function __construct(&$current_page_number, $max_rows_per_page, &$sql_query, &$query_num_rows, $count_key = '*')
 {
     $current_page_number = empty($current_page_number) || $current_page_number < 1 ? 1 : (int) $current_page_number;
     $pos_to = strlen($sql_query);
     $pos_from = strpos($sql_query, ' from', 0);
     $pos_group_by = strpos($sql_query, ' group by', $pos_from);
     if ($pos_group_by < $pos_to && $pos_group_by != false) {
         $pos_to = $pos_group_by;
     }
     $pos_having = strpos($sql_query, ' having', $pos_from);
     if ($pos_having < $pos_to && $pos_having != false) {
         $pos_to = $pos_having;
     }
     $pos_order_by = strpos($sql_query, ' order by', $pos_from);
     if ($pos_order_by < $pos_to && $pos_order_by != false) {
         $pos_to = $pos_order_by;
     }
     if (strpos($sql_query, 'distinct') || strpos($sql_query, 'group by')) {
         $count_string = 'distinct ' . xos_db_input($count_key);
     } else {
         $count_string = xos_db_input($count_key);
     }
     $reviews_count_query = xos_db_query("select count(" . $count_string . ") as total " . substr($sql_query, $pos_from, $pos_to - $pos_from));
     $reviews_count = xos_db_fetch_array($reviews_count_query);
     $query_num_rows = $reviews_count['total'];
     $num_pages = ceil($query_num_rows / $max_rows_per_page);
     if ($current_page_number > $num_pages) {
         $current_page_number = $num_pages;
     }
     $offset = $max_rows_per_page * ($current_page_number - 1);
     $sql_query .= " limit " . max($offset, 0) . ", " . $max_rows_per_page;
 }

 function canPerform($user_id, $user_name)
 {
     $check_query = xos_db_query("select date_added from " . TABLE_ACTION_RECORDER . " where module = '" . xos_db_input($this->code) . "' and (" . (!empty($user_id) ? "user_id = '" . (int) $user_id . "' or " : "") . " identifier = '" . xos_db_input($this->identifier) . "') and date_added >= date_sub(now(), interval " . (int) $this->minutes . " minute) and success = 1 order by date_added desc limit 1");
     if (xos_db_num_rows($check_query)) {
         return false;
     } else {
         return true;
     }
 }

 function canPerform($user_id, $user_name)
 {
     $check_query = xos_db_query("select id from " . TABLE_ACTION_RECORDER . " where module = '" . xos_db_input($this->code) . "' and user_name = '" . xos_db_input($user_name) . "' and date_added >= date_sub(now(), interval " . (int) $this->minutes . " minute) and success = 1 order by date_added desc limit " . (int) $this->attempts);
     if (xos_db_num_rows($check_query) == $this->attempts) {
         return false;
     } else {
         return true;
     }
 }

 function __construct($query, $max_rows, $count_key = '*', $page_holder = 'page')
 {
     $this->sql_query = $query;
     $this->page_name = $page_holder;
     if (isset($_GET[$page_holder])) {
         $page = (int) $_GET[$page_holder];
     } elseif (isset($_POST[$page_holder])) {
         $page = (int) $_POST[$page_holder];
     } else {
         $page = 1;
     }
     if (empty($page) || $page < 1) {
         $page = 1;
     }
     $this->current_page_number = $page;
     $this->number_of_rows_per_page = $max_rows;
     $pos_to = strlen($this->sql_query);
     $pos_from = strpos($this->sql_query, ' from', 0);
     $pos_group_by = strpos($this->sql_query, ' group by', $pos_from);
     if ($pos_group_by < $pos_to && $pos_group_by != false) {
         $pos_to = $pos_group_by;
     }
     $pos_having = strpos($this->sql_query, ' having', $pos_from);
     if ($pos_having < $pos_to && $pos_having != false) {
         $pos_to = $pos_having;
     }
     $pos_order_by = strpos($this->sql_query, ' order by', $pos_from);
     if ($pos_order_by < $pos_to && $pos_order_by != false) {
         $pos_to = $pos_order_by;
     }
     if (strpos($this->sql_query, 'distinct') || strpos($this->sql_query, 'group by')) {
         $count_string = 'distinct ' . xos_db_input($count_key);
     } else {
         $count_string = xos_db_input($count_key);
     }
     $count_query = xos_db_query("select count(" . $count_string . ") as total " . substr($this->sql_query, $pos_from, $pos_to - $pos_from));
     $count = xos_db_fetch_array($count_query);
     $this->number_of_rows = $count['total'];
     $this->number_of_pages = ceil($this->number_of_rows / $this->number_of_rows_per_page);
     if ($this->current_page_number > $this->number_of_pages) {
         $this->current_page_number = $this->number_of_pages;
     }
     $offset = $this->number_of_rows_per_page * ($this->current_page_number - 1);
     $this->sql_query .= " limit " . max($offset, 0) . ", " . $this->number_of_rows_per_page;
 }

     $orders_history_query = xos_db_query("select orders_status_id, date_added, customer_notified, comments from " . TABLE_ORDERS_STATUS_HISTORY . " where orders_id = '" . xos_db_input($oID) . "' order by date_added, orders_status_history_id");
     if (xos_db_num_rows($orders_history_query)) {
         $orders_history_array = array();
         while ($orders_history = xos_db_fetch_array($orders_history_query)) {
             $customer_notified = false;
             if ($orders_history['customer_notified'] == '1') {
                 $customer_notified = true;
             }
             $orders_history_array[] = array('date_added' => xos_datetime_short($orders_history['date_added']), 'status' => $orders_status_array[$orders_history['orders_status_id']], 'comments' => nl2br(xos_db_output($orders_history['comments'])), 'customer_notified' => $customer_notified);
         }
         $smarty->assign('orders_history', $orders_history_array);
     } else {
     }
     $languages_query = xos_db_query("select name from " . TABLE_LANGUAGES . " where use_in_id > '1' and languages_id = '" . $order->info['language_id'] . "'");
     if (!xos_db_num_rows($languages_query)) {
         $lang_query = xos_db_query("select name from " . TABLE_LANGUAGES . " where code = '" . xos_db_input(DEFAULT_LANGUAGE) . "'");
         $languages = xos_db_fetch_array($lang_query);
     } else {
         $languages = xos_db_fetch_array($languages_query);
     }
     if (SEND_EMAILS == 'true') {
         $smarty->assign(array('send_emails' => true, 'checkbox_notify' => xos_draw_checkbox_field('notify', '', true), 'checkbox_notify_comments' => xos_draw_checkbox_field('notify_comments', '', true)));
     }
     if (sizeof($order->info['tax_groups']) > 1) {
         $smarty->assign('tax_groups', true);
     }
     $smarty->assign(array('order_id' => $oID, 'order_language_name' => $languages['name'], 'date_purchased' => xos_datetime_short($order->info['date_purchased']), 'customer_address' => xos_address_format($order->customer['format_id'], $order->customer, 1, '', '<br />'), 'delivery_address' => xos_address_format($order->delivery['format_id'], $order->delivery, 1, '', '<br />'), 'billing_address' => xos_address_format($order->billing['format_id'], $order->billing, 1, '', '<br />'), 'c_id' => $order->customer['c_id'], 'telephone_number' => $order->customer['telephone'], 'email_address' => $order->customer['email_address'], 'payment_method' => $order->info['payment_method'], 'order_products' => $order_products_array, 'order_totals' => $order_totals_array, 'form_begin_status' => xos_draw_form('new_status', FILENAME_ORDERS, xos_get_all_get_params(array('action')) . 'action=update_order'), 'textarea_comments' => xos_draw_textarea_field('comments', '60', '5'), 'pull_down_status' => xos_draw_pull_down_menu('status', $orders_statuses, $order->info['orders_status']), 'form_end' => '</form>', 'link_filename_orders_invoice' => xos_href_link(FILENAME_ORDERS_INVOICE, 'oID=' . $_GET['oID']), 'link_filename_orders_packingslip' => xos_href_link(FILENAME_ORDERS_PACKINGSLIP, 'oID=' . $_GET['oID']), 'link_filename_orders' => xos_href_link(FILENAME_ORDERS, xos_get_all_get_params(array('action'))), 'edit' => true));
 } else {
     $orders_statuses = array();
     $orders_status_query = xos_db_query("select orders_status_id, orders_status_name from " . TABLE_ORDERS_STATUS . " where language_id = '" . (int) $_SESSION['used_lng_id'] . "'");
     while ($orders_status = xos_db_fetch_array($orders_status_query)) {

     $elements_comb = explode('|', $combinations['attributes_combinations']);
     for ($i = 0, $n = sizeof($elements_comb); $i < $n; $i++) {
         if (strpos($elements_comb[$i], $combinations['options_id'] . ',' . $combinations['options_values_id']) !== false) {
             $qty -= $attributes_quantity[$elements_comb[$i]] > 0 ? $attributes_quantity[$elements_comb[$i]] : 0;
             unset($attributes_quantity[$elements_comb[$i]]);
             unset($elements_comb[$i]);
         }
     }
     ksort($attributes_quantity);
     ksort($elements_comb);
     $comb_str = '';
     $comb_str = implode('|', $elements_comb);
     $qty < 1 || $comb_str == '' ? $qty = 0 : '';
     if ($comb_str != '') {
         $comb_str .= '|';
         xos_db_query("update " . TABLE_PRODUCTS . " set products_quantity = '" . (int) $qty . "', products_last_modified = now(), attributes_quantity = '" . xos_db_input(serialize($attributes_quantity)) . "', attributes_combinations = '" . xos_db_input($comb_str) . "', " . $not_updated . " where products_id = '" . (int) $products_id . "'");
     } else {
         xos_db_query("update " . TABLE_PRODUCTS . " set products_quantity = '" . (int) $qty . "', products_last_modified = now(), attributes_quantity = null, attributes_combinations = null, attributes_not_updated = null where products_id = '" . (int) $products_id . "'");
     }
     $smarty_cache_control->clearAllCache();
 }
 xos_db_query("delete from " . TABLE_PRODUCTS_ATTRIBUTES . " where products_attributes_id = '" . (int) $attribute_id . "'");
 // added for DOWNLOAD_ENABLED. Always try to remove attributes, even if downloads are no longer enabled
 xos_db_query("delete from " . TABLE_PRODUCTS_ATTRIBUTES_DOWNLOAD . " where products_attributes_id = '" . (int) $attribute_id . "'");
 if ($qty < 1 && STOCK_CHECK == 'true' && STOCK_ALLOW_CHECKOUT == 'false') {
     xos_db_query("update " . TABLE_PRODUCTS . " set products_status = '0' where products_id = '" . (int) $products_id . "'");
     $smarty_cache_control->clearAllCache();
 }
 $smarty_cache_control->clearCache(null, 'L3|cc_product_info');
 xos_redirect(xos_href_link(FILENAME_PRODUCTS_ATTRIBUTES, $parameter_string));
 break;

 if (isset($_GET['action']) && $_GET['action'] == 'process' && isset($_POST['formid']) && $_POST['formid'] == $_SESSION['sessiontoken']) {
     $rating = xos_db_prepare_input($_POST['rating']);
     $review = xos_db_prepare_input(substr(strip_tags($_POST['review']), 0, 1000));
     $error = false;
     if (strlen($review) < REVIEW_TEXT_MIN_LENGTH) {
         $error = true;
         $messageStack->add('review', JS_REVIEW_TEXT);
     }
     if ($rating < 1 || $rating > 5) {
         $error = true;
         $messageStack->add('review', JS_REVIEW_RATING);
     }
     if ($error == false) {
         xos_db_query("insert into " . TABLE_REVIEWS . " (products_id, customers_id, customers_name, reviews_rating, date_added) values ('" . (int) $_GET['p'] . "', '" . (int) $_SESSION['customer_id'] . "', '" . xos_db_input($customer['customers_firstname']) . ' ' . xos_db_input($customer['customers_lastname']) . "', '" . xos_db_input($rating) . "', now())");
         $insert_id = xos_db_insert_id();
         xos_db_query("insert into " . TABLE_REVIEWS_DESCRIPTION . " (reviews_id, languages_id, reviews_text) values ('" . (int) $insert_id . "', '" . (int) $_SESSION['languages_id'] . "', '" . xos_db_input($review) . "')");
         $smarty->clearCache(null, 'L3|cc_reviews');
         $smarty->clearCache(null, 'L3|cc_product_reviews');
         xos_redirect(xos_href_link(FILENAME_PRODUCT_REVIEWS, xos_get_all_get_params(array('action', 'rmp')) . 'rmp=0'), false);
     }
 }
 require DIR_FS_SMARTY . 'catalog/languages/' . $_SESSION['language'] . '/' . FILENAME_PRODUCT_REVIEWS_WRITE;
 $site_trail->add(NAVBAR_TITLE, xos_href_link(FILENAME_PRODUCT_REVIEWS, xos_get_all_get_params()));
 $add_header = '<script type="text/javascript">' . "\n" . '/* <![CDATA[ */' . "\n" . 'function checkForm() {' . "\n" . '  var error = 0;' . "\n" . '  var error_message = "' . JS_ERROR . '";' . "\n\n" . '  var review = document.product_reviews_write.review.value;' . "\n\n" . '  if (review.length < ' . REVIEW_TEXT_MIN_LENGTH . ') {' . "\n" . '    error_message = error_message + "* ' . JS_REVIEW_TEXT . '\\n";' . "\n" . '    error = 1;' . "\n" . '  }' . "\n\n" . '  if ((document.product_reviews_write.rating[0].checked) || (document.product_reviews_write.rating[1].checked) || (document.product_reviews_write.rating[2].checked) || (document.product_reviews_write.rating[3].checked) || (document.product_reviews_write.rating[4].checked)) {' . "\n" . '  } else {' . "\n" . '    error_message = error_message + "* ' . JS_REVIEW_RATING . '\\n";' . "\n" . '    error = 1;' . "\n" . '  }' . "\n\n" . '  if (error == 1) {' . "\n" . '    alert(error_message);' . "\n" . '    return false;' . "\n" . '  } else {' . "\n" . '    return true;' . "\n" . '  }' . "\n" . '}' . "\n" . '/* ]]> */' . "\n" . '</script>' . "\n";
 require DIR_WS_INCLUDES . 'html_header.php';
 require DIR_WS_INCLUDES . 'boxes.php';
 require DIR_WS_INCLUDES . 'header.php';
 require DIR_WS_INCLUDES . 'footer.php';
 $products_prices = xos_get_product_prices($product_info['products_price']);
 $products_tax_rate = xos_get_tax_rate($product_info['products_tax_class_id']);
 $price_breaks_array = array();

//
//              You should have received a copy of the GNU General Public License
//              along with XOS-Shop.  If not, see <http://www.gnu.org/licenses/>.
////////////////////////////////////////////////////////////////////////////////
require 'includes/application_top.php';
if (!(@(include DIR_FS_SMARTY . 'catalog/templates/' . SELECTED_TPL . '/php/' . FILENAME_OFFLINE) == 'overwrite_all')) {
    header('HTTP/1.1 503 Service Temporarily Unavailable');
    header('Status: 503 Service Temporarily Unavailable');
    $_SESSION['navigation']->remove_current_page();
    require DIR_FS_SMARTY . 'catalog/languages/' . $_SESSION['language'] . '/' . FILENAME_OFFLINE;
    $error = false;
    if (isset($_GET['action']) && $_GET['action'] == 'process') {
        $email_address = xos_db_prepare_input($_POST['email_address']);
        $password = xos_db_prepare_input($_POST['password']);
        // Check if email exists
        $check_admin_query = xos_db_query("select admin_id as login_id, admin_email_address as login_email_address, admin_password as login_password from " . TABLE_ADMIN . " where admin_email_address = '" . xos_db_input($email_address) . "'");
        if (!xos_db_num_rows($check_admin_query)) {
            $error = true;
        } else {
            $check_admin = xos_db_fetch_array($check_admin_query);
            // Check that password is good
            if (!xos_validate_password($password, $check_admin['login_password'])) {
                $error = true;
            } else {
                $_SESSION['access_allowed'] = true;
                xos_redirect(xos_href_link(FILENAME_DEFAULT), false);
            }
        }
    }
    if ($error == true) {
        unset($_SESSION['access_allowed']);

 function send($newsletter_id)
 {
     global $messageStack;
     if (SEND_EMAILS != 'true') {
         $messageStack->add('news_email', ERROR_EMAIL_WAS_NOT_SENT, 'error');
         return false;
     }
     $audience = array();
     $ids = $_GET['customers_chosen'];
     $customers_query = xos_db_query("select c.customers_id, c.customers_firstname, c.customers_lastname, c.customers_email_address from " . TABLE_CUSTOMERS . " c where c.customers_id in (" . $ids . ")");
     while ($customers = xos_db_fetch_array($customers_query)) {
         $audience[$customers['customers_id']] = array('firstname' => $customers['customers_firstname'], 'lastname' => $customers['customers_lastname'], 'email_address' => $customers['customers_email_address']);
     }
     if (empty($this->language_directory)) {
         $lang_query = xos_db_query("select directory from " . TABLE_LANGUAGES . " where code = '" . xos_db_input(DEFAULT_LANGUAGE) . "'");
         $lang = xos_db_fetch_array($lang_query);
         $this->language_directory = $lang['directory'];
     }
     //Let's build a message object using the mailer class
     $email_to_customer = new mailer();
     $email_from_value = EMAIL_FROM;
     $from = html_entity_decode($email_from_value, ENT_QUOTES, 'UTF-8');
     $address = '';
     $name = '';
     $pieces = explode('<', $from);
     if (count($pieces) == 2) {
         $address = trim($pieces[1], " >");
         $name = trim($pieces[0]);
     } elseif (count($pieces) == 1) {
         $pos = stripos($pieces[0], '@');
         $address = $pos ? trim($pieces[0], " >") : '';
     }
     $email_to_customer->From = $address;
     $email_to_customer->FromName = $name;
     $email_to_customer->WordWrap = '100';
     $email_to_customer->Subject = $this->title;
     $smarty_product_notification = new Smarty();
     $smarty_product_notification->template_dir = DIR_FS_SMARTY . 'catalog/templates/';
     $smarty_product_notification->compile_dir = DIR_FS_SMARTY . 'catalog/templates_c/';
     $smarty_product_notification->config_dir = DIR_FS_SMARTY . 'catalog/';
     $smarty_product_notification->cache_dir = DIR_FS_SMARTY . 'catalog/cache/';
     $smarty_product_notification->left_delimiter = '[@{';
     $smarty_product_notification->right_delimiter = '}@]';
     $is_html = false;
     if ($this->content_text_htlm != '' && EMAIL_USE_HTML == 'true') {
         $is_html = true;
         $smarty_product_notification->assign(array('html_params' => HTML_PARAMS, 'xhtml_lang' => !empty($this->language_code) ? $this->language_code : DEFAULT_LANGUAGE, 'charset' => CHARSET, 'base_href' => substr(HTTP_SERVER, -1) == '/' ? HTTP_SERVER : '', 'content_text_htlm' => $this->content_text_htlm, 'content_text_plain' => $this->content_text_plain));
         $smarty_product_notification->configLoad('languages/' . $this->language_directory . '_email.conf', 'product_notification_email_html.tpl');
         $output_product_notification_email_html = $smarty_product_notification->fetch(DEFAULT_TPL . '/includes/email/product_notification_email_html.tpl');
         $smarty_product_notification->configLoad('languages/' . $this->language_directory . '_email.conf', 'product_notification_email_text.tpl');
         $output_product_notification_email_text = $smarty_product_notification->fetch(DEFAULT_TPL . '/includes/email/product_notification_email_text.tpl');
         $email_to_customer->isHTML(true);
     } else {
         $smarty_product_notification->assign('content_text_plain', $this->content_text_plain);
         $smarty_product_notification->configLoad('languages/' . $this->language_directory . '_email.conf', 'product_notification_email_text.tpl');
         $output_product_notification_email_text = $smarty_product_notification->fetch(DEFAULT_TPL . '/includes/email/product_notification_email_text.tpl');
         $email_to_customer->isHTML(false);
     }
     reset($audience);
     while (list($key, $value) = each($audience)) {
         if ($is_html) {
             $email_to_customer->Body = $output_product_notification_email_html;
             $email_to_customer->AltBody = html_entity_decode(strip_tags($output_product_notification_email_text), ENT_QUOTES, 'UTF-8');
         } else {
             $email_to_customer->Body = html_entity_decode(strip_tags($output_product_notification_email_text), ENT_QUOTES, 'UTF-8');
         }
         $email_to_customer->addAddress($value['email_address'], $value['firstname'] . ' ' . $value['lastname']);
         if (!$email_to_customer->send()) {
             $messageStack->add('news_email', sprintf(ERROR_PHP_MAILER, $email_to_customer->ErrorInfo, '&lt;' . $value['email_address'] . '&gt;'), 'error');
         } else {
             $messageStack->add('news_email', sprintf(NOTICE_EMAIL_SENT_TO, '&lt;' . $value['email_address'] . '&gt;'), 'success');
         }
         $email_to_customer->clearAddresses();
     }
     $newsletter_id = xos_db_prepare_input($newsletter_id);
     xos_db_query("update " . TABLE_NEWSLETTERS . " set date_sent = now(), status = '1', locked = '0' where newsletters_id = '" . xos_db_input($newsletter_id) . "'");
 }

 function send($newsletter_id)
 {
     global $messageStack;
     if (SEND_EMAILS != 'true') {
         $messageStack->add('news_email', ERROR_EMAIL_WAS_NOT_SENT, 'error');
         return false;
     }
     $ids = $_GET['customers_chosen'];
     $mail_query = xos_db_query("select s.subscriber_id, s.subscriber_email_address, s.subscriber_identity_code, c.customers_firstname, c.customers_lastname  from " . TABLE_NEWSLETTER_SUBSCRIBERS . " s left join " . TABLE_CUSTOMERS . " c on s.customers_id = c.customers_id where s.subscriber_id in (" . $ids . ") order by s.customers_id");
     if (empty($this->language_directory)) {
         $lang_query = xos_db_query("select directory from " . TABLE_LANGUAGES . " where code = '" . xos_db_input(DEFAULT_LANGUAGE) . "'");
         $lang = xos_db_fetch_array($lang_query);
         $this->language_directory = $lang['directory'];
     }
     //Let's build a message object using the mailer class
     $email_to_subscriber = new mailer();
     $email_from_value = EMAIL_FROM;
     $from = html_entity_decode($email_from_value, ENT_QUOTES, 'UTF-8');
     $address = '';
     $name = '';
     $pieces = explode('<', $from);
     if (count($pieces) == 2) {
         $address = trim($pieces[1], " >");
         $name = trim($pieces[0]);
     } elseif (count($pieces) == 1) {
         $pos = stripos($pieces[0], '@');
         $address = $pos ? trim($pieces[0], " >") : '';
     }
     $email_to_subscriber->From = $address;
     $email_to_subscriber->FromName = $name;
     $email_to_subscriber->WordWrap = '100';
     $email_to_subscriber->Subject = $this->title;
     $smarty_newsletter = new Smarty();
     $smarty_newsletter->template_dir = DIR_FS_SMARTY . 'catalog/templates/';
     $smarty_newsletter->compile_dir = DIR_FS_SMARTY . 'catalog/templates_c/';
     $smarty_newsletter->config_dir = DIR_FS_SMARTY . 'catalog/';
     $smarty_newsletter->cache_dir = DIR_FS_SMARTY . 'catalog/cache/';
     $smarty_newsletter->left_delimiter = '[@{';
     $smarty_newsletter->right_delimiter = '}@]';
     $is_html = false;
     if ($this->content_text_htlm != '' && EMAIL_USE_HTML == 'true') {
         $is_html = true;
         $smarty_newsletter->assign(array('nl' => "\n", 'html_params' => HTML_PARAMS, 'xhtml_lang' => !empty($this->language_code) ? $this->language_code : DEFAULT_LANGUAGE, 'charset' => CHARSET, 'base_href' => substr(HTTP_SERVER, -1) == '/' ? HTTP_SERVER : '', 'content_text_htlm' => $this->content_text_htlm, 'content_text_plain' => $this->content_text_plain));
         $smarty_newsletter->configLoad('languages/' . $this->language_directory . '_email.conf', 'newsletter_email_html');
         $output_newsletter_email_html = $smarty_newsletter->fetch(DEFAULT_TPL . '/includes/email/newsletter_email_html.tpl');
         $smarty_newsletter->configLoad('languages/' . $this->language_directory . '_email.conf', 'newsletter_email_text');
         $output_newsletter_email_text = $smarty_newsletter->fetch(DEFAULT_TPL . '/includes/email/newsletter_email_text.tpl');
         $email_to_subscriber->isHTML(true);
     } else {
         $smarty_newsletter->assign(array('nl' => "\n", 'content_text_plain' => $this->content_text_plain));
         $smarty_newsletter->configLoad('languages/' . $this->language_directory . '_email.conf', 'newsletter_email_text');
         $output_newsletter_email_text = $smarty_newsletter->fetch(DEFAULT_TPL . '/includes/email/newsletter_email_text.tpl');
         $email_to_subscriber->isHTML(false);
     }
     while ($mail = xos_db_fetch_array($mail_query)) {
         $link_unsubscribe = xos_catalog_href_link('newsletter_subscribe.php', 'action=unsubscribe&amp;identity_code=' . $mail['subscriber_identity_code'], 'SSL');
         if ($is_html) {
             $email_to_subscriber->Body = $output_newsletter_email_html . '<a href="' . $link_unsubscribe . '"  target="_blank">' . $link_unsubscribe . '</a>' . "\n" . '</div>' . "\n" . '</body>' . "\n" . '</html>' . "\n";
             $email_to_subscriber->AltBody = html_entity_decode(strip_tags($output_newsletter_email_text . $link_unsubscribe), ENT_QUOTES, 'UTF-8');
         } else {
             $email_to_subscriber->Body = html_entity_decode(strip_tags($output_newsletter_email_text . $link_unsubscribe), ENT_QUOTES, 'UTF-8');
         }
         $email_to_subscriber->addAddress($mail['subscriber_email_address'], $mail['customers_firstname'] . ' ' . $mail['customers_lastname']);
         if (!$email_to_subscriber->send()) {
             $messageStack->add('news_email', sprintf(ERROR_PHP_MAILER, $email_to_subscriber->ErrorInfo, '&lt;' . $mail['subscriber_email_address'] . '&gt;'), 'error');
         } else {
             $messageStack->add('news_email', sprintf(NOTICE_EMAIL_SENT_TO, '&lt;' . $mail['subscriber_email_address'] . '&gt;'), 'success');
         }
         $email_to_subscriber->clearAddresses();
     }
     $newsletter_id = xos_db_prepare_input($newsletter_id);
     xos_db_query("update " . TABLE_NEWSLETTERS . " set date_sent = now(), status = '1', locked = '0' where newsletters_id = '" . xos_db_input($newsletter_id) . "'");
 }

     $value = xos_db_prepare_input($_POST['value']);
     $languages = xos_get_languages();
     for ($i = 0, $n = sizeof($languages); $i < $n; $i++) {
         $language_id = $languages[$i]['id'];
         $sql_data_array = array('title' => xos_db_prepare_input(htmlspecialchars($title_array[$language_id])), 'code' => $code, 'symbol_left' => xos_db_prepare_input(htmlspecialchars($symbol_left_array[$language_id])), 'symbol_right' => xos_db_prepare_input(htmlspecialchars($symbol_right_array[$language_id])), 'decimal_point' => xos_db_prepare_input($decimal_point_array[$language_id]), 'thousands_point' => xos_db_prepare_input($thousands_point_array[$language_id]), 'decimal_places' => $decimal_places, 'value' => $value, 'last_updated' => 'now()');
         if ($action == 'insert') {
             $insert_sql_data = array('currencies_id' => (int) $currency_id, 'language_id' => (int) $language_id);
             $sql_data_array = array_merge($sql_data_array, $insert_sql_data);
             xos_db_perform(TABLE_CURRENCIES, $sql_data_array);
             $currency_id = xos_db_insert_id();
         } elseif ($action == 'save') {
             xos_db_perform(TABLE_CURRENCIES, $sql_data_array, 'update', "currencies_id = '" . (int) $currency_id . "' and language_id = '" . (int) $language_id . "'");
         }
     }
     if (isset($_POST['default']) && $_POST['default'] == 'on') {
         xos_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = '" . xos_db_input($code) . "' where configuration_key = 'DEFAULT_CURRENCY'");
     }
     $smarty_cache_control->clearAllCache();
     xos_redirect(xos_href_link(FILENAME_CURRENCIES, 'page=' . $_GET['page'] . '&cID=' . $currency_id));
     break;
 case 'deleteconfirm':
     $currencies_id = xos_db_prepare_input($_GET['cID']);
     $currency_query = xos_db_query("select currencies_id from " . TABLE_CURRENCIES . " where code = '" . DEFAULT_CURRENCY . "'");
     $currency = xos_db_fetch_array($currency_query);
     if ($currency['currencies_id'] == $currencies_id) {
         xos_db_query("update " . TABLE_CONFIGURATION . " set configuration_value = '' where configuration_key = 'DEFAULT_CURRENCY'");
     }
     xos_db_query("delete from " . TABLE_CURRENCIES . " where currencies_id = '" . (int) $currencies_id . "'");
     $smarty_cache_control->clearAllCache();
     xos_redirect(xos_href_link(FILENAME_CURRENCIES, 'page=' . $_GET['page']));
     break;

 }
 if (isset($search_keywords) && sizeof($search_keywords) > 0) {
     $where_str .= " and (";
     for ($i = 0, $n = sizeof($search_keywords); $i < $n; $i++) {
         switch ($search_keywords[$i]) {
             case '(':
             case ')':
             case 'and':
             case 'or':
                 $where_str .= " " . $search_keywords[$i] . " ";
                 break;
             default:
                 $keyword = xos_db_prepare_input($search_keywords[$i]);
                 $where_str .= "(pd.products_name like '%" . xos_db_input($keyword) . "%' or p.products_model like '%" . xos_db_input($keyword) . "%' or mi.manufacturers_name like '%" . xos_db_input($keyword) . "%'";
                 if (isset($_GET['sid']) && $_GET['sid'] == '1') {
                     $where_str .= " or pd.products_description like '%" . xos_db_input($keyword) . "%' or pd.products_info like '%" . xos_db_input($keyword) . "%'";
                 }
                 $where_str .= ')';
                 break;
         }
     }
     $where_str .= " )";
 }
 if (xos_not_null($dfrom)) {
     $where_str .= " and p.products_date_added >= '" . xos_date_raw($dfrom) . "'";
 }
 if (xos_not_null($dto)) {
     $where_str .= " and p.products_date_added <= '" . xos_date_raw($dto) . "'";
 }
 if ($currencies->is_set($_SESSION['currency'])) {
     $rate = $currencies->get_value($_SESSION['currency']);

         }
         
         'input_coupon_startdate' => xos_draw_date_selector('coupon_startdate', mktime(0,0,0, $coupon_startdate[1], $coupon_startdate[2], $coupon_startdate[0])),
         'input_coupon_finishdate' => xos_draw_date_selector('coupon_finishdate', mktime(0,0,0, $coupon_finishdate[1], $coupon_finishdate[2], $coupon_finishdate[0])),        
     */
     $languages = xos_get_languages();
     $coupon_content_array = array();
     for ($i = 0, $n = sizeof($languages); $i < $n; $i++) {
         $language_id = $languages[$i]['id'];
         $coupon_content_array[] = array('languages_image' => xos_image(DIR_WS_CATALOG_IMAGES . 'catalog/templates/' . DEFAULT_TPL . '/' . $languages[$i]['directory'] . '/' . $languages[$i]['image'], $languages[$i]['name']), 'input_coupon_name' => xos_draw_input_field('coupon_name[' . $languages[$i]['id'] . ']', $coupon_name[$language_id]), 'textarea_coupon_desc' => xos_draw_textarea_field('coupon_desc[' . $languages[$i]['id'] . ']', '24', '3', $coupon_desc[$language_id]));
     }
     $smarty->assign(array('new' => true, 'form_begin' => xos_draw_form('coupon', FILENAME_COUPON_ADMIN, 'action=update&oldaction=' . ($oldaction == 'voucheredit' ? $oldaction : $action) . '&cid=' . $_GET['cid'], 'post', 'enctype="multipart/form-data"'), 'radio_coupon_status_Y' => xos_draw_radio_field('coupon_status', 'Y', $in_status), 'radio_coupon_status_N' => xos_draw_radio_field('coupon_status', 'N', $out_status), 'input_coupon_amount' => xos_draw_input_field('coupon_amount', $coupon_amount), 'input_coupon_min_order' => xos_draw_input_field('coupon_min_order', $coupon_min_order), 'checkbox_coupon_free_ship' => xos_draw_checkbox_field('coupon_free_ship', $coupon_free_ship), 'input_coupon_code' => xos_draw_input_field('coupon_code', $coupon_code), 'input_coupon_uses_coupon' => xos_draw_input_field('coupon_uses_coupon', $coupon_uses_coupon), 'input_coupon_uses_user' => xos_draw_input_field('coupon_uses_user', $coupon_uses_user), 'input_coupon_products' => xos_draw_input_field('coupon_products', $coupon_products), 'input_coupon_categories' => xos_draw_input_field('coupon_categories', $coupon_categories), 'input_coupon_startdate' => xos_draw_input_field('coupon_startdate', xos_date_format(DATE_FORMAT_SHORT), 'id="coupon_startdate" style="background: #ffffcc;" size ="10"'), 'input_coupon_finishdate' => xos_draw_input_field('coupon_finishdate', xos_date_format(DATE_FORMAT_SHORT, mktime(0, 0, 0, date("m"), date("d"), date("Y") + 1)), 'id="coupon_finishdate" style="background: #ffffcc;" size ="10"'), 'link_filename_coupon_admin' => xos_href_link(FILENAME_COUPON_ADMIN), 'hidden_field_date_created' => xos_draw_hidden_field('date_created', $date_created), 'coupon_content' => $coupon_content_array, 'form_end' => '</form>'));
     break;
 default:
     if ($_GET['status'] == 'Y' || $_GET['status'] == 'N') {
         $cc_query_raw = "select coupon_active, coupon_id, coupon_code, coupon_amount, coupon_minimum_order, coupon_type, coupon_start_date,coupon_expire_date,uses_per_user,uses_per_coupon,restrict_to_products, restrict_to_categories, date_created,date_modified from " . TABLE_COUPONS . " where coupon_active='" . xos_db_input($_GET['status']) . "' and coupon_type != 'G'";
     } else {
         $cc_query_raw = "select coupon_active, coupon_id, coupon_code, coupon_amount, coupon_minimum_order, coupon_type, coupon_start_date,coupon_expire_date,uses_per_user,uses_per_coupon,restrict_to_products, restrict_to_categories, date_created,date_modified from " . TABLE_COUPONS . " where coupon_type != 'G'";
     }
     $cc_split = new splitPageResults($_GET['page'], MAX_DISPLAY_RESULTS, $cc_query_raw, $cc_query_numrows);
     $cc_query = xos_db_query($cc_query_raw);
     $cc_list_array = array();
     while ($cc_list = xos_db_fetch_array($cc_query)) {
         $redeem_query = xos_db_query("select redeem_date from " . TABLE_COUPON_REDEEM_TRACK . " where coupon_id = '" . $cc_list['coupon_id'] . "'");
         if ($_GET['status'] == 'R' && xos_db_num_rows($redeem_query) == 0) {
             continue;
         }
         if ((!$_GET['cid'] || @$_GET['cid'] == $cc_list['coupon_id']) && !$cInfo) {
             $cInfo = new objectInfo($cc_list);
         }
         $selected = false;

             xos_db_query("insert into " . TABLE_MANUFACTURERS_INFO . " (manufacturers_id, languages_id, manufacturers_name, manufacturers_url) values ('" . $manufacturers['manufacturers_id'] . "', '" . (int) $lID . "', '" . xos_db_input($manufacturers['manufacturers_name']) . "', '" . xos_db_input($manufacturers['manufacturers_url']) . "')");
         }
         // create additional orders_status records
         $orders_status_query = xos_db_query("select orders_status_id, orders_status_name, orders_status_code, public_flag, downloads_flag from " . TABLE_ORDERS_STATUS . " where language_id = '" . (int) $default_language_id['languages_id'] . "'");
         while ($orders_status = xos_db_fetch_array($orders_status_query)) {
             xos_db_query("insert into " . TABLE_ORDERS_STATUS . " (orders_status_id, language_id, orders_status_name, orders_status_code, public_flag, downloads_flag) values ('" . (int) $orders_status['orders_status_id'] . "', '" . (int) $lID . "', '" . xos_db_input($orders_status['orders_status_name']) . "', '" . xos_db_input($orders_status['orders_status_code']) . "', '" . (int) $orders_status['public_flag'] . "', '" . (int) $orders_status['downloads_flag'] . "')");
         }
         // create additional tax_rates_description records
         $tax_rates_query = xos_db_query("select tr.tax_rates_id, trd.tax_description from " . TABLE_TAX_RATES . " tr left join " . TABLE_TAX_RATES_DESCRIPTION . " trd on tr.tax_rates_id = trd.tax_rates_id where trd.language_id = '" . (int) $default_language_id['languages_id'] . "'");
         while ($tax_rates = xos_db_fetch_array($tax_rates_query)) {
             xos_db_query("insert into " . TABLE_TAX_RATES_DESCRIPTION . " (tax_rates_id, language_id, tax_description) values ('" . (int) $tax_rates['tax_rates_id'] . "', '" . (int) $lID . "', '" . xos_db_input($tax_rates['tax_description']) . "')");
         }
         // create additional currencies records
         $currencies_query = xos_db_query("select currencies_id, title, code, symbol_left, symbol_right, decimal_point, thousands_point, decimal_places, value, last_updated from " . TABLE_CURRENCIES . " where language_id = '" . (int) $default_language_id['languages_id'] . "'");
         while ($currencies = xos_db_fetch_array($currencies_query)) {
             xos_db_query("insert into " . TABLE_CURRENCIES . " (currencies_id, language_id, title, code, symbol_left, symbol_right, decimal_point, thousands_point, decimal_places, value, last_updated) values ('" . (int) $currencies['currencies_id'] . "', '" . (int) $lID . "', '" . xos_db_input($currencies['title']) . "', '" . xos_db_input($currencies['code']) . "', '" . xos_db_input($currencies['symbol_left']) . "', '" . xos_db_input($currencies['symbol_right']) . "', '" . xos_db_input($currencies['decimal_point']) . "', '" . xos_db_input($currencies['thousands_point']) . "', '" . (int) $currencies['decimal_places'] . "', '" . xos_db_input($currencies['value']) . "', '" . xos_db_input($currencies['last_updated']) . "')");
         }
     }
     if ($_SESSION['languages_id'] == (int) $lID && $use_in_id < '3') {
         unset($_SESSION['language']);
     }
     $smarty_cache_control->clearAllCache();
     xos_redirect(xos_href_link(FILENAME_LANGUAGES, 'page=' . $_GET['page'] . '&lID=' . $_GET['lID']));
     break;
 case 'deleteconfirm':
     $lID = xos_db_prepare_input($_GET['lID']);
     xos_db_query("delete from " . TABLE_BANNERS_CONTENT . " where language_id = '" . (int) $lID . "'");
     xos_db_query("delete from " . TABLE_CATEGORIES_OR_PAGES_DATA . " where language_id = '" . (int) $lID . "'");
     xos_db_query("delete from " . TABLE_CONTENTS_DATA . " where language_id = '" . (int) $lID . "'");
     xos_db_query("delete from " . TABLE_PRODUCTS_DESCRIPTION . " where language_id = '" . (int) $lID . "'");
     xos_db_query("delete from " . TABLE_PRODUCTS_OPTIONS . " where language_id = '" . (int) $lID . "'");

 $from_str = "from " . TABLE_PRODUCTS . " p left join " . TABLE_MANUFACTURERS_INFO . " mi on (p.manufacturers_id = mi.manufacturers_id and mi.languages_id = '" . (int) $_SESSION['languages_id'] . "') left join " . TABLE_PRODUCTS_PRICES . " ppz on p.products_id = ppz.products_id and ppz.customers_group_id = '0' left join " . TABLE_PRODUCTS_PRICES . " pp on p.products_id = pp.products_id and pp.customers_group_id = '" . $customer_group_id . "' left join " . TABLE_SPECIALS . " s on p.products_id = s.products_id and s.customers_group_id = '" . $customer_group_id . "'";
 $from_str .= ", " . TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_CATEGORIES_OR_PAGES . " c, " . TABLE_PRODUCTS_TO_CATEGORIES . " p2c";
 $where_str = " where p.products_status = '1' and c.categories_or_pages_status = '1' and p.products_id = pd.products_id and pd.language_id = '" . (int) $_SESSION['languages_id'] . "' and p.products_id = p2c.products_id and p2c.categories_or_pages_id = c.categories_or_pages_id ";
 if (isset($search_keywords) && sizeof($search_keywords) > 0) {
     $where_str .= " and (";
     for ($i = 0, $n = sizeof($search_keywords); $i < $n; $i++) {
         switch ($search_keywords[$i]) {
             case '(':
             case ')':
             case 'and':
             case 'or':
                 $where_str .= " " . $search_keywords[$i] . " ";
                 break;
             default:
                 $keyword = xos_db_prepare_input($search_keywords[$i]);
                 $where_str .= "(pd.products_name like '%" . xos_db_input($keyword) . "%' or p.products_model like '%" . xos_db_input($keyword) . "%' or mi.manufacturers_name like '%" . xos_db_input($keyword) . "%'";
                 $where_str .= ')';
                 break;
         }
     }
     $where_str .= " )";
 }
 if (empty($_GET['sort']) || !preg_match('/^[0-9][ad]$/', $_GET['sort']) || substr($_GET['sort'], 0, 1) > sizeof($column_list)) {
     for ($i = 0, $n = sizeof($column_list); $i < $n; $i++) {
         if ($column_list[$i] == 'PRODUCT_LIST_NAME') {
             $_GET['sort'] = $i . 'a';
             $order_str = ' order by pd.products_name';
             break;
         }
     }
 } else {