<?php

require_once dirname(__FILE__).'/accesscheck.php';

$columns = array('messages','lists','bounces','blacklist');

if (!defined('PHPLISTINIT')) {
    exit;
}

$filterpanel = $countpanel = $paging = '';

if (!isset($_SESSION['userlistfilter']) || !$_SESSION['userlistfilter']) {
    $_SESSION['userlistfilter'] = array();
}
if (isset($_GET['sortby'])) {
    $sortby = removeXss($_GET['sortby']);
  ## only allow spaces and word chars
  $sortby = preg_replace('/[^\w ]+/', '', $sortby);
} else {
    $sortby = '';
}

if (isset($_GET['delete'])) {
    $delete = sprintf('%d', $_GET['delete']);
} else {
    $delete = 0;
}
#print $_GET["delete"].' '.$delete .isSuperUser();exit;

if (isset($_GET['start'])) {
    $start = sprintf('%d', $_GET['start']);
} else {
    $start = 0;
}

$searchdone = 1;
if (!empty($_GET['start'])) {
    $start = sprintf('%d', $_GET['start']);
} else {
    $start = 0;
}
$unconfirmed = !empty($_GET['unconfirmed']) ? sprintf('%d', $_GET['unconfirmed']) : 0;
$blacklisted = !empty($_GET['blacklisted']) ? sprintf('%d', $_GET['blacklisted']) : 0;
if (isset($_GET['sortorder'])) {
    if ($_GET['sortorder'] == 'asc') {
        $sortorder = 'asc';
    } else {
        $sortorder = 'desc';
    }
} else {
    $sortorder = 'desc';
}
if (isset($_GET['listid'])) {
    $listid = sprintf('%d', $_GET['listid']);
} else {
    $listid = 0;
}
if (isset($_GET['find'])) {
    if (!isset($_GET['findby'])) {
        $_GET['findby'] = '';
    }

    if ($_GET['find'] == 'NULL') {
        $_SESSION['userlistfilter']['find'] = '';
        $_SESSION['userlistfilter']['findby'] = '';
    } else {
        $_SESSION['userlistfilter']['find'] = removeXss($_GET['find']);
        $_SESSION['userlistfilter']['findby'] = removeXss($_GET['findby']);
    }
} else {
    $_SESSION['userlistfilter']['find'] = '';
    $_SESSION['userlistfilter']['findby'] = '';
}

$find = $_SESSION['userlistfilter']['find'];
$findby = $_SESSION['userlistfilter']['findby'];
if (!$findby) {
    $findby = 'email';
}
$findtables = '';
$findbyselect = '';
$findfield = '';
$findfieldname = '';
$find_url = '';

# hmm interesting, if they select a findby but not a find, use the Sql wildcard:
if ($findby && !$find) {
    # this is very slow, so instead erase the findby.
  #  $find = '%';
  $findby = '';
}

$system_findby = array(
  'email',
  'foreignkey',
  'uniqid',
);

if ($findby && $find && !in_array($findby, $system_findby)) {
    $find_url = '&amp;find='.urlencode($find).'&amp;findby='.urlencode($findby);
    $findatt = Sql_Fetch_Array_Query(sprintf('select id,tablename,type,name from %s where id = %d', $tables['attribute'], $findby));
    switch ($findatt['type']) {
    case 'textline' :
    case 'hidden' :
      $findtables = ','.$tables['user_attribute'];
      $findbyselect = sprintf(' %s.userid = %s.id and
              %s.attributeid = %d and %s.value like "%%%s%%"', $tables['user_attribute'], $tables['user'], $tables['user_attribute'], $findby, $tables['user_attribute'], sql_escape($find));
      $findfield = $tables['user_attribute'].'.value as display, '.$tables['user'].'.bouncecount';
      $findfieldname = $findatt['name'];
      break;
    case 'select' :
    case 'radio' :
      $findtables = ','.$tables['user_attribute'].','.$table_prefix.'listattr_'.$findatt['tablename'];
      $findbyselect = sprintf(' %s.userid = %s.id and
              %s.attributeid = %d and %s.value = %s.id and
              %s.name like "%%%s%%"', $tables['user_attribute'], $tables['user'], $tables['user_attribute'], $findby, $tables['user_attribute'], $table_prefix.
      'listattr_'.$findatt['tablename'], $table_prefix.
      'listattr_'.$findatt['tablename'], sql_escape($find));
      $findfield = $table_prefix.'listattr_'.$findatt['tablename'].'.name as display, '.$tables['user'].'.bouncecount';
      $findfieldname = $findatt['name'];
      break;
  }
} else {
    $findtables = '';
    $findbyselect = sprintf(' %s like "%%%s%%"', $findby, sql_escape($find));
    $findfield = $tables['user'].'.bouncecount,'.$tables['user'].'.foreignkey';
    $findfieldname = 'Email';
    $find_url = '&amp;find='.urlencode($find);
}

if (empty($findfield)) {
    $findfield = 'email';
}

if ($require_login && !isSuperUser()) {
    $access = accessLevel('users');
    switch ($access) {
    case 'owner' :
      $table_list = $tables['user'].','.$tables['listuser'].','.$tables['list'].$findtables;
      $subselect = "{$tables['user']}.id = {$tables['listuser']}.userid and {$tables['listuser']}.listid = {$tables['list']}.id and {$tables['list']}.owner = ".$_SESSION['logindetails']['id'];
      if ($unconfirmed) {
          $subselect .= ' and !confirmed ';
      }
      if ($blacklisted) {
          $subselect .= ' and blacklisted ';
      }
      if ($find && $findbyselect) {
          $listquery = "select DISTINCT {$tables['user']}.email,{$tables['user']}.id,$findfield,confirmed from ".$table_list." where $subselect and $findbyselect";
          $count = Sql_query("SELECT count(distinct {$tables['user']}.id) FROM ".$table_list." where $subselect and $findbyselect");
          $unconfirmedcount = Sql_query("SELECT count(distinct {$tables['user']}.id) FROM ".$table_list." where $subselect and !confirmed and $findbyselect");
      } else {
          $listquery = "SELECT DISTINCT {$tables['user']}.email,{$tables['user']}.id,$findfield,confirmed FROM ".$table_list." WHERE $subselect";
          $count = Sql_query("SELECT count(distinct {$tables['user']}.id) FROM ".$table_list." WHERE $subselect");
          $unconfirmedcount = Sql_query("SELECT count(distinct {$tables['user']}.id) FROM ".$table_list." WHERE !confirmed and $subselect");
      }
      break;
    case 'all' :
    case 'view' :
      $table_list = $tables['user'].$findtables;
      if ($find && $findbyselect) {
          if ($unconfirmed) {
              $findbyselect .= ' and !confirmed ';
          }
          if ($blacklisted) {
              $findbyselect .= ' and blacklisted ';
          }
          $listquery = "select DISTINCT {$tables['user']}.email,{$tables['user']}.id,$findfield,{$tables['user']}.confirmed from ".$table_list." where $findbyselect";
          $count = Sql_query('SELECT count(*) FROM '.$table_list." where $findbyselect");
          $unconfirmedcount = Sql_query('SELECT count(*) FROM '.$table_list." where !confirmed && $findbyselect");
      } else {
          $listquery = "select DISTINCT {$tables['user']}.email,{$tables['user']}.id,$findfield,{$tables['user']}.confirmed from ".$table_list;
          $count = Sql_query('SELECT count(*) FROM '.$table_list);
          $unconfirmedcount = Sql_query('SELECT count(*) FROM '.$table_list.' where !confirmed');
          $searchdone = 0;
      }
      $delete_message = '<br />'.$GLOBALS['I18N']->get('Delete will delete user and all listmemberships').'<br />';
      break;
    case 'none' :
    default :
      print Error($GLOBALS['I18N']->get('Your privileges for this page are insufficient'));

      return;
  }
    $delete_message = '<br />'.$GLOBALS['I18N']->get('Delete will delete user from the list').'<br />';
} else {
    ## is superuser
  $table_list = $tables['user'].$findtables;
    if ($find && $findbyselect) {
        if ($unconfirmed) {
            $findbyselect .= ' and !confirmed ';
        }
        if ($blacklisted) {
            $findbyselect .= ' and blacklisted ';
        }
        $listquery = "select {$tables['user']}.email,{$tables['user']}.id,$findfield,{$tables['user']}.confirmed from ".$table_list." where $findbyselect";
        $count = Sql_query('SELECT count(*) FROM '.$table_list." where $findbyselect");
        $unconfirmedcount = Sql_query('SELECT count(*) FROM '.$table_list." where !confirmed and $findbyselect");
    } else {
        $subselect = '';
        if ($unconfirmed || $blacklisted) {
            $subselect = ' where ';
            if ($unconfirmed && $blacklisted) {
                $subselect .= ' !confirmed and blacklisted ';
            } elseif ($unconfirmed) {
                $subselect .= ' !confirmed ';
            } else {
                $subselect .= ' blacklisted';
            }
        } else {
            $searchdone = 0;
        }
        $listquery = "select {$tables['user']}.email,{$tables['user']}.id,$findfield,{$tables['user']}.confirmed from ".$table_list.' '.$subselect;
        $count = Sql_query('SELECT count(*) FROM '.$table_list.' '.$subselect);
        $unconfirmedcount = Sql_query('SELECT count(*) FROM '.$table_list.' where !confirmed');
    }
    $delete_message = '<br />'.$GLOBALS['I18N']->get('Delete will delete user and all listmemberships').'<br />';
}

$totalres = Sql_fetch_Row($unconfirmedcount);
$totalunconfirmed = $totalres[0];
$totalres = Sql_fetch_Row($count);
$total = $totalres[0];

if ($start > $total) {
    $start = 0;
}

if (!empty($delete) && isSuperUser()) {
    # delete the index in delete
  $action_result = $GLOBALS['I18N']->get('deleting')." $delete ..\n";
    deleteUser($delete);

    $action_result .= '..'.$GLOBALS['I18N']->get('Done').'<br/><hr/>';
    $previous_search = '';
    if (!$find == '') {
        $previous_search = "&start=$start&find=$find&findby=$findby";
    }

    $_SESSION['action_result'] = $action_result;
    Redirect("users$previous_search");
} elseif (!empty($delete)) {
    print ActionResult(s('Sorry, only super users can delete users'));
}

if (isset($add)) {
    if (isset($new)) {
        $query = 'insert into '.$tables['user']." (email,entered) values(\"$new\",now())";
        $result = Sql_query($query);
        $userid = Sql_insert_id();
        $query = 'insert into '.$tables['listuser']." (userid,listid,entered) values($userid,$id,now())";
        $result = Sql_query($query);
    }
    echo ActionResult($GLOBALS['I18N']->get('User added'));
}

$countpanel .= s('%s subscribers in total', $total);
$countpanel .= '<br/>'.s('Subscribers with a red icon are either unconfirmed or blacklisted or both')." ($totalunconfirmed)<br/>";

$url = getenv('REQUEST_URI');
if ($unconfirmed) {
    $unc = 'checked="checked"';
} else {
    $unc = '';
}
if ($blacklisted) {
    $bll = 'checked="checked"';
} else {
    $bll = '';
}
if (!isset($start)) {
    $start = 0;
}

$filterpanel .= '<div class="filter">';
$filterpanel .= sprintf('<form method="get" name="listcontrol" action="">
  <input type="hidden" name="page" value="users" />
  <input type="hidden" name="start" value="%d" />
  <input type="hidden" name="find" value="%s" />
  <input type="hidden" name="findby" value="%s" />
  <label for="unconfirmed">%s:<input type="checkbox" name="unconfirmed" value="1" %s /></label>
  <label for="blacklisted">%s:<input type="checkbox" name="blacklisted" value="1" %s /></label>',
       $start,
       htmlspecialchars(stripslashes($find)),
       htmlspecialchars(stripslashes($findby)),
       $GLOBALS['I18N']->get('Show only unconfirmed users'),
       $unc,
       $GLOBALS['I18N']->get('Show only blacklisted users'),
       $bll);
#print '</td><td valign="top">';
$select = '';
foreach (array(
    'email',
    'bouncecount',
    'entered',
    'modified',
    'foreignkey',
  ) as $item) {
    $select .= sprintf('     <option value="%s" %s>%s</option>', $item, $item == $sortby ? 'selected="selected"' : '', $GLOBALS['I18N']->get($item));
}

$filterpanel .= sprintf('
  <label for="sortby">%s: <select name="sortby" onchange="document.listcontrol.submit();">
  <option value="0">-- default</option>
  %s
  </select></label>
  <label for="sortdesc">%s: <input type="radio" name="sortorder" id="sortdesc" value="desc" %s onchange="document.listcontrol.submit();" /></label>
  <label for="sortasc">%s: <input type="radio" name="sortorder" id="sortasc" value="asc" %s onchange="document.listcontrol.submit();" /></label>
  <input class="submit" type="submit" name="change" value="%s" />
  ',
       $GLOBALS['I18N']->get('Sort by'), $select,
       $GLOBALS['I18N']->get('desc'), $sortorder == 'desc' ? 'checked="checked"' : '',
       $GLOBALS['I18N']->get('asc'), $sortorder == 'asc' ? 'checked="checked"' : '',
       $GLOBALS['I18N']->get('Go'));
$filterpanel .= '</div>';

$order = '';
if ($sortby) {
    $order = ' order by '.$tables['user'].'.'.$sortby;
    if ($sortorder == 'asc') {
        $order .= ' asc';
    } else {
        $order .= ' desc';
    }
}
$find_url .= "&amp;sortby=$sortby&amp;sortorder=$sortorder&amp;unconfirmed=$unconfirmed&amp;blacklisted=$blacklisted";

$listing = '';
$dolist = 1;
if (true || $total > MAX_USER_PP) {
    if (isset($start) && $start) {
        $listing = sprintf($GLOBALS['I18N']->get('Listing user %d to %d'), $start, $start + MAX_USER_PP);
        $limit = "limit $start,".MAX_USER_PP;
    } else {
        if ($total < USERSPAGE_MAX || $searchdone) {
            $listing = sprintf($GLOBALS['I18N']->get('Listing user %d to %d'), 1, 50);
            $limit = 'limit 0,50';
            $start = 0;
            $dolist = 1;
        } else {
            $dolist = 0;
        }
    }
    if ($dolist) {
        $paging = simplePaging('users'.$find_url, $start, $total, MAX_USER_PP, $GLOBALS['I18N']->get('Subscribers'));
        $result = Sql_query("$listquery $order $limit");
    } else {
        #    print Info($GLOBALS['I18N']->get('too many subscribers, use a search query to list some'),1);
    $result = 0;
    }
} else {
    $result = Sql_Query("$listquery $order");
}

$filterpanel .= '
<div class="usersFind">
<input type="hidden" name="id" value="'.$listid.'" />';

$filterpanel .= '<label for="find">'.$GLOBALS['I18N']->get('Find a user').'</label>';
$filterpanel .= '<input type="text" name="find" value="';
$filterpanel .= $find != '%' ? htmlspecialchars(stripslashes($find)) : '';
$filterpanel .= '" size="30" />';

$filterpanel .=  '<select name="findby">';

$filterpanel .= '<option value="email" ';
$filterpanel .= $findby == 'email' ? 'selected="selected"' : '';
$filterpanel .= '>'.$GLOBALS['I18N']->get('Email').'</option>';
$filterpanel .= '<option value="foreignkey" ';
$filterpanel .= $findby == 'foreignkey' ? 'selected="selected"' : '';
$filterpanel .= '>'.$GLOBALS['I18N']->get('Foreign Key').'</option>';
$filterpanel .= '<option value="uniqid" ';
$filterpanel .= $findby == 'uniqid' ? 'selected="selected"' : '';
$filterpanel .= '>'.$GLOBALS['I18N']->get('Unique ID').'</option>';

$att_req = Sql_Query('select id,name from '.$tables['attribute'].' where type = "hidden" or type = "textline" or type = "select"');
while ($row = Sql_Fetch_Array($att_req)) {
    $filterpanel .= sprintf('<option value="%d" %s>%s</option>', $row['id'], $row['id'] == $findby ? 'selected="selected"' : '', substr($row['name'], 0, 20));
}

$filterpanel .= '</select><input class="submit" type="submit" value="'.s('Go').'" />&nbsp;&nbsp;<a href="./?page=users&amp;find=NULL" class="reset">'.s('reset').'</a>';
$filterpanel .= '</form></div>';
//$filterpanel .= '<tr><td colspan="4"></td></tr>
//</table>';

print Info($countpanel);

$panel = new UIPanel($GLOBALS['I18N']->get('Find subscribers'), $filterpanel);
print $panel->display();

#if (($require_login && isSuperUser()) || !$require_login)
print '<div class="actions">';
print '<div id="add-csv-button">'.PageLinkButton('dlusers', $GLOBALS['I18N']->get('Download all users as CSV file'), 'nocache='.uniqid('')).'</div>';
print '<div id="add-user-button">'.PageLinkButton('adduser', $GLOBALS['I18N']->get('Add a User')).'</div>';
print '</div>';

$some = 0;

$ls = new WebblerListing(s('users'));
$ls->usePanel($paging);
if ($result) {
    while ($user = Sql_fetch_array($result)) {
        $some = 1;
        $ls->addElement($user['email'], PageURL2("user&amp;start=$start&amp;id=".$user['id'].$find_url));
        $ls->setClass($user['email'], 'row1');

    ## we make one column with the subscriber status being "on" or "off"
    ## two columns are too confusing and really unnecessary
    # ON = confirmed &&  !blacklisted

#    $ls->addColumn($user["email"], $GLOBALS['I18N']->get('confirmed'), $user["confirmed"] ? $GLOBALS["img_tick"] : $GLOBALS["img_cross"]);
 #   if (in_array("blacklist", $columns)) {
      $onblacklist = isBlackListed($user['email']);
  #    $ls->addColumn($user["email"], $GLOBALS['I18N']->get('bl l'), $onblacklist ? $GLOBALS["img_tick"] : $GLOBALS["img_cross"]);
  #  }

    if ($user['confirmed'] && !$onblacklist) {
        $ls_confirmed = $GLOBALS['img_tick'];
    } else {
        $ls_confirmed = $GLOBALS['img_cross'];
    }

        $ls_del = '';
#    $ls->addColumn($user["email"], $GLOBALS['I18N']->get('del'), sprintf('<a href="%s" onclick="return deleteRec(\'%s\');">del</a>',PageUrl2('users'.$find_url), PageURL2("users&start=$start&delete=" .$user["id"])));
    if (isSuperUser()) {
        $ls_del = sprintf('<a href="javascript:deleteRec(\'%s\');" class="del">del</a>', PageURL2("users&start=$start&find=$find&findby=$findby&delete=".$user['id']));
    }
/*    if (isset ($user['foreignkey'])) {
      $ls->addColumn($user["email"], $GLOBALS['I18N']->get('key'), $user["foreignkey"]);
    }
    if (isset ($user["display"])) {
      $ls->addColumn($user["email"], "&nbsp;", $user["display"]);
    }
*/    if (in_array('lists', $columns)) {
        $lists = Sql_query('SELECT count(*) FROM '.$tables['listuser'].','.$tables['list'].' where userid = '.$user['id'].' and '.$tables['listuser'].'.listid = '.$tables['list'].'.id');
        $membership = Sql_fetch_row($lists);
        $ls->addColumn($user['email'], $GLOBALS['I18N']->get('lists'), $membership[0]);
    }

        if (in_array('messages', $columns)) {
            $msgs = Sql_query('SELECT count(*) FROM '.$tables['usermessage'].' where userid = '.$user['id'].' and status = "sent"');
            $nummsgs = Sql_fetch_row($msgs);
            $ls_msgs = $GLOBALS['I18N']->get('msgs').':&nbsp;'.$nummsgs[0];
        }

    ### allow plugins to add columns
    if (isset($GLOBALS['plugins']) && is_array($GLOBALS['plugins'])) {
        foreach ($GLOBALS['plugins'] as $plugin) {
            if (method_exists($plugin, 'displayUsers')) {
                $plugin->displayUsers($user, $user['email'], $ls);
            }
        }
    }

        $ls_bncs = '';
        if (in_array('bounces', $columns) && !empty($user['bouncecount'])) {
            $ls_bncs = $GLOBALS['I18N']->get('bncs').': '.$user['bouncecount'];
        }
        $ls->addRow($user['email'], "<div class='listinghdname gray'>".$ls_msgs.'<br />'.$ls_bncs.'</div>', $ls_del.'&nbsp;'.$ls_confirmed);
    }
    print $ls->display();
    if (!$some && !$total) {
        $p = new UIPanel($GLOBALS['I18N']->get('no results'), $GLOBALS['I18N']->get('No users apply'));
        print $p->display();
    }
}
