Let's just say that the API loads. While a decent part of PunBB works, we've still got a LONG way to go, mainly with form validation and security. At this point, Punano is NOT secure as far as privileges and user levels go.
<?php
/***********************************************************************
Copyright (C) 2002-2005 Rickard Andersson (rickard@punbb.org)
This file is part of PunBB.
PunBB is free software; you can redistribute it and/or modify it
under the terms of the GNU General Public License as published
by the Free Software Foundation; either version 2 of the License,
or (at your option) any later version.
PunBB is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston,
MA 02111-1307 USA
************************************************************************/
// Tell header.php to use the admin template
define('PUN_ADMIN_CONSOLE', 1);
//define('PUN_ROOT', './');
//require PUN_ROOT.'include/common.php';
global $pun_db, $pun_user, $pun_config, $lang_common;
require PUN_ROOT.'include/common_admin.php';
if ($pun_user['g_id'] < PUN_ADMIN)
message($lang_common['No permission']);
// Add a new category
if (isset($_POST['add_cat']))
{
confirm_referrer('admin_categories.php');
$new_cat_name = trim($_POST['new_cat_name']);
if ($new_cat_name == '')
message('You must enter a name for the category.');
$pun_db->query('INSERT INTO '.$pun_db->prefix.'categories (cat_name) VALUES(\''.$pun_db->escape($new_cat_name).'\')') or error('Unable to create category', __FILE__, __LINE__, $pun_db->error());
pun_redirect('admin_categories.php', 'Category added. Redirecting …');
}
// Delete a category
else if (isset($_POST['del_cat']) || isset($_POST['del_cat_comply']))
{
confirm_referrer('admin_categories.php');
$cat_to_delete = intval($_POST['cat_to_delete']);
if ($cat_to_delete < 1)
message($lang_common['Bad request']);
if (isset($_POST['del_cat_comply'])) // Delete a category with all forums and posts
{
@set_time_limit(0);
$result = $pun_db->query('SELECT id FROM '.$pun_db->prefix.'forums WHERE cat_id='.$cat_to_delete) or error('Unable to fetch forum list', __FILE__, __LINE__, $pun_db->error());
$num_forums = $pun_db->num_rows($result);
for ($i = 0; $i < $num_forums; ++$i)
{
$cur_forum = $pun_db->result($result, $i);
// Prune all posts and topics
prune($cur_forum, 1, -1);
// Delete the forum
$pun_db->query('DELETE FROM '.$pun_db->prefix.'forums WHERE id='.$cur_forum) or error('Unable to delete forum', __FILE__, __LINE__, $pun_db->error());
}
// Locate any "orphaned redirect topics" and delete them
$result = $pun_db->query('SELECT t1.id FROM '.$pun_db->prefix.'topics AS t1 LEFT JOIN '.$pun_db->prefix.'topics AS t2 ON t1.moved_to=t2.id WHERE t2.id IS NULL AND t1.moved_to IS NOT NULL') or error('Unable to fetch redirect topics', __FILE__, __LINE__, $pun_db->error());
$num_orphans = $pun_db->num_rows($result);
if ($num_orphans)
{
for ($i = 0; $i < $num_orphans; ++$i)
$orphans[] = $pun_db->result($result, $i);
$pun_db->query('DELETE FROM '.$pun_db->prefix.'topics WHERE id IN('.implode(',', $orphans).')') or error('Unable to delete redirect topics', __FILE__, __LINE__, $pun_db->error());
}
// Delete the category
$pun_db->query('DELETE FROM '.$pun_db->prefix.'categories WHERE id='.$cat_to_delete) or error('Unable to delete category', __FILE__, __LINE__, $pun_db->error());
// Regenerate the quickjump cache
require_once PUN_ROOT.'include/cache.php';
generate_quickjump_cache();
pun_redirect('admin_categories.php', 'Category deleted. Redirecting …');
}
else // If the user hasn't comfirmed the delete
{
$result = $pun_db->query('SELECT cat_name FROM '.$pun_db->prefix.'categories WHERE id='.$cat_to_delete) or error('Unable to fetch category info', __FILE__, __LINE__, $pun_db->error());
$cat_name = $pun_db->result($result);
$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / Admin / Categories';
require PUN_ROOT.'header.php';
generate_admin_menu('categories');
?>
<div class="blockform">
<h2><span>Category delete</span></h2>
<div class="box">
<form method="post" action="admin_categories.php">
<div class="inform">
<input type="hidden" name="cat_to_delete" value="<?php echo $cat_to_delete ?>" />
<fieldset>
<legend>Confirm delete category</legend>
<div class="infldset">
<p>Are you sure that you want to delete the category "<?php echo pun_htmlspecialchars($cat_name) ?>"?</p>
<p>WARNING! Deleting a category will delete all forums and posts (if any) in that category!</p>
</div>
</fieldset>
</div>
<p><input type="submit" name="del_cat_comply" value="Delete" /><a href="javascript:history.go(-1)">Go back</a></p>
</form>
</div>
</div>
<div class="clearer"></div>
</div>
<?php
require PUN_ROOT.'footer.php';
}
}
else if (isset($_POST['update'])) // Change position and name of the categories
{
confirm_referrer('admin_categories.php');
$cat_order = $_POST['cat_order'];
$cat_name = $_POST['cat_name'];
$result = $pun_db->query('SELECT id, disp_position FROM '.$pun_db->prefix.'categories ORDER BY disp_position') or error('Unable to fetch category list', __FILE__, __LINE__, $pun_db->error());
$num_cats = $pun_db->num_rows($result);
for ($i = 0; $i < $num_cats; ++$i)
{
if ($cat_name[$i] == '')
message('You must enter a category name.');
if (!@preg_match('#^\d+$#', $cat_order[$i]))
message('Position must be an integer value.');
list($cat_id, $position) = $pun_db->fetch_row($result);
$pun_db->query('UPDATE '.$pun_db->prefix.'categories SET cat_name=\''.$pun_db->escape($cat_name[$i]).'\', disp_position='.$cat_order[$i].' WHERE id='.$cat_id) or error('Unable to update category', __FILE__, __LINE__, $pun_db->error());
}
// Regenerate the quickjump cache
require_once PUN_ROOT.'include/cache.php';
generate_quickjump_cache();
pun_redirect('admin_categories.php', 'Categories updated. Redirecting …');
}
// Generate an array with all categories
$result = $pun_db->query('SELECT id, cat_name, disp_position FROM '.$pun_db->prefix.'categories ORDER BY disp_position') or error('Unable to fetch category list', __FILE__, __LINE__, $pun_db->error());
$num_cats = $pun_db->num_rows($result);
for ($i = 0; $i < $num_cats; ++$i)
$cat_list[] = $pun_db->fetch_row($result);
$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / Admin / Categories';
require PUN_ROOT.'header.php';
generate_admin_menu('categories');
?>
<div class="blockform">
<h2><span>Add/remove/edit categories</span></h2>
<div class="box">
<form method="post" action="admin_categories.php?action=foo">
<div class="inform">
<fieldset>
<legend>Add/delete categories</legend>
<div class="infldset">
<table class="aligntop" cellspacing="0">
<tr>
<th scope="row">Add a new category<div><input type="submit" name="add_cat" value="Add New" tabindex="2" /></div></th>
<td>
<input type="text" name="new_cat_name" size="35" maxlength="80" tabindex="1" />
<span>The name of the new category you want to add. You can edit the name of the category later (see below).Go to <a href="admin_forums.php">Forums</a> to add forums to your new category.</span>
</td>
</tr>
<?php if ($num_cats): ?> <tr>
<th scope="row">Delete a category<div><input type="submit" name="del_cat" value="Delete" tabindex="4" /></div></th>
<td>
<select name="cat_to_delete" tabindex="3">
<?php
while (list(, list($cat_id, $cat_name, ,)) = @each($cat_list))
echo "\t\t\t\t\t\t\t\t\t\t".'<option value="'.$cat_id.'">'.pun_htmlspecialchars($cat_name).'</option>'."\n";
?>
</select>
<span>Select the name of the category you want to delete. You will be asked to confirm your choice of category for deletion before it is deleted.</span>
</td>
</tr>
<?php endif; ?> </table>
</div>
</fieldset>
</div>
<?php if ($num_cats): ?> <div class="inform">
<fieldset>
<legend>Edit categories</legend>
<div class="infldset">
<table id="categoryedit" cellspacing="0" >
<thead>
<tr>
<th class="tcl" scope="col">Name</th>
<th scope="col">Position</th>
<th> </th>
</tr>
</thead>
<tbody>
<?php
@reset($cat_list);
for ($i = 0; $i < $num_cats; ++$i)
{
list(, list($cat_id, $cat_name, $position)) = @each($cat_list);
?>
<tr><td><input type="text" name="cat_name[<?php echo $i ?>]" value="<?php echo pun_htmlspecialchars($cat_name) ?>" size="35" maxlength="80" /></td><td><input type="text" name="cat_order[<?php echo $i ?>]" value="<?php echo $position ?>" size="3" maxlength="3" /></td><td> </td></tr>
<?php
}
?>
</tbody>
</table>
<div class="fsetsubmit"><input type="submit" name="update" value="Update" /></div>
</div>
</fieldset>
</div>
<?php endif; ?> </form>
</div>
</div>
<div class="clearer"></div>
</div>
<?php
require PUN_ROOT.'footer.php';