<?php

@( (bool)FALSE === strpos( $_SERVER['REQUEST_URI'], basename( __FILE__ ) ) ) OR exit( '!! ACCESS DENIED !!' );
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: users.php,v 1.9.2.7 2004/08/15 12:58:04 kirilt Exp $

/************************************************************************/
/* PHP-NUKE: Web Portal System                                          */
/* ===========================                                          */
/*                                                                      */
/* Copyright (c) 2001 by Francisco Burzi (fburzi@ncc.org.ve)            */
/* http://phpnuke.org                                                   */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/

// 2001-03-08 hombergs: Changed DelUser. Now the entry un users_stats are deleted.

checkAccess( 'user', NULL, TRUE );

$hlpfile = getHelpFile("users.html");

/*********************************************************/
/* Users Functions                                       */
/*********************************************************/

function displayUsers() {
    global $hlpfile, $admin, $mpnTables,$phpEx;
        include("header.$phpEx");
    GraphicAdmin($hlpfile);
    OpenTable();
        echo "
    <font size=4><b><center>".translate("Edit Users")."<br><br></b></font></center>";
    echo "<form method=post action=\"admin.$phpEx\">";
        echo '<table><tr><td width=100>';
        echo "<b>".translate("Handle/UserID/Email Address").": </b></td>";
        echo "<td><input class=textbox type=text size=\"20\" name=\"chng_uid\" size=10>\n";
        echo "<select class=textbox name=\"op\">";
        echo "<option value=\"modifyUser\">".translate("Modify User")."</option>\n";
        echo "<option value=\"delUser\">".translate("Delete User")."</option></select>\n";
        echo "<input class=\"button\" type=\"submit\" value=\"".translate("Go!")."\"></td></tr></form>";
echo "<form action=\"admin.$phpEx\" method=\"post\">"; ?>

<tr><td width=100><?php echo ""; ?><?php echo translate("Handle");?>*</td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="add_uname" size=30 maxlength=25></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Name");?></td>
    <td><?php echo ""; ?><input class=textbox type="text" name="add_name" size=30 maxlength=50></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Email");?>*</td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="add_email" size=30 maxlength=60></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Allow Email to all users");?></td>
    <td><?php echo ""; ?> <input type="checkbox" name="add_allowemail" value="1"></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Fake Email");?></td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="add_femail" size=30 maxlength=60></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("URL");?></td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="add_url" size=30 maxlength=60></td></tr>
<tr><td><?php echo translate("Your ICQ: "); ?></td>
    <td><input class=textbox type="text" name="add_user_icq" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your AIM: "); ?></td>
    <td><input class=textbox type="text" name="add_user_aim" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your YIM: "); ?></td>
    <td><input class=textbox type="text" name="add_user_yim" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your MSNM: "); ?></td>
    <td><input class=textbox type="text" name="add_user_msnm" size=20 maxlength=100></td></tr>
<tr><td><?php echo translate("Location: "); ?></td>
    <td><input class=textbox type="text" name="add_user_from" size=25 maxlength=60></td></tr>
<tr><td><?php echo translate("Occupation: "); ?></td>
    <td><input class=textbox type="text" name="add_user_occ" size=25 maxlength=60></td></tr>
<tr><td><?php echo translate("Interest: "); ?></td>
    <td><input class=textbox type="text" name="add_user_intrest" size=25 maxlength=255></td></tr>

<tr><td><?php echo translate("Rank: "); ?></td>
    <TD><SELECT NAME="add_rank">
<?php
        $sql = "SELECT rank_id, rank_title FROM ".$mpnTables['ranks']." WHERE rank_special = 1";
        $r = mysql_query($sql);
        if($m = mysql_fetch_array($r)) {
        echo "<OPTION VALUE=\"0\">No Special Rank Assigned</OPTION>";
        echo "<OPTION VALUE=\"0\">------------------------</OPTION>";
        do {
        unset($selected);
        echo '<OPTION VALUE="' . $m['rank_id'] . '">' . $m['rank_title'] . '</OPTION>' . "\n";
        } while($m = mysql_fetch_array($r));
        echo "</SELECT>\n";
            }

        else {
            echo "<OPTION VALUE=\"0\">No Special Ranks in Database</OPTION></SELECT>\n";
        }
?>
</TD>
</TR>

<TR><TD><?php echo translate("User Level: "); ?></TD>
    <TD><SELECT NAME="add_level">
<?php
        $sql = "SELECT access_id, access_title FROM ".$mpnTables['access'];
        $r = mysql_query($sql);
                if($m = mysql_fetch_array($r)) {
                    do {
                        unset($selected);
                        echo '<OPTION VALUE="' . $m['access_id'] . '">' . $m['access_title'] . '</OPTION>' . "\n";
                        } while($m = mysql_fetch_array($r));
        }
?>
        </SELECT>
    </TD>
</TR>


<tr><td><?php echo translate("Option: "); ?></td>
    <td><INPUT TYPE="CHECKBOX" NAME="add_user_viewemail" VALUE="1"><?php echo translate("Allow other users to view my email address"); ?></td></tr>
<tr><td><?php echo translate("Signature: "); ?></td>
    <td><TEXTAREA class=textbox NAME="add_user_sig" ROWS=6 COLS=45></TEXTAREA></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Password");?>*</td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="add_pass" size=12 maxlength=12></td></tr>
<input type="hidden" name="add_avatar" value="blank.gif">
<input type="hidden" name="op" value="addUser">
<tr><td colspan=2><?php echo ""; ?><input class='button' type=submit value="<?php echo translate("Add User");?>"></form></td></tr>
</table>
<?php echo "<center><font color=Red> ".translate("* indicates compulsory fields")." "; ?></font>
</td></tr></table></td></tr></table>
<?php

        include("footer.$phpEx");
}

function modifyUser($chng_user) {
    global $mpnTables,$phpEx;
        include("header.$phpEx");
    if (!isset($hlpfile))
    {
        $hlpfile = null;
    }

    GraphicAdmin($hlpfile);
        $result = mysql_query("select uid, uname, name, url, email, femail, user_icq, user_aim, user_yim, user_msnm, user_from, user_occ, user_intrest, user_viewemail, user_avatar, user_sig, pass, allowemail from ".$mpnTables['users']." where uid='$chng_user' or uname='$chng_user' or email='$chng_user'");
        if(mysql_num_rows($result) > 0) {
                while(list($chng_uid, $chng_uname, $chng_name, $chng_url, $chng_email, $chng_femail, $chng_user_icq, $chng_user_aim, $chng_user_yim, $chng_user_msnm, $chng_user_from, $chng_user_occ, $chng_user_intrest, $chng_user_viewemail, $chng_avatar, $chng_user_sig, $chng_pass, $chng_allowemail) = mysql_fetch_row($result)) {
                echo "
        <b><center>
        ".translate("Update User").": $chng_uname
        <br><br></b></center>";
OpenTable();
echo "<form action=\"admin.$phpEx\" method=\"post\">"; ?>
<table border=0>
<tr><td><?php echo ""; ?><?php echo translate("User ID");?></td>
    <td><?php echo ""; ?><?php echo $chng_uid ?></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Handle");?>*</td>
    <td><?php echo ""; ?><input class=textbox type="text" name="chng_uname" value="<?php echo $chng_uname ?>"></td></tr>
<tr><td width=100><?php echo ""; ?><?php echo translate("Name");?></td>
    <td><?php echo ""; ?><input class=textbox type="text" name="chng_name" value="<?php echo $chng_name ?>"></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("URL");?></td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="chng_url" value="<?php echo $chng_url ?>" size=30 maxlength=60></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Email");?>*</td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="chng_email" value="<?php echo $chng_email ?>" size=30 maxlength=60></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Allow Email to all users");?></td>
    <td><?php echo ""; ?>
    <?php if ($chng_allowemail==1) {?>
        <input type="checkbox" name="chng_allowemail" value="1" checked>
    <?php } else { ?>
        <input type="checkbox" name="chng_allowemail" value="1">
    <?php }?>
    </td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Fake Email");?></td>
    <td><?php echo ""; ?> <input class=textbox type="text" name="chng_femail" value="<?php echo $chng_femail ?>" size=30 maxlength=60></td></tr>
<tr><td><?php echo translate("Your ICQ: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_icq" value="<?php echo $chng_user_icq ?>" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your AIM: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_aim" value="<?php echo $chng_user_aim ?>" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your YIM: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_yim" value="<?php echo $chng_user_yim ?>" size=20 maxlength=20></td></tr>
<tr><td><?php echo translate("Your MSNM: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_msnm" value="<?php echo $chng_user_msnm ?>" size=20 maxlength=100></td></tr>
<tr><td><?php echo translate("Location: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_from" value="<?php echo $chng_user_from ?>" size=25 maxlength=60></td></tr>
<tr><td><?php echo translate("Occupation: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_occ" value="<?php echo $chng_user_occ ?>" size=25 maxlength=60></td></tr>
<tr><td><?php echo translate("Interest: "); ?></td>
    <td><input class=textbox type="text" name="chng_user_intrest" value="<?php echo $chng_user_intrest ?>" size=25 maxlength=255></td></tr>

<?php

$mytest = mysql_query("select rank, level from ".$mpnTables['users_status']." where uid='$chng_uid'");
list($chng_rank, $chng_level) = mysql_fetch_row($mytest); ?>

<tr><td><?php echo translate("Rank: "); ?></td>
    <TD><SELECT NAME="rank">
<?php
        $sql = "SELECT rank_id, rank_title FROM ".$mpnTables['ranks']." WHERE rank_special = 1";
        $r = mysql_query($sql);
        if($m = mysql_fetch_array($r)) {
        echo "<OPTION VALUE=\"0\">No Special Rank Assigned</OPTION>";
        echo "<OPTION VALUE=\"0\">------------------------</OPTION>";
        do {
        unset($selected);

        if($chng_rank == $m['rank_id'])
        {
            $selected = "SELECTED";
        }
        else
        {
            $selected = null;
        }

        echo '<OPTION VALUE="' . $m['rank_id'] . '" ' . $selected . '>' . $m['rank_title'] . '</OPTION>' . "\n";
        } while($m = mysql_fetch_array($r));
        echo "</SELECT>\n";
            }
        else {
            echo "<OPTION VALUE=\"0\">No Special Ranks in Database</OPTION></SELECT>\n";
        }
?>
</TD>
</TR>

<TR><TD><?php echo translate("User Level: "); ?></TD>
    <TD><SELECT NAME="level">
<?php
        $sql = "SELECT access_id, access_title FROM ".$mpnTables['access'];
        $r = mysql_query($sql);
                if($m = mysql_fetch_array($r)) {
                    do {
                        unset($selected);
                        if($chng_level == $m['access_id'])
                        {
                              $selected = "SELECTED";
                        }
                        else
                        {
                            $selected = null;
                        }

                        echo '<OPTION VALUE="' . $m['access_id'] . '" ' . $selected . '>' . $m['access_title'] . '</OPTION>' . "\n";
                        } while($m = mysql_fetch_array($r));
        }
?>
        </SELECT>
    </TD>
</TR>

<tr><td><?php echo translate("Option: "); ?></td>
<?php if ($chng_user_viewemail ==1) { ?>
    <td><INPUT TYPE="CHECKBOX" NAME="chng_user_viewemail" VALUE="1" checked> <?php echo translate("Allow other users to view my email address") ?></td></tr>
<?php } else { ?>
    <td><INPUT TYPE="CHECKBOX" NAME="chng_user_viewemail" VALUE="1"> <?php echo translate("Allow other users to view my email address") ?></td></tr>
<?php } ?>
<tr><td><?php echo translate("Signature: "); ?></td>
    <td><TEXTAREA class=textbox NAME="chng_sig" ROWS=6 COLS=45><?php echo $chng_user_sig ?></TEXTAREA></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Password")?></td>
    <td><?php echo ""; ?> <input class=textbox type="password" name="chng_pass"  size=12 maxlength=12></td></tr>
<tr><td><?php echo ""; ?><?php echo translate("Retype Password");?></td>
    <td><?php echo ""; ?> <input class=textbox type="password" name="chng_pass2" size=12 maxlength=12> <?php echo translate("(for changes only)");?></td></tr>
<input type="hidden" name="chng_avatar" value="<?php echo $chng_avatar; ?>">
<input type="hidden" name="chng_uid" value="<?php echo $chng_uid; ?>">
<input type="hidden" name="op" value="updateUser">
<tr><td colspan=2><?php echo ""; ?><input class='button' type="submit" value="<?php echo translate("Update User");?>"></form></td></tr>
</table>
<?php
                }
                echo "<center><font color=Red>".translate("* indicates compulsory fields")."</font>";
        echo "</td></tr></table></td></tr></table>";
        } else {
                echo "<center>";
        echo translate("User doesn't exist!");
        echo "</center>";
        }
        include("footer.$phpEx");
}

function updateUser($chng_uid, $chng_uname, $chng_name, $chng_url, $chng_email, $chng_allowemail,$chng_femail, $chng_user_icq, $chng_user_aim, $chng_user_yim, $chng_user_msnm, $chng_user_from, $chng_user_occ, $chng_user_intrest, $chng_user_viewemail, $chng_avatar, $chng_sig, $chng_pass, $chng_pass2, $rank, $level) {

    global $system, $mpnTables,$phpEx;

        $tmp = 0;
    if ($chng_pass2 != "") {
                if($chng_pass != $chng_pass2) {
                        $titlebar = "<b>".translate("bad pass")."</b>";
                        include("header.$phpEx");
            GraphicAdmin($hlpfile);
                        echo "
            <center>".translate("Sorry, the new passwords do not match. Click back and try again")."</center>";
                        include("footer.$phpEx");
                        exit;
                }
            $tmp = 1;
        }
    if ($tmp == 0) {
        mysql_query("update ".$mpnTables['users']." set uname='$chng_uname', name='$chng_name', email='$chng_email', femail='$chng_femail', url='$chng_url', user_icq='$chng_user_icq', user_aim='$chng_user_aim', user_yim='$chng_user_yim', user_msnm='$chng_user_msnm', user_from='$chng_user_from', user_occ='$chng_user_occ', user_intrest='$chng_user_intrest', user_viewemail='$chng_user_viewemail', user_avatar='$chng_avatar', user_sig='$chng_sig', allowemail='$chng_allowemail' where uid='$chng_uid'");
        mysql_query("update ".$mpnTables['users_status']." set rank='$rank', level='$level' where uid='$chng_uid'");
    }
    if ($tmp == 1) {
            $cpass = md5($chng_pass);
        mysql_query("update ".$mpnTables['users']." set uname='$chng_uname', name='$chng_name', email='$chng_email', femail='$chng_femail', url='$chng_url', user_icq='$chng_user_icq', user_aim='$chng_user_aim', user_yim='$chng_user_yim', user_msnm='$chng_user_msnm', user_from='$chng_user_from', user_occ='$chng_user_occ', user_intrest='$chng_user_intrest', user_viewemail='$chng_user_viewemail', user_avatar='$chng_avatar', user_sig='$chng_sig', pass='$cpass', allowemail='$chng_allowemail' where uid='$chng_uid'");
        mysql_query("update ".$mpnTables['users_status']." set rank='$rank', level='$level' where uid='$chng_uid'");
    }

    $_SERVER['F_LIB'] -> redirectRequest( 'admin.php?op=adminMain' );

}

switch($op) {

                case "mod_users":
                        displayUsers();
                        break;

                case "modifyUser":
                        modifyUser($chng_uid);
                        break;

                case "updateUser":
                        if (!isset( $chng_user_viewemail ))
                        {
                            $chng_user_viewemail = '';
                        }

                        updateUser($chng_uid, $chng_uname, $chng_name, $chng_url, $chng_email, $chng_allowemail,$chng_femail, $chng_user_icq, $chng_user_aim, $chng_user_yim, $chng_user_msnm, $chng_user_from, $chng_user_occ, $chng_user_intrest, $chng_user_viewemail, $chng_avatar, $chng_sig, $chng_pass, $chng_pass2, $rank, $level);
                        break;

                case "delUser":
                        include("header.$phpEx");
                        $titlebar = "<h3>".translate("Delete User")."</h3>";
                        echo $titlebar;
                        echo translate("Are you sure you want to delete") . " " . translate("user") . " $chng_uid? ";
                        $result = mysql_query("select uid from ".$mpnTables['users']." where uid='$chng_uid' or uname='$chng_uid'");
                        list($chn_uid) = mysql_fetch_row($result);
                        echo "[ <a href=\"admin.$phpEx?op=delUserConf&del_uid=$chn_uid\">".translate("Yes")."</a> | <a href=\"admin.$phpEx?op=adminMain\">".translate("No")."</a> ]";
                        include("footer.$phpEx");
                        break;

                case "delUserConf":
                        mysql_query("delete from ".$mpnTables['users']." where uid='$del_uid' or uname='$del_uid'");
                        mysql_query("delete from ".$mpnTables['users_status']." where uid='$del_uid'");
                        $_SERVER['F_LIB'] -> redirectRequest( 'admin.php?op=adminMain' );

                        echo mysql_error();
                        break;

                case "addUser":
                        $add_pass = md5($add_pass);
                        if (!($add_uname && $add_email && $add_pass)) {
                            echo translate("You must complete all compulsory fields");
                            return;
                        }
                        $user_regdate = date("M d, Y");

            // myPHPNuke get default comment method from CONFIG.PHP

            if (!isset($default_comment_method)) {
                $def_comment = "";
            } else {
                if ($default_comment_method == 0) { $def_comment = ""; }
                if ($default_comment_method == 1) { $def_comment = "nocomments"; }
                if ($default_comment_method == 2) { $def_comment = "nested"; }
                if ($default_comment_method == 3) { $def_comment = "flat"; }
                if ($default_comment_method == 4) { $def_comment = "thread"; }
            }

            if ($mpn_use_newuser_fix == 1) {

                $result = mysql_query("select max(uid) from ".$mpnTables['users']);
                if (mysql_num_rows($result) > 0) {
                    list($userid) = mysql_fetch_array($result);
                }

                $new_userid = $userid + 1;

                if (!isset( $add_user_viewemail ))
                {
                    $add_user_viewemail = '';
                }

                if (!isset( $add_allowemail ))
                {
                    $add_allowemail = '';
                }

                $sql    = "insert into ".$mpnTables['users']." ";
                $sql    .= "(uid,name,uname,email,femail,url,user_regdate,user_icq,user_aim,user_yim,user_msnm,user_from,user_occ,user_intrest,user_viewemail,user_avatar,user_sig,pass, umode, allowemail) ";
                $sql    .= "values ($new_userid,'$add_name','$add_uname','$add_email','$add_femail','$add_url','$user_regdate','$add_user_icq','$add_user_aim','$add_user_yim','$add_user_msnm','$add_user_from','$add_user_occ','$add_user_intrest','$add_user_viewemail','$add_avatar','$add_user_sig','$add_pass', '$def_comment', '$add_allowemail')";
                $result = mysql_query($sql);

                if ($result) {

                    $query = mysql_query("select uid from ".$mpnTables['users']." where email='$add_email' and uname='$add_uname'");
                    if (mysql_num_rows($query) > 0) {

                        list($userid) = mysql_fetch_array($query);

                        if ($userid == '2147483647') {

                            $result = mysql_query("update ".$mpnTables['users']." set uid=$new_userid where email='$add_email' and uname='$add_uname'");
                            $userid = $new_userid;
                        }
                        $query = "INSERT INTO ".$mpnTables['users_status']." (uid, posts, attachsig, rank, level) VALUES ($new_userid,'0','0','$add_rank','$add_level')";
                        $result = mysql_query($query);

                        $status_userid = mysql_insert_id();

                        if ($status_userid == '2147483647') {
                            $result = mysql_query("update ".$mpnTables['users_status']." set uid=$userid where uid='2147483647'");
                        }

                    }
                }
            } else {
                $sql    = "insert into ".$mpnTables['users']." ";
                $sql    .= "(uid,name,uname,email,femail,url,user_regdate,user_icq,user_aim,user_yim,user_msnm,user_from,user_occ,user_intrest,user_viewemail,user_avatar,user_sig,pass, umode) ";
                $sql    .= "values (NULL,'$add_name','$add_uname','$add_email','$add_femail','$add_url','$user_regdate','$add_user_icq','$add_user_aim','$add_user_yim','$add_user_msnm','$add_user_from','$add_user_occ','$add_user_intrest','$add_user_viewemail','$add_avatar','$add_user_sig','$add_pass', '$def_comment')";
                $result = mysql_query($sql);
                $result = mysql_query("insert into ".$mpnTables['users_status']." values (NULL,'0','0','$add_rank','$add_level')");
            }

            $_SERVER['F_LIB'] -> redirectRequest( 'admin.php?op=adminMain' );
            break;

}

?>
