1 <?php |
|
2 /*********************************************************************** |
|
3 |
|
4 Copyright (C) 2002-2005 Rickard Andersson (rickard@punbb.org) |
|
5 |
|
6 This file is part of PunBB. |
|
7 |
|
8 PunBB is free software; you can redistribute it and/or modify it |
|
9 under the terms of the GNU General Public License as published |
|
10 by the Free Software Foundation; either version 2 of the License, |
|
11 or (at your option) any later version. |
|
12 |
|
13 PunBB is distributed in the hope that it will be useful, but |
|
14 WITHOUT ANY WARRANTY; without even the implied warranty of |
|
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
16 GNU General Public License for more details. |
|
17 |
|
18 You should have received a copy of the GNU General Public License |
|
19 along with this program; if not, write to the Free Software |
|
20 Foundation, Inc., 59 Temple Place, Suite 330, Boston, |
|
21 MA 02111-1307 USA |
|
22 |
|
23 ************************************************************************/ |
|
24 |
|
25 |
|
26 // Tell header.php to use the admin template |
|
27 define('PUN_ADMIN_CONSOLE', 1); |
|
28 |
|
29 //define('PUN_ROOT', './'); |
|
30 //require PUN_ROOT.'include/common.php'; |
|
31 |
|
32 global $pun_db, $pun_user, $pun_config, $lang_common; |
|
33 |
|
34 require PUN_ROOT.'include/common_admin.php'; |
|
35 |
|
36 |
|
37 if ($pun_user['g_id'] < PUN_MOD || ($pun_user['g_id'] == PUN_MOD && $pun_config['p_mod_ban_users'] == '0')) |
|
38 message($lang_common['No permission']); |
|
39 |
|
40 |
|
41 // Add/edit a ban (stage 1) |
|
42 if (isset($_REQUEST['add_ban']) || isset($_GET['edit_ban'])) |
|
43 { |
|
44 if (isset($_GET['add_ban']) || isset($_POST['add_ban'])) |
|
45 { |
|
46 // If the id of the user to ban was provided through GET (a link from profile.php) |
|
47 if (isset($_GET['add_ban'])) |
|
48 { |
|
49 $add_ban = intval($_GET['add_ban']); |
|
50 if ($add_ban < 2) |
|
51 message($lang_common['Bad request']); |
|
52 |
|
53 $user_id = $add_ban; |
|
54 |
|
55 $result = $pun_db->query('SELECT group_id, username, email FROM '.$pun_db->prefix.'users WHERE id='.$user_id) or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); |
|
56 if ($pun_db->num_rows($result)) |
|
57 list($group_id, $ban_user, $ban_email) = $pun_db->fetch_row($result); |
|
58 else |
|
59 message('No user by that ID registered.'); |
|
60 } |
|
61 else // Otherwise the username is in POST |
|
62 { |
|
63 $ban_user = trim($_POST['new_ban_user']); |
|
64 |
|
65 if ($ban_user != '') |
|
66 { |
|
67 $result = $pun_db->query('SELECT id, group_id, username, email FROM '.$pun_db->prefix.'users WHERE username=\''.$pun_db->escape($ban_user).'\' AND id>1') or error('Unable to fetch user info', __FILE__, __LINE__, $pun_db->error()); |
|
68 if ($pun_db->num_rows($result)) |
|
69 list($user_id, $group_id, $ban_user, $ban_email) = $pun_db->fetch_row($result); |
|
70 else |
|
71 message('No user by that username registered. If you want to add a ban not tied to a specific username just leave the username blank.'); |
|
72 } |
|
73 } |
|
74 |
|
75 // Make sure we're not banning an admin |
|
76 if (isset($group_id) && $group_id == PUN_ADMIN) |
|
77 message('The user '.pun_htmlspecialchars($ban_user).' is an administrator and can\'t be banned. If you want to ban an administrator, you must first demote him/her to moderator or user.'); |
|
78 |
|
79 // If we have a $user_id, we can try to find the last known IP of that user |
|
80 if (isset($user_id)) |
|
81 { |
|
82 $result = $pun_db->query('SELECT poster_ip FROM '.$pun_db->prefix.'posts WHERE poster_id='.$user_id.' ORDER BY posted DESC LIMIT 1') or error('Unable to fetch post info', __FILE__, __LINE__, $pun_db->error()); |
|
83 $ban_ip = ($pun_db->num_rows($result)) ? $pun_db->result($result) : ''; |
|
84 } |
|
85 |
|
86 $mode = 'add'; |
|
87 } |
|
88 else // We are editing a ban |
|
89 { |
|
90 $ban_id = intval($_GET['edit_ban']); |
|
91 if ($ban_id < 1) |
|
92 message($lang_common['Bad request']); |
|
93 |
|
94 $result = $pun_db->query('SELECT username, ip, email, message, expire FROM '.$pun_db->prefix.'bans WHERE id='.$ban_id) or error('Unable to fetch ban info', __FILE__, __LINE__, $pun_db->error()); |
|
95 if ($pun_db->num_rows($result)) |
|
96 list($ban_user, $ban_ip, $ban_email, $ban_message, $ban_expire) = $pun_db->fetch_row($result); |
|
97 else |
|
98 message($lang_common['Bad request']); |
|
99 |
|
100 $ban_expire = ($ban_expire != '') ? date('Y-m-d', $ban_expire) : ''; |
|
101 |
|
102 $mode = 'edit'; |
|
103 } |
|
104 |
|
105 $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / Admin / Bans'; |
|
106 $focus_element = array('bans2', 'ban_user'); |
|
107 require PUN_ROOT.'header.php'; |
|
108 |
|
109 generate_admin_menu('bans'); |
|
110 |
|
111 |
|
112 ?> |
|
113 <div class="blockform"> |
|
114 <h2><span>Ban advanced settings</span></h2> |
|
115 <div class="box"> |
|
116 <form id="bans2" method="post" action="admin_bans.php"> |
|
117 <div class="inform"> |
|
118 <input type="hidden" name="mode" value="<?php echo $mode ?>" /> |
|
119 <?php if ($mode == 'edit'): ?> <input type="hidden" name="ban_id" value="<?php echo $ban_id ?>" /> |
|
120 <?php endif; ?> <fieldset> |
|
121 <legend>Supplement ban with IP and e-mail</legend> |
|
122 <div class="infldset"> |
|
123 <table class="aligntop" cellspacing="0"> |
|
124 <tr> |
|
125 <th scope="row">Username</th> |
|
126 <td> |
|
127 <input type="text" name="ban_user" size="25" maxlength="25" value="<?php if (isset($ban_user)) echo pun_htmlspecialchars($ban_user); ?>" tabindex="1" /> |
|
128 <span>The username to ban.</span> |
|
129 </td> |
|
130 </tr> |
|
131 <tr> |
|
132 <th scope="row">IP-adresses</th> |
|
133 <td> |
|
134 <input type="text" name="ban_ip" size="45" maxlength="255" value="<?php if (isset($ban_ip)) echo $ban_ip; ?>" tabindex="2" /> |
|
135 <span>The IP or IP-ranges you wish to ban (e.g. 150.11.110.1 or 150.11.110). Separate addresses with spaces. If an IP is entered already it is the last known IP of this user in the database.<?php if ($ban_user != '' && isset($user_id)) echo ' Click <a href="admin_users.php?ip_stats='.$user_id.'">here</a> to see IP statistics for this user.' ?></span> |
|
136 </td> |
|
137 </tr> |
|
138 <tr> |
|
139 <th scope="row">E-mail/domain</th> |
|
140 <td> |
|
141 <input type="text" name="ban_email" size="40" maxlength="50" value="<?php if (isset($ban_email)) echo strtolower($ban_email); ?>" tabindex="3" /> |
|
142 <span>The e-mail or e-mail domain you wish to ban (e.g. someone@somewhere.com or somewhere.com). See "Allow banned e-mail addresses" in Options for more info.</span> |
|
143 </td> |
|
144 </tr> |
|
145 </table> |
|
146 <p class="topspace"><strong class="warntext">You should be very careful when banning an IP-range because of the possibility of multiple users matching the same partial IP.</strong></p> |
|
147 </div> |
|
148 </fieldset> |
|
149 </div> |
|
150 <div class="inform"> |
|
151 <fieldset> |
|
152 <legend>Ban message and expiry</legend> |
|
153 <div class="infldset"> |
|
154 <table class="aligntop" cellspacing="0"> |
|
155 <tr> |
|
156 <th scope="row">Ban message</th> |
|
157 <td> |
|
158 <input type="text" name="ban_message" size="50" maxlength="255" value="<?php if (isset($ban_message)) echo pun_htmlspecialchars($ban_message); ?>" tabindex="4" /> |
|
159 <span>A message that will be displayed to the banned user when he/she visits the forums.</span> |
|
160 </td> |
|
161 </tr> |
|
162 <tr> |
|
163 <th scope="row">Expire date</th> |
|
164 <td> |
|
165 <input type="text" name="ban_expire" size="17" maxlength="10" value="<?php if (isset($ban_expire)) echo $ban_expire; ?>" tabindex="5" /> |
|
166 <span>The date when this ban should be automatically removed (format: YYYY-MM-DD). Leave blank to remove manually.</span> |
|
167 </td> |
|
168 </tr> |
|
169 </table> |
|
170 </div> |
|
171 </fieldset> |
|
172 </div> |
|
173 <p class="submitend"><input type="submit" name="add_edit_ban" value=" Save " tabindex="6" /></p> |
|
174 </form> |
|
175 </div> |
|
176 </div> |
|
177 <div class="clearer"></div> |
|
178 </div> |
|
179 <?php |
|
180 |
|
181 require PUN_ROOT.'footer.php'; |
|
182 } |
|
183 |
|
184 |
|
185 // Add/edit a ban (stage 2) |
|
186 else if (isset($_POST['add_edit_ban'])) |
|
187 { |
|
188 confirm_referrer('admin_bans.php'); |
|
189 |
|
190 $ban_user = trim($_POST['ban_user']); |
|
191 $ban_ip = trim($_POST['ban_ip']); |
|
192 $ban_email = strtolower(trim($_POST['ban_email'])); |
|
193 $ban_message = trim($_POST['ban_message']); |
|
194 $ban_expire = trim($_POST['ban_expire']); |
|
195 |
|
196 if ($ban_user == '' && $ban_ip == '' && $ban_email == '') |
|
197 message('You must enter either a username, an IP address or an e-mail address (at least).'); |
|
198 else if (strtolower($ban_user) == 'guest') |
|
199 message('The guest user cannot be banned.'); |
|
200 |
|
201 // Validate IP/IP range (it's overkill, I know) |
|
202 if ($ban_ip != '') |
|
203 { |
|
204 $ban_ip = preg_replace('/[\s]{2,}/', ' ', $ban_ip); |
|
205 $addresses = explode(' ', $ban_ip); |
|
206 $addresses = array_map('trim', $addresses); |
|
207 |
|
208 for ($i = 0; $i < count($addresses); ++$i) |
|
209 { |
|
210 $octets = explode('.', $addresses[$i]); |
|
211 |
|
212 for ($c = 0; $c < count($octets); ++$c) |
|
213 { |
|
214 $octets[$c] = (strlen($octets[$c]) > 1) ? ltrim($octets[$c], "0") : $octets[$c]; |
|
215 |
|
216 if ($c > 3 || preg_match('/[^0-9]/', $octets[$c]) || intval($octets[$c]) > 255) |
|
217 message('You entered an invalid IP/IP-range.'); |
|
218 } |
|
219 |
|
220 $cur_address = implode('.', $octets); |
|
221 $addresses[$i] = $cur_address; |
|
222 } |
|
223 |
|
224 $ban_ip = implode(' ', $addresses); |
|
225 } |
|
226 |
|
227 require PUN_ROOT.'include/email.php'; |
|
228 if ($ban_email != '' && !is_valid_email($ban_email)) |
|
229 { |
|
230 if (!preg_match('/^[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$/', $ban_email)) |
|
231 message('The e-mail address (e.g. user@domain.com) or partial e-mail address domain (e.g. domain.com) you entered is invalid.'); |
|
232 } |
|
233 |
|
234 if ($ban_expire != '' && $ban_expire != 'Never') |
|
235 { |
|
236 $ban_expire = strtotime($ban_expire); |
|
237 |
|
238 if ($ban_expire == -1 || $ban_expire <= time()) |
|
239 message('You entered an invalid expire date. The format should be YYYY-MM-DD and the date must be at least one day in the future.'); |
|
240 } |
|
241 else |
|
242 $ban_expire = 'NULL'; |
|
243 |
|
244 $ban_user = ($ban_user != '') ? '\''.$pun_db->escape($ban_user).'\'' : 'NULL'; |
|
245 $ban_ip = ($ban_ip != '') ? '\''.$pun_db->escape($ban_ip).'\'' : 'NULL'; |
|
246 $ban_email = ($ban_email != '') ? '\''.$pun_db->escape($ban_email).'\'' : 'NULL'; |
|
247 $ban_message = ($ban_message != '') ? '\''.$pun_db->escape($ban_message).'\'' : 'NULL'; |
|
248 |
|
249 if ($_POST['mode'] == 'add') |
|
250 $pun_db->query('INSERT INTO '.$pun_db->prefix.'bans (username, ip, email, message, expire) VALUES('.$ban_user.', '.$ban_ip.', '.$ban_email.', '.$ban_message.', '.$ban_expire.')') or error('Unable to add ban', __FILE__, __LINE__, $pun_db->error()); |
|
251 else |
|
252 $pun_db->query('UPDATE '.$pun_db->prefix.'bans SET username='.$ban_user.', ip='.$ban_ip.', email='.$ban_email.', message='.$ban_message.', expire='.$ban_expire.' WHERE id='.intval($_POST['ban_id'])) or error('Unable to update ban', __FILE__, __LINE__, $pun_db->error()); |
|
253 |
|
254 // Regenerate the bans cache |
|
255 require_once PUN_ROOT.'include/cache.php'; |
|
256 generate_bans_cache(); |
|
257 |
|
258 pun_redirect('admin_bans.php', 'Ban '.(($_POST['mode'] == 'edit') ? 'edited' : 'added').'. Redirecting …'); |
|
259 } |
|
260 |
|
261 |
|
262 // Remove a ban |
|
263 else if (isset($_GET['del_ban'])) |
|
264 { |
|
265 confirm_referrer('admin_bans.php'); |
|
266 |
|
267 $ban_id = intval($_GET['del_ban']); |
|
268 if ($ban_id < 1) |
|
269 message($lang_common['Bad request']); |
|
270 |
|
271 $pun_db->query('DELETE FROM '.$pun_db->prefix.'bans WHERE id='.$ban_id) or error('Unable to delete ban', __FILE__, __LINE__, $pun_db->error()); |
|
272 |
|
273 // Regenerate the bans cache |
|
274 require_once PUN_ROOT.'include/cache.php'; |
|
275 generate_bans_cache(); |
|
276 |
|
277 pun_redirect('admin_bans.php', 'Ban removed. Redirecting …'); |
|
278 } |
|
279 |
|
280 |
|
281 $page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / Admin / Bans'; |
|
282 $focus_element = array('bans', 'new_ban_user'); |
|
283 require PUN_ROOT.'header.php'; |
|
284 |
|
285 generate_admin_menu('bans'); |
|
286 |
|
287 ?> |
|
288 <div class="blockform"> |
|
289 <h2><span>New ban</span></h2> |
|
290 <div class="box"> |
|
291 <form id="bans" method="post" action="<?php echo makeUrlNS('Special', 'Forum/Admin_Bans', 'action=more', true); ?>"> |
|
292 <div class="inform"> |
|
293 <fieldset> |
|
294 <legend>Add ban</legend> |
|
295 <div class="infldset"> |
|
296 <table class="aligntop" cellspacing="0"> |
|
297 <tr> |
|
298 <th scope="row">Username<div><input type="submit" name="add_ban" value=" Add " tabindex="2" /></div></th> |
|
299 <td> |
|
300 <input type="text" name="new_ban_user" size="25" maxlength="25" tabindex="1" /> |
|
301 <span>The username to ban (case insensitive). The next page will let you enter a custom IP and e-mail. If you just want to ban a specific IP/IP-range or e-mail just leave it blank.</span> |
|
302 </td> |
|
303 </tr> |
|
304 </table> |
|
305 </div> |
|
306 </fieldset> |
|
307 </div> |
|
308 </form> |
|
309 </div> |
|
310 |
|
311 <h2 class="block2"><span>Existing bans</span></h2> |
|
312 <div class="box"> |
|
313 <div class="fakeform"> |
|
314 <?php |
|
315 |
|
316 $result = $pun_db->query('SELECT id, username, ip, email, message, expire FROM '.$pun_db->prefix.'bans ORDER BY id') or error('Unable to fetch ban list', __FILE__, __LINE__, $pun_db->error()); |
|
317 if ($pun_db->num_rows($result)) |
|
318 { |
|
319 while ($cur_ban = $pun_db->fetch_assoc($result)) |
|
320 { |
|
321 $expire = format_time($cur_ban['expire'], true); |
|
322 |
|
323 ?> |
|
324 <div class="inform"> |
|
325 <fieldset> |
|
326 <legend>Ban expires: <?php echo $expire ?></legend> |
|
327 <div class="infldset"> |
|
328 <table cellspacing="0"> |
|
329 <?php if ($cur_ban['username'] != ''): ?> <tr> |
|
330 <th>Username</th> |
|
331 <td><?php echo pun_htmlspecialchars($cur_ban['username']) ?></td> |
|
332 </tr> |
|
333 <?php endif; ?><?php if ($cur_ban['email'] != ''): ?> <tr> |
|
334 <th>E-mail</th> |
|
335 <td><?php echo $cur_ban['email'] ?></td> |
|
336 </tr> |
|
337 <?php endif; ?><?php if ($cur_ban['ip'] != ''): ?> <tr> |
|
338 <th>IP/IP-ranges</th> |
|
339 <td><?php echo $cur_ban['ip'] ?></td> |
|
340 </tr> |
|
341 <?php endif; ?><?php if ($cur_ban['message'] != ''): ?> <tr> |
|
342 <th>Reason</th> |
|
343 <td><?php echo pun_htmlspecialchars($cur_ban['message']) ?></td> |
|
344 </tr> |
|
345 <?php endif; ?> </table> |
|
346 <p class="linkactions"><a href="admin_bans.php?edit_ban=<?php echo $cur_ban['id'] ?>">Edit</a> - <a href="admin_bans.php?del_ban=<?php echo $cur_ban['id'] ?>">Remove</a></p> |
|
347 </div> |
|
348 </fieldset> |
|
349 </div> |
|
350 <?php |
|
351 |
|
352 } |
|
353 } |
|
354 else |
|
355 echo "\t\t\t\t".'<p>No bans in list.</p>'."\n"; |
|
356 |
|
357 ?> |
|
358 </div> |
|
359 </div> |
|
360 </div> |
|
361 <div class="clearer"></div> |
|
362 </div> |
|
363 <?php |
|
364 |
|
365 require PUN_ROOT.'footer.php'; |
|