root/admin/admin_user_ban.php

<?php
/***************************************************************************</span>
<span class="code-comment"> *                            admin_user_ban.php
 *                            -------------------
 *   begin                : Tuesday, Jul 31, 2001
 *   copyright            : (C) 2001 The phpBB Group
 *   email                : support@phpbb.com
 *
 *   $Id: admin_user_ban.php,v 1.21.2.6 2005/10/30 15:17:13 acydburn Exp $
 *
 *
 ***************************************************************************/

/***************************************************************************
 *
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 ***************************************************************************/

if ( !empty($setmodules) )</span>
<span class="code-keyword">{
        $filename = basename(__FILE__);
        $module['users']['ban_management'] = $filename;

        return;
}

define('IN_PHPBB', 1);

//</span>
<span class="code-comment">// Load default header
//
$root_path = './../';</span>
<span class="code-lang">require($root_path . 'extension.inc');
require('./pagestart.' . $phpEx);

//</span>
<span class="code-comment">// Start program
//
if ( isset($_POST['submit']) )</span>
<span class="code-keyword">{
        $user_bansql = '';
        $email_bansql = '';
        $ip_bansql = '';

        $user_list = array();
        if ( !empty($_POST['username']) )
        {
                $this_userdata = get_userdata($_POST['username'], true);
                if( !$this_userdata )
                {
                        trigger_error($lang['no_user_id_specified'] );
                        return;
                }

                $user_list[] = $this_userdata['id'];
        }

        $ban_list_ary = array();
        if ( isset($_POST['ban_ip']) )
        {
                $ban_list = explode(',', $_POST['ban_ip']);

            foreach ($ban_list as $ban_item)
            {
                if (preg_match('#^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})[ ]*\-[ ]*([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$#', trim($ban_item), $ip_range_explode))
                {
                    // This is an IP range
                    // Don't ask about all this, just don't ask ... !
                    $ip_1_counter = $ip_range_explode[1];
                    $ip_1_end = $ip_range_explode[5];

                    while ($ip_1_counter <= $ip_1_end)
                    {
                        $ip_2_counter = ($ip_1_counter == $ip_range_explode[1]) ? $ip_range_explode[2] : 0;
                        $ip_2_end = ($ip_1_counter < $ip_1_end) ? 254 : $ip_range_explode[6];

                        if ($ip_2_counter == 0 && $ip_2_end == 254)
                        {
                            $ip_2_counter = 256;
                            $ip_2_fragment = 256;

                            $banlist_ary[] = "$ip_1_counter.*";
                        }

                        while ($ip_2_counter <= $ip_2_end)
                        {
                            $ip_3_counter = ($ip_2_counter == $ip_range_explode[2] && $ip_1_counter == $ip_range_explode[1]) ? $ip_range_explode[3] : 0;
                            $ip_3_end = ($ip_2_counter < $ip_2_end || $ip_1_counter < $ip_1_end) ? 254 : $ip_range_explode[7];

                            if ($ip_3_counter == 0 && $ip_3_end == 254)
                            {
                                $ip_3_counter = 256;
                                $ip_3_fragment = 256;

                                $banlist_ary[] = "$ip_1_counter.$ip_2_counter.*";
                            }

                            while ($ip_3_counter <= $ip_3_end)
                            {
                                $ip_4_counter = ($ip_3_counter == $ip_range_explode[3] && $ip_2_counter == $ip_range_explode[2] && $ip_1_counter == $ip_range_explode[1]) ? $ip_range_explode[4] : 0;
                                $ip_4_end = ($ip_3_counter < $ip_3_end || $ip_2_counter < $ip_2_end) ? 254 : $ip_range_explode[8];

                                if ($ip_4_counter == 0 && $ip_4_end == 254)
                                {
                                    $ip_4_counter = 256;
                                    $ip_4_fragment = 256;

                                    $banlist_ary[] = "$ip_1_counter.$ip_2_counter.$ip_3_counter.*";
                                }

                                while ($ip_4_counter <= $ip_4_end)
                                {
                                    $banlist_ary[] = "$ip_1_counter.$ip_2_counter.$ip_3_counter.$ip_4_counter";
                                    $ip_4_counter++;
                                }
                                $ip_3_counter++;
                            }
                            $ip_2_counter++;
                        }
                        $ip_1_counter++;
                    }
                }
                else if (preg_match('#^([0-9]{1,3})\.([0-9\*]{1,3})\.([0-9\*]{1,3})\.([0-9\*]{1,3})$#', trim($ban_item)) || preg_match('#^[a-f0-9:]+\*?$#i', trim($ban_item)))
                {
                    // Normal IP address
                    $banlist_ary[] = trim($ban_item);
                }
                else if (preg_match('#^\*$#', trim($ban_item)))
                {
                    // Ban all IPs
                    $banlist_ary[] = "*";
                }
                else if (preg_match('#^([\w\-_]\.?){2,}$#is', trim($ban_item)))
                {
                    // hostname
                    $ip_ary = gethostbynamel(trim($ban_item));

                    if (!empty($ip_ary))
                    {
                        foreach ($ip_ary as $ip)
                        {
                            if ($ip)
                            {
                                if (strlen($ip) > 40)
                                {
                                    continue;
                                }

                                $banlist_ary[] = $ip;
                            }
                        }
                    }
                }

                }
        }

        $email_list = array();
        if ( isset($_POST['ban_email']) )
        {
                $email_list_temp = explode(',', $_POST['ban_email']);

                for($i = 0; $i < count($email_list_temp); $i++)
                {
                        //
                        // This ereg match is based on one by php@unreelpro.com
                        // contained in the annotated php manual at php.com (ereg
                        // section)
                        //
                        if (preg_match('/^(([a-z0-9&\'\.\-_\+])|(\*))+@(([a-z0-9\-])|(\*))+\.([a-z0-9\-]+\.)*?[a-z]+$/is', trim($email_list_temp[$i])))
                        {
                                $email_list[] = trim($email_list_temp[$i]);
                        }
                }
        }

        $sql = "SELECT *
                FROM " . BANLIST_TABLE . "
                WHERE ban_type = " . BAN_GLOBAL;
        $result = $db->sql_query($sql);

        $current_banlist = $db->sql_fetchrowset($result);
        $db->sql_freeresult($result);

        $kill_session_sql = '';
        for($i = 0; $i < sizeof($user_list); $i++)
        {
                $in_banlist = false;
                for($j = 0; $j < sizeof($current_banlist); $j++)
                {
                        if ( $user_list[$i] == $current_banlist[$j]['ban_userid'] )
                        {
                                $in_banlist = true;
                        }
                }

                if ( !$in_banlist )
                {
                        $kill_session_sql .= ( ( $kill_session_sql != '' ) ? ' OR ' : '' ) . "session_user_id = " . $user_list[$i];

                        $sql = "INSERT INTO " . BANLIST_TABLE . " (ban_userid, ban_added, ban_type)
                                VALUES (" . $user_list[$i] . ", " . time() . ", " . BAN_GLOBAL . ")";
                        $db->sql_query($sql);
                }
        }

        for($i = 0; $i < sizeof($banlist_ary); $i++)
        {
                $in_banlist = false;
                for($j = 0; $j < sizeof($current_banlist); $j++)
                {
                        if ( $banlist_ary[$i] == $current_banlist[$j]['ban_ip'] )
                        {
                                $in_banlist = true;
                        }
                }

                if ( !$in_banlist )
                {
                        $kill_ip_sql = $db->sql_in_set('session_ip', $banlist_ary);

                        $kill_session_sql .= ( ( $kill_session_sql != '' ) ? ' OR ' : '' ) . $kill_ip_sql;

                        $sql = "INSERT INTO " . BANLIST_TABLE . " (ban_ip, ban_added, ban_type)
                                VALUES ('" . $banlist_ary[$i] . "', " . time() . ", " . BAN_GLOBAL . ")";
                        $db->sql_query($sql);
                }
        }

        //
        // Now we'll delete all entries from the session table with any of the banned
        // user or IP info just entered into the ban table ... this will force a session
        // initialisation resulting in an instant ban
        //
        if ( $kill_session_sql != '' )
        {
                $sql = "DELETE FROM " . SESSIONS_TABLE . "
                        WHERE $kill_session_sql";
                $db->sql_query($sql);
        }

        for($i = 0; $i < count($email_list); $i++)
        {
                $in_banlist = false;
                for($j = 0; $j < count($current_banlist); $j++)
                {
                        if ( $email_list[$i] == $current_banlist[$j]['ban_email'] )
                        {
                                $in_banlist = true;
                        }
                }

                if ( !$in_banlist )
                {
                        $sql = "INSERT INTO " . BANLIST_TABLE . " (ban_email, ban_added, ban_type)
                                VALUES ('" . str_replace("\'", "''", $email_list[$i]) . "', " . time() . ", " . BAN_GLOBAL . ")";
                        $db->sql_query($sql);
                }
        }

        $where_sql = '';

        if ( isset($_POST['unban_user']) )
        {
                $user_list = $_POST['unban_user'];

                for($i = 0; $i < count($user_list); $i++)
                {
                        if ( $user_list[$i] != -1 )
                        {
                                $where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . intval($user_list[$i]);
                        }
                }
        }

        if ( isset($_POST['unban_ip']) )
        {
                $ban_list_ary = $_POST['unban_ip'];

                for($i = 0; $i < count($ban_list_ary); $i++)
                {
                        if ( $ban_list_ary[$i] != -1 )
                        {
                                $where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . str_replace("\'", "''", $ban_list_ary[$i]);
                        }
                }
        }

        if ( isset($_POST['unban_email']) )
        {
                $email_list = $_POST['unban_email'];

                for($i = 0; $i < count($email_list); $i++)
                {
                        if ( $email_list[$i] != -1 )
                        {
                                $where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . str_replace("\'", "''", $email_list[$i]);
                        }
                }
        }

        if ( $where_sql != '' )
        {
                $sql = "DELETE FROM " . BANLIST_TABLE . "
                        WHERE ban_id IN ($where_sql)";
                $db->sql_query($sql);
        }

        $message = $lang['ban_update_sucessful'] . '<br /><br />' . sprintf($lang['click_return_banadmin'], '<a href="' . append_sid("admin_user_ban.$phpEx") . '">', '</a>') . '<br /><br />' . sprintf($lang['click_return_admin_index'], '<a href="' . append_sid("index.$phpEx?pane=right") . '">', '</a>');

        trigger_error($message);
        return;

}
else
{
        $template->set_filenames(array(
                'body' => '../admin/user_ban_body.tpl')
        );

        $template->assign_vars(array(
                'L_BAN_TITLE' => $lang['ban_control'],
                'L_IP_OR_HOSTNAME' => $lang['ip_hostname'],
                'S_BANLIST_ACTION' => append_sid("admin_user_ban.$phpEx"))
        );

        $template->assign_vars(array(
                'L_BAN_USER' => $lang['ban_username'],
                'L_BAN_USER_EXPLAIN' => $lang['ban_username_explain'])
        );

        $userban_count = 0;
        $ipban_count = 0;
        $emailban_count = 0;

        $sql = "SELECT b.ban_id, u.uid, u.name AS username
                FROM " . BANLIST_TABLE . " b, " . USERS_TABLE . " u
                WHERE u.uid = b.ban_userid
                        AND b.ban_userid <> 0
                        AND u.uid <> " . ANONYMOUS . "
                        AND b.ban_type = " . BAN_GLOBAL . "
                ORDER BY u.uid ASC";
        $result = $db->sql_query($sql);

        $user_list = $db->sql_fetchrowset($result);
        $db->sql_freeresult($result);

        $select_userlist = '';
        for($i = 0; $i < count($user_list); $i++)
        {
                $select_userlist .= '<option value="' . $user_list[$i]['ban_id'] . '">' . $user_list[$i]['username'] . '</option>';
                $userban_count++;
        }

        if( $select_userlist == '' )
        {
                $select_userlist = '<option value="-1">' . $lang['no_banned_users'] . '</option>';
        }

        $select_userlist = '<select name="unban_user[]" multiple="multiple" size="5">' . $select_userlist . '</select>';

        $sql = "SELECT ban_id, ban_ip, ban_email
                FROM " . BANLIST_TABLE . "
             WHERE ban_type = " . BAN_GLOBAL;
        $result = $db->sql_query($sql);

        $banlist = $db->sql_fetchrowset($result);
        $db->sql_freeresult($result);

        $select_iplist = '';
        $select_emaillist = '';

        for($i = 0; $i < count($banlist); $i++)
        {
                $ban_id = $banlist[$i]['ban_id'];

                if ( !empty($banlist[$i]['ban_ip']) )
                {
                        $ban_ip = str_replace('255', '*', $banlist[$i]['ban_ip']);
                        $select_iplist .= '<option value="' . $ban_id . '">' . $ban_ip . '</option>';
                        $ipban_count++;
                }
                else if ( !empty($banlist[$i]['ban_email']) )
                {
                        $ban_email = $banlist[$i]['ban_email'];
                        $select_emaillist .= '<option value="' . $ban_id . '">' . $ban_email . '</option>';
                        $emailban_count++;
                }
        }

        if ( $select_iplist == '' )
        {
                $select_iplist = '<option value="-1">' . $lang['no_banned_ip'] . '</option>';
        }

        if ( $select_emaillist == '' )
        {
                $select_emaillist = '<option value="-1">' . $lang['no_banned_email'] . '</option>';
        }

        $select_iplist = '<select name="unban_ip[]" multiple="multiple" size="5">' . $select_iplist . '</select>';
        $select_emaillist = '<select name="unban_email[]" multiple="multiple" size="5">' . $select_emaillist . '</select>';

        $template->assign_vars(array(
                'L_UNBAN_USER' => $lang['unban_username'],
                'L_UNBAN_USER_EXPLAIN' => $lang['unban_username_explain'],
                'L_LOOK_UP' => $lang['look_up_user'],

                //'U_SEARCH_USER' => append_sid("./../search.$phpEx?mode=searchuser"),
                'U_SEARCH_USER' => append_sid($root_path . "/phpbb2.php?page=search&amp;mode=searchuser"),
                'S_UNBAN_USERLIST_SELECT' => $select_userlist,
                'S_UNBAN_IPLIST_SELECT' => $select_iplist,
                'S_UNBAN_EMAILLIST_SELECT' => $select_emaillist,
                'S_BAN_ACTION' => append_sid("admin_user_ban.$phpEx"))
        );
}

$template->display('body');</span>
<span class="code-lang">
include('./page_footer_admin.'.$phpEx);

?>