rendered paste body<?php// Make sure no one attempts to run this script "directly"if (!defined('PUN')) exit;// Tell admin_loader.php that this is indeed a plugin and that it is loadeddefine('PUN_PLUGIN_LOADED', 1);if (isset($_POST['add_item'])){ $item_name = $db->escape(trim($_POST['item_name'])); $item_description = $db->escape(trim($_POST['item_description'])); $item_price = intval($_POST['item_price']); $item_quantity = intval($_POST['item_quantity']); $item_rarity = intval($_POST['item_rarity']); $item_image = $db->escape(trim($_POST['item_image'])); if (strlen($item_name) == 0) message('Items need names, you know.'); if (strlen($item_description) == 0) message('Items need some info or you don\'t know what it is.'); if ($item_price < 0) message('You can\'t sell an item for less than 0 '.$pun_config['cm_cur_name'].'.'); if ($item_quantity < 0) message('You can\'t have a negative number of an item in the shop.'); if ($item_rarity < 0) message('An item may not have a negative rarity.'); if (strlen($item_image) == 0) message('An image might be handy.'); $db->query('INSERT INTO '.$db->prefix.'items (item_name, description, item_cost, item_quantity, item_rarity, item_image) VALUES ("'.$item_name.'", "'.$item_description.'", '.$item_price.', '.$item_quantity.', '.$item_rarity.', "'.$item_image.'")') or error('Unable to add new item', __FILE__, __LINE__, $db->error()); redirect($_SERVER['REQUEST_URI'], 'Item added. Redirecting …');}else if (isset($_POST['update_items'])){ while (list($item_id, $item_info) = @each($_POST['item'])) { $item_price = intval($item_info['item_price']); $item_description = intval($item_info['item_description']); $item_quantity = intval($item_info['item_quantity']); $item_rarity = intval($item_info['item_rarity']); $item_image = trim($item_info['item_image']); if ($item_description < 0) message('You should add info so everyone knows what it is.'); if ($item_price < 0) message('You can\'t sell an item for less than 0 '.$pun_config['cm_cur_name'].'.'); if ($item_quantity < 0) message('You can\'t have a negative number of an item in the shop.'); if ($item_rarity < 0) message('An item may not have a negative rarity.'); $db->query('UPDATE '.$db->prefix.'items SET item_description="'.$item_description.'", item_cost='.$item_price.', item_quantity='.$item_quantity.', item_rarity='.$item_rarity.' WHERE item_id='.intval($item_id)) or error('Unable to update item', __FILE__, __LINE__, $db->error()); } redirect($_SERVER['REQUEST_URI'], 'Items updated. Redirecting …');}else{ // Display the admin navigation menu generate_admin_menu($plugin);?> <div class="blockform"> <h2><span>Add item</span></h2> <div class="box"> <form method="post" action="<?php echo $_SERVER['REQUEST_URI'] ?>"> <div class="inform"> <fieldset> <legend>Create a new item</legend> <div class="infldset"> <table class="aligntop" cellspacing="0"> <tr> <th scope="row">Item Image</th> <td> <input type="text" name="item_image" size="30" maxlength="255" /> <span>The image for this item.</span> </td> </tr> <tr> <th scope="row">Item Name</th> <td> <input type="text" name="item_name" size="30" maxlength="255" /> <span>The name for the new item you are creating.</span> </td> </tr> <th scope="row">Item Description</th> <td> <input type="text" name="item_description" size="20" maxlength="400" /> <span>The info for the new item you are creating.</span> </td> </tr> <tr> <th scope="row">Item Price</th> <td> <input type="text" name="item_price" size="8" maxlength="8" /> <span>The price for the new item you are creating.</span> </td> </tr> <tr> <th scope="row">Item Quantity</th> <td> <input type="text" name="item_quantity" value="1" size="3" maxlength="4" /> <span>The quantity of the new item you are creating.</span> </td> </tr> <tr> <th scope="row">Item Rarity</th> <td> <input type="text" name="item_rarity" value="1" size="3" maxlength="3" /> <span>The rarity of new item you are creating.</span> </td> </tr> </table> </div> </fieldset> </div> <p class="submitend"><input type="submit" name="add_item" value="Add" tabindex="<?php echo $tabindex_count ?>" /></p> </form> </div><?php // Display all the categories and forums $result = $db->query('SELECT '.$db->prefix.'items.* FROM '.$db->prefix.'items ORDER BY item_name') or error('Unable to fetch item list', __FILE__, __LINE__, $db->error()); if ($db->num_rows($result) > 0) {?> <h2 class="block2"><span>Edit items</span></h2> <div class="box"> <form method="post" action="<?php echo $_SERVER['REQUEST_URI'] ?>"> <p class="submittop"><input type="submit" name="update_items" value="Update positions" tabindex="3" /></p> <div class="inform"> <fieldset> <legend>Item List:</legend> <div class="infldset"> <table cellspacing="0"><?php $tabindex_count = 4; while ($cur_item = $db->fetch_assoc($result)) {?> <tr> <th><?php echo pun_htmlspecialchars($cur_item['item_name']) ?></th> <td> Description <input type="text" name="item[<?php echo $cur_item['item_id'] ?>][item_description]" size="8" maxlength="400" value="<?php echo $cur_item['item_description'] ?>" tabindex="<?php echo $tabindex_count++ ?>" /> Price<input type="text" name="item[<?php echo $cur_item['item_id'] ?>][item_price]" size="8" maxlength="8" value="<?php echo $cur_item['item_cost'] ?>" tabindex="<?php echo $tabindex_count++ ?>" /> Quantity <input type="text" name="item[<?php echo $cur_item['item_id'] ?>][item_quantity]" size="3" maxlength="4" value="<?php echo $cur_item['item_quantity'] ?>" tabindex="<?php echo $tabindex_count++ ?>" /> Rarity <input type="text" name="item[<?php echo $cur_item['item_id'] ?>][item_rarity]" size="3" maxlength="3" value="<?php echo $cur_item['item_rarity'] ?>" tabindex="<?php echo $tabindex_count++ ?>" /> Image <?php echo pun_htmlspecialchars($cur_item['item_image']) ?> </td> </tr><?php }?> </table> </div> </fieldset> </div> <p class="submitend"><input type="submit" name="update_items" value="Update items" tabindex="<?php echo $tabindex_count++ ?>" /></p> </form> </div> <h2 class="block2"><span>Upload Image</span></h2> <div class="box"> <?php $file_dir = "img/items/"; foreach($_FILES as $file_name => $file_array) { if (is_uploaded_file($file_array['tmp_name'])) { move_uploaded_file($file_array['tmp_name'], $file_dir.'/'.$file_array['name']) or die("Couldn't copy."); } } ?> <form method="post" action="<?php echo $_SERVER['REQUEST_URI'] ?>" enctype="multipart/form-data"> <input type="hidden" name="MAX_FILE_SIZE" value="51200" /> <div class="inform"> <fieldset> <legend>Image Upload</legend> <div class="infldset"> <p><strong>File to upload:</strong> <input type="file" name="fileupload" /></p> </div> </fieldset> </div> <p class="submitend"><input type="submit" name="upload_image" value="Upload Image" tabindex="<?php echo $tabindex_count++ ?>" /></p> </form> </div> </div><?php }}