PageRenderTime 49ms CodeModel.GetById 20ms RepoModel.GetById 1ms app.codeStats 0ms

/includes/pages/admin/subscriptions.php

https://github.com/AndyRixon/LayerBulletin
PHP | 246 lines | 227 code | 8 blank | 11 comment | 14 complexity | 0b30e8f0c10496edbc955b891c94554c MD5 | raw file
    

  1. <?php
    2. 

  2. /*
    3. 

  3. +--------------------------------------------------------------------------
    4. 

  4. |  LayerBulletin
    5. 

  5. |  ========================================
    6. 

  6. |  By The LayerBulletin team
    7. 

  7. |  Released under the Artistic License 2.0
    8. 

  8. |  http://layerbulletin.com/
    9. 

  9. |  ========================================
    10. 

  10. |+--------------------------------------------------------------------------
    11. 

  11. |   subscriptions.php - create/edit/delete Paypal subscriptions
    12. 

  12. */
    13. 

  13. 

  14. if (!defined('LB_RUN'))
    15. 

  15. {
    16. 

  16. 	exit('<h1>ACCESS DENIED</h1>You cannot access this file directly.');
    17. 

  17. }
    18. 

  18. 

  19. template_hook("pages/admin/subscriptions.template.php", "start");
    20. 

  20. 

  21. if($_GET['success']=="created"){
    22. 

  22. 	template_hook("pages/admin/subscriptions.template.php", "successCreated");
    23. 

  23. }elseif($_GET['success']=="updated"){
    24. 

  24. 	template_hook("pages/admin/subscriptions.template.php", "successUpdated");
    25. 

  25. }elseif($_GET['success']=="deleted"){
    26. 

  26. 	template_hook("pages/admin/subscriptions.template.php", "successDeleted");
    27. 

  27. }
    28. 

  28. 

  29. if ($can_change_site_settings == 0)
    30. 

  30. {
    31. 

  31. 	lb_redirect("index.php?page=error&error=11","error/11");
    32. 

  32. }
    33. 

  33. 

  34. if ($_POST['subscription_name'] != '' && $_GET['func'] == 'edit')
    35. 

  35. {
    36. 

  36. 	$upgrade_id = escape_string($_POST['upgrade_id']);
    37. 

  37. 	$token_id	= $_POST['token_id'];
    38. 

  38. 	$token_id	= escape_string($token_id);
    39. 

  39. 

  40. 	$token_name = "token_subscriptions_$upgrade_id$token_id";
    41. 

  41. 	
    42. 

  42. 	if (isset($_POST[$token_name]) && isset($_SESSION[$token_name]) && $_SESSION[$token_name] == $_POST[$token_name])
    43. 

  43. 	{
    44. 

  44. 		$subscription_name		=	escape_string($_POST['subscription_name']);
    45. 

  45. 		$subscription_features	=	escape_string($_POST['subscription_features']);
    46. 

  46. 		$upgrade_from			=	(int) $_POST['upgrade_from'];
    47. 

  47. 		$upgrade_to				=	(int)$_POST['upgrade_to'];
    48. 

  48. 		$cost					=	escape_string($_POST['cost']);
    49. 

  49. 		$currency				=	escape_string($_POST['currency']);
    50. 

  50. 		$frequency_one			=	(int) $_POST['frequency_one'];
    51. 

  51. 		$frequency_two			=	escape_string($_POST['frequency_two']);
    52. 

  52. 		$paypal_email			=	escape_string($_POST['paypal_email']);
    53. 

  53. 		$upgrade_id				=	(int) $_POST['upgrade_id'];
    54. 

  54. 		 
    55. 

  55. 		if ($_POST['frequency_two'] != 'Once')
    56. 

  56. 		{
    57. 

  57. 			mysql_query("UPDATE {$db_prefix}group_upgrade SET upgrade_name='$subscription_name', upgrade_features='$subscription_features', upgrade_from='$upgrade_from', upgrade_to='$upgrade_to', upgrade_cost='$cost', upgrade_currency='$currency', upgrade_period='$frequency_one', upgrade_period_two='$frequency_two', paypal_email='$paypal_email' WHERE upgrade_id='$upgrade_id'");
    58. 

  58. 		}
    59. 

  59. 		else
    60. 

  60. 		{
    61. 

  61. 			mysql_query("UPDATE {$db_prefix}group_upgrade SET upgrade_name='$subscription_name', upgrade_features='$subscription_features', upgrade_from='$upgrade_from', upgrade_to='$pgrade_to, upgrade_cost='$cost', upgrade_currency='$currency', upgrade_period='0', upgrade_period_two='Once', paypal_email='$paypal_email' WHERE upgrade_id='$upgrade_id'");
    62. 

  62. 		}
    63. 

  63. 

  64. 		template_hook("pages/admin/subscriptions.template.php", "form_1");
    65. 

  65. 

  66. 		lb_redirect("index.php?page=admin&act=subscriptions&success=updated","admin/subscriptions/success/updated");
    67. 

  67. 	}
    68. 

  68. 	else
    69. 

  69. 	{
    70. 

  70. 		lb_redirect("index.php?page=error&error=28","error/28");
    71. 

  71. 	}
    72. 

  72. }
    73. 

  73. elseif ($_POST['subscription_name'] != '')
    74. 

  74. {
    75. 

  75. 	$token_id = $_POST['token_id'];
    76. 

  76. 	$token_id = escape_string($token_id);
    77. 

  77. 

  78. 	$token_name = "token_subscriptions_new_$token_id";
    79. 

  79. 	
    80. 

  80. 	if (isset($_POST[$token_name]) && isset($_SESSION[$token_name]) && $_SESSION[$token_name] == $_POST[$token_name])
    81. 

  81. 	{
    82. 

  82. 		$subscription_name		=	escape_string($_POST['subscription_name']);
    83. 

  83. 		$subscription_features	=	escape_string($_POST['subscription_features']);
    84. 

  84. 		$upgrade_from			=	(int) $_POST['upgrade_from'];
    85. 

  85. 		$upgrade_to				=	(int)$_POST['upgrade_to'];
    86. 

  86. 		$cost					=	escape_string($_POST['cost']);
    87. 

  87. 		$currency				=	escape_string($_POST['currency']);
    88. 

  88. 		$frequency_one			=	(int) $_POST['frequency_one'];
    89. 

  89. 		$frequency_two			=	escape_string($_POST['frequency_two']);
    90. 

  90. 		$paypal_email			=	escape_string($_POST['paypal_email']);
    91. 

  91. 		$upgrade_id				=	(int) $_POST['upgrade_id'];
    92. 

  92. 		 
    93. 

  93. 		if ($_POST['frequency_two'] != 'Once')
    94. 

  94. 		{
    95. 

  95. 			mysql_query("INSERT INTO {$db_prefix}group_upgrade (upgrade_name, upgrade_features, upgrade_from, upgrade_to, upgrade_cost, upgrade_currency, upgrade_period, upgrade_period_two, paypal_email) VALUES ('$subscription_name', '$subscription_features','$upgrade_from', '$upgrade_to', '$cost', '$currency', '$frequency_one', '$frequency_two', '$paypal_email')");
    96. 

  96. 		}
    97. 

  97. 		else
    98. 

  98. 		{
    99. 

  99. 			mysql_query("INSERT INTO {$db_prefix}group_upgrade (upgrade_name, upgrade_features, upgrade_from, upgrade_to, upgrade_cost, upgrade_currency, upgrade_period, upgrade_period_two, paypal_email) VALUES ('$subscription_name', '$subscription_features','$upgrade_from', '$upgrade_to', '$cost', '$currency', '0', 'Once', '$paypal_email')");
    100. 

  100. 		}
    101. 

  101. 

  102. 		template_hook("pages/admin/subscriptions.template.php", "form_2");
    103. 

  103. 

  104. 		lb_redirect("index.php?page=admin&act=subscriptions&success=created","admin/subscriptions/success/created");
    105. 

  105. 	}
    106. 

  106. 	else
    107. 

  107. 	{
    108. 

  108. 		lb_redirect("index.php?page=error&error=28","error/28");
    109. 

  109. 	}
    110. 

  110. }
    111. 

  111. 

  112. elseif ($_GET['func']=='new')
    113. 

  113. {
    114. 

  114. 	$token_id = md5(microtime());
    115. 

  115. 	$token = md5(uniqid(rand(),true));
    116. 

  116. 

  117. 	$token_name = "token_subscriptions_new_$token_id";
    118. 

  118. 

  119. 	$_SESSION[$token_name] = $token;
    120. 

  120. 

  121. 	template_hook("pages/admin/subscriptions.template.php", "3");
    122. 

  122. 

  123. 	$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME desc" ;
    124. 

  124. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  
    125. 

  125. 	while ($results2 = mysql_fetch_array($result2))
    126. 

  126. 	{
    127. 

  127. 		$group_id = $results2['GROUP_ID'];
    128. 

  128. 		$group_name = strip_slashes($results2['GROUP_NAME']);
    129. 

  129. 

  130. 		template_hook("pages/admin/subscriptions.template.php", "4");
    131. 

  131. 	}
    132. 

  132. 

  133. 	template_hook("pages/admin/subscriptions.template.php", "5");
    134. 

  134. 

  135. 	$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME desc" ;
    136. 

  136. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  
    137. 

  137. 	while ($results2 = mysql_fetch_array($result2))
    138. 

  138. 	{
    139. 

  139. 		$group_id = $results2['GROUP_ID'];
    140. 

  140. 		$group_name = strip_slashes($results2['GROUP_NAME']);
    141. 

  141. 

  142. 		template_hook("pages/admin/subscriptions.template.php", "4");
    143. 

  143. 	}
    144. 

  144. 

  145. 	template_hook("pages/admin/subscriptions.template.php", "6");
    146. 

  146. 

  147. }
    148. 

  148. elseif($_POST['subscriptions_delete'] == 1)
    149. 

  149. {
    150. 

  150. 	$id = (int) $_POST['subscription_id'];
    151. 

  151. 	
    152. 

  152. 	if (tokenCheck('subscriptions_delete', $id))
    153. 

  153. 	{
    154. 

  154. 		mysql_query("DELETE FROM {$db_prefix}group_upgrade WHERE upgrade_id ='$id'");
    155. 

  155. 		
    156. 

  156. 		template_hook("pages/admin/subscriptions.template.php", "form_3");
    157. 

  157. 		
    158. 

  158. 		lb_redirect("index.php?page=admin&act=subscriptions&success=deleted","admin/subscriptions/success/deleted");
    159. 

  159. 	}
    160. 

  160. 	else
    161. 

  161. 	{
    162. 

  162. 		lb_redirect('index.php?page=error&error=28', 'error/28');
    163. 

  163. 	}
    164. 

  164. }
    165. 

  165. elseif($_GET['func']=='edit')
    166. 

  166. {
    167. 

  167. 	$token_id = md5(microtime());
    168. 

  168. 	$token = md5(uniqid(rand(),true));
    169. 

  169. 

  170. 	$upgrade_id = escape_string($_GET['id']);
    171. 

  171. 

  172. 	$token_name = "token_subscriptions_$upgrade_id$token_id";
    173. 

  173. 

  174. 	$_SESSION[$token_name] = $token;
    175. 

  175. 

  176. 	$query29 = "select UPGRADE_ID, UPGRADE_NAME, UPGRADE_FEATURES, UPGRADE_FROM, UPGRADE_TO, UPGRADE_COST, UPGRADE_CURRENCY, UPGRADE_PERIOD, UPGRADE_PERIOD_TWO, PAYPAL_EMAIL from {$db_prefix}group_upgrade WHERE UPGRADE_ID='$upgrade_id'" ;
    177. 

  177. 	$result29 = mysql_query($query29) or die("upgrade.php - Error in query: $query29") ;                                  
    178. 

  178. 	while ($results29 = mysql_fetch_array($result29))
    179. 

  179. 	{
    180. 

  180. 		$upgrade_id = strip_slashes($results29['UPGRADE_ID']);
    181. 

  181. 		$upgrade_name = strip_slashes($results29['UPGRADE_NAME']);
    182. 

  182. 		$upgrade_features = strip_slashes($results29['UPGRADE_FEATURES']);
    183. 

  183. 		$upgrade_from = strip_slashes($results29['UPGRADE_FROM']);
    184. 

  184. 		$upgrade_to = strip_slashes($results29['UPGRADE_TO']);
    185. 

  185. 		$upgrade_cost = strip_slashes($results29['UPGRADE_COST']);
    186. 

  186. 		$upgrade_currency = strip_slashes($results29['UPGRADE_CURRENCY']);
    187. 

  187. 		$upgrade_period = strip_slashes($results29['UPGRADE_PERIOD']);
    188. 

  188. 		$upgrade_period_two = strip_slashes($results29['UPGRADE_PERIOD_TWO']);
    189. 

  189. 		$paypal_email = strip_slashes($results29['PAYPAL_EMAIL']);
    190. 

  190. 

  191. 		template_hook("pages/admin/subscriptions.template.php", "8");
    192. 

  192. 

  193. 		$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME asc" ;
    194. 

  194. 		$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  
    195. 

  195. 		while ($results2 = mysql_fetch_array($result2))
    196. 

  196. 		{
    197. 

  197. 			$group_id = $results2['GROUP_ID'];
    198. 

  198. 			$group_name = strip_slashes($results2['GROUP_NAME']);
    199. 

  199. 

  200. 			template_hook("pages/admin/subscriptions.template.php", "9");
    201. 

  201. 		}
    202. 

  202. 

  203. 		template_hook("pages/admin/subscriptions.template.php", "10");
    204. 

  204. 

  205. 		$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME asc" ;
    206. 

  206. 		$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  
    207. 

  207. 		while ($results2 = mysql_fetch_array($result2))
    208. 

  208. 		{
    209. 

  209. 			$group_id = $results2['GROUP_ID'];
    210. 

  210. 			$group_name = strip_slashes($results2['GROUP_NAME']);
    211. 

  211. 

  212. 			template_hook("pages/admin/subscriptions.template.php", "11");
    213. 

  213. 		}
    214. 

  214. 

  215. 		template_hook("pages/admin/subscriptions.template.php", "12");
    216. 

  216. 	}
    217. 

  217. }
    218. 

  218. else
    219. 

  219. {
    220. 

  220. 	template_hook("pages/admin/subscriptions.template.php", "13");
    221. 

  221. 

  222. 	$query2 = "select UPGRADE_ID, UPGRADE_NAME, UPGRADE_FEATURES, UPGRADE_FROM, UPGRADE_TO, UPGRADE_COST, UPGRADE_CURRENCY, UPGRADE_PERIOD, UPGRADE_PERIOD_TWO, PAYPAL_EMAIL from {$db_prefix}group_upgrade ORDER BY UPGRADE_ID desc" ;
    223. 

  223. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  
    224. 

  224. 	while ($results2 = mysql_fetch_array($result2))
    225. 

  225. 	{
    226. 

  226. 		$upgrade_id = strip_slashes($results2['UPGRADE_ID']);
    227. 

  227. 		$upgrade_name = strip_slashes($results2['UPGRADE_NAME']);
    228. 

  228. 		$upgrade_features = strip_slashes($results2['UPGRADE_FEATURES']);
    229. 

  229. 		$upgrade_from = strip_slashes($results2['UPGRADE_FROM']);
    230. 

  230. 		$upgrade_to = strip_slashes($results2['UPGRADE_TO']);
    231. 

  231. 		$upgrade_cost = strip_slashes($results2['UPGRADE_COST']);
    232. 

  232. 		$upgrade_currency = strip_slashes($results2['UPGRADE_CURRENCY']);
    233. 

  233. 		$upgrade_period = strip_slashes($results2['UPGRADE_PERIOD']);
    234. 

  234. 		$upgrade_period_two = strip_slashes($results2['UPGRADE_PERIOD_TWO']);
    235. 

  235. 		$paypal_email = strip_slashes($results2['PAYPAL_EMAIL']);
    236. 

  236. 

  237. 		list($token_id, $token, $token_name) = tokenCreate('subscriptions_delete', $upgrade_id);
    238. 

  238. 

  239. 		template_hook("pages/admin/subscriptions.template.php", "14");
    240. 

  240. 	}
    241. 

  241. 

  242. 	template_hook("pages/admin/subscriptions.template.php", "15");
    243. 

  243. }
    244. 

  244. 

  245. template_hook("pages/admin/subscriptions.template.php", "end");
    246. 

  246. ?>
    247.