<?php
// +------------------------------------------------------------------------+
// | PHP Melody version 1.6.7 ( www.phpsugar.com )
// +------------------------------------------------------------------------+
// | PHP Melody IS NOT FREE SOFTWARE
// | If you have downloaded this software from a website other
// | than www.phpsugar.com or if you have received
// | this software from someone who is not a representative of
// | phpSugar, you are involved in an illegal activity.
// | ---
// | In such case, please contact: support@phpsugar.com.
// +------------------------------------------------------------------------+
// | Developed by: phpSugar (www.phpsugar.com) / support@phpsugar.com
// | Copyright: (c) 2004-2011 PhpSugar.com. All rights reserved.
// +------------------------------------------------------------------------+

$showm = '6';
include('header.php');

$action		= $_GET['a'];
$page		= (int) $_GET['page'];
$userid		= (int) trim($_GET['uid']);

if(empty($page))
	$page = 1;
$limit = 20;
$from = $page * $limit - ($limit);


$total_members = count_entries('pm_banlist','','');

?>
<div id="sub_menu">
<ul>
<li><a href="banlist.php">Manage ban list</a></li>
<li><a href="members_export.php" class="hintanchor" onMouseover="showhint('The exported CSV is Outlook 2007 compatible. It is also supported by any other mailing list software that allows contacts import.', this, event, '250px')">Export to CSV</a></li>
</ul>
</div>
<div id="content">
<h2>Ban list</h2>
<?php echo $info_msg; ?>
<br />
<table width="100%" border="0" cellspacing="1" cellpadding="3">
  <tr>
  	<td valign="top"><a href="banlist.php?a=ban" class="b_edit">Ban user</a></td>
    <td width="220" valign="top"><div class="totals">Total bans: <?php echo $total_members; ?></div>
	</td>
  </tr>
</table>
<?php

switch($action)
{
	case 'ban':
	
		if(isset($_POST['Submit']))
		{
			$username = trim($_POST['username']);
			$reason = trim($_POST['reason']);
			$reason = nl2br($reason);
			$reason = secure_sql($reason);
			
			$sql = "SELECT id, power FROM pm_users WHERE username LIKE '".secure_sql($username)."'";
			$result = mysql_query($sql);
			if(!$result)
			{
				$info_msg = '<div class="info_msg_err">An error occurred!<br />MySQL Reported: '.mysql_error().'</div>';
			}
			else
			{
				if(mysql_num_rows($result) == 0)
				{
					$info_msg = '<div class="info_msg_err">User not found</div>';
				}
				else
				{
					$info = mysql_fetch_assoc($result);
					if ($info['id'] == $userdata['id'])
					{
						$info_msg = '<div class="info_msg_err">You can\'t do that.</div>';
					}
					else if ($info['power'] != U_ADMIN)
					{
						$sql = "INSERT INTO pm_banlist SET user_id = '".$info['id']."', reason ='".$reason."'";
						$result = mysql_query($sql);
						if ( ! $result)
						{
							$info_msg = '<div class="info_msg_err">An error occurred!<br />MySQL Reported: '.mysql_error().'</div>';
						}
						else
							$info_msg = '<div class="info_msg_ok">The banlist has been updated successfully!</div>';
					}
					else
						$info_msg = '<div class="info_msg_err">Administrator accounts cannot be banned!</div>';
				}
			}
		}
				
		echo $info_msg;
		//	show form
		?>
		<form name="ban_user" action="banlist.php?a=ban" method="post">
		<table width="100%" border="0" cellpadding="4">
		  <tr class="table_row1">
			<td class="fieldtitle" valign="top">Username:</td>
			<td><input type="text" name="username" value="<?php echo $_POST['username'];?>" size="40" /></td>
		  </tr>
		  <tr class="table_row1">
			<td class="fieldtitle" valign="top">Reason:<br /><small>Optional</small></td>
			<td><textarea name="reason" cols="60" rows="7"><?php echo $_POST['reason'];?></textarea></td>
		  </tr>
		  <tr>
			<td>&nbsp;</td>
			<td><input type="submit" name="Submit" value="Ban" class="inputbutton" /></td>
		  </tr>
		</table>
		</form>
		<?php
	break;
	default:
	case 'delete':
	case 'show':
		if($action == 'delete')
		{
			if(!empty($userid))
			{
				$sql = "DELETE FROM pm_banlist WHERE user_id = '".$userid."'";
				$result = mysql_query($sql);
				if(!$result)
				{
					$info_msg = '<div class="info_msg_err">An error occurred!<br />MySQL Reported: '.mysql_error().'</div>';
				}
				else
				{
					$info_msg = '<div class="info_msg_ok">The ban list was updated!</div>';
				}
			}
			else
			{
				$info_msg = '<div class="info_msg_err">"'.$userid.'" is not a valid user ID.</div>';
			}
			echo $info_msg;
		}
	
		$banlist = a_list_banned($from, $limit);
		
		// generate smart pagination
		$filename = 'banlist.php';
	
		$pagination = '';
		$pagination = a_generate_smart_pagination($page, $total_members, $limit, 1, $filename, '');		
	?>
<table class="tablesorter" cellspacing="1">
 <thead>
  <tr>
   <th width="35">ID</th>
   <th width="210">Username</th>
   <th>Reason</th>
   <th width="110">Action</th>
  </tr>
 </thead>
 <tbody>
  <?php echo $banlist; ?>
 </tbody>
</table>

<div align="center"><?php echo $pagination; ?></div>
</div>	
	<?php
			
	break;
}

?>
</div>
<?php
include('footer.php');
?>