FishEye: file osCommerce/branches/hpdl/oscommerce/admin/includes/applications/administrators/administrators.php

Annotated File View

hpdl	1016	1	<?php
		2	/*
		3	$Id: $
		4
		5	osCommerce, Open Source E-Commerce Solutions
		6	http://www.oscommerce.com
		7
		8	Copyright (c) 2006 osCommerce
		9
		10	Released under the GNU General Public License
		11	*/
		12
		13	class osC_Content_Administrators extends osC_Template {
		14
		15	/* Private variables */
		16
		17	var $_module = 'administrators',
hpdl	1070	18	$_page_title = HEADING_TITLE,
hpdl	1130	19	$_page_contents = 'main.php';
hpdl	1016	20
		21	/* Class constructor */
		22
		23	function osC_Content_Administrators() {
		24	if (!isset($_GET['action'])) {
		25	$_GET['action'] = '';
		26	}
		27
		28	if (!isset($_GET['page']) \|\| (isset($_GET['page']) && !is_numeric($_GET['page']))) {
		29	$_GET['page'] = 1;
		30	}
		31
		32	if (!empty($_GET['action'])) {
		33	switch ($_GET['action']) {
		34	case 'save':
		35	$this->_save();
		36	break;
		37
		38	case 'deleteconfirm':
		39	$this->_delete();
		40	break;
		41
hpdl	1125	42	case 'batchSave':
hpdl	1125	43	if ( isset($_POST['batch']) && is_array($_POST['batch']) && !empty($_POST['batch']) ) {
hpdl	1130	44	$this->_page_contents = 'batch_edit.php';
hpdl	1125	45
		46	if ( isset($_POST['subaction']) && ($_POST['subaction'] == 'confirm') ) {
		47	$this->_saveBatch();
		48	}
		49	} else {
		50	$_GET['action'] = '';
		51	}
		52
		53	break;
		54
		55	case 'batchDelete':
		56	if ( isset($_POST['batch']) && is_array($_POST['batch']) && !empty($_POST['batch']) ) {
hpdl	1130	57	$this->_page_contents = 'batch_delete.php';
hpdl	1125	58
		59	if ( isset($_POST['subaction']) && ($_POST['subaction'] == 'confirm') ) {
		60	$this->_deleteBatch();
		61	}
		62	} else {
		63	$_GET['action'] = '';
		64	}
		65
		66	break;
hpdl	1070	67	}
		68	}
		69	}
		70
hpdl	1016	71	/* Private methods */
		72
		73	function _save() {
		74	global $osC_Database, $osC_MessageStack;
		75
hpdl	1070	76	$error = false;
hpdl	1016	77
hpdl	1085	78	$Qcheck = $osC_Database->query('select id from :table_administrators where user_name = :user_name');
hpdl	1016	79	if (isset($_GET['aID']) && is_numeric($_GET['aID'])) {
hpdl	1085	80	$Qcheck->appendQuery('and id != :id limit 1');
hpdl	1085	81	$Qcheck->bindInt(':id', $_GET['aID']);
hpdl	1016	82	}
hpdl	1085	83	$Qcheck->bindTable(':table_administrators', TABLE_ADMINISTRATORS);
		84	$Qcheck->bindValue(':user_name', $_POST['user_name']);
		85	$Qcheck->execute();
hpdl	1016	86
hpdl	1085	87	if ($Qcheck->numberOfRows() < 1) {
hpdl	1085	88	$osC_Database->startTransaction();
hpdl	1016	89
hpdl	1085	90	if (isset($_GET['aID']) && is_numeric($_GET['aID'])) {
		91	$Qadmin = $osC_Database->query('update :table_administrators set user_name = :user_name where id = :id');
		92	$Qadmin->bindInt(':id', $_GET['aID']);
		93	} else {
hpdl	1110	94	$Qadmin = $osC_Database->query('insert into :table_administrators (user_name, user_password) values (:user_name, :user_password)');
hpdl	1110	95	$Qadmin->bindValue(':user_password', osc_encrypt_string(trim($_POST['user_password'])));
hpdl	1085	96	}
		97	$Qadmin->bindTable(':table_administrators', TABLE_ADMINISTRATORS);
		98	$Qadmin->bindValue(':user_name', $_POST['user_name']);
		99	$Qadmin->execute();
hpdl	1070	100
hpdl	1085	101	if ( !$osC_Database->isError() ) {
		102	$id = (isset($_GET['aID']) && is_numeric($_GET['aID']) ? $_GET['aID'] : $osC_Database->nextID());
		103
hpdl	1110	104	if ( isset($_GET['aID']) && is_numeric($_GET['aID']) && !empty($_POST['user_password']) ) {
hpdl	1085	105	$Qadmin = $osC_Database->query('update :table_administrators set user_password = :user_password where id = :id');
		106	$Qadmin->bindTable(':table_administrators', TABLE_ADMINISTRATORS);
		107	$Qadmin->bindValue(':user_password', osc_encrypt_string(trim($_POST['user_password'])));
		108	$Qadmin->bindInt(':id', $id);
		109	$Qadmin->execute();
		110
		111	if ( $osC_Database->isError() ) {
		112	$error = true;
		113	}
hpdl	1070	114	}
hpdl	1085	115	} else {
hpdl	1085	116	$error = true;
hpdl	1070	117	}
hpdl	1016	118
hpdl	1085	119	if ( $error === false ) {
hpdl	1085	120	$modules_array = array();
hpdl	1070	121
hpdl	1085	122	if ( isset($_POST['modules']) ) {
		123	if ( in_array( '*', $_POST['modules'] ) ) {
		124	$_POST['modules'] = array('*');
		125	}
hpdl	1070	126
hpdl	1085	127	foreach ($_POST['modules'] as $module) {
hpdl	1085	128	$modules_array[] = '\'' . $module . '\'';
hpdl	1070	129
hpdl	1085	130	$Qcheck = $osC_Database->query('select administrators_id from :table_administrators_access where administrators_id = :administrators_id and module = :module limit 1');
		131	$Qcheck->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		132	$Qcheck->bindInt(':administrators_id', $id);
		133	$Qcheck->bindValue(':module', $module);
		134	$Qcheck->execute();
hpdl	1070	135
hpdl	1085	136	if ( $Qcheck->numberOfRows() < 1 ) {
		137	$Qinsert = $osC_Database->query('insert into :table_administrators_access (administrators_id, module) values (:administrators_id, :module)');
		138	$Qinsert->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		139	$Qinsert->bindInt(':administrators_id', $id);
		140	$Qinsert->bindValue(':module', $module);
		141	$Qinsert->execute();
hpdl	1070	142
hpdl	1085	143	if ( $osC_Database->isError() ) {
		144	$error = true;
		145	break;
		146	}
hpdl	1070	147	}
		148	}
		149	}
		150	}
		151
hpdl	1085	152	if ( $error === false ) {
hpdl	1085	153	$Qdel = $osC_Database->query('delete from :table_administrators_access where administrators_id = :administrators_id');
hpdl	1070	154
hpdl	1085	155	if ( !empty($modules_array) ) {
		156	$Qdel->appendQuery('and module not in (:module)');
		157	$Qdel->bindRaw(':module', implode(',', $modules_array));
		158	}
		159
		160	$Qdel->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		161	$Qdel->bindInt(':administrators_id', $id);
		162	$Qdel->execute();
		163
		164	if ( $osC_Database->isError() ) {
		165	$error = true;
		166	}
hpdl	1070	167	}
hpdl	1070	168
hpdl	1085	169	if ( $error === false ) {
hpdl	1085	170	$osC_Database->commitTransaction();
hpdl	1070	171
hpdl	1125	172	if ($id == $_SESSION['admin']['id']) {
		173	$_SESSION['admin']['access'] = osC_Access::getUserLevels($id);
		174	}
		175
hpdl	1085	176	$osC_MessageStack->add_session($this->_module, SUCCESS_DB_ROWS_UPDATED, 'success');
hpdl	1074	177	} else {
hpdl	1085	178	$osC_Database->rollbackTransaction();
		179
		180	$osC_MessageStack->add_session($this->_module, ERROR_DB_ROWS_NOT_UPDATED, 'error');
hpdl	1070	181	}
hpdl	1070	182
hpdl	1085	183	osc_redirect(osc_href_link_admin(FILENAME_DEFAULT, $this->_module . '&page=' . $_GET['page'] . (isset($id) ? '&aID=' . $id : '')));
hpdl	1016	184	} else {
hpdl	1085	185	$osC_MessageStack->add($this->_module, ERROR_ADMINISTRATORS_USERNAME_EXISTS, 'error');
hpdl	1070	186
hpdl	1085	187	if (isset($_GET['aID']) && is_numeric($_GET['aID'])) {
		188	$_GET['action'] = 'aEdit';
		189	} else {
		190	$_GET['action'] = 'aNew';
		191	}
hpdl	1016	192	}
		193	}
		194
		195	function _delete() {
		196	global $osC_Database, $osC_MessageStack;
		197
		198	if (isset($_GET['aID']) && is_numeric($_GET['aID'])) {
hpdl	1070	199	$osC_Database->startTransaction();
		200
		201	$Qdel = $osC_Database->query('delete from :table_administrators_access where administrators_id = :administrators_id');
		202	$Qdel->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		203	$Qdel->bindInt(':administrators_id', $_GET['aID']);
		204	$Qdel->execute();
		205
hpdl	1016	206	$Qdel = $osC_Database->query('delete from :table_administrators where id = :id');
		207	$Qdel->bindTable(':table_administrators', TABLE_ADMINISTRATORS);
		208	$Qdel->bindInt(':id', $_GET['aID']);
		209	$Qdel->execute();
		210
hpdl	1070	211	$osC_Database->commitTransaction();
hpdl	1070	212
hpdl	1016	213	$osC_MessageStack->add_session($this->_module, SUCCESS_DB_ROWS_UPDATED, 'success');
		214	}
		215
		216	osc_redirect(osc_href_link_admin(FILENAME_DEFAULT, $this->_module . '&page=' . $_GET['page']));
		217	}
hpdl	1125	218
		219	function _saveBatch() {
		220	global $osC_Database, $osC_MessageStack;
		221
		222	$error = false;
		223
		224	$modules_array = array();
		225
		226	if ( in_array('*', $_POST['modules']) ) {
		227	$_POST['modules'] = array('*');
		228	}
		229
		230	foreach ($_POST['modules'] as $module) {
		231	$modules_array[$module] = '\'' . $module . '\'';
		232	}
		233
		234	$osC_Database->startTransaction();
		235
		236	if ( ($_POST['type'] == 'add') \|\| ($_POST['type'] == 'set') ) {
		237	foreach ($modules_array as $module_key => $module_access) {
		238	foreach ($_POST['batch'] as $id) {
		239	$execute = true;
		240
		241	if ( $module_key != '*' ) {
		242	$Qcheck = $osC_Database->query('select administrators_id from :table_administrators_access where administrators_id = :administrators_id and module = :module limit 1');
		243	$Qcheck->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		244	$Qcheck->bindInt(':administrators_id', $id);
		245	$Qcheck->bindValue(':module', '*');
		246	$Qcheck->execute();
		247
		248	if ( $Qcheck->numberOfRows() === 1 ) {
		249	$execute = false;
		250	}
		251	}
		252
		253	if ( $execute === true ) {
		254	$Qcheck = $osC_Database->query('select administrators_id from :table_administrators_access where administrators_id = :administrators_id and module = :module limit 1');
		255	$Qcheck->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		256	$Qcheck->bindInt(':administrators_id', $id);
		257	$Qcheck->bindValue(':module', $module_key);
		258	$Qcheck->execute();
		259
		260	if ( $Qcheck->numberOfRows() < 1 ) {
		261	$Qinsert = $osC_Database->query('insert into :table_administrators_access (administrators_id, module) values (:administrators_id, :module)');
		262	$Qinsert->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
		263	$Qinsert->bindInt(':administrators_id', $id);
		264	$Qinsert->bindValue(':module', $module_key);
		265	$Qinsert->execute();
		266
		267	if ( $osC_Database->isError() ) {
		268	$error = true;
		269	break;
		270	}
		271	}
		272	}
		273	}
		274	}
		275	}
		276
		277	if ( $error === false ) {
		278	if ( ($_POST['type'] == 'remove') \|\| ($_POST['type'] == 'set') \|\| in_array('*', $_POST['modules']) ) {
		279	if ( !empty($modules_array) ) {
		280	foreach ($_POST['batch'] as $id) {
		281	$Qdel = $osC_Database->query('delete from :table_administrators_access where administrators_id = :administrators_id');
282
283	if ( $_POST['type'] == 'remove' ) {
284	if ( !in_array('*', $_POST['modules']) ) {
285	$Qdel->appendQuery('and module in (:module)');
286	$Qdel->bindRaw(':module', implode(',', $modules_array));
287	}
288	} else {
289	$Qdel->appendQuery('and module not in (:module)');
290	$Qdel->bindRaw(':module', implode(',', $modules_array));
291	}
292
293	$Qdel->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
294	$Qdel->bindInt(':administrators_id', $id);
295	$Qdel->execute();
296
297	if ( $osC_Database->isError() ) {
298	$error = true;
299	break;
300	}
301	}
302	}
303	}
304	}
305
306	if ( $error === false ) {
307	$osC_Database->commitTransaction();
308
309	if ( in_array($_SESSION['admin']['id'], $_POST['batch']) ) {
310	$_SESSION['admin']['access'] = osC_Access::getUserLevels($_SESSION['admin']['id']);
311	}
312
313	$osC_MessageStack->add_session($this->_module, SUCCESS_DB_ROWS_UPDATED, 'success');
314	} else {
315	$osC_Database->rollbackTransaction();
316
317	$osC_MessageStack->add_session($this->_module, ERROR_DB_ROWS_NOT_UPDATED, 'error');
318	}
319
320	osc_redirect(osc_href_link_admin(FILENAME_DEFAULT, $this->_module . '&page=' . $_GET['page']));
321	}
322
323	function _deleteBatch() {
324	global $osC_Database, $osC_MessageStack;
325
326	if (isset($_POST['batch']) && is_array($_POST['batch'])) {
327	$osC_Database->startTransaction();
328
329	$Qdel = $osC_Database->query('delete from :table_administrators_access where administrators_id in (":administrators_id")');
330	$Qdel->bindTable(':table_administrators_access', TABLE_ADMINISTRATORS_ACCESS);
331	$Qdel->bindRaw(':administrators_id', implode('", "', array_unique(array_filter(array_slice($_POST['batch'], 0, MAX_DISPLAY_SEARCH_RESULTS), 'is_numeric'))));
332	$Qdel->execute();
333
334	$Qdel = $osC_Database->query('delete from :table_administrators where id in (":id")');
335	$Qdel->bindTable(':table_administrators', TABLE_ADMINISTRATORS);
336	$Qdel->bindRaw(':id', implode('", "', array_unique(array_filter(array_slice($_POST['batch'], 0, MAX_DISPLAY_SEARCH_RESULTS), 'is_numeric'))));
337	$Qdel->execute();
338
339	$osC_Database->commitTransaction();
340
341	$osC_MessageStack->add_session($this->_module, SUCCESS_DB_ROWS_UPDATED, 'success');
342	}
343
344	osc_redirect(osc_href_link_admin(FILENAME_DEFAULT, $this->_module . '&page=' . $_GET['page']));
345	}
hpdl	1016	346	}
hpdl	1016	347	?>

FishEye

View

Diff

Annotations

Annotated File View