260 lines
8.0 KiB
PHP
Executable File
260 lines
8.0 KiB
PHP
Executable File
<?php
|
|
function Admin($report)
|
|
{
|
|
$user_digest = VerifyUser();
|
|
|
|
$return_html = "<div class='admin_div'>\n<br />$report<hr />\n\n";
|
|
|
|
if( !$user_digest ) { $return_html .= AdminLogin(); }
|
|
else if( $user_digest ) { $return_html .= AdminIndex(); }
|
|
|
|
$return_html .= "</div>\n";
|
|
|
|
return( $return_html );
|
|
}
|
|
|
|
function AdminLogin()
|
|
{
|
|
$login_html = "
|
|
<form action='indextest.php?page=admin' method='post' style='position:relative;z-index:10;'>
|
|
<table cellpadding='2' cellspacing='0' border='0'>
|
|
<tr>
|
|
<td align='right'>Login:</td><td><input type='text' size='30' name='user' /></td>
|
|
</tr>
|
|
<tr>
|
|
<td align='right'>Password:</td><td><input type='password' size='30' name='password' /></td>
|
|
</tr>
|
|
<tr>
|
|
<td align='right' colspan='2'><input type='submit' value='Login' name='submit' /></td>
|
|
</tr>
|
|
</table>
|
|
</form>
|
|
";
|
|
|
|
return($login_html);
|
|
}
|
|
|
|
function AdminIndex()
|
|
{
|
|
$post_types = array("news","requests","big_requests","great_stuff","austria_trip");
|
|
$post_tables = array("news" => "news_posts",
|
|
"requests" => "requests_posts",
|
|
"big_requests" => "bigrequests_posts",
|
|
"great_stuff" => "greatstuff_posts",
|
|
'austria_trip' => 'austriatrip_posts'
|
|
);
|
|
|
|
$index_html = "
|
|
<div class='item_title'>Admin Panel</div>
|
|
<form action='indextest.php?page=admin' method='post'>
|
|
<input type='hidden' name='cmd' value='addpost' />
|
|
<div class='sub_title'>Add Post</div>
|
|
<div class='item_content'>
|
|
post type:<br />
|
|
<select name='type' id='type'>
|
|
<option value='news'>News</option>
|
|
<option value='requests'>Normal Prayer Request</option>
|
|
<option value='big_requests'>Big Prayer Request</option>
|
|
<option value='great_stuff'>Great Stuff</option>
|
|
<option value='austria_trip'>Austria Trip</option>
|
|
</select>
|
|
<br />
|
|
title:<br />
|
|
<input type='text' size='30' name='title' /><br />
|
|
author:<br />
|
|
<input type='text' size='20' name='author' /><br />
|
|
content:<br />
|
|
<textarea rows='15' cols='58' name='content'></textarea>
|
|
<br />
|
|
<input type='submit' value='add post' />
|
|
</div>
|
|
</form>
|
|
|
|
|
|
<form action='indextest.php?page=admin' method='post'>
|
|
<div class='sub_title'>Edit Posts</div>
|
|
<div class='item_content'>
|
|
post type:<br />
|
|
<select name='type' id='edit_type' onchange='EditDisplay()'>
|
|
<option value='news'>News</option>
|
|
<option value='requests'>Normal Prayer Request</option>
|
|
<option value='big_requests'>Big Prayer Request</option>
|
|
<option value='great_stuff'>Great Stuff</option>
|
|
<option value='austria_trip'>Austria Trip</option>
|
|
</select>
|
|
";
|
|
|
|
foreach($post_types as $type)
|
|
{
|
|
if($type == 'news') { $visible = "style='visibility:visible;'"; }
|
|
else { $visible = "style='visibility:hidden;'"; }
|
|
|
|
$index_html .= "
|
|
<div id='$type' $visible>
|
|
Select $type post:<br />
|
|
<select name='{$post_tables[$type]}'>
|
|
<option value='0'>None</option>";
|
|
|
|
$q_posts = mysql_query("SELECT ID,Title FROM {$post_tables[$type]} ORDER BY ID Desc;");
|
|
while( $post = mysql_fetch_assoc($q_posts) )
|
|
{ $index_html .= "\t\t\t<option value='{$post['ID']}'>{$post['Title']}</option>\n"; }
|
|
|
|
$index_html .= "
|
|
</select>
|
|
</div>
|
|
";
|
|
}
|
|
|
|
$index_html .= "
|
|
<br />
|
|
<input type='radio' name='cmd' value='editpost' checked='checked' /> edit post<br />
|
|
<input type='radio' name='cmd' value='deletepost' /> delete post
|
|
<br /> <br />
|
|
<input type='submit' value='edit/delete selected post' />
|
|
</div>
|
|
</form>
|
|
";
|
|
|
|
return($index_html);
|
|
}
|
|
|
|
function VerifyUser()
|
|
{
|
|
$digest = mysql_query("SELECT Value FROM rlinks_security WHERE Variable = 'Digest';");
|
|
$digest = mysql_fetch_assoc($digest);
|
|
$digest = $digest['Value'];
|
|
|
|
if( $_COOKIE['RLINKSDIGEST'] == $digest )
|
|
{ return $digest; }
|
|
else if( $_POST['user'] == "" or $_POST['password'] == "" )
|
|
{ return false; }
|
|
|
|
$phrase = mysql_query("SELECT Value FROM rlinks_security WHERE Variable = 'Phrase';");
|
|
$phrase = mysql_fetch_assoc($phrase);
|
|
$phrase = $phrase['Value'];
|
|
|
|
$user_password = $_POST['password'];
|
|
$user_login = $_POST['user'];
|
|
|
|
$user_digest = sha1("$user_login^$user_password^$phrase");
|
|
|
|
if( $user_digest == $digest )
|
|
{
|
|
return $user_digest;
|
|
}
|
|
else
|
|
{ return false; }
|
|
}
|
|
|
|
function AddPost($type)
|
|
{
|
|
$dbs = array( 'news' => 'news_posts',
|
|
'requests' => 'requests_posts',
|
|
'big_requests' => 'bigrequests_posts',
|
|
'great_stuff' => 'greatstuff_posts',
|
|
'austria_trip' => 'austriatrip_posts'
|
|
);
|
|
|
|
if( !(VerifyUser()) ) { return; }
|
|
|
|
$content = addslashes($_POST['content']);
|
|
$author = addslashes($_POST['author']);
|
|
$title = addslashes($_POST['title']);
|
|
|
|
$query = mysql_query("INSERT INTO {$dbs[$type]} (Title,Author,Content,Date,NumComments) VALUES ('$title','$author','$content',UNIX_TIMESTAMP(NOW()),0);");
|
|
|
|
if( $query ) { return "Successfully added post."; }
|
|
else { return "Could not add post."; }
|
|
}
|
|
|
|
function DeletePost($type)
|
|
{
|
|
$dbs = array( 'news' => 'news_posts',
|
|
'requests' => 'requests_posts',
|
|
'big_requests' => 'bigrequests_posts',
|
|
'great_stuff' => 'greatstuff_posts',
|
|
'austria_trip' => 'austriatrip_posts'
|
|
);
|
|
|
|
if( !(VerifyUser()) ) { return; }
|
|
|
|
$query = mysql_query("DELETE FROM {$dbs[$type]} WHERE ID = {$_POST[$dbs[$type]]} LIMIT 1;" );
|
|
|
|
if($query) { return "Post successfully deleted."; }
|
|
else { return "Post could not be deleted."; }
|
|
}
|
|
|
|
function EditPost($type)
|
|
{
|
|
$dbs = array( 'news' => 'news_posts',
|
|
'requests' => 'requests_posts',
|
|
'big_requests' => 'bigrequests_posts',
|
|
'great_stuff' => 'greatstuff_posts',
|
|
'austria_trip' => 'austriatrip_posts'
|
|
);
|
|
|
|
if( !(VerifyUser()) ) { return; }
|
|
|
|
if( !(isset($_POST['doediting'])) )
|
|
{
|
|
$edit_html = "
|
|
<div align='left' style='position:relative;z-index:10;'>
|
|
<form action='indextest.php?page=admin' method='post'>
|
|
<input type='hidden' name='doediting' value='1' />
|
|
<input type='hidden' name='cmd' value='editpost' />
|
|
<input type='hidden' name='type' value='$type' />
|
|
";
|
|
|
|
$post_id = $_POST[$dbs[$type]];
|
|
$post = mysql_query("SELECT * FROM {$dbs[$type]} WHERE ID = $post_id LIMIT 1;");
|
|
$post = mysql_fetch_assoc( $post );
|
|
|
|
$post['Title'] = stripslashes($post['Title']);
|
|
$post['Content'] = stripslashes($post['Content']);
|
|
$post['Author'] = stripslashes($post['Author']);
|
|
|
|
$edit_html .="
|
|
<div class='sub_title'>Edit Post</div>
|
|
<input type='hidden' name='id' value='{$_POST[$dbs[$type]]}' />
|
|
Title: <br />
|
|
<input type='text' name='title' value='{$post['Title']}' /><br />
|
|
Author: <br />
|
|
<input type='text' name='author' value='{$post['Author']}' /><br />
|
|
Content: <br />
|
|
<textarea rows='15' cols='58' name='content'>{$post['Content']}</textarea>
|
|
<br /> <br />
|
|
";
|
|
|
|
$edit_html .= "
|
|
<input type='submit' value='make changes to post' />
|
|
</form>
|
|
</div>
|
|
<hr />
|
|
";
|
|
}
|
|
else
|
|
{
|
|
if( isset($_POST['id']) )
|
|
{
|
|
$content = addslashes($_POST['content']);
|
|
$title = addslashes($_POST['title']);
|
|
$author = addslashes($_POST['author']);
|
|
|
|
$query = mysql_query("UPDATE {$dbs[$type]} SET Content = '$content', Title = '$title', Author = '$author'
|
|
WHERE ID = {$_POST['id']} LIMIT 1;");
|
|
|
|
print mysql_error();
|
|
|
|
if( $query ) { $edit_html .= "Successfully edited post.<br />\n\n"; }
|
|
else { $edit_html .= "Could not edit post.<br />\n\n"; }
|
|
}
|
|
}
|
|
|
|
return( $edit_html );
|
|
}
|
|
|
|
function SetAdminCookie($p_digest)
|
|
{
|
|
setcookie('RLINKSDIGEST',$p_digest,time() + (30*60),'/');
|
|
}
|
|
?>
|