From be8c6a6629b6b5919263664af1d28c426f5968d2 Mon Sep 17 00:00:00 2001 From: Gregory PLANCHAT Date: Thu, 15 Sep 2011 09:08:32 +0200 Subject: [PATCH] Updated alliances page, fixed SQL injections (hoegarden) Fided minor bugs Signed-off-by: Gregory PLANCHAT --- alliance.php | 2273 +++++++++-------- includes/application/code/core/Legacies.php | 2 +- .../Core/Controller/Response/Http.php | 2 +- .../code/core/Legacies/Core/Model.php | 46 +- .../code/core/Legacies/Database.php | 16 +- .../core/Legacies/Empire/Model/Planet.php | 33 +- .../code/core/Legacies/Empire/Model/User.php | 4 +- .../Legacies/Empire/Model/User/Message.php | 3 + .../scripts/deprecated/alliance_admin.tpl | 3 +- .../alliance_admin_request_form.tpl | 52 +- .../scripts/deprecated/alliance_applyform.tpl | 1 + includes/functions/ShowGalaxyRows.php | 2 +- overview.php | 25 +- reg.php | 2 +- 14 files changed, 1283 insertions(+), 1181 deletions(-) diff --git a/alliance.php b/alliance.php index 1301154..b3b716f 100644 --- a/alliance.php +++ b/alliance.php @@ -29,1171 +29,1214 @@ */ define('INSTALL' , false); - -$mode = $_GET['mode']; -if (empty($mode)) { unset($mode); } -$a = intval($_GET['a']); -if (empty($a)) { unset($a); } -$sort1 = intval($_GET['sort1']); -if (empty($sort1)) { unset($sort1); } -$sort2 = intval($_GET['sort2']); -if (empty($sort2)) { unset($sort2); } -$d = $_GET['d']; -if ((!is_numeric($d)) || (empty($d) && $d != 0)) - unset($d); - -$edit = $_GET['edit']; - -if (empty($edit)) - unset($edit); - -$rank = intval($_GET['rank']); -if (empty($rank)) - unset($rank); - -$kick = intval($_GET['kick']); -if (empty($kick)) - unset($kick); - -$id = intval($_GET['id']); -if (empty($id)) - unset($id); - define('INSIDE' , true); require_once dirname(__FILE__) .'/common.php'; +$user = Legacies_Empire_Model_User::getSingleton(); +$db = Legacies_Database::getSingleton(); -if(empty($user['id'])){ +if(!$user->getId()){ echo ''; } -$mode = $_GET['mode']; -$yes = $_GET['yes']; -$edit = $_GET['edit']; -$allyid = intval($_GET['allyid']); -$show = intval($_GET['show']); -$sort = intval($_GET['sort']); -$sendmail = intval($_GET['sendmail']); -$t = $_GET['t']; -$a = intval($_GET['a']); -$tag = mysql_escape_string($_GET['tag']); +$mode = isset($_GET['mode']) ? $_GET['mode'] : null; +$yes = isset($_GET['yes']) ? $_GET['yes'] : null; +$edit = isset($_GET['edit']) ? $_GET['edit'] : null; +$allyid = isset($_GET['allyid']) ? intval($_GET['allyid']) : null; +$kick = isset($_GET['kick']) ? $_GET['kick'] : null; +$show = isset($_GET['show']) ? intval($_GET['show']) : null; +$sort = isset($_GET['sort']) ? intval($_GET['sort']) : null; +$sendmail = isset($_GET['sendmail']) ? intval($_GET['sendmail']) : null; +$rank = isset($_GET['rank']) ? intval($_GET['rank']) : null; +$t = isset($_GET['t']) ? $_GET['t'] : null; +$a = isset($_GET['a']) ? intval($_GET['a']) : null; +$tag = isset($_GET['tag']) ? $db->quote($_GET['tag']) : null; +$page = isset($page) ? $page : null; +$d = isset($_GET['d']) ? $_GET['d'] : null; +$id = isset($_GET['id']) ? $_GET['id'] : null; + +$_POST['id'] = isset($_POST['id']) ? $_POST['id'] : null; +$_POST['t'] = isset($_POST['t']) ? $_POST['t'] : null; +$_POST['options'] = isset($_POST['options']) ? $_POST['options'] : null; +$_POST['action'] = isset($_POST['action']) ? $_POST['action'] : null; includeLang('alliance'); -/* - Alianza consiste en tres partes. - La primera es la comun. Es decir, no se necesita comprobar si se esta en una alianza o no. - La segunda, es sin alianza. Eso implica las solicitudes. - La ultima, seria cuando ya se esta dentro de una. -*/ -// Parte inicial. +/** + *Alliance information display. + */ -if ($_GET['mode'] == 'ainfo') { - $a = intval($_GET['a']); - $tag = mysql_escape_string($_GET['tag']); - // Evitamos errores casuales xD - // query - $lang['Alliance_information'] = "Information Alliance"; +if ($mode == 'ainfo') { + $lang['Alliance_information'] = "Information Alliance"; - if (isset($_GET['tag'])) { - $allyrow = doquery("SELECT * FROM {{table}} WHERE ally_tag='{$tag}'", "alliance", true); - } elseif (is_numeric($a) && $a != 0) { - $allyrow = doquery("SELECT * FROM {{table}} WHERE id='{$a}'", "alliance", true); - } else { + if ($tag) { + $allyrow = doquery("SELECT * FROM {{table}} WHERE ally_tag={$tag}", "alliance", true); + } elseif (is_numeric($a) && $a != 0) { + $allyrow = doquery("SELECT * FROM {{table}} WHERE id='{$a}'", "alliance", true); + } else { message("Cette alliance n'existe pas !", "Information Alliance (1)"); - } - // Si no existe - if (!$allyrow) { + } + // if not exists + if (!$allyrow) { message("Cette alliance n'existe pas !", "Information Alliance (1)"); - } - extract($allyrow); + } + extract($allyrow); - if ($ally_image != "") { - $ally_image = ""; - } + if ($ally_image != "") { + $ally_image = ""; + } - if ($ally_description != "") { - $ally_description = "{$ally_description}"; - } else - $ally_description = "Il n'y as aucune descriptions de cette alliance."; + if ($ally_description != "") { + $ally_description = "{$ally_description}"; + } else + $ally_description = "Il n'y as aucune descriptions de cette alliance."; - if ($ally_web != "") { - $ally_web = " - {$lang['Initial_page']} - {$ally_web} - "; - } + if ($ally_web != "") { + $ally_web = " + {$lang['Initial_page']} + {$ally_web} + "; + } - $lang['ally_member_scount'] = $ally_members; - $lang['ally_name'] = $ally_name; - $lang['ally_tag'] = $ally_tag; - // codigo raro - $patterns[] = "#\[fc\]([a-z0-9\#]+)\[/fc\](.*?)\[/f\]#Ssi"; - $replacements[] = '\2'; - $patterns[] = '#\[img\](.*?)\[/img\]#Smi'; - $replacements[] = '\1'; - $patterns[] = "#\[fc\]([a-z0-9\#\ \[\]]+)\[/fc\]#Ssi"; - $replacements[] = ''; - $patterns[] = "#\[/f\]#Ssi"; - $replacements[] = ''; - $ally_description = preg_replace($patterns, $replacements, $ally_description); + $lang['ally_member_scount'] = $ally_members; + $lang['ally_name'] = $ally_name; + $lang['ally_tag'] = $ally_tag; + $patterns[] = "#\[fc\]([a-z0-9\#]+)\[/fc\](.*?)\[/f\]#Ssi"; + $replacements[] = '\2'; + $patterns[] = '#\[img\](.*?)\[/img\]#Smi'; + $replacements[] = '\1'; + $patterns[] = "#\[fc\]([a-z0-9\#\ \[\]]+)\[/fc\]#Ssi"; + $replacements[] = ''; + $patterns[] = "#\[/f\]#Ssi"; + $replacements[] = ''; + $ally_description = preg_replace($patterns, $replacements, $ally_description); - $lang['ally_description'] = nl2br($ally_description); - $lang['ally_image'] = $ally_image; - $lang['ally_web'] = $ally_web; + $lang['ally_description'] = nl2br($ally_description); + $lang['ally_image'] = $ally_image; + $lang['ally_web'] = $ally_web; - if ($user['ally_id'] == 0) { - $lang['bewerbung'] = " - Candidature - Cliquer ici pour ecrire votre candidature + if ($user->getData('ally_id') == 0) { + $lang['bewerbung'] = " + Candidature + Cliquer ici pour ecrire votre candidature - "; - } else - $lang['bewerbung'] = "Candidature"; + "; + } else + $lang['bewerbung'] = "Candidature"; - $page .= parsetemplate(gettemplate('alliance_ainfo'), $lang); - display($page, str_replace('%s', $ally_name, $lang['Info_of_Alliance'])); + $page .= parsetemplate(gettemplate('alliance_ainfo'), $lang); + display($page, str_replace('%s', $ally_name, $lang['Info_of_Alliance'])); } -// --[Comprobaciones de alianza]------------------------- -if ($user['ally_id'] == 0) { // Sin alianza - if ($mode == 'make' && $user['ally_request'] == 0) { // Make alliance - /* - Aca se crean las alianzas... - */ - if ($yes == 1 && $_POST) { - /* - Por el momento solo estoy improvisando, luego se perfeccionara el sistema :) - Creo que aqui se realiza una query para comprovar el nombre, y luego le pregunta si es el tag correcto... - */ - if (!$_POST['atag']) { - message($lang['have_not_tag'], $lang['make_alliance']); - } - if (!$_POST['aname']) { - message($lang['have_not_name'], $lang['make_alliance']); - } - $_POST['aname']=addslashes($_POST['aname']); - $_POST['atag']=addslashes($_POST['atag']); +/** + * Verification of the alliance + */ +if ($user->getData('ally_id') == 0) { + if ($mode == 'make' && $user->getData('ally_request') == 0) { // Make alliance + /* + * Creation of the alliance + */ + if ($yes == 1 && isset($_POST)) { - $tagquery = doquery("SELECT * FROM {{table}} WHERE ally_tag='{$_POST['atag']}'", 'alliance', true); + if (empty($_POST['atag'])) { + message($lang['have_not_tag'], $lang['make_alliance']); + } + if (empty($_POST['aname'])) { + message($lang['have_not_name'], $lang['make_alliance']); + } - if ($tagquery) { - message(str_replace('%s', $_POST['atag'], $lang['always_exist']), $lang['make_alliance']); - } + $alliance_name = $db->quote($_POST['aname']); + $alliance_tag = $db->quote($_POST['atag']); - doquery("INSERT INTO {{table}} SET - `ally_name`='{$_POST['aname']}', - `ally_tag`='{$_POST['atag']}' , - `ally_owner`='{$user['id']}', - `ally_owner_range`='Leader', - `ally_members`='1', - `ally_register_time`=" . time() , "alliance"); + $tagquery = doquery("SELECT * FROM {{table}} WHERE ally_tag=" .$alliance_tag. ";", 'alliance', true); - $allyquery = doquery("SELECT * FROM {{table}} WHERE ally_tag='{$_POST['atag']}'", 'alliance', true); + if ($tagquery) { + message(str_replace('%s', $alliance_tag, $lang['always_exist']), $lang['make_alliance']); + } + $ranks = ''; + $allianz_raenge[] = array('name' => 'Novice', + 'mails' => 0, + 'delete' => 0, + 'kick' => 0, + 'bewerbungen' => 0, + 'administrieren' => 0, + 'bewerbungenbearbeiten' => 0, + 'memberlist' => 0, + 'onlinestatus' => 0, + 'rechtehand' => 0 + ); - doquery("UPDATE {{table}} SET - `ally_id`='{$allyquery['id']}', - `ally_name`='{$allyquery['ally_name']}', - `ally_register_time`='" . time() . "' - WHERE `id`='{$user['id']}'", "users"); + $ranks = serialize($allianz_raenge); - $page = MessageForm(str_replace('%s', $_POST['atag'], $lang['ally_maked']), + doquery("INSERT INTO {{table}} SET + `ally_name`=" . $alliance_name . ", + `ally_tag`=" . $alliance_tag . " , + `ally_owner`='" .$user->getId(). "', + `ally_owner_range`='Leader', + `ally_ranks`='" . $ranks . "', + `ally_members`='1', + `ally_register_time`=" . time() , "alliance"); - str_replace('%s', $_POST['atag'], $lang['alliance_has_been_maked']) . "

", "", $lang['Ok']); - } else { - $page .= parsetemplate(gettemplate('alliance_make'), $lang); - } + $allyquery = doquery("SELECT * FROM {{table}} WHERE ally_tag=" .$alliance_tag. ";", 'alliance', true); - display($page, $lang['make_alliance']); - } + doquery("UPDATE {{table}} SET + `ally_id`='" .$allyquery['id']. "', + `ally_name`='" .$allyquery['ally_name']. "', + `ally_register_time`='" . time() . "' + WHERE `id`='{$user->getId()}'", "users"); - if ($mode == 'search' && $user['ally_request'] == 0) { // search one + $page = MessageForm(str_replace('%s', $alliance_tag, $lang['ally_maked']), str_replace('%s', $alliance_tag, $lang['alliance_has_been_maked']) . "

", "", $lang['Ok']); + } else { + $page .= parsetemplate(gettemplate('alliance_make'), $lang); + } - $parse = $lang; - $lang['searchtext'] = $_POST['searchtext']; - $page = parsetemplate(gettemplate('alliance_searchform'), $lang); + display($page, $lang['make_alliance']); + } + /** + * User is searching for an alliance + */ + if ($mode == 'search' && $user->getData('ally_request') == 0) { - if ($_POST) { // esta parte es igual que el buscador de search.php... - // searchtext - $search = doquery("SELECT * FROM {{table}} WHERE ally_name LIKE '%{$_POST['searchtext']}%' or ally_tag LIKE '%{$_POST['searchtext']}%' LIMIT 30", "alliance"); + $parse = $lang; + $search_text = isset($_POST['searchtext']) ? $_POST['searchtext'] : null; + $lang['searchtext'] = $search_text; + $page = parsetemplate(gettemplate('alliance_searchform'), $lang); - if (mysql_num_rows($search) != 0) { - $template = gettemplate('alliance_searchresult_row'); + if (isset($_POST['searchtext'])) { + $stmt = $db->prepare("SELECT * FROM {$db->getTable('alliance')} WHERE ally_name LIKE :search_field OR ally_tag LIKE :search_field LIMIT 30"); + $stmt->execute(array(':search_field' => '%' .$search_text. '%')); + if ($stmt->rowCount() != 0) { + $template = gettemplate('alliance_searchresult_row'); + $parse['result'] = null; + while ($s = $stmt->fetch(PDO::FETCH_BOTH)) { + $entry = array(); + $entry['ally_tag'] = "[{$s['ally_tag']}]"; + $entry['ally_name'] = $s['ally_name']; + $entry['ally_members'] = $s['ally_members']; - while ($s = $search->fetch(PDO::FETCH_BOTH)) { - $entry = array(); - $entry['ally_tag'] = "[{$s['ally_tag']}]"; - $entry['ally_name'] = $s['ally_name']; - $entry['ally_members'] = $s['ally_members']; + $parse['result'] .= parsetemplate($template, $entry); + } - $parse['result'] .= parsetemplate($template, $entry); - } + $page .= parsetemplate(gettemplate('alliance_searchresult_table'), $parse); + } + } - $page .= parsetemplate(gettemplate('alliance_searchresult_table'), $parse); - } - } + display($page, $lang['search_alliance']); + } + /** + * request handler. + */ + if ($mode == 'apply' && $user->getData('ally_request') == 0) { - display($page, $lang['search_alliance']); - } + if (!is_numeric($allyid) || empty($allyid) || $user->getData('ally_request') != 0 || $user->getData('ally_id') != 0) { + message($lang['it_is_not_posible_to_apply'], $lang['it_is_not_posible_to_apply']); + } + /** + * ask for the info of the alliance + */ + $allyrow = doquery("SELECT ally_tag,ally_request FROM {{table}} WHERE id='" .$allyid. "'", "alliance", true); - if ($mode == 'apply' && $user['ally_request'] == 0) { // solicitudes - if (!is_numeric($_GET['allyid']) || !$_GET['allyid'] || $user['ally_request'] != 0 || $user['ally_id'] != 0) { - message($lang['it_is_not_posible_to_apply'], $lang['it_is_not_posible_to_apply']); - } - // pedimos la info de la alianza - $allyrow = doquery("SELECT ally_tag,ally_request FROM {{table}} WHERE id='" . intval($_GET['allyid']) . "'", "alliance", true); + if (!$allyrow) { + message($lang['it_is_not_posible_to_apply'], $lang['it_is_not_posible_to_apply']); + } - if (!$allyrow) { - message($lang['it_is_not_posible_to_apply'], $lang['it_is_not_posible_to_apply']); - } + extract($allyrow); - extract($allyrow); + if (isset($_POST['further']) && $_POST['further'] == $lang['Send']) { + doquery("UPDATE {{table}} SET `ally_request`='" . $allyid . "', ally_request_text=" . $db->quote($_POST['text']) . ", ally_register_time='" . time() . "' WHERE `id`='" . $user->getId(). "'", "users"); + message($lang['apply_registered'], $lang['your_apply']); + } else { + $text_apply = ($ally_request) ? $ally_request : $lang['There_is_no_a_text_apply']; + } - if ($_POST['further'] == $lang['Send']) { // esta parte es igual que el buscador de search.php... - doquery("UPDATE {{table}} SET `ally_request`='" . intval($allyid) . "', ally_request_text='" . mysql_escape_string(strip_tags($_POST['text'])) . "', ally_register_time='" . time() . "' WHERE `id`='" . $user['id'] . "'", "users"); - // mensaje de cuando se envia correctamente el mensaje - message($lang['apply_registered'], $lang['your_apply']); - // mensaje de cuando falla el envio - // message($lang['apply_cantbeadded'], $lang['your_apply']); - } else { - $text_apply = ($ally_request) ? $ally_request : $lang['There_is_no_a_text_apply']; - } + $parse = $lang; + $parse['allyid'] = $allyid; + $parse['chars_count'] = strlen($text_apply); + $parse['text_apply'] = $text_apply; + $parse['Write_to_alliance'] = str_replace('%s', $ally_tag, $lang['Write_to_alliance']); - $parse = $lang; - $parse['allyid'] = intval($_GET['allyid']); - $parse['chars_count'] = strlen($text_apply); - $parse['text_apply'] = $text_apply; - $parse['Write_to_alliance'] = str_replace('%s', $ally_tag, $lang['Write_to_alliance']); + $page = parsetemplate(gettemplate('alliance_applyform'), $parse); - $page = parsetemplate(gettemplate('alliance_applyform'), $parse); + display($page, $lang['Write_to_alliance']); + } + /** + * accept request + */ + if ($user['ally_request'] != 0) { - display($page, $lang['Write_to_alliance']); - } + $allyquery = doquery("SELECT ally_tag FROM {{table}} WHERE id='" . $user->getData('ally_request') . "' ORDER BY `id`", "alliance", true); - if ($user['ally_request'] != 0) { // Esperando una respuesta - // preguntamos por el ally_tag - $allyquery = doquery("SELECT ally_tag FROM {{table}} WHERE id='" . intval($user['ally_request']) . "' ORDER BY `id`", "alliance", true); + extract($allyquery); + if (isset($_POST['bcancel'])) { + doquery("UPDATE {{table}} SET `ally_request`=0 WHERE `id`=" . $user->getId('id'), "users"); - extract($allyquery); - if ($_POST['bcancel']) { - doquery("UPDATE {{table}} SET `ally_request`=0 WHERE `id`=" . $user['id'], "users"); - - $lang['request_text'] = str_replace('%s', $ally_tag, $lang['Canceled_a_request_text']); - $lang['button_text'] = $lang['Ok']; - $page = parsetemplate(gettemplate('alliance_apply_waitform'), $lang); - } else { - $lang['request_text'] = str_replace('%s', $ally_tag, $lang['Waiting_a_request_text']); - $lang['button_text'] = $lang['Delete_apply']; - $page = parsetemplate(gettemplate('alliance_apply_waitform'), $lang); - } - // mysql_escape_string(strip_tags()); - display($page, "Deine Anfrage"); - } else { // Vista sin allianza - /* - Vista normal de cuando no se tiene ni solicitud ni alianza - */ - $page .= parsetemplate(gettemplate('alliance_defaultmenu'), $lang); - display($page, $lang['alliance']); - } + $lang['request_text'] = str_replace('%s', $ally_tag, $lang['Canceled_a_request_text']); + $lang['button_text'] = $lang['Ok']; + $page = parsetemplate(gettemplate('alliance_apply_waitform'), $lang); + } else { + $lang['request_text'] = str_replace('%s', $ally_tag, $lang['Waiting_a_request_text']); + $lang['button_text'] = $lang['Delete_apply']; + $page = parsetemplate(gettemplate('alliance_apply_waitform'), $lang); + } + display($page, "You don't have any requests"); + } else { + $page .= parsetemplate(gettemplate('alliance_defaultmenu'), $lang); + display($page, $lang['alliance']); + } } -//--------------------------------------------------------------------------------------------------------------------------------------------------- -// Parte de adentro de la alianza -elseif ($user['ally_id'] != 0 && $user['ally_request'] == 0) { // Con alianza - - $ally = doquery("SELECT * FROM {{table}} WHERE id='{$user['ally_id']}'", "alliance", true); - - $ally_ranks = unserialize($ally['ally_ranks']); - - $allianz_raenge = unserialize($ally['ally_ranks']); - - if ($allianz_raenge[$user['ally_rank_id']-1]['onlinestatus'] == 1 || $ally['ally_owner'] == $user['id']) { - $user_can_watch_memberlist_status = true; - } else - $user_can_watch_memberlist_status = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['memberlist'] == 1 || $ally['ally_owner'] == $user['id']) { - $user_can_watch_memberlist = true; - } else - $user_can_watch_memberlist = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['mails'] == 1 || $ally['ally_owner'] == $user['id']) { - $user_can_send_mails = true; - } else - $user_can_send_mails = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['kick'] == 1 || $ally['ally_owner'] == $user['id']) { - $user_can_kick = true; - } else - $user_can_kick = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['rechtehand'] == 1 || $ally['ally_owner'] == $user['id']) - $user_can_edit_rights = true; - else - $user_can_edit_rights = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['delete'] == 1 || $ally['ally_owner'] == $user['id']) - $user_can_exit_alliance = true; - else - $user_can_exit_alliance = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['bewerbungen'] == 1 || $ally['ally_owner'] == $user['id']) - $user_bewerbungen_einsehen = true; - else - $user_bewerbungen_einsehen = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['bewerbungenbearbeiten'] == 1 || $ally['ally_owner'] == $user['id']) - $user_bewerbungen_bearbeiten = true; - else - $user_bewerbungen_bearbeiten = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['administrieren'] == 1 || $ally['ally_owner'] == $user['id']) - $user_admin = true; - else - $user_admin = false; - - if ($allianz_raenge[$user['ally_rank_id']-1]['onlinestatus'] == 1 || $ally['ally_owner'] == $user['id']) - $user_onlinestatus = true; - else - $user_onlinestatus = false; - - if (!$ally) { - doquery("UPDATE {{table}} SET `ally_name`='',`ally_id`=0 WHERE `id`='{$user['id']}'", "users"); - message($lang['ally_notexist'], $lang['your_alliance'], 'alliance.php'); - } - - if ($mode == 'exit') { - if ($ally['ally_owner'] == $user['id']) { - message($lang['Owner_cant_go_out'], $lang['Alliance']); - } - // se sale de la alianza - if ($_GET['yes'] == 1) { - doquery("UPDATE {{table}} SET `ally_id`=0, `ally_name` = '' WHERE `id`='{$user['id']}'", "users"); - $lang['Go_out_welldone'] = str_replace("%s", $ally_name, $lang['Go_out_welldone']); - $page = MessageForm($lang['Go_out_welldone'], "
", $PHP_SELF, $lang['Ok']); - // Se quitan los puntos del user en la alianza - } else { - // se pregunta si se quiere salir - $lang['Want_go_out'] = str_replace("%s", $ally_name, $lang['Want_go_out']); - $page = MessageForm($lang['Want_go_out'], "
", "?mode=exit&yes=1", "Oui"); - } - display($page); - } - - if ($mode == 'memberslist') { // Lista de miembros. - /* - Lista de miembros. - Por lo que parece solo se hace una query fijandose los usuarios con el mismo ally_id. - seguido del query del planeta principal de cada uno para sacarle la posicion, pero - voy a ver si tambien agrego las cordenadas en el id user... - */ - // obtenemos el array de los rangos - // $ally_ranks = unserialize($ally['ally_ranks']); - $allianz_raenge = unserialize($ally['ally_ranks']); - // $user_can_watch_memberlist - // comprobamos el permiso - if ($ally['ally_owner'] != $user['id'] && !$user_can_watch_memberlist) { - message($lang['Denied_access'], $lang['Members_list']); - } - // El orden de aparicion - if ($sort2) { - $sort1 = intval($_GET['sort1']); - $sort2 = intval($_GET['sort2']); - - if ($sort1 == 1) { - $sort = " ORDER BY `username`"; - } elseif ($sort1 == 2) { - $sort = " ORDER BY `username`"; - } elseif ($sort1 == 4) { - $sort = " ORDER BY `ally_register_time`"; - } elseif ($sort1 == 5) { - $sort = " ORDER BY `onlinetime`"; - } else { - $sort = " ORDER BY `id`"; - } - - if ($sort2 == 1) { - $sort .= " DESC;"; - } elseif ($sort2 == 2) { - $sort .= " ASC;"; - } - $listuser = doquery("SELECT * FROM {{table}} WHERE ally_id='{$user['ally_id']}'{$sort}", 'users'); - } else { - $listuser = doquery("SELECT * FROM {{table}} WHERE ally_id='{$user['ally_id']}'", 'users'); - } - // contamos la cantidad de usuarios. - $i = 0; - // Como es costumbre. un row template - $template = gettemplate('alliance_memberslist_row'); - $page_list = ''; - while ($u = $listuser->fetch(PDO::FETCH_BOTH)) { - $UserPoints = doquery("SELECT * FROM {{table}} WHERE `stat_type` = '1' AND `stat_code` = '1' AND `id_owner` = '" . $u['id'] . "';", 'statpoints', true); - - $i++; - $u['i'] = $i; - - if ($u["onlinetime"] + 60 * 10 >= time() && $user_can_watch_memberlist_status) { - $u["onlinetime"] = "lime>{$lang['On']}<"; - } elseif ($u["onlinetime"] + 60 * 20 >= time() && $user_can_watch_memberlist_status) { - $u["onlinetime"] = "yellow>{$lang['15_min']}<"; - } elseif ($user_can_watch_memberlist_status) { - $u["onlinetime"] = "red>{$lang['Off']}<"; - } else $u["onlinetime"] = "orange>-<"; - // Nombre de rango - if ($ally['ally_owner'] == $u['id']) { - $u["ally_range"] = ($ally['ally_owner_range'] == '')?"Leader":$ally['ally_owner_range']; - } elseif (isset($allianz_raenge[$u['ally_rank_id']]['name'])) { - $u["ally_range"] = $allianz_raenge[$u['ally_rank_id']]['name']; - } else { - $u["ally_range"] = $lang['Novate']; - } - - $u["dpath"] = $dpath; - $u['points'] = "" . pretty_number($UserPoints['total_points']) . ""; - - if ($u['ally_register_time'] > 0) - $u['ally_register_time'] = date("Y-m-d h:i:s", $u['ally_register_time']); - else - $u['ally_register_time'] = "-"; - - $page_list .= parsetemplate($template, $u); - } - // para cambiar el link de ordenar. - if ($sort2 == 1) { - $s = 2; - } elseif ($sort2 == 2) { - $s = 1; - } else { - $s = 1; - } - - if ($i != $ally['ally_members']) { - doquery("UPDATE {{table}} SET `ally_members`='{$i}' WHERE `id`='{$ally['id']}'", 'alliance'); - } - - $parse = $lang; - $parse['i'] = $i; - $parse['s'] = $s; - $parse['list'] = $page_list; - - $page .= parsetemplate(gettemplate('alliance_memberslist_table'), $parse); - - display($page, $lang['Members_list']); - } - - if ($mode == 'circular') { // Correo circular - /* - Mandar un correo circular. - creo que aqui tendria que ver yo como crear el sistema de mensajes... - */ - // un loop para mostrar losrangos - $allianz_raenge = unserialize($ally['ally_ranks']); - // comprobamos el permiso - if ($ally['ally_owner'] != $user['id'] && !$user_can_send_mails) { - message($lang['Denied_access'], $lang['Send_circular_mail']); - } - - if ($sendmail == 1) { - $_POST['r'] = intval($_POST['r']); - $_POST['text'] = mysql_escape_string(strip_tags($_POST['text'])); - - if ($_POST['r'] == 0) { - $sq = doquery("SELECT id,username FROM {{table}} WHERE ally_id='{$user['ally_id']}'", "users"); - } else { - $sq = doquery("SELECT id,username FROM {{table}} WHERE ally_id='{$user['ally_id']}' AND ally_rank_id='{$_POST['r']}'", "users"); - } - // looooooop - $list = ''; - while ($u = $sq->fetch(PDO::FETCH_BOTH)) { - doquery("INSERT INTO {{table}} SET - `message_owner`='{$u['id']}', - `message_sender`='{$user['id']}' , - `message_time`='" . time() . "', - `message_type`='2', - `message_from`='{$ally['ally_tag']}', - `message_subject`='{$user['username']}', - `message_text`='{$_POST['text']}' - ", "messages"); - $list .= "
{$u['username']} "; - } - // doquery("SELECT id,username FROM {{table}} WHERE ally_id='{$user['ally_id']}' ORDER BY `id`","users"); - doquery("UPDATE {{table}} SET `new_message`=new_message+1 WHERE ally_id='{$user['ally_id']}' AND ally_rank_id='{$_POST['r']}'", "users"); - doquery("UPDATE {{table}} SET `mnl_alliance`=mnl_alliance+1 WHERE ally_id='{$user['ally_id']}' AND ally_rank_id='{$_POST['r']}'", "users"); - /* - Aca un mensajito diciendo que a quien se mando. - */ - $page = MessageForm($lang['Circular_sended'], "Les membres suivants ont re�u un message:" . $list, "alliance.php", $lang['Ok'], true); - display($page, $lang['Send_circular_mail']); - } - - $lang['r_list'] = ""; - if ($allianz_raenge) { - foreach($allianz_raenge as $id => $array) { - $lang['r_list'] .= ""; - } - } - - $page .= parsetemplate(gettemplate('alliance_circular'), $lang); - - display($page, $lang['Send_circular_mail']); - } - - if ($mode == 'admin' && $edit == 'rights') { // Administrar leyes - $allianz_raenge = unserialize($ally['ally_ranks']); - - if ($ally['ally_owner'] != $user['id'] && !$user_can_edit_rights) { - message($lang['Denied_access'], $lang['Members_list']); - } elseif (!empty($_POST['newrangname'])) { - $name = mysql_escape_string(strip_tags($_POST['newrangname'])); - - $allianz_raenge[] = array('name' => $name, - 'mails' => 0, - 'delete' => 0, - 'kick' => 0, - 'bewerbungen' => 0, - 'administrieren' => 0, - 'bewerbungenbearbeiten' => 0, - 'memberlist' => 0, - 'onlinestatus' => 0, - 'rechtehand' => 0 - ); - - $ranks = serialize($allianz_raenge); - - doquery("UPDATE {{table}} SET `ally_ranks`='" . $ranks . "' WHERE `id`=" . $ally['id'], "alliance"); - - $goto = $_SERVER['PHP_SELF'] . "?" . $_SERVER['QUERY_STRING']; - - header("Location: " . $goto); - exit(); - } elseif ($_POST['id'] != '' && is_array($_POST['id'])) { - $ally_ranks_new = array(); - - foreach ($_POST['id'] as $id) { - $name = $allianz_raenge[$id]['name']; - - $ally_ranks_new[$id]['name'] = $name; - - if (isset($_POST['u' . $id . 'r0'])) { - $ally_ranks_new[$id]['delete'] = 1; - } else { - $ally_ranks_new[$id]['delete'] = 0; - } - - if (isset($_POST['u' . $id . 'r1']) && $ally['ally_owner'] == $user['id']) { - $ally_ranks_new[$id]['kick'] = 1; - } else { - $ally_ranks_new[$id]['kick'] = 0; - } - - if (isset($_POST['u' . $id . 'r2'])) { - $ally_ranks_new[$id]['bewerbungen'] = 1; - } else { - $ally_ranks_new[$id]['bewerbungen'] = 0; - } - - if (isset($_POST['u' . $id . 'r3'])) { - $ally_ranks_new[$id]['memberlist'] = 1; - } else { - $ally_ranks_new[$id]['memberlist'] = 0; - } - - if (isset($_POST['u' . $id . 'r4'])) { - $ally_ranks_new[$id]['bewerbungenbearbeiten'] = 1; - } else { - $ally_ranks_new[$id]['bewerbungenbearbeiten'] = 0; - } - - if (isset($_POST['u' . $id . 'r5'])) { - $ally_ranks_new[$id]['administrieren'] = 1; - } else { - $ally_ranks_new[$id]['administrieren'] = 0; - } - - if (isset($_POST['u' . $id . 'r6'])) { - $ally_ranks_new[$id]['onlinestatus'] = 1; - } else { - $ally_ranks_new[$id]['onlinestatus'] = 0; - } - - if (isset($_POST['u' . $id . 'r7'])) { - $ally_ranks_new[$id]['mails'] = 1; - } else { - $ally_ranks_new[$id]['mails'] = 0; - } - - if (isset($_POST['u' . $id . 'r8'])) { - $ally_ranks_new[$id]['rechtehand'] = 1; - } else { - $ally_ranks_new[$id]['rechtehand'] = 0; - } - } - - $ranks = serialize($ally_ranks_new); - - doquery("UPDATE {{table}} SET `ally_ranks`='" . $ranks . "' WHERE `id`=" . $ally['id'], "alliance"); - - $goto = $_SERVER['PHP_SELF'] . "?" . $_SERVER['QUERY_STRING']; - - header("Location: " . $goto); - exit(); - } - // borrar una entrada - elseif (isset($d) && isset($ally_ranks[$d])) { - unset($ally_ranks[$d]); - $ally['ally_rank'] = serialize($ally_ranks); - - doquery("UPDATE {{table}} SET `ally_ranks`='{$ally['ally_rank']}' WHERE `id`={$ally['id']}", "alliance"); - } - - if (count($ally_ranks) == 0 || $ally_ranks == '') { // si no hay rangos - $list = "{$lang['There_is_not_range']}"; - } else { // Si hay rangos - // cargamos la template de tabla - $list = parsetemplate(gettemplate('alliance_admin_laws_head'), $lang); - $template = gettemplate('alliance_admin_laws_row'); - // Creamos la lista de rangos - $i = 0; - - foreach($ally_ranks as $a => $b) { - if ($ally['ally_owner'] == $user['id']) { - // $i++;u2r5 - $lang['id'] = $a; - $lang['delete'] = "\"{$lang['Delete_range']}\""; - $lang['r0'] = $b['name']; - $lang['a'] = $a; - $lang['r1'] = ""; //{$b[1]} - $lang['r2'] = ""; - $lang['r3'] = ""; - $lang['r4'] = ""; - $lang['r5'] = ""; - $lang['r6'] = ""; - $lang['r7'] = ""; - $lang['r8'] = ""; - $lang['r9'] = ""; - - $list .= parsetemplate($template, $lang); - } else { - $lang['id'] = $a; - $lang['r0'] = $b['name']; - $lang['delete'] = "\"{$lang['Delete_range']}\""; - $lang['a'] = $a; - $lang['r1'] = "-"; - $lang['r2'] = ""; - $lang['r3'] = ""; - $lang['r4'] = ""; - $lang['r5'] = ""; - $lang['r6'] = ""; - $lang['r7'] = ""; - $lang['r8'] = ""; - $lang['r9'] = ""; - - $list .= parsetemplate($template, $lang); - } - } - - if (count($ally_ranks) != 0) { - $list .= parsetemplate(gettemplate('alliance_admin_laws_feet'), $lang); - } - } - - $lang['list'] = $list; - $lang['dpath'] = $dpath; - $page .= parsetemplate(gettemplate('alliance_admin_laws'), $lang); - - display($page, $lang['Law_settings']); - } - - if ($mode == 'admin' && $edit == 'ally') { // Administrar la alianza *pendiente urgente* - if ($t != 1 && $t != 2 && $t != 3) { - $t = 1; - } - // post! - if ($_POST) { - if (!get_magic_quotes_gpc()) { - $_POST['owner_range'] = stripslashes($_POST['owner_range']); - $_POST['web'] = stripslashes($_POST['web']); - $_POST['image'] = stripslashes($_POST['image']); - $_POST['text'] = stripslashes($_POST['text']); - } - } - - if ($_POST['options']) { - $ally['ally_owner_range'] = mysql_escape_string(htmlspecialchars(strip_tags($_POST['owner_range']))); - - $ally['ally_web'] = mysql_escape_string(htmlspecialchars(strip_tags($_POST['web']))); - - $ally['ally_image'] = mysql_escape_string(htmlspecialchars(strip_tags($_POST['image']))); - - $ally['ally_request_notallow'] = intval($_POST['request_notallow']); - - if ($ally['ally_request_notallow'] != 0 && $ally['ally_request_notallow'] != 1) { - message("Aller � \"Candidature\" et sur une option dans le formulaire!", "Erreur"); - exit; - } - - doquery("UPDATE {{table}} SET - `ally_owner_range`='{$ally['ally_owner_range']}', - `ally_image`='{$ally['ally_image']}', - `ally_web`='{$ally['ally_web']}', - `ally_request_notallow`='{$ally['ally_request_notallow']}' - WHERE `id`='{$ally['id']}'", "alliance"); - } elseif ($_POST['t']) { - if ($t == 3) { - $ally['ally_request'] = mysql_escape_string(strip_tags($_POST['text'])); - - doquery("UPDATE {{table}} SET - `ally_request`='{$ally['ally_request']}' - WHERE `id`='{$ally['id']}'", "alliance"); - } elseif ($t == 2) { - $ally['ally_text'] = mysql_escape_string(strip_tags($_POST['text'])); - doquery("UPDATE {{table}} SET - `ally_text`='{$ally['ally_text']}' - WHERE `id`='{$ally['id']}'", "alliance"); - } else { - $ally['ally_description'] = mysql_escape_string(strip_tags(stripslashes($_POST['text']))); - - doquery("UPDATE {{table}} SET - `ally_description`='" . $ally['ally_description'] . "' - WHERE `id`='{$ally['id']}'", "alliance"); - } - } - $lang['dpath'] = $dpath; - /* - Depende del $t, muestra el formulario para cada tipo de texto. - */ - if ($t == 3) { - $lang['request_type'] = $lang['Show_of_request_text']; - } elseif ($t == 2) { - $lang['request_type'] = $lang['Internal_text_of_alliance']; - } else { - $lang['request_type'] = $lang['Public_text_of_alliance']; - } - - if ($t == 2) { - $lang['text'] = $ally['ally_text']; - $lang['Texts'] = "Texte Interne"; - $lang['Show_of_request_text'] = "Texte Interne d'ALliance"; - } else { - $lang['text'] = $ally['ally_description']; - } - - if ($t == 3) { - } - $lang['t'] = $t; - - $lang['ally_web'] = $ally['ally_web']; - $lang['ally_image'] = $ally['ally_image']; - $lang['ally_request_notallow_0'] = (($ally['ally_request_notallow'] == 1) ? ' SELECTED' : ''); - $lang['ally_request_notallow_1'] = (($ally['ally_request_notallow'] == 0) ? ' SELECTED' : ''); - $lang['ally_owner_range'] = $ally['ally_owner_range']; - $lang['Transfer_alliance'] = MessageForm("Abandonner / Transférer L'alliance", "", "?mode=admin&edit=give", $lang['Continue']); - $lang['Disolve_alliance'] = MessageForm("Dissoudre L'alliance", "", "?mode=admin&edit=exit", $lang['Continue']); - - $page .= parsetemplate(gettemplate('alliance_admin'), $lang); - display($page, $lang['Alliance_admin']); - } - - if ($mode == 'admin' && $edit == 'give') { - if ($_POST["id"]) { - doquery("update {{table}} set `ally_owner`='".$_POST["id"]."' where `id`='".$user['ally_id']."'",'alliance'); - } else { - $selection=doquery("SELECT * FROM {{table}} where ally_id='".$user['ally_id']."'",'users'); - $select=''; -while ($data = $selection->fetch(PDO::FETCH_BOTH)){ - $select.='