CVE-2012-10008 (PHP, published 2023-02-20T07:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in uakfdotb oneapp. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 5413ac804f1b09f9decc46a6c37b08352c49669c. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221483.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/uakfdotb/oneapp
Files changed:
admin/comments.php
admin/easy_question.php
admin/gen_pdf.php
admin/index.php
admin/man_club.php
admin/man_notes.php
admin/man_questions.php
admin/preview.php
admin/statistics.php
admin/user_detail.php
admin/view_recommendation.php
admin/view_submit.php
astyle/one/admin/index_login.php
astyle/one/admin/man_club.php
astyle/one/root/index_login.php
astyle/one/root/man_admins.php
astyle/two/admin/index_login.php
astyle/two/root/index_login.php
astyle/two/root/man_admins.php
include/common.php
install.sql
install/install.php
login.php
page/admin/index_login.php
page/admin/man_club.php
page/root/index_login.php
page/root/man_admins.php
root/index.php
root/man_admins.php
Commit message: All users are now unified in the users table. Club and site administrators are determined by associations with groups in the user_groups table. Additionally, a few critical MySQL injection vulnerabilities are fixed in this revision.


Vulnerable code:
if(isset($_SESSION['admin_id']) && $_REQUEST['id']) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
	$admin_id = escape($_SESSION['admin_id']);
		$result = mysql_query("SELECT comments FROM club_notes WHERE application_id='$app_id' AND admin_id='$admin_id'");
	header('Location: index.php?error=' . urlencode("You are not logged in!"));
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
if(isset($_REQUEST['username']) && isset($_REQUEST['password'])) {
	$checkResult = checkAdmin($_REQUEST['username'], $_REQUEST['password']);
	if($checkResult !== FALSE) {
		$_SESSION['admin_id'] = $checkResult;
	} else {
		$error = "Incorrect username/password. You may be locked from your account. ";
} else if(isset($_REQUEST['action']) && isset($_SESSION['admin_id'])) {
		$success = "You are now logged out.";
		session_unset();
if(isset($_SESSION['admin_id'])) {
	get_page_advanced("index", "admin");
} else if(isset($error)) {
	get_page_advanced("index_login", "admin", array('error' => $error));
	get_page_advanced("index_login", "admin", array('success' => $success));
	get_page_advanced("index_login", "admin");
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
	$admin_id = escape($_SESSION['admin_id']);
		if(isset($_REQUEST['action'])){
			$currpass = mysql_query("SELECT password FROM admins WHERE id='" . $_SESSION['admin_id'] . "'");
			$currpass = mysql_fetch_array($currpass);
			if($_REQUEST['old_password']==$currpass[0]){
				if(isset($_REQUEST['description']) && isset($_REQUEST['view_time']) && isset($_REQUEST['open_time']) && isset($_REQUEST['close_time']) && isset($_REQUEST['user_type'])) {
					$description = escape($_REQUEST['description']);
					$view_time = strtotime($_REQUEST['view_time']);
					$open_time = strtotime($_REQUEST['open_time']);
					$close_time = strtotime($_REQUEST['close_time']);
					$num_recommend = escape($_REQUEST['num_recommend']);
					$user_type = escape($_REQUEST['user_type']);
					if($user_type == "Name"){
						$usernot = 1;
					} else {
						$usernot = 0;
					}
		
					mysql_query("UPDATE clubs SET description='$description', view_time='$view_time', open_time='$open_time', close_time='$close_time', num_recommend='$num_recommend' WHERE id='$club_id'");
					$success = "Account Updated!";
				}
				if(isset($_REQUEST['new_password'])) {
					$changepass = changeAdminPass($admin_id,$_REQUEST['new_password'],$_REQUEST['new_password_conf']);
					if($changepass == 1){
						$success = "Password Updated!";
					} else if($changepass == -2){
						$error = "New password does not match!";
					} else {
						$error = "Invaid new password!";
					}
				}
			} else {
				$error = "Incorrect password! If you have forgotten this password, contact your rood advisor.";
			}
		} else {
			$info = "You need your current password to make any changes!";
		$result = mysql_query("SELECT c.name, a.email, c.description, c.view_time, c.open_time, c.close_time, c.num_recommend FROM clubs c, admins a WHERE c.id='$club_id' AND a.id='$admin_id'");
			if( isset($error) ) {
				get_page_advanced("man_club", "admin", array('error'=> $error, 'email' => $row['email'], 'club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']));
				get_page_advanced("man_club", "admin", array('success' => $success, 'email' => $row['email'], 'club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']));
				get_page_advanced("man_club", "admin", array('info' => $info, 'email' => $row['email'], 'club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']));
				get_page_advanced("man_club", "admin", array('warning' => $warning, 'email' => $row['email'], 'club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']));
			} else {
				get_page_advanced("man_club", "admin", array('email' => $row['email'], 'club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']));
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
	$admin_id = escape($_SESSION['admin_id']);
			mysql_query("UPDATE admins SET box_enabled = '$box_enabled', cat_enabled = '$cat_enabled', comment_enabled = '$comment_enabled' WHERE id = '" . $_SESSION['admin_id'] . "'");
		$result = mysql_query("SELECT box_enabled, cat_enabled, comment_enabled FROM admins WHERE id='" . $_SESSION['admin_id'] . "'");
				mysql_query("DELETE FROM club_notes_categories WHERE admin_id = '$admin_id' AND name = '$catName'");
				$result = mysql_query("SELECT name FROM club_notes_categories WHERE admin_id = '$admin_id' AND name = '$catName'");
					mysql_query("INSERT INTO club_notes_categories (name, admin_id) VALUES ('$catName', '$admin_id')");
		$result = mysql_query("SELECT name FROM club_notes_categories WHERE admin_id = '$admin_id'");
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
if(isset($_SESSION['admin_id']) && isset($_REQUEST['id'])) {
if(isset($_SESSION['admin_id']) && isset($_REQUEST['peer_pdf']) && isset($_REQUEST['user_id'])) {
if(isset($_SESSION['admin_id'])) {
	$club_id = escape(getAdminClub($_SESSION['admin_id']));
	$admin_id = escape($_SESSION['admin_id']);
		$result = mysql_query("SELECT box_enabled, cat_enabled, comment_enabled FROM admins WHERE id='" . escape($_SESSION['admin_id']) . "'");
			$toolsResult = mysql_query("SELECT application_id, box, category, comments FROM club_notes WHERE admin_id = '$admin_id'");
						mysql_query("INSERT INTO club_notes (application_id, admin_id) VALUES ('$application_id', '$admin_id')");
						mysql_query("UPDATE club_notes SET $updateString WHERE application_id='$application_id' AND admin_id='$admin_id'");
			$catResult = mysql_query("SELECT name FROM club_notes_categories WHERE admin_id = '$admin_id'");
<p>Log in with the administrator username and password. These are added through <b>Admin Management</b> in the root administration section. If you do not know your username and password, then you should contact your root administrator.</p>
<tr><td><p>Update Password</p></td><td><input type="password" name="new_password"></td></tr>
Password: <input type="password" name="password"><br>
<input type="submit" name="submit" value="Submit">
<tr>
	<td align="right"><p class="admin_table_entry">Password</p></td>
	<td><input type="password" name="password" style="width:100%"></td>
</tr>
<tr>
	<td align="right"><p class="admin_table_entry">Email address</p></td>
	<td><input type="text" name="email" style="width:100%"></td>
</tr>
			<option value="0">General Application</option>
			
			$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

			while($row = mysql_fetch_array($result))
			  {
				echo "<option value=\"".$row['id']."\">".$row['name']."</option>";
			  }

	<th><p class="admin_table_header">Club ID</th></p>
	<th><p class="admin_table_header">Email</p></th>
	<th><p class="admin_table_header">Change pass</p></th>
	<th><p class="admin_table_header">Delete</p></th>
				   echo "General App";
				}
				else {
					 $result = mysql_query("SELECT id, name FROM clubs WHERE id = '$item[1]'");
					 $row = mysql_fetch_array($result);
					 echo $row['name'];

					$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

					while($row = mysql_fetch_array($result)) {
						if ($row['id']!=$item[1]) {
							echo "<option value=\"".$row['id']."\">".$row['name']."</option>";
						}
					}

					if ($item[1] > 0) {
					   echo "<option value=\"0\">General Application</option>";
					}

		<td><input type="text" name="username" value="<?= $item[2] ?>" style="width:100%"></td>
		<td><input type="text" name="email" value="<?= $item[3] ?>" style="width:100%"></td>
		<td><input type="password" name="password" style="width:100%"></td>
		<td><input type="submit" name="action" value="delete"></td>
<tr>
	<td>Password</p></td>
	<td><input type="password" name="password"></td>
</tr>
<tr>
	<td>Email address</td>
	<td><input type="text" name="email"></td>
</tr>
		<option value="0">General Application</option>
			$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

			while($row = mysql_fetch_array($result))
			{
				echo "<option value=\"".$row['id']."\">".$row['name']."</option>";
	<th>Club</th>
	<th align="left">Email</th>
	<th align="left">Change pass</th>
				   echo "General App";
				}
				else {
					//todo: terribly inefficient
					$result = mysql_query("SELECT id, name FROM clubs WHERE id = '$item[1]'");
					$row = mysql_fetch_array($result);
					echo $row['name'];
		
				$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

				while($row = mysql_fetch_array($result)) {
					if ($row['id']!=$item[1]) {
						echo "<option value=\"" . $row['id'] . "\">" . $row['name'] . "</option>";
					}
				}
				if ($item[1] > 0) {
				   echo "<option value=\"0\">General Application</option>";
			</select>
			</td>
			<td><input class="slide" onfocus="OnFocusInput (this)" onblur="OnBlurInput (this)" type="text" name="username" value="<?= $item[2] ?>"></td>
			<td><input class="slide" onfocus="OnFocusInput (this)" onblur="OnBlurInput (this)" type="text" name="email" value="<?= $item[3] ?>" size="10"></td>
			<td><input class="slide" onfocus="OnFocusInput (this)" onblur="OnBlurInput (this)" type="password" name="password"></td>
			<td><input type="submit" name="action" value="Update" class="update"></td>
			<td><input type="submit" name="action" value="Delete" class="delete negative"></td>
	if(!lockAction("checkuser")) {
//returns array (username, email address, name)
function getUserInformation($user_id) {
	$user_id = escape($user_id);
	$result = mysql_query("SELECT username, email, name FROM users WHERE id='$user_id'");
	if($row = mysql_fetch_array($result)) {
		return array($row[0], $row[1], $row[2]);
//returns array (username, email address, club name)
function getAdminInformation($admin_id) {
	$admin_id = escape($admin_id);
	$club_id = getAdminClub($admin_id);
	$result = mysql_query("SELECT a.username, a.email, c.name FROM admins a, clubs c WHERE a.id='$admin_id' AND c.id='$club_id'");
	if(!lockAction("checkuser")) {
function addAdmin($username, $password, $email, $club_id) {
	$username = escape($username);
	$password = escape(chash($password));
	$email = escape($email);
	
	$result = mysql_query("INSERT INTO admins (username, password, email, club_id) VALUES ('$username', '$password', '$email', '$club_id')");
}

function updateAdmin($admin_id, $username, $password, $email, $club_id) {
	$admin_id = escape($admin_id);
	$setString = "";
	
	if(strlen($username) > 0) {
		$setString .= ", username = '" . escape($username) . "'";
	}
	
	if(strlen($password) > 0) {
		$setString .= ", password = '" . escape(chash($password)) . "'";
	}
	
	if(strlen($email) > 0) {
		$setString .= ", email = '" . escape($email) . "'";
	}
	
	if(strlen($club_id) > 0) {
		$setString .= ", club_id = '" . escape($club_id) . "'";
	}
	
	if(strlen($setString) > 0) {
		$setString = substr($setString, 2);
		$result = mysql_query("UPDATE admins SET $setString WHERE id='$admin_id'");
	}
}
function checkAdmin($username, $password) {
	if(!checkLock("checkadmin")) {
		return FALSE;
	}
	$username = escape($username);
	$password = escape(chash($password));
	
	$result = mysql_query("SELECT id, password FROM admins WHERE username='" . $username . "'");
	
	if($row = mysql_fetch_array($result)) {
		if(strcmp($password, $row['password']) == 0) {
			return $row['id'];
			lockAction("checkadmin");
			return FALSE;
		lockAction("checkadmin");
		return FALSE;
//returns admin ID, or false on failure
function getAdminClub($admin_id) {
	$admin_id = escape($admin_id);
	$result = mysql_query("SELECT club_id FROM admins WHERE id='$admin_id'");
	if($row = mysql_fetch_array($result)) {
		return $row[0];
		return FALSE;
function checkRoot($password) {
	if(!checkLock("root")) {
		return FALSE;
	}
	$config = $GLOBALS['config'];
	$root_password = $config['root_password'];
	if(substr($root_password, 0, 1) == ':') { //rest of root password is actually a hash
		$root_password = substr($root_password, 1);
		$password = chash($config['root_password_salt'] . $password);
	if($password == $root_password) {
		return true;
	} else {
		lockAction("root");
		return false;
//1: success; -1: invalid password
function changeAdminPassword($admin_id, $password){
	if(validPassword($password) != 0) {
		return -1;
	} else {
		mysql_query("UPDATE admins SET password = '" . escape(chash($password)) . "' WHERE id='" . $admin_id . "'");
		return 1;
}

//1: success; -1: invalid password, -2 password doesnt match
function changeAdminPass($admin_id, $password, $verify){
	if($password != $verify){
		return -2;
	} else if(validPassword($password) != 0) {
		return -1;
	} else {
		mysql_query("UPDATE admins SET password = '" . escape(chash($password)) . "' WHERE id='" . $admin_id . "'");
		return 1;
CREATE TABLE admins (id INT PRIMARY KEY AUTO_INCREMENT, club_id INT, username VARCHAR(64), password VARCHAR(128), email VARCHAR(256), box_enabled INT, cat_enabled INT, comment_enabled INT);
CREATE TABLE club_notes (application_id INT, admin_id INT, box TEXT, category VARCHAR(16), rank INT, comments TEXT);
CREATE TABLE club_notes_categories (admin_id INT, name VARCHAR(16));
<p>Log in with the administrator username and password. These are added through <b>Admin Management</b> in the root administration section. If you do not know your username and password, then you should contact your root administrator.</p>

<h3>Administrator password</h3>
<form method="post" action="man_club.php">
<table>
<tr>
	<td>Update Password</td>
	<td><input type="password" name="new_password"></td>
</tr>
<tr>
	<td colspan="2"><input type="submit" value="Update" /></td>
</tr>
</table>
</form>
Password: <input type="password" name="password"><br>
<input type="submit" name="submit" value="Submit">
<tr>
	<td>Password</p></td>
	<td><input type="password" name="password"></td>
</tr>
<tr>
	<td>Email address</td>
	<td><input type="text" name="email"></td>
</tr>
		<option value="0">General Application</option>
			$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

			while($row = mysql_fetch_array($result))
			{
				echo "<option value=\"".$row['id']."\">".$row['name']."</option>";
	<th>Club ID</th>
	<th>Email</th>
	<th>Change pass</th>
	<th>Delete</th>
				   echo "General App";
				}
				else {
					//todo: terribly inefficient
					$result = mysql_query("SELECT id, name FROM clubs WHERE id = '$item[1]'");
					$row = mysql_fetch_array($result);
					echo $row['name'];
				$result = mysql_query("SELECT id, name FROM clubs ORDER BY name");

				while($row = mysql_fetch_array($result)) {
					if ($row['id']!=$item[1]) {
						echo "<option value=\"" . $row['id'] . "\">" . $row['name'] . "</option>";
					}
				if ($item[1] > 0) {
				   echo "<option value=\"0\">General Application</option>";
				}
		<td><input type="text" name="username" value="<?= $item[2] ?>"></td>
		<td><input type="text" name="email" value="<?= $item[3] ?>"></td>
		<td><input type="password" name="password"></td>
		<td><input type="submit" name="action" value="delete"></td>
if(isset($_SESSION['admin_id']) || isset($_SESSION['id'] ) ) {
	session_unset();
	$warning = "You have been logged out! You may not log in as two different account types at once!";
	get_page_advanced("index_login", "root", array("warning" => $warning));
}
if(isset($_REQUEST['action'])) {
		session_unset();
		get_page_advanced("index_login", "root", array('success' => "You have been logged out!"));
} else if(isset($_REQUEST['password'])) {
	if(checkRoot($_REQUEST['password'])) {
		$_SESSION['root'] = true;
		get_page_advanced("index", "root", array('success' => "You are now logged in!"));
	} else {
		get_page_advanced("index_login", "root", array('error' => "Password is incorrect or you have been locked out."));
} else if(isset($_SESSION['root'])) {
	get_page_advanced("index", "root");
	get_page_advanced("index_login", "root");
		if($action == 'add') {
			if($_REQUEST['username'] != "" && $_REQUEST['password'] != "") {
				$result = mysql_query("SELECT id FROM admins WHERE username='" . $_REQUEST['username'] . "'");
				if($row = mysql_fetch_array($result)){
					$error = "Username already in use!";
				} else {
					if($_REQUEST['email'] != "") {
						$result = mysql_query("SELECT id FROM admins WHERE email='" . $_REQUEST['email'] . "'");
						if($row = mysql_fetch_array($result)){
							$error = "Email already in use!";
						} else {
							addAdmin($_REQUEST['username'], $_REQUEST['password'], $_REQUEST['email'], $_REQUEST['club_id']);
							$success = "Admin added successfully!";
						}
					} else {
						addAdmin($_REQUEST['username'], $_REQUEST['password'], $_REQUEST['email'], $_REQUEST['club_id']);
						$success = "Admin added successfully!";
					}
				}
				$error = "You need a username and password!";
			}
		} else if($action == 'delete' || $action == 'Delete') {
			$admin_id = escape($_REQUEST['id']);
			mysql_query("DELETE FROM admins WHERE id='$admin_id'");
			$success =  "Admin deleted successfully!";
		} else if($action == 'update' || $action == 'Update') {
			$result = mysql_query("SELECT id FROM admins WHERE username='" . $_REQUEST['username'] . "'");
			if($row = mysql_fetch_array($result)){
				$error = "Username already in use!";
			} else {
				if($_REQUEST['email'] != "") {
					$result = mysql_query("SELECT id FROM admins WHERE email='" . $_REQUEST['email'] . "'");
					if($row = mysql_fetch_array($result)){
						$error = "Email already in use!";
					} else {
						updateAdmin($_REQUEST['id'], $_REQUEST['username'], $_REQUEST['password'], $_REQUEST['email'], $_REQUEST['club_id']);
						$success =  "Admin updated successfully!";
					}
				} else {
					updateAdmin($_REQUEST['id'], $_REQUEST['username'], $_REQUEST['password'], $_REQUEST['email'], $_REQUEST['club_id']);
					$success =  "Admin updated successfully!";
				}
	$result = mysql_query("SELECT id, club_id, username, email FROM admins ORDER BY club_id");
		array_push($adminList, array($row[0], $row[1], $row[2], $row[3]));
	if(isset($error)){
		get_page_advanced("man_admins", "root", array('error' => $error, 'adminList' => $adminList));
	} else if(isset($success)){
		get_page_advanced("man_admins", "root", array('success' => $success, 'adminList' => $adminList));
	} else {
		get_page_advanced("man_admins", "root", array('adminList' => $adminList));

Fixed code:
if(isset($_SESSION['admin']) && isset($_REQUEST['id'])) {
	$club_id = $_SESSION['admin_club_id'];
	$user_id = $_SESSION['user_id'];
		$result = mysql_query("SELECT comments FROM club_notes WHERE application_id='$app_id' AND user_id='$user_id'");
	header('Location: index.php');
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
if(!isset($_SESSION['admin']) && (isset($_SESSION['user_id']) || isset($_REQUEST['username'])) && isset($_REQUEST['password']) && isset($_REQUEST['club'])) {
	if(!isset($_SESSION['user_id'])) {
		//log in first
		$loginResult = checkLogin($_REQUEST['username'], $_REQUEST['password']);
		
		if($result >= 0) {
			$_SESSION['user_id'] = $loginResult;
		} else if($result == -2) {
			$error = "Please try again later (you are locked out for too many failed attempts).";
		} else if($result == -3) {
			$error = "Login and registration are currently disabled.";
		} else if($result == -1) {
			$error = "Login information is not correct.";
		} else {
			$error = "Internal error!";
		}
	}
	//only continue if we haven't failed already
	if(isset($_SESSION['user_id'])) {
		$attempt_club_id = escape(intval($_REQUEST['club']));
		$checkResult = checkAdminLogin($_SESSION['user_id'], $_REQUEST['password'], $attempt_club_id);
		
		if($checkResult === TRUE) {
			$_SESSION['admin'] = true;
			$_SESSION['admin_club_id'] = $attempt_club_id;
			
			//make sure a admin_notes_settings entry exists for this user
			$result = mysql_query("SELECT COUNT(*) FROM admin_notes_settings WHERE user_id = '" . $_SESSION['user_id'] . "'");
			$row = mysql_fetch_row($result);
		
			if($row[0] == 0) {
				mysql_query("INSERT INTO admin_notes_settings (user_id, box_enabled, cat_enabled, comment_enabled) VALUES ('" . $_SESSION['user_id'] . "', '0', '0', '0')");
			}
		} else if($checkResult === -1) {
			$error = "Login information is not correct.";
		} else if($checkResult === -2) {
			$error = "Please try again later (you are locked out for too many failed attempts).";
		} else if($checkResult === 1) {
			$error = "Invalid club specified.";
		}
} else if(isset($_REQUEST['action']) && isset($_SESSION['admin'])) {
		$success = "You are now logged out of the club administration area.";
		unset($_SESSION['admin']);
		unset($_SESSION['admin_club_id']);
$parameters = array();

if(isset($error)) {
	$parameters['error'] = $error;
	$parameters['success'] = $success;
}

if(isset($_SESSION['admin'])) {
	get_page_advanced("index", "admin", $parameters);
	if(isset($_SESSION['user_id'])) {
		$parameters['user_loggedin'] = true;
		$parameters['clubs'] = getAdminClubs($_SESSION['user_id']);
	} else {
		$parameters['user_loggedin'] = false;
		
		//list normal clubs, and general application
		$parameters['clubs'] = listClubsIdName();
		$parameters['clubs'][0] = 'General application';
	}
	
	get_page_advanced("index_login", "admin", $parameters);
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
	$user_id = $_SESSION['user_id'];
		if(isset($_REQUEST['description']) && isset($_REQUEST['view_time']) && isset($_REQUEST['open_time']) && isset($_REQUEST['close_time'])) {
			$description = escape($_REQUEST['description']);
			$view_time = strtotime($_REQUEST['view_time']);
			$open_time = strtotime($_REQUEST['open_time']);
			$close_time = strtotime($_REQUEST['close_time']);
			$num_recommend = escape($_REQUEST['num_recommend']);

			mysql_query("UPDATE clubs SET description='$description', view_time='$view_time', open_time='$open_time', close_time='$close_time', num_recommend='$num_recommend' WHERE id='$club_id'");
			$success = "Club updated successfully.";
		$result = mysql_query("SELECT name, description, view_time, open_time, close_time, num_recommend FROM clubs WHERE id='$club_id'");
			$parameters = array('club_name' => $row['name'], 'description' => $row['description'], 'view_time' => $row['view_time'], 'open_time' => $row['open_time'], 'close_time' => $row['close_time'], 'num_recommend' => $row['num_recommend']);
			
			if(isset($error)) {
				$parameters['error'] = $error;
				$parameters['success'] = $success;
				$parameters['info'] = $info;
				$parameters['warning'] = $warning;
			
			get_page_advanced("man_club", "admin", $parameters);
	} else {
			get_page_advanced("message", "admin", array('message' => "Error: general application does not have club settings.", 'title' => "Manage Club"));
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
	$user_id = $_SESSION['user_id'];
			mysql_query("UPDATE admin_notes_settings SET box_enabled = '$box_enabled', cat_enabled = '$cat_enabled', comment_enabled = '$comment_enabled' WHERE user_id = '$user_id'");
		$result = mysql_query("SELECT box_enabled, cat_enabled, comment_enabled FROM admin_notes_settings WHERE user_id='$user_id'");
				mysql_query("DELETE FROM club_notes_categories WHERE club_id = '$club_id' AND name = '$catName'");
				$result = mysql_query("SELECT name FROM club_notes_categories WHERE club_id = '$club_id' AND name = '$catName'");
					mysql_query("INSERT INTO club_notes_categories (name, club_id) VALUES ('$catName', '$club_id')");
		$result = mysql_query("SELECT name FROM club_notes_categories WHERE club_id = '$club_id'");
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['club_id'];
if(isset($_SESSION['admin']) && isset($_REQUEST['id'])) {
if(isset($_SESSION['admin']) && isset($_REQUEST['peer_pdf']) && isset($_REQUEST['user_id'])) {
if(isset($_SESSION['admin'])) {
	$club_id = $_SESSION['admin_club_id'];
	$user_id = $_SESSION['user_id'];
		$result = mysql_query("SELECT box_enabled, cat_enabled, comment_enabled FROM admin_notes_settings WHERE user_id='$user_id'");
		
			$toolsResult = mysql_query("SELECT application_id, box, category, comments FROM club_notes WHERE club_id = '$club_id'");
						mysql_query("INSERT INTO club_notes (application_id, club_id) VALUES ('$application_id', '$club_id')");
						mysql_query("UPDATE club_notes SET $updateString WHERE application_id='$application_id' AND club_id='$club_id'");
			$catResult = mysql_query("SELECT name FROM club_notes_categories WHERE club_id = '$club_id'");
<p>Use the form below to log in to the club administration area.</p>
	<? if(!$user_loggedin) { ?>
	<? } ?>
	<tr id="admin_username">
	<td><p id="admin_username" align="right">Club:</p></td>
	<td><select name="club">
		<? foreach($clubs as $club_id => $club_name) { ?>
			<option value="<?= $club_id ?>"><?= $club_name ?></option>
		<? } ?>
	</select></td>
	</tr>
<? if(!$user_loggedin) { ?>
Username: <input type="text" name="username" /><br />
<? } ?>
Password: <input type="password" name="password" /><br />
<input type="submit" name="submit" value="Submit" />
			foreach($clubsList as $club_id => $club_name) {
				echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";
 			}
		<option value="0">General Application</option>
	
	<th><p class="admin_table_header">Club</p></th>
	<th><p class="admin_table_header">Remove</p></th>
	<input type="hidden" name="club_id_orig" value="<?= $item[1] ?>">
		<td><input type="text" name="username" value="<?= $item[2] ?>" style="width:100%"></td>
				   echo "General Application";
				} else {
					 echo $clubsList[$item[1]];
				foreach($clubsList as $club_id => $club_name) {
					echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";
 				}
 				
 				echo "<option value=\"0\">General Application</option>";
		<td><input type="submit" name="action" value="remove"></td>
	<? if(!$user_loggedin) { ?>
	<? } ?>
	<tr>
		<td><p class="name">Club:</p></td>
		<td align="right"><select name="club">
		<? foreach($clubs as $club_id => $club_name) { ?>
			<option value="<?= $club_id ?>"><?= $club_name ?></option>
		<? } ?>
		</select></td>
	</tr>
<? if(!$user_loggedin) { ?>
<td>Username <input type="text" name="username" /></td>
<? } ?>
			foreach($clubsList as $club_id => $club_name) {
				echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";
		<option value="0">General Application</option>
	<th>Club</th>
	<input type="hidden" name="club_id_orig" value="<?= $item[1] ?>">
		<td><input class="slide" onfocus="OnFocusInput (this)" onblur="OnBlurInput (this)" type="text" name="username" value="<?= $item[2] ?>"></td>
				   echo "General Application";
				} else {
					echo $clubsList[$item[1]];
			
				foreach($clubsList as $club_id => $club_name) {
					echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";

				echo "<option value=\"0\">General Application</option>";
		</select>
		</td>
		<td><input type="submit" name="action" value="Update" class="update"></td>
		<td><input type="submit" name="action" value="Remove" class="delete negative"></td>
	if(!checkLock("checkuser")) {
			lockAction("checkuser");
		lockAction("checkuser");
//returns user_id, or FALSE on failure
function getUserId($username) {
	$username = escape($username);
	$result = mysql_query("SELECT id FROM users WHERE username = '$username'");
	if($row = mysql_fetch_row($result)) {
		return $row[0];
//returns array (username, email address, name)
function getUserInformation($user_id) {
	$user_id = escape($user_id);
	$result = mysql_query("SELECT username, email, name FROM users WHERE id='$user_id'");
	if(!checkLock("checkuser")) {
			lockAction("checkuser");
		lockAction("checkuser");
//true: success; -1: invalid login; -2: try again later; 1: invalid club
function checkAdminLogin($user_id, $password, $club_id) {
	$user_id = escape($user_id);
	//first verify login information
	$login_result = verifyLogin($user_id, $password);
	if($login_result === TRUE) {
		//check that admin owns the club
		$result = mysql_query("SELECT COUNT(*) FROM user_groups WHERE user_id = '$user_id' AND `group` = '$club_id' AND `group` >= '0'");
		$row = mysql_fetch_row($result);
		
		if($row[0] == 0) {
			return 1;
			return TRUE;
		return $login_result;
//true: success; -1: invalid login; -2: try again later; 1: not root administrator
function checkRootLogin($user_id, $password) {
	$user_id = escape($user_id);

	//first verify login information
	$login_result = verifyLogin($user_id, $password);
	if($login_result === TRUE) {
		//check that admin is a root administrator
		$result = mysql_query("SELECT COUNT(*) FROM user_groups WHERE `group` = '-1' AND user_id = '$user_id'");
		$row = mysql_fetch_row($result);
		
		if($row[0] == 0) {
			return 1;
		} else {
			return TRUE;
		}
		return $login_result;
//returns list of club_id => club_name that admin can manage, or empty list of none
function getAdminClubs($user_id) {
	$user_id = escape($user_id);
	//first add regular clubs
	$result = mysql_query("SELECT `group`, clubs.name FROM user_groups LEFT JOIN clubs ON clubs.id = `group` WHERE user_id='$user_id' AND `group` > '0'");
	$clubs_array = array();
	
	while($row = mysql_fetch_row($result)) {
		$clubs_array[$row[0]] = $row[1];
	//add general application if needed
	$result = mysql_query("SELECT COUNT(*) FROM user_groups WHERE user_id =' $user_id' AND `group` = '0'");
	$row = mysql_fetch_row($result);
	
	if($row[0] > 0) {
		$clubs_array[0] = 'General application';
	
	return $clubs_array;
//can be used to add, remove, or alter a user group association
// if club_id = -1 or association doesn't exist, association will be added
// if new_club_id = -1, association will be removed
// otherwise, association will be altered
//returns TRUE in success, FALSE on failure
function alterAdminClubs($user_id, $club_id, $new_club_id) {
	$user_id = escape($user_id);
	$club_id = escape($club_id);
	$new_club_id = escape($new_club_id);
	
	$old_association = FALSE;
	
	//verify existing association
	if($club_id != -1) {
		$result = mysql_query("SELECT COUNT(*) FROM user_groups WHERE user_id = '$user_id' AND `group` = '$club_id'");
		$row = mysql_fetch_row($result);
		
		if($row[0] > 0) {
			$old_association = TRUE;
		}
	
	//invalidate new_club_id if it exists already
	// in this case, we just delete club_id association
	if($new_club_id != -1) {
		$result = mysql_query("SELECT COUNT(*) FROM user_groups WHERE user_id = '$user_id' AND `group` = '$new_club_id'");
		$row = mysql_fetch_row($result);
		
		if($row[0] > 0) {
			$new_club_id = -1;
		}
	}
	
	if($old_association) {
		//update or delete existing association
		if($new_club_id == -1) {
			mysql_query("DELETE FROM user_groups WHERE user_id = '$user_id' AND `group` = '$club_id'");
		} else {
			mysql_query("UPDATE user_groups SET `group` = '$new_club_id' WHERE user_id = '$user_id' AND `group` = '$club_id'");
		}
	} else if($new_club_id != -1) { //only add an association if we're not trying to delete it!
		mysql_query("INSERT INTO user_groups (user_id, `group`) VALUES ('$user_id', '$new_club_id')");
	
	return TRUE;
//returns array of club_id => club_name
function listClubsIdName() {
	$result = mysql_query("SELECT id, name FROM clubs");
	$array = array();
	
	while($row = mysql_fetch_row($result)) {
		$array[$row[0]] = $row[1];
	}
	
	return $array;
}

CREATE TABLE user_groups (user_id INT, `group` INT);
CREATE TABLE club_notes (application_id INT, user_id INT, box TEXT, category VARCHAR(16), rank INT, comments TEXT);
CREATE TABLE club_notes_categories (club_id INT, name VARCHAR(16));
CREATE TABLE admin_notes_settings (user_id INT, box_enabled INT, cat_enabled INT, comment_enabled INT);
<?php
include("../include/common.php");
include("../config.php");
include("../include/db_connect.php");
include("../include/session.php");

//make sure that users aren't set up yet
$result = mysql_query("SELECT COUNT(*) FROM users");
$row = mysql_fetch_row($result);

if($row[0] == 0) {
	mysql_query("INSERT INTO users (username, password, name, email, register_time, accessed) VALUES ('admin', '" . chash("") . "', 'Site Administrator', 'admin@example.com', '0', '0')");
	$admin_id = escape(mysql_insert_id());
	mysql_query("INSERT INTO user_groups (user_id, `group`) VALUES ('$admin_id', '0')");
	mysql_query("INSERT INTO user_groups (user_id, `group`) VALUES ('$admin_id', '-1')");
}

?>
	
<p>Use the form below to log in to the club administration area.</p>
			<? if(!$user_loggedin) { ?>
			<? } ?>
			<tr>
				<td>Club:</td>
				<td><select name="club">
				<? foreach($clubs as $club_id => $club_name) { ?>
					<option value="<?= $club_id ?>"><?= $club_name ?></option>
				<? } ?>
				</select></td>
			</tr>
<? if(!$user_loggedin) { ?>
Username: <input type="text" name="username" /><br />
<? } ?>
Password: <input type="password" name="password" /><br />
<input type="submit" name="submit" value="Submit" />
			foreach($clubsList as $club_id => $club_name) {
				echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";
		<option value="0">General Application</option>
	<th>Club</th>
	<th>Remove</th>
	<input type="hidden" name="club_id_orig" value="<?= $item[1] ?>">
		<td><input type="text" name="username" value="<?= $item[2] ?>"></td>
				   echo "General Application";
				} else {
					echo $clubsList[$item[1]];
				foreach($clubsList as $club_id => $club_name) {
					echo "<option value=\"" . $club_id . "\">" . $club_name . "</option>";
				echo "<option value=\"0\">General Application</option>";
		<td><input type="submit" name="action" value="remove"></td>
$parameters = array();
if(isset($_REQUEST['action']) && isset($_SESSION['root'])) {
		unset($_SESSION['root']);
		$parameters['success'] = "You are now logged out of the site administration area.";
	}
} else if(!isset($_SESSION['root']) && (isset($_SESSION['user_id']) || isset($_REQUEST['username'])) && isset($_REQUEST['password'])) {
	if(!isset($_SESSION['user_id'])) {
		//log in first
		$loginResult = checkLogin($_REQUEST['username'], $_REQUEST['password']);
		
		if($loginResult >= 0) {
			$_SESSION['user_id'] = $loginResult;
		} else if($loginResult == -2) {
			$parameters['error'] = "Please try again later (you are locked out for too many failed attempts).";
		} else if($loginResult == -3) {
			$parameters['error'] = "Login and registration are currently disabled.";
		} else if($loginResult == -1) {
			$parameters['error'] = "Login information is not correct.";
		} else {
			$parameters['error'] = "Internal error!";
		}
	
	//only continue if we haven't failed already
	if(isset($_SESSION['user_id'])) {
		$checkResult = checkRootLogin($_SESSION['user_id'], $_REQUEST['password']);
		
		if($checkResult === TRUE) {
			$_SESSION['root'] = true;
		} else if($checkResult === -1) {
			$parameters['error'] = "Login information is not correct.";
		} else if($checkResult === -2) {
			$parameters['error'] = "Please try again later (you are locked out for too many failed attempts).";
		} else if($checkResult === 1) {
			$parameters['error'] = "You are not a root administrator.";
		}
}

if(isset($_SESSION['root'])) {
	get_page_advanced("index", "root", $parameters);
	$parameters['user_loggedin'] = isset($_SESSION['user_id']);
	get_page_advanced("index_login", "root", $parameters);
		if($action == 'add' && isset($_REQUEST['username']) && isset($_REQUEST['club_id'])) {
			$user_id = getUserId($_REQUEST['username']);
			
			if($user_id !== FALSE) {
				alterAdminClubs($user_id, -1, $_REQUEST['club_id']);
				$error = "Username not found.";
		} else if(($action == 'remove' || $action == "Remove") && isset($_REQUEST['id']) && isset($_REQUEST['club_id_orig'])) {
			alterAdminClubs($_REQUEST['id'], $_REQUEST['club_id_orig'], -1);
			$success =  "Admin removed successfully.";
		} else if(($action == 'update' || $action == 'Update') && isset($_REQUEST['id']) && isset($_REQUEST['club_id_orig']) && isset($_REQUEST['club_id'])) {
			alterAdminClubs($_REQUEST['id'], $_REQUEST['club_id_orig'], $_REQUEST['club_id']);
			$success = "Admin updated successfully.";
	$clubsList = listClubsIdName();
	$result = mysql_query("SELECT user_groups.user_id, user_groups.`group`, users.username FROM user_groups LEFT JOIN users ON user_groups.user_id = users.id WHERE user_groups.`group` >= '0' ORDER BY user_groups.`group`");
		array_push($adminList, array($row[0], $row[1], $row[2]));
	$parameters = array();
	$parameters['adminList'] = $adminList;
	$parameters['clubsList'] = $clubsList;
	
	if(isset($error)) {
		$parameters['error'] = $error;
	} else if(isset($success)) {
		$parameters['success'] = $success;
	
	get_page_advanced("man_admins", "root", $parameters);