admin.lib.php

<?php
/*
 * blogs class - provides functions for blogs
 */

// Some useful validation functions
require_once("validation.lib.php");
// random other functions that aren't validation or db related
require_once("miscfunctions.lib.php");
//stuff from blog.lib will be useful
require_once("blog.lib.php");

//Our Blogs Class
class admin {
	//Blog ID
	var $id;
	//Blogger's Details
	var $userName;
	var $realName;
	//Errors
	var $error;
	//Date formats
	var $shortDateFormat;
	var $longDateFormat;
	//Paths
	var $httpPath;
	var $adminPath;
	var $blogPath;
	var $basePath;
	//[temporary] holder for instance of blog class
	var $blog;
			
	//Constructor - checks we've been given a valid username, and pulls in generic blog info
	function admin() 
	{
		global $session, $BlogDB, $baseurl;

		//set the error string first, so we dont wipe out any errors
		$this->error = '';
		//set the locale
		setlocale(LC_ALL, 'en_GB');
		//pull in the session stuff
		$this->startSession();
		//setup our environment
		$this->userName = $session->username;
		$this->realName = $session->fullname;

		$this->id = $BlogDB->GetOne("select id from users where username='".$this->userName."'");

		$this->shortDateFormat = "Y-m-d";
		$this->longDateFormat = "r";
		$this->httpPath = $baseurl."/Blogs/";
		$this->adminPath = $this->httpPath."Admin/";
		$this->basePath = $baseurl."/Blogs/";
		if($this->httpPath[strlen($this->httpPath)-1]!="/") {
			$this->httpPath .= "/";
		}
		//if we are logged in start a blog instance, and setup the blog path
		if ($this->userName) {
			$this->blog = new blogs($this->userName);
			$this->blogPath = $this->basePath.$this->userName."/";
		}
	}
	
	//start / check our session
	function startSession() 
	{
		//set the session time out in seconds
		$maxSessionAge = 10800; //1 hour
		//setup the session stuff
		session_name("BlogSession");
		session_set_cookie_params($maxSessionAge,dirname($_SERVER['SCRIPT_NAME'])."/");
		session_start();
		//if we dont have a session, start one
		if (!$_SESSION[time]) {
			$_SESSION[time] = time();
		}
		//close the session if its too old
		elseif ((time()-$_SESSION[time]) > $maxSessionAge) {
			session_unset();
			$this->error =_("Session Expired");
			$this->startSession();
		}
		//else we are happy, and we just update the session time
		else {
			$_SESSION[oldTime] = $_SESSION[time];
			$_SESSION[time] = time();
		}
	}
	
	//logs people in
	function login() 
	{		
		global $BlogDB, $smarty;
		$username = "";
		$password = "";
		//sanitise username
		if (isset($_POST['username']) && trim($_POST['username']) != "" && safeuname(trim($_POST['username']))) {
			$username = trim($_POST['username']);
		} 
		else {
			$this->error = _("Please check the username field");
		}
		//sanitise password
		if (isset($_POST['password']) && trim($_POST['password']) != "") {
			$password = trim($_POST['password']);
		} 
		else {
			$this->error = _("Please check the password field");
		}
		//no errors?
		if(!$this->error)
		{
			//try to pull in the users details
			$sqlRow = $BlogDB->GetRow("SELECT id, name, password from users where enabled = true and username = '".$username."' limit 1;");

			//check we returned a user
			if (!$sqlRow) {
				$this->error =_("Invalid Username or Password");
			}
			else	{
				//check the password the user gave us agaisnt the one in the database
				if ($sqlRow['password']!=crypt($password, $sqlRow['password'])) {
					$this->error =_("Invalid Username or Password");				
				}
				else {
					//if everything matches dump some persistant details into the session
					$_SESSION['id'] = $sqlRow['id'];
					$_SESSION['userName'] = $username;
					$_SESSION['realName'] = $sqlRow['name'];
					$this->id = $_SESSION['id'];
					$this->userName = $_SESSION['userName'];
					$this->realName = $_SESSION['realName'];
				}
			}
		}
		//return a state to indicate wether login was successful
		if ($this->error) {
			return false;
		}
		else {
			return true;
		}
	}
	
	//admin menu
	function menu() {
		global $BlogDB, $smarty, $session;

		$submenu = array();
		if (blogger($session->username)) {
			$submenu[_("My blog")] = $this->blogPath;
			$submenu[_("Write new entry")] = $this->adminPath."newentry";
			$submenu[_("Edit entries")] = $this->adminPath."showentries";
			$submenu[_("Settings")] = $this->adminPath."Settings";

			$comments = _("Comments");
			$result = $BlogDB->GetOne("SELECT count(comments.id) from comments join entries on comments.post = entries.id where moderated = false and entries.user_id = ".$this->id.";");
			if($result){
				$comments .= " (".$result.")";
				}
			$submenu[$comments] = $this->adminPath."moderatecomments";
		} else {
			$submenu[_("Start a Blog")] = $this->adminPath."signup";
		}

		$menu = $smarty->get_template_vars("menu");
		$menu[Blogs] = $submenu;
		$smarty->assign("menu", $menu);
	}
	
	//destroys the session
	function logout () 
	{
		session_unset();
		header("Location: ".$this->blogPath);
	}
	
	//prints a login form
	function printLoginForm() 
	{
		echo "The Login Form display function has been called. This should not happen.";
	}

	// post an entry to the db
	function postEntry()
	{
		global $BlogDB;
		$category = '';
		$subject = '';
		$body = '';
		//sanitise category (make sure it IS a number!)
		if (isset($_POST['category']) && (int)$_POST['category'] != "" && (int)$_POST['category'] != 0) {
			$category = (int)$_POST['category'];
		} else {
			$this->error = _("Undefined Category!");
		}
		//sanitise subject
		if (isset($_POST['subject']) && trim($_POST['subject']) != "") {
			//complain if the subject contains html or html like things rather than dumping it without warning