wAVYYmVF

1<?php
2/*************************************************************************
3	This file is part of SourceBans++
4
5	Copyright © 2014-2016 SourceBans++ Dev Team <https://github.com/sbpp>
6
7	SourceBans++ is licensed under a
8	Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
9
10	You should have received a copy of the license along with this
11	work.  If not, see <http://creativecommons.org/licenses/by-nc-sa/3.0/>.
12
13	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
16	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
17	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
18	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
19	THE SOFTWARE.
20
21	This program is based off work covered by the following copyright(s):
22		SourceBans 1.4.11
23		Copyright © 2007-2014 SourceBans Team - Part of GameConnect
24		Licensed under CC BY-NC-SA 3.0
25		Page: <http://www.sourcebans.net/> - <http://www.gameconnect.net/>
26*************************************************************************/
27
28require_once('xajax.inc.php');
29include_once('system-functions.php');
30include_once('user-functions.php');
31$xajax = new xajax();
32//$xajax->debugOn();
33$xajax->setRequestURI(XAJAX_REQUEST_URI);
34global $userbank;
35
36if(isset($_COOKIE['aid'], $_COOKIE['password']) && $userbank->CheckLogin($_COOKIE['password'], $_COOKIE['aid']))
37{
38	$xajax->registerFunction("AddMod");
39	$xajax->registerFunction("RemoveMod");
40	$xajax->registerFunction("AddGroup");
41	$xajax->registerFunction("RemoveGroup");
42	$xajax->registerFunction("RemoveAdmin");
43	$xajax->registerFunction("RemoveSubmission");
44	$xajax->registerFunction("RemoveServer");
45	$xajax->registerFunction("UpdateGroupPermissions");
46	$xajax->registerFunction("UpdateAdminPermissions");
47	$xajax->registerFunction("AddAdmin");
48	$xajax->registerFunction("SetupEditServer");
49	$xajax->registerFunction("AddServerGroupName");
50	$xajax->registerFunction("AddServer");
51	$xajax->registerFunction("AddBan");
52	$xajax->registerFunction("EditGroup");
53	$xajax->registerFunction("RemoveProtest");
54	$xajax->registerFunction("SendRcon");
55	$xajax->registerFunction("EditAdminPerms");
56	$xajax->registerFunction("SelTheme");
57	$xajax->registerFunction("ApplyTheme");
58	$xajax->registerFunction("AddComment");
59	$xajax->registerFunction("EditComment");
60	$xajax->registerFunction("RemoveComment");
61	$xajax->registerFunction("PrepareReban");
62	$xajax->registerFunction("ClearCache");
63	$xajax->registerFunction("KickPlayer");
64	$xajax->registerFunction("PasteBan");
65	$xajax->registerFunction("RehashAdmins");
66	$xajax->registerFunction("GroupBan");
67	$xajax->registerFunction("BanMemberOfGroup");
68	$xajax->registerFunction("GetGroups");
69	$xajax->registerFunction("BanFriends");
70	$xajax->registerFunction("SendMessage");
71	$xajax->registerFunction("ViewCommunityProfile");
72	$xajax->registerFunction("SetupBan");
73	$xajax->registerFunction("CheckPassword");
74	$xajax->registerFunction("ChangePassword");
75	$xajax->registerFunction("CheckSrvPassword");
76	$xajax->registerFunction("ChangeSrvPassword");
77	$xajax->registerFunction("ChangeEmail");
78	$xajax->registerFunction("CheckVersion");
79	$xajax->registerFunction("SendMail");
80	$xajax->registerFunction("AddBlock");
81	$xajax->registerFunction("PrepareReblock");
82	$xajax->registerFunction("PrepareBlockFromBan");
83	$xajax->registerFunction("PasteBlock");
84}
85
86$xajax->registerFunction("Plogin");
87$xajax->registerFunction("ServerHostPlayers");
88$xajax->registerFunction("ServerHostProperty");
89$xajax->registerFunction("ServerHostPlayers_list");
90$xajax->registerFunction("ServerPlayers");
91$xajax->registerFunction("LostPassword");
92$xajax->registerFunction("RefreshServer");
93
94global $userbank;
95$username = $userbank->GetProperty("user");
96
97
98function Plogin($username, $password, $remember, $redirect, $nopass)
99{
100	global $userbank;
101	$objResponse = new xajaxResponse();
102	$q = $GLOBALS['db']->GetRow("SELECT `aid`, `password` FROM `" . DB_PREFIX . "_admins` WHERE `user` = ?", array($username));
103	if($q)
104		$aid = $q[0];
105	if($q && (strlen($q[1]) == 0 || $q[1] == $userbank->encrypt_password('') || $q[1] == $userbank->hash('')) && count($q) != 0)
106	{
107		$lostpassword_url = SB_WP_URL . '/index.php?p=lostpassword';
108		$objResponse->addScript(<<<JS
109			ShowBox(
110				'Information',
111				'You are unable to login because your account have an empty password set.<br />' +
112				'Please <a href="$lostpassword_url">restore your password</a> or ask an admin to do that for you.<br />' +
113				'Do note that you are required to have a non empty password set event if you sign in through Steam.',
114				'blue', '', true
115			);
116JS
117		);
118		return $objResponse;
119	}
120
121    if (!$q || !$userbank->login($aid, $password, $remember)) {
122        if($nopass!=1)
123			$objResponse->addScript('ShowBox("Login Failed", "The username or password you supplied was incorrect.<br \> If you have forgotten your password, use the <a href=\"index.php?p=lostpassword\" title=\"Lost password\">Lost Password</a> link.", "red", "", true);');
124		return $objResponse;
125    } else {
126		$objResponse->addScript("$('msg-red').setStyle('display', 'none');");
127	}
128
129	if(strstr($redirect, "validation") || empty($redirect))
130		$objResponse->addRedirect("?",  0);
131	else
132		$objResponse->addRedirect("?" . $redirect, 0);
133	return $objResponse;
134}
135
136function LostPassword($email)
137{
138	$objResponse = new xajaxResponse();
139	$q = $GLOBALS['db']->GetRow("SELECT * FROM `" . DB_PREFIX . "_admins` WHERE `email` = ?", array($email));
140
141	if(!$q[0])
142	{
143		$objResponse->addScript("ShowBox('Error', 'The email address you supplied is not registered on the system', 'red', '');");
144			return $objResponse;
145	}
146	else {
147		$objResponse->addScript("$('msg-red').setStyle('display', 'none');");
148	}
149
150	$validation = md5(generate_salt(20).generate_salt(20)).md5(generate_salt(20).generate_salt(20));
151	$query = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_admins` SET `validate` = ? WHERE `email` = ?", array($validation, $email));
152	$message = "";
153	$message .= "Hello " . $q['user'] . "\n";
154	$message .= "You have requested to have your password reset for your SourceBans account.\n";
155	$message .= "To complete this process, please click the following link.\n";
156	$message .= "NOTE: If you didnt request this reset, then simply ignore this email.\n\n";
157
158	$message .= "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] . "?p=lostpassword&email=". RemoveCode($email) . "&validation=" . $validation;
159
160	$headers = 'From: ' . $GLOBALS['sb-email'] . "\n" .
161    'X-Mailer: PHP/' . phpversion();
162	$m = mail($email, "SourceBans Password Reset", $message, $headers);
163
164	$objResponse->addScript("ShowBox('Check E-Mail', 'Please check your email inbox (and spam) for a link which will help you reset your password.', 'blue', '');");
165	return $objResponse;
166}
167
168function CheckSrvPassword($aid, $srv_pass)
169{
170	$objResponse = new xajaxResponse();
171    global $userbank, $username;
172	$aid = (int)$aid;
173    if(!$userbank->is_logged_in() || $aid != $userbank->GetAid())
174	{
175		$objResponse->redirect("index.php?p=login&m=no_access", 0);
176		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to check ".$userbank->GetProperty('user', $aid)."'s server password, but doesn't have access.");
177		return $objResponse;
178	}
179	$res = $GLOBALS['db']->Execute("SELECT `srv_password` FROM `".DB_PREFIX."_admins` WHERE `aid` = '".$aid."'");
180	if($res->fields['srv_password'] != NULL && $res->fields['srv_password'] != $srv_pass)
181	{
182		$objResponse->addScript("$('scurrent.msg').setStyle('display', 'block');");
183		$objResponse->addScript("$('scurrent.msg').setHTML('Incorrect password.');");
184		$objResponse->addScript("set_error(1);");
185
186	}
187	else
188	{
189		$objResponse->addScript("$('scurrent.msg').setStyle('display', 'none');");
190		$objResponse->addScript("set_error(0);");
191	}
192	return $objResponse;
193}
194
195function ChangeSrvPassword($aid, $srv_pass)
196{
197	$objResponse = new xajaxResponse();
198    global $userbank, $username;
199    $aid = (int)$aid;
200    if(!$userbank->is_logged_in() || $aid != $userbank->GetAid())
201	{
202		$objResponse->redirect("index.php?p=login&m=no_access", 0);
203		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to change ".$userbank->GetProperty('user', $aid)."'s server password, but doesn't have access.");
204		return $objResponse;
205	}
206
207	if($srv_pass == "NULL")
208		$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `srv_password` = NULL WHERE `aid` = '".$aid."'");
209	else
210		$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `srv_password` = ? WHERE `aid` = ?", array($srv_pass, $aid));
211	$objResponse->addScript("ShowBox('Server Password changed', 'Your server password has been changed successfully.', 'green', 'index.php?p=account', true);");
212	$log = new CSystemLog("m", "Srv Password Changed", "Password changed for admin (".$aid.")");
213	return $objResponse;
214}
215
216function ChangeEmail($aid, $email, $password)
217{
218    global $userbank, $username;
219	$objResponse = new xajaxResponse();
220	$aid = (int)$aid;
221
222    if(!$userbank->is_logged_in() || $aid != $userbank->GetAid())
223	{
224		$objResponse->redirect("index.php?p=login&m=no_access", 0);
225		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to change ".$userbank->GetProperty('user', $aid)."'s email, but doesn't have access.");
226		return $objResponse;
227	}
228
229    if($userbank->encrypt_password($password) != $userbank->getProperty('password'))
230    {
231        $objResponse->addScript("$('emailpw.msg').setStyle('display', 'block');");
232		$objResponse->addScript("$('emailpw.msg').setHTML('The password you supplied is wrong.');");
233		$objResponse->addScript("set_error(1);");
234		return $objResponse;
235	} else {
236		$objResponse->addScript("$('emailpw.msg').setStyle('display', 'none');");
237		$objResponse->addScript("set_error(0);");
238	}
239
240	if(!check_email($email)) {
241		$objResponse->addScript("$('email1.msg').setStyle('display', 'block');");
242		$objResponse->addScript("$('email1.msg').setHTML('You must type a valid email address.');");
243		$objResponse->addScript("set_error(1);");
244		return $objResponse;
245	} else {
246		$objResponse->addScript("$('email1.msg').setStyle('display', 'none');");
247		$objResponse->addScript("set_error(0);");
248	}
249
250	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `email` = ? WHERE `aid` = ?", array($email, $aid));
251	$objResponse->addScript("ShowBox('E-mail address changed', 'Your E-mail address has been changed successfully.', 'green', 'index.php?p=account', true);");
252	$log = new CSystemLog("m", "E-mail Changed", "E-mail changed for admin (".$aid.")");
253	return $objResponse;
254}
255
256function AddGroup($name, $type, $bitmask, $srvflags)
257{
258	$objResponse = new xajaxResponse();
259	global $userbank, $username;
260	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_GROUP))
261	{
262		$objResponse->redirect("index.php?p=login&m=no_access", 0);
263		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to Add a new group, but doesnt have access.");
264		return $objResponse;
265	}
266
267	$error = 0;
268	$query = $GLOBALS['db']->GetRow("SELECT `gid` FROM `" . DB_PREFIX . "_groups` WHERE `name` = ?", array($name));
269	$query2 = $GLOBALS['db']->GetRow("SELECT `id` FROM `" . DB_PREFIX . "_srvgroups` WHERE `name` = ?", array($name));
270	if(strlen($name) == 0 || count($query) > 0 || count($query2) > 0)
271	{
272		if(strlen($name) == 0)
273		{
274			$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
275			$objResponse->addScript("$('name.msg').setHTML('Please enter a name for this group.');");
276			$error++;
277		}
278		else if(strstr($name, ','))	{
279			$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
280			$objResponse->addScript("$('name.msg').setHTML('You cannot have a comma \',\' in a group name.');");
281			$error++;
282		}
283		else if(count($query) > 0 || count($query2) > 0){
284			$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
285			$objResponse->addScript("$('name.msg').setHTML('A group is already named \'" . $name . "\'');");
286			$error++;
287		}
288		else {
289			$objResponse->addScript("$('name.msg').setStyle('display', 'none');");
290			$objResponse->addScript("$('name.msg').setHTML('');");
291		}
292	}
293	if($type == "0")
294	{
295		$objResponse->addScript("$('type.msg').setStyle('display', 'block');");
296		$objResponse->addScript("$('type.msg').setHTML('Please choose a type for the group.');");
297		$error++;
298	}
299	else {
300		$objResponse->addScript("$('type.msg').setStyle('display', 'none');");
301		$objResponse->addScript("$('type.msg').setHTML('');");
302	}
303	if($error > 0)
304		return $objResponse;
305
306	$query = $GLOBALS['db']->GetRow("SELECT MAX(gid) AS next_gid FROM `" . DB_PREFIX . "_groups`");
307	if($type == "1")
308	{
309		// add the web group
310		$query1 = $GLOBALS['db']->Execute("INSERT INTO `" . DB_PREFIX . "_groups` (`gid`, `type`, `name`, `flags`) VALUES (". (int)($query['next_gid']+1) .", '" . (int)$type . "', ?, '" . (int)$bitmask . "')", array($name));
311	}
312	elseif($type == "2")
313	{
314		if(strstr($srvflags, "#"))
315		{
316			$immunity = "0";
317			$immunity = substr($srvflags, strpos($srvflags, "#")+1);
318			$srvflags = substr($srvflags, 0, strlen($srvflags) - strlen($immunity)-1);
319		}
320		$immunity = (isset($immunity) && $immunity>0) ? $immunity : 0;
321		$add_group = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_srvgroups(immunity,flags,name,groups_immune)
322					VALUES (?,?,?,?)");
323		$GLOBALS['db']->Execute($add_group,array($immunity, $srvflags, $name, " "));
324	}
325	elseif($type == "3")
326	{
327		// We need to add the server into the table
328		$query1 = $GLOBALS['db']->Execute("INSERT INTO `" . DB_PREFIX . "_groups` (`gid`, `type`, `name`, `flags`) VALUES (". ($query['next_gid']+1) .", '3', ?, '0')", array($name));
329	}
330
331	$log = new CSystemLog("m", "Group Created", "A new group was created ($name)");
332    $objResponse->addScript("ShowBox('Group Created', 'Your group has been successfully created.', 'green', 'index.php?p=admin&c=groups', true);");
333    $objResponse->addScript("TabToReload();");
334	return $objResponse;
335}
336
337function RemoveGroup($gid, $type)
338{
339	$objResponse = new xajaxResponse();
340	global $userbank, $username;
341	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_DELETE_GROUPS))
342	{
343		$objResponse->redirect("index.php?p=login&m=no_access", 0);
344		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a group, but doesnt have access.");
345		return $objResponse;
346	}
347
348	$gid = (int)$gid;
349
350
351	if($type == "web") {
352		$query2 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_admins` SET gid = -1 WHERE gid = $gid");
353		$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_groups` WHERE gid = $gid");
354	}
355	else if($type == "server") {
356		$query2 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_servers_groups` WHERE group_id = $gid");
357		$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_groups` WHERE gid = $gid");
358	}
359	else {
360		$query2 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_admins` SET srv_group = NULL WHERE srv_group = (SELECT name FROM `" . DB_PREFIX . "_srvgroups` WHERE id = $gid)");
361		$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_srvgroups` WHERE id = $gid");
362		$query0 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_srvgroups_overrides` WHERE group_id = $gid");
363	}
364
365	if(isset($GLOBALS['config']['config.enableadminrehashing']) && $GLOBALS['config']['config.enableadminrehashing'] == 1)
366	{
367		// rehash the settings out of the database on all servers
368		$serveraccessq = $GLOBALS['db']->GetAll("SELECT sid FROM ".DB_PREFIX."_servers WHERE enabled = 1;");
369		$allservers = array();
370		foreach($serveraccessq as $access) {
371			if(!in_array($access['sid'], $allservers)) {
372				$allservers[] = $access['sid'];
373			}
374		}
375		$rehashing = true;
376	}
377
378	$objResponse->addScript("SlideUp('gid_$gid');");
379	if($query1)
380	{
381		if(isset($rehashing))
382			$objResponse->addScript("ShowRehashBox('".implode(",", $allservers)."', 'Group Deleted', 'The selected group has been deleted from the database', 'green', 'index.php?p=admin&c=groups', true);");
383		else
384			$objResponse->addScript("ShowBox('Group Deleted', 'The selected group has been deleted from the database', 'green', 'index.php?p=admin&c=groups', true);");
385		$log = new CSystemLog("m", "Group Deleted", "Group (" . $gid . ") has been deleted");
386	}
387	else
388		$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the group from the database. Check the logs for more info', 'red', 'index.php?p=admin&c=groups', true);");
389
390	return $objResponse;
391}
392
393function RemoveSubmission($sid, $archiv)
394{
395	$objResponse = new xajaxResponse();
396	global $userbank, $username;
397	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_BAN_SUBMISSIONS))
398	{
399		$objResponse->redirect("index.php?p=login&m=no_access", 0);
400		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a submission, but doesnt have access.");
401		return $objResponse;
402	}
403	$sid = (int)$sid;
404	if($archiv == "1") { // move submission to archiv
405		$query1 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_submissions` SET archiv = '1', archivedby = '".$userbank->GetAid()."' WHERE subid = $sid");
406		$query = $GLOBALS['db']->GetRow("SELECT count(subid) AS cnt FROM `" . DB_PREFIX . "_submissions` WHERE archiv = '0'");
407		$objResponse->addScript("$('subcount').setHTML('" . $query['cnt'] . "');");
408
409		$objResponse->addScript("SlideUp('sid_$sid');");
410		$objResponse->addScript("SlideUp('sid_" . $sid . "a');");
411
412		if($query1)
413		{
414			$objResponse->addScript("ShowBox('Submission Archived', 'The selected submission has been moved to the archive!', 'green', 'index.php?p=admin&c=bans', true);");
415			$log = new CSystemLog("m", "Submission Archived", "Submission (" . $sid . ") has been moved to the archive");
416		}
417		else
418			$objResponse->addScript("ShowBox('Error', 'There was a problem moving the submission to the archive. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
419	} else if($archiv == "0") { // delete submission
420		$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_submissions` WHERE subid = $sid");
421		$query2 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_demos` WHERE demid = '".$sid."' AND demtype = 'S'");
422		$query = $GLOBALS['db']->GetRow("SELECT count(subid) AS cnt FROM `" . DB_PREFIX . "_submissions` WHERE archiv = '1'");
423		$objResponse->addScript("$('subcountarchiv').setHTML('" . $query['cnt'] . "');");
424
425		$objResponse->addScript("SlideUp('asid_$sid');");
426		$objResponse->addScript("SlideUp('asid_" . $sid . "a');");
427
428		if($query1)
429		{
430			$objResponse->addScript("ShowBox('Submission Deleted', 'The selected submission has been deleted from the database', 'green', 'index.php?p=admin&c=bans', true);");
431			$log = new CSystemLog("m", "Submission Deleted", "Submission (" . $sid . ") has been deleted");
432		}
433		else
434			$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the submission from the database. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
435	} else if($archiv == "2") { // restore the submission
436		$query1 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_submissions` SET archiv = '0', archivedby = NULL WHERE subid = $sid");
437		$query = $GLOBALS['db']->GetRow("SELECT count(subid) AS cnt FROM `" . DB_PREFIX . "_submissions` WHERE archiv = '0'");
438		$objResponse->addScript("$('subcountarchiv').setHTML('" . $query['cnt'] . "');");
439
440		$objResponse->addScript("SlideUp('asid_$sid');");
441		$objResponse->addScript("SlideUp('asid_" . $sid . "a');");
442
443		if($query1)
444		{
445			$objResponse->addScript("ShowBox('Submission Restored', 'The selected submission has been restored from the archive!', 'green', 'index.php?p=admin&c=bans', true);");
446			$log = new CSystemLog("m", "Submission Restored", "Submission (" . $sid . ") has been restored from the archive");
447		}
448		else
449			$objResponse->addScript("ShowBox('Error', 'There was a problem restoring the submission from the archive. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
450	}
451	return $objResponse;
452}
453
454function RemoveProtest($pid, $archiv)
455{
456	$objResponse = new xajaxResponse();
457	global $userbank, $username;
458	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_BAN_PROTESTS))
459	{
460		$objResponse->redirect("index.php?p=login&m=no_access", 0);
461		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a protest, but doesnt have access.");
462		return $objResponse;
463	}
464	$pid = (int)$pid;
465	if($archiv == '0') { // delete protest
466		$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_protests` WHERE pid = $pid");
467		$query2 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_comments` WHERE type = 'P' AND bid = $pid;");
468		$query = $GLOBALS['db']->GetRow("SELECT count(pid) AS cnt FROM `" . DB_PREFIX . "_protests` WHERE archiv = '1'");
469		$objResponse->addScript("$('protcountarchiv').setHTML('" . $query['cnt'] . "');");
470		$objResponse->addScript("SlideUp('apid_$pid');");
471		$objResponse->addScript("SlideUp('apid_" . $pid . "a');");
472
473		if($query1)
474		{
475			$objResponse->addScript("ShowBox('Protest Deleted', 'The selected protest has been deleted from the database', 'green', 'index.php?p=admin&c=bans', true);");
476			$log = new CSystemLog("m", "Protest Deleted", "Protest (" . $pid . ") has been deleted");
477		}
478		else
479			$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the protest from the database. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
480	} else if($archiv == '1') { // move protest to archiv
481		$query1 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_protests` SET archiv = '1', archivedby = '".$userbank->GetAid()."' WHERE pid = $pid");
482		$query = $GLOBALS['db']->GetRow("SELECT count(pid) AS cnt FROM `" . DB_PREFIX . "_protests` WHERE archiv = '0'");
483		$objResponse->addScript("$('protcount').setHTML('" . $query['cnt'] . "');");
484		$objResponse->addScript("SlideUp('pid_$pid');");
485		$objResponse->addScript("SlideUp('pid_" . $pid . "a');");
486
487		if($query1)
488		{
489			$objResponse->addScript("ShowBox('Protest Archived', 'The selected protest has been moved to the archive.', 'green', 'index.php?p=admin&c=bans', true);");
490			$log = new CSystemLog("m", "Protest Archived", "Protest (" . $pid . ") has been moved to the archive.");
491		}
492		else
493			$objResponse->addScript("ShowBox('Error', 'There was a problem moving the protest to the archive. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
494	} else if($archiv == '2') { // restore protest
495		$query1 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_protests` SET archiv = '0', archivedby = NULL WHERE pid = $pid");
496		$query = $GLOBALS['db']->GetRow("SELECT count(pid) AS cnt FROM `" . DB_PREFIX . "_protests` WHERE archiv = '1'");
497		$objResponse->addScript("$('protcountarchiv').setHTML('" . $query['cnt'] . "');");
498		$objResponse->addScript("SlideUp('apid_$pid');");
499		$objResponse->addScript("SlideUp('apid_" . $pid . "a');");
500
501		if($query1)
502		{
503			$objResponse->addScript("ShowBox('Protest Restored', 'The selected protest has been restored from the archive.', 'green', 'index.php?p=admin&c=bans', true);");
504			$log = new CSystemLog("m", "Protest Deleted", "Protest (" . $pid . ") has been restored from the archive.");
505		}
506		else
507			$objResponse->addScript("ShowBox('Error', 'There was a problem restoring the protest from the archive. Check the logs for more info', 'red', 'index.php?p=admin&c=bans', true);");
508	}
509	return $objResponse;
510}
511
512function RemoveServer($sid)
513{
514	$objResponse = new xajaxResponse();
515	global $userbank, $username;
516	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_DELETE_SERVERS))
517	{
518		$objResponse->redirect("index.php?p=login&m=no_access", 0);
519		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a server, but doesnt have access.");
520		return $objResponse;
521	}
522	$sid = (int)$sid;
523	$objResponse->addScript("SlideUp('sid_$sid');");
524	$servinfo = $GLOBALS['db']->GetRow("SELECT ip, port FROM `" . DB_PREFIX . "_servers` WHERE sid = $sid");
525	$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_servers` WHERE sid = $sid");
526	$query2 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_servers_groups` WHERE server_id = $sid");
527    $query3 = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_admins_servers_groups` SET server_id = -1 WHERE server_id = $sid");
528
529	$query = $GLOBALS['db']->GetRow("SELECT count(sid) AS cnt FROM `" . DB_PREFIX . "_servers`");
530	$objResponse->addScript("$('srvcount').setHTML('" . $query['cnt'] . "');");
531
532
533	if($query1)
534	{
535		$objResponse->addScript("ShowBox('Server Deleted', 'The selected server has been deleted from the database', 'green', 'index.php?p=admin&c=servers', true);");
536		$log = new CSystemLog("m", "Server Deleted", "Server (" . $servinfo['ip'] . ":" . $servinfo['port'] . ") has been deleted");
537	}
538	else
539		$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the server from the database. Check the logs for more info', 'red', 'index.php?p=admin&c=servers', true);");
540	return $objResponse;
541}
542
543function RemoveMod($mid)
544{
545	$objResponse = new xajaxResponse();
546	global $userbank, $username;
547	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_DELETE_MODS))
548	{
549		$objResponse->redirect("index.php?p=login&m=no_access", 0);
550		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a mod, but doesnt have access.");
551		return $objResponse;
552	}
553	$mid = (int)$mid;
554	$objResponse->addScript("SlideUp('mid_$mid');");
555
556	$modicon = $GLOBALS['db']->GetRow("SELECT icon, name FROM `" . DB_PREFIX . "_mods` WHERE mid = '" . $mid . "';");
557	@unlink(SB_ICONS."/".$modicon['icon']);
558
559	$query1 = $GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_mods` WHERE mid = '" . $mid . "'");
560
561	if($query1)
562	{
563		$objResponse->addScript("ShowBox('MOD Deleted', 'The selected MOD has been deleted from the database', 'green', 'index.php?p=admin&c=mods', true);");
564		$log = new CSystemLog("m", "MOD Deleted", "MOD (" . $modicon['name'] . ") has been deleted");
565	}
566	else
567		$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the MOD from the database. Check the logs for more info', 'red', 'index.php?p=admin&c=mods', true);");
568	return $objResponse;
569}
570
571function RemoveAdmin($aid)
572{
573	$objResponse = new xajaxResponse();
574	global $userbank, $username;
575	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_DELETE_ADMINS))
576	{
577		$objResponse->redirect("index.php?p=login&m=no_access", 0);
578		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove an admin, but doesnt have access.");
579		return $objResponse;
580	}
581	$aid = (int)$aid;
582	$gid = $GLOBALS['db']->GetRow("SELECT gid, authid, extraflags, user FROM `" . DB_PREFIX . "_admins` WHERE aid = $aid");
583	if((intval($gid[2]) & ADMIN_OWNER) != 0)
584	{
585		$objResponse->addAlert("Error: You cannot delete the owner.");
586		return $objResponse;
587	}
588
589	$delquery = $GLOBALS['db']->Execute(sprintf("DELETE FROM `%s_admins` WHERE aid = %d LIMIT 1", DB_PREFIX, $aid));
590	if($delquery) {
591		if(isset($GLOBALS['config']['config.enableadminrehashing']) && $GLOBALS['config']['config.enableadminrehashing'] == 1)
592		{
593			// rehash the admins for the servers where this admin was on
594			$serveraccessq = $GLOBALS['db']->GetAll("SELECT s.sid FROM `".DB_PREFIX."_servers` s
595												LEFT JOIN `".DB_PREFIX."_admins_servers_groups` asg ON asg.admin_id = '".(int)$aid."'
596												LEFT JOIN `".DB_PREFIX."_servers_groups` sg ON sg.group_id = asg.srv_group_id
597												WHERE ((asg.server_id != '-1' AND asg.srv_group_id = '-1')
598												OR (asg.srv_group_id != '-1' AND asg.server_id = '-1'))
599												AND (s.sid IN(asg.server_id) OR s.sid IN(sg.server_id)) AND s.enabled = 1");
600			$allservers = array();
601			foreach($serveraccessq as $access) {
602				if(!in_array($access['sid'], $allservers)) {
603					$allservers[] = $access['sid'];
604				}
605			}
606			$rehashing = true;
607		}
608
609		$GLOBALS['db']->Execute(sprintf("DELETE FROM `%s_admins_servers_groups` WHERE admin_id = %d", DB_PREFIX, $aid));
610 	}
611
612	$query = $GLOBALS['db']->GetRow("SELECT count(aid) AS cnt FROM `" . DB_PREFIX . "_admins`");
613	$objResponse->addScript("SlideUp('aid_$aid');");
614	$objResponse->addScript("$('admincount').setHTML('" . $query['cnt'] . "');");
615	if($delquery)
616	{
617		if(isset($rehashing))
618			$objResponse->addScript("ShowRehashBox('".implode(",", $allservers)."', 'Admin Deleted', 'The selected admin has been deleted from the database', 'green', 'index.php?p=admin&c=admins', true);");
619		else
620			$objResponse->addScript("ShowBox('Admin Deleted', 'The selected admin has been deleted from the database', 'green', 'index.php?p=admin&c=admins', true);");
621		$log = new CSystemLog("m", "Admin Deleted", "Admin (" . $gid['user'] . ") has been deleted");
622	}
623	else
624		$objResponse->addScript("ShowBox('Error', 'There was an error removing the admin from the database, please check the logs', 'red', 'index.php?p=admin&c=admins', true);");
625	return $objResponse;
626}
627
628function AddServer($ip, $port, $rcon, $rcon2, $mod, $enabled, $group, $group_name)
629{
630	$objResponse = new xajaxResponse();
631	global $userbank, $username;
632	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_SERVER))
633	{
634		$objResponse->redirect("index.php?p=login&m=no_access", 0);
635		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add a server, but doesnt have access.");
636		return $objResponse;
637	}
638	$ip = RemoveCode($ip);
639	$group_name = RemoveCode($group_name);
640
641	$error = 0;
642	// ip
643	if((empty($ip)))
644	{
645		$error++;
646		$objResponse->addAssign("address.msg", "innerHTML", "You must type the server address.");
647		$objResponse->addScript("$('address.msg').setStyle('display', 'block');");
648	}
649	else
650	{
651		$objResponse->addAssign("address.msg", "innerHTML", "");
652		if(!validate_ip($ip) && !is_string($ip))
653		{
654			$error++;
655			$objResponse->addAssign("address.msg", "innerHTML", "You must type a valid IP.");
656			$objResponse->addScript("$('address.msg').setStyle('display', 'block');");
657		}
658		else
659			$objResponse->addAssign("address.msg", "innerHTML", "");
660	}
661	// Port
662	if((empty($port)))
663	{
664		$error++;
665		$objResponse->addAssign("port.msg", "innerHTML", "You must type the server port.");
666		$objResponse->addScript("$('port.msg').setStyle('display', 'block');");
667	}
668	else
669	{
670		$objResponse->addAssign("port.msg", "innerHTML", "");
671		if(!is_numeric($port))
672		{
673			$error++;
674			$objResponse->addAssign("port.msg", "innerHTML", "You must type a valid port <b>number</b>.");
675			$objResponse->addScript("$('port.msg').setStyle('display', 'block');");
676		}
677		else
678		{
679			$objResponse->addScript("$('port.msg').setStyle('display', 'none');");
680			$objResponse->addAssign("port.msg", "innerHTML", "");
681		}
682	}
683	// rcon
684	if(!empty($rcon) && $rcon != $rcon2)
685	{
686		$error++;
687		$objResponse->addAssign("rcon2.msg", "innerHTML", "The passwords don't match.");
688		$objResponse->addScript("$('rcon2.msg').setStyle('display', 'block');");
689	}
690	else
691		$objResponse->addAssign("rcon2.msg", "innerHTML", "");
692
693	// Please Select
694	if($mod == -2)
695	{
696		$error++;
697		$objResponse->addAssign("mod.msg", "innerHTML", "You must select the mod your server runs.");
698		$objResponse->addScript("$('mod.msg').setStyle('display', 'block');");
699	}
700	else
701		$objResponse->addAssign("mod.msg", "innerHTML", "");
702
703	if($group == -2)
704	{
705		$error++;
706		$objResponse->addAssign("group.msg", "innerHTML", "You must select an option.");
707		$objResponse->addScript("$('group.msg').setStyle('display', 'block');");
708	}
709	else
710		$objResponse->addAssign("group.msg", "innerHTML", "");
711
712	if($error)
713		return $objResponse;
714
715	// Check for dublicates afterwards
716	$chk = $GLOBALS['db']->GetRow('SELECT sid FROM `'.DB_PREFIX.'_servers` WHERE ip = ? AND port = ?;', array($ip, (int)$port));
717	if($chk)
718	{
719		$objResponse->addScript("ShowBox('Error', 'There already is a server with that IP:Port combination.', 'red');");
720		return $objResponse;
721	}
722
723	// ##############################################################
724	// ##                     Start adding to DB                   ##
725	// ##############################################################
726	//they wanna make a new group
727	$gid = -1;
728	$sid = nextSid();
729
730	$enable = ($enabled=="true"?1:0);
731
732	// Add the server
733	$addserver = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_servers (`sid`, `ip`, `port`, `rcon`, `modid`, `enabled`)
734										  VALUES (?,?,?,?,?,?)");
735	$GLOBALS['db']->Execute($addserver,array($sid, $ip, (int)$port, $rcon, $mod, $enable));
736
737	// Add server to each group specified
738	$groups = explode(",", $group);
739	$addtogrp = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_servers_groups (`server_id`, `group_id`) VALUES (?,?)");
740	foreach($groups AS $g)
741	{
742		if($g)
743			$GLOBALS['db']->Execute($addtogrp,array($sid, $g));
744	}
745
746
747	$objResponse->addScript("ShowBox('Server Added', 'Your server has been successfully created.', 'green', 'index.php?p=admin&c=servers');");
748    $objResponse->addScript("TabToReload();");
749    $log = new CSystemLog("m", "Server Added", "Server (" . $ip . ":" . $port . ") has been added");
750	return $objResponse;
751}
752
753
754function UpdateGroupPermissions($gid)
755{
756	$objResponse = new xajaxResponse();
757	global $userbank;
758	$gid = (int)$gid;
759	if($gid == 1)
760	{
761		$permissions = @file_get_contents(TEMPLATES_PATH . "/groups.web.perm.php");
762		$permissions = str_replace("{title}", "Web Admin Permissions", $permissions);
763	}
764	elseif($gid == 2)
765	{
766		$permissions = @file_get_contents(TEMPLATES_PATH . "/groups.server.perm.php");
767		$permissions = str_replace("{title}", "Server Admin Permissions", $permissions);
768	}
769	elseif($gid == 3)
770		$permissions = "";
771
772	$objResponse->addAssign("perms", "innerHTML", $permissions);
773	if(!$userbank->HasAccess(ADMIN_OWNER))
774		$objResponse->addScript('if($("wrootcheckbox")) {
775									$("wrootcheckbox").setStyle("display", "none");
776								}
777								if($("srootcheckbox")) {
778									$("srootcheckbox").setStyle("display", "none");
779								}');
780	$objResponse->addScript("$('type.msg').setHTML('');");
781	$objResponse->addScript("$('type.msg').setStyle('display', 'none');");
782	return $objResponse;
783}
784
785function UpdateAdminPermissions($type, $value)
786{
787	$objResponse = new xajaxResponse();
788	global $userbank;
789	$type = (int)$type;
790	if($type == 1)
791	{
792		$id = "web";
793		if($value == "c")
794		{
795			$permissions = @file_get_contents(TEMPLATES_PATH . "/groups.web.perm.php");
796			$permissions = str_replace("{title}", "Web Admin Permissions", $permissions);
797		}
798		elseif($value == "n")
799		{
800			$permissions = @file_get_contents(TEMPLATES_PATH . "/group.name.php") . @file_get_contents(TEMPLATES_PATH . "/groups.web.perm.php");
801			$permissions = str_replace("{name}", "webname", $permissions);
802			$permissions = str_replace("{title}", "New Group Permissions", $permissions);
803		}
804		else
805			$permissions = "";
806	}
807	if($type == 2)
808	{
809		$id = "server";
810		if($value == "c")
811		{
812			$permissions = file_get_contents(TEMPLATES_PATH . "/groups.server.perm.php");
813			$permissions = str_replace("{title}", "Server Admin Permissions", $permissions);
814		}
815		elseif($value == "n")
816		{
817			$permissions = @file_get_contents(TEMPLATES_PATH . "/group.name.php") . @file_get_contents(TEMPLATES_PATH . "/groups.server.perm.php");
818			$permissions = str_replace("{name}", "servername", $permissions);
819			$permissions = str_replace("{title}", "New Group Permissions", $permissions);
820		}
821		else
822			$permissions = "";
823	}
824
825	$objResponse->addAssign($id."perm", "innerHTML", $permissions);
826	if(!$userbank->HasAccess(ADMIN_OWNER))
827		$objResponse->addScript('if($("wrootcheckbox")) {
828									$("wrootcheckbox").setStyle("display", "none");
829								}
830								if($("srootcheckbox")) {
831									$("srootcheckbox").setStyle("display", "none");
832								}');
833	$objResponse->addAssign($id.".msg", "innerHTML", "");
834	return $objResponse;
835
836}
837
838function AddServerGroupName()
839{
840	$objResponse = new xajaxResponse();
841	global $userbank, $username;
842	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_EDIT_GROUPS))
843	{
844		$objResponse->redirect("index.php?p=login&m=no_access", 0);
845		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to edit group name, but doesnt have access.");
846		return $objResponse;
847	}
848	$inject = '<td valign="top"><div class="rowdesc">' . HelpIcon("Server Group Name", "Please type the name of the new group you wish to create.") . 'Group Name </div></td>';
849	$inject .= '<td><div align="left">
850        <input type="text" style="border: 1px solid #000000; width: 105px; font-size: 14px; background-color: rgb(215, 215, 215);width: 200px;" id="sgroup" name="sgroup" />
851      </div>
852        <div id="group_name.msg" style="color:#CC0000;width:195px;display:none;"></div></td>
853  ';
854	$objResponse->addAssign("nsgroup", "innerHTML", $inject);
855	$objResponse->addAssign("group.msg", "innerHTML", "");
856	return $objResponse;
857
858}
859
860function AddAdmin($mask, $srv_mask, $a_name, $a_steam, $a_email, $a_password, $a_password2,	$a_sg, $a_wg, $a_serverpass, $a_webname, $a_servername, $server, $singlesrv)
861{
862	$objResponse = new xajaxResponse();
863	global $userbank, $username;
864	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_ADMINS))
865	{
866		$objResponse->redirect("index.php?p=login&m=no_access", 0);
867		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add an admin, but doesnt have access.");
868		return $objResponse;
869	}
870	$a_name = RemoveCode($a_name);
871	$a_steam = RemoveCode($a_steam);
872	$a_email = RemoveCode($a_email);
873	$a_servername = ($a_servername=="0" ? null : RemoveCode($a_servername));
874	$a_webname = RemoveCode($a_webname);
875	$mask = (int)$mask;
876
877	$error=0;
878
879    //No name
880	if(empty($a_name))
881	{
882		$error++;
883		$objResponse->addAssign("name.msg", "innerHTML", "You must type a name for the admin.");
884		$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
885	}
886	else{
887		if(strstr($a_name, "'"))
888		{
889			$error++;
890			$objResponse->addAssign("name.msg", "innerHTML", "An admin name can not contain a \" ' \".");
891			$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
892		}
893		else
894		{
895			if(is_taken("admins", "user", $a_name))
896			{
897					$error++;
898					$objResponse->addAssign("name.msg", "innerHTML", "An admin with this name already exists");
899					$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
900			}
901			else
902			{
903					$objResponse->addAssign("name.msg", "innerHTML", "");
904					$objResponse->addScript("$('name.msg').setStyle('display', 'none');");
905			}
906		}
907	}
908	// If they didnt type a steamid
909	if((empty($a_steam) || strlen($a_steam) < 10))
910	{
911		$error++;
912		$objResponse->addAssign("steam.msg", "innerHTML", "You must type a Steam ID or Community ID for the admin.");
913		$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
914	}
915	else
916	{
917		// Validate the steamid or fetch it from the community id
918		if((!is_numeric($a_steam)
919		&& !validate_steam($a_steam))
920		|| (is_numeric($a_steam)
921		&& (strlen($a_steam) < 15
922		|| !validate_steam($a_steam = FriendIDToSteamID($a_steam)))))
923		{
924			$error++;
925			$objResponse->addAssign("steam.msg", "innerHTML", "Please enter a valid Steam ID or Community ID.");
926			$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
927		}
928		else
929		{
930			if(is_taken("admins", "authid", $a_steam))
931			{
932				$admins = $userbank->GetAllAdmins();
933				foreach($admins as $admin)
934				{
935					if($admin['authid'] == $a_steam)
936					{
937						$name = $admin['user'];
938						break;
939					}
940				}
941				$error++;
942				$objResponse->addAssign("steam.msg", "innerHTML", "Admin ".htmlspecialchars(addslashes($name))." already uses this Steam ID.");
943				$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
944			}
945			else
946			{
947				$objResponse->addAssign("steam.msg", "innerHTML", "");
948				$objResponse->addScript("$('steam.msg').setStyle('display', 'none');");
949			}
950		}
951	}
952
953	// No email
954	if(empty($a_email))
955	{
956		// An E-Mail address is only required for users with web permissions.
957		if($mask != 0)
958		{
959			$error++;
960			$objResponse->addAssign("email.msg", "innerHTML", "You must type an e-mail address.");
961			$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
962		}
963	}
964	else{
965		// Is an other admin already registred with that email address?
966		if(is_taken("admins", "email", $a_email))
967		{
968			$admins = $userbank->GetAllAdmins();
969			foreach($admins as $admin)
970			{
971				if($admin['email'] == $a_email)
972				{
973					$name = $admin['user'];
974					break;
975				}
976			}
977			$error++;
978			$objResponse->addAssign("email.msg", "innerHTML", "This email address is already being used by ".htmlspecialchars(addslashes($name)).".");
979			$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
980		}
981		else
982		{
983			$objResponse->addAssign("email.msg", "innerHTML", "");
984			$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
985		/*	if(!validate_email($a_email))
986			{
987				$error++;
988				$objResponse->addAssign("email.msg", "innerHTML", "Please enter a valid email address.");
989				$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
990			}
991			else
992			{
993				$objResponse->addAssign("email.msg", "innerHTML", "");
994				$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
995
996			}*/
997		}
998	}
999
1000	// no pass
1001	if(empty($a_password))
1002	{
1003		// A password is only required for users with web permissions.
1004		if($mask != 0)
1005		{
1006			$error++;
1007			$objResponse->addAssign("password.msg", "innerHTML", "You must type a password.");
1008			$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
1009		}
1010	}
1011	// Password too short?
1012	else if(strlen($a_password) < MIN_PASS_LENGTH)
1013	{
1014		$error++;
1015		$objResponse->addAssign("password.msg", "innerHTML", "Your password must be at-least " . MIN_PASS_LENGTH . " characters long.");
1016		$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
1017	}
1018	else
1019	{
1020		$objResponse->addAssign("password.msg", "innerHTML", "");
1021		$objResponse->addScript("$('password.msg').setStyle('display', 'none');");
1022
1023		// No confirmation typed
1024		if(empty($a_password2))
1025		{
1026			$error++;
1027			$objResponse->addAssign("password2.msg", "innerHTML", "You must confirm the password");
1028			$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
1029		}
1030		// Passwords match?
1031		else if($a_password != $a_password2)
1032		{
1033			$error++;
1034			$objResponse->addAssign("password2.msg", "innerHTML", "Your passwords don't match");
1035			$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
1036		}
1037		else
1038		{
1039			$objResponse->addAssign("password2.msg", "innerHTML", "");
1040			$objResponse->addScript("$('password2.msg').setStyle('display', 'none');");
1041		}
1042	}
1043
1044	// Choose to use a server password
1045	if($a_serverpass != "-1")
1046	{
1047		// No password given?
1048		if(empty($a_serverpass))
1049		{
1050			$error++;
1051			$objResponse->addAssign("a_serverpass.msg", "innerHTML", "You must type a server password or uncheck the box.");
1052			$objResponse->addScript("$('a_serverpass.msg').setStyle('display', 'block');");
1053		}
1054		// Password too short?
1055		else if(strlen($a_serverpass) < MIN_PASS_LENGTH)
1056		{
1057			$error++;
1058			$objResponse->addAssign("a_serverpass.msg", "innerHTML", "Your password must be at-least " . MIN_PASS_LENGTH . " characters long.");
1059			$objResponse->addScript("$('a_serverpass.msg').setStyle('display', 'block');");
1060		}
1061		else
1062		{
1063			$objResponse->addAssign("a_serverpass.msg", "innerHTML", "");
1064			$objResponse->addScript("$('a_serverpass.msg').setStyle('display', 'none');");
1065		}
1066	}
1067	else
1068	{
1069		$objResponse->addAssign("a_serverpass.msg", "innerHTML", "");
1070		$objResponse->addScript("$('a_serverpass.msg').setStyle('display', 'none');");
1071		// Don't set "-1" as password ;)
1072		$a_serverpass = "";
1073	}
1074
1075    // didn't choose a server group
1076    if($a_sg == "-2")
1077    {
1078        $error++;
1079        $objResponse->addAssign("server.msg", "innerHTML", "You must choose a group.");
1080        $objResponse->addScript("$('server.msg').setStyle('display', 'block');");
1081    }
1082    else
1083    {
1084        $objResponse->addAssign("server.msg", "innerHTML", "");
1085        $objResponse->addScript("$('server.msg').setStyle('display', 'none');");
1086    }
1087
1088	// chose to create a new server group
1089	if($a_sg == 'n')
1090	{
1091		// didn't type a name
1092		if(empty($a_servername))
1093		{
1094			$error++;
1095			$objResponse->addAssign("servername_err", "innerHTML", "You need to type a name for the new group.");
1096			$objResponse->addScript("$('servername_err').setStyle('display', 'block');");
1097		}
1098		// Group names can't contain ,
1099		else if(strstr($a_servername, ','))
1100		{
1101			$error++;
1102			$objResponse->addAssign("servername_err", "innerHTML", "Group name cannot contain a ','");
1103			$objResponse->addScript("$('servername_err').setStyle('display', 'block');");
1104		}
1105		else
1106		{
1107			$objResponse->addAssign("servername_err", "innerHTML", "");
1108			$objResponse->addScript("$('servername_err').setStyle('display', 'none');");
1109		}
1110	}
1111
1112	// didn't choose a web group
1113    if($a_wg == "-2")
1114	{
1115        $error++;
1116        $objResponse->addAssign("web.msg", "innerHTML", "You must choose a group.");
1117        $objResponse->addScript("$('web.msg').setStyle('display', 'block');");
1118    }
1119    else
1120    {
1121        $objResponse->addAssign("web.msg", "innerHTML", "");
1122        $objResponse->addScript("$('web.msg').setStyle('display', 'none');");
1123    }
1124
1125	// Choose to create a new webgroup
1126	if($a_wg == 'n')
1127	{
1128		// But didn't type a name
1129		if(empty($a_webname))
1130		{
1131			$error++;
1132			$objResponse->addAssign("webname_err", "innerHTML", "You need to type a name for the new group.");
1133			$objResponse->addScript("$('webname_err').setStyle('display', 'block');");
1134		}
1135		// Group names can't contain ,
1136		else if(strstr($a_webname, ','))
1137		{
1138			$error++;
1139			$objResponse->addAssign("webname_err", "innerHTML", "Group name cannot contain a ','");
1140			$objResponse->addScript("$('webname_err').setStyle('display', 'block');");
1141		}
1142		else
1143		{
1144			$objResponse->addAssign("webname_err", "innerHTML", "");
1145			$objResponse->addScript("$('webname_err').setStyle('display', 'none');");
1146		}
1147	}
1148
1149	// Ohnoes! something went wrong, stop and show errs
1150	if($error)
1151	{
1152		ShowBox_ajx("Error", "There are some errors in your input. Please correct them.", "red", "", true, $objResponse);
1153		return $objResponse;
1154	}
1155
1156// ##############################################################
1157// ##                     Start adding to DB                   ##
1158// ##############################################################
1159
1160	$gid = 0;
1161	$groupID = 0;
1162	$inGroup = false;
1163	$wgid = NextAid();
1164	$immunity = 0;
1165
1166	// Extract immunity from server mask string
1167	if(strstr($srv_mask, "#"))
1168	{
1169		$immunity = "0";
1170		$immunity = substr($srv_mask, strpos($srv_mask, "#")+1);
1171		$srv_mask = substr($srv_mask, 0, strlen($srv_mask) - strlen($immunity)-1);
1172	}
1173
1174	// Avoid negative immunity
1175	$immunity = ($immunity>0) ? $immunity : 0;
1176
1177	// Handle Webpermissions
1178	// Chose to create a new webgroup
1179	if($a_wg == 'n')
1180	{
1181		$add_webgroup = $GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_groups(type, name, flags)
1182										VALUES (?,?,?)", array(1, $a_webname, $mask));
1183		$web_group = (int)$GLOBALS['db']->Insert_ID();
1184
1185		// We added those permissons to the group, so don't add them as custom permissions again
1186		$mask = 0;
1187	}
1188	// Chose an existing group
1189	else if($a_wg != 'c' && $a_wg > 0)
1190	{
1191		$web_group = (int)$a_wg;
1192	}
1193	// Custom permissions -> no group
1194	else
1195	{
1196		$web_group = -1;
1197	}
1198
1199	// Handle Serverpermissions
1200	// Chose to create a new server admin group
1201	if($a_sg == 'n')
1202	{
1203		$add_servergroup = $GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_srvgroups(immunity, flags, name, groups_immune)
1204					VALUES (?,?,?,?)", array($immunity, $srv_mask, $a_servername, " "));
1205
1206		$server_admin_group = $a_servername;
1207		$server_admin_group_int = (int)$GLOBALS['db']->Insert_ID();
1208
1209		// We added those permissons to the group, so don't add them as custom permissions again
1210		$srv_mask = "";
1211	}
1212	// Chose an existing group
1213	else if($a_sg != 'c' && $a_sg > 0)
1214	{
1215		$server_admin_group = $GLOBALS['db']->GetOne("SELECT `name` FROM ".DB_PREFIX."_srvgroups WHERE id = '" . (int)$a_sg . "'");
1216		$server_admin_group_int = (int)$a_sg;
1217	}
1218	// Custom permissions -> no group
1219	else
1220	{
1221		$server_admin_group = "";
1222		$server_admin_group_int = -1;
1223	}
1224
1225	// Add the admin
1226	$aid = $userbank->AddAdmin($a_name, $a_steam, $a_password, $a_email, $web_group, $mask, $server_admin_group, $srv_mask, $immunity, $a_serverpass);
1227
1228	if($aid > -1)
1229	{
1230		// Grant permissions to the selected server groups
1231		$srv_groups = explode(",", $server);
1232		$addtosrvgrp = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_admins_servers_groups(admin_id,group_id,srv_group_id,server_id) VALUES (?,?,?,?)");
1233		foreach($srv_groups AS $srv_group)
1234		{
1235			if(!empty($srv_group))
1236				$GLOBALS['db']->Execute($addtosrvgrp,array($aid, $server_admin_group_int, substr($srv_group, 1), '-1'));
1237		}
1238
1239		// Grant permissions to individual servers
1240		$srv_arr = explode(",", $singlesrv);
1241		$addtosrv = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_admins_servers_groups(admin_id,group_id,srv_group_id,server_id) VALUES (?,?,?,?)");
1242		foreach($srv_arr AS $server)
1243		{
1244			if(!empty($server))
1245				$GLOBALS['db']->Execute($addtosrv,array($aid, $server_admin_group_int, '-1', substr($server, 1)));
1246		}
1247		if(isset($GLOBALS['config']['config.enableadminrehashing']) && $GLOBALS['config']['config.enableadminrehashing'] == 1)
1248		{
1249			// rehash the admins on the servers
1250			$serveraccessq = $GLOBALS['db']->GetAll("SELECT s.sid FROM `".DB_PREFIX."_servers` s
1251												LEFT JOIN `".DB_PREFIX."_admins_servers_groups` asg ON asg.admin_id = '".(int)$aid."'
1252												LEFT JOIN `".DB_PREFIX."_servers_groups` sg ON sg.group_id = asg.srv_group_id
1253												WHERE ((asg.server_id != '-1' AND asg.srv_group_id = '-1')
1254												OR (asg.srv_group_id != '-1' AND asg.server_id = '-1'))
1255												AND (s.sid IN(asg.server_id) OR s.sid IN(sg.server_id)) AND s.enabled = 1");
1256			$allservers = array();
1257			foreach($serveraccessq as $access) {
1258				if(!in_array($access['sid'], $allservers)) {
1259					$allservers[] = $access['sid'];
1260				}
1261			}
1262			$objResponse->addScript("ShowRehashBox('".implode(",", $allservers)."','Admin Added', 'The admin has been added successfully', 'green', 'index.php?p=admin&c=admins');TabToReload();");
1263		} else
1264			$objResponse->addScript("ShowBox('Admin Added', 'The admin has been added successfully', 'green', 'index.php?p=admin&c=admins');TabToReload();");
1265
1266		$log = new CSystemLog("m", "Admin added", "Admin (" . $a_name . ") has been added");
1267		return $objResponse;
1268	}
1269	else
1270	{
1271		$objResponse->addScript("ShowBox('User NOT Added', 'The admin failed to be added to the database. Check the logs for any SQL errors.', 'red', 'index.php?p=admin&c=admins');");
1272	}
1273}
1274
1275function ServerHostPlayers($sid, $type="servers", $obId="", $tplsid="", $open="", $inHome=false, $trunchostname=48)
1276{
1277	$objResponse = new xajaxResponse();
1278	global $userbank;
1279	require INCLUDES_PATH.'/CServerInfo.php';
1280
1281	$sid = (int)$sid;
1282
1283	$res = $GLOBALS['db']->GetRow("SELECT sid, ip, port FROM ".DB_PREFIX."_servers WHERE sid = $sid");
1284	if(empty($res[1]) || empty($res[2]))
1285		return $objResponse;
1286	$info = array();
1287	$sinfo = new CServerInfo($res[1],$res[2]);
1288	$info = $sinfo->getInfo();
1289	if($type == "servers")
1290	{
1291		if(!empty($info['hostname']))
1292		{
1293			$objResponse->addAssign("host_$sid", "innerHTML", trunc($info['hostname'], $trunchostname, false));
1294			$objResponse->addAssign("players_$sid", "innerHTML", $info['numplayers'] . "/" . $info['maxplayers']);
1295			$objResponse->addAssign("os_$sid", "innerHTML", "<img src='images/" . (!empty($info['os'])?$info['os']:'server_small') . ".png'>");
1296			if( $info['secure'] == 1 )
1297			{
1298				$objResponse->addAssign("vac_$sid", "innerHTML", "<img src='images/shield.png'>");
1299			}
1300			$objResponse->addAssign("map_$sid", "innerHTML", basename($info['map'])); // Strip Steam Workshop folder
1301			if(!$inHome) {
1302				$objResponse->addScript("$('mapimg_$sid').setProperty('src', '".GetMapImage($info['map'])."').setProperty('alt', '".$info['map']."').setProperty('title', '".basename($info['map'])."');");
1303				if($info['numplayers'] == 0 || empty($info['numplayers']))
1304				{
1305					$objResponse->addScript("$('sinfo_$sid').setStyle('display', 'none');");
1306					$objResponse->addScript("$('noplayer_$sid').setStyle('display', 'block');");
1307					$objResponse->addScript("$('serverwindow_$sid').setStyle('height', '64px');");
1308				} else {
1309					$objResponse->addScript("$('sinfo_$sid').setStyle('display', 'block');");
1310					$objResponse->addScript("$('noplayer_$sid').setStyle('display', 'none');");
1311					if(!defined('IN_HOME')) {
1312						$players = $sinfo->getPlayers();
1313						// remove childnodes
1314						$objResponse->addScript('var toempty = document.getElementById("playerlist_'.$sid.'");
1315						var empty = toempty.cloneNode(false);
1316						toempty.parentNode.replaceChild(empty,toempty);');
1317						//draw table headlines
1318						$objResponse->addScript('var e = document.getElementById("playerlist_'.$sid.'");
1319						var tr = e.insertRow("-1");
1320							// Name Top TD
1321							var td = tr.insertCell("-1");
1322								td.setAttribute("width","45%");
1323								td.setAttribute("height","16");
1324								td.className = "listtable_top";
1325									var b = document.createElement("b");
1326									var txt = document.createTextNode("Name");
1327									b.appendChild(txt);
1328								td.appendChild(b);
1329							// Score Top TD
1330							var td = tr.insertCell("-1");
1331								td.setAttribute("width","10%");
1332								td.setAttribute("height","16");
1333								td.className = "listtable_top";
1334									var b = document.createElement("b");
1335									var txt = document.createTextNode("Score");
1336									b.appendChild(txt);
1337								td.appendChild(b);
1338							// Time Top TD
1339							var td = tr.insertCell("-1");
1340								td.setAttribute("height","16");
1341								td.className = "listtable_top";
1342									var b = document.createElement("b");
1343									var txt = document.createTextNode("Time");
1344									b.appendChild(txt);
1345								td.appendChild(b);');
1346						// add players
1347						$playercount = 0;
1348						foreach($players AS $player) {
1349							$objResponse->addScript('var e = document.getElementById("playerlist_'.$sid.'");
1350													var tr = e.insertRow("-1");
1351													tr.className="tbl_out";
1352													tr.onmouseout = function(){this.className="tbl_out"};
1353													tr.onmouseover = function(){this.className="tbl_hover"};
1354													tr.id = "player_s'.$sid.'p'.$player["index"].'";
1355														// Name TD
1356														var td = tr.insertCell("-1");
1357															td.className = "listtable_1";
1358															var txt = document.createTextNode("'.str_replace('"', '\"', $player["name"]).'");
1359															td.appendChild(txt);
1360														// Score TD
1361														var td = tr.insertCell("-1");
1362															td.className = "listtable_1";
1363															var txt = document.createTextNode("'.$player["kills"].'");
1364															td.appendChild(txt);
1365														// Time TD
1366														var td = tr.insertCell("-1");
1367															td.className = "listtable_1";
1368															var txt = document.createTextNode("'.$player["time"].'");
1369															td.appendChild(txt);
1370														');
1371							if($userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN)) {
1372								$objResponse->addScript('AddContextMenu("#player_s'.$sid.'p'.$player["index"].'", "contextmenu", true, "Player Commands", [
1373														{name: "Kick", callback: function(){KickPlayerConfirm('.$sid.', "'.str_replace('"', '\"', $player["name"]).'", 0);}},
1374														{name: "Block Comms", callback: function(){window.location = "index.php?p=admin&c=comms&action=pasteBan&sid='.$sid.'&pName='.str_replace('"', '\"', $player["name"]).'"}},
1375														{name: "Ban", callback: function(){window.location = "index.php?p=admin&c=bans&action=pasteBan&sid='.$sid.'&pName='.str_replace('"', '\"', $player["name"]).'"}},
1376														{separator: true},
1377														'.(ini_get('safe_mode')==0 ? '{name: "View Profile", callback: function(){ViewCommunityProfile('.$sid.', "'.str_replace('"', '\"', $player["name"]).'")}},':'').'
1378														{name: "Send Message", callback: function(){OpenMessageBox('.$sid.', "'.str_replace('"', '\"', $player["name"]).'", 1)}}
1379														]);');
1380							}
1381							$playercount++;
1382						}
1383					}
1384					if($playercount>15)
1385						$height = 329 + 16 * ($playercount-15) + 4 * ($playercount-15) . "px";
1386					else
1387						$height = 329 . "px";
1388					$objResponse->addScript("$('serverwindow_$sid').setStyle('height', '".$height."');");
1389				}
1390			}
1391		}else{
1392			if($userbank->HasAccess(ADMIN_OWNER))
1393				$objResponse->addAssign("host_$sid", "innerHTML", "<b>Error connecting</b> (<i>" . $res[1] . ":" . $res[2]. "</i>) <small><a href=\"https://sbpp.github.io/faq/\" title=\"Which ports does the SourceBans webpanel require to be open?\">Help</a></small>");
1394			else
1395				$objResponse->addAssign("host_$sid", "innerHTML", "<b>Error connecting</b> (<i>" . $res[1] . ":" . $res[2]. "</i>)");
1396			$objResponse->addAssign("players_$sid", "innerHTML", "N/A");
1397			$objResponse->addAssign("os_$sid", "innerHTML", "N/A");
1398			$objResponse->addAssign("vac_$sid", "innerHTML", "N/A");
1399			$objResponse->addAssign("map_$sid", "innerHTML", "N/A");
1400			if(!$inHome) {
1401				$connect = "onclick = \"document.location = 'steam://connect/" .  $res['ip'] . ":" . $res['port'] . "'\"";
1402				$objResponse->addScript("$('sinfo_$sid').setStyle('display', 'none');");
1403				$objResponse->addScript("$('noplayer_$sid').setStyle('display', 'block');");
1404				$objResponse->addScript("$('serverwindow_$sid').setStyle('height', '64px');");
1405				$objResponse->addScript("if($('sid_$sid'))$('sid_$sid').setStyle('color', '#adadad');");
1406			}
1407		}
1408		if($tplsid != "" && $open != "" && $tplsid==$open)
1409			$objResponse->addScript("InitAccordion('tr.opener', 'div.opener', 'mainwrapper', '".$open."');");
1410		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1411		$objResponse->addScript("$('dialog-placement').setStyle('display', 'none');");
1412	}
1413	elseif($type=="id")
1414	{
1415		if(!empty($info['hostname']))
1416		{
1417			$objResponse->addAssign("$obId", "innerHTML", trunc($info['hostname'], $trunchostname, false));
1418		}else{
1419			$objResponse->addAssign("$obId", "innerHTML", "<b>Error connecting</b> (<i>" . $res[1] . ":" . $res[2]. "</i>)");
1420		}
1421	}
1422	else
1423	{
1424		if(!empty($info['hostname']))
1425		{
1426			$objResponse->addAssign("ban_server_$type", "innerHTML", trunc($info['hostname'], $trunchostname, false));
1427		}else{
1428			$objResponse->addAssign("ban_server_$type", "innerHTML", "<b>Error connecting</b> (<i>" . $res[1] . ":" . $res[2]. "</i>)");
1429		}
1430	}
1431	return $objResponse;
1432}
1433
1434function ServerHostProperty($sid, $obId, $obProp, $trunchostname)
1435{
1436    $objResponse = new xajaxResponse();
1437	global $userbank;
1438	require INCLUDES_PATH.'/CServerInfo.php';
1439
1440	$sid = (int)$sid;
1441    $obId = htmlspecialchars($obId);
1442    $obProp = htmlspecialchars($obProp);
1443    $trunchostname = (int)$trunchostname;
1444
1445	$res = $GLOBALS['db']->GetRow("SELECT ip, port FROM ".DB_PREFIX."_servers WHERE sid = $sid");
1446	if(empty($res[0]) || empty($res[1]))
1447		return $objResponse;
1448	$info = array();
1449	$sinfo = new CServerInfo($res[0],$res[1]);
1450	$info = $sinfo->getInfo();
1451
1452    if(!empty($info['hostname'])) {
1453        $objResponse->addAssign("$obId", "$obProp", addslashes(trunc($info['hostname'], $trunchostname, false)));
1454    } else {
1455        $objResponse->addAssign("$obId", "$obProp", "Error connecting (" . $res[0] . ":" . $res[1]. ")");
1456    }
1457    return $objResponse;
1458}
1459
1460function ServerHostPlayers_list($sid, $type="servers", $obId="")
1461{
1462	$objResponse = new xajaxResponse();
1463	require INCLUDES_PATH.'/CServerInfo.php';
1464
1465	$sids = explode(";", $sid, -1);
1466	if(count($sids) < 1)
1467		return $objResponse;
1468
1469	$ret = "";
1470	for($i=0;$i<count($sids);$i++)
1471	{
1472		$sid = (int)$sids[$i];
1473
1474		$res = $GLOBALS['db']->GetRow("SELECT sid, ip, port FROM ".DB_PREFIX."_servers WHERE sid = $sid");
1475		if(empty($res[1]) || empty($res[2]))
1476			return $objResponse;
1477		$info = array();
1478		$sinfo = new CServerInfo($res[1],$res[2]);
1479		$info = $sinfo->getInfo();
1480
1481		if(!empty($info['hostname']))
1482		{
1483			$ret .= trunc($info['hostname'], 48, false) . "<br />";
1484		}else{
1485			$ret .= "<b>Error connecting</b> (<i>" . $res[1] . ":" . $res[2]. "</i>)<br />";
1486		}
1487	}
1488
1489	if($type=="id")
1490	{
1491		$objResponse->addAssign("$obId", "innerHTML", $ret);
1492	}
1493	else
1494	{
1495		$objResponse->addAssign("ban_server_$type", "innerHTML", $ret);
1496	}
1497
1498	return $objResponse;
1499}
1500
1501
1502function ServerPlayers($sid)
1503{
1504	$objResponse = new xajaxResponse();
1505	require INCLUDES_PATH.'/CServerInfo.php';
1506
1507
1508	$sid = (int)$sid;
1509
1510	$res = $GLOBALS['db']->GetRow("SELECT sid, ip, port FROM ".DB_PREFIX."_servers WHERE sid = $sid");
1511	if(empty($res[1]) || empty($res[2]))
1512	{
1513		$objResponse->addAlert('IP or Port not set :o');
1514		return $objResponse;
1515	}
1516	$info = array();
1517	$sinfo = new CServerInfo($res[1],$res[2]);
1518	$info = $sinfo->getPlayers();
1519
1520	$html = "";
1521	if(empty($info))
1522		return $objResponse;
1523	foreach($info AS $player)
1524	{
1525		$html .= '<tr> <td class="listtable_1">'.htmlentities($player['name']).'</td>
1526						<td class="listtable_1">'.(int)$player['kills'].'</td>
1527						<td class="listtable_1">'.$player['time'].'</td>
1528				  </tr>';
1529	}
1530	$objResponse->addAssign("player_detail_$sid", "innerHTML", $html);
1531	//$objResponse->addScript("document.getElementById('player_detail_$sid').innerHTML = 'hi';");
1532	$objResponse->addScript("setTimeout('xajax_ServerPlayers($sid)', 5000);");
1533	$objResponse->addScript("$('opener_$sid').setProperty('onclick', '');");
1534	return $objResponse;
1535}
1536
1537function KickPlayer($sid, $name)
1538{
1539	$objResponse = new xajaxResponse();
1540	global $userbank, $username;
1541	$sid = (int)$sid;
1542
1543	$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1544
1545	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
1546	{
1547		$objResponse->redirect("index.php?p=login&m=no_access", 0);
1548		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to kick ".htmlspecialchars($name).", but doesn't have access.");
1549		return $objResponse;
1550	}
1551
1552	require INCLUDES_PATH.'/CServerRcon.php';
1553	//get the server data
1554	$data = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = '".$sid."';");
1555	if(empty($data['rcon'])) {
1556		$objResponse->addScript("ShowBox('Error', 'Can\'t kick ".addslashes(htmlspecialchars($name)).". No RCON password!', 'red', '', true);");
1557		return $objResponse;
1558	}
1559	$r = new CServerRcon($data['ip'], $data['port'], $data['rcon']);
1560
1561	if(!$r->Auth())
1562	{
1563		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = '".$sid."';");
1564		$objResponse->addScript("ShowBox('Error', 'Can\'t kick ".addslashes(htmlspecialchars($name)).". Wrong RCON password!', 'red', '', true);");
1565		return $objResponse;
1566	}
1567	// search for the playername
1568	$ret = $r->rconCommand("status");
1569	$search = preg_match_all(STATUS_PARSE,$ret,$matches,PREG_PATTERN_ORDER);
1570	$i = 0;
1571	$found = false;
1572	$index = -1;
1573	foreach($matches[2] AS $match) {
1574		if($match == $name) {
1575			$found = true;
1576			$index = $i;
1577			break;
1578		}
1579		$i++;
1580	}
1581	if($found) {
1582		$steam = $matches[3][$index];
1583		$steam2 = $steam;
1584		// Hack to support steam3 [U:1:X] representation.
1585		if(strpos($steam, "[U:") === 0) {
1586			$steam2 = renderSteam2(getAccountId($steam), 0);
1587		}
1588		// check for immunity
1589		$admin = $GLOBALS['db']->GetRow("SELECT a.immunity AS pimmune, g.immunity AS gimmune FROM `".DB_PREFIX."_admins` AS a LEFT JOIN `".DB_PREFIX."_srvgroups` AS g ON g.name = a.srv_group WHERE authid = '".$steam2."' LIMIT 1;");
1590		if($admin && $admin['gimmune']>$admin['pimmune'])
1591			$immune = $admin['gimmune'];
1592		elseif($admin)
1593			$immune = $admin['pimmune'];
1594		else
1595			$immune = 0;
1596
1597		if($immune <= $userbank->GetProperty('srv_immunity')) {
1598			$requri = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], ".php")+4);
1599
1600			if(strpos($steam, "[U:") === 0) {
1601				$kick = $r->sendCommand("kickid \"".$steam."\" \"You have been banned by this server, check http://" . $_SERVER['HTTP_HOST'].$requri." for more info.\"");
1602			} else {
1603				$kick = $r->sendCommand("kickid ".$steam." \"You have been banned by this server, check http://" . $_SERVER['HTTP_HOST'].$requri." for more info.\"");
1604			}
1605
1606			$log = new CSystemLog("m", "Player kicked", $username . " kicked player '".htmlspecialchars($name)."' (".$steam.") from ".$data['ip'].":".$data['port'].".", true, true);
1607			$objResponse->addScript("ShowBox('Player kicked', 'Player \'".addslashes(htmlspecialchars($name))."\' has been kicked from the server.', 'green', 'index.php?p=servers');");
1608		} else {
1609			$objResponse->addScript("ShowBox('Error', 'Can\'t kick ".addslashes(htmlspecialchars($name)).". Player is immune!', 'red', '', true);");
1610		}
1611	} else {
1612		$objResponse->addScript("ShowBox('Error', 'Can\'t kick ".addslashes(htmlspecialchars($name)).". Player not on the server anymore!', 'red', '', true);");
1613	}
1614	return $objResponse;
1615}
1616
1617function PasteBan($sid, $name, $type=0)
1618{
1619	$objResponse = new xajaxResponse();
1620	global $userbank, $username;
1621
1622	$sid = (int)$sid;
1623	$type = (int)$type;
1624	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
1625	{
1626		$objResponse->redirect("index.php?p=login&m=no_access", 0);
1627		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried paste a ban, but doesn't have access.");
1628		return $objResponse;
1629	}
1630	require INCLUDES_PATH.'/CServerRcon.php';
1631	//get the server data
1632	$data = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = ?;", array($sid));
1633	if(empty($data['rcon'])) {
1634		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1635		$objResponse->addScript("ShowBox('Error', 'No RCON password for server ".$data['ip'].":".$data['port']."!', 'red', '', true);");
1636		return $objResponse;
1637	}
1638
1639	$r = new CServerRcon($data['ip'], $data['port'], $data['rcon']);
1640	if(!$r->Auth())
1641	{
1642		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = ?;", array($sid));
1643		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1644		$objResponse->addScript("ShowBox('Error', 'Wrong RCON password for server ".$data['ip'].":".$data['port']."!', 'red', '', true);");
1645		return $objResponse;
1646	}
1647
1648	$ret = $r->rconCommand("status");
1649	$search = preg_match_all(STATUS_PARSE,$ret,$matches,PREG_PATTERN_ORDER);
1650	$i = 0;
1651	$found = false;
1652	$index = -1;
1653	foreach($matches[2] AS $match) {
1654		if($match == $name) {
1655			$found = true;
1656			$index = $i;
1657			break;
1658		}
1659		$i++;
1660	}
1661	if($found) {
1662		$steam = $matches[3][$index];
1663		// Hack to support steam3 [U:1:X] representation.
1664		if(strpos($steam, "[U:") === 0) {
1665			$steam = renderSteam2(getAccountId($steam), 0);
1666		}
1667		$name = $matches[2][$index];
1668		$ip = explode(":", $matches[8][$index]);
1669		$ip = $ip[0];
1670		$objResponse->addScript("$('nickname').value = '" . addslashes($name) . "'");
1671		if($type==1)
1672			$objResponse->addScript("$('type').options[1].selected = true");
1673		$objResponse->addScript("$('steam').value = '" . $steam . "'");
1674		$objResponse->addScript("$('ip').value = '" . $ip . "'");
1675	} else {
1676		$objResponse->addScript("ShowBox('Error', 'Can\'t get player info for ".addslashes(htmlspecialchars($name)).". Player is not on the server (".$data['ip'].":".$data['port'].") anymore!', 'red', '', true);");
1677		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1678		return $objResponse;
1679	}
1680	$objResponse->addScript("SwapPane(0);");
1681	$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
1682	$objResponse->addScript("$('dialog-placement').setStyle('display', 'none');");
1683	return $objResponse;
1684}
1685
1686function AddBan($nickname, $type, $steam, $ip, $length, $dfile, $dname, $reason, $fromsub)
1687{
1688	$objResponse = new xajaxResponse();
1689	global $userbank, $username;
1690	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
1691	{
1692		$objResponse->redirect("index.php?p=login&m=no_access", 0);
1693		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add a ban, but doesnt have access.");
1694		return $objResponse;
1695	}
1696
1697	$steam = trim($steam);
1698
1699	$error = 0;
1700	// If they didnt type a steamid
1701	if(empty($steam) && $type == 0)
1702	{
1703		$error++;
1704		$objResponse->addAssign("steam.msg", "innerHTML", "You must type a Steam ID or Community ID");
1705		$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
1706	}
1707	else if(($type == 0
1708	&& !is_numeric($steam)
1709	&& !validate_steam($steam))
1710	|| (is_numeric($steam)
1711	&& (strlen($steam) < 15
1712	|| !validate_steam($steam = FriendIDToSteamID($steam)))))
1713	{
1714		$error++;
1715		$objResponse->addAssign("steam.msg", "innerHTML", "Please enter a valid Steam ID or Community ID");
1716		$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
1717	}
1718	else if (empty($ip) && $type == 1)
1719	{
1720		$error++;
1721		$objResponse->addAssign("ip.msg", "innerHTML", "You must type an IP");
1722		$objResponse->addScript("$('ip.msg').setStyle('display', 'block');");
1723	}
1724	else if($type == 1 && !validate_ip($ip))
1725	{
1726		$error++;
1727		$objResponse->addAssign("ip.msg", "innerHTML", "You must type a valid IP");
1728		$objResponse->addScript("$('ip.msg').setStyle('display', 'block');");
1729	}
1730	else
1731	{
1732		$objResponse->addAssign("steam.msg", "innerHTML", "");
1733		$objResponse->addScript("$('steam.msg').setStyle('display', 'none');");
1734		$objResponse->addAssign("ip.msg", "innerHTML", "");
1735		$objResponse->addScript("$('ip.msg').setStyle('display', 'none');");
1736	}
1737
1738	if($error > 0)
1739		return $objResponse;
1740
1741	$nickname = RemoveCode($nickname);
1742	$ip = preg_replace('#[^\d\.]#', '', $ip);//strip ip of all but numbers and dots
1743	$dname = RemoveCode($dname);
1744	$reason = RemoveCode($reason);
1745	if(!$length)
1746		$len = 0;
1747	else
1748		$len = $length*60;
1749
1750	// prune any old bans
1751	PruneBans();
1752	if((int)$type==0) {
1753		// Check if the new steamid is already banned
1754		$chk = $GLOBALS['db']->GetRow("SELECT count(bid) AS count FROM ".DB_PREFIX."_bans WHERE authid = ? AND (length = 0 OR ends > UNIX_TIMESTAMP()) AND RemovedBy IS NULL AND type = '0'", array($steam));
1755
1756		if(intval($chk[0]) > 0)
1757		{
1758			$objResponse->addScript("ShowBox('Error', 'SteamID: $steam is already banned.', 'red', '');");
1759			return $objResponse;
1760		}
1761
1762        // Check if player is immune
1763        $admchk = $userbank->GetAllAdmins();
1764        foreach($admchk as $admin)
1765            if($admin['authid'] == $steam && $userbank->GetProperty('srv_immunity') < $admin['srv_immunity'])
1766            {
1767                $objResponse->addScript("ShowBox('Error', 'SteamID: Admin ".$admin['user']." ($steam) is immune.', 'red', '');");
1768                return $objResponse;
1769            }
1770	}
1771	if((int)$type==1) {
1772		$chk = $GLOBALS['db']->GetRow("SELECT count(bid) AS count FROM ".DB_PREFIX."_bans WHERE ip = ? AND (length = 0 OR ends > UNIX_TIMESTAMP()) AND RemovedBy IS NULL AND type = '1'", array($ip));
1773
1774		if(intval($chk[0]) > 0)
1775		{
1776			$objResponse->addScript("ShowBox('Error', 'IP: $ip is already banned.', 'red', '');");
1777			return $objResponse;
1778		}
1779	}
1780
1781	$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_bans(created,type,ip,authid,name,ends,length,reason,aid,adminIp ) VALUES
1782									(UNIX_TIMESTAMP(),?,?,?,?,(UNIX_TIMESTAMP() + ?),?,?,?,?)");
1783	$GLOBALS['db']->Execute($pre,array($type,
1784									   $ip,
1785									   $steam,
1786									   $nickname,
1787									   $length*60,
1788									   $len,
1789									   $reason,
1790									   $userbank->GetAid(),
1791									   $_SERVER['REMOTE_ADDR']));
1792	$subid = $GLOBALS['db']->Insert_ID();
1793
1794	if($dname && $dfile && preg_match('/^[a-z0-9]*$/i', $dfile))
1795	//Thanks jsifuentes: http://jacobsifuentes.com/sourcebans-1-4-lfi-exploit/
1796	//Official Fix: https://code.google.com/p/sourcebans/source/detail?r=165
1797	{
1798		$GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_demos(demid,demtype,filename,origname)
1799						     VALUES(?,'B', ?, ?)", array((int)$subid, $dfile, $dname));
1800	}
1801	if($fromsub) {
1802		$submail = $GLOBALS['db']->Execute("SELECT name, email FROM ".DB_PREFIX."_submissions WHERE subid = '" . (int)$fromsub . "'");
1803		// Send an email when ban is accepted
1804		$requri = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], ".php")+4);
1805		$headers = 'From: submission@' . $_SERVER['HTTP_HOST'] . "\n" .
1806		'X-Mailer: PHP/' . phpversion();
1807
1808		$message = "Hello,\n";
1809		$message .= "Your ban submission was accepted by our admins.\nThank you for your support!\nClick the link below to view the current ban list.\n\nhttp://" . $_SERVER['HTTP_HOST'] . $requri . "?p=banlist";
1810
1811		mail($submail->fields['email'], "[SourceBans] Ban Added", $message, $headers);
1812		$GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_submissions` SET archiv = '2', archivedby = '".$userbank->GetAid()."' WHERE subid = '" . (int)$fromsub . "'");
1813	}
1814
1815	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_submissions` SET archiv = '3', archivedby = '".$userbank->GetAid()."' WHERE SteamId = ?;", array($steam));
1816
1817	$kickit = isset($GLOBALS['config']['config.enablekickit']) && $GLOBALS['config']['config.enablekickit'] == "1";
1818	if ($kickit)
1819		$objResponse->addScript("ShowKickBox('".((int)$type==0?$steam:$ip)."', '".(int)$type."');");
1820	else
1821		$objResponse->addScript("ShowBox('Ban Added', 'The ban has been successfully added', 'green', 'index.php?p=admin&c=bans');");
1822
1823	$objResponse->addScript("TabToReload();");
1824	$log = new CSystemLog("m", "Ban Added", "Ban against (" . ((int)$type==0?$steam:$ip) . ") has been added, reason: $reason, length: $length", true, $kickit);
1825	return $objResponse;
1826}
1827
1828function SetupBan($subid)
1829{
1830	$objResponse = new xajaxResponse();
1831	$subid = (int)$subid;
1832
1833	$ban = $GLOBALS['db']->GetRow("SELECT * FROM ".DB_PREFIX."_submissions WHERE subid = $subid");
1834	$demo = $GLOBALS['db']->GetRow("SELECT * FROM ".DB_PREFIX."_demos WHERE demid = $subid AND demtype = \"S\"");
1835	// clear any old stuff
1836	$objResponse->addScript("$('nickname').value = ''");
1837	$objResponse->addScript("$('fromsub').value = ''");
1838	$objResponse->addScript("$('steam').value = ''");
1839	$objResponse->addScript("$('ip').value = ''");
1840	$objResponse->addScript("$('txtReason').value = ''");
1841	$objResponse->addAssign("demo.msg", "innerHTML",  "");
1842	// add new stuff
1843	$objResponse->addScript("$('nickname').value = '" . $ban['name'] . "'");
1844	$objResponse->addScript("$('steam').value = '" . $ban['SteamId']. "'");
1845	$objResponse->addScript("$('ip').value = '" . $ban['sip'] . "'");
1846	if(trim($ban['SteamId']) == "")
1847		$type = "1";
1848	else
1849		$type = "0";
1850	$objResponse->addScriptCall("selectLengthTypeReason", "0", $type, addslashes($ban['reason']));
1851
1852	$objResponse->addScript("$('fromsub').value = '$subid'");
1853	if($demo)
1854	{
1855		$objResponse->addAssign("demo.msg", "innerHTML",  $demo['origname']);
1856		$objResponse->addScript("demo('" . $demo['filename'] . "', '" . $demo['origname'] . "');");
1857	}
1858	$objResponse->addScript("SwapPane(0);");
1859	return $objResponse;
1860}
1861
1862function PrepareReban($bid)
1863{
1864	$objResponse = new xajaxResponse();
1865	$bid = (int)$bid;
1866
1867	$ban = $GLOBALS['db']->GetRow("SELECT type, ip, authid, name, length, reason FROM ".DB_PREFIX."_bans WHERE bid = '".$bid."';");
1868	$demo = $GLOBALS['db']->GetRow("SELECT * FROM ".DB_PREFIX."_demos WHERE demid = '".$bid."' AND demtype = \"B\";");
1869	// clear any old stuff
1870	$objResponse->addScript("$('nickname').value = ''");
1871	$objResponse->addScript("$('ip').value = ''");
1872	$objResponse->addScript("$('fromsub').value = ''");
1873	$objResponse->addScript("$('steam').value = ''");
1874	$objResponse->addScript("$('txtReason').value = ''");
1875	$objResponse->addAssign("demo.msg", "innerHTML",  "");
1876	$objResponse->addAssign("txtReason", "innerHTML",  "");
1877
1878	// add new stuff
1879	$objResponse->addScript("$('nickname').value = '" . $ban['name'] . "'");
1880	$objResponse->addScript("$('steam').value = '" . $ban['authid']. "'");
1881	$objResponse->addScript("$('ip').value = '" . $ban['ip']. "'");
1882	$objResponse->addScriptCall("selectLengthTypeReason", $ban['length'], $ban['type'], addslashes($ban['reason']));
1883
1884	if($demo)
1885	{
1886		$objResponse->addAssign("demo.msg", "innerHTML",  $demo['origname']);
1887		$objResponse->addScript("demo('" . $demo['filename'] . "', '" . $demo['origname'] . "');");
1888	}
1889	$objResponse->addScript("SwapPane(0);");
1890	return $objResponse;
1891}
1892
1893function SetupEditServer($sid)
1894{
1895	$objResponse = new xajaxResponse();
1896	$sid = (int)$sid;
1897	$server = $GLOBALS['db']->GetRow("SELECT * FROM ".DB_PREFIX."_servers WHERE sid = $sid");
1898
1899	// clear any old stuff
1900	$objResponse->addScript("$('address').value = ''");
1901	$objResponse->addScript("$('port').value = ''");
1902	$objResponse->addScript("$('rcon').value = ''");
1903	$objResponse->addScript("$('rcon2').value = ''");
1904	$objResponse->addScript("$('mod').value = '0'");
1905	$objResponse->addScript("$('serverg').value = '0'");
1906
1907
1908	// add new stuff
1909	$objResponse->addScript("$('address').value = '" . $server['ip']. "'");
1910	$objResponse->addScript("$('port').value =  '" . $server['port']. "'");
1911	$objResponse->addScript("$('rcon').value =  '" . $server['rcon']. "'");
1912	$objResponse->addScript("$('rcon2').value =  '" . $server['rcon']. "'");
1913	$objResponse->addScript("$('mod').value =  " . $server['modid']);
1914	$objResponse->addScript("$('serverg').value =  " . $server['gid']);
1915
1916	$objResponse->addScript("$('insert_type').value =  " . $server['sid']);
1917	$objResponse->addScript("SwapPane(1);");
1918	return $objResponse;
1919}
1920
1921function CheckPassword($aid, $pass)
1922{
1923	$objResponse = new xajaxResponse();
1924	global $userbank;
1925	$aid = (int)$aid;
1926	if(!$userbank->CheckLogin($userbank->encrypt_password($pass), $aid))
1927	{
1928		$objResponse->addScript("$('current.msg').setStyle('display', 'block');");
1929		$objResponse->addScript("$('current.msg').setHTML('Incorrect password.');");
1930		$objResponse->addScript("set_error(1);");
1931
1932	}
1933	else
1934	{
1935		$objResponse->addScript("$('current.msg').setStyle('display', 'none');");
1936		$objResponse->addScript("set_error(0);");
1937	}
1938	return $objResponse;
1939}
1940function ChangePassword($aid, $pass)
1941{
1942	global $userbank;
1943	$objResponse = new xajaxResponse();
1944	$aid = (int)$aid;
1945
1946	if($aid != $userbank->GetAid() && !$userbank->HasAccess(ADMIN_OWNER|ADMIN_EDIT_ADMINS))
1947	{
1948		$objResponse->redirect("index.php?p=login&m=no_access", 0);
1949		$log = new CSystemLog("w", "Hacking Attempt", $_SERVER["REMOTE_ADDR"] . " tried to change a password that doesn't have permissions.");
1950		return $objResponse;
1951	}
1952
1953	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `password` = '" . $userbank->encrypt_password($pass) . "' WHERE `aid` = $aid");
1954	$admname = $GLOBALS['db']->GetRow("SELECT user FROM `".DB_PREFIX."_admins` WHERE aid = ?", array((int)$aid));
1955	$objResponse->addAlert("Password changed successfully");
1956	$objResponse->addRedirect("index.php?p=login", 0);
1957	$log = new CSystemLog("m", "Password Changed", "Password changed for admin (".$admname['user'].")");
1958	return $objResponse;
1959}
1960
1961function AddMod($name, $folder, $icon, $steam_universe, $enabled)
1962{
1963	$objResponse = new xajaxResponse();
1964	global $userbank, $username;
1965	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_MODS))
1966	{
1967		$objResponse->redirect("index.php?p=login&m=no_access", 0);
1968		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add a mod, but doesnt have access.");
1969		return $objResponse;
1970	}
1971	$name = htmlspecialchars(strip_tags($name));//don't want to addslashes because execute will automatically do it
1972	$icon = htmlspecialchars(strip_tags($icon));
1973	$folder = htmlspecialchars(strip_tags($folder));
1974	$steam_universe = (int)$steam_universe;
1975	$enabled = (int)$enabled;
1976
1977	// Already there?
1978	$check = $GLOBALS['db']->GetRow("SELECT * FROM `" . DB_PREFIX . "_mods` WHERE modfolder = ? OR name = ?;", array($folder, $name));
1979	if(!empty($check))
1980	{
1981		$objResponse->addScript("ShowBox('Error adding mod', 'A mod using that folder or name already exists.', 'red');");
1982		return $objResponse;
1983	}
1984
1985	$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_mods(name,icon,modfolder,steam_universe,enabled) VALUES (?,?,?,?,?)");
1986	$GLOBALS['db']->Execute($pre,array($name, $icon, $folder, $steam_universe, $enabled));
1987
1988	$objResponse->addScript("ShowBox('Mod Added', 'The game mod has been successfully added', 'green', 'index.php?p=admin&c=mods');");
1989	$objResponse->addScript("TabToReload();");
1990	$log = new CSystemLog("m", "Mod Added", "Mod ($name) has been added");
1991	return $objResponse;
1992}
1993
1994function EditAdminPerms($aid, $web_flags, $srv_flags)
1995{
1996	if(empty($aid))
1997		return;
1998	$aid = (int)$aid;
1999	$web_flags = (int)$web_flags;
2000
2001	$objResponse = new xajaxResponse();
2002	global $userbank, $username;
2003	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_EDIT_ADMINS))
2004	{
2005		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2006		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to edit admin permissions, but doesnt have access.");
2007		return $objResponse;
2008	}
2009
2010	if(!$userbank->HasAccess(ADMIN_OWNER) && (int)$web_flags & ADMIN_OWNER )
2011	{
2012			$objResponse->redirect("index.php?p=login&m=no_access", 0);
2013			$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to gain OWNER admin permissions, but doesnt have access.");
2014			return $objResponse;
2015	}
2016
2017	// Users require a password and email to have web permissions
2018	$password = $GLOBALS['userbank']->GetProperty('password', $aid);
2019	$email = $GLOBALS['userbank']->GetProperty('email', $aid);
2020	if($web_flags > 0 && (empty($password) || empty($email)))
2021	{
2022		$objResponse->addScript("ShowBox('Error', 'Admins have to have a password and email set in order to get web permissions.<br /><a href=\"index.php?p=admin&c=admins&o=editdetails&id=" . $aid . "\" title=\"Edit Admin Details\">Set the details</a> first and try again.', 'red', '');");
2023		return $objResponse;
2024	}
2025
2026	// Update web stuff
2027	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `extraflags` = $web_flags WHERE `aid` = $aid");
2028
2029
2030	if(strstr($srv_flags, "#"))
2031	{
2032		$immunity = "0";
2033		$immunity = substr($srv_flags, strpos($srv_flags, "#")+1);
2034		$srv_flags = substr($srv_flags, 0, strlen($srv_flags) - strlen($immunity)-1);
2035	}
2036	$immunity = ($immunity>0) ? $immunity : 0;
2037	// Update server stuff
2038	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `srv_flags` = ?, `immunity` = ? WHERE `aid` = $aid", array($srv_flags, $immunity));
2039
2040	if(isset($GLOBALS['config']['config.enableadminrehashing']) && $GLOBALS['config']['config.enableadminrehashing'] == 1)
2041	{
2042		// rehash the admins on the servers
2043		$serveraccessq = $GLOBALS['db']->GetAll("SELECT s.sid FROM `".DB_PREFIX."_servers` s
2044												LEFT JOIN `".DB_PREFIX."_admins_servers_groups` asg ON asg.admin_id = '".(int)$aid."'
2045												LEFT JOIN `".DB_PREFIX."_servers_groups` sg ON sg.group_id = asg.srv_group_id
2046												WHERE ((asg.server_id != '-1' AND asg.srv_group_id = '-1')
2047												OR (asg.srv_group_id != '-1' AND asg.server_id = '-1'))
2048												AND (s.sid IN(asg.server_id) OR s.sid IN(sg.server_id)) AND s.enabled = 1");
2049		$allservers = array();
2050		foreach($serveraccessq as $access) {
2051			if(!in_array($access['sid'], $allservers)) {
2052				$allservers[] = $access['sid'];
2053			}
2054		}
2055		$objResponse->addScript("ShowRehashBox('".implode(",", $allservers)."', 'Permissions updated', 'The user`s permissions have been updated successfully', 'green', 'index.php?p=admin&c=admins');TabToReload();");
2056	} else
2057		$objResponse->addScript("ShowBox('Permissions updated', 'The user`s permissions have been updated successfully', 'green', 'index.php?p=admin&c=admins');TabToReload();");
2058	$admname = $GLOBALS['db']->GetRow("SELECT user FROM `".DB_PREFIX."_admins` WHERE aid = ?", array((int)$aid));
2059    $log = new CSystemLog("m", "Permissions Changed", "Permissions have been changed for (".$admname['user'].")");
2060	return $objResponse;
2061}
2062
2063function EditGroup($gid, $web_flags, $srv_flags, $type, $name, $overrides, $newOverride)
2064{
2065	$objResponse = new xajaxResponse();
2066	global $userbank, $username;
2067	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_EDIT_GROUPS))
2068	{
2069		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2070		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to edit group details, but doesnt have access.");
2071		return $objResponse;
2072	}
2073
2074	if(empty($name))
2075	{
2076		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2077		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to set group's name to nothing. This isn't possible with the normal form.");
2078		return $objResponse;
2079	}
2080
2081	$gid = (int)$gid;
2082	$name = RemoveCode($name);
2083	$web_flags = (int)$web_flags;
2084	if($type == "web" || $type == "server" )
2085	// Update web stuff
2086	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_groups` SET `flags` = ?, `name` = ? WHERE `gid` = $gid", array($web_flags, $name));
2087
2088	if($type == "srv")
2089	{
2090		$gname = $GLOBALS['db']->GetRow("SELECT name FROM ".DB_PREFIX."_srvgroups WHERE id = $gid");
2091
2092		if(strstr($srv_flags, "#"))
2093		{
2094			$immunity = 0;
2095			$immunity = substr($srv_flags, strpos($srv_flags, "#")+1);
2096			$srv_flags = substr($srv_flags, 0, strlen($srv_flags) - strlen($immunity)-1);
2097		}
2098		$immunity = ($immunity>0) ? $immunity : 0;
2099
2100		// Update server stuff
2101		$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_srvgroups` SET `flags` = ?, `name` = ?, `immunity` = ? WHERE `id` = $gid", array($srv_flags, $name, $immunity));
2102
2103		$oldname = $GLOBALS['db']->GetAll("SELECT aid FROM ".DB_PREFIX."_admins WHERE srv_group = ?", array($gname['name']));
2104		foreach($oldname as $o)
2105		{
2106			$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `srv_group` = ? WHERE `aid` = '" . (int)$o['aid'] . "'", array($name));
2107		}
2108
2109		// Update group overrides
2110		if(!empty($overrides))
2111		{
2112			foreach($overrides as $override)
2113			{
2114				// Skip invalid stuff?!
2115				if($override['type'] != "command" && $override['type'] != "group")
2116					continue;
2117
2118				$id = (int)$override['id'];
2119				// Wants to delete this override?
2120				if(empty($override['name']))
2121				{
2122					$GLOBALS['db']->Execute("DELETE FROM `" . DB_PREFIX . "_srvgroups_overrides` WHERE id = ?;", array($id));
2123					continue;
2124				}
2125
2126				// Check for duplicates
2127				$chk = $GLOBALS['db']->GetAll("SELECT * FROM `" . DB_PREFIX . "_srvgroups_overrides` WHERE name = ? AND type = ? AND group_id = ? AND id != ?", array($override['name'], $override['type'], $gid, $id));
2128				if(!empty($chk))
2129				{
2130					$objResponse->addScript("ShowBox('Error', 'There already is an override with name \\\"" . htmlspecialchars(addslashes($override['name'])) . "\\\" from the selected type..', 'red', '', true);");
2131					return $objResponse;
2132				}
2133
2134				// Edit the override
2135				$GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_srvgroups_overrides` SET name = ?, type = ?, access = ? WHERE id = ?;", array($override['name'], $override['type'], $override['access'], $id));
2136			}
2137		}
2138
2139		// Add a new override
2140		if(!empty($newOverride))
2141		{
2142			if(($newOverride['type'] == "command" || $newOverride['type'] == "group") && !empty($newOverride['name']))
2143			{
2144				// Check for duplicates
2145				$chk = $GLOBALS['db']->GetAll("SELECT * FROM `" . DB_PREFIX . "_srvgroups_overrides` WHERE name = ? AND type = ? AND group_id = ?", array($newOverride['name'], $newOverride['type'], $gid));
2146				if(!empty($chk))
2147				{
2148					$objResponse->addScript("ShowBox('Error', 'There already is an override with name \\\"" . htmlspecialchars(addslashes($newOverride['name'])) . "\\\" from the selected type..', 'red', '', true);");
2149					return $objResponse;
2150				}
2151
2152				// Insert the new override
2153				$GLOBALS['db']->Execute("INSERT INTO `" . DB_PREFIX . "_srvgroups_overrides` (group_id, type, name, access) VALUES (?, ?, ?, ?);", array($gid, $newOverride['type'], $newOverride['name'], $newOverride['access']));
2154			}
2155		}
2156
2157		if(isset($GLOBALS['config']['config.enableadminrehashing']) && $GLOBALS['config']['config.enableadminrehashing'] == 1)
2158		{
2159			// rehash the settings out of the database on all servers
2160			$serveraccessq = $GLOBALS['db']->GetAll("SELECT sid FROM ".DB_PREFIX."_servers WHERE enabled = 1;");
2161			$allservers = array();
2162			foreach($serveraccessq as $access) {
2163				if(!in_array($access['sid'], $allservers)) {
2164					$allservers[] = $access['sid'];
2165				}
2166			}
2167			$objResponse->addScript("ShowRehashBox('".implode(",", $allservers)."', 'Group updated', 'The group has been updated successfully', 'green', 'index.php?p=admin&c=groups');TabToReload();");
2168		} else
2169			$objResponse->addScript("ShowBox('Group updated', 'The group has been updated successfully', 'green', 'index.php?p=admin&c=groups');TabToReload();");
2170		$log = new CSystemLog("m", "Group Updated", "Group ($name) has been updated");
2171		return $objResponse;
2172	}
2173
2174	$objResponse->addScript("ShowBox('Group updated', 'The group has been updated successfully', 'green', 'index.php?p=admin&c=groups');TabToReload();");
2175	$log = new CSystemLog("m", "Group Updated", "Group ($name) has been updated");
2176	return $objResponse;
2177}
2178
2179
2180function SendRcon($sid, $command, $output)
2181{
2182	global $userbank, $username;
2183	$objResponse = new xajaxResponse();
2184	if(!$userbank->HasAccess(SM_RCON . SM_ROOT))
2185	{
2186		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2187		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to send an rcon command, but doesnt have access.");
2188		return $objResponse;
2189	}
2190	if(empty($command))
2191	{
2192		$objResponse->addScript("$('cmd').value=''; $('cmd').disabled='';$('rcon_btn').disabled=''");
2193		return $objResponse;
2194	}
2195	if($command == "clr")
2196	{
2197		$objResponse->addAssign("rcon_con", "innerHTML",  "");
2198		$objResponse->addScript("scroll.toBottom(); $('cmd').value=''; $('cmd').disabled='';$('rcon_btn').disabled=''");
2199		return $objResponse;
2200	}
2201
2202    if(stripos($command, "rcon_password") !== false)
2203	{
2204        $objResponse->addAppend("rcon_con", "innerHTML",  "> Error: You have to use this console. Don't try to cheat the rcon password!<br />");
2205		$objResponse->addScript("scroll.toBottom(); $('cmd').value=''; $('cmd').disabled='';$('rcon_btn').disabled=''");
2206		return $objResponse;
2207	}
2208
2209	$sid = (int)$sid;
2210
2211	$rcon = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM `".DB_PREFIX."_servers` WHERE sid = ".$sid." LIMIT 1");
2212	if(empty($rcon['rcon']))
2213	{
2214		$objResponse->addAppend("rcon_con", "innerHTML",  "> Error: No RCON password!<br />You have to add the RCON password for this server in the 'edit server' <br />page to use this console!<br />");
2215		$objResponse->addScript("scroll.toBottom(); $('cmd').value='Add RCON password.'; $('cmd').disabled=true; $('rcon_btn').disabled=true");
2216		return $objResponse;
2217	}
2218    if(!$test = @fsockopen($rcon['ip'], $rcon['port'], $errno, $errstr, 2))
2219    {
2220        @fclose($test);
2221		$objResponse->addAppend("rcon_con", "innerHTML",  "> Error: Can't connect to server!<br />");
2222		$objResponse->addScript("scroll.toBottom(); $('cmd').value=''; $('cmd').disabled='';$('rcon_btn').disabled=''");
2223		return $objResponse;
2224	}
2225    @fclose($test);
2226	include(INCLUDES_PATH . "/CServerRcon.php");
2227	$r = new CServerRcon($rcon['ip'], $rcon['port'], $rcon['rcon']);
2228	if(!$r->Auth())
2229	{
2230		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = '".$sid."';");
2231		$objResponse->addAppend("rcon_con", "innerHTML",  "> Error: Wrong RCON password!<br />You MUST change the RCON password for this server in the 'edit server' <br />page. If you continue to use this console with the wrong password, <br />the server will block the connection!<br />");
2232		$objResponse->addScript("scroll.toBottom(); $('cmd').value='Change RCON password.'; $('cmd').disabled=true; $('rcon_btn').disabled=true");
2233		return $objResponse;
2234	}
2235	$ret = $r->rconCommand($command);
2236
2237
2238	$ret = str_replace("\n", "<br />", $ret);
2239	if(empty($ret))
2240	{
2241		if($output)
2242		{
2243			$objResponse->addAppend("rcon_con", "innerHTML",  "-> $command<br />");
2244			$objResponse->addAppend("rcon_con", "innerHTML",  "Command Executed.<br />");
2245		}
2246	}
2247	else
2248	{
2249		if($output)
2250		{
2251			$objResponse->addAppend("rcon_con", "innerHTML",  "-> $command<br />");
2252			$objResponse->addAppend("rcon_con", "innerHTML",  "$ret<br />");
2253		}
2254	}
2255	$objResponse->addScript("scroll.toBottom(); $('cmd').value=''; $('cmd').disabled=''; $('rcon_btn').disabled=''");
2256	$log = new CSystemLog("m", "RCON Sent", "RCON Command was sent to server (".$rcon['ip'].":".$rcon['port']."): $command", true, true);
2257	return $objResponse;
2258}
2259
2260
2261function SendMail($subject, $message, $type, $id)
2262{
2263	$objResponse = new xajaxResponse();
2264    global $userbank, $username;
2265
2266	$id = (int)$id;
2267
2268    if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_BAN_PROTESTS|ADMIN_BAN_SUBMISSIONS))
2269	{
2270		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2271		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to send an email, but doesnt have access.");
2272		return $objResponse;
2273	}
2274
2275	// Don't mind wrong types
2276	if($type != 's' && $type != 'p')
2277	{
2278		return $objResponse;
2279	}
2280
2281	// Submission
2282	$email = "";
2283	if($type == 's')
2284	{
2285		$email = $GLOBALS['db']->GetOne('SELECT email FROM `'.DB_PREFIX.'_submissions` WHERE subid = ?', array($id));
2286	}
2287	// Protest
2288	else if($type == 'p')
2289	{
2290		$email = $GLOBALS['db']->GetOne('SELECT email FROM `'.DB_PREFIX.'_protests` WHERE pid = ?', array($id));
2291	}
2292
2293	if(empty($email))
2294	{
2295		$objResponse->addScript("ShowBox('Error', 'There is no email to send to supplied.', 'red', 'index.php?p=admin&c=bans');");
2296		return $objResponse;
2297	}
2298
2299	$headers = "From: noreply@" . $_SERVER['HTTP_HOST'] . "\n" . 'X-Mailer: PHP/' . phpversion();
2300	$m = @mail($email, '[SourceBans] ' . $subject, $message, $headers);
2301
2302
2303	if($m)
2304	{
2305		$objResponse->addScript("ShowBox('Email Sent', 'The email has been sent to the user.', 'green', 'index.php?p=admin&c=bans');");
2306		$log = new CSystemLog("m", "Email Sent", $username . " send an email to ".htmlspecialchars($email).".<br />Subject: '[SourceBans] " . htmlspecialchars($subject) . "'<br />Message: '" . nl2br(htmlspecialchars($message)) . "'");
2307	}
2308	else
2309		$objResponse->addScript("ShowBox('Error', 'Failed to send the email to the user.', 'red', '');");
2310
2311	return $objResponse;
2312}
2313
2314function CheckVersion()
2315{
2316	$objResponse = new xajaxResponse();
2317	$relver = @file_get_contents("https://sbpp.sarabveer.me/rel/");
2318
2319	if(defined('SB_GIT'))
2320		$relgit = @file_get_contents("https://sbpp.sarabveer.me/dev/");
2321
2322	if(version_compare($relver, SB_VERSION) > 0)
2323		$versmsg = "<span style='color:#aa0000;'><strong>A new release is available.</strong></span>";
2324	else
2325		$versmsg = "<span style='color:#00aa00;'><strong>You have the latest release.</strong></span>";
2326
2327	$msg = $versmsg;
2328	if(strlen($relver)>8 || $relver=="") {
2329		$relver = "<span style='color:#aa0000;'>Error</span>";
2330		$msg = "<span style='color:#aa0000;'><strong>Error retrieving latest release.</strong></span>";
2331	}
2332	$objResponse->addAssign("relver", "innerHTML",  $relver);
2333
2334	if(defined('SB_GIT'))
2335	{
2336		if(intval($relgit) > GetGITRev())
2337			$svnmsg = "<span style='color:#aa0000;'><strong>A new Dev release is available.</strong></span>";
2338		else
2339			$svnmsg = "<span style='color:#00aa00;'><strong>You have the latest Dev release.</strong></span>";
2340
2341		if(strlen($relgit)>8 || $relgit=="") {
2342			$relgit = "<span style='color:#aa0000;'>Error</span>";
2343			$svnmsg = "<span style='color:#aa0000;'><strong>Error retrieving latest Git Commit.</strong></span>";
2344		}
2345		$msg .= "<br />" . $svnmsg;
2346		$objResponse->addAssign("svnrev", "innerHTML",  $relgit);
2347	}
2348
2349	$objResponse->addAssign("versionmsg", "innerHTML", $msg);
2350	return $objResponse;
2351}
2352
2353function SelTheme($theme)
2354{
2355	$objResponse = new xajaxResponse();
2356    global $userbank, $username;
2357    if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_WEB_SETTINGS))
2358	{
2359		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2360		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to execute SelTheme() function, but doesnt have access.");
2361		return $objResponse;
2362	}
2363
2364	$theme = rawurldecode($theme);
2365	$theme = str_replace(array('../', '..\\', chr(0)), '', $theme);
2366	$theme = basename($theme);
2367
2368	if($theme[0] == '.' || !in_array($theme, scandir(SB_THEMES)) || !is_dir(SB_THEMES . $theme) || !file_exists(SB_THEMES . $theme . "/theme.conf.php"))
2369	{
2370		$objResponse->addAlert('Invalid theme selected.');
2371		return $objResponse;
2372	}
2373
2374	include(SB_THEMES . $theme . "/theme.conf.php");
2375
2376	if(!defined('theme_screenshot'))
2377	{
2378		$objResponse->addAlert('Bad theme selected.');
2379		return $objResponse;
2380	}
2381
2382	$objResponse->addAssign("current-theme-screenshot", "innerHTML", '<img width="250px" height="170px" src="themes/'.$theme.'/'.strip_tags(theme_screenshot).'">');
2383	$objResponse->addAssign("theme.name", "innerHTML",  theme_name);
2384	$objResponse->addAssign("theme.auth", "innerHTML",  theme_author);
2385	$objResponse->addAssign("theme.vers", "innerHTML",  theme_version);
2386	$objResponse->addAssign("theme.link", "innerHTML",  '<a href="'.theme_link.'" target="_new">'.theme_link.'</a>');
2387	$objResponse->addAssign("theme.apply", "innerHTML",  "<input type='button' onclick=\"javascript:xajax_ApplyTheme('" .$theme."')\" name='btnapply' class='btn ok' onmouseover='ButtonOver(\"btnapply\")' onmouseout='ButtonOver(\"btnapply\")' id='btnapply' value='Apply Theme' />");
2388
2389	return $objResponse;
2390}
2391
2392function ApplyTheme($theme)
2393{
2394	$objResponse = new xajaxResponse();
2395    global $userbank, $username;
2396    if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_WEB_SETTINGS))
2397	{
2398		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2399		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to change the theme to ".htmlspecialchars(addslashes($theme)).", but doesnt have access.");
2400		return $objResponse;
2401	}
2402
2403	$theme = rawurldecode($theme);
2404	$theme = str_replace(array('../', '..\\', chr(0)), '', $theme);
2405	$theme = basename($theme);
2406
2407	if($theme[0] == '.' || !in_array($theme, scandir(SB_THEMES)) || !is_dir(SB_THEMES . $theme) || !file_exists(SB_THEMES . $theme . "/theme.conf.php"))
2408	{
2409		$objResponse->addAlert('Invalid theme selected.');
2410		return $objResponse;
2411	}
2412
2413	include(SB_THEMES . $theme . "/theme.conf.php");
2414
2415	if(!defined('theme_screenshot'))
2416	{
2417		$objResponse->addAlert('Bad theme selected.');
2418		return $objResponse;
2419	}
2420
2421	$query = $GLOBALS['db']->Execute("UPDATE `" . DB_PREFIX . "_settings` SET `value` = ? WHERE `setting` = 'config.theme'", array($theme));
2422	$objResponse->addScript('window.location.reload( false );');
2423	return $objResponse;
2424}
2425
2426function AddComment($bid, $ctype, $ctext, $page)
2427{
2428	$objResponse = new xajaxResponse();
2429	global $userbank, $username;
2430	if(!$userbank->is_admin())
2431	{
2432		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2433		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add a comment, but doesnt have access.");
2434		return $objResponse;
2435	}
2436
2437	$bid = (int)$bid;
2438	$page = (int)$page;
2439
2440	$pagelink = "";
2441	if($page != -1)
2442		$pagelink = "&page=".$page;
2443
2444	if($ctype=="B")
2445		$redir = "?p=banlist".$pagelink;
2446	elseif($ctype=="C")
2447		$redir = "?p=commslist".$pagelink;
2448	elseif($ctype=="S")
2449		$redir = "?p=admin&c=bans#^2";
2450	elseif($ctype=="P")
2451		$redir = "?p=admin&c=bans#^1";
2452	else
2453	{
2454		$objResponse->addScript("ShowBox('Error', 'Bad comment type.', 'red');");
2455		return $objResponse;
2456	}
2457
2458	$ctext = trim($ctext);
2459
2460	$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_comments(bid,type,aid,commenttxt,added) VALUES (?,?,?,?,UNIX_TIMESTAMP())");
2461	$GLOBALS['db']->Execute($pre,array($bid,
2462									   $ctype,
2463									   $userbank->GetAid(),
2464									   $ctext));
2465
2466	$objResponse->addScript("ShowBox('Comment Added', 'The comment has been successfully published', 'green', 'index.php$redir');");
2467	$objResponse->addScript("TabToReload();");
2468	$log = new CSystemLog("m", "Comment Added", $username." added a comment for ban #".$bid);
2469	return $objResponse;
2470}
2471
2472function EditComment($cid, $ctype, $ctext, $page)
2473{
2474	$objResponse = new xajaxResponse();
2475	global $userbank, $username;
2476	if(!$userbank->is_admin())
2477	{
2478		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2479		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to edit a comment, but doesnt have access.");
2480		return $objResponse;
2481	}
2482
2483	$cid = (int)$cid;
2484	$page = (int)$page;
2485
2486	$pagelink = "";
2487	if($page != -1)
2488		$pagelink = "&page=".$page;
2489
2490	if($ctype=="B")
2491		$redir = "?p=banlist".$pagelink;
2492	elseif($ctype=="C")
2493		$redir = "?p=commslist".$pagelink;
2494	elseif($ctype=="S")
2495		$redir = "?p=admin&c=bans#^2";
2496	elseif($ctype=="P")
2497		$redir = "?p=admin&c=bans#^1";
2498	else
2499	{
2500		$objResponse->addScript("ShowBox('Error', 'Bad comment type.', 'red');");
2501		return $objResponse;
2502	}
2503
2504	$ctext = trim($ctext);
2505
2506	$pre = $GLOBALS['db']->Prepare("UPDATE ".DB_PREFIX."_comments SET `commenttxt` = ?, `editaid` = ?, `edittime`= UNIX_TIMESTAMP() WHERE cid = ?");
2507	$GLOBALS['db']->Execute($pre,array($ctext,
2508									   $userbank->GetAid(),
2509									   $cid));
2510
2511	$objResponse->addScript("ShowBox('Comment Edited', 'The comment #".$cid." has been successfully edited', 'green', 'index.php$redir');");
2512	$objResponse->addScript("TabToReload();");
2513	$log = new CSystemLog("m", "Comment Edited", $username." edited comment #".$cid);
2514	return $objResponse;
2515}
2516
2517function RemoveComment($cid, $ctype, $page)
2518{
2519	$objResponse = new xajaxResponse();
2520	global $userbank, $username;
2521	if (!$userbank->HasAccess(ADMIN_OWNER))
2522	{
2523		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2524		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to remove a comment, but doesnt have access.");
2525		return $objResponse;
2526	}
2527
2528	$cid = (int)$cid;
2529	$page = (int)$page;
2530
2531	$pagelink = "";
2532	if($page != -1)
2533		$pagelink = "&page=".$page;
2534
2535	$res = $GLOBALS['db']->Execute("DELETE FROM `".DB_PREFIX."_comments` WHERE `cid` = ?",
2536								array( $cid ));
2537	if($ctype=="B")
2538		$redir = "?p=banlist".$pagelink;
2539	elseif($ctype=="C")
2540		$redir = "?p=commslist".$pagelink;
2541	else
2542		$redir = "?p=admin&c=bans";
2543	if($res)
2544	{
2545		$objResponse->addScript("ShowBox('Comment Deleted', 'The selected comment has been deleted from the database', 'green', 'index.php$redir', true);");
2546		$log = new CSystemLog("m", "Comment Deleted", $username." deleted comment #".$cid);
2547	}
2548	else
2549		$objResponse->addScript("ShowBox('Error', 'There was a problem deleting the comment from the database. Check the logs for more info', 'red', 'index.php$redir', true);");
2550	return $objResponse;
2551}
2552
2553function ClearCache()
2554{
2555	$objResponse = new xajaxResponse();
2556	global $userbank, $username;
2557	if (!$userbank->HasAccess(ADMIN_OWNER|ADMIN_WEB_SETTINGS))
2558	{
2559		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2560		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to clear the cache, but doesnt have access.");
2561		return $objResponse;
2562	}
2563
2564	$cachedir = dir(SB_THEMES_COMPILE);
2565	while (($entry = $cachedir->read()) !== false) {
2566		if (is_file($cachedir->path.$entry)) {
2567			unlink($cachedir->path.$entry);
2568		}
2569	}
2570	$cachedir->close();
2571
2572	$objResponse->addScript("$('clearcache.msg').innerHTML = '<font color=\"green\" size=\"1\">Cache cleared.</font>';");
2573
2574	return $objResponse;
2575}
2576
2577function RefreshServer($sid)
2578{
2579	$objResponse = new xajaxResponse();
2580	$sid = (int)$sid;
2581	session_start();
2582	$data = $GLOBALS['db']->GetRow("SELECT ip, port FROM `".DB_PREFIX."_servers` WHERE sid = ?;", array($sid));
2583	if (isset($_SESSION['getInfo.' . $data['ip'] . '.' . $data['port']]) && is_array($_SESSION['getInfo.' . $data['ip'] . '.' . $data['port']]))
2584		unset($_SESSION['getInfo.' . $data['ip'] . '.' . $data['port']]);
2585	$objResponse->addScript("xajax_ServerHostPlayers('".$sid."');");
2586	return $objResponse;
2587}
2588
2589function RehashAdmins($server, $do=0)
2590{
2591	$objResponse = new xajaxResponse();
2592    global $userbank, $username;
2593	$do = (int)$do;
2594	if (!$userbank->HasAccess(ADMIN_OWNER|ADMIN_EDIT_ADMINS|ADMIN_EDIT_GROUPS|ADMIN_ADD_ADMINS))
2595	{
2596		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2597		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to rehash admins, but doesnt have access.");
2598		return $objResponse;
2599	}
2600	$servers = explode(",",$server);
2601	if(sizeof($servers)>0) {
2602		if(sizeof($servers)-1 > $do)
2603			$objResponse->addScriptCall("xajax_RehashAdmins", $server, $do+1);
2604
2605		$serv = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = '".(int)$servers[$do]."';");
2606		if(empty($serv['rcon'])) {
2607			$objResponse->addAppend("rehashDiv", "innerHTML", "".$serv['ip'].":".$serv['port']." (".($do+1)."/".sizeof($servers).") <font color='red'>failed: No rcon password set</font>.<br />");
2608			if($do >= sizeof($servers)-1) {
2609				$objResponse->addAppend("rehashDiv", "innerHTML", "<b>Done</b>");
2610				$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2611			}
2612			return $objResponse;
2613		}
2614
2615		$test = @fsockopen($serv['ip'], $serv['port'], $errno, $errstr, 2);
2616		if(!$test) {
2617			$objResponse->addAppend("rehashDiv", "innerHTML", "".$serv['ip'].":".$serv['port']." (".($do+1)."/".sizeof($servers).") <font color='red'>failed: Can't connect</font>.<br />");
2618			if($do >= sizeof($servers)-1) {
2619				$objResponse->addAppend("rehashDiv", "innerHTML", "<b>Done</b>");
2620				$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2621			}
2622			return $objResponse;
2623		}
2624
2625		require INCLUDES_PATH.'/CServerRcon.php';
2626		$r = new CServerRcon($serv['ip'], $serv['port'], $serv['rcon']);
2627		if(!$r->Auth())
2628		{
2629			$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = '".$serv['sid']."';");
2630			$objResponse->addAppend("rehashDiv", "innerHTML", "".$serv['ip'].":".$serv['port']." (".($do+1)."/".sizeof($servers).") <font color='red'>failed: Wrong rcon password</font>.<br />");
2631			if($do >= sizeof($servers)-1) {
2632				$objResponse->addAppend("rehashDiv", "innerHTML", "<b>Done</b>");
2633				$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2634			}
2635			return $objResponse;
2636		}
2637		$ret = $r->rconCommand("sm_rehash");
2638
2639		$objResponse->addAppend("rehashDiv", "innerHTML", "".$serv['ip'].":".$serv['port']." (".($do+1)."/".sizeof($servers).") <font color='green'>successful</font>.<br />");
2640		if($do >= sizeof($servers)-1) {
2641			$objResponse->addAppend("rehashDiv", "innerHTML", "<b>Done</b>");
2642			$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2643		}
2644	} else {
2645		$objResponse->addAppend("rehashDiv", "innerHTML", "No servers to check.");
2646		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2647	}
2648	return $objResponse;
2649}
2650
2651function GroupBan($groupuri, $isgrpurl="no", $queue="no", $reason="", $last="")
2652{
2653	$objResponse = new xajaxResponse();
2654	if($GLOBALS['config']['config.enablegroupbanning']==0)
2655		return $objResponse;
2656    global $userbank, $username;
2657    if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
2658	{
2659		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2660		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to initiate a groupban '".htmlspecialchars(addslashes(trim($groupuri)))."', but doesnt have access.");
2661		return $objResponse;
2662	}
2663	if($isgrpurl=="yes")
2664		$grpname = $groupuri;
2665	else {
2666		$url = parse_url($groupuri, PHP_URL_PATH);
2667		$url = explode("/", $url);
2668		$grpname = $url[2];
2669	}
2670	if(empty($grpname)) {
2671		$objResponse->addAssign("groupurl.msg", "innerHTML", "Error parsing the group url.");
2672		$objResponse->addScript("$('groupurl.msg').setStyle('display', 'block');");
2673		return $objResponse;
2674	}
2675	else {
2676		$objResponse->addScript("$('groupurl.msg').setStyle('display', 'none');");
2677	}
2678
2679	if($queue=="yes")
2680		$objResponse->addScript("ShowBox('Please Wait...', 'Banning all members of the selected groups... <br>Please Wait...<br>Notice: This can last 15mins or longer, depending on the amount of members of the groups!', 'info', '', true);");
2681	else
2682		$objResponse->addScript("ShowBox('Please Wait...', 'Banning all members of ".$grpname."...<br>Please Wait...<br>Notice: This can last 15mins or longer, depending on the amount of members of the group!', 'info', '', true);");
2683	$objResponse->addScript("$('dialog-control').setStyle('display', 'none');");
2684	$objResponse->addScriptCall("xajax_BanMemberOfGroup", $grpname, $queue, htmlspecialchars(addslashes($reason)), $last);
2685	return $objResponse;
2686
2687}
2688
2689function BanMemberOfGroup($grpurl, $queue, $reason, $last)
2690{
2691	set_time_limit(0);
2692	$objResponse = new xajaxResponse();
2693	if($GLOBALS['config']['config.enablegroupbanning']==0)
2694		return $objResponse;
2695	global $userbank, $username;
2696	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
2697	{
2698		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2699		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to ban group '".$grpurl."', but doesnt have access.");
2700		return $objResponse;
2701	}
2702	$bans = $GLOBALS['db']->GetAll("SELECT CAST(MID(authid, 9, 1) AS UNSIGNED) + CAST('76561197960265728' AS UNSIGNED) + CAST(MID(authid, 11, 10) * 2 AS UNSIGNED) AS community_id FROM ".DB_PREFIX."_bans WHERE RemoveType IS NULL;");
2703	foreach($bans as $ban) {
2704		$already[] = $ban["community_id"];
2705	}
2706	$doc = new DOMDocument();
2707	// This could be changed to use the memberlistxml
2708	// https://partner.steamgames.com/documentation/community_data
2709	// http://steamcommunity.com/groups/<GroupName>/memberslistxml/?xml=1
2710	// but we'd need to open every single profile of every member to get the name..
2711	$raw = file_get_contents("http://steamcommunity.com/groups/".$grpurl."/members"); // get the members page
2712	@$doc->loadHTML($raw); // load it into a handy object so we can maintain it
2713	// the memberlist is paginated, so we need to check the number of pages
2714	$pagetag = $doc->getElementsByTagName('div');
2715	foreach($pagetag as $pageclass) {
2716		if($pageclass->getAttribute('class') == "pageLinks") { //search for the pageLinks div
2717			$pageclasselmt = $pageclass;
2718			break;
2719		}
2720	}
2721	$pagelinks = $pageclasselmt->getElementsByTagName('a'); // get all page links
2722	$pagenumbers = array();
2723	$pagenumbers[] = 1; // add at least one page for the loop. if the group doesn't have 50 members -> no paginating
2724	foreach($pagelinks as $pagelink) {
2725		$pagenumber = str_replace("?p=", "", $pagelink->childNodes->item(0)->nodeValue); // remove the get variable stuff so we only have the pagenumber
2726		if(strpos($pagenumber, ">") === false) // don't want the "next" button ;)
2727			$pagenumbers[] = $pagenumber;
2728	}
2729	$members = array();
2730	$total = 0;
2731	$bannedbefore = 0;
2732	$error = 0;
2733	for($i=1;$i<=max($pagenumbers);$i++) { // loop through all the pages
2734		if($i!=1) { // if we are on page 1 we don't need to reget the content as we did above already.
2735			$raw = file_get_contents("http://steamcommunity.com/groups/".$grpurl."/members?p=".$i); // open the memberpage
2736			@$doc->loadHTML($raw);
2737		}
2738		$tags = $doc->getElementsByTagName('a');
2739		foreach ($tags as $tag) {
2740			// search for the member profile links
2741			if((strstr($tag->getAttribute('href'), "http://steamcommunity.com/id/") || strstr($tag->getAttribute('href'), "http://steamcommunity.com/profiles/")) && $tag->hasChildNodes() && $tag->childNodes->length == 1 && $tag->childNodes->item(0)->nodeValue != "") {
2742				$total++;
2743				$url = parse_url($tag->getAttribute('href'), PHP_URL_PATH);
2744				$url = explode("/", $url);
2745				if(in_array($url[2], $already)) {
2746					$bannedbefore++;
2747					continue;
2748				}
2749				if(strstr($tag->getAttribute('href'), "http://steamcommunity.com/id/")) {
2750					// we don't have the friendid as this player is using a custom id :S need to get the friendid
2751					if($tfriend = GetFriendIDFromCommunityID($url[2])) {
2752						if(in_array($tfriend, $already)) {
2753							$bannedbefore++;
2754							continue;
2755						}
2756						$cust = $url[2];
2757						$steamid = FriendIDToSteamID($tfriend);
2758						$urltag = $tfriend;
2759					} else {
2760						$error++;
2761						continue;
2762					}
2763				} else {
2764					// just a normal friendid profile =)
2765					$cust = NULL;
2766					$steamid = FriendIDToSteamID($url[2]);
2767					$urltag = $url[2];
2768				}
2769				$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_bans(created,type,ip,authid,name,ends,length,reason,aid,adminIp ) VALUES
2770									(UNIX_TIMESTAMP(),?,?,?,?,UNIX_TIMESTAMP(),?,?,?,?)");
2771				$GLOBALS['db']->Execute($pre,array(0,
2772												   "",
2773												   $steamid,
2774												   utf8_decode($tag->childNodes->item(0)->nodeValue),
2775												   0,
2776												   "Steam Community Group Ban (".$grpurl.") ".$reason,
2777												   $userbank->GetAid(),
2778												   $_SERVER['REMOTE_ADDR']));
2779			}
2780		}
2781	}
2782	if($queue=="yes") {
2783		$objResponse->addAppend("steamGroupStatus", "innerHTML", "<p>Banned ".($total-$bannedbefore-$error)."/".$total." players of group '".$grpurl."'. | ".$bannedbefore." were banned already. | ".$error." failed.</p>");
2784		if($grpurl==$last) {
2785			$objResponse->addScript("ShowBox('Groups banned successfully', 'The selected Groups were banned successfully. For detailed info check below.', 'green', '', true);");
2786			$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2787		}
2788	} else {
2789		$objResponse->addScript("ShowBox('Group banned successfully', 'Banned ".($total-$bannedbefore-$error)."/".$total." players of group \'".$grpurl."\'.<br>".$bannedbefore." were banned already.<br>".$error." failed.', 'green', '', true);");
2790		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2791	}
2792	$log = new CSystemLog("m", "Group Banned", "Banned ".($total-$bannedbefore-$error)."/".$total." players of group \'".$grpurl."\'.<br>".$bannedbefore." were banned already.<br>".$error." failed.");
2793	return $objResponse;
2794}
2795
2796function GetGroups($friendid)
2797{
2798	set_time_limit(0);
2799	$objResponse = new xajaxResponse();
2800	if($GLOBALS['config']['config.enablegroupbanning']==0 || !is_numeric($friendid))
2801		return $objResponse;
2802	global $userbank, $username;
2803	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
2804	{
2805		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2806		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to list groups of '".$friendid."', but doesnt have access.");
2807		return $objResponse;
2808	}
2809	// check if we're getting redirected, if so there is $result["Location"] (the player uses custom id)  else just use the friendid. !We can't get the xml with the friendid url if the player has a custom one!
2810	$result = get_headers("http://steamcommunity.com/profiles/".$friendid."/", 1);
2811	$raw = file_get_contents((!empty($result["Location"])?$result["Location"]:"http://steamcommunity.com/profiles/".$friendid."/")."?xml=1");
2812	preg_match("/<privacyState>([^\]]*)<\/privacyState>/", $raw, $status);
2813	if(($status && $status[1] != "public") || strstr($raw, "<groups>")) {
2814		$raw = str_replace("&", "", $raw);
2815		$raw = strip_31_ascii($raw);
2816		$raw = utf8_encode($raw);
2817		$xml = simplexml_load_string($raw); // parse xml
2818		$result = $xml->xpath('/profile/groups/group'); // go to the group nodes
2819		$i = 0;
2820		while(list( , $node) = each($result)) {
2821			// Steam only provides the details of the first 3 groups of a players profile. We need to fetch the individual groups seperately to get the correct information.
2822			if(empty($node->groupName)) {
2823				$memberlistxml = file_get_contents("http://steamcommunity.com/gid/".$node->groupID64."/memberslistxml/?xml=1");
2824				$memberlistxml = str_replace("&", "", $memberlistxml);
2825				$memberlistxml = strip_31_ascii($memberlistxml);
2826				$memberlistxml = utf8_encode($memberlistxml);
2827				$groupxml = simplexml_load_string($memberlistxml); // parse xml
2828				$node = $groupxml->xpath('/memberList/groupDetails');
2829				$node = $node[0];
2830			}
2831
2832			// Checkbox & Groupname table cols
2833			$objResponse->addScript('var e = document.getElementById("steamGroupsTable");
2834													var tr = e.insertRow("-1");
2835														var td = tr.insertCell("-1");
2836															td.className = "listtable_1";
2837															td.style.padding = "0px";
2838															td.style.width = "3px";
2839																var input = document.createElement("input");
2840																input.setAttribute("type","checkbox");
2841																input.setAttribute("id","chkb_'.$i.'");
2842																input.setAttribute("value","'.$node->groupURL.'");
2843															td.appendChild(input);
2844														var td = tr.insertCell("-1");
2845															td.className = "listtable_1";
2846															var a = document.createElement("a");
2847																a.href = "http://steamcommunity.com/groups/'.$node->groupURL.'";
2848																a.setAttribute("target","_blank");
2849																	var txt = document.createTextNode("'.utf8_decode($node->groupName).'");
2850																a.appendChild(txt);
2851															td.appendChild(a);
2852																var txt = document.createTextNode(" (");
2853															td.appendChild(txt);
2854																var span = document.createElement("span");
2855																span.setAttribute("id","membcnt_'.$i.'");
2856																span.setAttribute("value","'.$node->memberCount.'");
2857																	var txt3 = document.createTextNode("'.$node->memberCount.'");
2858																span.appendChild(txt3);
2859															td.appendChild(span);
2860																var txt2 = document.createTextNode(" Members)");
2861															td.appendChild(txt2);
2862														');
2863			$i++;
2864		}
2865	} else {
2866		$objResponse->addScript("ShowBox('Error', 'There was an error retrieving the group data. <br>Maybe the player isn\'t member of any group or his profile is private?<br><a href=\"http://steamcommunity.com/profiles/".$friendid."/\" title=\"Community profile\" target=\"_blank\">Community profile</a>', 'red', 'index.php?p=banlist', true);");
2867		$objResponse->addScript("$('steamGroupsText').innerHTML = '<i>No groups...</i>';");
2868		return $objResponse;
2869	}
2870	$objResponse->addScript("$('steamGroupsText').setStyle('display', 'none');");
2871	$objResponse->addScript("$('steamGroups').setStyle('display', 'block');");
2872	return $objResponse;
2873}
2874
2875function BanFriends($friendid, $name)
2876{
2877	set_time_limit(0);
2878	$objResponse = new xajaxResponse();
2879	if($GLOBALS['config']['config.enablefriendsbanning']==0 || !is_numeric($friendid))
2880		return $objResponse;
2881	global $userbank, $username;
2882	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
2883	{
2884		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2885		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to ban friends of '".RemoveCode($friendid)."', but doesnt have access.");
2886		return $objResponse;
2887	}
2888	$bans = $GLOBALS['db']->GetAll("SELECT CAST(MID(authid, 9, 1) AS UNSIGNED) + CAST('76561197960265728' AS UNSIGNED) + CAST(MID(authid, 11, 10) * 2 AS UNSIGNED) AS community_id FROM ".DB_PREFIX."_bans WHERE RemoveType IS NULL;");
2889	foreach($bans as $ban) {
2890		$already[] = $ban["community_id"];
2891	}
2892	$doc = new DOMDocument();
2893	$result = get_headers("http://steamcommunity.com/profiles/".$friendid."/", 1);
2894	$raw = file_get_contents(($result["Location"]!=""?$result["Location"]:"http://steamcommunity.com/profiles/".$friendid."/")."friends"); // get the friends page
2895	@$doc->loadHTML($raw);
2896	$divs = $doc->getElementsByTagName('div');
2897	foreach($divs as $div) {
2898		if($div->getAttribute('id') == "memberList") {
2899			$memberdiv = $div;
2900			break;
2901		}
2902	}
2903
2904	$total = 0;
2905	$bannedbefore = 0;
2906	$error = 0;
2907	$links = $memberdiv->getElementsByTagName('a');
2908	foreach ($links as $link) {
2909		if(strstr($link->getAttribute('href'), "http://steamcommunity.com/id/") || strstr($link->getAttribute('href'), "http://steamcommunity.com/profiles/"))
2910		{
2911			$total++;
2912			$url = parse_url($link->getAttribute('href'), PHP_URL_PATH);
2913			$url = explode("/", $url);
2914			if(in_array($url[2], $already)) {
2915				$bannedbefore++;
2916				continue;
2917			}
2918			if(strstr($link->getAttribute('href'), "http://steamcommunity.com/id/")) {
2919				// we don't have the friendid as this player is using a custom id :S need to get the friendid
2920				if($tfriend = GetFriendIDFromCommunityID($url[2])) {
2921					if(in_array($tfriend, $already)) {
2922						$bannedbefore++;
2923						continue;
2924					}
2925					$cust = $url[2];
2926					$steamid = FriendIDToSteamID($tfriend);
2927					$urltag = $tfriend;
2928				} else {
2929					$error++;
2930					continue;
2931				}
2932			} else {
2933				// just a normal friendid profile =)
2934				$cust = NULL;
2935				$steamid = FriendIDToSteamID($url[2]);
2936				$urltag = $url[2];
2937			}
2938
2939			// get the name
2940			$friendName = $link->parentNode->childNodes->item(5)->childNodes->item(0)->nodeValue;
2941			$friendName = str_replace("&#13;", "", $friendName);
2942			$friendName = trim($friendName);
2943
2944			$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_bans(created,type,ip,authid,name,ends,length,reason,aid,adminIp ) VALUES
2945									(UNIX_TIMESTAMP(),?,?,?,?,UNIX_TIMESTAMP(),?,?,?,?)");
2946			$GLOBALS['db']->Execute($pre,array(0,
2947											   "",
2948											   $steamid,
2949											   utf8_decode($friendName),
2950											   0,
2951											   "Steam Community Friend Ban (".htmlspecialchars($name).")",
2952											   $userbank->GetAid(),
2953											   $_SERVER['REMOTE_ADDR']));
2954		}
2955	}
2956	if($total==0) {
2957		$objResponse->addScript("ShowBox('Error retrieving friends', 'There was an error retrieving the friend list. Check if the profile isn\'t private or if he hasn\'t got any friends!', 'red', 'index.php?p=banlist', true);");
2958		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2959		return $objResponse;
2960	}
2961	$objResponse->addScript("ShowBox('Friends banned successfully', 'Banned ".($total-$bannedbefore-$error)."/".$total." friends of \'".htmlspecialchars($name)."\'.<br>".$bannedbefore." were banned already.<br>".$error." failed.', 'green', 'index.php?p=banlist', true);");
2962	$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
2963	$log = new CSystemLog("m", "Friends Banned", "Banned ".($total-$bannedbefore-$error)."/".$total." friends of \'".htmlspecialchars($name)."\'.<br>".$bannedbefore." were banned already.<br>".$error." failed.");
2964	return $objResponse;
2965}
2966
2967function ViewCommunityProfile($sid, $name)
2968{
2969	$objResponse = new xajaxResponse();
2970    global $userbank, $username;
2971	if(!$userbank->is_admin())
2972	{
2973		$objResponse->redirect("index.php?p=login&m=no_access", 0);
2974		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to view profile of '".htmlspecialchars($name)."', but doesnt have access.");
2975		return $objResponse;
2976	}
2977	$sid = (int)$sid;
2978
2979	require INCLUDES_PATH.'/CServerRcon.php';
2980	//get the server data
2981	$data = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = '".$sid."';");
2982	if(empty($data['rcon'])) {
2983		$objResponse->addScript("ShowBox('Error', 'Can\'t get playerinfo for ".addslashes(htmlspecialchars($name)).". No RCON password!', 'red', '', true);");
2984		return $objResponse;
2985	}
2986	$r = new CServerRcon($data['ip'], $data['port'], $data['rcon']);
2987
2988	if(!$r->Auth())
2989	{
2990		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = '".$sid."';");
2991		$objResponse->addScript("ShowBox('Error', 'Can\'t get playerinfo for ".addslashes(htmlspecialchars($name)).". Wrong RCON password!', 'red', '', true);");
2992		return $objResponse;
2993	}
2994	// search for the playername
2995	$ret = $r->rconCommand("status");
2996	$search = preg_match_all(STATUS_PARSE,$ret,$matches,PREG_PATTERN_ORDER);
2997	$i = 0;
2998	$found = false;
2999	$index = -1;
3000	foreach($matches[2] AS $match) {
3001		if($match == $name) {
3002			$found = true;
3003			$index = $i;
3004			break;
3005		}
3006		$i++;
3007	}
3008	if($found) {
3009		$steam = $matches[3][$index];
3010		// Hack to support steam3 [U:1:X] representation.
3011		if(strpos($steam, "[U:") === 0) {
3012			$steam = renderSteam2(getAccountId($steam), 0);
3013		}
3014        $objResponse->addScript("$('dialog-control').setStyle('display', 'block');$('dialog-content-text').innerHTML = 'Generating Community Profile link for ".addslashes(htmlspecialchars($name)).", please wait...<br /><font color=\"green\">Done.</font><br /><br /><b>Watch the profile <a href=\"http://www.steamcommunity.com/profiles/".SteamIDToFriendID($steam)."/\" title=\"".addslashes(htmlspecialchars($name))."\'s Profile\" target=\"_blank\">here</a>.</b>';");
3015		$objResponse->addScript("window.open('http://www.steamcommunity.com/profiles/".SteamIDToFriendID($steam)."/', 'Community_".$steam."');");
3016	} else {
3017		$objResponse->addScript("ShowBox('Error', 'Can\'t get playerinfo for ".addslashes(htmlspecialchars($name)).". Player not on the server anymore!', 'red', '', true);");
3018	}
3019	return $objResponse;
3020}
3021
3022function SendMessage($sid, $name, $message)
3023{
3024	$objResponse = new xajaxResponse();
3025    global $userbank, $username;
3026	if(!$userbank->is_admin())
3027	{
3028		$objResponse->redirect("index.php?p=login&m=no_access", 0);
3029		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to send ingame message to '".addslashes(htmlspecialchars($name))."' (\"".RemoveCode($message)."\"), but doesnt have access.");
3030		return $objResponse;
3031	}
3032	$sid = (int)$sid;
3033	require INCLUDES_PATH.'/CServerRcon.php';
3034	//get the server data
3035	$data = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = '".$sid."';");
3036	if(empty($data['rcon'])) {
3037		$objResponse->addScript("ShowBox('Error', 'Can\'t send message to ".addslashes(htmlspecialchars($name)).". No RCON password!', 'red', '', true);");
3038		return $objResponse;
3039	}
3040	$r = new CServerRcon($data['ip'], $data['port'], $data['rcon']);
3041	if(!$r->Auth())
3042	{
3043		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = '".$sid."';");
3044		$objResponse->addScript("ShowBox('Error', 'Can\'t send message to ".addslashes(htmlspecialchars($name)).". Wrong RCON password!', 'red', '', true);");
3045		return $objResponse;
3046	}
3047	$ret = $r->sendCommand('sm_psay "'.$name.'" "'.preg_replace('/[^A-Za-z0-9\ ]/', '', $message).'"');
3048  new CSystemLog("m", "Message sent to player", "The following message was sent to " . addslashes(htmlspecialchars($name)) . " on server " . $data['ip'] . ":" . $data['port'] . ": " . RemoveCode($message));
3049	$objResponse->addScript("ShowBox('Message Sent', 'The message has been sent to player \'".addslashes(htmlspecialchars($name))."\' successfully!', 'green', '', true);$('dialog-control').setStyle('display', 'block');");
3050	return $objResponse;
3051}
3052function AddBlock($nickname, $type, $steam, $length, $reason)
3053{
3054	$objResponse = new xajaxResponse();
3055	global $userbank, $username;
3056	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
3057	{
3058		$objResponse->redirect("index.php?p=login&m=no_access", 0);
3059		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add a block, but doesnt have access.");
3060		return $objResponse;
3061	}
3062
3063	$steam = trim($steam);
3064
3065	$error = 0;
3066	// If they didnt type a steamid
3067	if(empty($steam))
3068	{
3069		$error++;
3070		$objResponse->addAssign("steam.msg", "innerHTML", "You must type a Steam ID or Community ID");
3071		$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
3072	}
3073	else if((!is_numeric($steam)
3074	&& !validate_steam($steam))
3075	|| (is_numeric($steam)
3076	&& (strlen($steam) < 15
3077	|| !validate_steam($steam = FriendIDToSteamID($steam)))))
3078	{
3079		$error++;
3080		$objResponse->addAssign("steam.msg", "innerHTML", "Please enter a valid Steam ID or Community ID");
3081		$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
3082	}
3083	else
3084	{
3085		$objResponse->addAssign("steam.msg", "innerHTML", "");
3086		$objResponse->addScript("$('steam.msg').setStyle('display', 'none');");
3087	}
3088
3089	if($error > 0)
3090		return $objResponse;
3091
3092	$nickname = RemoveCode($nickname);
3093	$reason = RemoveCode($reason);
3094	if(!$length)
3095		$len = 0;
3096	else
3097		$len = $length*60;
3098
3099	// prune any old bans
3100	PruneComms();
3101
3102	$typeW = "";
3103	switch ((int)$type)
3104	{
3105		case 1:
3106			$typeW = "type = 1";
3107			break;
3108		case 2:
3109			$typeW = "type = 2";
3110			break;
3111		case 3:
3112			$typeW = "(type = 1 OR type = 2)";
3113			break;
3114		default:
3115			$typeW = "";
3116			break;
3117	}
3118
3119	// Check if the new steamid is already banned
3120	$chk = $GLOBALS['db']->GetRow("SELECT count(bid) AS count FROM ".DB_PREFIX."_comms WHERE authid = ? AND (length = 0 OR ends > UNIX_TIMESTAMP()) AND RemovedBy IS NULL AND ".$typeW, array($steam));
3121
3122	if(intval($chk[0]) > 0)
3123	{
3124		$objResponse->addScript("ShowBox('Error', 'SteamID: $steam is already blocked.', 'red', '');");
3125		return $objResponse;
3126	}
3127
3128	// Check if player is immune
3129	$admchk = $userbank->GetAllAdmins();
3130	foreach($admchk as $admin)
3131	if($admin['authid'] == $steam && $userbank->GetProperty('srv_immunity') < $admin['srv_immunity'])
3132		{
3133			$objResponse->addScript("ShowBox('Error', 'SteamID: Admin ".$admin['user']." ($steam) is immune.', 'red', '');");
3134			return $objResponse;
3135		}
3136
3137	if((int)$type == 1 || (int)$type == 3)
3138	{
3139		$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_comms(created,type,authid,name,ends,length,reason,aid,adminIp ) VALUES
3140									  (UNIX_TIMESTAMP(),1,?,?,(UNIX_TIMESTAMP() + ?),?,?,?,?)");
3141		$GLOBALS['db']->Execute($pre,array($steam,
3142										   $nickname,
3143										   $length*60,
3144										   $len,
3145										   $reason,
3146										   $userbank->GetAid(),
3147										   $_SERVER['REMOTE_ADDR']));
3148	}
3149	if ((int)$type == 2 || (int)$type ==3)
3150	{
3151		$pre = $GLOBALS['db']->Prepare("INSERT INTO ".DB_PREFIX."_comms(created,type,authid,name,ends,length,reason,aid,adminIp ) VALUES
3152									  (UNIX_TIMESTAMP(),2,?,?,(UNIX_TIMESTAMP() + ?),?,?,?,?)");
3153		$GLOBALS['db']->Execute($pre,array($steam,
3154										   $nickname,
3155										   $length*60,
3156										   $len,
3157										   $reason,
3158										   $userbank->GetAid(),
3159										   $_SERVER['REMOTE_ADDR']));
3160	}
3161
3162	$objResponse->addScript("ShowBlockBox('".$steam."', '".(int)$type."', '".(int)$len."');");
3163	$objResponse->addScript("TabToReload();");
3164	$log = new CSystemLog("m", "Block Added", "Block against (" . $steam . ") has been added, reason: $reason, length: $length", true, $kickit);
3165	return $objResponse;
3166}
3167
3168function PrepareReblock($bid)
3169{
3170	$objResponse = new xajaxResponse();
3171
3172	$ban = $GLOBALS['db']->GetRow("SELECT name, authid, type, length, reason FROM ".DB_PREFIX."_comms WHERE bid = '".$bid."';");
3173
3174	// clear any old stuff
3175	$objResponse->addScript("$('nickname').value = ''");
3176	$objResponse->addScript("$('steam').value = ''");
3177	$objResponse->addScript("$('txtReason').value = ''");
3178	$objResponse->addAssign("txtReason", "innerHTML",  "");
3179
3180	// add new stuff
3181	$objResponse->addScript("$('nickname').value = '" . $ban['name'] . "'");
3182	$objResponse->addScript("$('steam').value = '" . $ban['authid']. "'");
3183	$objResponse->addScriptCall("selectLengthTypeReason", $ban['length'], $ban['type']-1, addslashes($ban['reason']));
3184
3185	$objResponse->addScript("SwapPane(0);");
3186	return $objResponse;
3187}
3188
3189function PrepareBlockFromBan($bid)
3190{
3191	$objResponse = new xajaxResponse();
3192
3193	// clear any old stuff
3194	$objResponse->addScript("$('nickname').value = ''");
3195	$objResponse->addScript("$('steam').value = ''");
3196	$objResponse->addScript("$('txtReason').value = ''");
3197	$objResponse->addAssign("txtReason", "innerHTML",  "");
3198
3199	$ban = $GLOBALS['db']->GetRow("SELECT name, authid FROM ".DB_PREFIX."_bans WHERE bid = '".$bid."';");
3200
3201	// add new stuff
3202	$objResponse->addScript("$('nickname').value = '" . $ban['name'] . "'");
3203	$objResponse->addScript("$('steam').value = '" . $ban['authid']. "'");
3204
3205	$objResponse->addScript("SwapPane(0);");
3206	return $objResponse;
3207}
3208
3209function PasteBlock($sid, $name)
3210{
3211	$objResponse = new xajaxResponse();
3212	global $userbank, $username;
3213
3214	$sid = (int)$sid;
3215	if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_BAN))
3216	{
3217		$objResponse->redirect("index.php?p=login&m=no_access", 0);
3218		$log = new CSystemLog("w", "Hacking Attempt", $username . " tried paste a block, but doesn't have access.");
3219		return $objResponse;
3220	}
3221	require INCLUDES_PATH.'/CServerRcon.php';
3222	//get the server data
3223	$data = $GLOBALS['db']->GetRow("SELECT ip, port, rcon FROM ".DB_PREFIX."_servers WHERE sid = ?;", array($sid));
3224	if(empty($data['rcon'])) {
3225		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
3226		$objResponse->addScript("ShowBox('Error', 'No RCON password for server ".$data['ip'].":".$data['port']."!', 'red', '', true);");
3227		return $objResponse;
3228	}
3229
3230	$r = new CServerRcon($data['ip'], $data['port'], $data['rcon']);
3231	if(!$r->Auth())
3232	{
3233		$GLOBALS['db']->Execute("UPDATE ".DB_PREFIX."_servers SET rcon = '' WHERE sid = ?;", array($sid));
3234		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
3235		$objResponse->addScript("ShowBox('Error', 'Wrong RCON password for server ".$data['ip'].":".$data['port']."!', 'red', '', true);");
3236		return $objResponse;
3237	}
3238
3239	$ret = $r->rconCommand("status");
3240	$search = preg_match_all(STATUS_PARSE,$ret,$matches,PREG_PATTERN_ORDER);
3241	$i = 0;
3242	$found = false;
3243	$index = -1;
3244	foreach($matches[2] AS $match) {
3245		if($match == $name) {
3246			$found = true;
3247			$index = $i;
3248			break;
3249		}
3250		$i++;
3251	}
3252	if($found) {
3253		$steam = $matches[3][$index];
3254		$name = $matches[2][$index];
3255		$objResponse->addScript("$('nickname').value = '" . addslashes($name) . "'");
3256		$objResponse->addScript("$('steam').value = '" . $steam . "'");
3257	} else {
3258		$objResponse->addScript("ShowBox('Error', 'Can\'t get player info for ".addslashes(htmlspecialchars($name)).". Player is not on the server (".$data['ip'].":".$data['port'].") anymore!', 'red', '', true);");
3259		$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
3260		return $objResponse;
3261	}
3262	$objResponse->addScript("SwapPane(0);");
3263	$objResponse->addScript("$('dialog-control').setStyle('display', 'block');");
3264	$objResponse->addScript("$('dialog-placement').setStyle('display', 'none');");
3265	return $objResponse;
3266}
3267?>