forked from Xkeeper0/jul
/
admin-deluser.php
286 lines (240 loc) · 11.5 KB
/
admin-deluser.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
<?php
require "lib/common.php";
$allowedusers = array(
$x_hacks['adminip'], // Xkeeper
//"24.234.157.232", // also me
);
const _SHOW_ALL = -20;
const _SHOW_BANNED = -10;
if (!in_array($_SERVER['REMOTE_ADDR'], $allowedusers) && !$sysadmin && $loguser['id'] != 1) errorpage("Nein.");
pageheader();
print adminlinkbar();
if (!$config['deleted-user-id'])
boardmessage("The deleted user ID doesn't exist, you won't be able to delete users.", "Warning", false);
else if (!$sql->resultq("SELECT COUNT(*) FROM users WHERE id = {$config['deleted-user-id']} AND powerlevel <= -2")) {
boardmessage("The <a href=\"profile.php?id={$config['deleted-user-id']}\">deleted user ID</a> has the wrong powerlevel set (likely pointing to an unintended user), you won't be able to delete users.", "Warning", false);
$config['deleted-user-id'] = 0;
}
// Explicitly check if the 'dodelete' button was pressed
// Since the forms have been merged to preserve sort options between deletions
else if (isset($_POST['dodelete']) && filter_array($_POST['deluser'])) {
check_token($_POST['auth'], TOKEN_USERDEL);
$dellist = array_keys($_POST['deluser']);
$delusercnt = 0;
$delusertext = "";
$sql->beginTransaction();
foreach($dellist as $key => $id) {
// Although this is a sysadmin-only tool, filter that id properly just in case
$dellist[$key] = (int) $dellist[$key];
$id = $dellist[$key];
$user = $sql->fetchq("SELECT $userfields FROM users u WHERE u.id = $id");
if (!$user) {
$dellist = array(); // Post-delete refresh likely; exit immediately
break;
}
$id = $user['id'];
$name = $user['name'];
// Backup the user's data just in case
$sql->query("INSERT INTO `delusers` ( SELECT * FROM `users` WHERE `id` = '$id' )");
// Since we're moving all posts to the deleted user account, include the user's name as a "signature"
$namecolor = getnamecolor($user['sex'],$user['powerlevel'],$user['namecolor']);
$line = addslashes("<br><br>===================<br>[Posted by <span style='color:#$namecolor'><b>$name</b></span>]<br>");
$sql->query("UPDATE posts_old SET revuser = {$config['deleted-user-id']} WHERE revuser = $id");
$sql->query("UPDATE posts_old SET cssid = 0, headid = 0, signid = 0, signtext = CONCAT_WS('','$line',signtext) WHERE pid IN (SELECT id FROM posts WHERE user = {$id})");
$sql->query("UPDATE posts SET user = {$config['deleted-user-id']}, cssid = 0, headid = 0, signid = 0, signtext = CONCAT_WS('','$line',signtext) WHERE user = $id");
$sql->query("UPDATE pm_posts SET user = {$config['deleted-user-id']}, cssid = 0, headid = 0, signid = 0, signtext = CONCAT_WS('','$line',signtext) WHERE user = $id");
$sql->query("UPDATE threads SET user = {$config['deleted-user-id']} WHERE user=$id");
$sql->query("UPDATE threads SET lastposter = {$config['deleted-user-id']} WHERE lastposter=$id");
$sql->query("UPDATE pm_threads SET user = {$config['deleted-user-id']} WHERE user=$id");
$sql->query("UPDATE pm_threads SET lastposter = {$config['deleted-user-id']} WHERE lastposter=$id");
$sql->query("UPDATE forums SET lastpostuser = {$config['deleted-user-id']} WHERE lastpostuser=$id");
$sql->query("UPDATE events SET user = {$config['deleted-user-id']} WHERE user=$id");
$sql->query("UPDATE pm_access SET user = {$config['deleted-user-id']}, folder = 0 WHERE user=$id");
$sql->query("UPDATE attachments SET user = {$config['deleted-user-id']} WHERE user=$id");
$sql->query("UPDATE users SET posts = -1 * (SELECT COUNT(*) FROM posts WHERE user = {$config['deleted-user-id']}) WHERE id = {$config['deleted-user-id']}");
$sql->query("UPDATE users_comments SET userto = {$config['deleted-user-id']} WHERE userto = $id");
$sql->query("UPDATE users_comments SET userfrom = {$config['deleted-user-id']} WHERE userfrom = $id");
$sql->query("UPDATE news SET user = {$config['deleted-user-id']} WHERE user = $id");
$sql->query("UPDATE news_comments SET user = {$config['deleted-user-id']} WHERE user = $id");
$sql->query("DELETE FROM forummods WHERE user=$id");
$sql->query("DELETE FROM userratings WHERE userrated=$id OR userfrom=$id");
$sql->query("DELETE FROM posts_ratings WHERE user=$id");
$sql->query("DELETE FROM pm_ratings WHERE user=$id");
$sql->query("DELETE FROM pollvotes WHERE user=$id");
$sql->query("DELETE FROM users WHERE id=$id");
$sql->query("DELETE FROM users_avatars WHERE id=$id");
$sql->query("DELETE FROM users_rpg WHERE uid=$id");
$sql->query("DELETE FROM announcementread WHERE user = $id");
$sql->query("DELETE FROM forumread WHERE user = $id");
$sql->query("DELETE FROM threadsread WHERE uid = $id");
$sql->query("DELETE FROM pm_threadsread WHERE uid = $id");
$sql->query("DELETE FROM pm_foldersread WHERE user = $id");
$sql->query("DELETE FROM pm_folders WHERE user = $id");
$delusertext .= "\r\n<tr><td class='tdbg1 center' style='width: 120px'>$id</td><td class='tdbg2'><span style='color:#$namecolor'><b>{$user['name']}</b></span></td></tr>";
$delusercnt++;
}
$sql->commit();
// Since we're sure the queries have succeeded, now delete the avatars in the userpic folder
// Not done on post-delete refresh
foreach ($dellist as $id) {
delete_all_avatars($id, DAA_MINIPIC | DAA_SKIPSETMOOD);
}
?>
<table class='table'>
<tr>
<td class='tdbgc center' colspan=2>
<b><?=$delusercnt?> user<?=($delusercnt != 1 ? "s" : "")?> deleted.</b>
</td>
</tr>
<?=$delusertext?>
</table>
<br>
<?php
}
// Layout config for easy add/removal
$sort_types = array(
0 => ['lastactivity', 'Last activity'],
1 => ['regdate', 'Registration date'],
2 => ['posts', 'Posts'],
3 => ['threads', 'Threads'],
4 => ['power', 'Group'],
5 => ['lastip', 'IP address'],
);
// Variable fetching
$_POST['searchname'] = filter_string($_POST['searchname']);
$_POST['searchip'] = filter_string($_POST['searchip']);
$_POST['maxposts'] = filter_int($_POST['maxposts']);
// Display only banned users by default
if (!isset($_POST['sortpower'])) {
$_POST['sortpower'] = _SHOW_BANNED;
} else {
$_POST['sortpower'] = filter_int($_POST['sortpower']);
}
$_POST['sortord'] = filter_int($_POST['sortord']);
$_POST['sorttype'] = numrange(filter_int($_POST['sorttype']), 0, count($sort_types) - 1);
$sortsel[$_POST['sorttype']] = 'selected';
$ordsel[$_POST['sortord']] = 'checked';
// Hack around adding extra elements to the select list
$pwlnames[_SHOW_ALL] = "* Any powerlevel";
$pwlnames[_SHOW_BANNED] = "* All banned (default)";
ksort($pwlnames);
?>
<form method="POST" action="?">
<table class="table">
<tr><td class="tdbgh center" colspan=2>Sort Options</td></tr>
<tr><td class="tdbg1 center b" style="width: 300px">User Search:</td>
<td class="tdbg2"><input type="text" name="searchname" size=30 maxlength=25 value="<?=htmlspecialchars($_POST['searchname'])?>"></td></tr>
<tr><td class="tdbg1 center b">IP Search:</td>
<td class="tdbg2"><input type="text" name="searchip" size=30 maxlength=32 value="<?=htmlspecialchars($_POST['searchip'])?>"></td></tr>
<tr><td class="tdbg1 center b">Show users with less than:</td>
<td class="tdbg2"><input type='text' name="maxposts" size=15 maxlength=9 value="<?=htmlspecialchars($_POST['maxposts'])?>"> posts</td></tr>
<tr><td class="tdbg1 center b">Powerlevel:</td>
<td class="tdbg2"><?= power_select('sortpower', $_POST['sortpower'], -10000) ?></td>
</tr>
<tr><td class="tdbg1 center b">Sort by:</td>
<td class="tdbg2">
<select name="sorttype">
<?php foreach ($sort_types as $sort_id => $x) { ?>
<option value=<?= $sort_id ?> <?=filter_string($sortsel[$sort_id])?>> <?= $x[1] ?> </option>
<?php } ?>
</select>,
<input type="radio" name="sortord" value="0" <?=filter_string($ordsel[0])?>> Descending
<input type="radio" name="sortord" value="1" <?=filter_string($ordsel[1])?>> Ascending
</td>
</tr>
<tr>
<td class="tdbg1 center"> </td>
<td class="tdbg2">
<input type="submit" name="setfilter" value="Apply filters">
</td>
</tr>
</table>
<?php
// WHERE Clause
$sqlwhere = array();
$values = array();
if ($_POST['maxposts']) {
$sqlwhere[] = "`posts` <= :posts";
$values['posts'] = $_POST['maxposts'];
}
if ($_POST['searchip']) {
$sqlwhere[] = "`lastip` LIKE :searchip";
$values['searchip'] = "{$_POST['searchip']}%";
}
if ($_POST['searchname']) {
$sqlwhere[] = "`name` LIKE :searchname";
$values['searchname'] = "%{$_POST['searchname']}%";
}
if ($_POST['sortpower'] == _SHOW_BANNED) { // Special handler for all banned
$sqlwhere[] = "(`powerlevel` < 0) ";
} else if ($_POST['sortpower'] != _SHOW_ALL) {
$sqlwhere[] = "`powerlevel` = :powerlevel";
$values['powerlevel'] = $_POST['sortpower'];
}
$wheretxt = $sqlwhere ? "WHERE ". implode(" AND ", $sqlwhere) : "";
// ORDER Clause
$sortfield = $sort_types[$_POST['sorttype']][0];
$sortorder = $_POST['sortord'] ? "ASC" : "DESC";
$users = $sql->queryp("
SELECT u.*, COUNT(t.id) threads
FROM users u
LEFT JOIN threads t ON u.id = t.user
{$wheretxt}
GROUP BY u.id
ORDER BY {$sortfield} {$sortorder}", $values);
$usercount = $sql->num_rows($users);
// User results / selection table
?>
<table class='table'>
<tr><td class="tdbgc center b" colspan=9><?=$usercount?> user(s) found.</td></tr>
<tr>
<td class="tdbgh center"> </td>
<td class="tdbgh center">Name</td>
<td class="tdbgh center">Posts</td>
<td class="tdbgh center">Threads</td>
<td class="tdbgh center" style="width: 200px">Regdate</td>
<td class="tdbgh center" style="width: 200px">Last post</td>
<td class="tdbgh center" style="width: 200px">Last activity</td>
<td class="tdbgh center">Last URL</td>
<td class="tdbgh center">IP</td>
</tr>
<?php
while ($user = $sql->fetch($users)) {
$userlink = getuserlink($user);
if($user['lastposttime']) $lastpost = printdate($user['lastposttime'], true);
else $lastpost = '-';
if($user['lastactivity'] != $user['regdate']) $lastactivity = printdate($user['lastactivity']);
else $lastactivity = '-';
if($user['regdate']) $regdate = printdate($user['regdate'], true);
else $regdate = '-';
// Padding of numbers to gray 0
$textid = str_pad($user['id'], 5, "x", STR_PAD_LEFT);
$textid = str_replace("x", "<font color=#606060>0</font>", $textid);
$textid = str_replace("</font><font color=#606060>", "", $textid);
?>
<tr>
<td class="tdbg1 center"><input type="checkbox" name="deluser[<?=$user['id']?>]" value="1"></td>
<td class="tdbg2"><?= $textid ?> - <?= $userlink ?></td>
<td class="tdbg1 center"><?= $user['posts'] ?></td>
<td class="tdbg1 center"><?= $user['threads'] ?></td>
<td class="tdbg1 center"><?= $regdate ?></td>
<td class="tdbg1 center"><?= $lastpost ?></td>
<td class="tdbg1 center"><?= $lastactivity ?></td>
<td class="tdbg2"><?= htmlspecialchars($user['lasturl']) ?> </td>
<td class="tdbg2 center"><?= htmlspecialchars($user['lastip']) ?></td>
</tr>
<?php
}
if ($config['deleted-user-id']) {
?>
<tr>
<td class="tdbg1" colspan="9">
<input type="submit" name="dodelete" value="Submit">
<?= auth_tag(TOKEN_USERDEL) ?>
</td>
</tr>
<?php } ?>
</table>
</form>
<?php
pagefooter();