· 9 years ago · May 05, 2017, 01:04 AM
1<?php
2
3
4// page header, and any additional required libraries
5require_once 'header.php';
6require_once 'libs/char_lib.php';
7// minimum permission to view page
8valid_login($action_permission['read']);
9
10//########################################################################################################################
11// BROWSE USERS
12//########################################################################################################################
13function browse_users(&$sqlr, &$sqlc)
14{
15 global $output, $lang_global, $lang_user,
16 $mmfpm_db,
17 $action_permission, $user_lvl, $user_name,
18 $itemperpage, $showcountryflag, $expansion_select,
19 $gm_level_arr, $server_type;
20
21 $active_realm_id_pq = ($server_type) ? "0 as active_realm_id" :
22 "active_realm_id";
23
24 $sqlm = new SQL;
25 $sqlm->connect($mmfpm_db['addr'], $mmfpm_db['user'], $mmfpm_db['pass'], $mmfpm_db['name']);
26
27 //-------------------SQL Injection Prevention--------------------------------
28 $start = (isset($_GET['start'])) ? $sqlr->quote_smart($_GET['start']) : 0;
29 if (is_numeric($start)); else $start=0;
30
31 $order_by = (isset($_GET['order_by'])) ? $sqlr->quote_smart($_GET['order_by']) : 'id';
32 if (preg_match('/^[_[:lower:]]{1,15}$/', $order_by)); else $order_by='id';
33
34 $dir = (isset($_GET['dir'])) ? $sqlr->quote_smart($_GET['dir']) : 1;
35 if (preg_match('/^[01]{1}$/', $dir)); else $dir=1;
36
37 $order_dir = ($dir) ? 'ASC' : 'DESC';
38 $dir = ($dir) ? 0 : 1;
39
40 //-------------------Search--------------------------------------------------
41 $search_by = '';
42 $search_value = '';
43
44
45 if ($server_type == 1) { //If TrinityCore Server Type
46 $order_by2 = $order_by;
47 if ($order_by == 'gmlevel') {
48 $order_by = 'account_access.gmlevel';
49 }
50 elseif ($order_by == 'active_realm_id') {
51 $order_by = 'account.online';
52 }
53 else {
54 $order_by = 'account.'.$order_by2;
55 unset($order_by2);
56 }
57 // if we have a search request, if not we just return everything
58 if(isset($_GET['search_value']) && isset($_GET['search_by']))
59 {
60 // injection prevention
61 $search_value = $sqlr->quote_smart($_GET['search_value']);
62 $search_by = $sqlr->quote_smart($_GET['search_by']);
63 $search_menu = array('username', 'id', 'gmlevel', 'greater_gmlevel', 'email', 'joindate', 'last_ip', 'failed_logins', 'last_login', 'active_realm_id', 'banned', 'locked', 'expansion');
64
65 if (in_array($search_by, $search_menu));
66 else $search_by = 'username';
67 unset($search_menu);
68
69 if ($search_by == 'active_realm_id') { $search_by = 'online'; }
70 // special search cases
71 // developer note: 'if else' is always faster then 'switch case'
72 if ($search_by === 'gmlevel')
73 {
74 $sql_query = 'SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE account_access.gmlevel = '.$search_value.' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
75 $query_1 = $sqlr->query('SELECT count(*) FROM account_access WHERE gmlevel = "%'.$search_value.'%"');
76 }
77 elseif ($search_by === 'greater_gmlevel')
78 {
79 $sql_query = 'SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE account_access.gmlevel < '.$search_value.' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
80 $query_1 = $sqlr->query('SELECT count(*) FROM account_access WHERE gmlevel < "%'.$search_value.'%"');
81 }
82 elseif ($search_by === 'banned')
83 {
84 $sql_query = 'SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE account.id = 0 ';
85 $count_query = 'SELECT count(*) FROM account WHERE id = 0 ';
86 $que = $sqlr->query('SELECT id FROM account_banned');
87 while ($banned = $sqlr->fetch_assoc($que))
88 {
89 $sql_query .= 'OR id = '.$banned['id'].'';
90 $count_query .= 'OR id = '.$banned['id'].'';
91 }
92 $query_1 = $sqlr->query($count_query);
93 unset($count_query);
94 }
95 elseif ($search_by === 'failed_logins')
96 {
97 $sql_query = 'SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE failed_logins > '.$search_value.' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
98 $query_1 = $sqlr->query('SELECT count(*) FROM account WHERE failed_logins > '.$search_value.'');
99 }
100 else
101 {
102 // default search case
103 $sql_query = 'SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE '.$search_by.' LIKE "%'.$search_value.'%" ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
104 $query_1 = $sqlr->query('SELECT count(*) FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE '.$search_by.' LIKE "%'.$search_value.'%"');
105 }
106 $query = $sqlr->query($sql_query);
107 }
108 else
109 {
110 // get total number of items
111 $query_1 = $sqlr->query('SELECT count(*) FROM account');
112 $query = $sqlr->query('SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'');
113 }
114
115 }
116 else { //If MaNGOS Server Type
117 // if we have a search request, if not we just return everything
118 if(isset($_GET['search_value']) && isset($_GET['search_by']))
119 {
120 // injection prevention
121 $search_value = $sqlr->quote_smart($_GET['search_value']);
122 $search_by = $sqlr->quote_smart($_GET['search_by']);
123 $search_menu = array('username', 'id', 'gmlevel', 'greater_gmlevel', 'email', 'joindate', 'last_ip', 'failed_logins', 'last_login', 'active_realm_id', 'banned', 'locked', 'expansion');
124 if (in_array($search_by, $search_menu));
125 else $search_by = 'username';
126 unset($search_menu);
127
128 // special search cases
129 // developer note: 'if else' is always faster then 'switch case'
130 if ($search_by === 'greater_gmlevel')
131 {
132 $sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,'.$active_realm_id_pq.',expansion
133 FROM account WHERE gmlevel > "%'.$search_value.'%" ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
134 $query_1 = $sqlr->query('SELECT count(*) FROM account WHERE gmlevel > "%'.$search_value.'%"');
135 }
136 elseif ($search_by === 'banned')
137 {
138 $sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,'.$active_realm_id_pq.',expansion
139 FROM account WHERE id = 0 ';
140 $count_query = 'SELECT count(*) FROM account WHERE id = 0 ';
141 $que = $sqlr->query('SELECT id FROM account_banned');
142 while ($banned = $sqlr->fetch_assoc($que))
143 {
144 $sql_query .= 'OR id = '.$banned['id'].'';
145 $count_query .= 'OR id = '.$banned['id'].'';
146 }
147 $sql_query .= ' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
148 $query_1 = $sqlr->query($count_query);
149 unset($count_query);
150 }
151 elseif ($search_by === 'failed_logins')
152 {
153 $sql_query = 'SELECT * FROM account WHERE failed_logins > '.$search_value.' ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
154 $query_1 = $sqlr->query('SELECT count(*) FROM account WHERE failed_logins > '.$search_value.'');
155 }
156 else
157 {
158 // default search case
159 $sql_query = 'SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,'.$active_realm_id_pq.',expansion
160 FROM account WHERE '.$search_by.' LIKE "%'.$search_value.'%" ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'';
161 $query_1 = $sqlr->query('SELECT count(*) FROM account WHERE '.$search_by.' LIKE "%'.$search_value.'%"');
162 }
163 $query = $sqlr->query($sql_query);
164 }
165 else
166 {
167 // get total number of items
168 $query_1 = $sqlr->query('SELECT count(*) FROM account');
169 $query = $sqlr->query('SELECT *
170 FROM account ORDER BY '.$order_by.' '.$order_dir.' LIMIT '.$start.', '.$itemperpage.'');
171 }
172 }
173 // this is for multipage support
174 $all_record = $sqlr->result($query_1,0);
175 unset($query_1);
176
177 //==========================top tage navigaion starts here========================
178 // we start with a lead of 10 spaces,
179 // because last line of header is an opening tag with 8 spaces
180 // keep html indent in sync, so debuging from browser source would be easy to read
181 $output .='
182 <!-- start of user.php -->
183 <script type="text/javascript" src="libs/js/check.js"></script>
184 <center>
185 <table class="top_hidden">
186 <tr>
187 <td>';
188 if ($user_lvl >= $action_permission['insert'])
189 {
190 makebutton($lang_user['add_acc'], 'user.php?action=add_new', 130);
191 // backup is broken
192 // makebutton($lang_user['backup'], 'backup.php', 130);
193 }
194
195 // cleanup unknown working condition
196 //if($user_lvl >= $action_permission['delete'])
197 // makebutton($lang_user['cleanup'], 'cleanup.php', 130);
198 makebutton($lang_global['back'], 'javascript:window.history.back()', 130);
199 if ($search_by && $search_value)
200 {
201 makebutton($lang_user['user_list'], 'user.php', 130);
202 }
203 $output .= '
204 </td>
205 <td align="right" width="25%" rowspan="2">';
206
207 // multi page links
208 $output .=
209 $lang_user['tot_acc'].' : '.$all_record.'<br /><br />'.
210 generate_pagination('user.php?order_by='.$order_by.'&dir='.(($dir) ? 0 : 1).( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'', $all_record, $itemperpage, $start);
211 // this part for search
212 $output .= '
213 </td>
214 </tr>
215 <tr align="left">
216 <td>
217 <table class="hidden">
218 <tr>
219 <td>
220 <form action="user.php" method="get" name="form">
221 <input type="hidden" name="error" value="3" />
222 <input type="text" size="24" maxlength="50" name="search_value" value="'.$search_value.'" />
223 <select name="search_by">
224 <option value="username"'.($search_by === 'username' ? ' selected="selected"' : '').'>'.$lang_user['by_name'].'</option>
225 <option value="id"'.($search_by === 'id' ? ' selected="selected"' : '').'>'.$lang_user['by_id'].'</option>
226 <option value="gmlevel"'.($search_by === 'gmlevel' ? ' selected="selected"' : '').'>'.$lang_user['by_gm_level'].'</option>
227 <option value="greater_gmlevel"'.($search_by === 'greater_gmlevel' ? ' selected="selected"' : '').'>'.$lang_user['greater_gm_level'].'</option>
228 <option value="expansion"'.($search_by === 'expansion' ? ' selected="selected"' : '').'>'.$lang_user['by_expansion'].'</option>
229 <option value="email"'.($search_by === 'email' ? ' selected="selected"' : '').'>'.$lang_user['by_email'].'</option>
230 <option value="joindate"'.($search_by === 'joindate' ? ' selected="selected"' : '').'>'.$lang_user['by_join_date'].'</option>
231 <option value="last_ip"'.($search_by === 'last_ip' ? ' selected="selected"' : '').'>'.$lang_user['by_ip'].'</option>
232 <option value="failed_logins"'.($search_by === 'failed_logins' ? ' selected="selected"' : '').'>'.$lang_user['by_failed_loggins'].'</option>
233 <option value="last_login"'.($search_by === 'last_login' ? ' selected="selected"' : '').'>'.$lang_user['by_last_login'].'</option>
234 <option value="active_realm_id"'.($search_by === 'active_realm_id' ? ' selected="selected"' : '').'>'.$lang_user['by_online'].'</option>
235 <option value="locked"'.($search_by === 'locked' ? ' selected="selected"' : '').'>'.$lang_user['by_locked'].'</option>
236 <option value="banned"'.($search_by === 'banned' ? ' selected="selected"' : '').'>'.$lang_user['by_banned'].'</option>
237 </select>
238 </form>
239 </td>
240 <td>';
241 makebutton($lang_global['search'], 'javascript:do_submit()',80);
242 $output .= '
243 </td>
244 </tr>
245 </table>
246 </td>
247 </tr>
248 </table>';
249 //==========================top tage navigaion ENDS here ========================
250 $output .= '
251 <form method="get" action="user.php" name="form1">
252 <input type="hidden" name="action" value="del_user" />
253 <input type="hidden" name="start" value="'.$start.'" />
254 <input type="hidden" name="backup_op" value="0"/>
255 <table class="lined">
256 <tr>';
257 // column headers, with links for sorting
258 // first column is the selection check box
259 if($user_lvl >= $action_permission['insert'])
260 $output.= '
261 <th width="1%">
262 <input name="allbox" type="checkbox" value="Check All" onclick="CheckAll(document.form1);" />
263 </th>';
264 else
265 $output .= '
266 <th width="1%"></th>';
267 $output .='
268 <th width="1%"><a href="user.php?order_by=id&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='id' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['id'].'</a></th>
269 <th width="1%"><a href="user.php?order_by=username&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='username' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['username'].'</a></th>
270 <th width="1%"><a href="user.php?order_by=gmlevel&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='gmlevel' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['gm_level'].'</a></th>';
271 if ($expansion_select)
272 $output .='
273 <th width="1%"><a href="user.php?order_by=expansion&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='expansion' ? ' class="'.$order_dir.'"' : '').'>EXP</a></th>';
274 $output .='
275 <th width="1%"><a href="user.php?order_by=email&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='email' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['email'].'</a></th>
276 <th width="1%"><a href="user.php?order_by=joindate&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='joindate' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['join_date'].'</a></th>
277 <th width="1%"><a href="user.php?order_by=last_ip&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='last_ip' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['ip'].'</a></th>
278 <th width="1%"><a href="user.php?order_by=failed_logins&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='failed_logins' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['failed_logins'].'</a></th>
279 <th width="1%"><a href="user.php?order_by=locked&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='locked' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['locked'].'</a></th>
280 <th width="1%"><a href="user.php?order_by=last_login&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='last_login' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['last_login'].'</a></th>
281 <th width="1%"><a href="user.php?order_by=active_realm_id&start='.$start.( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'&dir='.$dir.'"'.($order_by==='active_realm_id' ? ' class="'.$order_dir.'"' : '').'>'.$lang_user['online'].'</a></th>';
282 if ($showcountryflag)
283 {
284 require_once 'libs/misc_lib.php';
285 $output .= '
286 <th width="1%">'.$lang_global['country'].'</th>';
287 }
288 $output .= '
289 </tr>';
290
291 //---------------Page Specific Data Starts Here--------------------------
292 while ($data = $sqlr->fetch_assoc($query))
293 {
294 if (($user_lvl >= $data['gmlevel'])||($user_name === $data['username']))
295 {
296 $output .= '
297 <tr>';
298 if ($user_lvl >= $action_permission['insert'])
299 $output .= '
300 <td><input type="checkbox" name="check[]" value="'.$data['id'].'" onclick="CheckCheckAll(document.form1);" /></td>';
301 else
302 $output .= '
303 <td></td>';
304 $output .= '
305 <td>'.$data['id'].'</td>
306 <td>
307 <a href="user.php?action=edit_user&error=11&id='.$data['id'].'">'.$data['username'].'</a>
308 </td>
309 <td>'.$gm_level_arr[$data['gmlevel']][2].'</td>';
310 if ($expansion_select)
311 {
312 $exp_lvl_arr = id_get_exp_lvl();
313 $output .= '
314 <td>'.$exp_lvl_arr[$data['expansion']][2].'</td>';
315 unset($exp_lvl_arr);
316 }
317 if ($user_lvl >= $action_permission['update']||($user_name === $data['username']))
318 $output .= '
319 <td><a href="mailto:'.$data['email'].'">'.substr($data['email'],0,15).'</a></td>';
320 else
321 $output .= '
322 <td>***@***.***</td>';
323 $output .= '
324 <td class="small">'.$data['joindate'].'</td>';
325 if (($user_lvl >= $action_permission['update'])||($user_name === $data['username']))
326 $output .= '
327 <td>'.$data['last_ip'].'</td>';
328 else
329 $output .= '
330 <td>*******</td>';
331 $output .= '
332 <td>'.(($data['failed_logins']) ? $data['failed_logins'] : '-').'</td>
333 <td>'.(($data['locked']) ? $lang_global['yes_low'] : '-').'</td>
334 <td class="small">'.$data['last_login'].'</td>';
335 if ($server_type == 1) {
336 $output .= '<td>'.(($data['online']) ? '<img src="img/up.gif" alt="" />' : '-').'</td>';
337 }
338 else {
339 $output .= '<td>'.(($data['active_realm_id']) ? '<img src="img/up.gif" alt="" />' : '-').'</td>';
340 }
341 if ($showcountryflag)
342 {
343 $country = misc_get_country_by_ip($data['last_ip'], $sqlm);
344 $output .= '
345 <td>'.(($country['code']) ? '<img src="img/flags/'.$country['code'].'.png" onmousemove="toolTip(\''.($country['country']).'\', \'item_tooltip\')" onmouseout="toolTip()" alt="" />' : '-').'</td>';
346 }
347 $output .= '
348 </tr>';
349 }
350 else
351 {
352 $output .= '
353 <tr>
354 <td>*</td><td>***</td><td>You</td><td>Have</td><td>No</td>
355 <td class=\"small\">Permission</td><td>to</td><td>View</td><td>this</td><td>Data</td><td>***</td>';
356 if ($expansion_select)
357 $output .= '
358 <td>*</td>';
359 if ($showcountryflag)
360 $output .= '
361 <td>*</td>';
362 $output .= '
363 </tr>';
364 }
365 }
366 $output .= '
367 <tr>
368 <td colspan="';
369 if ($expansion_select || $showcountryflag)
370 {
371 if ($expansion_select && $showcountryflag)
372 $output .= '13';
373 else
374 $output .= '12';
375 }
376 else
377 $output .= '11';
378 $output .= '" class="hidden" align="right" width="25%">';
379 $output .= generate_pagination('user.php?order_by='.$order_by.'&dir='.(($dir) ? 0 : 1).( $search_value && $search_by ? '&search_by='.$search_by.'&search_value='.$search_value.'' : '' ).'', $all_record, $itemperpage, $start);
380 $output .= '
381 </td>
382 </tr>
383 <tr>
384 <td colspan="8" align="left" class="hidden">';
385 if($user_lvl >= $action_permission['delete'])
386 makebutton($lang_user['del_selected_users'], 'javascript:do_submit(\'form1\',0)" type="wrn',230);
387// backup is broken
388//if($user_lvl >= $action_permission['insert'])
389// makebutton($lang_user['backup_selected_users'], 'javascript:do_submit(\'form1\',1)',230);
390 $output .= '
391 </td>
392 <td colspan="';
393 if ($expansion_select || $showcountryflag)
394 {
395 if ($expansion_select && $showcountryflag)
396 $output .= '5';
397 else
398 $output .= '4';
399 }
400 else
401 $output .= '3';
402 $output .= '" align="right" class="hidden">'.$lang_user['tot_acc'].' : '.$all_record.'</td>
403 </tr>
404 </table>
405 </form>
406 <br />
407 </center>
408 <!-- end of user.php -->';
409
410}
411
412
413//#######################################################################################################
414// DELETE USER
415//#######################################################################################################
416function del_user()
417{
418 global $lang_global, $lang_user, $output, $realm_db, $action_permission;
419 valid_login($action_permission['delete']);
420 if(isset($_GET['check'])) $check = $_GET['check'];
421 else redirect("user.php?error=1");
422
423 $pass_array = "";
424
425 //skip to backup
426 if (isset($_GET['backup_op'])&&($_GET['backup_op'] == 1))
427 {
428 for ($i=0; $i<count($check); $i++)
429 {
430 $pass_array .= "&check%5B%5D=$check[$i]";
431 }
432 redirect("user.php?action=backup_user$pass_array");
433 }
434
435 $output .= "
436 <center>
437 <img src=\"img/warn_red.gif\" width=\"48\" height=\"48\" alt=\"\" />
438 <h1><font class=\"error\">{$lang_global['are_you_sure']}</font></h1>
439 <br />
440 <font class=\"bold\">{$lang_user['acc_ids']}: ";
441
442 $sqlr = new SQL;
443 $sqlr->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
444
445 for ($i=0; $i<count($check); $i++)
446 {
447 $username = $sqlr->result($sqlr->query("SELECT username FROM `account` WHERE id = {$check[$i]}"),0);
448 $output .= "
449 <a href=\"user.php?action=edit_user&id=$check[$i]\" target=\"_blank\">$username, </a>";
450 $pass_array .= "&check%5B%5D=$check[$i]";
451 }
452
453 $output .= "
454 <br />{$lang_global['will_be_erased']}</font>
455 <br /><br />
456 <table width=\"300\" class=\"hidden\">
457 <tr>
458 <td>";
459 makebutton($lang_global['yes'], "user.php?action=dodel_user$pass_array\" type=\"wrn" ,130);
460 makebutton($lang_global['no'], "user.php\" type=\"def" ,130);
461 $output .= "
462 </td>
463 </tr>
464 </table>
465 <br />
466 </center>
467";
468
469}
470
471
472//#####################################################################################################
473// DO DELETE USER
474//#####################################################################################################
475function dodel_user()
476{
477 global $lang_global, $lang_user, $output, $realm_db, $characters_db, $realm_id, $user_lvl, $server_type,
478 $tab_del_user_characters, $tab_del_user_characters_trinity, $tab_del_user_realmd, $action_permission;
479 valid_login($action_permission['delete']);
480 if ($server_type)
481 $tab_del_user_characters = $tab_del_user_characters_trinity;
482
483 $sqlr = new SQL;
484 $sqlr->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
485
486 if(isset($_GET['check']))
487 $check = $sqlr->quote_smart($_GET['check']);
488 else
489 redirect("user.php?error=1");
490
491 $deleted_acc = 0;
492 $deleted_chars = 0;
493 require_once("libs/del_lib.php");
494
495 for ($i=0; $i<count($check); $i++)
496 {
497 if ($check[$i] != "" )
498 {
499 list($flag,$del_char) = del_acc($check[$i]);
500 if ($flag)
501 {
502 $deleted_acc++;
503 $deleted_chars += $del_char;
504 }
505 }
506 }
507 $output .= "
508 <center>";
509 if ($deleted_acc == 0)
510 $output .= "
511 <h1><font class=\"error\">{$lang_user['no_acc_deleted']}</font></h1>";
512 else
513 {
514 $output .= "
515 <h1><font class=\"error\">{$lang_user['total']} <font color=blue>$deleted_acc</font> {$lang_user['acc_deleted']}</font><br /></h1>";
516 $output .= "
517 <h1><font class=\"error\">{$lang_user['total']} <font color=blue>$deleted_chars</font> {$lang_user['char_deleted']}</font></h1>";
518 }
519 $output .= "
520 <br /><br />";
521 $output .= "
522 <table class=\"hidden\">
523 <tr>
524 <td>";
525 makebutton($lang_user['back_browsing'], "user.php", 230);
526 $output .= "
527 </td>
528 </tr>
529 </table>
530 <br />
531 </center>
532";
533
534}
535
536
537//#####################################################################################################
538// DO BACKUP USER
539//#####################################################################################################
540function backup_user()
541{
542 global $lang_global, $lang_user, $output, $realm_db, $characters_db, $realm_id, $user_lvl, $backup_dir, $action_permission;
543 valid_login($action_permission['insert']);
544
545 $sql = new SQL;
546 $sql->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
547
548 if(isset($_GET['check'])) $check = $sql->quote_smart($_GET['check']);
549 else redirect("user.php?error=1");
550
551 require_once("libs/tab_lib.php");
552 if ($server_type)
553 $tab_backup_user_characters = $tab_backup_user_characters_trinity;
554
555 $subdir = "$backup_dir/accounts/".date("m_d_y_H_i_s")."_partial";
556 mkdir($subdir, 0750);
557
558 for ($t=0; $t<count($check); $t++)
559 {
560 if ($check[$t] != "" )
561 {
562 $sql->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
563 $query = $sql->query("SELECT id FROM account WHERE id = $check[$t]");
564 $acc = $sql->fetch_array($query);
565 $file_name_new = $acc[0]."_{$realm_db['name']}.sql";
566 $fp = fopen("$subdir/$file_name_new", 'w') or die (error($lang_backup['file_write_err']));
567 fwrite($fp, "CREATE DATABASE /*!32312 IF NOT EXISTS*/ {$realm_db['name']};\n")or die (error($lang_backup['file_write_err']));
568 fwrite($fp, "USE {$realm_db['name']};\n\n")or die (error($lang_backup['file_write_err']));
569 foreach ($tab_backup_user_realmd as $value) {
570 $acc_query = $sql->query("SELECT * FROM $value[0] WHERE $value[1] = $acc[0]");
571 $num_fields = $sql->num_fields($acc_query);
572 $numrow = $sql->num_rows($acc_query);
573 $result = "-- Dumping data for $value[0] ".date("m.d.y_H.i.s")."\n";
574 $result .= "LOCK TABLES $value[0] WRITE;\n";
575 $result .= "DELETE FROM $value[0] WHERE $value[1] = $acc[0];\n";
576
577 if ($numrow)
578 {
579 $result .= "INSERT INTO $value[0] (";
580 for($count = 0; $count < $num_fields; $count++)
581 {
582 $result .= "`".$sql->field_name($acc_query,$count)."`";
583 if ($count < ($num_fields-1)) $result .= ",";
584 }
585 $result .= ") VALUES \n";
586 for ($i =0; $i<$numrow; $i++)
587 {
588 $result .= "\t(";
589 $row = $sql->fetch_row($acc_query);
590 for($j=0; $j<$num_fields; $j++)
591 {
592 $row[$j] = addslashes($row[$j]);
593 $row[$j] = ereg_replace("\n","\\n",$row[$j]);
594 if (isset($row[$j]))
595 {
596 if ($sql->field_type($acc_query,$j) == "int")
597 $result .= "$row[$j]";
598 else
599 $result .= "'$row[$j]'" ;
600 }
601 else
602 $result .= "''";
603 if ($j<($num_fields-1))
604 $result .= ",";
605 }
606 if ($i < ($numrow-1))
607 $result .= "),\n";
608 }
609 $result .= ");\n";
610 }
611 $result .= "UNLOCK TABLES;\n";
612 $result .= "\n";
613 fwrite($fp, $result)or die (error($lang_backup['file_write_err']));
614 }
615 fclose($fp);
616
617 foreach ($characters_db as $db)
618 {
619 $file_name_new = $acc[0]."_{$db['name']}.sql";
620 $fp = fopen("$subdir/$file_name_new", 'w') or die (error($lang_backup['file_write_err']));
621 fwrite($fp, "CREATE DATABASE /*!32312 IF NOT EXISTS*/ {$db['name']};\n")or die (error($lang_backup['file_write_err']));
622 fwrite($fp, "USE {$db['name']};\n\n")or die (error($lang_backup['file_write_err']));
623
624 $sql->connect($db['addr'], $db['user'], $db['pass'], $db['name']);
625 $all_char_query = $sql->query("SELECT guid,name FROM `characters` WHERE account = $acc[0]");
626
627 while ($char = $sql->fetch_array($all_char_query))
628 {
629 fwrite($fp, "-- Dumping data for character $char[1]\n")or die (error($lang_backup['file_write_err']));
630 foreach ($tab_backup_user_characters as $value)
631 {
632 $char_query = $sql->query("SELECT * FROM $value[0] WHERE $value[1] = $char[0]");
633 $num_fields = $sql->num_fields($char_query);
634 $numrow = $sql->num_rows($char_query);
635 $result = "LOCK TABLES $value[0] WRITE;\n";
636 $result .= "DELETE FROM $value[0] WHERE $value[1] = $char[0];\n";
637 if ($numrow)
638 {
639 $result .= "INSERT INTO $value[0] (";
640 for($count = 0; $count < $num_fields; $count++)
641 {
642 $result .= "`".$sql->field_name($char_query,$count)."`";
643 if ($count < ($num_fields-1)) $result .= ",";
644 }
645 $result .= ") VALUES \n";
646 for ($i =0; $i<$numrow; $i++)
647 {
648 $result .= "\t(";
649 $row = $sql->fetch_row($char_query);
650 for($j=0; $j<$num_fields; $j++)
651 {
652 $row[$j] = addslashes($row[$j]);
653 $row[$j] = ereg_replace("\n","\\n",$row[$j]);
654 if (isset($row[$j]))
655 {
656 if ($sql->field_type($char_query,$j) == "int")
657 $result .= "$row[$j]";
658 else
659 $result .= "'$row[$j]'" ;
660 }
661 else
662 $result .= "''";
663 if ($j<($num_fields-1))
664 $result .= ",";
665 }
666 if ($i < ($numrow-1))
667 $result .= "),\n";
668 }
669 $result .= ");\n";
670 }
671 $result .= "UNLOCK TABLES;\n";
672 $result .= "\n";
673 fwrite($fp, $result)or die (error($lang_backup['file_write_err']));
674 }
675 }
676 fclose($fp);
677 }
678 }
679 }
680 redirect("user.php?error=15");
681}
682
683
684//#######################################################################################################
685// ADD NEW USER
686//#######################################################################################################
687function add_new()
688{
689 global $lang_global, $lang_user, $output, $action_permission, $expansion_select;
690 valid_login($action_permission['insert']);
691 $output .= "
692 <center>
693 <script type=\"text/javascript\" src=\"libs/js/sha1.js\"></script>
694 <script type=\"text/javascript\">
695 // <![CDATA[
696 function do_submit_data ()
697 {
698 if (document.form.new_pass1.value != document.form.new_pass2.value)
699 {
700 alert('{$lang_user['nonidentical_passes']}');
701 return;
702 }
703 else
704 {
705 document.form.pass.value = hex_sha1(document.form.new_user.value.toUpperCase()+':'+document.form.new_pass1.value.toUpperCase());
706 document.form.new_pass1.value = '0';
707 document.form.new_pass2.value = '0';
708 do_submit();
709 }
710 }
711 // ]]>
712 </script>
713 <fieldset style=\"width: 550px;\">
714 <legend>{$lang_user['create_new_acc']}</legend>
715 <form method=\"get\" action=\"user.php\" name=\"form\">
716 <input type=\"hidden\" name=\"pass\" value=\"\" maxlength=\"256\" />
717 <input type=\"hidden\" name=\"action\" value=\"doadd_new\" />
718 <table class=\"flat\">
719 <tr>
720 <td>{$lang_user['username']}</td>
721 <td><input type=\"text\" name=\"new_user\" size=\"24\" maxlength=\"15\" value=\"New_Account\" /></td>
722 </tr>
723 <tr>
724 <td>{$lang_user['password']}</td>
725 <td><input type=\"text\" name=\"new_pass1\" size=\"24\" maxlength=\"25\" value=\"123456\" /></td>
726 </tr>
727 <tr>
728 <td>{$lang_user['confirm']}</td>
729 <td><input type=\"text\" name=\"new_pass2\" size=\"24\" maxlength=\"25\" value=\"123456\" /></td>
730 </tr>
731 <tr>
732 <td>{$lang_user['email']}</td>
733 <td><input type=\"text\" name=\"new_mail\" size=\"24\" maxlength=\"225\" value=\"none@mail.com\" /></td>
734 </tr>
735 <tr>
736 <td>{$lang_user['locked']}</td>
737 <td><input type=\"checkbox\" name=\"new_locked\" value=\"1\" /></td>
738 </tr>";
739 if ( $expansion_select )
740 $output .= "
741 <tr>
742 <td>{$lang_user['expansion_account']}</td>
743 <td>
744 <select name=\"new_expansion\">
745 <option value=\"2\">{$lang_user['wotlk']}</option>
746 <option value=\"1\">{$lang_user['tbc']}</option>
747 <option value=\"0\">{$lang_user['classic']}</option>
748 </select>
749 </td>
750 </tr>";
751 $output .="
752 <tr>
753 <td>";
754 makebutton($lang_user['create_acc'], "javascript:do_submit_data()\" type=\"wrn",130);
755 $output .= "
756 </td>
757 <td>";
758 makebutton($lang_global['back'], "javascript:window.history.back()\" type=\"def",130);
759 $output .= "
760 </td>
761 </tr>
762 </table>
763 </form>
764 </fieldset>
765 <br /><br />
766 </center>
767";
768}
769
770
771//#########################################################################################################
772// DO ADD NEW USER
773//#########################################################################################################
774function doadd_new()
775{
776 global $lang_global, $realm_db, $action_permission, $server_type;
777 valid_login($action_permission['insert']);
778
779 if ( empty($_GET['new_user']) || empty($_GET['pass']) )
780 redirect("user.php?action=add_new&error=4");
781
782 $sqlc = new SQL;
783 $sqlc->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
784
785 $new_user = $sqlc->quote_smart(trim($_GET['new_user']));
786 $pass = $sqlc->quote_smart($_GET['pass']);
787
788 //make sure username/pass at least 4 chars long and less than max
789 if ((strlen($new_user) < 4) || (strlen($new_user) > 15))
790 redirect("user.php?action=add_new&error=8");
791 require_once("libs/valid_lib.php");
792 //make sure it doesnt contain non english chars.
793 if (!valid_alphabetic($new_user))
794 redirect("user.php?action=add_new&error=9");
795 $result = $sqlc->query("SELECT username FROM account WHERE username = '$new_user'");
796 //there is already someone with same username
797 if ($sqlc->num_rows($result))
798 redirect("user.php?action=add_new&error=7");
799 else
800 $last_ip = "0.0.0.0";
801 $new_mail = (isset($_GET['new_mail'])) ? $sqlc->quote_smart(trim($_GET['new_mail'])) : NULL;
802 $locked = (isset($_GET['new_locked'])) ? $sqlc->quote_smart($_GET['new_locked']) : 0;
803 $expansion = (isset($_GET['new_expansion'])) ? $sqlc->quote_smart($_GET['new_expansion']) : 0;
804 if ($server_type) {
805 $result = $sqlc->query("INSERT INTO account (username,sha_pass_hash,gmlevel,email, joindate,last_ip,failed_logins,locked,last_login,expansion)
806 VALUES ('$new_user','$pass',0 ,'$new_mail',now() ,'$last_ip',0, $locked ,NULL, $expansion)");
807 } else {
808 $result = $sqlc->query("INSERT INTO account (username,sha_pass_hash,gmlevel,email, joindate,last_ip,failed_logins,locked,last_login,active_realm_id,expansion)
809 VALUES ('$new_user','$pass',0 ,'$new_mail',now() ,'$last_ip',0, $locked ,NULL, 0, $expansion)");
810
811 }
812 if ($result)
813 redirect("user.php?error=5");
814
815}
816
817
818//###########################################################################################################
819// EDIT USER
820//###########################################################################################################
821function edit_user()
822{
823 global $lang_global, $lang_user, $output, $realm_db, $characters_db, $realm_id, $mmfpm_db, $user_lvl, $user_name,
824 $gm_level_arr, $action_permission, $expansion_select, $developer_test_mode, $multi_realm_mode, $server, $server_type;
825
826 $active_realm_id_pq = ($server_type) ? "0 as active_realm_id" :
827 "active_realm_id";
828
829
830 if (empty($_GET['id'])) redirect("user.php?error=10");
831
832 $sqlr = new SQL;
833 $sqlr->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
834 $sqlm = new SQL;
835 $sqlm->connect($mmfpm_db['addr'], $mmfpm_db['user'], $mmfpm_db['pass'], $mmfpm_db['name']);
836 $sqlc = new SQL;
837 $sqlc->connect($characters_db[$realm_id]['addr'], $characters_db[$realm_id]['user'], $characters_db[$realm_id]['pass'], $characters_db[$realm_id]['name']);
838
839 $id = $sqlr->quote_smart($_GET['id']);
840
841 if ($server_type == 1) {
842
843 $result = $sqlr->query("SELECT * FROM account LEFT JOIN account_access ON account.id=account_access.id WHERE account.id = '$id'");
844 }
845 else {
846 $result = $sqlr->query("SELECT id,username,gmlevel,email,joindate,last_ip,failed_logins,locked,last_login,{$active_realm_id_pq},expansion FROM account WHERE id = '$id'");
847 }
848 $data = $sqlr->fetch_assoc($result);
849
850 $refguid = $sqlm->fetch_assoc($sqlm->query('SELECT InvitedBy FROM point_system_invites WHERE PlayersAccount = '.$data['id'].''));
851 $refguid = $refguid['InveitedBy'];
852 $referred_by = $sqlc->fetch_assoc($sqlc->query("SELECT name FROM characters WHERE guid = '$refguid'"));
853 unset($refguid);
854 $referred_by = $referred_by['name'];
855
856 if ($sqlr->num_rows($result))
857 {
858 $output .= '
859 <center>
860 <script type="text/javascript" src="libs/js/sha1.js"></script>
861 <script type="text/javascript">
862 // <![CDATA[
863 function do_submit_data ()
864 {
865 if ((document.form.username.value != "'.$data['username'].'") && (document.form.new_pass.value == "******"))
866 {
867 alert("If you are changing Username, The password must be changed too.");
868 return;
869 }
870 else
871 {
872 document.form.pass.value = hex_sha1(document.form.username.value.toUpperCase()+":"+document.form.new_pass.value.toUpperCase());
873 document.form.new_pass.value = "0";
874 do_submit();
875 }
876 }
877 // ]]>
878 </script>
879 <fieldset style="width: 550px;">
880 <legend>'.$lang_user['edit_acc'].'</legend>
881 <form method="post" action="user.php?action=doedit_user" name="form">
882 <input type="hidden" name="pass" value="" maxlength="256" />
883 <input type="hidden" name="id" value="'.$id.'" />
884 <table class="flat">
885 <tr>
886 <td>'.$lang_user['id'].'</td>
887 <td>'.$data['id'].'</td>
888 </tr>
889 <tr>
890 <td>'.$lang_user['username'].'</td>';
891 if($user_lvl >= $action_permission['update'])
892 $output .='
893 <td><input type="text" name="username" size="42" maxlength="15" value="'.$data['username'].'" /></td>';
894 else
895 $output.='
896 <td>'.$data['username'].'</td>';
897 $output .= '
898 </tr>
899 <tr>
900 <td>'.$lang_user['password'].'</td>';
901 if($user_lvl >= $action_permission['update'])
902 $output .="
903 <td><input type=\"text\" name=\"new_pass\" size=\"42\" maxlength=\"40\" value=\"******\" /></td>";
904 else
905 $output.="
906 <td>********</td>";
907 $output .= "
908 </tr>
909 <tr>
910 <td>{$lang_user['email']}</td>";
911 if($user_lvl >= $action_permission['update'])
912 $output .= '
913 <td><input type="text" name="mail" size="42" maxlength="225" value="'.$data['email'].'" /></td>';
914 else
915 $output.="
916 <td>***@***.***</td>";
917 $output .= "
918 </tr>
919 <tr>
920 <td>{$lang_user['invited_by']}:</td>
921 <td>";
922 if($user_lvl >= $action_permission['update'] && !$referred_by !=NULL)
923 $output .="
924 <input type=\"text\" name=\"referredby\" size=\"42\" maxlength=\"12\" value=\"$referred_by\" />";
925 else
926 $output .="
927 $referred_by";
928 $output .="
929 </td>
930 </tr>
931 <tr>
932 <td>{$lang_user['gm_level_long']}</td>";
933 if($user_lvl >= $action_permission['update'])
934 {
935 $output .="
936 <td>
937 <select name=\"gmlevel\">";
938 foreach ($gm_level_arr as $level)
939 {
940 if (($level[0] > -1) && ($level[0] < $user_lvl))
941 {
942 $output .= "
943 <option value=\"{$level[0]}\" ";
944 if ($data['gmlevel'] == $level[0])
945 $output .= "selected=\"selected\" ";
946 $output .= ">{$level[1]}</option>";
947 }
948 }
949 $output .= "
950 </select>
951 </td>";
952 }
953 else
954 $output .= '
955 <td>'.id_get_gm_level($data['gmlevel']).' ( '.$data['gmlevel'].' )</td>';
956 $output .= '
957 </tr>
958 <tr>
959 <td>'.$lang_user['join_date'].'</td>
960 <td>'.$data['joindate'].'</td>
961 </tr>
962 <tr>
963 <td>'.$lang_user['last_ip'].'</td>';
964 if($user_lvl >= $action_permission['update'])
965 $output .= '
966 <td>'.$data['last_ip'].'<a href="banned.php?action=do_add_entry&entry='.$data['last_ip'].'&bantime=3600&ban_type=ip_banned"> <- '.$lang_user['ban_this_ip'].'</a></td>';
967 else
968 $output .= "
969 <td>***.***.***.***</td>";
970 $output .= "
971 </tr>
972 <tr>
973 <td>{$lang_user['banned']}</td>";
974 $que = $sqlr->query("SELECT bandate, unbandate, bannedby, banreason FROM account_banned WHERE id = $id");
975 if ($sqlr->num_rows($que))
976 {
977 $banned = $sqlr->fetch_row($que);
978 $ban_info = " From:".date('d-m-Y G:i', $banned[0])." till:".date('d-m-Y G:i', $banned[1])."<br />by $banned[2]";
979 $ban_checked = " checked=\"checked\"";
980 }
981 else
982 {
983 $ban_checked = "";
984 $ban_info = "";
985 $banned[3] = "";
986 }
987 if($user_lvl >= $action_permission['update'])
988 $output .= "
989 <td><input type=\"checkbox\" name=\"banned\" value=\"1\" $ban_checked/>$ban_info</td>";
990 else
991 $output .= "
992 <td>$ban_info</td>";
993 $output .="
994 </tr>
995 <tr>
996 <td>{$lang_user['banned_reason']}</td>";
997 if($user_lvl >= $action_permission['update'])
998 $output .="
999 <td><input type=\"text\" name=\"banreason\" size=\"42\" maxlength=\"255\" value=\"$banned[3]\" /></td>";
1000 else
1001 $output .= "
1002 <td>$banned[3]</td>";
1003 if ($expansion_select)
1004 {
1005 $output .="
1006 </tr>
1007 <tr>";
1008 if($user_lvl >= $action_permission['update'])
1009 {
1010 $output .="
1011 <td>{$lang_user['client_type']}</td>";
1012 $output .="
1013 <td>
1014 <select name=\"expansion\">";
1015 $output .= "
1016 <option value=\"0\">{$lang_user['classic']}</option>
1017 <option value=\"1\" ";
1018 if ($data['expansion'] == 1)
1019 $output .= "selected=\"selected\" ";
1020 $output .= ">{$lang_user['tbc']}</option>
1021 <option value=\"2\" ";
1022 if ($data['expansion'] ==2)
1023 $output .= "selected=\"selected\" ";
1024 $output .= ">{$lang_user['wotlk']}</option>
1025 </select>
1026 </td>";
1027 }
1028 else
1029 $output .= "
1030 <td>{$lang_user['classic']}</td>";
1031 }
1032 $output .="
1033 </tr>
1034 <tr>
1035 <td>{$lang_user['failed_logins_long']}</td>";
1036 if($user_lvl >= $action_permission['update'])
1037 $output .='
1038 <td><input type="text" name="failed" size="42" maxlength="3" value="'.$data['failed_logins'].'" /></td>';
1039 else
1040 $output .= '
1041 <td>'.$data['failed_logins'].'</td>';
1042 $output .="
1043 </tr>
1044 <tr>
1045 <td>{$lang_user['locked']}</td>";
1046 $lock_checked = ($data['locked']) ? " checked=\"checked\"" : "";
1047 if($user_lvl >= $action_permission['update'])
1048 $output .= "
1049 <td><input type=\"checkbox\" name=\"locked\" value=\"1\" $lock_checked/></td>";
1050 else
1051 $output .="
1052 <td></td>";
1053 $output.= '
1054 </tr>
1055 <tr>
1056 <td>'.$lang_user['last_login'].'</td>
1057 <td>'.$data['last_login'].'</td>
1058 </tr>
1059 <tr>
1060 <td>'.$lang_user['online'].'</td>';
1061 $output .= "
1062 <td>".(( $data['active_realm_id'] ) ? $lang_global['yes'] : $lang_global['no'])."</td>
1063 </tr>";
1064 $query = $sqlr->query("SELECT SUM(numchars) FROM realmcharacters WHERE acctid = '$id'");
1065 $tot_chars = $sqlr->result($query, 0);
1066 $query = $sqlc->query("SELECT count(*) FROM `characters` WHERE account = $id");
1067 $chars_on_realm = $sqlc->result($query, 0);
1068 $output .= "
1069 <tr>
1070 <td>{$lang_user['tot_chars']}</td>
1071 <td>$tot_chars</td>
1072 </tr>";
1073 $realms = $sqlr->query("SELECT id, name FROM realmlist");
1074 if ($developer_test_mode && $multi_realm_mode && ($sqlr->num_rows($realms) > 1 && (count($server) > 1) && (count($characters_db) > 1)))
1075 {
1076 require_once("scripts/get_lib.php");
1077 while ($realm = $sqlr->fetch_array($realms))
1078 {
1079 $sqlc->connect($characters_db[$realm[0]]['addr'], $characters_db[$realm[0]]['user'], $characters_db[$realm[0]]['pass'], $characters_db[$realm[0]]['name']);
1080 $query = $sqlc->query("SELECT count(*) FROM `characters` WHERE account = $id");
1081 $chars_on_realm = $sqlc->result($query, 0);
1082 $output .= "
1083 <tr>
1084 <td>{$lang_user['chars_on_realm']} ".get_realm_name($realm[0])."</td>
1085 <td>$chars_on_realm</td>
1086 </tr>";
1087 if ($chars_on_realm)
1088 {
1089 $char_array = $sqlc->query("SELECT guid, name, race, class, level, gender
1090 FROM `characters` WHERE account = $id");
1091 while ($char = $sqlc->fetch_array($char_array))
1092 {
1093 $output .= "
1094 <tr>
1095 <td> '---></td>
1096 <td>
1097 <a href=\"char.php?id=$char[0]&realm=$realm[0]\">$char[1] - <img src='img/c_icons/{$char[2]}-{$char[5]}.gif' onmousemove='toolTip(\"".char_get_race_name($char[2])."\",\"item_tooltip\")' onmouseout='toolTip()' alt=\"\" />
1098 <img src='img/c_icons/{$char[3]}.gif' onmousemove='toolTip(\"".char_get_class_name($char[3])."\",\"item_tooltip\")' onmouseout='toolTip()' alt=\"\"/> - lvl ".char_get_level_color($char[4])."</a>
1099 </td>
1100 </tr>";
1101 }
1102 }
1103 }
1104 }
1105 else
1106 {
1107 $query = $sqlc->query("SELECT count(*) FROM `characters` WHERE account = $id");
1108 $chars_on_realm = $sqlc->result($query, 0);
1109 $output .= "
1110 <tr>
1111 <td>{$lang_user['chars_on_realm']}</td>
1112 <td>$chars_on_realm</td>
1113 </tr>";
1114 if ($chars_on_realm)
1115 {
1116 $char_array = $sqlc->query("SELECT guid,name,race,class, level, gender FROM `characters` WHERE account = $id");
1117 while ($char = $sqlc->fetch_array($char_array))
1118 {
1119 $output .= "
1120 <tr>
1121 <td> '---></td>
1122 <td>
1123 <a href=\"char.php?id=$char[0]\">$char[1] - <img src='img/c_icons/{$char[2]}-{$char[5]}.gif' onmousemove='toolTip(\"".char_get_race_name($char[2])."\",\"item_tooltip\")' onmouseout='toolTip()' alt=\"\" />
1124 <img src='img/c_icons/{$char[3]}.gif' onmousemove='toolTip(\"".char_get_class_name($char[3])."\",\"item_tooltip\")' onmouseout='toolTip()' alt=\"\"/> - lvl ".char_get_level_color($char[4])."</a>
1125 </td>
1126 </tr>";
1127 }
1128 }
1129 }
1130 $output .= "
1131 <tr>
1132 <td>";
1133 if($user_lvl >= $action_permission['delete'])
1134 makebutton($lang_user['del_acc'], "user.php?action=del_user&check%5B%5D=$id\" type=\"wrn",130);
1135 $output .= "
1136 </td>
1137 <td>";
1138 if($user_lvl >= $action_permission['update'])
1139 makebutton($lang_user['update_data'], "javascript:do_submit_data()",130);
1140 makebutton($lang_global['back'], "javascript:window.history.back()\" type=\"def",130);
1141 $output .= "
1142 </td>
1143 </tr>
1144 </table>
1145 </form>
1146 </fieldset>
1147 <br /><br />
1148 </center>
1149";
1150
1151 }
1152 else error($lang_global['err_no_user']);
1153
1154}
1155
1156
1157//############################################################################################################
1158// DO EDIT USER
1159//############################################################################################################
1160function doedit_user()
1161{
1162 global $lang_global, $realm_db, $mmfpm_db, $user_lvl, $user_name, $action_permission;
1163 valid_login($action_permission['update']);
1164 if ( (!isset($_POST['pass'])||($_POST['pass'] === ''))
1165 && (!isset($_POST['mail'])||($_POST['mail'] === ''))
1166 && (!isset($_POST['expansion'])||($_POST['expansion'] === ''))
1167 && (!isset($_POST['referredby'])||($_POST['referredby'] === '')) )
1168 redirect("user.php?action=edit_user&&id={$_POST['id']}&error=1");
1169
1170 $sqlr = new SQL;
1171 $sqlr->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
1172
1173 $id = $sqlr->quote_smart($_POST['id']);
1174 $username = $sqlr->quote_smart($_POST['username']);
1175 $banreason = $sqlr->quote_smart($_POST['banreason']);
1176 $pass = $sqlr->quote_smart($_POST['pass']);
1177 $user_pass_change = ($pass != sha1(strtoupper($username).":******")) ? "username='$username',sha_pass_hash='$pass'," : "";
1178
1179 $mail = (isset($_POST['mail']) && $_POST['mail'] != '') ? $sqlr->quote_smart($_POST['mail']) : "";
1180 $failed = (isset($_POST['failed'])) ? $sqlr->quote_smart($_POST['failed']) : 0;
1181 $gmlevel = (isset($_POST['gmlevel'])) ? $sqlr->quote_smart($_POST['gmlevel']) : 0;
1182 $expansion = (isset($_POST['expansion'])) ? $sqlr->quote_smart($_POST['expansion']) : 1;
1183 $banned = (isset($_POST['banned'])) ? $sqlr->quote_smart($_POST['banned']) : 0;
1184 $locked = (isset($_POST['locked'])) ? $sqlr->quote_smart($_POST['locked']) : 0;
1185 $referredby = $sqlr->quote_smart(trim($_POST['referredby']));
1186
1187 //make sure username/pass at least 4 chars long and less than max
1188 if ((strlen($username) < 4) || (strlen($username) > 15))
1189 redirect("user.php?action=edit_user&id=$id&error=8");
1190
1191 if ($gmlevel >= $user_lvl)
1192 redirect("user.php?action=edit_user&&id={$_POST['id']}&error=16");
1193 require_once("libs/valid_lib.php");
1194 if (!valid_alphabetic($username))
1195 redirect("user.php?action=edit_user&error=9&id=$id");
1196 //restricting accsess to lower gmlvl
1197 $result = $sqlr->query("SELECT gmlevel,username FROM account WHERE id = '$id'");
1198 if (($user_lvl <= $sqlr->result($result, 0, 'gmlevel')) && ($user_name != $sqlr->result($result, 0, 'username')))
1199 redirect("user.php?error=14");
1200 if (!$banned)
1201 $sqlr->query("DELETE FROM account_banned WHERE id='$id'");
1202 else
1203 {
1204 $result = $sqlr->query("SELECT count(*) FROM account_banned WHERE id = '$id'");
1205 if(!$sqlr->result($result, 0))
1206 $sqlr->query("INSERT INTO account_banned (id, bandate, unbandate, bannedby, banreason, active)
1207 VALUES ($id, ".time().",".(time()+(365*24*3600)).",'$user_name','$banreason', 1)");
1208 }
1209 $sqlr->query("UPDATE account SET email='$mail', $user_pass_change v=0,s=0,failed_logins='$failed',locked='$locked',gmlevel='$gmlevel',expansion='$expansion' WHERE id=$id");
1210 if (doupdate_referral($referredby, $id) || $sqlr->affected_rows())
1211 redirect("user.php?action=edit_user&error=13&id=$id");
1212 else
1213 redirect("user.php?action=edit_user&error=12&id=$id");
1214}
1215
1216function doupdate_referral($referredby, $user_id)
1217{
1218 global $realm_db, $mmfpm_db, $characters_db, $realm_id;
1219 $sqlm = new SQL;
1220 $sqlm->connect($mmfpm_db['addr'], $mmfpm_db['user'], $mmfpm_db['pass'], $mmfpm_db['name']);
1221 $sqlc = new SQL;
1222 $sqlc->connect($characters_db[$realm_id]['addr'], $characters_db[$realm_id]['user'], $characters_db[$realm_id]['pass'], $characters_db[$realm_id]['name']);
1223 $sqlr = new SQL;
1224 $sqlr->connect($realm_db['addr'], $realm_db['user'], $realm_db['pass'], $realm_db['name']);
1225
1226 $result = $sqlm->fetch_row($sqlm->query("SELECT InvitedBy FROM point_system_invites WHERE PlayersAccount = '$user_id'"));
1227 $result = $result[0];
1228
1229 if ($result == NULL)
1230 {
1231 $referred_by = $sqlc->fetch_row($sqlc->query("SELECT guid FROM characters WHERE name = '$referredby'"));
1232 $referred_by = $referred_by[0];
1233
1234 if ($referred_by != NULL)
1235 {
1236 $char = $sqlc->fetch_row($sqlc->query("SELECT account FROM characters WHERE guid = '$referred_by'"));
1237 $result = $sqlr->fetch_row($sqlr->query("SELECT id FROM account WHERE id = '$char'"));
1238 $result = $result[0];
1239 if ($result != $user_id)
1240 {
1241 $sqlm->query("INSERT INTO point_system_invites (PlayersAccount, InvitedBy, InviterAccount) VALUES ('$user_id', '$referred_by', '$result')");
1242 return true;
1243 }
1244 else
1245 return false;
1246 }
1247 }
1248}
1249
1250
1251//########################################################################################################################
1252// MAIN
1253//########################################################################################################################
1254$err = (isset($_GET['error'])) ? $_GET['error'] : NULL;
1255
1256$output .= "
1257 <div class=\"top\">";
1258
1259// load language
1260$lang_user = lang_user();
1261
1262// defines the title header in error cases
1263switch ($err)
1264{
1265 case 1:
1266 $output .= "
1267 <h1><font class=\"error\">{$lang_global['empty_fields']}</font></h1>";
1268 break;
1269 case 2:
1270 $output .= "
1271 <h1><font class=\"error\">{$lang_global['err_no_search_passed']}</font></h1>";
1272 break;
1273 case 3:
1274 $output .= "
1275 <h1><font class=\"error\">{$lang_user['search_results']}</font></h1>";
1276 break;
1277 case 4:
1278 $output .= "
1279 <h1><font class=\"error\">{$lang_user['acc_creation_failed']}</font></h1>";
1280 break;
1281 case 5:
1282 $output .= "
1283 <h1>{$lang_user['acc_created']}</h1>";
1284 break;
1285 case 6:
1286 $output .= "
1287 <h1><font class=\"error\">{$lang_user['nonidentical_passes']}</font></h1>";
1288 break;
1289 case 7:
1290 $output .= "
1291 <h1><font class=\"error\">{$lang_user['user_already_exist']}</font></h1>";
1292 break;
1293 case 8:
1294 $output .= "
1295 <h1><font class=\"error\">{$lang_user['username_pass_too_long']}</font></h1>";
1296 break;
1297 case 9:
1298 $output .= "
1299 <h1><font class=\"error\">{$lang_user['use_only_eng_charset']}</font></h1>";
1300 break;
1301 case 10:
1302 $output .= "
1303 <h1><font class=\"error\">{$lang_user['no_value_passed']}</font></h1>";
1304 break;
1305 case 11:
1306 $output .= "
1307 <h1>{$lang_user['edit_acc']}</h1>";
1308 break;
1309 case 12:
1310 $output .= "
1311 <h1><font class=\"error\">{$lang_user['update_failed']}</font></h1>";
1312 break;
1313 case 13:
1314 $output .= "
1315 <h1>{$lang_user['data_updated']}</h1>";
1316 break;
1317 case 14:
1318 $output .= "
1319 <h1><font class=\"error\">{$lang_user['you_have_no_permission']}</font></h1>";
1320 break;
1321 case 15:
1322 $output .= "
1323 <h1><font class=\"error\">{$lang_user['acc_backedup']}</font></h1>";
1324 break;
1325 case 16:
1326 $output .= "
1327 <h1><font class=\"error\">{$lang_user['you_have_no_permission_to_set_gmlvl']}</font></h1>";
1328 break;
1329 default: //no error
1330 $output .= "
1331 <h1>{$lang_user['browse_acc']}</h1>";
1332}
1333unset($err);
1334
1335$output .= "
1336 </div>";
1337
1338$action = (isset($_GET['action'])) ? $_GET['action'] : NULL;
1339
1340switch ($action)
1341{
1342 case "add_new":
1343 add_new();
1344 break;
1345 case "doadd_new":
1346 doadd_new();
1347 break;
1348 case "edit_user":
1349 edit_user();
1350 break;
1351 case "doedit_user":
1352 doedit_user();
1353 break;
1354 case "del_user":
1355 del_user();
1356 break;
1357 case "dodel_user":
1358 dodel_user();
1359 break;
1360 case "backup_user":
1361 backup_user();
1362 break;
1363 default:
1364 browse_users($sqlr, $sqlc);
1365}
1366
1367unset($action);
1368unset($action_permission);
1369unset($lang_user);
1370
1371require_once("footer.php");
1372
1373?>