PageRenderTime 53ms CodeModel.GetById 24ms RepoModel.GetById 0ms app.codeStats 0ms

/legacy/includes/pages/admin/subscriptions.php

http://novaboard.googlecode.com/
PHP | 238 lines | 220 code | 7 blank | 11 comment | 13 complexity | 9fc4f291a47046e68cc1296da078cb6a MD5 | raw file
Possible License(s): AGPL-3.0 
    

  1. <?php

    2. 

  2. /*

    3. 

  3. +--------------------------------------------------------------------------

    4. 

  4. |  NovaBoard

    5. 

  5. |  ========================================

    6. 

  6. |  By The NovaBoard team

    7. 

  7. |  Released under the Artistic License 2.0

    8. 

  8. |  http://www.novaboard.net

    9. 

  9. |  ========================================

    10. 

  10. |+--------------------------------------------------------------------------

    11. 

  11. |   subscriptions.php - create/edit/delete Paypal subscriptions

    12. 

  12. */

    13. 

  13. 

    14. 

  14. if (!defined('NOVA_RUN'))

    15. 

  15. {

    16. 

  16. 	exit('<h1>ACCESS DENIED</h1>You cannot access this file directly.');

    17. 

  17. }

    18. 

  18. 

    19. 

  19. template_hook("pages/admin/subscriptions.template.php", "start");

    20. 

  20. 

    21. 

  21. if ($can_change_site_settings == 0)

    22. 

  22. {

    23. 

  23. 	nova_redirect("index.php?page=error&error=11","error/11");

    24. 

  24. }

    25. 

  25. 

    26. 

  26. if ($_POST['subscription_name'] != '' && $_GET['func'] == 'edit')

    27. 

  27. {

    28. 

  28. 	$upgrade_id = escape_string($_POST['upgrade_id']);

    29. 

  29. 	$token_id	= $_POST['token_id'];

    30. 

  30. 	$token_id	= escape_string($token_id);

    31. 

  31. 

    32. 

  32. 	$token_name = "token_subscriptions_$upgrade_id$token_id";

    33. 

  33. 	

    34. 

  34. 	if (isset($_POST[$token_name]) && isset($_SESSION[$token_name]) && $_SESSION[$token_name] == $_POST[$token_name])

    35. 

  35. 	{

    36. 

  36. 		$subscription_name		=	escape_string($_POST['subscription_name']);

    37. 

  37. 		$subscription_features	=	escape_string($_POST['subscription_features']);

    38. 

  38. 		$upgrade_from			=	(int) $_POST['upgrade_from'];

    39. 

  39. 		$upgrade_to				=	(int)$_POST['upgrade_to'];

    40. 

  40. 		$cost					=	escape_string($_POST['cost']);

    41. 

  41. 		$currency				=	escape_string($_POST['currency']);

    42. 

  42. 		$frequency_one			=	(int) $_POST['frequency_one'];

    43. 

  43. 		$frequency_two			=	escape_string($_POST['frequency_two']);

    44. 

  44. 		$paypal_email			=	escape_string($_POST['paypal_email']);

    45. 

  45. 		$upgrade_id				=	(int) $_POST['upgrade_id'];

    46. 

  46. 		 

    47. 

  47. 		if ($_POST['frequency_two'] != 'Once')

    48. 

  48. 		{

    49. 

  49. 			mysql_query("UPDATE {$db_prefix}group_upgrade SET upgrade_name='$subscription_name', upgrade_features='$subscription_features', upgrade_from='$upgrade_from', upgrade_to='$upgrade_to', upgrade_cost='$cost', upgrade_currency='$currency', upgrade_period='$frequency_one', upgrade_period_two='$frequency_two', paypal_email='$paypal_email' WHERE upgrade_id='$upgrade_id'");

    50. 

  50. 		}

    51. 

  51. 		else

    52. 

  52. 		{

    53. 

  53. 			mysql_query("UPDATE {$db_prefix}group_upgrade SET upgrade_name='$subscription_name', upgrade_features='$subscription_features', upgrade_from='$upgrade_from', upgrade_to='$pgrade_to, upgrade_cost='$cost', upgrade_currency='$currency', upgrade_period='0', upgrade_period_two='Once', paypal_email='$paypal_email' WHERE upgrade_id='$upgrade_id'");

    54. 

  54. 		}

    55. 

  55. 

    56. 

  56. 		template_hook("pages/admin/subscriptions.template.php", "form_1");

    57. 

  57. 

    58. 

  58. 		nova_redirect("index.php?page=admin&act=subscriptions","admin/subscriptions");

    59. 

  59. 	}

    60. 

  60. 	else

    61. 

  61. 	{

    62. 

  62. 		nova_redirect("index.php?page=error&error=28","error/28");

    63. 

  63. 	}

    64. 

  64. }

    65. 

  65. elseif ($_POST['subscription_name'] != '')

    66. 

  66. {

    67. 

  67. 	$token_id = $_POST['token_id'];

    68. 

  68. 	$token_id = escape_string($token_id);

    69. 

  69. 

    70. 

  70. 	$token_name = "token_subscriptions_new_$token_id";

    71. 

  71. 	

    72. 

  72. 	if (isset($_POST[$token_name]) && isset($_SESSION[$token_name]) && $_SESSION[$token_name] == $_POST[$token_name])

    73. 

  73. 	{

    74. 

  74. 		$subscription_name		=	escape_string($_POST['subscription_name']);

    75. 

  75. 		$subscription_features	=	escape_string($_POST['subscription_features']);

    76. 

  76. 		$upgrade_from			=	(int) $_POST['upgrade_from'];

    77. 

  77. 		$upgrade_to				=	(int)$_POST['upgrade_to'];

    78. 

  78. 		$cost					=	escape_string($_POST['cost']);

    79. 

  79. 		$currency				=	escape_string($_POST['currency']);

    80. 

  80. 		$frequency_one			=	(int) $_POST['frequency_one'];

    81. 

  81. 		$frequency_two			=	escape_string($_POST['frequency_two']);

    82. 

  82. 		$paypal_email			=	escape_string($_POST['paypal_email']);

    83. 

  83. 		$upgrade_id				=	(int) $_POST['upgrade_id'];

    84. 

  84. 		 

    85. 

  85. 		if ($_POST['frequency_two'] != 'Once')

    86. 

  86. 		{

    87. 

  87. 			mysql_query("INSERT INTO {$db_prefix}group_upgrade (upgrade_name, upgrade_features, upgrade_from, upgrade_to, upgrade_cost, upgrade_currency, upgrade_period, upgrade_period_two, paypal_email) VALUES ('$subscription_name', '$subscription_features','$upgrade_from', '$upgrade_to', '$cost', '$currency', '$frequency_one', '$frequency_two', '$paypal_email')");

    88. 

  88. 		}

    89. 

  89. 		else

    90. 

  90. 		{

    91. 

  91. 			mysql_query("INSERT INTO {$db_prefix}group_upgrade (upgrade_name, upgrade_features, upgrade_from, upgrade_to, upgrade_cost, upgrade_currency, upgrade_period, upgrade_period_two, paypal_email) VALUES ('$subscription_name', '$subscription_features','$upgrade_from', '$upgrade_to', '$cost', '$currency', '0', 'Once', '$paypal_email')");

    92. 

  92. 		}

    93. 

  93. 

    94. 

  94. 		template_hook("pages/admin/subscriptions.template.php", "form_2");

    95. 

  95. 

    96. 

  96. 		nova_redirect("index.php?page=admin&act=subscriptions","admin/subscriptions");

    97. 

  97. 	}

    98. 

  98. 	else

    99. 

  99. 	{

    100. 

  100. 		nova_redirect("index.php?page=error&error=28","error/28");

    101. 

  101. 	}

    102. 

  102. }

    103. 

  103. 

    104. 

  104. elseif ($_GET['func']=='new')

    105. 

  105. {

    106. 

  106. 	$token_id = md5(microtime());

    107. 

  107. 	$token = md5(uniqid(rand(),true));

    108. 

  108. 

    109. 

  109. 	$token_name = "token_subscriptions_new_$token_id";

    110. 

  110. 

    111. 

  111. 	$_SESSION[$token_name] = $token;

    112. 

  112. 

    113. 

  113. 	template_hook("pages/admin/subscriptions.template.php", "3");

    114. 

  114. 

    115. 

  115. 	$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME desc" ;

    116. 

  116. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  

    117. 

  117. 	while ($results2 = mysql_fetch_array($result2))

    118. 

  118. 	{

    119. 

  119. 		$group_id = $results2['GROUP_ID'];

    120. 

  120. 		$group_name = strip_slashes($results2['GROUP_NAME']);

    121. 

  121. 

    122. 

  122. 		template_hook("pages/admin/subscriptions.template.php", "4");

    123. 

  123. 	}

    124. 

  124. 

    125. 

  125. 	template_hook("pages/admin/subscriptions.template.php", "5");

    126. 

  126. 

    127. 

  127. 	$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME desc" ;

    128. 

  128. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  

    129. 

  129. 	while ($results2 = mysql_fetch_array($result2))

    130. 

  130. 	{

    131. 

  131. 		$group_id = $results2['GROUP_ID'];

    132. 

  132. 		$group_name = strip_slashes($results2['GROUP_NAME']);

    133. 

  133. 

    134. 

  134. 		template_hook("pages/admin/subscriptions.template.php", "4");

    135. 

  135. 	}

    136. 

  136. 

    137. 

  137. 	template_hook("pages/admin/subscriptions.template.php", "6");

    138. 

  138. 

    139. 

  139. }

    140. 

  140. elseif($_POST['subscriptions_delete'] == 1)

    141. 

  141. {

    142. 

  142. 	$id = (int) $_POST['subscription_id'];

    143. 

  143. 	

    144. 

  144. 	if (tokenCheck('subscriptions_delete', $id))

    145. 

  145. 	{

    146. 

  146. 		mysql_query("DELETE FROM {$db_prefix}group_upgrade WHERE upgrade_id ='$id'");

    147. 

  147. 		

    148. 

  148. 		template_hook("pages/admin/subscriptions.template.php", "form_3");

    149. 

  149. 		

    150. 

  150. 		nova_redirect("index.php?page=admin&act=subscriptions","admin/subscriptions");

    151. 

  151. 	}

    152. 

  152. 	else

    153. 

  153. 	{

    154. 

  154. 		nova_redirect('index.php?page=error&error=28', 'error/28');

    155. 

  155. 	}

    156. 

  156. }

    157. 

  157. elseif($_GET['func']=='edit')

    158. 

  158. {

    159. 

  159. 	$token_id = md5(microtime());

    160. 

  160. 	$token = md5(uniqid(rand(),true));

    161. 

  161. 

    162. 

  162. 	$upgrade_id = escape_string($_GET['id']);

    163. 

  163. 

    164. 

  164. 	$token_name = "token_subscriptions_$upgrade_id$token_id";

    165. 

  165. 

    166. 

  166. 	$_SESSION[$token_name] = $token;

    167. 

  167. 

    168. 

  168. 	$query29 = "select UPGRADE_ID, UPGRADE_NAME, UPGRADE_FEATURES, UPGRADE_FROM, UPGRADE_TO, UPGRADE_COST, UPGRADE_CURRENCY, UPGRADE_PERIOD, UPGRADE_PERIOD_TWO, PAYPAL_EMAIL from {$db_prefix}group_upgrade WHERE UPGRADE_ID='$upgrade_id'" ;

    169. 

  169. 	$result29 = mysql_query($query29) or die("upgrade.php - Error in query: $query29") ;                                  

    170. 

  170. 	while ($results29 = mysql_fetch_array($result29))

    171. 

  171. 	{

    172. 

  172. 		$upgrade_id = strip_slashes($results29['UPGRADE_ID']);

    173. 

  173. 		$upgrade_name = strip_slashes($results29['UPGRADE_NAME']);

    174. 

  174. 		$upgrade_features = strip_slashes($results29['UPGRADE_FEATURES']);

    175. 

  175. 		$upgrade_from = strip_slashes($results29['UPGRADE_FROM']);

    176. 

  176. 		$upgrade_to = strip_slashes($results29['UPGRADE_TO']);

    177. 

  177. 		$upgrade_cost = strip_slashes($results29['UPGRADE_COST']);

    178. 

  178. 		$upgrade_currency = strip_slashes($results29['UPGRADE_CURRENCY']);

    179. 

  179. 		$upgrade_period = strip_slashes($results29['UPGRADE_PERIOD']);

    180. 

  180. 		$upgrade_period_two = strip_slashes($results29['UPGRADE_PERIOD_TWO']);

    181. 

  181. 		$paypal_email = strip_slashes($results29['PAYPAL_EMAIL']);

    182. 

  182. 

    183. 

  183. 		template_hook("pages/admin/subscriptions.template.php", "8");

    184. 

  184. 

    185. 

  185. 		$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME asc" ;

    186. 

  186. 		$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  

    187. 

  187. 		while ($results2 = mysql_fetch_array($result2))

    188. 

  188. 		{

    189. 

  189. 			$group_id = $results2['GROUP_ID'];

    190. 

  190. 			$group_name = strip_slashes($results2['GROUP_NAME']);

    191. 

  191. 

    192. 

  192. 			template_hook("pages/admin/subscriptions.template.php", "9");

    193. 

  193. 		}

    194. 

  194. 

    195. 

  195. 		template_hook("pages/admin/subscriptions.template.php", "10");

    196. 

  196. 

    197. 

  197. 		$query2 = "select GROUP_ID, GROUP_NAME from {$db_prefix}groups ORDER BY GROUP_NAME asc" ;

    198. 

  198. 		$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  

    199. 

  199. 		while ($results2 = mysql_fetch_array($result2))

    200. 

  200. 		{

    201. 

  201. 			$group_id = $results2['GROUP_ID'];

    202. 

  202. 			$group_name = strip_slashes($results2['GROUP_NAME']);

    203. 

  203. 

    204. 

  204. 			template_hook("pages/admin/subscriptions.template.php", "11");

    205. 

  205. 		}

    206. 

  206. 

    207. 

  207. 		template_hook("pages/admin/subscriptions.template.php", "12");

    208. 

  208. 	}

    209. 

  209. }

    210. 

  210. else

    211. 

  211. {

    212. 

  212. 	template_hook("pages/admin/subscriptions.template.php", "13");

    213. 

  213. 

    214. 

  214. 	$query2 = "select UPGRADE_ID, UPGRADE_NAME, UPGRADE_FEATURES, UPGRADE_FROM, UPGRADE_TO, UPGRADE_COST, UPGRADE_CURRENCY, UPGRADE_PERIOD, UPGRADE_PERIOD_TWO, PAYPAL_EMAIL from {$db_prefix}group_upgrade ORDER BY UPGRADE_ID desc" ;

    215. 

  215. 	$result2 = mysql_query($query2) or die("upgrade.php - Error in query: $query2") ;                                  

    216. 

  216. 	while ($results2 = mysql_fetch_array($result2))

    217. 

  217. 	{

    218. 

  218. 		$upgrade_id = strip_slashes($results2['UPGRADE_ID']);

    219. 

  219. 		$upgrade_name = strip_slashes($results2['UPGRADE_NAME']);

    220. 

  220. 		$upgrade_features = strip_slashes($results2['UPGRADE_FEATURES']);

    221. 

  221. 		$upgrade_from = strip_slashes($results2['UPGRADE_FROM']);

    222. 

  222. 		$upgrade_to = strip_slashes($results2['UPGRADE_TO']);

    223. 

  223. 		$upgrade_cost = strip_slashes($results2['UPGRADE_COST']);

    224. 

  224. 		$upgrade_currency = strip_slashes($results2['UPGRADE_CURRENCY']);

    225. 

  225. 		$upgrade_period = strip_slashes($results2['UPGRADE_PERIOD']);

    226. 

  226. 		$upgrade_period_two = strip_slashes($results2['UPGRADE_PERIOD_TWO']);

    227. 

  227. 		$paypal_email = strip_slashes($results2['PAYPAL_EMAIL']);

    228. 

  228. 

    229. 

  229. 		list($token_id, $token, $token_name) = tokenCreate('subscriptions_delete', $upgrade_id);

    230. 

  230. 

    231. 

  231. 		template_hook("pages/admin/subscriptions.template.php", "14");

    232. 

  232. 	}

    233. 

  233. 

    234. 

  234. 	template_hook("pages/admin/subscriptions.template.php", "15");

    235. 

  235. }

    236. 

  236. 

    237. 

  237. template_hook("pages/admin/subscriptions.template.php", "end");

    238. 

  238. ?>
    239.