Source for file mvblog_admin.php

Documentation is available at mvblog_admin.php

  1. <?php
  2. /**
  3.  * MvBlog -- An open source no-nosense blogtool
  4.  *
  5.  * Copyright (C) 2005-2007, Michiel van Baak
  6.  * Michiel van Baak <mvanbaak@users.sourceforge.net>
  7.  *
  8.  * See http://dev.mvblog.org for more information on MvBlog.
  9.  * That page also provides Bugtrackers, Filereleases etc.
  10.  *
  11.  * This program is free software, distributed under the terms of
  12.  * the GNU General Public License Version 2. See the LICENSE file
  13.  * at the top of the source tree.
  14.  *
  15.  * @package MvBlog
  16.  * @author Michiel van Baak
  17.  * @version %%VERSION%%
  18.  * @copyright 2005-2007 Michiel van Baak
  19.  */
  20.  
  21. /**
  22.  * Class that holds methods to create admin site.
  23.  * @package MvBlog
  24.  */
  25. Class MvBlog_admin extends MvBlog_common {
  26.  
  27.     /* constants */
  28.  
  29.     /* variables */
  30.     public $lang = "en_US";
  31.     public $languages = array(
  32.         "en_US" => "english",
  33.         "nl_NL" => "dutch",
  34.         "sv_SE" => "swedish",
  35.     );
  36.     private $_selected_menuitem;
  37.     private $_selected_submenuitem;
  38.  
  39.     /* methods */
  40.  
  41.     /* __construct {{{ */
  42.     /**
  43.      * Class constructor. Check some defaults etc
  44.      */
  45.     public function __construct($basedir="") {
  46.         /* first do the common construct tasks */
  47.         parent::__construct($basedir."plugins/", 1);
  48.         $this->webroot = $this->webroot."admin/";
  49.  
  50.         if (array_key_exists("action", $_POST))
  51.             $action = $_POST["action"];
  52.         else
  53.             $action = "";
  54.  
  55.         /* check if we are logged in */
  56.         if (!array_key_exists("author_id", $_SESSION) && $action != "check_login")
  57.             $this->show_login();
  58.         if (array_key_exists("action", $_REQUEST)) {
  59.             switch($_REQUEST["action"]) {
  60.             case "show_cats" :
  61.             case "edit_cat" :
  62.                 $this->_selected_menuitem = "manage";
  63.                 $this->_selected_submenuitem = "categories";
  64.                 break;
  65.             case "show_dossiers" :
  66.             case "edit_dossier" :
  67.                 $this->_selected_menuitem = "manage";
  68.                 $this->_selected_submenuitem = "dossiers";
  69.                 break;
  70.             case "show_authors" :
  71.             case "edit_author" :
  72.                 $this->_selected_menuitem = "users";
  73.                 if (array_key_exists("id", $_REQUEST) && $_REQUEST["id"] == $_SESSION["author_id"])
  74.                     $this->_selected_submenuitem = "my";
  75.                 else
  76.                     $this->_selected_submenuitem = "authors";
  77.                 break;
  78.             case "show_users" :
  79.             case "edit_user" :
  80.                 $this->_selected_menuitem = "users";
  81.                 $this->_selected_submenuitem = "users";
  82.                 break;
  83.             case "show_posts" :
  84.             case "edit_post" :
  85.                 $this->_selected_menuitem = "manage";
  86.                 $this->_selected_submenuitem = "posts";
  87.                 break;
  88.             case "show_comments" :
  89.             case "edit_comment" :
  90.                 $this->_selected_menuitem = "manage";
  91.                 $this->_selected_submenuitem = "comments";
  92.                 break;
  93.             case "show_plugins" :
  94.             case "config_plugin" :
  95.             case "edit_plugin_setting" :
  96.             case "save_plugin_setting" :
  97.                 $this->_selected_menuitem = "plugins";
  98.                 break;
  99.             case "show_settings" :
  100.             case "save_settings" :
  101.                 $this->_selected_menuitem = "settings";
  102.                 $this->_selected_submenuitem = "settings";
  103.                 break;
  104.             case "show_menuitems" :
  105.                 $this->_selected_menuitem = "settings";
  106.                 $this->_selected_submenuitem = "menuitems";
  107.                 break;
  108.             case "show_about" :
  109.                 $this->_selected_menuitem = "index";
  110.                 $this->_selected_submenuitem = "about";
  111.                 break;
  112.             default :
  113.                 $this->_selected_menuitem = "index";
  114.                 $this->_selected_submenuitem = "index";
  115.                 break;
  116.             }
  117.         } else {
  118.             $this->_selected_menuitem = "index";
  119.             $this->_selected_submenuitem = "index";
  120.         }
  121.     }
  122.     /* }}} */
  123.     /* _strip_tags {{{ */
  124.     /**
  125.      * strip all html tags cept for some tags we like.
  126.      * The tags we leave will be stripped from attributes we dont like.
  127.      *
  128.      * @param string The text to process
  129.      * @return string The text with only allowed tags.
  130.      */
  131.     private function _strip_tags($text) {
  132.         $allowed_tags  = "<a><abbr><acronym><address><area><b><bdo><big><blockquote><br><caption><center><cite>";
  133.         $allowed_tags .= "<code><col><dd><del><dir><div><dfn><dl><dt><fieldset><font><h1><h2><h3><h4><h5><h6>";
  134.         $allowed_tags .= "<hr><i><img><ins><kbd><li><link><menu><ol><p><pre><q><s><samp><small><span><strike>";
  135.         $allowed_tags .= "<strong><style><sub><sup><table><tbody><td><tfoot><th><thead><tr><tt><u><ul><var><em>";
  136.         $text = strip_tags($text, $allowed_tags);
  137.         return @preg_replace('/<(.*?)>/ie', "'<'.$this->_strip_attributes('\\1').'>'", $text);
  138.     }
  139.     /* }}} */
  140.     /* _strip_attributes {{{ */
  141.     /**
  142.      * strip evil attributes from tags
  143.      *
  144.      * @param string The text to process
  145.      * @return string The processed text
  146.      */
  147.     private function _strip_attributes($text) {
  148.         $attr_to_strip = array(
  149.             "javascript:",
  150.             "onclick",
  151.             "ondblclick",
  152.             "onmousedown",
  153.             "onmouseup",
  154.             "onmouseover"
  155.         );
  156.         foreach ($attr_to_strip as $attribute) {
  157.             $text = stripslashes(preg_replace("/$attribute/i", "forbidden", $text));
  158.         }
  159.         return $text;
  160.     }
  161.     /* }}} */
  162.     /* show_login {{{ */
  163.     /**
  164.      * Show admin login screen
  165.      */
  166.     public function show_login() {
  167.         $this->html_header("Admin login");
  168.         ?>
  169.         <form name="loginform" method="post" action="index.php">
  170.         <input type="hidden" name="action" value="check_login" />
  171.         <div id="if_container">
  172.             <div id="if_title"></div>
  173.             <div id="if_bar1"></div>
  174.             <div id="if_page_header">
  175.                 <h1 class="page_title">login</h1>
  176.             </div>
  177.             <div id="if_page">
  178.                 <div class="log_post">
  179.                     <table border="0" cellspacing="3" cellpadding="0" align="center"><tr>
  180.                         <td align="right">username:</td><td><input type="text" id="loginname" name="login[name]" /></td>
  181.                     </tr><tr>
  182.                         <td align="right">password:</td><td><input type="password" name="login[password]" /></td>
  183.                     </tr><tr>
  184.                         <td colspan="2" align="center"><input type="submit" value="login" /></td>
  185.                     </tr></table>
  186.                 </div>
  187.         </form>
  188.         <script language="Javascript" type="text/javascript">
  189.             document.loginform.loginname.focus();
  190.         </script>
  191.         <?php
  192.         $this->html_footer();
  193.         exit;
  194.     }
  195.     /* }}} */
  196.     /* check_login {{{ */
  197.     /**
  198.      * Check user supplied data against admin database
  199.      *
  200.      * @param array name and password to check
  201.      */
  202.     public function check_login($login) {
  203.         $query = sprintf("SELECT * FROM authors WHERE login = '%s' AND password = '%s' AND active = 1",
  204.             preg_quote($login["name"], "'"),
  205.             preg_quote($login["password"], "'")
  206.         );
  207.         $res =& $this->db->query($query);
  208.         if (PEAR::isError($res)) {
  209.             die($res->getUserInfo());
  210.         }
  211.         if ($res->numRows()) {
  212.             $row = $res->fetchRow(MDB2_FETCHMODE_ASSOC);
  213.             $_SESSION["author_id"]       = $row["id"];
  214.             $_SESSION["author_name"]     = $row["login"];
  215.             $_SESSION["author_fullname"] = $row["fullname"];
  216.             $_SESSION["author_email"]    = $row["email"];
  217.             $_SESSION["author_website"]  = $row["website"];
  218.             $_SESSION["blog_user"]       = 1;
  219.             header("Location: index.php");
  220.         } else {
  221.             $this->show_login();
  222.         }
  223.     }
  224.     /* }}} */
  225.     /* logout {{{ */
  226.     /**
  227.      * Logout user
  228.      */
  229.     public function logout() {
  230.         session_destroy();
  231.         header("Location: index.php");
  232.     }
  233.     /* }}} */
  234.     /* show_index {{{ */
  235.     /**
  236.      * Show nice welcome screen for admin
  237.      */
  238.     public function show_index() {
  239.         ?>
  240.         <script language="Javascript1.2" type="text/javascript">
  241.             var reloadinterval = setInterval("document.location.href='index.php';", 60000);
  242.         </script>
  243.         <p class="first"><?php echo gettext("Welcome to MvBlog"); ?> "<?php echo $_SESSION["author_fullname"]; ?>".</p>
  244.         <p class="first">
  245.             <h3><?php echo gettext("Use these links to get started"); ?>:</h3>
  246.             <ul>
  247.                 <li><a href="index.php?action=edit_post&id=0"><?php echo gettext("write post"); ?></a></li>
  248.                 <li><a href="index.php?action=edit_author&id=<?php echo $_SESSION["author_id"];?>"><?php echo gettext("update your account settings"); ?></a></li>
  249.             </ul>
  250.         </p>
  251.         <p class="first">
  252.             <h3><?php echo gettext("5 latest posts"); ?></h3>
  253.             <ul>
  254.                 <?php
  255.                 $sql = "SELECT id, title, last_modified, modified_by, date, authors_id FROM articles ORDER BY date DESC LIMIT 5";
  256.                 $res =& $this->db->query($sql);
  257.                 while ($row = $res->fetchRow(MDB2_FETCHMODE_ASSOC)) {
  258.                     if (!$row["last_modified"])
  259.                         $row["last_modified"] = $row["date"];
  260.                     if (!$row["modified_by"])
  261.                         $row["modified_by"] = $row["authors_id"];
  262.                     echo "<li><a href=\"index.php?action=edit_post&id=".$row["id"]."\">".$row["title"]."</a> (modified ".date("d-m-Y H:i", $row["last_modified"])." by ".$this->authors[$row["modified_by"]]["fullname"].")</li>\n";
  263.                 }
  264.                 ?>
  265.             </ul>
  266.         </p>
  267.         <p class="first">
  268.             <h3><?php echo gettext("5 latest comments"); ?></h3>
  269.             <ul>
  270.                 <?php
  271.                 $sql = "SELECT id, title, date, name, articles_id FROM comments ORDER BY date DESC LIMIT 5";
  272.                 $res =& $this->db->query($sql);
  273.                 while ($row = $res->fetchRow(MDB2_FETCHMODE_ASSOC)) {
  274.                     if (!$row["title"])
  275.                         $row["title"] = "[".gettext("no title")."]";
  276.                     $q = sprintf("SELECT title FROM articles WHERE id = %d", $row["articles_id"]);
  277.                     $r =& $this->db->query($q);
  278.                     $art = $r->fetchRow(MDB2_FETCHMODE_ASSOC);
  279.                     echo "<li><a href=\"../index.php?action=view&id=".$row["articles_id"]."#comment".$row["id"]."\">".$row["title"]."</a> - ".$art["title"]." (".date("d-m-Y H:i", $row["date"])." by ".$row["name"].")</li>\n";
  280.                 }
  281.                 ?>
  282.             </ul>
  283.         </p>
  284.         <p class="first">
  285.             <h3><?php echo gettext("latest mvblog news"); ?></h3>
  286.             <?php
  287.             $oldtimeout = ini_set("default_socket_timeout", 5);
  288.             if (!($rss = file_get_contents("http://www.mvblog.org/blog/common/rdf.php"))) {
  289.                 echo "Your php setup does not allow opening remote files.<br />For the latest news and updates visit <a href=\"http://www.mvblog.org\">http://www.mvblog.org</a>";
  290.             } else {
  291.                 echo "<ul>";
  292.                 require("rssparser.php");
  293.                 $rssparser = new RSSParser($rss);
  294.                 $rsscount = 0;
  295.                 foreach ($rssparser->rssItems as $rssItem) {
  296.                     if (strstr($rssItem["dc:subject"], "updates")) {
  297.                         $rsscount++;
  298.                         if ($rsscount > 5)
  299.                             break;
  300.                         echo "<li><a href=\"".$rssItem["link"]."\" target=\"_new\">".$rssItem["title"]."</a> (".date("d-m-Y H:i", $rssItem["dc:date"])." by ".$rssItem["dc:creator"].")</li>";
  301.                     }
  302.                 }
  303.                 echo "</ul>";
  304.             }
  305.             ini_set("default_socket_timeout", $oldtimeout);
  306.             ?>
  307.         </p>
  308.         <?php
  309.     }
  310.     /* }}} */
  311.     /* show_about {{{ */
  312.     /**
  313.      * Show information about the current version etc.
  314.      */
  315.     public function show_about() {
  316.         /* gather some info we want to show */
  317.         $mvblogversion = $this->version;
  318.         if (array_key_exists("dbversion", $this->settings))
  319.             $dbversion = $this->settings["dbversion"];
  320.         else
  321.             $dbversion = gettext("Unknown");
  322.         if (array_key_exists("webroot", $this->settings))
  323.             $webroot = $this->settings["webroot"];
  324.         else
  325.             $webroot = gettext("Unknown");
  326.         if (is_array($this->active_plugins))
  327.             $active_plugins = implode(", ", $this->active_plugins);
  328.         else
  329.             $active_plugins = gettext("None");
  330.         ?>
  331.         <p class="first">
  332.             <h2>Information about this MvBlog instance</h2>
  333.             MvBlog version: <?php echo $mvblogversion; ?><br />
  334.             Database version: <?php echo $dbversion; ?><br />
  335.             Active plugins: <?php echo $active_plugins; ?> <br />
  336.         </p>
  337.         <p class="first">
  338.             MvBlog is created by Michiel van Baak &lt;michiel@mvblog.org&gt;<br />
  339.             With the help of Leonieke Aalders, Sofie van Tendeloo en Ferry Boender.<br />
  340.             Besides those 3 contributers others have helped as well, but those 3 were there from the beginning<br />
  341.             and without them this project would never be this far.<br /><br />
  342.             For more information please visit <a href="http://www.mvblog.org">www.mvblog.org</a><br />
  343.             For documentation please go to the <a href="http://dev.mvblog.org/wiki/EndUserDocumentation">wiki</a><br />
  344.             If you found a bug or need a new feature please report it on <a href="http://dev.mvblog.org">the developement website</a>.
  345.         </p>
  346.         <?php
  347.     }
  348.     /* }}} */
  349.     /* show_admin_menu {{{ */
  350.     /**
  351.      * If user is logged in, show menu
  352.      */
  353.     public function show_admin_menu() {
  354.         if (array_key_exists("author_id", $_SESSION)) {
  355.             ?>
  356.             <div id="if_menu">
  357.                 <a class="if_menu_item" href="../index.php">Site</a>&nbsp;
  358.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "index")      { echo "_act"; } ?>" href="./index.php"><?php echo gettext("Main"); ?></a>&nbsp;
  359.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "manage")     { echo "_act"; } ?>" href="./index.php?action=show_posts"><?php echo gettext("Manage"); ?></a>&nbsp;
  360.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "users")      { echo "_act"; } ?>" href="./index.php?action=show_authors"><?php echo gettext("Users"); ?></a>&nbsp;
  361.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "settings")   { echo "_act"; } ?>" href="./index.php?action=show_settings"><?php echo gettext("Settings"); ?></a>&nbsp;
  362.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "plugins")    { echo "_act"; } ?>" href="./index.php?action=show_plugins"><?php echo gettext("Plugins"); ?></a>&nbsp;
  363.                 <a class="if_menu_item<?php if ($this->_selected_menuitem == "import")     { echo "_act"; } ?>" href="./index.php?action=show_import"><?php echo gettext("Import"); ?></a>&nbsp;
  364.                 <a class="if_menu_item" href="./index.php?action=logout"><?php echo gettext("Logout"); ?></a>&nbsp;
  365.             </div>
  366.             <div id="if_submenu">
  367.                 <?php
  368.                 switch ($this->_selected_menuitem) {
  369.                 case "manage" :
  370.                     ?>
  371.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "posts")      { echo "_act"; } ?>" href="./index.php?action=show_posts"><?php echo gettext("Posts"); ?></a>&nbsp;
  372.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "dossiers")   { echo "_act"; } ?>" href="./index.php?action=show_dossiers"><?php echo gettext("Dossiers"); ?></a>&nbsp;
  373.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "categories") { echo "_act"; } ?>" href="./index.php?action=show_cats"><?php echo gettext("Categories"); ?></a>&nbsp;
  374.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "comments")   { echo "_act"; } ?>" href="./index.php?action=show_comments"><?php echo gettext("Comments"); ?></a>&nbsp;
  375.                     <?php
  376.                     break;
  377.                 case "users" :
  378.                     ?>
  379.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "authors")    { echo "_act"; } ?>" href="./index.php?action=show_authors"><?php echo gettext("Authors"); ?></a>&nbsp;
  380.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "users")      { echo "_act"; } ?>" href="./index.php?action=show_users"><?php echo gettext("Users"); ?></a>&nbsp;
  381.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "my")         { echo "_act"; } ?>" href="./index.php?action=edit_author&id=<?php echo $_SESSION["author_id"];?>"><?php echo gettext("Your profile"); ?></a>&nbsp;
  382.                     <?php
  383.                     break;
  384.                 case "settings" :
  385.                     ?>
  386.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "settings")   { echo "_act"; } ?>" href="./index.php?action=show_settings"><?php echo gettext("Settings"); ?></a>&nbsp;
  387.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "menuitems")  { echo "_act"; } ?>" href="./index.php?action=show_menuitems"><?php echo gettext("Menu items"); ?></a>&nbsp;
  388.                     <?php
  389.                     break;
  390.                 case "index" :
  391.                     ?>
  392.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "index")      { echo "_act"; } ?>" href="./index.php"><?php echo gettext("Main"); ?></a>&nbsp;
  393.                     <a class="if_submenu_item<?php if ($this->_selected_submenuitem == "about")      { echo "_act"; } ?>" href="./index.php?action=show_about"><?php echo gettext("About"); ?></a>&nbsp;
  394.                     <?php
  395.                     break;
  396.                 default:
  397.                     break;
  398.                 }
  399.                 ?>
  400.             </div>
  401.             <?php
  402.         }
  403.     }
  404.     /* }}} */
  405.     /* show_cats {{{ */
  406.     /**
  407.      * Show overview of available categories
  408.      */
  409.     public function show_cats() {
  410.         $count = 0;
  411.         ?><h1 class="log_post_new"><a href="./index.php?action=edit_cat&amp;id=0"><?php echo gettext("create new"); ?></a></h1><br /><?php
  412.         foreach ($this->categories as $id => $cat) {
  413.             if ($id == 0) continue;
  414.             ?>
  415.             <div class="log_post">
  416.                 <div class="log_post_head">
  417.                     <h1 class="log_post_h1"><a href="?action=edit_cat&amp;id=<?php echo $id; ?>"><?php echo stripslashes($cat["name"]); ?></a></h1>
  418.                     <?php
  419.                         $r =& $this->db->query(sprintf("SELECT COUNT(*) AS count FROM articles WHERE (categories_ids LIKE '%%,%1\$d' OR categories_ids LIKE '%1\$d,%%' OR categories_ids = '%d' OR categories_ids LIKE '%%,%1\$d,%%')", $id));
  420.                         if (PEAR::isError($r)) {
  421.                             die($r->getMessage