rendered paste body<?
require "include/bittorrent.php";
dbconn();
loggedinorreturn();
function puke($text = "w00t")
{
stderr("w00t", $text);
}
if (get_user_class() < UC_MODERATOR)
puke();
$action = $_POST["action"];
if ($action == "confirmuser") {
$userid = 0 + $_POST["userid"];
$confirm = sqlesc($_POST["confirm"]);
mysql_query("UPDATE users SET status = $confirm WHERE id = $userid LIMIT 1") or sqlerr(__FILE__, __LINE__);
header("Location: $BASEURL/unco.php");
die;
}
if ($action == "edituser")
{
$userid = $_POST["userid"];
$title = $_POST["title"];
$avatar = $_POST["avatar"];
$signature = $_POST["signature"];
$enabled = $_POST["enabled"];
$uploadpos = $_POST["uploadpos"];
$downloadpos = $_POST["downloadpos"];
$shoutboxpos = $_POST["shoutboxpos"];
$comments = $_POST["comments"];
$sendpmpos = $_POST["sendpmpos"];
$forumpost = $_POST["forumpost"];
$commentallow = $_POST["commentallow"];
$parked = $_POST["parked"];
$warned = 0 + $_POST["warned"];
$warnlength = 0 + $_POST["warnlength"];
$warnpm = $_POST["warnpm"];
$donor = $_POST["donor"];
$invites = $_POST["invites"];
$support = $_POST["support"];
$supportfor = $_POST["supportfor"];
$modcomment = $_POST["modcomment"];
$addcomment = $_POST["addcomment"];
$downloaded = $_POST["downloaded"];
$uploaded = $_POST["uploaded"];
$cheat_flag = 0 + $_POST["cheat_flag"];
$allowdupe = $_POST["allowdupe"];
if ($_POST["downloaded"] > 0) {
for ($i = 0; $i < $_POST["downloadsize"]; $i++) {
$downloaded = $downloaded * 1024;
}
} else $downloaded = 0;
if ($uploaded > 0) {
for ($i = 0; $i < $_POST["uploadsize"]; $i++) {
$uploaded = $uploaded * 1024;
$up2 = 0 + $uploaded;
// print $i . ": " . $up2 . "<br>";
}
//die;
} else $uploaded = 0;
$email = $_POST["email"];
$username = $_POST["username"];
$cheat_flag = $_POST["cheat_flag"];
$class = 0 + $_POST["class"];
if (!is_valid_id($userid) || !is_valid_user_class($class))
stderr("Error", "Bad user ID or class ID.");
// check target user class
$res = mysql_query("SELECT * FROM users WHERE id=$userid") or sqlerr(__FILE__, __LINE__);
$arr = mysql_fetch_assoc($res) or puke();
$curenabled = $arr["enabled"];
$curuploadpos = $arr["uploadpos"];
$curdownloadpos = $arr["downloadpos"];
$curshoutboxpos = $arr["shoutboxpos"];
$curcomments = $arr["comments"];
$cursendpmpos = $arr["sendpmpos"];
$curforumpost = $arr["forumpost"];
$curparked = $arr["parked"];
$curcomment = $arr["comment"];
$curclass = $arr["class"];
$curwarned = $arr["warned"];
$passkey = $arr["passkey"];
// User may not edit someone with same or higher class than himself!
if ($curclass >= get_user_class())
puke();
if ($curclass != $class)
{
// Notify user
$what = ($class > $curclass ? "promoted" : "demoted");
$msg = sqlesc("You have been $what to '" . get_user_class_name($class) . "' by $CURUSER[username].");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES(0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
$updateset[] = "class = $class";
$what = ($class > $curclass ? "Promoted" : "Demoted");
$modcomment = gmdate("Y-m-d") . " - $what to '" . get_user_class_name($class) . "' by $CURUSER[username].\n". $modcomment;
}
// some Helshad fun
$fun = "";
if ($curwarned != $warned)
{
$updateset[] = "warned = " . sqlesc($warned);
$updateset[] = "warneduntil = '0000-00-00 00:00:00'";
if ($warned == 0)
{
$modcomment = gmdate("Y-m-d") . " - Warning removed by " . $CURUSER['username'] . ".\n". $modcomment;
$msg = sqlesc("Your warning has been removed by " . $CURUSER['username'] . ".");
}
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
elseif ($warnlength)
{
if ($warnlength == 255)
{
$modcomment = gmdate("Y-m-d") . " - Warned by " . $CURUSER['username'] . ".\nReason: $warnpm\n" . $modcomment;
$msg = sqlesc("You have received a [url=rules.php#warning]warning[/url] from $CURUSER[username].$fun" . ($warnpm ? "\n\nReason: $warnpm" : ""));
$updateset[] = "warneduntil = '0000-00-00 00:00:00'";
}
else
{
$warneduntil = get_date_time(gmtime() + $warnlength * 604800);
$dur = $warnlength . " week" . ($warnlength > 1 ? "s" : "");
$msg = sqlesc("You have received a $dur [url=rules.php#warning]warning[/url] from " . $CURUSER['username'] . ".$fun" . ($warnpm ? "\n\nReason: $warnpm" : ""));
$modcomment = gmdate("Y-m-d") . " - Warned for $dur by " . $CURUSER['username'] . ".\nReason: $warnpm\n" . $modcomment;
$updateset[] = "warneduntil = '$warneduntil'";
}
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
$updateset[] = "warned = 1";
}
if ($enabled != $curenabled)
{
if ($enabled == 'yes')
$modcomment = gmdate("Y-m-d") . " - Enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
else
$modcomment = gmdate("Y-m-d") . " - Disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
}
if($addcomment != "")
{
$modcomment = gmdate("Y-m-d") . " - ".$addcomment." - " . $CURUSER['username'] . ".\n" . $modcomment;
}
if ($forumpost != $curforumpost)
{
if ($forumpost == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Posting enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your Posting rights have been given back by " . $CURUSER['username'] . ". You can post to forum again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Posting disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your Posting rights have been removed by " . $CURUSER['username'] . ", propably because of bad Atitdue or description.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($uploadpos != $curuploadpos)
{
if ($uploadpos == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Upload enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your upload rights have been given back by " . $CURUSER['username'] . ". You can upload torrents again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Upload disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your upload rights have been removed by " . $CURUSER['username'] . ", propably because of bad torrent .nfo or description.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($downloadpos != $curdownloadpos)
{
if ($downloadpos == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Download enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your download rights have been given back by " . $CURUSER['username'] . ". You can download torrents again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Download disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your download rights have been removed by " . $CURUSER['username'] . ", possibly because of a bad ratio, bad torrent nfo or description.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($shoutboxpos != $curshoutboxpos)
{
if ($shoutboxpos == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Shoutbox Post enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your shoutbox rights have been given back by " . $CURUSER['username'] . ". You can post in the shoutbox again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Shoutbox Post disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your shoutbox rights have been removed by " . $CURUSER['username'] . ", because you have ignored the shoutbox rules");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($sendpmpos != $cursendpmpos)
{
if ($sendpmpos == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - PM enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("PM rights have been given back by " . $CURUSER['username'] . ". ");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - PM disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("PM rights have been removed by " . $CURUSER['username'] . ", propably because of bad torrent .nfo or description.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($comments != $curcomments)
{
if ($comments == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Torrent comments enabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your Torrent comments rights have been given back by " . $CURUSER['username'] . ". You can post comments again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Torrent comments disabled by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your Torrent comments rights have been removed by " . $CURUSER['username'] . ", propably because of bad Atitdue or description.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
if ($parked != $curparked)
{
if ($parked == 'yes')
{
$modcomment = gmdate("Y-m-d") . " - Parked by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your account has set to be in parked mode by " . $CURUSER['username'] . ". You can remove this in your profile when you are ready to use your account again.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
else
{
$modcomment = gmdate("Y-m-d") . " - Parking removed by " . $CURUSER['username'] . ".\n" . $modcomment;
$msg = sqlesc("Your account has been removed from parked status by " . $CURUSER['username'] . ", propably because you requested it or did it on accident.");
$added = sqlesc(get_date_time());
mysql_query("INSERT INTO messages (sender, receiver, msg, added) VALUES (0, $userid, $msg, $added)") or sqlerr(__FILE__, __LINE__);
}
}
// The following code will place the old passkey in the mod comment and create
// a new passkey. This is good practice as it allows usersearch to find old
// passkeys by searching the mod comments of members.
// Reset Passkey
if ((isset($_POST['resetpasskey'])) && ($_POST['resetpasskey']))
{
$newpasskey = md5($user['username'].get_date_time().$user['passhash']);
$modcomment = gmdate("Y-m-d") . " - Passkey $passkey Reset to $newpasskey by " . $CURUSER['username'] . ".\n" . $modcomment;
$updateset[] = "passkey=".sqlesc($newpasskey);
}
$updateset[] = "enabled = " . sqlesc($enabled);
$updateset[] = "uploadpos = " . sqlesc($uploadpos);
$updateset[] = "downloadpos = " . sqlesc($downloadpos);
$updateset[] = "shoutboxpos = " . sqlesc($shoutboxpos);
// $updateset[] = "comments = " . sqlesc($comments);
// $updateset[] = "sendpmpos = " . sqlesc($sendpmpos);
$updateset[] = "forumpost = " . sqlesc($forumpost);
$updateset[] = "allow_comment = " . sqlesc($commentallow);
// $updateset[] = "parked = " . sqlesc($parked);
$updateset[] = "donor = " . sqlesc($donor);
$updateset[] = "invites = " . sqlesc($invites);
$updateset[] = "supportfor = " . sqlesc($supportfor);
$updateset[] = "support = " . sqlesc($support);
$updateset[] = "avatar = " . sqlesc($avatar);
// $updateset[] = "signature = " . sqlesc($signature);
$updateset[] = "title = " . sqlesc($title);
$updateset[] = "modcomment = " . sqlesc($modcomment);
$updateset[] = "downloaded = " . sqlesc($downloaded);
$updateset[] = "uploaded = " . sqlesc($uploaded);
$updateset[] = "email = " . sqlesc($email);
$updateset[] = "username = " . sqlesc($username);
$updateset[] = "cheat_flag = " . sqlesc($cheat_flag);
$updateset[] = "allowdupe = " . sqlesc($allowdupe);
$chpassword = $_POST["chpassword"];
$passagain = $_POST["passagain"];
if ($chpassword != "") {
if (strlen($chpassword) > 40)
stderr("Error", "Sorry, password is too long (max is 40 chars)");
if ($chpassword != $passagain)
stderr("Error", "Oops the passwords dont match!");
$sec = mksecret();
$passhash = md5($sec . $chpassword . $sec);
$updateset[] = "secret = " . sqlesc($sec);
$updateset[] = "passhash = " . sqlesc($passhash);
}
mysql_query("UPDATE users SET " . implode(", ", $updateset) . " WHERE id=$userid") or sqlerr(__FILE__, __LINE__);
$returnto = htmlentities($_POST["returnto"]);
header("Location: $BASEURL/$returnto");
die;
}
puke();
?>