236 lines
10 KiB
PHP
236 lines
10 KiB
PHP
<?php
|
|
/**
|
|
* This file is part of Wootook
|
|
*
|
|
* @license http://www.gnu.org/licenses/gpl-3.0.txt
|
|
* @see http://wootook.org/
|
|
*
|
|
* Copyright (c) 2009-Present, Wootook Support Team <http://wootook.org>
|
|
* All rights reserved.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*
|
|
* --> NOTICE <--
|
|
* This file is part of the core development branch, changing its contents will
|
|
* make you unable to use the automatic updates manager. Please refer to the
|
|
* documentation for further information about customizing Wootook.
|
|
*
|
|
*/
|
|
|
|
define('INSIDE' , true);
|
|
define('INSTALL' , false);
|
|
define('IN_ADMIN', true);
|
|
|
|
require_once dirname(dirname(__FILE__)) .'/application/bootstrap.php';
|
|
|
|
if (in_array($user['authlevel'], array(LEVEL_ADMIN, LEVEL_OPERATOR, LEVEL_MODERATOR))) {
|
|
|
|
includeLang('admin/adminpanel');
|
|
|
|
$PanelMainTPL = gettemplate('admin/admin_panel_main');
|
|
|
|
$parse = $lang;
|
|
$parse['adm_sub_form1'] = "";
|
|
$parse['adm_sub_form2'] = "";
|
|
$parse['adm_sub_form3'] = "";
|
|
|
|
// Afficher les templates
|
|
if (isset($_GET['result'])) {
|
|
|
|
switch ($_GET['result']){
|
|
case 'usr_search':
|
|
$db = Legacies_Database::getSingleton();
|
|
$sql =<<<SQL_EOF
|
|
SELECT
|
|
planet.id AS planet_id,
|
|
planet.name AS planet_name,
|
|
planet.galaxy AS planet_galaxy,
|
|
planet.system AS planet_system,
|
|
planet.planet AS planet_position,
|
|
user.id AS user_id,
|
|
user.username AS username,
|
|
user.user_lastip AS user_lastip,
|
|
user.email AS email,
|
|
user.authlevel AS authlevel,
|
|
user.sex AS sex
|
|
|
|
FROM {{table}}planets AS planet
|
|
INNER JOIN {{table}}users AS user ON user.id_planet=planet.id
|
|
WHERE user.id = {$db->quote('%' . str_replace('*', '%', str_replace('%', '%%', $_GET['player'])) . '%')}"
|
|
SQL_EOF;
|
|
$statement = $db->prepare($sql);
|
|
$statement->execute();
|
|
$data = $statement->fetch(PDO::FETCH_ASSOC);
|
|
|
|
$bloc = $lang;
|
|
$bloc['answer1'] = $data['user_id'];
|
|
$bloc['answer2'] = $data['username'];
|
|
$bloc['answer3'] = $data['user_lastip'];
|
|
$bloc['answer4'] = $data['email'];
|
|
$bloc['answer5'] = $lang['adm_usr_level'][$data['authlevel']];
|
|
$bloc['answer6'] = $lang['adm_usr_genre'][$data['sex']];
|
|
$bloc['answer7'] = "[".$data['planet_id']."] {$data['planet_name']}";
|
|
$bloc['answer8'] = "[".$SelUser['planet_galaxy'].":".$SelUser['planet_system'].":".$SelUser['planet_position']."] ";
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_asw1');
|
|
$parse['adm_sub_form2'] = parsetemplate($SubPanelTPL, $bloc);
|
|
break;
|
|
|
|
case 'usr_data':
|
|
$db = Legacies_Database::getSingleton();
|
|
$sql =<<<SQL_EOF
|
|
SELECT
|
|
planet.id AS planet_id,
|
|
planet.name AS planet_name,
|
|
planet.galaxy AS planet_galaxy,
|
|
planet.system AS planet_system,
|
|
planet.planet AS planet_position,
|
|
user.id AS user_id,
|
|
user.username AS username,
|
|
user.user_lastip AS user_lastip,
|
|
user.email AS email,
|
|
user.authlevel AS authlevel,
|
|
user.sex AS sex
|
|
|
|
FROM {{table}}planets AS planet
|
|
INNER JOIN {{table}}users AS user ON user.id_planet=planet.id
|
|
WHERE user.id = {$db->quote('%' . str_replace('*', '%', str_replace('%', '%%', $_GET['player'])) . '%')}"
|
|
SQL_EOF;
|
|
$statement = $db->prepare($sql);
|
|
$statement->execute();
|
|
$data = $statement->fetch(PDO::FETCH_ASSOC);
|
|
|
|
$pattern = mysql_real_escape_string($_GET['player']);
|
|
$SelUser = doquery("SELECT * FROM {{table}} WHERE `username` LIKE '%". $pattern ."%' LIMIT 1;", 'users', true);
|
|
$UsrMain = doquery("SELECT `name` FROM {{table}} WHERE `id` = '". $SelUser['id_planet'] ."';", 'planets', true);
|
|
|
|
$bloc = $lang;
|
|
$bloc['answer1'] = $data['user_id'];
|
|
$bloc['answer2'] = $data['username'];
|
|
$bloc['answer3'] = $data['user_lastip'];
|
|
$bloc['answer4'] = $data['email'];
|
|
$bloc['answer5'] = $lang['adm_usr_level'][$data['authlevel']];
|
|
$bloc['answer6'] = $lang['adm_usr_genre'][$data['sex']];
|
|
$bloc['answer7'] = "[".$data['planet_id']."] {$data['planet_name']}";
|
|
$bloc['answer8'] = "[".$SelUser['planet_galaxy'].":".$SelUser['planet_system'].":".$SelUser['planet_position']."] ";
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_asw1');
|
|
$parse['adm_sub_form1'] = parsetemplate( $SubPanelTPL, $bloc );
|
|
|
|
$parse['adm_sub_form2'] = "<table><tbody>";
|
|
$parse['adm_sub_form2'] .= "<tr><td colspan=\"4\" class=\"c\">".$lang['adm_colony']."</td></tr>";
|
|
$UsrColo = doquery("SELECT * FROM {{table}} WHERE `id_owner` = '". $SelUser['id'] ." ORDER BY `galaxy` ASC, `planet` ASC, `system` ASC, `planet_type` ASC';", 'planets');
|
|
while ( $Colo = mysql_fetch_assoc($UsrColo) ) {
|
|
if ($Colo['id'] != $SelUser['id_planet']) {
|
|
$parse['adm_sub_form2'] .= "<tr><th>".$Colo['id']."</th>";
|
|
$parse['adm_sub_form2'] .= "<th>". (($Colo['planet_type'] == 1) ? $lang['adm_planet'] : $lang['adm_moon'] ) ."</th>";
|
|
$parse['adm_sub_form2'] .= "<th>[".$Colo['galaxy'].":".$Colo['system'].":".$Colo['planet']."]</th>";
|
|
$parse['adm_sub_form2'] .= "<th>".$Colo['name']."</th></tr>";
|
|
}
|
|
}
|
|
$parse['adm_sub_form2'] .= "</tbody></table>";
|
|
|
|
$parse['adm_sub_form3'] = "<table><tbody>";
|
|
$parse['adm_sub_form3'] .= "<tr><td colspan=\"4\" class=\"c\">".$lang['adm_technos']."</td></tr>";
|
|
for ($Item = 100; $Item <= 199; $Item++) {
|
|
if ($resource[$Item] != "") {
|
|
$parse['adm_sub_form3'] .= "<tr><th>".$lang['tech'][$Item]."</th>";
|
|
$parse['adm_sub_form3'] .= "<th>".$SelUser[$resource[$Item]]."</th></tr>";
|
|
}
|
|
}
|
|
$parse['adm_sub_form3'] .= "</tbody></table>";
|
|
break;
|
|
|
|
case 'usr_level':
|
|
if (!isset($_GET['s']) || !isset($_SESSION['CSRF']) || $_GET['s'] !== $_SESSION['CSRF']) {
|
|
AdminMessage(
|
|
'One have tried to overcome administration privilleges.',
|
|
'Hacking attempt');
|
|
break;
|
|
}
|
|
|
|
$player = isset($_GET['player']) ? mysql_real_escape_string($_GET['player']) : '';
|
|
$level = isset($_GET['authlvl']) ? mysql_real_escape_string($_GET['authlvl']) : '';
|
|
|
|
if ($level >= $user['authlevel'] && $user['authlevel'] != LEVEL_ADMIN) {
|
|
AdminMessage('Not enough privilleges to promote user.', $lang['adm_mod_level']);
|
|
break;
|
|
}
|
|
|
|
$userData = doquery("SELECT id FROM {{table}} WHERE `username` = '".$player."';", 'users', true);
|
|
if (empty($user)) {
|
|
AdminMessage('No such user.', $lang['adm_mod_level']);
|
|
break;
|
|
}
|
|
|
|
doquery("UPDATE {{table}} SET `authlevel` = '{$level}' WHERE id={$userData['id']}", 'users');
|
|
$message = $lang['adm_mess_lvl1']. " ". $player ." ".$lang['adm_mess_lvl2'];
|
|
$message .= "<font color=\"red\">".$lang['adm_usr_level'][$level]."</font>!";
|
|
|
|
AdminMessage($message, $lang['adm_mod_level']);
|
|
break;
|
|
|
|
case 'ip_search':
|
|
$pattern = isset($_GET['ip']) ? mysql_real_escape_string($_GET['ip']) : '';
|
|
$SelUser = doquery("SELECT * FROM {{table}} WHERE `user_lastip` = '". $pattern ."' LIMIT 10;", 'users');
|
|
$bloc = $lang;
|
|
$bloc['adm_this_ip'] = $pattern;
|
|
while ( $Usr = mysql_fetch_assoc($SelUser) ) {
|
|
$UsrMain = doquery("SELECT `name` FROM {{table}} WHERE `id` = '". $Usr['id_planet'] ."';", 'planets', true);
|
|
$bloc['adm_plyer_lst'] .= "<tr><th>".$Usr['username']."</th><th>[".$Usr['galaxy'].":".$Usr['system'].":".$Usr['planet']."] ".$UsrMain['name']."</th></tr>";
|
|
}
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_asw2');
|
|
$parse['adm_sub_form2'] = parsetemplate( $SubPanelTPL, $bloc );
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
// Traiter les reponses aux formulaires
|
|
if (isset($_GET['action'])) {
|
|
$bloc = $lang;
|
|
|
|
$_SESSION['CSRF'] = sha1(uniqid(null, true));
|
|
$bloc['csrf_hack'] = $_SESSION['CSRF'];
|
|
|
|
switch ($_GET['action']){
|
|
case 'usr_search':
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_frm1');
|
|
break;
|
|
|
|
case 'usr_data':
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_frm4');
|
|
break;
|
|
|
|
case 'usr_level':
|
|
for ($Lvl = 0; $Lvl < 4; $Lvl++) {
|
|
$bloc['adm_level_lst'] .= "<option value=\"". $Lvl ."\">". $lang['adm_usr_level'][ $Lvl ] ."</option>";
|
|
}
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_frm3');
|
|
break;
|
|
|
|
case 'ip_search':
|
|
$SubPanelTPL = gettemplate('admin/admin_panel_frm2');
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
$parse['adm_sub_form2'] = parsetemplate( $SubPanelTPL, $bloc );
|
|
}
|
|
|
|
$page = parsetemplate( $PanelMainTPL, $parse );
|
|
display( $page, $lang['panel_mainttl'], false, '', true );
|
|
} else {
|
|
message( $lang['sys_noalloaw'], $lang['sys_noaccess'] );
|
|
}
|