\n";
// user must be in user group
// or superadmin
$query = "SELECT uid FROM ".db_table_name('user_in_groups') ." WHERE ugid = {$ugid} AND uid = {$_SESSION['loginID']}";
$result = db_execute_assoc($query); //Checked
if($result->RecordCount() > 0 ||
$_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$eguquery = "SELECT * FROM ".db_table_name("user_in_groups")." AS a INNER JOIN ".db_table_name("users")." AS b ON a.uid = b.uid WHERE ugid = " . $ugid . " AND b.uid != {$_SESSION['loginID']} ORDER BY b.users_name";
$eguresult = db_execute_assoc($eguquery); //Checked
$addressee = '';
$to = '';
while ($egurow = $eguresult->FetchRow())
{
$to .= $egurow['users_name']. ' <'.$egurow['email'].'>'. '; ' ;
$addressee .= $egurow['users_name'].', ';
}
$to = substr("$to", 0, -2);
$addressee = substr("$addressee", 0, -2);
$from_user = "SELECT email, users_name, full_name FROM ".db_table_name("users")." WHERE uid = " .$_SESSION['loginID'];
$from_user_result = db_execute_assoc($from_user); //Checked
$from_user_row = $from_user_result->FetchRow();
if ($from_user_row['full_name'])
{
$from = $from_user_row['full_name'].' <'.$from_user_row['email'].'> ';
}
else
{
$from = $from_user_row['users_name'].' <'.$from_user_row['email'].'> ';
}
$ugid = $postusergroupid;
$body = $_POST['body'];
$subject = $_POST['subject'];
if(isset($_POST['copymail']) && $_POST['copymail'] == 1)
{
$to .= ", " . $from;
}
$body = str_replace("\n.", "\n..", $body);
$body = wordwrap($body, 70);
//echo $body . '-'.$subject .'-'.'
'.'-'.$from;
if (SendEmailMessage(null, $body, $subject, $to, $from,''))
{
$usersummary = "
\n";
$usersummary .= "\n"
. "
".$clang->gT("To:")."". $addressee."
\n"
. "
gT("Continue")."\"/>\n";
}
else
{
$usersummary = "
\n";
$usersummary .= "";
if ($debug>0)
{
$usersummary .= "
Subject : $subject
".htmlspecialchars($maildebugbody)."
";
}
$usersummary .= "
gT("Continue")."\"/>\n";
}
}
else
{
include("access_denied.php");
}
$usersummary .= "
\n";
}
if ($action == "editusergroupindb")
{
if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$ugid = $postusergroupid;
$db_name = db_quote($_POST['name']);
$db_description = db_quote($_POST['description']);
$html_name = html_escape($_POST['name']);
$html_description = html_escape($_POST['description']);
$usersummary = "
\n";
if(updateusergroup($db_name, $db_description, $ugid))
{
$usersummary .= "\n"
. "
".$clang->gT("Name").": {$html_name}
\n"
. $clang->gT("Description: ").$html_description."
\n"
. "
".$clang->gT("Continue")." \n";
}
else
{
$usersummary .= "\n"
. "
".$clang->gT("Continue")." \n";
}
$usersummary .= "
\n";
}
else
{
include("access_denied.php");
}
}
if ($action == "editusergroups" )
{
// REMOVING CONDITION ON loginID == 1
// editusergroups is only to display groups
// a user is in
//if ( $_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
if ( isset($_SESSION['loginID']))
{
if(isset($_GET['ugid']))
{
$ugid = sanitize_int($_GET['ugid']);
$query = "SELECT a.ugid, a.name, a.owner_id, a.description, b.uid FROM ".db_table_name('user_groups') ." AS a LEFT JOIN ".db_table_name('user_in_groups') ." AS b ON a.ugid = b.ugid WHERE a.ugid = {$ugid} AND uid = {$_SESSION['loginID']} ORDER BY name";
$result = db_execute_assoc($query); //Checked
$crow = $result->FetchRow();
if($result->RecordCount() > 0)
{
if(!empty($crow['description']))
{
$usergroupsummary .= "
\n"
. "| "
. "".$clang->gT("Description: ").""
. "{$crow['description']} |
\n"
. "
";
}
$eguquery = "SELECT * FROM ".db_table_name("user_in_groups")." AS a INNER JOIN ".db_table_name("users")." AS b ON a.uid = b.uid WHERE ugid = " . $ugid . " ORDER BY b.users_name";
$eguresult = db_execute_assoc($eguquery); //Checked
$usergroupsummary .= "
\n"
. "\n"
. "| ".$clang->gT("Action")." | \n"
. "".$clang->gT("Username")." | \n"
. "".$clang->gT("Email")." | \n"
. "
\n";
$query2 = "SELECT ugid FROM ".db_table_name('user_groups')." WHERE ugid = ".$ugid." AND owner_id = ".$_SESSION['loginID'];
$result2 = db_select_limit_assoc($query2, 1);
$row2 = $result2->FetchRow();
$row = 1;
$usergroupentries='';
while ($egurow = $eguresult->FetchRow())
{
if (!isset($bgcc)) {$bgcc="evenrow";}
else
{
if ($bgcc == "evenrow") {$bgcc = "oddrow";}
else {$bgcc = "evenrow";}
}
if($egurow['uid'] == $crow['owner_id'])
{
$usergroupowner = "\n"
. "| | \n"
. "{$egurow['users_name']} | \n"
. "{$egurow['email']} | \n"
. "
";
continue;
}
// output users
$usergroupentries .= "\n"
. "| \n";
if($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$usergroupentries .= ""
. " | \n";
$usergroupentries .= "{$egurow['users_name']} | \n"
. "{$egurow['email']} | \n"
. "
\n";
$row++;
}
$usergroupsummary .= $usergroupowner;
if (isset($usergroupentries)) {$usergroupsummary .= $usergroupentries;};
$usergroupsummary .= '
';
if(isset($row2['ugid']))
{
$usergroupsummary .= "
\n";
}
}
else
{
include("access_denied.php");
}
}
}
else
{
include("access_denied.php");
}
}
if($action == "deleteuserfromgroup")
{
$usersummary = "\n";
$usersummary .= "
\n";
if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$ugid = $postusergroupid;
$uid = $postuserid;
$query = "SELECT ugid, owner_id FROM ".db_table_name('user_groups')." WHERE ugid = ".$ugid." AND ((owner_id = ".$_SESSION['loginID']." AND owner_id != ".$uid.") OR (owner_id != ".$_SESSION['loginID']." AND $uid = ".$_SESSION['loginID']."))";
$result = db_execute_assoc($query); //Checked
if($result->RecordCount() > 0)
{
$remquery = "DELETE FROM ".db_table_name('user_in_groups')." WHERE ugid = {$ugid} AND uid = {$uid}";
if($connect->Execute($remquery)) //Checked
{
$usersummary .= "
".$clang->gT("Username").": ".sanitize_xss_string(strip_tags($_POST['user']))."
\n";
$usersummary .= "\n";
}
else
{
$usersummary .= "\n";
}
}
else
{
include("access_denied.php");
}
if($_SESSION['loginID'] != $postuserid)
{
$usersummary .= "
gT("Continue")."\"/>\n";
}
else
{
$usersummary .= "
gT("Continue")."\"/>\n";
}
}
else
{
include("access_denied.php");
}
$usersummary .= "
\n";
}
if($action == "addusertogroup")
{
$ugid=returnglobal('ugid');
$addsummary = "\n";
$addsummary .= "
\n";
if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$query = "SELECT ugid, owner_id FROM ".db_table_name('user_groups')." WHERE ugid = {$ugid} AND owner_id = ".$_SESSION['loginID']." AND owner_id != ".$postuserid;
$result = db_execute_assoc($query); //Checked
if($result->RecordCount() > 0)
{
if($postuserid > 0)
{
$isrquery = "INSERT INTO {$dbprefix}user_in_groups VALUES({$ugid},{$postuserid})";
$isrresult = $connect->Execute($isrquery); //Checked
if($isrresult)
{
$addsummary .= "\n";
}
else // ToDo: for this to happen the keys on the table must still be set accordingly
{
// Username already exists.
$addsummary .= "\n"
. "
" . $clang->gT("Username already exists.")."
\n";
}
}
else
{
$addsummary .= "\n"
. "
" . $clang->gT("No Username selected.")."
\n";
}
$addsummary .= "
gT("Continue")."\"/>\n";
}
else
{
include("access_denied.php");
}
}
else
{
include("access_denied.php");
}
$addsummary .= "
\n";
}
function updateusergroup($name, $description, $ugid)
{
global $dbprefix, $scriptname, $connect;
$uquery = "UPDATE ".db_table_name('user_groups')." SET name = '$name', description = '$description' WHERE ugid =$ugid";
// TODO
return $connect->Execute($uquery) or safe_die($connect->ErrorMsg()) ; //Checked
}
function refreshtemplates() {
global $connect ;
global $dbprefix ;
$template_a = gettemplatelist();
foreach ($template_a as $tp=>$fullpath) {
// check for each folder if there is already an entry in the database
// if not create it with current user as creator (user with rights "create user" can assign template rights)
$query = "SELECT * FROM ".$dbprefix."templates WHERE folder LIKE '".$tp."'";
$result = db_execute_assoc($query) or safe_die($connect->ErrorMsg()); //Checked
if ($result->RecordCount() == 0) {
$query2 = "INSERT INTO ".$dbprefix."templates (".db_quote_id('folder').",".db_quote_id('creator').") VALUES ('".$tp."', ".$_SESSION['loginID'].')' ;
$connect->Execute($query2) or safe_die($connect->ErrorMsg()); //Checked
}
}
return true;
}
// adds Usergroups in Database by Moses
function addUserGroupInDB($group_name, $group_description) {
global $connect;
$iquery = "INSERT INTO ".db_table_name('user_groups')." (name, description, owner_id) VALUES('{$group_name}', '{$group_description}', '{$_SESSION['loginID']}')";
if($connect->Execute($iquery)) { //Checked
$id = $connect->Insert_Id(db_table_name_nq('user_groups'),'ugid');
if($id > 0) {
$iquery = "INSERT INTO ".db_table_name('user_in_groups')." VALUES($id, '{$_SESSION['loginID']}')";
$connect->Execute($iquery ) or safe_die($connect->ErrorMsg()); //Checked
}
return $id;
} else {
return -1;
}
}
?>
\n"
. "
\n";
if($ugid && $grpresultcount > 0)
{
$usergroupsummary .= " "
."
\n" ;
}
else
{
$usergroupsummary .= "
\n" ;
}
else
{
$usergroupsummary .= "
\n";
}
else
{
$usergroupsummary .= "
\n";
}
$usergroupsummary .= "