function query($order_id)
 {
     $order_query = xos_db_query("select customers_c_id, customers_name, customers_company, customers_street_address, customers_suburb, customers_city, customers_postcode, customers_state, customers_country, customers_telephone, customers_email_address, customers_address_format_id, delivery_name, delivery_company, delivery_street_address, delivery_suburb, delivery_city, delivery_postcode, delivery_state, delivery_country, delivery_address_format_id, billing_name, billing_company, billing_street_address, billing_suburb, billing_city, billing_postcode, billing_state, billing_country, billing_address_format_id, payment_method, cc_type, cc_owner, AES_DECRYPT(cc_number, 'key_cc_number') AS cc_number, cc_expires, language_id, language_directory, currency, currency_value, date_purchased, orders_status, last_modified from " . TABLE_ORDERS . " where orders_id = '" . (int) $order_id . "'");
     $order = xos_db_fetch_array($order_query);
     $this->info = array('language_id' => $order['language_id'], 'language_directory' => $order['language_directory'], 'currency' => $order['currency'], 'currency_value' => $order['currency_value'], 'payment_method' => $order['payment_method'], 'cc_type' => $order['cc_type'], 'cc_owner' => $order['cc_owner'], 'cc_number' => $order['cc_number'], 'cc_expires' => $order['cc_expires'], 'date_purchased' => $order['date_purchased'], 'orders_status' => $order['orders_status'], 'last_modified' => $order['last_modified']);
     $this->customer = array('c_id' => $order['customers_c_id'], 'name' => $order['customers_name'], 'company' => $order['customers_company'], 'street_address' => $order['customers_street_address'], 'suburb' => $order['customers_suburb'], 'city' => $order['customers_city'], 'postcode' => $order['customers_postcode'], 'state' => $order['customers_state'], 'country' => $order['customers_country'], 'format_id' => $order['customers_address_format_id'], 'telephone' => $order['customers_telephone'], 'email_address' => $order['customers_email_address']);
     $this->delivery = array('name' => $order['delivery_name'], 'company' => $order['delivery_company'], 'street_address' => $order['delivery_street_address'], 'suburb' => $order['delivery_suburb'], 'city' => $order['delivery_city'], 'postcode' => $order['delivery_postcode'], 'state' => $order['delivery_state'], 'country' => $order['delivery_country'], 'format_id' => $order['delivery_address_format_id']);
     $this->billing = array('name' => $order['billing_name'], 'company' => $order['billing_company'], 'street_address' => $order['billing_street_address'], 'suburb' => $order['billing_suburb'], 'city' => $order['billing_city'], 'postcode' => $order['billing_postcode'], 'state' => $order['billing_state'], 'country' => $order['billing_country'], 'format_id' => $order['billing_address_format_id']);
     $index = 0;
     $orders_products_query = xos_db_query("select orders_products_id, products_id, products_model, products_name, products_p_unit, products_price, final_price, products_price_text, final_price_text, total_price_text, products_tax, products_quantity from " . TABLE_ORDERS_PRODUCTS . " where orders_id = '" . (int) $order_id . "'");
     while ($orders_products = xos_db_fetch_array($orders_products_query)) {
         $this->products[$index] = array('qty' => $orders_products['products_quantity'], 'id' => $orders_products['products_id'], 'model' => $orders_products['products_model'], 'name' => $orders_products['products_name'], 'packaging_unit' => $orders_products['products_p_unit'], 'tax' => $orders_products['products_tax'], 'price' => $orders_products['products_price'], 'final_price' => $orders_products['final_price'], 'price_formated' => $orders_products['products_price_text'], 'final_price_formated' => $orders_products['final_price_text'], 'total_price_formated' => $orders_products['total_price_text']);
         $subindex = 0;
         $attributes_query = xos_db_query("select products_options, products_options_values, options_values_price, options_values_price_text, price_prefix from " . TABLE_ORDERS_PRODUCTS_ATTRIBUTES . " where orders_id = '" . (int) $order_id . "' and orders_products_id = '" . (int) $orders_products['orders_products_id'] . "'");
         if (xos_db_num_rows($attributes_query)) {
             while ($attributes = xos_db_fetch_array($attributes_query)) {
                 $this->products[$index]['attributes'][$subindex] = array('option' => $attributes['products_options'], 'value' => $attributes['products_options_values'], 'prefix' => $attributes['price_prefix'], 'price' => $attributes['options_values_price'], 'price_formated' => $attributes['options_values_price_text']);
                 $subindex++;
             }
         }
         $this->info['tax_groups']["{$this->products[$index]['tax']}"] = '1';
         $index++;
     }
     $totals_query = xos_db_query("select title, text, tax, class from " . TABLE_ORDERS_TOTAL . " where orders_id = '" . (int) $order_id . "' order by sort_order, orders_total_id");
     while ($totals = xos_db_fetch_array($totals_query)) {
         $this->totals[] = array('title' => $totals['title'], 'text' => $totals['text'], 'tax' => $totals['tax'], 'class' => $totals['class']);
         if ($totals['tax'] > -1 && ($totals['class'] == 'ot_shipping' || $totals['class'] == 'ot_loworderfee' || $totals['class'] == 'ot_cod_fee')) {
             $this->info['tax_groups']["{$totals['tax']}"] = '1';
         }
     }
 }

 function check()
 {
     if (!isset($this->_check)) {
         $check_query = xos_db_query("select configuration_value from " . TABLE_CONFIGURATION . " where configuration_key = 'MODULE_ORDER_TOTAL_LOWORDERFEE_STATUS'");
         $this->_check = xos_db_num_rows($check_query);
     }
     return $this->_check;
 }

function xos_update_new_order_date()
{
    global $smarty;
    $new_order_date_query = xos_db_query("select last_modified  from " . TABLE_CONFIGURATION . " where configuration_key = 'NEW_ORDER' and configuration_value = 'true' and now() > date_add(last_modified,interval " . UPDATE_INTERVAL_AFTER_NEW_ORDER . " day)");
    if (xos_db_num_rows($new_order_date_query)) {
        xos_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = 'false', last_modified = null where configuration_key = 'NEW_ORDER'");
        $smarty->clearAllCache();
    }
}

 function canPerform($user_id, $user_name)
 {
     $check_query = xos_db_query("select id from " . TABLE_ACTION_RECORDER . " where module = '" . xos_db_input($this->code) . "' and user_name = '" . xos_db_input($user_name) . "' and date_added >= date_sub(now(), interval " . (int) $this->minutes . " minute) and success = 1 order by date_added desc limit " . (int) $this->attempts);
     if (xos_db_num_rows($check_query) == $this->attempts) {
         return false;
     } else {
         return true;
     }
 }

 function canPerform($user_id, $user_name)
 {
     $check_query = xos_db_query("select date_added from " . TABLE_ACTION_RECORDER . " where module = '" . xos_db_input($this->code) . "' and (" . (!empty($user_id) ? "user_id = '" . (int) $user_id . "' or " : "") . " identifier = '" . xos_db_input($this->identifier) . "') and date_added >= date_sub(now(), interval " . (int) $this->minutes . " minute) and success = 1 order by date_added desc limit 1");
     if (xos_db_num_rows($check_query)) {
         return false;
     } else {
         return true;
     }
 }

////////////////////////////////////////////////////////////////////////////////
require 'includes/application_top.php';
if (!$is_shop) {
    xos_redirect(xos_href_link(FILENAME_DEFAULT), false);
} elseif (!(@(include DIR_FS_SMARTY . 'catalog/templates/' . SELECTED_TPL . '/php/' . FILENAME_DOWNLOAD) == 'overwrite_all')) {
    $_SESSION['navigation']->remove_current_page();
    if (!isset($_SESSION['customer_id'])) {
        die;
    }
    // Check download.php was called with proper GET parameters
    if (isset($_GET['order']) && !is_numeric($_GET['order']) || isset($_GET['id']) && !is_numeric($_GET['id'])) {
        die;
    }
    // Check that order_id, customer_id and filename match
    $downloads_query = xos_db_query("select date_format(o.date_purchased, '%Y-%m-%d') as date_purchased_day, opd.download_maxdays, opd.download_count, opd.download_maxdays, opd.orders_products_filename from " . TABLE_ORDERS . " o, " . TABLE_ORDERS_PRODUCTS . " op, " . TABLE_ORDERS_PRODUCTS_DOWNLOAD . " opd, " . TABLE_ORDERS_STATUS . " os where o.customers_id = '" . $_SESSION['customer_id'] . "' and o.orders_id = '" . (int) $_GET['order'] . "' and o.orders_id = op.orders_id and op.orders_products_id = opd.orders_products_id and opd.orders_products_download_id = '" . (int) $_GET['id'] . "' and opd.orders_products_filename != '' and o.orders_status = os.orders_status_id and os.downloads_flag = '1' and os.language_id = '" . (int) $_SESSION['languages_id'] . "'");
    if (!xos_db_num_rows($downloads_query)) {
        die;
    }
    $downloads = xos_db_fetch_array($downloads_query);
    // MySQL 3.22 does not have INTERVAL
    list($dt_year, $dt_month, $dt_day) = explode('-', $downloads['date_purchased_day']);
    $download_timestamp = mktime(23, 59, 59, $dt_month, $dt_day + $downloads['download_maxdays'], $dt_year);
    // Die if time expired (maxdays = 0 means no time limit)
    if ($downloads['download_maxdays'] != 0 && $download_timestamp <= time()) {
        die;
    }
    // Die if remaining count is <=0
    if ($downloads['download_count'] <= 0) {
        die;
    }
    // Die if file is not there

         $smarty_cache_control->clearCache(null, 'L3|cc_product_info');
         xos_redirect(xos_href_link(FILENAME_PRODUCTS_ATTRIBUTES, 'options_page=1&' . $parameter_string));
     }
     break;
 case 'update_value':
     $value_name_array = $_POST['value_name'];
     $value_id = xos_db_prepare_input($_POST['value_id']);
     $option_id = xos_db_prepare_input($_POST['option_id']);
     $actual_option_value_array = xos_db_prepare_input($_POST['actual_value_name']);
     $products_options_value_error = array();
     $error_options_value = false;
     for ($i = 0, $n = sizeof($languages); $i < $n; $i++) {
         if (mb_strtolower($actual_option_value_array[$languages[$i]['id']], 'UTF-8') != mb_strtolower($value_name_array[$languages[$i]['id']], 'UTF-8') || $value_name_array[$languages[$i]['id']] == '') {
             $check_query = xos_db_query("select products_options_name from " . TABLE_PRODUCTS_OPTIONS . " where language_id = '" . (int) $languages[$i]['id'] . "' and products_options_name = '" . xos_db_input(htmlspecialchars($option_name_array[$languages[$i]['id']])) . "'");
             $check_query = xos_db_query("select pov.products_options_values_name from " . TABLE_PRODUCTS_OPTIONS_VALUES . " pov, " . TABLE_PRODUCTS_OPTIONS_VALUES_TO_PRODUCTS_OPTIONS . " pov2po where pov2po.products_options_id = '" . $option_id . "' and pov2po.products_options_values_id = pov.products_options_values_id and pov.products_options_values_name = '" . xos_db_input(htmlspecialchars($value_name_array[$languages[$i]['id']])) . "' and pov.language_id = '" . (int) $languages[$i]['id'] . "'");
             if (xos_db_num_rows($check_query) || $value_name_array[$languages[$i]['id']] == '') {
                 $error_options_value = true;
                 $products_options_value_error[$languages[$i]['id']] = $value_name_array[$languages[$i]['id']];
             }
         }
     }
     if ($error_options_value) {
         $products_options_value_error_array = urlencode(serialize($products_options_value_error));
         $products_options_value_array = urlencode(serialize($value_name_array));
         xos_redirect(xos_href_link(FILENAME_PRODUCTS_ATTRIBUTES, 'options_page=1&action=update_option_value&option_id=' . $option_id . '&value_id=' . $value_id . '&options_value=' . $products_options_value_array . '&options_value_error=' . $products_options_value_error_array . '&' . $parameter_string));
     } else {
         for ($i = 0, $n = sizeof($languages); $i < $n; $i++) {
             $value_name = xos_db_prepare_input(htmlspecialchars($value_name_array[$languages[$i]['id']]));
             xos_db_query("update " . TABLE_PRODUCTS_OPTIONS_VALUES . " set products_options_values_name = '" . xos_db_input($value_name) . "' where products_options_values_id = '" . xos_db_input($value_id) . "' and language_id = '" . (int) $languages[$i]['id'] . "'");
         }
         $smarty_cache_control->clearCache(null, 'L3|cc_product_info');

     return $output_string;
 }
 $add_header = '<script type="text/javascript" src="' . DIR_WS_CATALOG . DIR_WS_IMAGES . 'catalog/templates/' . SELECTED_TPL . '/' . $_SESSION['language'] . '/jquery.ui.datepicker-language.min.js"></script>' . "\n" . '<script type="text/javascript">' . "\n" . '/* <![CDATA[ */' . "\n\n" . '$(function() {' . "\n" . '  $( "#id_dfrom" ).datepicker({' . "\n" . '    changeMonth: true,' . "\n" . '    changeYear: true' . "\n" . '  });' . "\n\n" . '  $( "#id_dto" ).datepicker({' . "\n" . '    changeMonth: true,' . "\n" . '    changeYear: true' . "\n" . '  });' . "\n\n" . '});' . "\n\n" . 'function UpdateManufacturers() {' . "\n" . '  var NumManufacturers = document.advanced_search_and_results._m.options.length;' . "\n" . '  var PostNumManufacturers = "";' . "\n" . '  var SelectedManufacturer = "";' . "\n" . '  var SelectedCategory = "";' . "\n\n" . '  SelectedManufacturer = document.advanced_search_and_results._m.options[document.advanced_search_and_results._m.selectedIndex].value;' . "\n" . '  SelectedCategory = document.advanced_search_and_results.copid.options[document.advanced_search_and_results.copid.selectedIndex].value;' . "\n\n" . '  while(NumManufacturers > 0) {' . "\n" . '    NumManufacturers--;' . "\n" . '    document.advanced_search_and_results._m.options[NumManufacturers] = null;' . "\n" . '  }' . "\n\n" . xos_js_manufacturers_list('SelectedCategory', 'advanced_search_and_results', '_m') . "\n\n" . '  PostNumManufacturers = document.advanced_search_and_results._m.options.length;' . "\n\n" . '  while(PostNumManufacturers > 0) {' . "\n" . '    PostNumManufacturers--;' . "\n" . '    if (document.advanced_search_and_results._m.options[PostNumManufacturers].value == SelectedManufacturer)' . "\n" . '    document.advanced_search_and_results._m.options[PostNumManufacturers].selected = true;' . "\n" . '  }' . "\n\n" . '}' . "\n\n" . 'function SetFocus(TargetFormName) {' . "\n" . '  var target = 0;' . "\n" . '  if (TargetFormName != "") {' . "\n" . '    for (i=0; i<document.forms.length; i++) {' . "\n" . '      if (document.forms[i].name == TargetFormName) {' . "\n" . '        target = i;' . "\n" . '        break;' . "\n" . '      }' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  var TargetForm = document.forms[target];' . "\n\n" . '  for (i=0; i<TargetForm.length; i++) {' . "\n" . '    if ( (TargetForm.elements[i].type != "image") && (TargetForm.elements[i].type != "hidden") && (TargetForm.elements[i].type != "reset") && (TargetForm.elements[i].type != "submit") ) {' . "\n" . '      TargetForm.elements[i].focus();' . "\n\n" . '      if ( (TargetForm.elements[i].type == "text") || (TargetForm.elements[i].type == "password") ) {' . "\n" . '        TargetForm.elements[i].select();' . "\n" . '      }' . "\n\n" . '      break;' . "\n" . '    }' . "\n" . '  }' . "\n" . '}' . "\n\n" . 'function RemoveFormatString(TargetElement, FormatString) {' . "\n" . '  if (TargetElement.value == FormatString) {' . "\n" . '    TargetElement.value = "";' . "\n" . '  }' . "\n\n" . '  TargetElement.select();' . "\n" . '}' . "\n\n" . 'function IsValidDate(DateToCheck, FormatString, RemoveFormat) {' . "\n" . '  var strDateToCheck;' . "\n" . '  var strDateToCheckArray;' . "\n" . '  var strFormatArray;' . "\n" . '  var strFormatString;' . "\n" . '  var strDay;' . "\n" . '  var strMonth;' . "\n" . '  var strYear;' . "\n" . '  var intday;' . "\n" . '  var intMonth;' . "\n" . '  var intYear;' . "\n" . '  var intDateSeparatorIdx = -1;' . "\n" . '  var intFormatSeparatorIdx = -1;' . "\n" . '  var strSeparatorArray = new Array("-"," ","/",".");' . "\n" . '  var strMonthArray = new Array("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec");' . "\n" . '  var intDaysArray = new Array(31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31);' . "\n\n" . '  strDateToCheck = DateToCheck.toLowerCase();' . "\n" . '  strFormatString = FormatString.toLowerCase();' . "\n\n" . '  if (strDateToCheck.length != strFormatString.length) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  for (i=0; i<strSeparatorArray.length; i++) {' . "\n" . '    if (strFormatString.indexOf(strSeparatorArray[i]) != -1) {' . "\n" . '      intFormatSeparatorIdx = i;' . "\n" . '      break;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  for (i=0; i<strSeparatorArray.length; i++) {' . "\n" . '    if (strDateToCheck.indexOf(strSeparatorArray[i]) != -1) {' . "\n" . '      intDateSeparatorIdx = i;' . "\n" . '      break;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if (intDateSeparatorIdx != intFormatSeparatorIdx) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  if (intDateSeparatorIdx != -1) {' . "\n" . '    strFormatArray = strFormatString.split(strSeparatorArray[intFormatSeparatorIdx]);' . "\n" . '    if (strFormatArray.length != 3) {' . "\n" . '      return false;' . "\n" . '    }' . "\n\n" . '    strDateToCheckArray = strDateToCheck.split(strSeparatorArray[intDateSeparatorIdx]);' . "\n" . '    if (strDateToCheckArray.length != 3) {' . "\n" . '      return false;' . "\n" . '    }' . "\n\n" . '    for (i=0; i<strFormatArray.length; i++) {' . "\n" . '      if (strFormatArray[i] == "mm" || strFormatArray[i] == "mmm") {' . "\n" . '        strMonth = strDateToCheckArray[i];' . "\n" . '      }' . "\n\n" . '      if (strFormatArray[i] == "dd") {' . "\n" . '        strDay = strDateToCheckArray[i];' . "\n" . '      }' . "\n\n" . '      if (strFormatArray[i] == "yyyy") {' . "\n" . '        strYear = strDateToCheckArray[i];' . "\n" . '      }' . "\n" . '    }' . "\n" . '  } else {' . "\n" . '    if (FormatString.length > 7) {' . "\n" . '      if (strFormatString.indexOf("mmm") == -1) {' . "\n" . '        strMonth = strDateToCheck.substring(strFormatString.indexOf("mm"), 2);' . "\n" . '      } else {' . "\n" . '        strMonth = strDateToCheck.substring(strFormatString.indexOf("mmm"), 3);' . "\n" . '      }' . "\n\n" . '      strDay = strDateToCheck.substring(strFormatString.indexOf("dd"), 2);' . "\n" . '      strYear = strDateToCheck.substring(strFormatString.indexOf("yyyy"), 2);' . "\n" . '    } else {' . "\n" . '      return false;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if (RemoveFormat == true) {' . "\n" . '    return strYear + strMonth + strDay;' . "\n" . '  }' . "\n\n" . '  if (strYear.length != 4) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  intday = parseInt(strDay, 10);' . "\n" . '  if (isNaN(intday)) {' . "\n" . '    return false;' . "\n" . '  }' . "\n" . '  if (intday < 1) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  intMonth = parseInt(strMonth, 10);' . "\n" . '  if (isNaN(intMonth)) {' . "\n" . '    for (i=0; i<strMonthArray.length; i++) {' . "\n" . '      if (strMonth == strMonthArray[i]) {' . "\n" . '        intMonth = i+1;' . "\n" . '        break;' . "\n" . '      }' . "\n" . '    }' . "\n" . '    if (isNaN(intMonth)) {' . "\n" . '      return false;' . "\n" . '    }' . "\n" . '  }' . "\n" . '  if (intMonth > 12 || intMonth < 1) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  intYear = parseInt(strYear, 10);' . "\n" . '  if (isNaN(intYear)) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  if (IsLeapYear(intYear) == true) {' . "\n" . '    intDaysArray[1] = 29;' . "\n" . '  }' . "\n\n" . '  if (intday > intDaysArray[intMonth - 1]) {' . "\n" . '    return false;' . "\n" . '  }' . "\n\n" . '  return true;' . "\n" . '}' . "\n\n" . 'function IsLeapYear(intYear) {' . "\n" . '  if (intYear % 100 == 0) {' . "\n" . '    if (intYear % 400 == 0) {' . "\n" . '      return true;' . "\n" . '    }' . "\n" . '  } else {' . "\n" . '    if ((intYear % 4) == 0) {' . "\n" . '      return true;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  return false;' . "\n" . '}' . "\n\n" . 'function check_form() {' . "\n" . '  var error_message = "' . JS_ERROR . '";' . "\n" . '  var error_found = false;' . "\n" . '  var error_field;' . "\n" . '  var keywords = document.advanced_search_and_results.keywords.value;' . "\n" . '  var dfrom = document.advanced_search_and_results.dfrom.value;' . "\n" . '  var dto = document.advanced_search_and_results.dto.value;' . "\n" . '  var pfrom = document.advanced_search_and_results.pfrom.value;' . "\n" . '  var pto = document.advanced_search_and_results.pto.value;' . "\n" . '  var pfrom_float;' . "\n" . '  var pto_float;' . "\n\n" . '  String.prototype.trim = function () {' . "\n" . '    return (this.replace(/\\s+$/,"").replace(/^\\s+/,""));' . "\n" . '  };' . "\n\n" . '  if ( ((keywords == "") || (keywords.trim().length < 1)) && ((dfrom == "") || (dfrom == "' . AS_FORMAT_STRING . '") || (dfrom.length < 1)) && ((dto == "") || (dto == "' . AS_FORMAT_STRING . '") || (dto.length < 1)) && ((pfrom == "") || (pfrom.length < 1)) && ((pto == "") || (pto.length < 1)) ) {' . "\n" . '    error_message = error_message + "* ' . ERROR_AT_LEAST_ONE_INPUT . '\\n";' . "\n" . '    error_field = document.advanced_search_and_results.keywords;' . "\n" . '    error_found = true;' . "\n" . '  }' . "\n\n" . '  if ((dfrom.length > 0) && (dfrom != "' . AS_FORMAT_STRING . '")) {' . "\n" . '    if (!IsValidDate(dfrom, "' . AS_FORMAT_STRING_JS . '")) {' . "\n" . '      error_message = error_message + "* ' . ERROR_INVALID_FROM_DATE . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.dfrom;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if ((dto.length > 0) && (dto != "' . AS_FORMAT_STRING . '")) {' . "\n" . '    if (!IsValidDate(dto, "' . AS_FORMAT_STRING_JS . '")) {' . "\n" . '      error_message = error_message + "* ' . ERROR_INVALID_TO_DATE . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.dto;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if ((dfrom.length > 0) && (dfrom != "' . AS_FORMAT_STRING . '") && (IsValidDate(dfrom, "' . AS_FORMAT_STRING_JS . '")) && (dto.length > 0) && (dto != "' . AS_FORMAT_STRING . '") && (IsValidDate(dto, "' . AS_FORMAT_STRING_JS . '"))) {' . "\n" . '    if (IsValidDate(dfrom, "' . AS_FORMAT_STRING_JS . '", true) > IsValidDate(dto, "' . AS_FORMAT_STRING_JS . '", true)) {' . "\n" . '      error_message = error_message + "* ' . ERROR_TO_DATE_LESS_THAN_FROM_DATE . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.dto;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if (pfrom.length > 0) {' . "\n" . '    pfrom_float = parseFloat(pfrom);' . "\n" . '    if (isNaN(pfrom_float)) {' . "\n" . '      error_message = error_message + "* ' . ERROR_PRICE_FROM_MUST_BE_NUM . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.pfrom;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  } else {' . "\n" . '    pfrom_float = 0;' . "\n" . '  }' . "\n\n" . '  if (pto.length > 0) {' . "\n" . '    pto_float = parseFloat(pto);' . "\n" . '    if (isNaN(pto_float)) {' . "\n" . '      error_message = error_message + "* ' . ERROR_PRICE_TO_MUST_BE_NUM . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.pto;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  } else {' . "\n" . '    pto_float = 0;' . "\n" . '  }' . "\n\n" . '  if ( (pfrom.length > 0) && (pto.length > 0) ) {' . "\n" . '    if ( (!isNaN(pfrom_float)) && (!isNaN(pto_float)) && (pto_float <= pfrom_float) ) {' . "\n" . '      error_message = error_message + "* ' . ERROR_PRICE_TO_LESS_THAN_PRICE_FROM . '\\n";' . "\n" . '      error_field = document.advanced_search_and_results.pto;' . "\n" . '      error_found = true;' . "\n" . '    }' . "\n" . '  }' . "\n\n" . '  if (error_found == true) {' . "\n" . '    alert(error_message);' . "\n" . '    error_field.focus();' . "\n" . '    return false;' . "\n" . '  } else {' . "\n" . '    $( "#id_dfrom, #id_dto" ).datepicker( "destroy" );' . "\n" . '    RemoveFormatString(document.advanced_search_and_results.dfrom, "' . AS_FORMAT_STRING . '");' . "\n" . '    RemoveFormatString(document.advanced_search_and_results.dto, "' . AS_FORMAT_STRING . '");' . "\n" . '    $( "#id_dfrom, #id_dto" ).blur();' . "\n" . '    return true;' . "\n" . '  }' . "\n" . '}' . "\n" . '/* ]]> */' . "\n" . '</script> ' . "\n";
 require DIR_WS_INCLUDES . 'html_header.php';
 require DIR_WS_INCLUDES . 'boxes.php';
 require DIR_WS_INCLUDES . 'header.php';
 require DIR_WS_INCLUDES . 'footer.php';
 $search_in_description = $_GET['sid'];
 if ($messageStack->size('search') > 0) {
     $smarty->assign('message_stack', $messageStack->output('search'));
     $smarty->assign('message_stack_error', $messageStack->output('search', 'error'));
     $smarty->assign('message_stack_warning', $messageStack->output('search', 'warning'));
     $smarty->assign('message_stack_success', $messageStack->output('search', 'success'));
 }
 $popup_status_query = xos_db_query("select status from " . TABLE_CONTENTS . "  where type = 'system_popup' and status = '1' and content_id = '9' LIMIT 1");
 $smarty->assign(array('form_begin' => xos_draw_form('advanced_search_and_results', xos_href_link(FILENAME_ADVANCED_SEARCH_AND_RESULTS, '', 'NONSSL', false), 'post', 'onsubmit="return check_form(this);"'), 'hide_session_id' => xos_hide_session_id(), 'input_field_keywords' => xos_draw_input_field('keywords', stripslashes($_GET['keywords']), 'class="form-control" id="keywords"'), 'checkbox_search_in_description' => xos_draw_checkbox_field('sid', '1', $action && !isset($_GET['sid']) ? false : true, 'id="search_in_description"'), 'link_filename_advanced_search_and_results' => xos_href_link(FILENAME_ADVANCED_SEARCH_AND_RESULTS), 'link_filename_popup_content_9' => xos_db_num_rows($popup_status_query) ? xos_href_link(FILENAME_POPUP_CONTENT, 'co=9', $request_type) : '', 'categories_pull_down_menu' => xos_draw_pull_down_menu('copid', $categories_array, $_GET['copid'], 'class="form-control" id="categories_or_pages_id" onchange="UpdateManufacturers();"'), 'manufacturers_pull_down_menu' => xos_draw_pull_down_menu('_m', xos_get_manufacturers(array(array('id' => '', 'text' => TEXT_ALL_MANUFACTURERS))), $_GET['_m'], 'class="form-control" id="manufacturers_id"'), 'input_field_pfrom' => xos_draw_input_field('pfrom', $_GET['pfrom'], 'class="form-control" id="pfrom"'), 'input_field_pto' => xos_draw_input_field('pto', $_GET['pto'], 'class="form-control" id="pto"'), 'input_field_dfrom' => xos_draw_input_field('dfrom', $_GET['dfrom'] ? $_GET['dfrom'] : AS_FORMAT_STRING, 'class="form-control" id="id_dfrom"'), 'input_field_dto' => xos_draw_input_field('dto', $_GET['dto'] ? $_GET['dto'] : AS_FORMAT_STRING, 'class="form-control" id="id_dto"'), 'body_tag_params' => 'onload="UpdateManufacturers();"', 'form_end' => '</form>'));
 ///////////////////////////////////////////////////////////
 if ($action && !$error) {
     is_numeric($_GET['mdsr']) && $_GET['mdsr'] >= 1 ? $_SESSION['mdsr'] = (int) $_GET['mdsr'] : '';
     if ($_GET['srv'] == 'list') {
         $_SESSION['srv'] = 'list';
     } elseif ($_GET['srv'] == 'grid') {
         $_SESSION['srv'] = 'grid';
     }
     if (PRODUCT_LISTS_FOR_SEARCH_RESULTS == 'B' && $_SESSION['srv'] != 'list' || $_SESSION['srv'] == 'grid') {
         $product_list_b = true;
         // create column list
         $define_list = array('PRODUCT_LIST_MODEL' => PRODUCT_LIST_B_MODEL, 'PRODUCT_LIST_NAME' => PRODUCT_LIST_B_NAME, 'PRODUCT_LIST_INFO' => PRODUCT_LIST_B_INFO, 'PRODUCT_LIST_PACKING_UNIT' => PRODUCT_LIST_B_PACKING_UNIT, 'PRODUCT_LIST_MANUFACTURER' => PRODUCT_LIST_B_MANUFACTURER, 'PRODUCT_LIST_PRICE' => PRODUCT_LIST_B_PRICE, 'PRODUCT_LIST_QUANTITY' => STOCK_CHECK == 'true' ? PRODUCT_LIST_B_QUANTITY : '', 'PRODUCT_LIST_WEIGHT' => PRODUCT_LIST_B_WEIGHT, 'PRODUCT_LIST_IMAGE' => PRODUCT_LIST_B_IMAGE, 'PRODUCT_LIST_BUY_NOW' => PRODUCT_LIST_B_BUY_NOW);
     } else {
         $product_list_b = false;
         // create column list

//              You should have received a copy of the GNU General Public License
//              along with XOS-Shop.  If not, see <http://www.gnu.org/licenses/>.
////////////////////////////////////////////////////////////////////////////////
require 'includes/application_top.php';
if (!(@(include DIR_FS_SMARTY . 'catalog/templates/' . SELECTED_TPL . '/php/' . FILENAME_OFFLINE) == 'overwrite_all')) {
    header('HTTP/1.1 503 Service Temporarily Unavailable');
    header('Status: 503 Service Temporarily Unavailable');
    $_SESSION['navigation']->remove_current_page();
    require DIR_FS_SMARTY . 'catalog/languages/' . $_SESSION['language'] . '/' . FILENAME_OFFLINE;
    $error = false;
    if (isset($_GET['action']) && $_GET['action'] == 'process') {
        $email_address = xos_db_prepare_input($_POST['email_address']);
        $password = xos_db_prepare_input($_POST['password']);
        // Check if email exists
        $check_admin_query = xos_db_query("select admin_id as login_id, admin_email_address as login_email_address, admin_password as login_password from " . TABLE_ADMIN . " where admin_email_address = '" . xos_db_input($email_address) . "'");
        if (!xos_db_num_rows($check_admin_query)) {
            $error = true;
        } else {
            $check_admin = xos_db_fetch_array($check_admin_query);
            // Check that password is good
            if (!xos_validate_password($password, $check_admin['login_password'])) {
                $error = true;
            } else {
                $_SESSION['access_allowed'] = true;
                xos_redirect(xos_href_link(FILENAME_DEFAULT), false);
            }
        }
    }
    if ($error == true) {
        unset($_SESSION['access_allowed']);
        $messageStack->add('offline', TEXT_OFFLINE_ERROR);

//------------------------------------------------------------------------------
// this file is based on:
//              osCommerce, Open Source E-Commerce Solutions
//              http://www.oscommerce.com
//              Copyright (c) 2003 osCommerce
//              filename: manufacturer_info.php
//
//              Released under the GNU General Public License
////////////////////////////////////////////////////////////////////////////////
if (!(@(include DIR_FS_SMARTY . 'catalog/templates/' . SELECTED_TPL . '/php/includes/boxes/manufacturer_info.php') == 'overwrite_all')) {
    if (CACHE_LEVEL > 2 && (isset($_COOKIE[session_name()]) && !isset($_GET[session_name()]) || SESSION_FORCE_COOKIE_USE == 'true')) {
        $smarty->caching = 1;
        $cache_id = 'L3|box_manufacturer_info|' . $_SESSION['language'] . '-' . $_GET['lnc'] . '-' . $_GET[session_name()] . '-' . $session_started . '-' . SELECTED_TPL . '-' . $_SESSION['currency'] . '-' . $_GET['p'];
    }
    if (!$smarty->isCached(SELECTED_TPL . '/includes/boxes/manufacturers_info.tpl', $cache_id)) {
        $manufacturer_query = xos_db_query("select m.manufacturers_id, m.manufacturers_image, mi.manufacturers_name, mi.manufacturers_url from " . TABLE_MANUFACTURERS . " m left join " . TABLE_MANUFACTURERS_INFO . " mi on (m.manufacturers_id = mi.manufacturers_id and mi.languages_id = '" . (int) $_SESSION['languages_id'] . "'), " . TABLE_PRODUCTS . " p  where p.products_id = '" . (int) $_GET['p'] . "' and p.manufacturers_id = m.manufacturers_id");
        if (xos_db_num_rows($manufacturer_query)) {
            $manufacturer = xos_db_fetch_array($manufacturer_query);
            if (xos_not_null($manufacturer['manufacturers_image'])) {
                $smarty->assign('box_manufacturer_info_manufacturer_image', xos_image(DIR_WS_IMAGES . 'manufacturers/' . rawurlencode($manufacturer['manufacturers_image']), $manufacturer['manufacturers_name']));
            }
            if (xos_not_null($manufacturer['manufacturers_url'])) {
                $smarty->assign(array('box_manufacturer_info_link_to_the_manufacturer' => xos_href_link(FILENAME_REDIRECT, 'action=manufacturer&m=' . $manufacturer['manufacturers_id']), 'box_manufacturer_info_manufacturer_name' => $manufacturer['manufacturers_name']));
            }
            $smarty->assign(array('box_manufacturer_info_has_content' => true, 'box_manufacturer_info_link_filename_default' => xos_href_link(FILENAME_DEFAULT, 'm=' . $manufacturer['manufacturers_id'])));
        }
    }
    $output_manufacturer_info = $smarty->fetch(SELECTED_TPL . '/includes/boxes/manufacturers_info.tpl', $cache_id);
    $smarty->caching = 0;
    $smarty->assign('box_manufacturer_info', $output_manufacturer_info);
}

if (!(@(include DIR_FS_SMARTY . 'admin/templates/' . ADMIN_TPL . '/php/' . FILENAME_STATS_CUSTOMERS) == 'overwrite_all')) {
    require DIR_WS_CLASSES . 'currencies.php';
    $currencies = new currencies();
    $javascript = '<script type="text/javascript" src="' . DIR_WS_ADMIN . 'includes/general.js"></script>' . "\n";
    require DIR_WS_INCLUDES . 'html_header.php';
    require DIR_WS_INCLUDES . 'header.php';
    require DIR_WS_INCLUDES . 'column_left.php';
    require DIR_WS_INCLUDES . 'footer.php';
    if (isset($_GET['page']) && $_GET['page'] > 1) {
        $rows = $_GET['page'] * MAX_DISPLAY_RESULTS - MAX_DISPLAY_RESULTS;
    }
    $customers_query_raw = "select c.customers_firstname, c.customers_lastname, sum(ot.value / o.currency_value) as ordersum from " . TABLE_CUSTOMERS . " c, " . TABLE_ORDERS . " o left join " . TABLE_ORDERS_TOTAL . " ot on (o.orders_id = ot.orders_id) where c.customers_id = o.customers_id and ot.class = 'ot_total' group by c.customers_id order by ordersum DESC";
    $customers_split = new splitPageResults($_GET['page'], MAX_DISPLAY_RESULTS, $customers_query_raw, $customers_query_numrows, 'c.customers_id');
    // fix counted customers
    $customers_query_numrows = xos_db_query("select customers_id from " . TABLE_ORDERS . " group by customers_id");
    $customers_query_numrows = xos_db_num_rows($customers_query_numrows);
    $rows = 0;
    $customers_query = xos_db_query($customers_query_raw);
    $customers_array = array();
    while ($customers = xos_db_fetch_array($customers_query)) {
        $rows++;
        if (strlen($rows) < 2) {
            $rows = '0' . $rows;
        }
        $customers_array[] = array('link_filename_customers' => xos_href_link(FILENAME_CUSTOMERS, 'search=' . $customers['customers_lastname']), 'rows' => $rows, 'firstname' => $customers['customers_firstname'], 'lastname' => $customers['customers_lastname'], 'ordersum' => $currencies->format($customers['ordersum']));
    }
    $smarty->assign(array('customers' => $customers_array, 'nav_bar_number' => $customers_split->display_count($customers_query_numrows, MAX_DISPLAY_RESULTS, $_GET['page'], TEXT_DISPLAY_NUMBER_OF_CUSTOMERS), 'nav_bar_result' => $customers_split->display_links($customers_query_numrows, MAX_DISPLAY_RESULTS, MAX_DISPLAY_PAGE_LINKS, $_GET['page'])));
    $smarty->configLoad('languages/' . $_SESSION['language'] . '.conf', 'stats_customers');
    $output_stats_customers = $smarty->fetch(ADMIN_TPL . '/stats_customers.tpl');
    $smarty->assign('central_contents', $output_stats_customers);
    $smarty->display(ADMIN_TPL . '/frame.tpl');

         $new_country_id = LAST_COUNTRY_ID + 1;
         xos_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = '" . (int) $new_country_id . "', last_modified = now() where configuration_key = 'LAST_COUNTRY_ID'");
         xos_db_query("insert into " . TABLE_COUNTRIES . " (countries_id, countries_name, countries_iso_code_2, countries_iso_code_3, address_format_id) values ('" . (int) $new_country_id . "', '" . xos_db_input($countries_name) . "', '" . xos_db_input($countries_iso_code_2) . "', '" . xos_db_input($countries_iso_code_3) . "', '" . (int) $address_format_id . "')");
         $smarty_cache_control->clearAllCache();
         xos_redirect(xos_href_link(FILENAME_COUNTRIES, 'page=' . $_GET['page'] . '&cID=' . $new_country_id));
         break;
     case 'save':
         $countries_id = xos_db_prepare_input($_GET['cID']);
         $countries_name = xos_db_prepare_input($_POST['countries_name']);
         $actual_countries_name = xos_db_prepare_input($_POST['actual_countries_name']);
         $countries_iso_code_2 = xos_db_prepare_input($_POST['countries_iso_code_2']);
         $countries_iso_code_3 = xos_db_prepare_input($_POST['countries_iso_code_3']);
         $address_format_id = xos_db_prepare_input($_POST['address_format_id']);
         if (mb_strtolower($actual_countries_name) != mb_strtolower($countries_name)) {
             $check_query = xos_db_query("select countries_name from " . TABLE_COUNTRIES . " where countries_name = '" . xos_db_input($countries_name) . "'");
             if (xos_db_num_rows($check_query) || $countries_name == '') {
                 xos_redirect(xos_href_link(FILENAME_COUNTRIES, 'page=' . $_GET['page'] . '&cID=' . $_GET['cID'] . '&countries_name=' . $countries_name . '&countries_iso_code_2=' . $countries_iso_code_2 . '&countries_iso_code_3=' . $countries_iso_code_3 . '&address_format_id=' . $address_format_id . '&action=edit&error_name=' . $countries_name));
             }
         }
         xos_db_query("update " . TABLE_COUNTRIES . " set countries_name = '" . xos_db_input($countries_name) . "', countries_iso_code_2 = '" . xos_db_input($countries_iso_code_2) . "', countries_iso_code_3 = '" . xos_db_input($countries_iso_code_3) . "', address_format_id = '" . (int) $address_format_id . "' where countries_id = '" . (int) $countries_id . "'");
         $smarty_cache_control->clearAllCache();
         xos_redirect(xos_href_link(FILENAME_COUNTRIES, 'page=' . $_GET['page'] . '&cID=' . $_GET['cID']));
         break;
     case 'deleteconfirm':
         $countries_id = xos_db_prepare_input($_GET['cID']);
         xos_db_query("delete from " . TABLE_COUNTRIES . " where countries_id = '" . (int) $countries_id . "'");
         xos_db_query("delete from " . TABLE_ZONES . " where zone_country_id = '" . (int) $countries_id . "'");
         $smarty_cache_control->clearAllCache();
         xos_redirect(xos_href_link(FILENAME_COUNTRIES, 'page=' . $_GET['page']));
         break;
 }

     $messageStack->add('checkout_address', ENTRY_POST_CODE_ERROR);
     $smarty->assign('post_code_error', true);
 }
 if (strlen($city) < ENTRY_CITY_MIN_LENGTH) {
     $error = true;
     $messageStack->add('checkout_address', ENTRY_CITY_ERROR);
     $smarty->assign('city_error', true);
 }
 if (ACCOUNT_STATE == 'true') {
     $zone_id = 0;
     $check_query = xos_db_query("select count(*) as total from " . TABLE_ZONES . " where zone_country_id = '" . (int) $country . "'");
     $check = xos_db_fetch_array($check_query);
     $entry_state_has_zones = $check['total'] > 0;
     if ($entry_state_has_zones == true) {
         $zone_query = xos_db_query("select distinct zone_id from " . TABLE_ZONES . " where zone_country_id = '" . (int) $country . "' and zone_name = '" . xos_db_input($state) . "'");
         if (xos_db_num_rows($zone_query) == 1) {
             $zone = xos_db_fetch_array($zone_query);
             $zone_id = $zone['zone_id'];
         } else {
             $error = true;
             $messageStack->add('checkout_address', ENTRY_STATE_ERROR_SELECT);
             $smarty->assign('state_error', true);
         }
     } else {
         if (strlen($state) < ENTRY_STATE_MIN_LENGTH) {
             $error = true;
             $messageStack->add('checkout_address', ENTRY_STATE_ERROR);
             $smarty->assign('state_error', true);
         }
     }
 }