root/admin.lib.php

<?php
/*
 * blogs class - provides functions for blogs
 */

// Some useful validation functions
require_once("validation.lib.php");
// random other functions that aren't validation or db related
require_once("miscfunctions.lib.php");
//stuff from blog.lib will be useful
require_once("blog.lib.php");

//Our Blogs Class
class admin {
    //Blog ID
    var $id;
    //Blogger's Details
    var $userName;
    var $realName;
    //Errors
    var $error;
    //Date formats
    var $shortDateFormat;
    var $longDateFormat;
    //Paths
    var $httpPath;
    var $adminPath;
    var $blogPath;
    var $basePath;
    //[temporary] holder for instance of blog class
    var $blog;
            
    //Constructor - checks we've been given a valid username, and pulls in generic blog info
    function admin() 
    {
        //set the error string first, so we dont wipe out any errors
        $this->error = '';
        //set the locale
        setlocale(LC_ALL, 'en_GB');
        //pull in the session stuff
        $this->startSession();
        //setup our environment
        $this->id = $_SESSION['id'];
        $this->userName = $_SESSION['userName'];
        $this->realName = $_SESSION['realName'];
        $this->shortDateFormat = "Y-m-d";
        $this->longDateFormat = "r";
        $this->httpPath = "/blog/";
        $this->adminPath = $this->httpPath."admin/";
        $this->basePath = "/blogs/";
        if($this->httpPath[strlen($this->httpPath)-1]!="/") {
            $this->httpPath .= "/";
        }
        //if we are logged in start a blog instance, and setup the blog path
        if ($this->userName) {
            $this->blog = new blogs($this->userName);
            $this->blogPath = $this->basePath.$this->userName."/";
        }
    }
    
    //start / check our session
    function startSession() 
    {
        //set the session time out in seconds
        $maxSessionAge = 10800; //1 hour
        //setup the session stuff
        session_name("BlogSession");
        session_set_cookie_params($maxSessionAge,dirname($_SERVER['SCRIPT_NAME'])."/");
        session_start();
        //if we dont have a session, start one
        if (!$_SESSION[time]) {
            $_SESSION[time] = time();
        }
        //close the session if its too old
        elseif ((time()-$_SESSION[time]) > $maxSessionAge) {
            session_unset();
            $this->error =_("Session Expired");
            $this->startSession();
        }
        //else we are happy, and we just update the session time
        else {
            $_SESSION[oldTime] = $_SESSION[time];
            $_SESSION[time] = time();
        }
    }
    
    //logs people in
    function login() 
    {
        global $BlogDB;
        $username = "";
        $password = "";
        //sanitise username
        if (isset($_POST['username']) && trim($_POST['username']) != "" && safeuname(trim($_POST['username']))) {
            $username = trim($_POST['username']);
        } 
        else {
            $this->error = _("Please check the username field");
        }
        //sanitise password
        if (isset($_POST['password']) && trim($_POST['password']) != "") {
            $password = trim($_POST['password']);
        } 
        else {
            $this->error = _("Please check the password field");
        }
        //no errors?
        if(!$this->error)
        {
            //try to pull in the users details
            $sqlRow = $BlogDB->GetRow("SELECT id, name, password from users where enabled = true and username = '".$username."' limit 1;");

            //check we returned a user
            if (!$sqlRow) {
                $this->error =_("Invalid Username or Password");
            }
            else    {
                //check the password the user gave us agaisnt the one in the database
                if ($sqlRow['password']!=crypt($password, $sqlRow['password'])) {
                    $this->error =_("Invalid Username or Password");                
                }
                else {
                    //if everything matches dump some persistant details into the session
                    $_SESSION['id'] = $sqlRow['id'];
                    $_SESSION['userName'] = $username;
                    $_SESSION['realName'] = $sqlRow['name'];
                    $this->id = $_SESSION['id'];
                    $this->userName = $_SESSION['userName'];
                    $this->realName = $_SESSION['realName'];
                }
            }
        }
        //return a state to indicate wether login was successful
        if ($this->error) {
            return false;
        }
        else {
            return true;
        }
    }
    
    //admin menu
    function menu() {
        global $BlogDB;
        echo "<ul class=\"side-menu\">\n";
        echo "<li><a href=\"".$this->adminPath."newentry\">"._("Write new entry")."</a></li>\n";
        echo "<li><a href=\"".$this->adminPath."showentries\">"._("Edit entries")."</a></li>\n";
        echo "<li><a href=\"".$this->adminPath."settings\">"._("Settings")."</a></li>\n";
        echo "<li><a href=\"".$this->adminPath."moderatecomments\">"._("Comments");
        //count how many unmoderated comments there are
        $result = $BlogDB->GetOne("SELECT count(comments.id) from comments join entries on comments.post = entries.id where moderated = false and entries.user_id = ".$this->id.";");
        if($result){
            echo "<span style=\"font-size: 0.8em; color: red\"> (".$result[0].")</span>";
        }
        echo "</a></li>\n";
        echo "<li><a href=\"".$this->blogPath."\">"._("My blog")."</a></li>\n";
        echo "</ul>\n";
    }
    
    //destroys the session
    function logout () 
    {
        session_unset();
        header("Location: ".$this->blogPath);
    }
    
    //prints a login form
    function printLoginForm() 
    {
        echo "<h2>"._("Login")."</h2>\n";
        echo "<div class=\"td\">\n";
        if ($this->error) {
            echo "<div class=\"errorinfo\">"._("Error")." : " . $this->error . "</div>\n";
        }
        echo "<form action=\"".$this->adminPath."login\" method=\"post\" id=\"commentform\">\n";
        echo "<p>\n";
        echo "<input type=\"text\" name=\"username\" id=\"username\" value=\"" . (($this->error) ? strip_tags(trim($_POST['username'])) : "") . "\" size=\"22\" maxlength=\"50\" tabindex=\"1\" />\n";
        echo "<label for=\"username\">"._("Username")."</label>\n";
        echo "</p>\n";
        echo "<p>\n";
        echo "<input type=\"password\" name=\"password\" id=\"password\" size=\"22\" maxlength=\"128\" tabindex=\"2\" />\n";
        echo "<label for=\"password\">"._("Password")."</label>\n";
        echo "</p>\n";
        echo "<p>\n";
        echo "<input name=\"submit\" type=\"submit\" id=\"submit\" tabindex=\"4\" value=\"Login\" />\n";
        echo "</p>\n";
        echo "</form>\n";
        echo _("Not got an account?")."<br /><a href=\"{$this->adminPath}signup\">"._("Sign Up Here!")."</a></div>";
        echo "</div>\n";
    }

    // post an entry to the db
    function postEntry()
    {
        global $BlogDB;
        $category = '';
        $subject = '';
        $body = '';
        //sanitise category (make sure it IS a number!)
        if (isset($_POST['category']) && (int)$_POST['category'] != "" && (int)$_POST['category'] != 0) {
            $category = (int)$_POST['category'];
        } else {
            $this->error = _("Undefined Category!");
        }
        //sanitise subject
        if (isset($_POST['subject']) && trim($_POST['subject']) != "") {
            //complain if the subject contains html or html like things rather than dumping it without warning
            if (strip_tags($_POST['subject']) != $_POST['subject']) {
                $this->error = _("HTML is not allowed in the subject!");            
            }
            else {
                $subject = addslashes(trim($_POST['subject']));
            }
        } else {
            $this->error = _("No entry subject!");
        }        
        //sanitise body
        if (isset($_POST['body']) && trim($_POST['body']) != "") {
            $body = trim($_POST['body']);
            //we dont want to use nl2br if peeps are useing tinymce
            if (!$this->blog->editor) {
                $body = nl2br($body);
            }
            $body = addslashes($body);
        } else {
            $this->error = _("No entry body!");
        }
        //no errors, so continue..
        if (!$this->error) {
            //first we make our short subject
            $shortsubject = $this->blog->makeCleanString($subject,true);
            //need to check if there are any short titles like this one already
            $sql = $BlogDB->GetAll("SELECT shortsubject FROM entries WHERE user_id = {$this->id} AND shortsubject ~ '{$shortsubject}(_[0-9]{1,3}$|$)' ORDER BY char_length(shortsubject) DESC, shortsubject DESC LIMIT 1;");
            //if so we grab the last one, and add 1 to it..
            if (count($sql) != 0) {
                $sqlRow = array_shift($sql);
                // Put the matched _number into $matches[0] if there is one
                if (preg_match("/\_[0-9]{1,3}$/",$sqlRow['shortsubject'],$matches)) {
                    // Remove the _ to get the number, add 1 and append
                    $shortsubject .= '_' . ((int)substr($matches[0],1) + 1);
                } else {
                    $shortsubject .= '_1';
                }
            }
            //shortsubject is now safe..
            //insert our new entry
            $sql = $BlogDB->Execute("INSERT INTO entries (category, subject, body, user_id, shortsubject) VALUES ({$category},'{$subject}','{$body}','{$this->id}','{$shortsubject}')");
            if (!$sql) {
                error(2,_("Database commit failed")." - ".$BlogDB->ErrorMsg());
            } 
            else {
                // $row = db_last($sql, "entries");
                $row = $BlogDB->GetRow("SELECT * FROM entries WHERE user_id = {$this->id} AND shortsubject='".$shortsubject."'");
                $this->blog->printEntry($row,false,false);
            }
        }
        //re-display entry form if there are errors
        else {
            $this->printEntryForm($_POST,true);
        }    
    }
    
    //update an entry in the db
    function updateEntry($shortSubject)
    {        
        global $BlogDB;
        $category = '';
        $subject = '';
        $body = '';        
        //sanitise and check for existance of a short subject
        $shortSubject = $this->blog->makeCleanString($shortSubject);
        if (!$shortSubject) {
            error(4,_("If you dont give me a post how do you expect me to update it"));
        }
        //sanitise category (make sure it IS a number!)
        if (isset($_POST['category']) && (int)$_POST['category'] != "" && (int)$_POST['category'] != 0) {
            $category = (int)$_POST['category'];
        } else {
            $this->error = _("Undefined Category!");
        }
        //sanitise subject
        if (isset($_POST['subject']) && trim($_POST['subject']) != "") {
            //complain if the subject contains html or html like things rather than dumping it without warning
            if (strip_tags($_POST['subject']) != $_POST['subject']) {
                $this->error = _("HTML is not allowed in the subject!");            
            }
            else {
                $subject = addslashes(trim($_POST['subject']));
            }
        } else {
            $this->error = _("No entry subject!");
        }        
        //sanitise body
        if (isset($_POST['body']) && trim($_POST['body']) != "") {
            $body = trim($_POST['body']);
            //we dont want to use nl2br if peeps are useing tinymce
            if (!$this->blog->editor) {
                $body = nl2br($body);
            }
            $body = addslashes($body);
        } else {
            $this->error = _("No entry body!");
        }

        //no errors, so continue..
        if (!$this->error) {
            //check to see this post exists
            $sql = $BlogDB->GetRow("SELECT id from entries where shortsubject = '".$shortSubject."' AND user_id='".$this->id."';");
            //yes?, we can update it then..
            if ($sql) { 
                $sql = $BlogDB->Execute("UPDATE entries SET category = {$category}, subject = '{$subject}', body = '{$body}' WHERE shortsubject = '{$shortSubject}' AND user_id = '".$this->id."';");
                if (!$sql) {
                    error(2,_("Database commit failed - ").$BlogDB->ErrorMsg());
                } 
                else {
                    echo "<div class=\"updateinfo\">"._("Updated!")."</div>\n";
                    $this->updateForm($shortSubject);
                }
            }
            //cant update non-existant entrys
            else {
                 error(2,_("Cannot update entry, as it does not exist.".$BlogDB->ErrorMsg()));
            }
        }
        //redisplay entry form if there are errors
        else {
            $this->updateForm($shortSubject);
        }
    }

    //update form
    function updateForm($shortSubject)
    {
        global $BlogDB;
        //sanitise and check the short subject
        $shortSubject = $this->blog->makeCleanString($shortSubject);
        if (!$shortSubject) {
            error(4,_("If you dont give me a post how do you expect me to decide which one you want to edit?"));
        }
        //try to grab the post
        $row = $BlogDB->GetRow("SELECT subject, category, body, shortsubject from entries where shortsubject = '".$shortSubject."' AND user_id = '".$this->id."';");
        //if it exists we can do stuff with it
        if ($row) { 
            $this->printEntryForm($row,true,true);
        } 
        //else give an error
        else {
            error(2, _("Could not find the requested entry."));
        }
    }
/*    currently not used.. if we dont want to bring back the delete link in printEntry from blog.lib we can get rid of this entirely
    
    //delete an entry
    function deleteEntry($shortSubject)
    {
        //sanitise the short subject
        $shortSubject = $this->blog->makeCleanString($shortSubject);
        if (!$shortSubject) {
            error(4,_("If you dont give me a post how do you expect me to delete it"));
        }
        //check to see this post exists
        $sql = db_query("SELECT id from entries where shortsubject = '".$shortSubject."' AND user_id='".$this->id."';");
        $sqlNum = db_num_rows($sql);
        //yes?, we can delete it then..
        if ($sqlNum == 1) { 
            db_query("DELETE FROM entries WHERE shortsubject = '{$shortSubject}' AND user_id = '".$this->id."';");            
            echo "<p>"._("Entry deleted.")."</p>";
        }
        //can't delete non-existant entries
        else {
             error(2,_("Cannot delete entry, as it does not exist.".db_error()));
        }
    }
*/
    //update settings
    function updateSettings()
    {
        global $BlogDB;
        $name = '';
        $title = '';
        $description = '';
        $css = 'blog.css';
        $password = "";
        //sanitise name
        if (isset($_POST['name']) && trim($_POST['name']) != "") {
            $name = addslashes(trim(strip_tags($_POST['name'])));
        } 
        else {
            $this->error = _("Bad Input - Realname");
        }
        //sanitise title
        if (isset($_POST['title']) && trim($_POST['title']) != "") {
            //complain if the title contains html or html like things rather than dumping it without warning
            if (strip_tags($_POST['title']) != $_POST['title']) {
                $this->error = _("HTML is not allowed in the title!");            
            }
            else {
                $title = addslashes(trim($_POST['title']));
            }
        } 
        else {
            $this->error = _("Bad Input - Title");
        }
        //sanitise description
        if (isset($_POST['description']) && trim($_POST['description']) != "") {
            //complain if the description contains html or html like things rather than dumping it without warning
            if (strip_tags($_POST['description']) != $_POST['description']) {
                $this->error = _("HTML is not allowed in the description!");            
            }
            else {
                $description = addslashes(trim($_POST['description']));
            }
        }
        else {
            $this->error = _("Bad Input - Description");
        }
        //sanitise css
        if (isset($_POST['css'])) { // if its not set its defaulted...
            if (trim($_POST['css']) != "" && is_file($_POST['css'])) {
                $css = $_POST['css'];
            } 
            else {
                $this->error = _("Bad Input - CSS location");
            }
        }
        //sanitise password and encrypt
        if ($_POST['pass1']) {
            if ((isset($_POST['pass1']) && trim($_POST['pass1']) != "") && ($_POST['pass1']==$_POST['pass2'])) {
                $password = crypt($_POST['pass1']);
            } 
            else {
                $this->error = _("Bad Input - Password");
            }
        }
        // checkbox for comment moderation, either is or isnt
        if ($_POST['moderate'] != "") {
            $moderate = "true";
        }
        else {
            $moderate = "false";
        }    
        // checkbox for editor, either is or isnt
        if ($_POST['editor'] != "") {
            $editor = "true";
        } 
        else {
            $editor = "false";
        }
        //if there are no errors
        if (!$this->error) {
            //construct the query
            $query = "UPDATE USERS SET name='{$name}', title='{$title}', description='{$description}', css='{$css}', moderate={$moderate}, editor={$editor}";
            //if the password is set add that too
            if ($password) {
                $query .= ", password='{$password}'";