<?php
session_start();
function goto($seite) {
header("Location: $seite");
}
if(!file_exists("config.php"))
header("Location: ../installer/index.php");
else include 'config.php';
$admin = false;
if($_SESSION['alert'] == "") $_SESSION['alert'] = false;
if(isset($_GET['go']))
if($_GET['go'] == "logout")
unset($_SESSION['user_res']);
if(isset($_GET['activate']))
if($_GET['activate'] != "")
{
echo "<body><div id=\"main\" align=\"center\">";
$code = $acti;
$sql = "SELECT id,pass FROM user";
$result = mysql_query($sql);
while($zeile = mysql_fetch_object($result))
if(md5($zeile->pass) == $code)
$activate_id = $zeile->id;
$sql = "UPDATE user SET activated = 1 WHERE id = '$activate_id' LIMIT 1";
if(mysql_query($sql))
echo "Ihr Account wurde erfolgreich aktiviert. Sie können sich jetzt <a href='login.php'>einloggen</a>.";
else echo "Bei der Aktivierung ist ein Fehler aufgetreten!";
echo "</div>";
}
else
// Session gesetzt, dann Session prüfen und ggf. weiterleiten
if(!isset($_SESSION['user_res']))
goto("login.php");
else
{
$ses = $_SESSION['user_res'];
$user_data = explode("_",$ses);
$uid = $user_data[0];
$pass = $user_data[1];
$sql = "SELECT id,pass,is_admin FROM user WHERE id = '$uid' LIMIT 1";
$sql_data = mysql_fetch_object(mysql_query($sql));
if($sql_data->pass == $pass)
{
// Session auffrischen
$_SESSION['user_res'] = $uid."_".$pass;
if($sql_data->is_admin == 1)
{
$admin = true;
}
}
else
{
unset($_SESSION['user_res']);
goto("login.php");
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Admin-Script | Eingeloggt</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="publisher" content= "Philipp Seckel">
<meta name="robots" content= "INDEX,FOLLOW">
<meta name="author" content="Philipp Seckel">
<link href="css/style.css" type="text/css" rel="stylesheet">
</head>
<?php
// Start geschützter Bereich
$i = 0;
$sql = "SELECT * FROM msg WHERE an = '$uid' AND del_rec = '0' AND gelesen = '0'";
$result = mysql_query($sql);
while($zeile = mysql_fetch_object($result))
$i++;
echo "<body";
if($i > 0 && $_SESSION['alert']!=true)
{
echo " onload=\"javascript:alert('Sie haben neue Nachrichten!')\"";
$_SESSION['alert'] = true;
}
echo "><div id=\"main\" align=\"center\">";
$sql = "SELECT nick FROM user WHERE id = '$uid' LIMIT 1";
$sql_data = mysql_fetch_object(mysql_query($sql));
echo "<h2 id='title'>Willkommen ".ucfirst($sql_data->nick)."!</h2>";
echo "<p id='menu'>
<a href='?go='>Startseite</a>
<a href='?go=projekte'>Projekte</a>
<a href='?go=userlist'>Nutzerliste</a>
<a href='?go=myprofile'>Mein Profil</a>
<a href='?go=msg'>Nachrichten</a>
<a href='?go=logout'>Ausloggen</a>
</p>";
if($_GET['go'] == "")
echo "Script exklusiv für das <font color='red' size='6'>CHIP</font>Forum";
// Verschiedene Aufgaben
if($_GET['go'] == "msg")
include_once 'msg.php';
if($_GET['go'] == "projekte")
include_once 'projekte.php';
if($_GET['go'] == "userlist")
{
echo "<table>
<tr><td>ID:</td><td>Nickname:</td><td>Mail:</td><td>Registriert:</td><td>Aktion:</td></tr>";
$sql = "SELECT * FROM user ORDER BY nick";
$res = mysql_query($sql);
while($zeile = mysql_fetch_object($res))
{
if($admin && $zeile->id != 1)
$action = "<a href='?go=edituser&id=$zeile->id'><img src='images/edit.gif' alt='Edit'></a> <a href='?go=chpw&id=$zeile->id'><img src='images/chpw.gif' alt='ChPw'></a>
<a href='?go=deluser&id=$zeile->id'><img src='images/del.gif' alt='Del'></a>";
else $action = "";
if($zeile->is_admin==1)
$isadmin = "(A)";
else $isadmin="";
if($zeile->id != $uid) $msg = "<a href='?go=msg&open=new&to=$zeile->id'><img src='images/msg.jpg' alt='MSG'></a>"; else $msg = "";
echo "<tr><td>$zeile->id</td><td>$zeile->nick $isadmin</td><td>".str_replace("@"," (at) ",$zeile->mail)."</td><td>$zeile->reg_date</td>
<td>$msg $action</td></tr>\n";
}
echo "</table>";
}
if($_GET['go'] == "myprofile")
{
if(isset($_GET['proceed']))
{
$editpw = false;
$mail = $_POST['mail'];
$id = $_POST['id'];
$pass1 = md5($_POST['pass1']);
$pass2 = md5($_POST['pass2']);
if($_POST['pass1'] != "" && $pass1 == $pass2)
$editpw = true;
if($editpw)
$sql = "UPDATE user SET mail = '$mail', pass = '$pass1' WHERE id = '$uid' LIMIT 1";
else $sql = "UPDATE user SET mail = '$mail' WHERE id = '$uid' LIMIT 1";
if(mysql_query($sql))
{
echo "Profil bearbeitet. ";
if($editpw)
{
echo "Passwort geändert.";
$_SESSION['admin_res'] = $uid."_".$pass1;
}
}
else echo "Fehler!";
}
else
{
$sql = "SELECT * FROM user WHERE id = '$uid' LIMIT 1";
$user_data = mysql_fetch_object(mysql_query($sql));
echo "<form action='?go=myprofile&proceed' method='POST'>
<table>
<tr><td>Benutzername:</td><td>$user_data->nick <font size='1'>(Kann nur vom Admin geändert werden)</font></td></tr>
<tr><td>Mail:</td><td><input type='text' value='$user_data->mail' name='mail'></td></tr>
<tr><td>Neues Passwort:</td><td><input type='password' name='pass1'></td></tr>
<tr><td>Neues Passwort wiederholen:</td><td><input type='password' name='pass2'></td></tr>
<tr><td><input type='hidden' value='$uid' name='id'></td><td><input type='submit' value='Bearbeiten'></td></tr>
</table></form>";
}
}
if($_GET['go'] == "edituser" && $admin && $_GET['id'] != 1)
{
if(isset($_GET['proceed']))
{
$id = $_POST['id'];
$nick = $_POST['nick'];
$mail = $_POST['mail'];
$is_admin = $_POST['admin'];
$nick_exists = false;
$sql = "SELECT id,nick FROM user";
$result = mysql_query($sql);
while($row = mysql_fetch_object($result))
if($row->nick == $nick && $row->id != $id)
$nick_exists = true;
if(!$nick_exists)
{
$sql = "UPDATE user SET nick = '$nick', mail = '$mail', is_admin = '$is_admin' WHERE id = '$id' LIMIT 1";
if(mysql_query($sql))
echo "Eintrag bearbeitet.";
else echo "Fehler!";
}
else echo "Der angegebene Benutzername wird bereits verwendet. Bearbeitung abgebrochen.";
}
else
{
$id = $_GET['id'];
$sql = "SELECT * FROM user WHERE id = '$id' LIMIT 1";
$user_data = mysql_fetch_object(mysql_query($sql));
echo "<form action='?go=edituser&proceed' method='POST'>
<table>
<tr><td>Benutzername:</td><td><input type='text' value='$user_data->nick' name='nick'></td></tr>
<tr><td>Mail:</td><td><input type='text' value='$user_data->mail' name='mail'></td></tr>
<tr><td>Admin:</td><td><select name='admin'><option value='0'>Nein</option><option value='1'>Ja</option></select></td></tr>
<tr><td><input type='hidden' value='$id' name='id'></td><td><input type='submit' value='Bearbeiten'></td></tr>
</table></form>";
}
}
if($_GET['go'] == "chpw" && $admin && $_GET['id'] != 1)
{
if(isset($_GET['proceed']))
{
$id = $_POST['id'];
$pass1 = md5($_POST['pass1']);
$pass2 = md5($_POST['pass2']);
if($pass1 == $pass2)
$sql = "UPDATE user SET pass = '$pass1' WHERE id = '$id' LIMIT 1";
if(mysql_query($sql))
echo "Passwort geändert.";
else echo "Fehler! Passwort nicht geändert.";
}
else
{
$id = $_GET['id'];
echo "<form action='?go=chpw&proceed' method='POST'>
<table>
<tr><td>Neues Passwort:</td><td><input type='password' name='pass1'></td></tr>
<tr><td>Neues Passwort wiederholen:</td><td><input type='password' name='pass2'></td></tr>
<tr><td><input type='hidden' value='$id' name='id'></td><td><input type='submit' value='Passwort zuweisen'></td></tr>
</table></form>";
}
}
if($_GET['go'] == "deluser" && $admin && $_GET['id'] != 1)
{
if(isset($_GET['proceed']))
{
$id = $_POST['id'];
$sql = "DELETE FROM user WHERE id = '$id' LIMIT 1";
if(mysql_query($sql))
echo "Benutzer gelöscht!";
else echo "Fehler! Benutzer nicht gelöscht.";
}
else
{
$id = $_GET['id'];
echo "<form action='?go=deluser&proceed' method='POST'>
<table>
<tr><td><input type='hidden' value='$id' name='id'>Nutzer (ID: $id) wirklich löschen?</td><td><input type='submit' value='Löschen'></td></tr>
</table></form>";
}
}
// Ende geschützter Bereich
}
mysql_close($connection);
?>
</div><div id="footer"><table><tr><td align="left">Erstellt: Philipp Seckel <a href="http://www.philipp-s.de?partner=4">www.philipp-s.de</a></td><td align="right">
<a href="http://validator.w3.org"><img
src="http://www.w3.org/Icons/valid-html401-blue"
alt="Valid HTML 4.01 Transitional" width="88" height="31"
border="0"></a></td></tr></table></div>
</html>
..
..
