//            exit;
//        }

        // Check Email

        if ( ! $_SERVER['SAN'] -> verifyContent( $_POST['email'], 2 ) )
        {
            goBack( translate( 'Invalid Email' ) );
            exit;
        }

        unset( $check_ary, $verify_check_ary );

        foreach( $_POST AS $key => $v )
        {
            if ( $v == '' )
            {
                $_POST[ $key ] = translate( 'no info' );
            }
        }

        extract( $_POST );

       $query = "insert into ". $mpnTables['contactbook'] ." (uid,firstname,lastname,email,company,homeaddress,city,homepage,
       homephone,workphone,IM,events,reminders,notes) values($userid,'$firstname','$lastname','$email','$company','$homeaddress','$city','$homepage',
       '$homephone','$workphone','$IM','$events','$reminders','$notes');";

       $res = mysql_query($query);

       listall();

   }
   else
   {


   echo "<form name=addnew method=post action=contactbook.php>
   <b>" . translate("Add a new contact:") . "</b><br>\n";

   echo "<em>" . translate( 'Note: First Name, Last Name, And Email ARE required' ) . "</em>\n";

   echo "<br /><br />\n";


   echo "<table align=center width=90%>
   <tr><td width=25%>" . translate("First Name") . " </td><td><input type=text name=firstname> * " . translate( 'Required' ) . "</td></tr>
   <tr><td>" . translate("Last Name") . " </td><td><input type=text name=lastname> * " . translate( 'Required' ) . "</td></tr>
   <tr><td>" . translate("Email") . " </td><td><input type=text name=email> * " . translate( 'Required' ) . "</td></tr>
   <tr><td>" . translate("Phone (Work)") . "</td><td><input type=text name=homephone></td></tr>
   <tr><td>" . translate("Phone (Home)") . "</td><td><input type=text name=workphone></td></tr>
   <tr><td>" . translate("Address") . " </td><td><textarea name=address rows=4 cols=25></textarea></td></tr>
   <tr><td>" . translate("City") . " </td><td><input type=text name=city></td></tr>
   <tr><td>" . translate("Company") . " </td><td><input type=text name=company size=40></td></tr>
   <tr><td>" . translate("Homepage") . " </td><td><input type=text name=homepage size=40 value='http://'></td></tr>
   <tr><td colspan=2><hr align=left width=100% color=$bgcolor1></td></tr>
   <tr><td valign=top>" . translate("Instant Messenger ids") . "</td><td>" . translate("List the instant messenger ids of this person one below the other.") . "<br>
   " . translate("To add a messenger id, add as 'messenger name: messenger id'") . "<br><textarea name=IM rows=4 cols=25>Yahoo:
MSN:
ICQ:
AIM:
</textarea></td></tr>
   <tr><td colspan=2><hr align=left width=100%  color=$bgcolor1></td></tr>
   <tr><td valign=top>" . translate("Related Events") . " </td><td>" . translate("List the events related to this person such as Birthday, Anniversary etc.. or any special dates that you want to be reminded by us. Add as many events as you like.") . "<br>
   " . translate("To add an event, add as 'Event name: date' (eg: Birthday : 03/21)") . "<br>
   " . translate("(note: The date format is mm/dd)") . "<br>
   <textarea name=events rows=4 cols=40></textarea></td></tr>
   <tr><td>" . translate("Remind me") . " </td><td><input type=text name=reminders size=3 value=1> " . translate("day(s) before the event") . "</td></tr>
   <tr><td colspan=2><hr  align=left width=100% color=$bgcolor1></td></tr>

   <tr><td>" . translate("Notes") . " </td><td><textarea name=notes rows=4 cols=40></textarea></td></tr></table>\n";

   // Kiril: New Sanitizer

    echo "<input type='hidden' name='stripit_form' value='firstname|lastname|email|company|homeaddress|homepage|city|homephone|workphone|IM|events|reminders|notes' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

    // End Sanitizer


   echo "<input type=hidden name=save value='true'>
   <input type=hidden name=op value='addnew'>
   <center><input class='button' type=submit name=add value='" . translate("submit") . "'></center></form>";
   }

}


function view() {
   global $userid, $cid, $domain, $imgpath;
   global $bgcolor1, $bgcolor2, $bgcolor3, $mpnTables;
   include "config.php";
   include "themes/$Default_Theme/theme.php";
   $query = "Select * from ". $mpnTables['contactbook'] ." where uid = $userid and contactid=$cid";
   $res = mysql_query($query);

   echo "<html><title>$domain - " . translate("View profile") . "</title>
   <STYLE>
td{font:8pt Verdana}
</STYLE>
<body>";

   if(mysql_num_rows($res) == 0) {
       echo "<tr><td colspan=2 align=center>" . translate("No records found") . "</td></tr>";
   }

   if( $row = mysql_fetch_array($res))
   {
//       $_SERVER['SAN'] -> slashIT( $res );
//       extract( $res );

       $contactid = $row['contactid'];
       $uid = $row['uid'];

       if($uid != $userid) {
           echo "<br><center><b>" . translate("Error: Permission denied") . "<br><br></b></center></table>";
           return;
       }

       $firstname = $row["firstname"];
       $lastname = $row["lastname"];
       $email = $row["email"];
       $homephone = $row["homephone"];
       $workphone = $row["workphone"];
       $homeaddress = $row["homeaddress"];
       $city = $row["city"];
       $company = $row["company"];
       $homepage = $row["homepage"];
       $IM = $row["IM"];
       $events = $row["events"];
       $reminders = $row["reminders"];
       $notes = $row["notes"];
   }

OpenTable();
   echo "
   <center><font size=2><b>" . translate("V i e w  &nbsp; P r o f i l e") . "</b></center></font><br>
   <Table width=90% align=center>
   <tr bgcolor=$bgcolor1><td width=35%>" . translate("First Name") . " </td><td>$firstname</td></tr>
   <tr><td>" . translate("Last Name") . " </td><td>$lastname</td></tr>
   <tr bgcolor=$bgcolor1><td>" . translate("Email") . " </td><td>$email</td></tr>
   <tr><td>" . translate("Phone (Work)") . "</td><td>$homephone</td></tr>
   <tr bgcolor=$bgcolor1><td>" . translate("Phone (Home)") . "</td><td>$workphone</td></tr>

   <tr><td>" . translate("Address") . " </td><td>$homeaddress</td></tr>
   <tr bgcolor=$bgcolor1><td>" . translate("City") . " </td><td>$city</td></tr>
   <tr><td>" . translate("Company") . " </td><td>$company</td></tr>
   <tr bgcolor=$bgcolor1><td>" . translate("Homepage") . " </td><td>$homepage</td></tr>
   <tr><td colspan=2><hr align=left width=100% color=$bgcolor2></td></tr>
   <tr bgcolor=$bgcolor1><td valign=top colspan=2>" . translate("Instant Messenger ids") . "</td></tr>";

   echo "<tr><td colspan=2><table width=80% align=center>";
   $listim = explode("\n",$IM);
   foreach($listim as $item) {
           $array = explode(":",$item);
           if (!isset($array[1]))
           {
               $array[1] = null;
           }

           echo "<tr><td><b>$array[0]</B></td><td>: $array[1]</tr>";
   }

   echo "</table></td></tr>
   <tr><td colspan=2><hr align=left width=100%  color=$bgcolor2></td></tr>

   <tr bgcolor=$bgcolor1><td colspan=2 valign=top>" . translate("Related Events:") . " </td></tr>";

   echo "<tr><td colspan=2><table width=80% align=center>";
   $listevents = explode("\n",$events);
   foreach($listevents as $ev) {
           $array = explode(":",$ev);
           if (!isset($array[1]))
           {
               $array[1] = null;
           }

           echo "<tr><td><b>$array[0]</b></td><td>: $array[1]</tr>";
   }

   echo "
   </table></td></tr>
   <tr><td colspan=2><hr align=left width=100% color=$bgcolor2></td></tr>
   <tr bgcolor=$bgcolor1><td>" . translate("Notes") . " </td><td>$notes</td></tr></table>";
CloseTable();
   echo "</body></html>";
}

function del() {

    global $userid, $del, $imgpath;
    global $bgcolor1, $bgcolor2, $bgcolor3, $mpnTables;

    if(is_array($del)) {
        foreach ($del as $d) {
            $q = "select * from ". $mpnTables['contactbook'] ." where uid = $userid and contactid = $d";
            $r = mysql_query($q);
            if(mysql_num_rows($r) > 0) {
                $query = "delete from ". $mpnTables['contactbook']. " where contactid = $d";
                $res = mysql_query($query);
            }
        }
    } else {
            $q = "select * from ". $mpnTables['contactbook'] ." where uid = $userid and contactid = $del";
            $r = mysql_query($q);
            if(mysql_num_rows($r) > 0) {
                $query = "delete from ". $mpnTables['contactbook']." where contactid = $del";
                $res = mysql_query($query);
            }
    }
    listall();
}

function edit() {
   global $userid,$cid, $save,$userid,$firstname,$lastname,$email,$company,$homeaddress,$homepage,$city,
       $homephone,$workphone,$IM,$events,$reminders,$notes;
   global $bgcolor1, $bgcolor2, $bgcolor3, $imgpath, $mpnTables;

   if($save == "true")
   {
        // Check For Empty

        $check_ary = array( $_POST['firstname'], $_POST['lastname'], $_POST['email'] );

        $verify_check_ary = $_SERVER['SAN'] -> verifyContent( $check_ary, 3 );

        if ( in_array( (bool)FALSE, $verify_check_ary ) )
        {
            goBack( translate( 'You Failed To Include Required Information' ) );
            exit;
        }

        // Check URL

//        if ( ! $_SERVER['SAN'] -> verifyContent( $_POST['homepage'], 1 ) )
//        {
//            goBack( translate( 'Invalid URL' ) );
//            exit;
//        }

        // Check Email

        if ( ! $_SERVER['SAN'] -> verifyContent( $_POST['email'], 2 ) )
        {
            goBack( translate( 'Invalid Email' ) );
            exit;
        }

        unset( $check_ary, $verify_check_ary );

        foreach( $_POST AS $key => $v )
        {
            if ( $v == '' )
            {
                $_POST[ $key ] = translate( 'no info' );
            }
        }

        extract( $_POST );

      $query = "update ". $mpnTables['contactbook'] ." set  firstname= '$firstname',lastname='$lastname',
      email = '$email', homephone = '$homephone', workphone ='$workphone', homeaddress= '$homeaddress',
      city = '$city', company = '$company', homepage= '$homepage',IM = '$IM', events = '$events',
      reminders = '$reminders',notes = '$notes' where contactid = $cid";
      $res = mysql_query($query);
      listall();
      return;
   }

   $query = "Select * from ". $mpnTables['contactbook']." where uid = $userid and contactid = $cid";
   $res = mysql_query($query);

   if($row = mysql_fetch_array($res))
   {
//       $_SERVER['SAN'] -> slashIT( $res );
//       extract( $res );

       $uid = $row['uid'];

       if($uid != $userid) {
           echo "<br><center><b>" . translate("Error : Permission denied") . "<br><br></b></center></table>";
           return;
       }

       $firstname = $row["firstname"];
       $lastname = $row["lastname"];
       $email = $row["email"];
       $homephone = $row["homephone"];
       $workphone = $row["workphone"];
       $homeaddress = $row["homeaddress"];
       $city = $row["city"];
       $company = $row["company"];
       $homepage = $row["homepage"];
       $IM = $row["IM"];
       $events = $row["events"];
       $reminders = $row["reminders"];
       $notes = $row["notes"];
   }

   echo "<form name=editform method=post action=contactbook.php>
   <font size=3><b>" . translate("Edit contact:") . "</b><hr align=left color=$bgcolor1 width=40%></font><br><br>
   <table align=center width=90%>
   <tr><td width=25%>" . translate("First Name") . " </td><td><input type=text name=firstname value='$firstname'></td></tr>
   <tr><td>" . translate("Last Name") . " </td><td><input type=text name=lastname value='$lastname'></td></tr>
   <tr><td>" . translate("Email") . " </td><td><input type=text name=email value='$email'></td></tr>
   <tr><td>" . translate("Phone (Work)") . "</td><td><input type=text name=homephone value='$homephone'></td></tr>
   <tr><td>" . translate("Phone (Home)") . "</td><td><input type=text name=workphone value='$workphone'></td></tr>
   <tr><td>" . translate("Address") . " </td><td><textarea name=homeaddress rows=4 cols=25>$homeaddress</textarea></td></tr>
   <tr><td>" . translate("City") . " </td><td><input type=text name=city value='$city'></td></tr>
   <tr><td>" . translate("Company") . " </td><td><input type=text name=company size=40 value='$company'></td></tr>
   <tr><td>" . translate("Homepage") . " </td><td><input type=text name=homepage size=40  value='$homepage'></td></tr>
   <tr><td colspan=2><hr align=left width=100% color=$bgcolor1></td></tr>

   <tr><td valign=top>" . translate("Instant Messenger ids") . "</td><td><textarea name=IM rows=4 cols=25>$IM</textarea></td></tr>
   <tr><td colspan=2><hr align=left width=100%  color=$bgcolor1></td></tr>

   <tr><td valign=top>" . translate("Related Events") . " </td><td><textarea name=events rows=4 cols=40>$events</textarea></td></tr>

   <tr><td>" . translate("Remind me") . " </td><td><input type=text name=reminders  value='$reminders'size=3 value=1> " . translate("day(s) before the event") . "</td></tr>
   <tr><td colspan=2><hr  align=left width=100% color=$bgcolor1></td></tr>

   <tr><td>" . translate("Notes") . " </td><td><textarea name=notes rows=4 cols=40>$notes</textarea></td></tr></table>\n";

    // Kiril: New Sanitizer

    echo "<input type='hidden' name='stripit_form' value='firstname|lastname|email|company|homeaddress|homepage|city|homephone|workphone|IM|events|reminders|notes' />\n";
    echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

    // End Sanitizer


   echo "<input type=hidden name=save value='true'>
   <input type=hidden name=op value='edit'>
   <input type=hidden name=cid value='$cid'>
   <center><input class='button' type=submit name=add value='" . translate("submit") . "'></center></form>";
}


?>
