public function setStartCode()
 {
     $query = 'SELECT TOP 1 MemberCardNo FROM POS_Member WHERE MemberCardNo LIKE \'T%\' ORDER BY Code DESC';
     $res = Processor::execErp($query);
     $member = odbc_fetch_array($res);
     $this->code = getArrayVal($member, 'MemberCardNo');
     return $this;
 }

 public static function genQueryNestReplace(array $targetArr, array $replaceArr, $columnName)
 {
     $string = '';
     foreach ($targetArr as $key => $target) {
         $target = '\'' === $target ? $target . '\'' : $target;
         $columnName = 0 === $key ? $columnName : $string;
         $string = 'REPLACE(' . $columnName . ', \'' . $target . '\', \'' . getArrayVal($replaceArr, $key) . '\')';
     }
     return $string;
 }

 protected function appendRow(array $data, array $css)
 {
     $this->targetSheet->row($this->getIndex(), $data);
     $this->targetSheet->cells($this->getCellsRange(), function ($cells) use($css) {
         $cells->setBackground(getArrayVal($css, 'backgrounColor'))->setFontColor(getArrayVal($css, 'fontColor'));
     });
     return $this;
 }

/**
* Detect if Collabtive runs on HTTP or HTTPS
*/
function detectSSL()
{
    if (getArrayVal($_SERVER, "https") == "on") {
        return true;
    } elseif (getArrayVal($_SERVER, "https") == 1) {
        return true;
    } elseif (getArrayVal($_SERVER, "HTTPS") == 'on') {
        return true;
    } elseif (getArrayVal($_SERVER, "HTTPS") == 1) {
        return true;
    } elseif (getArrayVal($_SERVER, "SERVER_PORT") == 443) {
        return true;
    } else {
        return false;
    }
}

    if (!$userpermissions["admin"]["add"]) {
        $errtxt = $langfile["nopermission"];
        $noperm = $langfile["accessdenied"];
        $template->assign("errortext", "{$errtxt}<br>{$noperm}");
        $template->assign("mode", "error");
        $template->display("error.tpl");
        die;
    }
    if ($user->del($id)) {
        $loc = $url . "admin.php?action=users&mode=deleted";
        header("Location: {$loc}");
    }
} elseif ($action == "profile") {
    $thetag = new tags();
    $start = getArrayVal($_GET, "start");
    $end = getArrayVal($_GET, "end");
    $proj = (object) new project();
    if ($userpermissions["admin"]["add"]) {
        $projects = $proj->getMyProjects($id);
        $i = 0;
        if (!empty($projects)) {
            foreach ($projects as $opro) {
                $membs = $proj->getProjectMembers($opro["ID"], 1000);
                $projects[$i]['members'] = $membs;
                $i = $i + 1;
            }
            $template->assign("opros", $projects);
        }
    }
    $tracker = (object) new timetracker();
    $track = array();

    // Get milestone info
    $milestone = $milestone->getMilestone($mid);
    $template->assign("projectname", $projectname);
    $template->assign("milestone", $milestone);
    $template->display("editmilestone.tpl");
} elseif ($action == "edit") {
    if (!$userpermissions["milestones"]["edit"]) {
        $errtxt = $langfile["nopermission"];
        $noperm = $langfile["accessdenied"];
        $template->assign("errortext", "<h2>{$errtxt}</h2><br>{$noperm}");
        $template->display("error.tpl");
        die;
    }
    // Get milestone ID and start date from form
    $mid = $_POST['mid'];
    $start = getArrayVal($_POST, "start");
    // Edit the milestone
    if ($milestone->edit($mid, $name, $desc, $start, $end)) {
        $loc = $url . "managemilestone.php?action=showproject&id={$id}&mode=edited";
        header("Location: {$loc}");
    } else {
        $template->assign("editmilestone", 0);
    }
} elseif ($action == "del") {
    if (!$userpermissions["milestones"]["del"]) {
        $errtxt = $langfile["nopermission"];
        $noperm = $langfile["accessdenied"];
        $template->assign("errortext", "<h2>{$errtxt}</h2><br>{$noperm}");
        $template->display("error.tpl");
        die;
    }

 function __construct()
 {
     $this->userid = getArrayVal($_SESSION, "userid");
     $this->uname = getArrayVal($_SESSION, "username");
 }

        $loc = $url . "admin.php?action=users&mode=roleadded";
        header("Location: $loc");
    }
}
// delete a role
elseif ($action == "delrole")
{
    if ($roleobj->del($id))
    {
        echo "ok";
    }
}
// edit a role
elseif ($action == "editrole")
{
    $rolename = getArrayVal($_POST, "rolename");
    $projectperms = $roleobj->sanitizeArray($projectperms);
    $mileperms = $roleobj->sanitizeArray($mileperms);
    $taskperms = $roleobj->sanitizeArray($taskperms);
    $messageperms = $roleobj->sanitizeArray($messageperms);
    $fileperms = $roleobj->sanitizeArray($fileperms);
    $trackerperms = $roleobj->sanitizeArray($trackerperms);
    $chatperms = $roleobj->sanitizeArray($chatperms);
    $adminperms = $roleobj->sanitizeArray($adminperms);

    if ($roleobj->edit($id, $rolename, $projectperms, $taskperms, $mileperms, $messageperms, $fileperms, $trackerperms, $chatperms, $adminperms))
    {
        $loc = $url . "admin.php?action=users&mode=roleedited";
        header("Location: $loc");
    }
}

 /**
  * Log a user in
  *
  * @param string $user User name
  * @param string $pass Password
  * @return bool
  */
 function openIdLogin($url)
 {
     /* here the openid auth should take place */
     try {
         $openid = new LightOpenID($_SERVER['HTTP_HOST']);
         if (!$openid->mode) {
             $openid->identity = $url;
             header('Location: ' . $openid->authUrl());
         } elseif ($openid->mode == 'cancel') {
             return false;
         } else {
             $identity = $openid->data['openid_identity'];
             $sel1 = $conn->query("SELECT ID from openids WHERE identity='{$identity}'");
             if ($row = $sel1->fetch()) {
                 $id = $row['ID'];
             } else {
                 return false;
             }
             // die("SELECT ID,name,locale,lastlogin,gender FROM user WHERE ID=$id");
             $sel1 = $conn->query("SELECT ID,name,locale,lastlogin,gender FROM user WHERE ID={$id}");
             $chk = $sel1->fetch();
             if ($chk["ID"] != "") {
                 $rolesobj = new roles();
                 $now = time();
                 $_SESSION['userid'] = $chk['ID'];
                 $_SESSION['username'] = stripslashes($chk['name']);
                 $_SESSION['lastlogin'] = $now;
                 $_SESSION['userlocale'] = $chk['locale'];
                 $_SESSION['usergender'] = $chk['gender'];
                 $_SESSION["userpermissions"] = $rolesobj->getUserRole($chk["ID"]);
                 $userid = $_SESSION['userid'];
                 $seid = session_id();
                 $staylogged = getArrayVal($_POST, 'staylogged');
                 if ($staylogged == 1) {
                     setcookie("PHPSESSID", "{$seid}", time() + 14 * 24 * 3600);
                 }
                 $upd1 = $conn->prepare("UPDATE user SET lastlogin = ? WHERE ID = ?");
                 $upd1Stmt = $upd1->execute(array($now, $userid));
                 return true;
             } else {
                 return false;
             }
         }
     } catch (ErrorException $e) {
         return false;
     }
 }

function cleanArray(array $theArray)
{
    $outArray = array();
    foreach ($theArray as $anArrayKey => $anArrayVal) {
        $outArray[$anArrayKey] = getArrayVal($theArray, $anArrayKey);
    }
    return $outArray;
}

    $template->assign("templates", $templates);
    $template->display("editsettings.tpl");
} elseif ($action == "editsets") {
    $theme = getArrayVal($_POST, "theme");
    if ($theset->editSettings($name, $subtitle, $locale, $timezone, $dateformat, $templ, $theme, $rssuser, $rsspass)) {
        $handle = opendir($template->compile_dir);
        while (false !== ($file = readdir($handle))) {
            if ($file != "." and $file != "..") {
                unlink(CL_ROOT . "/" . $template->compile_dir . "/" . $file);
            }
        }
        $_SESSION["userlocale"] = $locale;
        $users = $user->getAllUsers(100000);
        foreach ($users as $theuser) {
            // set the new locale for all the users
            $user->edit($theuser["ID"], $theuser["name"], $theuser["realname"], $theuser["email"], $theuser["tel1"], $theuser["tel2"], $theuser["company"], $theuser["zip"], $theuser["gender"], $theuser["url"], $theuser["adress"], $theuser["adress2"], $theuser["state"], $theuser["country"], $theuser["tags"], $locale, "", $theuser["rate"]);
        }
        header("Location: admin.php?action=system&mode=edited");
    }
} elseif ($action == "editmailsets") {
    $status = getArrayVal($_POST, "mailstatus");
    $mailfrom = getArrayVal($_POST, "mailfrommail");
    $mailfromname = getArrayVal($_POST, "mailfromname");
    $method = getArrayVal($_POST, "mailmethod");
    $server = getArrayVal($_POST, "server");
    $mailuser = getArrayVal($_POST, "mailuser");
    $mailpass = getArrayVal($_POST, "mailpass");
    if ($theset->editMailsettings($status, $mailfrom, $mailfromname, $method, $server, $mailuser, $mailpass)) {
        header("Location: admin.php?action=system&mode=edited");
    }
}

            $content = '(.+</' . $tag . '(>|\\s[^>]*>)|)';
        }
        $str = preg_replace('#</?' . $tag . '(>|\\s[^>]*>)' . $content . '#is', '', $str);
    }
    return $str;
}
function getArrayVal(array $array, $name)
{
    if (array_key_exists($name, $array)) {
        return strip_only_tags($array[$name], "script");
    }
}
error_reporting(0);
$pic = getArrayVal($_GET, "pic");
$height = getArrayVal($_GET, "height");
$width = getArrayVal($_GET, "width");
include CL_ROOT . "/include/class.hft_image.php";
$imagehw = GetImageSize($pic);
$imagewidth = $imagehw[0];
$imageheight = $imagehw[1];
$myThumb = new hft_image(CL_ROOT . "/" . $pic);
$myThumb->jpeg_quality = 80;
if (!isset($height)) {
    $ratio = $imageheight / $imagewidth;
    $height = $width * $ratio;
    $height = round($height);
}
if (!isset($width)) {
    $ratio = $imagewidth / $imageheight;
    $width = $height * $ratio;
}

<?php
require("init.php");

$action = getArrayVal($_GET, "action");

$mainclasses = array("desktop" => "desktop",
    "profil" => "profil",
    "admin" => "admin_active"
    );
$template->assign("mainclasses", $mainclasses);

//check if the user is admin
if (!$userpermissions["admin"]["add"])
{
    $errtxt = $langfile["nopermission"];
    $noperm = $langfile["accessdenied"];
    $template->assign("errortext", "$errtxt<br>$noperm");
    $template->display("error.tpl");
}

//basecamp import
if ($action == "basecamp")
{
    // create new file object
    $myfile = new datei();
    // create new importer object
    $importer = new importer();
    // upload the file
    $up = $myfile->upload("importfile", "files/" . CL_CONFIG . "/ics", 0);
    if ($up)
    {

 /**
  * Log a user in
  *
  * @param string $user User name
  * @param string $pass Password
  * @return bool
  */
 function login($user, $pass)
 {
     global $conn;
     if (!$user) {
         return false;
     }
     $user = $conn->quote($user);
     $pass = sha1($pass);
     $sel1 = $conn->query("SELECT ID,name,locale,lastlogin,gender FROM user WHERE (name = {$user} OR email = {$user}) AND pass = '{$pass}'");
     $chk = $sel1->fetch();
     if ($chk["ID"] != "") {
         $rolesobj = new roles();
         $now = time();
         $_SESSION['userid'] = $chk['ID'];
         $_SESSION['username'] = stripslashes($chk['name']);
         $_SESSION['lastlogin'] = $now;
         $_SESSION['userlocale'] = $chk['locale'];
         $_SESSION['usergender'] = $chk['gender'];
         $_SESSION["userpermissions"] = $rolesobj->getUserRole($chk["ID"]);
         $userid = $_SESSION['userid'];
         $seid = session_id();
         $staylogged = getArrayVal($_POST, 'staylogged');
         if ($staylogged == 1) {
             setcookie("PHPSESSID", "{$seid}", time() + 14 * 24 * 3600);
         }
         $upd1 = $conn->query("UPDATE user SET lastlogin = '{$now}' WHERE ID = {$userid}");
         return true;
     } else {
         return false;
     }
 }

    $template->assign("loginerror", 0);
    $template->display("login.tpl");
    die();
}
$liste = (object) new tasklist();
$objmilestone = (object) new milestone();

$action = getArrayVal($_GET, "action");
$id = getArrayVal($_GET, "id");
$tlid = getArrayVal($_GET, "tlid");
$mode = getArrayVal($_GET, "mode");

$name = getArrayVal($_POST, "name");
$desc = getArrayVal($_POST, "desc");
$access = getArrayVal($_POST, "email");
$milestone = getArrayVal($_POST, "milestone");

$project = array();
$project['ID'] = $id;
$classes = array("overview" => "overview",
    "msgs" => "msgs",
    "tasks" => "tasks_active",
    "miles" => "miles",
    "files" => "files",
    "users" => "users",
    "tracker" => "tracking"
    );
$template->assign("classes", $classes);
if (!chkproject($userid, $id))
{
    $errtxt = $langfile["notyourproject"];

     $noperm = $langfile["accessdenied"];
     $template->assign("errortext", "<h2>{$errtxt}</h2><br>{$noperm}");
     $template->display("error.tpl");
     die;
 }
 $themsg = $msg->add($id, $title, $message, $userid, $username, $mid_post, $milestone);
 if ($themsg) {
     if ($thefiles > 0) {
         // attach existing file
         $msg->attachFile($thefiles, $themsg);
     } elseif ($thefiles == 0 and $numfiles > 0) {
         // if upload files are set, upload and attach
         $msg->attachFile(0, $themsg, $id);
     }
     if ($settings["mailnotify"]) {
         $sendto = getArrayVal($_POST, "sendto");
         $usr = (object) new project();
         $users = $usr->getProjectMembers($id, 10000);
         if ($sendto[0] == "all") {
             $sendto = $users;
             $sendto = reduceArray($sendto);
         } elseif ($sendto[0] == "none") {
             $sendto = array();
         }
         foreach ($users as $user) {
             if (!empty($user["email"])) {
                 $userlang = readLangfile($user['locale']);
                 $subject = $userlang["messagewasaddedsubject"] . ' ("' . $title . '" - ' . $userlang['by'] . ' ' . $username . ')';
                 // added message title and author  to subject
                 $mailcontent = $userlang["hello"] . ",<br /><br/>" . $userlang["messagewasaddedtext"] . "<br /><br />" . "<h3><a href = \"" . $url . "managemessage.php?action=showmessage&id={$id}&mid={$themsg}\">{$title}</a></h3>" . $message;
                 if (is_array($sendto)) {

if (!file_exists("./templates_c") or !is_writable("./templates_c")) {
    die("Required folder templates_c does not exist or is not writable. <br>Please create the folder or make it writable in order to proceed.");
}
// check if the settings table / object is present. if yes, assume collabtive is already installed and abort
if (!empty($settings)) {
    die("Collabtive seems to be already installed.<br />If this is an error, please clear your database.");
}
session_start();
session_destroy();
session_unset();
setcookie("PHPSESSID", "");
date_default_timezone_set("Europe/Berlin");
require "./init.php";
error_reporting(0);
$action = getArrayVal($_GET, "action");
$locale = getArrayVal($_GET, "locale");
if (!empty($locale)) {
    $_SESSION['userlocale'] = $locale;
} else {
    $locale = $_SESSION['userlocale'];
}
if (empty($locale)) {
    $locale = "en";
}
$template->assign("locale", $locale);
$template->config_dir = "./language/{$locale}/";
$title = $langfile['installcollabtive'];
$template->assign("title", $title);
$template->template_dir = "./templates/standard/";
$installSettings["template"] = "standard";
$installSettings["theme"] = "standard";

                } else {
                    if (strlen($res["title"]) > $strlim) {
                        $res["title"] = substr($res["title"], 0, $strlim);
                    }
                    // style = \"list-style-image: url(templates/standard/img/symbols/$res[icon]);\"
                    echo "<li><img src = \"templates/{$settings['template']}/theme/{$settings['theme']}/images/symbols/{$res['icon']}\" >{$res['title']}</li>";
                }
            }
        }
    } else {
        echo "<li></li>";
    }
    echo "</ul>";
    // echo "<ul><li>$query</li></ul>";
} elseif ($action == "ajaxsearch-p") {
    $query = getArrayVal($_POST, "query");
    $result = $such->dosearch($query, $project);
    if (!empty($result)) {
        echo "<ul>";
        foreach ($result as $res) {
            if (!empty($res)) {
                if ($res["type"] == "file") {
                    if (strlen($res["name"]) > $strlim) {
                        $res["name"] = substr($res["name"], 0, $strlim);
                    }
                    echo "<li><img src = \"templates/{$settings['template']}/images/files/{$res['ftype']}.png\">{$res['name']}</li>";
                } elseif ($res["type"] != "task" and $res["type"] != "message") {
                    if (strlen($res["name"]) > $strlim) {
                        $res["name"] = substr($res["name"], 0, $strlim);
                    }
                    // style = \"list-style-image: url(templates/standard/img/symbols/$res[icon]);\"

<?php

require "init.php";
include "./include/class.rss.php";
$rss = new UniversalFeedCreator();
$rss->useCached();
$action = getArrayVal($_GET, "action");
$user = getArrayVal($_GET, "user");
$project = getArrayVal($_GET, "project");
$username = $_SESSION["username"];
error_reporting(0);
if (!empty($settings["rssuser"]) and !empty($settings["rsspass"])) {
    if (!isset($_SERVER['PHP_AUTH_USER'])) {
        header('WWW-Authenticate: Basic realm="Collabtive"');
        header('HTTP/1.0 401 Unauthorized');
        $errtxt = $langfile["nopermission"];
        $noperm = $langfile["accessdenied"];
        $template->assign("errortext", "{$errtxt}<br>{$noperm}");
        $template->display("error.tpl");
        die;
    }
    $authuser = $_SERVER['PHP_AUTH_USER'];
    $authpw = $_SERVER['PHP_AUTH_PW'];
    if ($authuser != $settings["rssuser"] or $authpw != $settings["rsspass"]) {
        unset($_SERVER['PHP_AUTH_USER']);
        unset($_SERVER['PHP_AUTH_PW']);
        $errtxt = $langfile["nopermission"];
        $noperm = $langfile["accessdenied"];
        $template->assign("errortext", "{$errtxt}<br>{$noperm}");
        $template->display("error.tpl");
        die;

     $noperm = $langfile["accessdenied"];
     $template->assign("errortext", "{$errtxt}<br>{$noperm}");
     $template->display("error.tpl");
     die;
 }
 if (!chkproject($userid, $id)) {
     $errtxt = $langfile["notyourproject"];
     $noperm = $langfile["accessdenied"];
     $template->assign("errortext", "{$errtxt}<br>{$noperm}");
     $template->display("error.tpl");
     die;
 }
 $start = getArrayVal($_POST, "start");
 $end = getArrayVal($_POST, "end");
 $usr = getArrayVal($_POST, "usr");
 $taski = getArrayVal($_POST, "task");
 //get open project tasks for filtering
 $task = new task();
 $ptasks = $task->getProjectTasks($id, 1);
 $tracker = (object) new timetracker();
 //If the user can not read tt entries from other user, set the user filter to the current user id.
 if (!$usr) {
     if (!$userpermissions["timetracker"]["read"]) {
         $usr = $userid;
     } else {
         $usr = 0;
     }
 }
 if (!empty($start) and !empty($end)) {
     $track = $tracker->getProjectTrack($id, $usr, $taski, $start, $end, 50);
 } else {