<?php
/**
 * @version $Id: admincp.php v2.0 $
 * @package PBDigg
 * @copyright Copyright (C) 2007 - 2008 PBDigg.com. All Rights Reserved.
 * @license PBDigg is free software and use is subject to license terms
 */

error_reporting(E_ERROR | E_WARNING | E_PARSE);
set_magic_quotes_runtime(0);

$loadTime = explode(' ', microtime());
$loadTime = $loadTime[0] + $loadTime[1];
$timestamp = time();

$_PBDEV = $_PBENV = array();
$_PBDEV['PHP_SELF'] = isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];
$_PBDEV['REQUEST_URL'] = $_PBDEV['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'];
$_PBDEV['REAL_PATH'] = dirname(__FILE__);
$_DS = DIRECTORY_SEPARATOR;

define('IN_PBDIGG', TRUE);
define('IN_ADMIN', TRUE);
define('PBDIGG_ROOT', str_replace('\\', '/', substr($_PBDEV['REAL_PATH'], 0, strrpos($_PBDEV['REAL_PATH'], $_DS) + 1)));
define('PBDIGG_CP', str_replace('\\', '/', $_PBDEV['REAL_PATH'].'/'));
$_PBVERSION = '2.0 ÖÜÄê°æ';
$_PBRELEASE = '20080921';

if(function_exists('date_default_timezone_set')) @date_default_timezone_set('UTC');

require_once(PBDIGG_ROOT.'data/sql.inc.php');
header('Content-Type: text/html; charset='.$db_charset);

require_once(PBDIGG_CP.'include/admin.func.php');
if (!get_magic_quotes_gpc())
{
	addS($_GET);
	addS($_POST);
	addS($_COOKIE);
}
@extract($_GET);
@extract($_POST);

require_once(PBDIGG_ROOT.'include/Cache.class.php');
$Cache = new Cache;
if (!@include_once(PBDIGG_ROOT.'data/cache/cache_config.php'))
{
	$Cache->setCacheList('config');
}
$Cache->setLifeTime($pb_cachetime);

require_once(loadLang('admincp'));
require_once(loadLang('cp'));
require_once(loadLang('func'));
require_once(loadLang('option'));
if ($pb_ucenable)
{
	require_once(PBDIGG_ROOT.'config.inc.php');
	require_once(PBDIGG_ROOT.'client/client.php');
}

if ($pb_gzip && (strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') !== FALSE) && function_exists('ob_gzhandler'))
{
	ob_start('ob_gzhandler');
	$_PBDEV['gzip'] = 'Gzip Enabled';
}
else
{
	ob_start();
}

if (file_exists(PBDIGG_ROOT . 'install/install.php') && !file_exists(PBDIGG_ROOT . 'install/install.lock'))
{
	exit($a_message['admin_installfile_exist']);
}

$rewrite_ext = array('html','htm','shtml','php','asp','jsp','cgi');
$pb_rewriteext = $rewrite_ext[$pb_rewriteext];
$pb_gdcheck = unserialize($pb_gdcheck);

require_once(PBDIGG_ROOT.'data/manager.inc.php');
require_once(PBDIGG_ROOT.'include/smarty.inc.php');
$_PBENV['PB_CHARSET'] = $db_charset;
$_PBENV['PB_VERSION'] = array($_PBVERSION, $_PBRELEASE);
list($_PBDEV['PB_IP'], $_PBDEV['PB_ISAGENT']) = getIP();

if ($pb_siteurl)
{
	$_PBENV['PB_URL'] = $pb_siteurl;
}
else
{
	$_PBDIR = dirname($_PBDEV['PHP_SELF']);
	$_PBDIR = substr($_PBDIR, 0, strrpos($_PBDIR, '/')+1);
	$_PBENV['PB_URL'] = 'http://'.$_SERVER['HTTP_HOST'].$_PBDIR;
}
if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) !== FALSE)
{
	$_PBDEV['PB_REFERER'] = addslashes($_SERVER['HTTP_REFERER']);
}

$_SUPERMANAGER = 0;
$m_shortcut = $m_setting = $m_cate = $m_tag = $m_member = $m_group = $m_check = $m_batch = $m_tpl = $m_db = $m_tool = $m_log = $log_description = '';
$categories = $grouplevel = $cateOption = array();
if (!@include_once(PBDIGG_ROOT.'data/cache/cache_grouplevel.php'))
{
	$Cache->setCacheList('grouplevel');
}
if (!@include_once(PBDIGG_ROOT.'data/cache/cache_categories.php'))
{
	$Cache->setCacheList('categories');
}

require_once(PBDIGG_ROOT.'include/'.$_PBDEV['dbType'].'.class.php');

$DB = new MySQL($db_host, $db_username, $db_password, $db_name, $db_pconnect);
require_once(PBDIGG_CP.'menu.php');
require_once(PBDIGG_CP.'include/datagateway.func.php');
require_once(PBDIGG_ROOT.'include/validate.func.php');
require_once(PBDIGG_CP.'topmenu.php');

if ($Cache->refreshCache())
{
	exit('<p>'.$a_message['admin_cacheload_success'].'</p>');
}

if (!accessIPControl($_PBDEV['PB_IP']))
{
	showMsg($a_message['admin_accessip_denied'], 'admincp.php');
}

$TPL->assign('PB_ENV', $_PBENV);
$TPL->assign('PB_DEV', $_PBDEV);
$TPL->assign('cp_lang', $cp_message);
$TPL->assign('topMenu', $topMenu);

if ($action == 'logout')
{
	sCookie('pb_adminsid', '', -1);
	$DB->db_query("DELETE FROM {$db_prefix}adminonlines WHERE sid = '$pb_adminsid' OR ($timestamp - lastactivity > 600)", 0);
	redirect($a_message['admin_logout_success'], 'admincp.php');
}

if ($action == 'login')
{
	if ($pb_adminsafecode)
	{
		$_adminsafecode = NULL;
		require_once(PBDIGG_ROOT.'data/safe.inc.php');
		if (empty($_adminsafecode) || ($adminsafecode != $_adminsafecode))
		{
			login();
		}
	}
	if (empty ($_POST['admin_user']) || empty ($_POST['admin_pw']))
	{
		login();
	}
	elseif ($pb_gdcheck['admin'] && !ckgdcode($checkcode))
	{
		redirect($a_message['admin_checkcode_error'], 'admincp.php');
	}
	else
	{
		$username = $password = $customer = $customercode = $pb_adminsid = '';
		$username = trim($_POST['admin_user']);
		$password = md5(trim($_POST['admin_pw']));
		$customer = checkLogin($username, $password);
		if ($customer)
		{
			$customer['super'] = $_SUPERMANAGER;
			$customercode = PEncode(serialize($customer), $pb_sitehash);
			$pb_adminsid = getAdminHash($customercode);
			$DB->db_query("DELETE FROM {$db_prefix}adminonlines WHERE sid = '$pb_adminsid' OR ($timestamp - lastactivity > 600)");
			$DB->db_query("INSERT INTO {$db_prefix}adminonlines (sid, loginfo, logdate, logip, lastactivity) VALUES ('$pb_adminsid', '$customercode', $timestamp, '".$_PBDEV['PB_IP']."', $timestamp)");
			sCookie('pb_adminsid', PEncode($pb_adminsid."\t".$customer['uid']."\t".$customer['password']."\t".$timestamp, $pb_sitehash));
			if ($customer['adminid'] == '1')
			{
				sCookie('pb_auth', PEncode($customer['uid']."\t".$customer['password'], $pb_sitehash));
			}
			adminlog('', 1, 1);
			redirect($a_message['admin_login_success'], $_PBDEV['REQUEST_URL']);
		}
		else
		{
			adminlog('username: '.htmlspecialchars($_POST['admin_user']).' password: '.htmlspecialchars($_POST['admin_pw']), 0, 1);
			login();
		}
	}
}

$islogin = $customer = $pb_adminsid = $pb_adminuid = $pb_adminpw = $pb_admintime = '';
list($pb_adminsid, $pb_adminuid, $pb_adminpw, $pb_admintime) = explode("\t", PDecode(gCookie('pb_adminsid'), $pb_sitehash));
if ($pb_adminsid && $pb_adminuid &&  $pb_adminpw && $pb_admintime)
{
	$rs = $DB->db_fetch_one_array("SELECT sid, loginfo, logdate, logip, lastactivity FROM {$db_prefix}adminonlines WHERE sid = '$pb_adminsid' AND logip = '".$_PBDEV['PB_IP']."' AND ($timestamp - lastactivity <= 600)");
	if ($rs && ($rs['logip'] == $_PBDEV['PB_IP']))
	{
		$customer = unserialize(PDecode($rs['loginfo'], $pb_sitehash));
		$_SUPERMANAGER = $customer['super'];
		$customer['groupname'] = $grouplevel[$customer['groupid']]['grouptitle'];
		$islogin = checkLogin($customer['username'], $customer['password']);
		if (!$islogin)
		{
			login();
		}
		$DB->db_query("UPDATE {$db_prefix}adminonlines SET lastactivity = $timestamp WHERE sid = '$pb_adminsid' AND logip = '".$_PBDEV['PB_IP']."'");
	}
	elseif ($timestamp <= 600 + $pb_admintime)
	{
		$rs = $DB->db_fetch_one_array("SELECT username, password FROM {$db_prefix}members WHERE uid = '$pb_adminuid' AND password = '$pb_adminpw' AND groupid IN (1,2)");
		$customer = checkLogin($rs['username'], $rs['password']);
		if ($customer)
		{
			$customer['super'] = $_SUPERMANAGER;
			$customercode = PEncode(serialize($customer), $pb_sitehash);
			$pb_adminsid = getAdminHash($customercode);
			$DB->db_query("DELETE FROM {$db_prefix}adminonlines WHERE sid = '$pb_adminsid' OR ($timestamp - lastactivity > 600)");
			$DB->db_query("INSERT INTO {$db_prefix}adminonlines (sid, loginfo, logdate, logip, lastactivity) VALUES ('$pb_adminsid', '$customercode', $timestamp, '".$_PBDEV['PB_IP']."', $timestamp)");
			sCookie('pb_adminsid', PEncode($pb_adminsid."\t".$customer['uid']."\t".$customer['password']."\t".$timestamp, $pb_sitehash));
		}
		else
		{
			sCookie('pb_adminsid','');
			login();
		}
	}
	else
	{
		sCookie('pb_adminsid','');
		login();
	}
}
else
{
	login();
}
$activeMenu = activeMenu();
$actionurl = $activeMenu[0];
$TPL->assign('navlink', $activeMenu[1]);
unset($activeMenu, $_ENV, $HTTP_ENV_VARS, $_REQUEST, $HTTP_POST_VARS, $HTTP_GET_VARS, $HTTP_POST_FILES, $HTTP_COOKIE_VARS, $db_host, $db_username, $db_password, $db_name, $db_pconnect, $PB_VERSION, $PB_RELEASE, $rs, $customer['password'], $pb_adminsid);
$TPL->assign('customer', $customer);
?>