function verifyparam_groupid($paramid)
{
    global $settings, $errors;
    $groupid = "";
    if ($settings['enablegroups'] == '1') {
        $groupid = verifyparam($paramid, "/^\\d{0,10}\$/", "");
        if ($groupid) {
            $group = group_by_id($groupid);
            if (!$group) {
                $errors[] = getlocal("page.group.no_such");
                $groupid = "";
            }
        }
    }
    return $groupid;
}

function prepare_pagination($items_count, $default_items_per_page = 15)
{
    global $page;
    if ($items_count) {
        $items_per_page = verifyparam("items", "/^\\d{1,3}\$/", $default_items_per_page);
        if ($items_per_page < 2) {
            $items_per_page = 2;
        }
        $total_pages = div($items_count + $items_per_page - 1, $items_per_page);
        $curr_page = verifyparam("page", "/^\\d{1,6}\$/", 1);
        if ($curr_page < 1) {
            $curr_page = 1;
        }
        if ($curr_page > $total_pages) {
            $curr_page = $total_pages;
        }
        $start_index = ($curr_page - 1) * $items_per_page;
        $end_index = min($start_index + $items_per_page, $items_count);
        $page['pagination'] = array("page" => $curr_page, "items" => $items_per_page, "total" => $total_pages, "count" => $items_count, "start" => $start_index, "end" => $end_index, "limit" => "LIMIT {$start_index}," . ($end_index - $start_index));
    } else {
        $page['pagination'] = true;
    }
}

    global $mibew_encoding;
    echo "<operators>";
    $operators = operator_get_all();
    foreach ($operators as $operator) {
        if (!operator_is_online($operator)) {
            continue;
        }
        $name = myiconv($mibew_encoding, "utf-8", safe_htmlspecialchars(safe_htmlspecialchars($operator['vclocalename'])));
        $away = operator_is_away($operator) ? " away=\"1\"" : "";
        echo "<operator name=\"{$name}\"{$away}/>";
    }
    echo "</operators>";
}
$since = verifyparam("since", "/^\\d{1,10}\$/", 0);
$status = verifyparam("status", "/^\\d{1,2}\$/", 0);
$showonline = verifyparam("showonline", "/^1\$/", 0);
$link = connect();
loadsettings_($link);
if (!isset($_SESSION["{$mysqlprefix}operatorgroups"])) {
    $_SESSION["{$mysqlprefix}operatorgroups"] = get_operator_groupslist($operator['operatorid'], $link);
}
close_old_threads($link);
mysql_close($link);
$groupids = $_SESSION["{$mysqlprefix}operatorgroups"];
start_xml_output();
echo '<update>';
if ($showonline) {
    print_operators();
}
print_pending_threads($groupids, $since);
echo '</update>';

            }
            header("Location: {$webimroot}/operator/operator.php?op={$opId}&stored");
            exit;
        }
    } else {
        $page['formlogin'] = topage($login);
        $page['formname'] = topage($localname);
        $page['formemail'] = topage($email);
        $page['formjabber'] = topage($jabber);
        $page['formjabbernotify'] = $jabbernotify;
        $page['formcommonname'] = topage($commonname);
        $page['opid'] = topage($opId);
    }
} else {
    if (isset($_GET['op'])) {
        $opId = verifyparam('op', "/^\\d{1,9}\$/");
        $op = operator_by_id($opId);
        if (!$op) {
            $errors[] = getlocal("no_such_operator");
            $page['opid'] = topage($opId);
        } else {
            $page['formlogin'] = topage($op['vclogin']);
            $page['formname'] = topage($op['vclocalename']);
            $page['formemail'] = topage($op['vcemail']);
            $page['formjabber'] = topage($op['vcjabbername']);
            $page['formjabbernotify'] = $op['inotify'] != 0;
            $page['formcommonname'] = topage($op['vccommonname']);
            $page['opid'] = topage($op['operatorid']);
        }
    }
}

loadsettings();
$stringid = verifyparam("key", "/^\\d{0,10}\$/", "");
$errors = array();
$page = array();
if ($stringid) {
    $message = load_message($stringid);
    if (!$message) {
        $errors[] = getlocal("cannededit.no_such");
        $stringid = "";
    }
} else {
    $message = "";
    $page['locale'] = verifyparam("lang", "/^[\\w-]{2,5}\$/", "");
    $page['groupid'] = "";
    if ($settings['enablegroups'] == '1') {
        $page['groupid'] = verifyparam("group", "/^\\d{0,10}\$/");
    }
}
if (isset($_POST['message'])) {
    $message = getparam('message');
    if (!$message) {
        $errors[] = no_field("form.field.message");
    }
    if (count($errors) == 0) {
        if ($stringid) {
            save_message($stringid, $message);
        } else {
            add_message($page['locale'], $page['groupid'], $message);
        }
        $page['saved'] = true;
        prepare_menu($operator, false);

 * the provisions of the GPL are applicable instead of those above. If you wish
 * to allow use of your version of this file only under the terms of the GPL, and
 * not to allow others to use your version of this file under the terms of the
 * EPL, indicate your decision by deleting the provisions above and replace them
 * with the notice and other provisions required by the GPL.
 * 
 * Contributors:
 *    Evgeny Gryaznov - initial API and implementation
 */
require_once '../libs/common.php';
require_once '../libs/operator.php';
require_once '../libs/settings.php';
$errors = array();
$page = array('version' => $version, 'showform' => true);
$opId = verifyparam("id", "/^\\d{1,9}\$/");
$token = verifyparam("token", "/^[\\dabcdef]+\$/");
$operator = operator_by_id($opId);
if (!$operator) {
    $errors[] = "No such operator";
    $page['showform'] = false;
} else {
    if ($token != $operator['vcrestoretoken']) {
        $errors[] = "Wrong token";
        $page['showform'] = false;
    }
}
if (count($errors) == 0 && isset($_POST['password'])) {
    $password = getparam('password');
    $passwordConfirm = getparam('passwordConfirm');
    if (!$password) {
        $errors[] = no_field("form.field.password");

 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once '../libs/common.php';
require_once '../libs/operator.php';
require_once 'dbinfo.php';
function runsql($query, $link)
{
    $res = mysql_query($query, $link) or show_install_err(' Query failed: ' . mysql_error($link));
    return $res;
}
$act = verifyparam("act", "/^(silentcreateall|createdb|ct|dt|addcolumns)\$/");
$link = @mysql_connect($mysqlhost, $mysqllogin, $mysqlpass) or show_install_err('Could not connect: ' . mysql_error());
if ($act == "silentcreateall") {
    mysql_query("CREATE DATABASE {$mysqldb}", $link) or show_install_err(' Query failed: ' . mysql_error($link));
    foreach ($dbtables as $id) {
        create_table($id, $link);
    }
} else {
    if ($act == "createdb") {
        mysql_query("CREATE DATABASE {$mysqldb}", $link) or show_install_err(' Query failed: ' . mysql_error($link));
    } else {
        mysql_select_db($mysqldb, $link) or show_install_err('Could not select database');
        if ($force_charset_in_connection) {
            mysql_query("SET character set {$dbencoding}", $link);
        }
        if ($act == "ct") {

 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once '../libs/common.php';
require_once '../libs/operator.php';
require_once '../libs/chat.php';
$operator = check_login();
$page = array();
setlocale(LC_TIME, getstring("time.locale"));
function notification_info($id)
{
    global $mysqlprefix;
    $link = connect();
    $notification = select_one_row(db_build_select("id, locale, vckind, vcto, unix_timestamp(dtmcreated) as created, vcsubject, tmessage, refoperator", "{$mysqlprefix}chatnotification", array("id = {$id}"), ""), $link);
    mysql_close($link);
    return $notification;
}
$notificationid = verifyparam("id", "/^(\\d{1,9})\$/");
$page['notification'] = notification_info($notificationid);
prepare_menu($operator, false);
start_html_output();
require '../view/notification.php';

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once '../libs/common.php';
require_once '../libs/operator.php';
require_once '../libs/chat.php';
require_once '../libs/userinfo.php';
require_once '../libs/pagination.php';
$operator = check_login();
loadsettings();
$page = array();
setlocale(LC_TIME, getstring("time.locale"));
$userid = "";
if (isset($_GET['userid'])) {
    $userid = verifyparam("userid", "/^.{0,63}\$/", "");
}
function threads_by_userid($userid)
{
    global $mysqlprefix;
    if ($userid == "") {
        return null;
    }
    $link = connect();
    $query = sprintf("select unix_timestamp(dtmcreated) as created, unix_timestamp(dtmmodified) as modified, " . " threadid, remote, agentName, userName " . "from {$mysqlprefix}chatthread " . "where userid=\"{$userid}\" order by created DESC", $userid);
    $result = mysql_query($query, $link) or die(' Query failed: ' . mysql_error($link));
    $foundThreads = array();
    while ($thread = mysql_fetch_array($result, MYSQL_ASSOC)) {
        $foundThreads[] = $thread;
    }
    mysql_free_result($result);

} else {
    if (isset($_GET['id'])) {
        $banId = verifyparam('id', "/^\\d{1,10}\$/");
        $link = connect();
        $ban = select_one_row("select banid,(unix_timestamp(dtmtill)-unix_timestamp(CURRENT_TIMESTAMP)) as days,address,comment from {$mysqlprefix}chatban where banid = " . intval($banId), $link);
        mysql_close($link);
        if ($ban) {
            $page['banId'] = topage($ban['banid']);
            $page['formaddress'] = topage($ban['address']);
            $page['formdays'] = topage(round($ban['days'] / 86400));
            $page['formcomment'] = topage($ban['comment']);
        } else {
            $errors[] = "Wrong id";
        }
    } else {
        if (isset($_GET['thread'])) {
            $threadid = verifyparam('thread', "/^\\d{1,10}\$/");
            $thread = thread_by_id($threadid);
            if ($thread) {
                $page['thread'] = topage($thread['userName']);
                $page['threadid'] = $threadid;
                $page['formaddress'] = topage($thread['remote']);
                $page['formdays'] = 15;
            }
        }
    }
}
prepare_menu($operator, false);
start_html_output();
require '../view/ban.php';
exit;

 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once '../libs/common.php';
require_once '../libs/operator.php';
require_once '../libs/chat.php';
require_once '../libs/userinfo.php';
$operator = check_login();
$page = array();
loadsettings();
setlocale(LC_TIME, getstring("time.locale"));
function thread_info($id)
{
    global $mysqlprefix;
    $link = connect();
    $thread = select_one_row("select userName,agentName,remote,userAgent," . "unix_timestamp(dtmmodified) as modified, unix_timestamp(dtmcreated) as created," . "vclocalname as groupName " . "from {$mysqlprefix}chatthread left join {$mysqlprefix}chatgroup on {$mysqlprefix}chatthread.groupid = {$mysqlprefix}chatgroup.groupid " . "where threadid = " . intval($id), $link);
    mysql_close($link);
    return $thread;
}
if (isset($_GET['threadid'])) {
    $threadid = verifyparam("threadid", "/^(\\d{1,10})?\$/", "");
    $lastid = -1;
    $page['threadMessages'] = get_messages($threadid, "html", false, $lastid);
    $page['thread'] = thread_info($threadid);
}
prepare_menu($operator, false);
start_html_output();
require '../view/thread_log.php';

$page = array('agentId' => '');
$errors = array();
$options = array('enableban', 'usercanchangename', 'enablegroups', 'enablestatistics', 'enablejabber', 'enablessl', 'forcessl', 'enablepresurvey', 'surveyaskmail', 'surveyaskgroup', 'surveyaskmessage', 'surveyaskcaptcha', 'enablepopupnotification', 'showonlineoperators', 'enablecaptcha');
loadsettings();
if ($settings['featuresversion'] != $featuresversion) {
    $settings['featuresversion'] = $featuresversion;
    update_settings();
}
$params = array();
foreach ($options as $opt) {
    $params[$opt] = $settings[$opt];
}
if (isset($_POST['sent'])) {
    if (is_capable($can_administrate, $operator)) {
        foreach ($options as $opt) {
            $settings[$opt] = verifyparam($opt, "/^on\$/", "") == "on" ? "1" : "0";
        }
        update_settings();
        header("Location: {$mibewroot}/operator/features.php?stored");
        exit;
    } else {
        $errors[] = "Not an administrator";
    }
}
$page['canmodify'] = is_capable($can_administrate, $operator);
$page['stored'] = isset($_GET['stored']);
foreach ($options as $opt) {
    $page["form{$opt}"] = $params[$opt] == "1";
}
prepare_menu($operator);
setup_settings_tabs(1);

        } else {
            update_group($groupid, $name, $description, $commonname, $commondescription, $email);
            header("Location: {$webimroot}/operator/group.php?gid={$groupid}&stored");
            exit;
        }
    } else {
        $page['formname'] = topage($name);
        $page['formdescription'] = topage($description);
        $page['formcommonname'] = topage($commonname);
        $page['formcommondescription'] = topage($commondescription);
        $page['formemail'] = topage($email);
        $page['grid'] = topage($groupid);
    }
} else {
    if (isset($_GET['gid'])) {
        $groupid = verifyparam('gid', "/^\\d{1,9}\$/");
        $group = group_by_id($groupid);
        if (!$group) {
            $errors[] = getlocal("page.group.no_such");
            $page['grid'] = topage($groupid);
        } else {
            $page['formname'] = topage($group['vclocalname']);
            $page['formdescription'] = topage($group['vclocaldescription']);
            $page['formcommonname'] = topage($group['vccommonname']);
            $page['formcommondescription'] = topage($group['vccommondescription']);
            $page['formemail'] = topage($group['vcemail']);
            $page['grid'] = topage($group['groupid']);
        }
    }
}
$page['stored'] = isset($_GET['stored']);

    }
    if ($email) {
        post_message_($thread['threadid'], $kind_for_agent, getstring2('chat.visitor.email', array($email), true), $link);
    }
    if ($info) {
        post_message_($thread['threadid'], $kind_for_agent, getstring2('chat.visitor.info', array($info), true), $link);
    }
    post_message_($thread['threadid'], $kind_user, $message, $link, $name);
    mysql_close($link);
}
$groupid = "";
$groupname = "";
$group = NULL;
loadsettings();
if ($settings['enablegroups'] == '1') {
    $groupid = verifyparam("group", "/^\\d{1,10}\$/", "");
    if ($groupid) {
        $group = group_by_id($groupid);
        if (!$group) {
            $groupid = "";
        } else {
            $groupname = get_group_name($group);
        }
    }
}
$email = getparam('email');
$visitor_name = getparam('name');
$message = getparam('message');
$info = getparam('info');
$referrer = urldecode(getparam("referrer"));
if (!$email) {

    start_xml_output();
    echo "<error><descr>{$message}</descr></error>";
    exit;
}
ping_thread($thread, $isuser, $istyping);
if (!$isuser && $act != "rename") {
    $operator = check_login();
    check_for_reassign($thread, $operator);
}
if ($act == "refresh") {
    $lastid = verifyparam("lastid", "/^\\d{1,10}\$/", -1);
    print_thread_messages($thread, $token, $lastid, $isuser, $outformat, $isuser ? null : $operator['operatorid']);
    exit;
} else {
    if ($act == "post") {
        $lastid = verifyparam("lastid", "/^\\d{1,10}\$/", -1);
        $message = getrawparam('message');
        $kind = $isuser ? $kind_user : $kind_agent;
        $from = $isuser ? $thread['userName'] : $thread['agentName'];
        if (!$isuser && $operator['operatorid'] != $thread['agentId']) {
            show_error("cannot send");
        }
        $link = connect();
        $postedid = post_message_($threadid, $kind, $message, $link, $from, null, $isuser ? null : $operator['operatorid']);
        if ($isuser && $postedid && $thread["shownmessageid"] == 0) {
            commit_thread($thread['threadid'], array('shownmessageid' => intval($postedid)), $link);
        }
        mysql_close($link);
        print_thread_messages($thread, $token, $lastid, $isuser, $outformat, $isuser ? null : $operator['operatorid']);
        exit;
    } else {

    mysql_close($link);
}
$opId = verifyparam("op", "/^\\d{1,9}\$/");
$page = array('opid' => $opId, 'canmodify' => is_capable($can_administrate, $operator) ? "1" : "");
$errors = array();
$op = operator_by_id($opId);
if (!$op) {
    $errors[] = getlocal("no_such_operator");
} else {
    if (isset($_POST['op'])) {
        if (!is_capable($can_administrate, $operator)) {
            $errors[] = getlocal('page_agent.cannot_modify');
        }
        $new_permissions = isset($op['iperm']) ? $op['iperm'] : 0;
        foreach ($permission_ids as $perm => $id) {
            if (verifyparam("permissions{$id}", "/^on\$/", "") == "on") {
                $new_permissions |= 1 << $perm;
            } else {
                $new_permissions &= ~(1 << $perm);
            }
        }
        if (count($errors) == 0) {
            update_operator_permissions($op['operatorid'], $new_permissions);
            if ($opId && $_SESSION["{$mysqlprefix}operator"] && $operator['operatorid'] == $opId) {
                $_SESSION["{$mysqlprefix}operator"]['iperm'] = $new_permissions;
            }
            header("Location: {$webimroot}/operator/permissions.php?op={$opId}&stored");
            exit;
        }
    }
}

require_once '../libs/common.php';
require_once '../libs/chat.php';
require_once '../libs/operator.php';
$operator = check_login();
setlocale(LC_TIME, getstring("time.locale"));
$page = array();
$page['operator'] = topage(get_operator_name($operator));
$page['availableDays'] = range(1, 31);
$page['availableMonth'] = get_month_selection(time() - 400 * 24 * 60 * 60, time() + 50 * 24 * 60 * 60);
$page['showresults'] = false;
$errors = array();
if (isset($_GET['startday'])) {
    $startday = verifyparam("startday", "/^\\d+\$/");
    $startmonth = verifyparam("startmonth", "/^\\d{2}.\\d{2}\$/");
    $endday = verifyparam("endday", "/^\\d+\$/");
    $endmonth = verifyparam("endmonth", "/^\\d{2}.\\d{2}\$/");
    $start = get_form_date($startday, $startmonth);
    $end = get_form_date($endday, $endmonth) + 24 * 60 * 60;
} else {
    $curr = getdate(time());
    if ($curr['mday'] < 7) {
        // previous month
        if ($curr['mon'] == 1) {
            $month = 12;
            $year = $curr['year'] - 1;
        } else {
            $month = $curr['mon'] - 1;
            $year = $curr['year'];
        }
        $start = mktime(0, 0, 0, $month, 1, $year);
        $end = mktime(0, 0, 0, $month, date("t", $start), $year) + 24 * 60 * 60;

$page['groups'] = get_all_groups($link);
mysql_close($link);
$errors = array();
$canmodify = $opId == $operator['operatorid'] && is_capable($can_modifyprofile, $operator) || is_capable($can_administrate, $operator);
$op = operator_by_id($opId);
if (!$op) {
    $errors[] = getlocal("no_such_operator");
} else {
    if (isset($_POST['op'])) {
        if (!$canmodify) {
            $errors[] = getlocal('page_agent.cannot_modify');
        }
        if (count($errors) == 0) {
            $new_groups = array();
            foreach ($page['groups'] as $group) {
                if (verifyparam("group" . $group['groupid'], "/^on\$/", "") == "on") {
                    $new_groups[] = $group['groupid'];
                }
            }
            update_operator_groups($op['operatorid'], $new_groups);
            header("Location: {$webimroot}/operator/opgroups.php?op={$opId}&stored");
            exit;
        }
    }
}
$page['formgroup'] = array();
$page['currentop'] = $op ? topage(get_operator_name($op)) . " (" . $op['vclogin'] . ")" : "-not found-";
$page['canmodify'] = $canmodify ? "1" : "";
if ($op) {
    foreach (get_operator_groupids($opId) as $rel) {
        $page['formgroup'][] = $rel['groupid'];

    $nextGroup = group_by_id($nextid);
    if ($nextGroup) {
        $page['message'] = getlocal2("chat.redirected.group.content", array(safe_htmlspecialchars(topage(get_group_name($nextGroup)))));
        if ($thread['istate'] == $state_chatting) {
            $link = connect();
            commit_thread($threadid, array("istate" => intval($state_waiting), "nextagent" => 0, "groupid" => intval($nextid), "agentId" => 0, "agentName" => "''"), $link);
            post_message_($thread['threadid'], $kind_events, getstring2_("chat.status.operator.redirect", array(get_operator_name($operator)), $thread['locale'], true), $link);
            mysql_close($link);
        } else {
            $errors[] = getlocal("chat.redirect.cannot");
        }
    } else {
        $errors[] = getlocal("chat.redirect.unknown_group");
    }
} else {
    $nextid = verifyparam("nextAgent", "/^\\d{1,10}\$/");
    $nextOperator = operator_by_id($nextid);
    if ($nextOperator) {
        $page['message'] = getlocal2("chat.redirected.content", array(safe_htmlspecialchars(topage(get_operator_name($nextOperator)))));
        if ($thread['istate'] == $state_chatting) {
            $link = connect();
            $threadupdate = array("istate" => intval($state_waiting), "nextagent" => intval($nextid), "agentId" => 0);
            if ($thread['groupid'] != 0) {
                if (FALSE === select_one_row("select groupid from {$mysqlprefix}chatgroupoperator where operatorid = " . intval($nextid) . " and groupid = " . intval($thread['groupid']), $link)) {
                    $threadupdate['groupid'] = 0;
                }
            }
            commit_thread($threadid, $threadupdate, $link);
            post_message_($thread['threadid'], $kind_events, getstring2_("chat.status.operator.redirect", array(get_operator_name($operator)), $thread['locale'], true), $link);
            mysql_close($link);
        } else {

    $level = get_remote_level($_SERVER['HTTP_USER_AGENT']);
    $chatstyle = verifyparam("style", "/^\\w+\$/", "");
    header("Location: {$mibewroot}/client.php?thread={$threadid}&token={$token}&level={$level}" . ($chatstyle ? "&style={$chatstyle}" : ""));
    exit;
}
$token = verifyparam("token", "/^\\d{1,10}\$/");
$threadid = verifyparam("thread", "/^\\d{1,10}\$/");
$level = verifyparam("level", "/^(ajaxed|simple|old)\$/");
// We have to check that the thread is owned by the user.
$is_own_thread = isset($_SESSION['own_threads']) && in_array($threadid, $_SESSION['own_threads']);
$thread = thread_by_id($threadid);
if (!$thread || !isset($thread['ltoken']) || $token != $thread['ltoken'] || !$is_own_thread) {
    die("wrong thread");
}
setup_chatview_for_user($thread, $level);
$pparam = verifyparam("act", "/^(mailthread)\$/", "default");
if ($pparam == "mailthread") {
    expand("styles", getchatstyle(), "mail.tpl");
} else {
    if ($level == "ajaxed") {
        expand("styles", getchatstyle(), "chat.tpl");
    } else {
        if ($level == "simple") {
            expand("styles", getchatstyle(), "chatsimple.tpl");
        } else {
            if ($level == "old") {
                expand("styles", getchatstyle(), "nochat.tpl");
            }
        }
    }
}