'; $grouplist = get_groups( 4 ); $search_name = $db->safesql( trim( htmlspecialchars( strip_tags( $_REQUEST['search_name'] ) ) ) ); $search_mail = $db->safesql( trim( htmlspecialchars( strip_tags( $_REQUEST['search_mail'] ) ) ) ); echo <<
{$lang['user_auser']}
{$lang['user_name']}
{$lang['user_pass']}
{$lang['user_mail']}
{$lang['user_acc']}
 
HTML; if( $search_reglevel ) $group_list = get_groups( $search_reglevel ); else $group_list = get_groups(); if( $search_banned == "yes" ) $ifch = "checked"; $search_order_user = array ('----' => '', 'asc' => '', 'desc' => '' ); if( ! empty( $search_order_u ) ) { $search_order_user[$search_order_u] = 'selected'; } else { $search_order_user['----'] = 'selected'; } $search_order_reg = array ('----' => '', 'asc' => '', 'desc' => '' ); if( ! empty( $search_order_r ) ) { $search_order_reg[$search_order_r] = 'selected'; } else { $search_order_reg['----'] = 'selected'; } $search_order_last = array ('----' => '', 'asc' => '', 'desc' => '' ); if( ! empty( $search_order_l ) ) { $search_order_last[$search_order_l] = 'selected'; } else { $search_order_last['----'] = 'selected'; } $search_order_news = array ('----' => '', 'asc' => '', 'desc' => '' ); if( ! empty( $search_order_n ) ) { $search_order_news[$search_order_n] = 'selected'; } else { $search_order_news['----'] = 'selected'; } $search_order_coms = array ('----' => '', 'asc' => '', 'desc' => '' ); if( ! empty( $search_order_c ) ) { $search_order_coms[$search_order_c] = 'selected'; } else { $search_order_coms['----'] = 'selected'; } echo <<
{$lang['user_se']}
{$lang['user_name']} [?] {$lang['edit_regdate']} {$lang['edit_fdate']} {$lang['edit_tdate']}
{$lang['user_mail']} [?] {$lang['edit_entedate']} {$lang['edit_fdate']} {$lang['edit_tdate']}
{$lang['user_banned']} {$lang['edit_newsnum']} {$lang['edit_fdate']} [?] {$lang['edit_tdate']} [?]
{$lang['user_acc']} {$lang['edit_comsnum']} {$lang['edit_fdate']} [?] {$lang['edit_tdate']} [?]
{$lang['user_order']}
{$lang['user_name']} {$lang['user_reg']} {$lang['user_last']} {$lang['user_news']} {$lang['user_coms']}
 
HTML; $where = array (); if( ! empty( $search ) ) { $where[] = "name like '$search_name%'"; } if( ! empty( $search_mail ) ) { $where[] = "email='$search_mail'"; } if( ! empty( $search_banned ) ) { $search_banned = $db->safesql( $search_banned ); $where[] = "banned='$search_banned'"; } if( ! empty( $fromregdate ) ) { $where[] = "reg_date>='" . strtotime( $fromregdate ) . "'"; } if( ! empty( $toregdate ) ) { $where[] = "reg_date<='" . strtotime( $toregdate ) . "'"; } if( ! empty( $fromentdate ) ) { $where[] = "lastdate>='" . strtotime( $fromentdate ) . "'"; } if( ! empty( $toentdate ) ) { $where[] = "lastdate<='" . strtotime( $toentdate ) . "'"; } if( ! empty( $search_news_f ) ) { $search_news_f = intval( $search_news_f ); $where[] = "news_num>='$search_news_f'"; } if( ! empty( $search_news_t ) ) { $search_news_t = intval( $search_news_t ); $where[] = "news_num<'$search_news_t'"; } if( ! empty( $search_coms_f ) ) { $search_coms_f = intval( $search_coms_f ); $where[] = "comm_num>='$search_coms_f'"; } if( ! empty( $search_coms_t ) ) { $search_coms_t = intval( $search_coms_t ); $where[] = "comm_num<'$search_coms_t'"; } if( $search_reglevel ) { $search_reglevel = intval( $search_reglevel ); $where[] = "user_group='$search_reglevel'"; } $where = implode( " AND ", $where ); if( ! $where ) $where = "user_group < '4'"; $order_by = array (); if( ! empty( $search_order_u ) ) { $order_by[] = "name $search_order_u"; } if( ! empty( $search_order_r ) ) { $order_by[] = "reg_date $search_order_r"; } if( ! empty( $search_order_l ) ) { $order_by[] = "lastdate $search_order_l"; } if( ! empty( $search_order_n ) ) { $order_by[] = "news_num $search_order_n"; } if( ! empty( $search_order_c ) ) { $order_by[] = "comm_num $search_order_c"; } $order_by = implode( ", ", $order_by ); if( ! $order_by ) $order_by = "reg_date asc"; // ------ Запрос к базе $query_count = "SELECT COUNT(*) as count FROM " . USERPREFIX . "_users WHERE $where"; $result_count = $db->super_query( $query_count ); $all_count_news = $result_count['count']; echo <<
{$lang['user_list']} ({$all_count_news})
HTML; $news_per_page = 50; $start_from = intval( $start_from ); $i = $start_from; // ------ Запрос к базе $db->query( "SELECT user_id, name, user_group, reg_date, lastdate, news_num, comm_num, banned FROM " . USERPREFIX . "_users WHERE {$where} ORDER BY {$order_by} LIMIT {$start_from},{$news_per_page}" ); while ( $row = $db->get_row() ) { $i ++; $last_login = langdate( 'd/m/Y - H:i', $row['lastdate'] ); $user_name = "" . $row[name] . ""; if( $row[news_num] == 0 ) { $news_link = "$row[news_num]"; } else { $news_link = "[" . $row[news_num] . "]"; } if( $row[comm_num] == 0 ) { $comms_link = $row['comm_num']; } else { $comms_link = "[" . $row[comm_num] . "]"; } $user_delete = "[" . $lang[user_del] . "]"; if( $row['banned'] == 'yes' ) $user_level = "" . $lang['user_ban'] . ""; else $user_level = $user_group[$row['user_group']]['group_name']; if( $row['user_group'] == 1 ) $user_delete = ""; echo ""; } $db->free(); $npp_nav = ""; if( $start_from > 0 ) { $previous = $start_from - $news_per_page; $npp_nav .= "<< $lang[edit_prev]"; } // pagination if( $all_count_news > $news_per_page ) { $npp_nav .= " [ "; $enpages_count = @ceil( $all_count_news / $news_per_page ); $enpages_start_from = 0; $enpages = ""; for($j = 1; $j <= $enpages_count; $j ++) { if( $enpages_start_from != $start_from ) { $enpages .= "$j "; } else { $enpages .= " $j "; } $enpages_start_from += $news_per_page; } $npp_nav .= $enpages; $npp_nav .= " ] "; } // pagination if( $all_count_news > $i ) { $how_next = $all_count_news - $i; if( $how_next > $news_per_page ) { $how_next = $news_per_page; } $npp_nav .= "$lang[edit_next] $how_next >>"; } echo <<
{$lang['user_name']} {$lang['user_reg']}   {$lang['user_last']}   {$lang['user_news']} {$lang['user_coms']} {$lang['user_acc']} {$lang['user_action']}
 $user_name "; echo (langdate( "d/m/Y - H:i", $row['reg_date'] )); echo "  $last_login  $news_link $comms_link  $user_level [$lang[user_edit]] $user_delete [$lang[bb_b_mail]] [$lang[nl_pm]]
{$npp_nav}
HTML; echofooter(); } // ******************************************************************************** // Добавление пользователя // ******************************************************************************** elseif( $action == "adduser" ) { if( $_REQUEST['user_hash'] == "" or $_REQUEST['user_hash'] != $dle_login_hash ) { die( "Hacking attempt! User not found" ); } if( ! $_POST['regusername'] ) { msg( "error", $lang['user_err'], $lang['user_err_1'], "javascript:history.go(-1)" ); } if( preg_match( "/[\||\'|\<|\>|\"|\!|\$|\@|\&\~\*\+]/", $_POST['regusername'] ) ) msg( "error", $lang['user_err'], $lang['user_err_1'], "javascript:history.go(-1)" ); if( ! $_POST['regpassword'] ) { msg( "error", $lang['user_err'], $lang['user_err_2'], "javascript:history.go(-1)" ); } if( (! preg_match("/^[0-9a-z_\.\-]+@[0-9a-z_\.\-]+\.[a-z]{2,6}$/i", $_POST['regemail'] )) or (empty( $_POST['regemail'] )) ) { msg( "error", $lang['user_err_1'], $lang['user_err_1'], "javascript:history.go(-1)" ); } $regusername = $db->safesql($_POST['regusername']); $regemail = $db->safesql($_POST['regemail']); $row = $db->super_query( "SELECT name, email FROM " . USERPREFIX . "_users WHERE name = '$regusername' OR email = '$regemail'" ); if( $row['name'] ) { msg( "error", $lang['user_err'], $lang['user_err_3'], "javascript:history.go(-1)" ); } if( $row['email'] ) { msg( "error", $lang['user_err'], $lang['user_err_4'], "javascript:history.go(-1)" ); } $add_time = time() + ($config['date_adjust'] * 60); $regpassword = md5( md5( $_POST['regpassword'] ) ); $reglevel = intval( $_POST['reglevel'] ); if ( $member_id['user_group'] != 1 AND $reglevel < 2 ) $reglevel = 4; $db->query( "INSERT INTO " . USERPREFIX . "_users (name, password, email, user_group, reg_date, lastdate, info, signature, favorites, xfields) values ('$regusername', '$regpassword', '$regemail', '$reglevel', '$add_time', '$add_time','','','','')" ); msg( "info", $lang['user_addok'], "$lang[user_ok] $regusername $lang[user_ok_1] {$user_group[$reglevel]['group_name']}", "$PHP_SELF?mod=editusers&action=list" ); } // ******************************************************************************** // Редактирование пользователя // ******************************************************************************** elseif( $action == "edituser" ) { if( isset( $_REQUEST['user'] ) ) { $user = $db->safesql( strip_tags( urldecode( $_GET['user'] ) ) ); if( $user != "" ) { $row = $db->super_query( "SELECT user_id FROM " . USERPREFIX . "_users WHERE name = '$user'" ); if( ! $row['user_id'] ) die( "User not found" ); header( "Location: ?mod=editusers&action=edituser&id=" . $row['user_id'] ); die( "User not found" ); } } $row = $db->super_query( "SELECT " . USERPREFIX . "_users.*, " . USERPREFIX . "_banned.days, " . USERPREFIX . "_banned.descr, " . USERPREFIX . "_banned.date as banned_date FROM " . USERPREFIX . "_users LEFT JOIN " . USERPREFIX . "_banned ON " . USERPREFIX . "_users.user_id=" . USERPREFIX . "_banned.users_id WHERE user_id = '$id'" ); if( ! $row['user_id'] ) die( "User not found" ); if ($row['user_id'] != 1) $delete_link = ""; else $delete_link = ""; if ($member_id['user_group'] != 1 AND $row['user_group'] == 1 ) die( $lang['edit_not_admin'] ); include_once ENGINE_DIR . '/classes/parse.class.php'; $parse = new ParseFilter( ); $parse->safe_mode = true; $row['fullname'] = $parse->decodeBBCodes( $row['fullname'], false ); $row['icq'] = $parse->decodeBBCodes( $row['icq'], false ); $row['land'] = $parse->decodeBBCodes( $row['land'], false ); $row['info'] = $parse->decodeBBCodes( $row['info'], false ); $row['signature'] = $parse->decodeBBCodes( $row['signature'], false ); $row['descr'] = $parse->decodeBBCodes( $row['descr'], false ); echo << {$lang['user_edhead']}
HTML; $last_date = langdate( "j F Y - H:i", $row['lastdate'] ); $reg_date = langdate( "j F Y - H:i", $row['reg_date'] ); if( $row['time_limit'] != "" ) $row['time_limit'] = date( "Y-m-d H:i", $row['time_limit'] ); if( $row['foto'] ) { $avatar = $config['http_home_url'] . "uploads/fotos/" . $row['foto']; } else { $avatar = "engine/skins/images/noavatar.png"; } $xfieldsaction = "admin"; $xfieldsid = $row['xfields']; include (ENGINE_DIR . '/inc/userfields.php'); echo <<
{$row['name']}
{$output}
IP: {$row['logged_ip']}
{$lang['user_news']} {$row['news_num']}
{$lang['user_last']} {$last_date}
{$lang['user_reg']} {$reg_date}
{$lang['user_mail']}
{$lang['user_newlogin']}
{$lang['user_newpass']}
{$lang['user_acc']}
{$lang['user_gtlimit']} [?]
{$lang['user_banned']} [?]
{$lang['ban_date']} [?] {$endban}
{$lang['ban_descr']}
{$lang['restricted']}
{$lang['restricted_date']} [?] {$end_restricted}
{$lang['user_del_comments']}
{$lang['opt_fullname']}
{$lang['opt_icq']}
{$lang['opt_land']}
{$lang['user_avatar']}
{$lang['user_del_avatar']}
{$lang['extra_minfo']}
{$lang['extra_signature']}
      {$delete_link}
HTML; echo <<
HTML; } // ******************************************************************************** // Сохранение отредактированной информации // ******************************************************************************** elseif( $action == "doedituser" ) { if( ! $id ) { die( $lang['user_nouser'] ); } if( $_REQUEST['user_hash'] == "" or $_REQUEST['user_hash'] != $dle_login_hash ) { die( "Hacking attempt! User not found" ); } $row = $db->super_query( "SELECT user_id, user_group, email FROM " . USERPREFIX . "_users WHERE user_id = '$id'" ); if( ! $row['user_id'] ) die( "User not found" ); if ($member_id['user_group'] != 1 AND $row['user_group'] == 1 ) die( $lang['edit_not_admin'] ); $editlevel = intval( $_POST['editlevel'] ); if ($member_id['user_group'] != 1 AND $editlevel < 2 ) die( $lang['admin_not_access'] ); include_once ENGINE_DIR . '/classes/parse.class.php'; $parse = new ParseFilter(); $editlogin = $db->safesql( $parse->process( $_POST['editlogin'] ) ); $editfullname = $db->safesql( $parse->process( $_POST['editfullname'] ) ); if ($_POST['editicq']) $editicq = intval( $_POST['editicq'] ); else $editicq = ""; $editland = $db->safesql( $parse->process( $_POST['editland'] ) ); $editinfo = $db->safesql( $parse->BB_Parse( $parse->process( $_POST['editinfo'] ), false ) ); $editsignature = $db->safesql( $parse->BB_Parse( $parse->process( $_POST['editsignature'] ), false ) ); $editmail = $db->safesql( $parse->process( $_POST['editmail'] ) ); $time_limit = trim( $_POST['time_limit'] ) ? strtotime( $_POST['time_limit'] ) : ""; if ($editmail != $row['email']) { if ( $db->num_rows( $db->query( "SELECT user_id FROM " . USERPREFIX . "_users WHERE email = '$editmail'" ) ) ) header( "Location: {$_SERVER['REQUEST_URI']}" ); } if ( $_POST['banned'] ) $banned = "yes"; if( ! $user_group[$editlevel]['time_limit'] ) $time_limit = ""; $image = $_FILES['image']['tmp_name']; $image_name = $_FILES['image']['name']; $image_size = $_FILES['image']['size']; $img_name_arr = explode( ".", $image_name ); $type = end( $img_name_arr ); if( $image_name != "" ) $image_name = totranslit( stripslashes( $img_name_arr[0] ) ) . "." . totranslit( $type ); if( is_uploaded_file( $image ) ) { if( $image_size < 100000 ) { $allowed_extensions = array ("jpg", "png", "jpe", "jpeg", "gif" ); if( (in_array( $type, $allowed_extensions ) or in_array( strtolower( $type ), $allowed_extensions )) and $image_name ) { include_once ENGINE_DIR . '/classes/thumb.class.php'; $res = @move_uploaded_file( $image, ROOT_DIR . "/uploads/fotos/" . $id . "." . $type ); if( $res ) { @chmod( ROOT_DIR . "/uploads/fotos/" . $id . "." . $type, 0666 ); $thumb = new thumbnail( ROOT_DIR . "/uploads/fotos/" . $id . "." . $type ); if( $thumb->size_auto( $user_group[$member_id['user_group']]['max_foto'] ) ) { $thumb->jpeg_quality( $config['jpeg_quality'] ); $thumb->save( ROOT_DIR . "/uploads/fotos/foto_" . $id . "." . $type ); } else { @rename( ROOT_DIR . "/uploads/fotos/" . $id . "." . $type, ROOT_DIR . "/uploads/fotos/foto_" . $id . "." . $type ); } @chmod( ROOT_DIR . "/uploads/fotos/foto_" . $id . "." . $type, 0666 ); $foto_name = "foto_" . $id . "." . $type; $db->query( "UPDATE " . USERPREFIX . "_users set foto='$foto_name' WHERE user_id='$id'" ); } } } @unlink( ROOT_DIR . "/uploads/fotos/" . $id . "." . $type ); } if( $_POST['del_foto'] == "yes" ) { $row = $db->super_query( "SELECT foto FROM " . USERPREFIX . "_users WHERE user_id='$id'" ); $db->query( "UPDATE " . USERPREFIX . "_users set foto='' WHERE user_id='$id'" ); @unlink( ROOT_DIR . "/uploads/fotos/" . $row['foto'] ); } $xfieldsaction = "init_admin"; include (ENGINE_DIR . '/inc/userfields.php'); $filecontents = array (); if( ! empty( $postedxfields ) ) { foreach ( $postedxfields as $xfielddataname => $xfielddatavalue ) { if( ! $xfielddatavalue ) { continue; } $xfielddatavalue = $db->safesql( $parse->BB_Parse( htmlspecialchars( $parse->process( $xfielddatavalue ) ), false ) ); $xfielddataname = $db->safesql( $xfielddataname ); $xfielddataname = str_replace( "|", "|", $xfielddataname ); $xfielddatavalue = str_replace( "|", "|", $xfielddatavalue ); $filecontents[] = "$xfielddataname|$xfielddatavalue"; } $filecontents = implode( "||", $filecontents ); } else $filecontents = ''; $sql_update = "UPDATE " . USERPREFIX . "_users set user_group='$editlevel', banned='$banned', icq='$editicq', land='$editland', info='$editinfo', signature='$editsignature', email='$editmail', fullname='$editfullname', time_limit='$time_limit', xfields='$filecontents'"; if( trim( $editlogin ) != "" ) { $row = $db->super_query( "SELECT user_id FROM " . USERPREFIX . "_users WHERE name='$editlogin'" ); if( ! $row['user_id'] ) { $row = $db->super_query( "SELECT name FROM " . USERPREFIX . "_users WHERE user_id='$id'" ); $db->query( "UPDATE " . PREFIX . "_post SET autor='$editlogin' WHERE autor='{$row['name']}'" ); $db->query( "UPDATE " . PREFIX . "_comments SET autor='$editlogin' WHERE autor='{$row['name']}' AND is_register='1'" ); $db->query( "UPDATE " . USERPREFIX . "_pm SET user_from='$editlogin' WHERE user_from='{$row['name']}'" ); $db->query( "UPDATE " . PREFIX . "_vote_result SET name='$editlogin' WHERE name='{$row['name']}'" ); $db->query( "UPDATE " . PREFIX . "_images SET author='$editlogin' WHERE author='{$row['name']}'" ); $sql_update .= ", name='$editlogin'"; } else msg( "error", $lang['addnews_error'], $lang['user_edit_found'], "javascript:history.go(-1)" ); } if( $_POST['restricted'] ) { $restricted = intval( $_POST['restricted'] ); $restricted_days = intval( $_POST['restricted_days'] ); $sql_update .= ", restricted='$restricted'"; if( $restricted_days != $_POST['prev_restricted'] ) { $restricted_date = time() + ($config['date_adjust'] * 60); $restricted_date = $restricted_days ? $restricted_date + ($restricted_days * 60 * 60 * 24) : ''; $sql_update .= ", restricted_days='$restricted_days', restricted_date='$restricted_date'"; } } else { $sql_update .= ", restricted='0', restricted_days='0', restricted_date=''"; } if( trim( $editpass ) != "" ) { $editpass = md5( md5( $_POST['editpass'] ) ); $sql_update .= ", password='$editpass'"; } $sql_update .= " WHERE user_id='$id'"; $db->query( $sql_update ); if( $banned ) { $banned_descr = $db->safesql( $parse->BB_Parse( $parse->process( $_POST['banned_descr'] ), false ) ); $this_time = time() + ($config['date_adjust'] * 60); $banned_date = intval( $_POST['banned_date'] ); $this_time = $banned_date ? $this_time + ($banned_date * 60 * 60 * 24) : 0; $row = $db->super_query( "SELECT users_id, days FROM " . USERPREFIX . "_banned WHERE users_id = '$id'" ); if( ! $row['users_id'] ) $db->query( "INSERT INTO " . USERPREFIX . "_banned (users_id, descr, date, days) values ('$id', '$banned_descr', '$this_time', '$banned_date')" ); else { if( $row['days'] != $banned_date ) $db->query( "UPDATE " . USERPREFIX . "_banned set descr='$banned_descr', days='$banned_date', date='$this_time' WHERE users_id = '$id'" ); else $db->query( "UPDATE " . USERPREFIX . "_banned set descr='$banned_descr' WHERE users_id = '$id'" ); } @unlink( ENGINE_DIR . '/cache/system/banned.php' ); } else { $db->query( "DELETE FROM " . USERPREFIX . "_banned WHERE users_id = '$id'" ); @unlink( ENGINE_DIR . '/cache/system/banned.php' ); } if( $_POST['del_comments'] ) { $result = $db->query( "SELECT COUNT(*) as count, post_id FROM " . PREFIX . "_comments WHERE user_id='$id' AND is_register='1' GROUP BY post_id" ); while ( $row = $db->get_array( $result ) ) { $db->query( "UPDATE " . PREFIX . "_post SET comm_num=comm_num-{$row['count']} where id='{$row['post_id']}'" ); } $db->free( $result ); $db->query( "UPDATE " . USERPREFIX . "_users set comm_num='0' where user_id ='$id'" ); $db->query( "DELETE FROM " . PREFIX . "_comments WHERE user_id='$id' AND is_register='1'" ); } header( "Location: {$_SERVER['REQUEST_URI']}" ); } // ******************************************************************************** // Удаление пользователя // ******************************************************************************** elseif( $action == "dodeleteuser" ) { if( $_REQUEST['user_hash'] == "" or $_REQUEST['user_hash'] != $dle_login_hash ) { die( "Hacking attempt! User not found" ); } if( ! $id ) { die( $lang['user_nouser'] ); } if( $id == 1 ) { die( $lang['user_undel'] ); } $row = $db->super_query( "SELECT user_id, user_group, name, foto FROM " . USERPREFIX . "_users WHERE user_id='$id'" ); if( ! $row['user_id'] ) die( "User not found" ); if ($member_id['user_group'] != 1 AND $row['user_group'] == 1 ) die( $lang['user_undel'] ); $db->query( "DELETE FROM " . USERPREFIX . "_pm WHERE user_from = '{$row['name']}' AND folder = 'outbox'" ); @unlink( ROOT_DIR . "/uploads/fotos/" . $row['foto'] ); $db->query( "delete FROM " . USERPREFIX . "_users WHERE user_id='$id'" ); $db->query( "delete FROM " . USERPREFIX . "_banned WHERE users_id='$id'" ); $db->query( "delete FROM " . USERPREFIX . "_pm WHERE user='$id'" ); if ($_GET['popup'] == "yes") { die( "".$lang[user_ok]." ".$lang[user_delok_1]."" ); } else { msg( "info", $lang['user_delok'], "$lang[user_ok] $user $lang[user_delok_1]", "$PHP_SELF?mod=editusers&action=list" ); } } elseif( $action == "dodelcomments" ) { if( ! $id ) { die( $lang['user_nouser'] ); } if( $_REQUEST['user_hash'] == "" or $_REQUEST['user_hash'] != $dle_login_hash ) { die( "Hacking attempt! User not found" ); } $result = $db->query( "SELECT COUNT(*) as count, post_id FROM " . PREFIX . "_comments WHERE user_id='$id' AND is_register='1' GROUP BY post_id" ); while ( $row = $db->get_array( $result ) ) { $db->query( "UPDATE " . PREFIX . "_post set comm_num=comm_num-{$row['count']} where id='{$row['post_id']}'" ); } $db->free( $result ); $db->query( "UPDATE " . USERPREFIX . "_users set comm_num='0' where user_id ='$id'" ); $db->query( "DELETE FROM " . PREFIX . "_comments WHERE user_id='$id' AND is_register='1'" ); msg( "info", $lang['user_delok'], $lang['comm_alldel'], "$PHP_SELF?mod=editusers&action=list" ); } ?>