siteadmin.php

<?php 
//
// GiftWeb: PHP/PostgreSQL online Gift Registry System 
// Matthew T. Jachimstal
// Copyright (C) 2000-2008  Matthew T. Jachimstal
//
// email: matthew@jachimstal.com
//
// Snail mail: Matthew Jachimstal
//             1106 Canterbury Ct, Unit D
//             Elgin, IL 60120
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; either version 2
// of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
//
require "./main.inc";
require "./util.php";

$s = $_COOKIE["GiftWeb_Session"];
$mode = $_GET["mode"];

$uid = validatesession($s);

$conn = ADONewConnection($dbtype);
$conn->PConnect($dbhost, $dbuser, $dbpass, $dbname);

$sql = "SELECT * FROM giftweb WHERE admin='$uid'";
$result1 = $conn->Execute($sql);

if ($result1->RecordCount() == 0)
{
	startpage_old("Error: Not Administrator", 0);
	?>
	<h2>Error: You are not the site administrator</h2>
	<?php 
	redir("./main.php", "the main GiftWeb page", 3);
	endpage_old(-1);
	exit();
}

function upload_image()
{
	// no file to upload
	
	if (!$_FILES["newimg"]["name"])
	{
		return;
	}

	// file already exists with this name
	
	if (file_exists($destfile))
	{
		echo "<h3>This file already exists, please delete it first</h3>\n";
		return;
	}

	// determine where on the server the web site files are
	// maybe there's an easier way to do this?

	$path = explode("/", $_SERVER["SCRIPT_FILENAME"]);
	array_pop($path);
	$basedir = implode("/", $path);

	// copy the uploaded image to our image directory
	
	$basedir .= "/images/";
	$destfile = $basedir . $_FILES["newimg"]["name"];
	move_uploaded_file($_FILES["newimg"]["tmp_name"], $destfile);

	// make sure we have a valid JPG, PNG or GIF
	
	$file = exec("file $destfile");
	$filetype = explode(":", $file);
	echo "$filetype[1]<p>\n";
	if (!(stristr($filetype[1], "jpeg") || stristr($filetype[1], "gif") ||
										stristr($filetype[1], "png")))
	{
		echo "<h3>Invalid image file!</h3>\n";
		unlink($destfile);
	}
}

function show_users()
{
	global $conn;
	global $uid;

	$sql = "SELECT * FROM users WHERE uid != '$uid' and uid != '-1'
			ORDER BY last_name, first_name";

	$result = $conn->Execute($sql);


	?>
	<form method="post" action="siteadmin.php?mode=userman">
	<table cellspaceing=0 cellpadding=2 border=0>
	<tr><th width=20%>Last Name</th>
		<th width=20%>First Name</th>
		<th width=5%>Select</th>
		<th width=40%>Groups (<b>Primary</b>)</th>
		<th width=15%>&nbsp;</th></tr>
	<?php 

	$result->MoveFirst();

	while (!$result->EOF)
	{
		$fname = chop($result->fields["first_name"]);
		$lname = chop($result->fields["last_name"]);
		$userid = chop($result->fields["uid"]);
		$groups = "";
		$comma = 0;

		// find the user's primary group (if any)

		$sql2 = "SELECT groups.description
				 FROM members, groups
				 WHERE groups.gid = members.gid
					and members.uid = '$userid'
					and members.prim = 't'";

		$result2 = $conn->Execute($sql2);

		$result2->MoveFirst();

		while (!$result2->EOF)
		{
			$groups .= "<b>".chop($result2->fields["description"])."</b>";
			$comma = 1;
			$result2->MoveNext(); 	// should only be one result, though
		}

		// find the users non-primary groups (if any)
		
		$sql3 = "SELECT groups.description
				 FROM members, groups
				 WHERE groups.gid = members.gid
				 	and members.uid = '$userid'
					and members.prim = 'f'";
		$result3 = $conn->Execute($sql3);

		$result3->MoveFirst();

		while (!$result3->EOF)
		{
			if($comma)
				$groups .= ", ";

			$comma = 1;
			$groups .= chop($result3->fields["description"]);
			$result3->MoveNext();
		}

		?>
		<tr><td><?php echo $lname?></td>
			<td><?php echo $fname?></td>
			<td><input type=checkbox name=userlist[]
				 value="<?php echo $userid?>"></td>
			<td><?php echo $groups?></td>
			<td>&nbsp</td></tr>
		<?php 

		$result->MoveNext();
	}

	?>
	</table>
	<center>
	<table><tr>
		<td><input type=submit name=del_users value="Delete users"></td>
		<td width=90%>&nbsp;</td>
		</tr></table>
	</form>
	<br>
	<center>
		<a href="siteadmin.php">Back to Site Maintenance Page</a>
	</center>

	<?php 
}

function delete_users()
{
	global $conn;

	if (isset($_POST["del_users"]))
	{
		$userlist = $_POST["userlist"];

		$cntdel = count($userlist);

		for ($i=0; $i < $cntdel; $i++)
		{
			$sql = "DELETE FROM users WHERE uid='$userlist[$i]'";
			$result = $conn->Execute($sql);

			$sql2 = "DELETE FROM members WHERE uid='$userlist[$i]'";
			$result2 = $conn->Execute($sql2);

			$sql3 = "DELETE FROM items WHERE uid='$userlist[$i]'";
			$result3 = $conn->Execute($sql3);

			$sql4 = "UPDATE items SET purchased=-1 ";
			$sql4 .= "WHERE purchased='$userlist[$i]'";
			$result4 = $conn->Execute($sql4);

			$sql5 = "DELETE FROM session WHERE uid='$userlist[$i]'";
			$result5 = $conn->Execute($sql5);
		}

		?>
			<h3>Users have been deleted.</h3>
			<?php 
			redir("./siteadmin.php", "the GiftWeb site administrator page", 3);

			endpage_old(0);
		exit();
	}
}

function change_image()
{
	global $conn;

}

function show_options()
{
	global $conn;

}


startpage_old("Site Administration", 0);

if ($mode == "purgedb")
{
	?>

	<h3>This will purge all purchased items from the database. Are you
		<em>sure</em> you want to do this?</h3>
	<p>
	<a href="./siteadmin.php?mode=confirmpurge">Yes</a>
	<p>
	<a href="./siteadmin.php">No</a>
	<?php 

	endpage_old(0);
	exit();
}

if ($mode == "confirmpurge")
{
	$sql = "DELETE FROM items WHERE purchased > 0";
	$result = $conn->Execute($sql);

	if($result->RecordCount() == -1)
	{
		?>
		<h3>There was an error purging the purchased items. Please check 
			the database manually.</h3>
		<?php 
	}
	else
	{
		?>
		<h3>The purchased items have been purged.</h3>
		<?php 
		redir("./siteadmin.php", "Site Administration", 5);
	}

	endpage_old(0);
	exit();
}

if ($mode == "userman")
{
	if (isset($_POST["del_users"]))
	{
		delete_users();
	}

	show_users();

	endpage_old(0);
	exit();
}

// display/change website options.

if ($mode == "options")
{
	if (isset($_POST["upload"]))
	{
		upload_image();
	}

	if (isset($_POST["chg_img"]))
	{
		change_image();
		redir("./siteadmin.php?mode=options", "site administrator options", 0);
	}

	show_options();

	endpage_old(0);
	exit();
}

?>
<h3>Site Maintenance options</h3>
<a href="./siteadmin.php?mode=options">Set website options</a>
<p>
<a href="./siteadmin.php?mode=purgedb">Purge Purchased Items</a>
<p>
<a href="./siteadmin.php?mode=userman">Manage Users</a>
<p>
<a href="./grpedit.php">Manage Groups</a>
<p>
<a href="">Manage System Events</a>

<?php 

endpage_old(0);
?>