zotpress / lib / admin / admin.php

admin.php in Zotpress trunk, at lib/admin/admin.php

667 lines 25.2 KB

Raw Download Zip

1	<?php if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
2
3
4	// ADMIN -----------------------------------------------------------------------------------------
5
6	function Zotpress_options()
7	{
8	// Prevent access to users who are not editors
9	if ( ! current_user_can('edit_others_posts')
10	&& ! is_admin() )
11	wp_die( esc_html('Only logged-in editors can access this page.', 'zotpress'), esc_html('Zotpress: 403 Access Denied', 'zotpress'), array( 'response' => 403 ) );
12
13
14	// +--------------------+
15	// \| Set up admin pages \|
16	// +--------------------+
17
18	if (isset($_GET['setup'])) {
19	include( dirname(__FILE__) . '/admin.setup.php' );
20	} elseif (isset($_GET['accounts'])) {
21	include( dirname(__FILE__) . '/admin.accounts.php' );
22	} elseif (isset($_GET['options'])) {
23	include( dirname(__FILE__) . '/admin.options.php' );
24	} elseif (isset($_GET['help'])) {
25	include( dirname(__FILE__) . '/admin.help.php' );
26	} else {
27	include( dirname(__FILE__) . '/admin.browse.php' );
28	}
29	}
30
31
32	function zotpress_get_default_style()
33	{
34	$zp_default_style = "apa";
35	if ( get_option("Zotpress_DefaultStyle") )
36	$zp_default_style = get_option("Zotpress_DefaultStyle");
37
38	return $zp_default_style;
39	}
40
41
42	function Zotpress_process_accounts_AJAX()
43	{
44	check_ajax_referer( 'zpAccountsAJAX_nonce_val', 'zpAccountsAJAX_nonce' );
45
46	global $wpdb;
47
48
49	include( dirname(__FILE__) . '/../request/request.functions.php' );
50
51	$xml = "";
52
53	// 7.3.13: Added security check for WP role
54	if ( current_user_can('edit_others_posts') ) {
55
56
57	// +-------------+
58	// \| ADD ACCOUNT \|
59	// +-------------+
60
61	if ( isset($_GET['action_type'])
62	&& $_GET['action_type'] == "add_account" )
63	{
64	// Set up error array
65	$errors =
66	array(
67	"api_user_id_blank"=>array(0,"<strong>User ID</strong> was left blank."),
68	"api_user_id_format"=>array(0,"<strong>User ID</strong> was formatted incorrectly."),
69	"public_key_blank"=>array(0,"<strong>Public Key</strong> was left blank."),
70	"public_key_format"=>array(0,"<strong>Public Key</strong> was formatted incorrectly."),
71	"nickname_format"=>array(0,"<strong>Nickname</strong> was formatted incorrectly.")
72	);
73
74	// ACCOUNT TYPE
75	if ( isset($_GET['account_type'])
76	&& $_GET['account_type'] != "" )
77	$account_type = $_GET['account_type'] == "groups" ? "groups" : "users";
78	else
79	$account_type = "users";
80
81	// API USER ID
82	if ( isset($_GET['api_user_id'])
83	&& $_GET['api_user_id'] != "" )
84	if ( preg_match("/^\\d+\$/", sanitize_text_field(wp_unslash($_GET['api_user_id']))) == 1 )
85	$api_user_id = sanitize_text_field(wp_unslash($_GET['api_user_id']));
86	else
87	$errors['api_user_id_format'][0] = 1;
88	else
89	$errors['api_user_id_blank'][0] = 1;
90
91	// PUBLIC KEY
92	$public_key = false;
93
94	if ( isset($_GET['public_key'])
95	&& $_GET['public_key'] != "" )
96	if ( preg_match("/^[0-9a-zA-Z]+$/", sanitize_text_field(wp_unslash($_GET['public_key']))) == 1) {
97	$public_key = trim(sanitize_text_field(wp_unslash($_GET['public_key'])));
98	} elseif ( $account_type == "users" ) {
99	$errors['public_key_format'][0] = 1;
100	} elseif ( $account_type == "users" ) {
101	$errors['public_key_blank'][0] = 1;
102	}
103
104	// NICKNAME
105	$nickname = false;
106	if ( isset($_GET['nickname'])
107	&& trim(sanitize_text_field(wp_unslash($_GET['nickname']))) != "" )
108	if ( preg_match('/^[\'0-9a-zA-Z -_]+$/', stripslashes(sanitize_text_field(wp_unslash($_GET['nickname'])))) == 1 )
109	$nickname = str_replace("'", "", str_replace(" ", "", trim(urldecode(sanitize_text_field(wp_unslash($_GET['nickname']))))));
110	else
111	$errors['nickname_format'][0] = 1;
112
113	// CHECK ERRORS
114	$errorCheck = false;
115	foreach ($errors as $field => $error)
116	{
117	if ( $error[0] == 1 ) {
118	$errorCheck = true;
119	break;
120	}
121	}
122
123	// ADD ACCOUNT
124	if ( $errorCheck == false )
125	{
126	$zp_query = "INSERT INTO ".$wpdb->prefix."zotpress (account_type, api_user_id, public_key";
127	if ($nickname) $zp_query .= ", nickname";
128	$zp_query .= ") ";
129	$zp_query .= " VALUES (%s, %s, %s";
130	if ($nickname) $zp_query .= ", %s";
131	$zp_query .= ")";
132
133	$temp_arr = array( $account_type, $api_user_id, $public_key);
134	if ($nickname) array_push($temp_arr, $nickname);
135
136	// 7.4: PCP hack
137	$wpdb->zp_add_acc_query = $zp_query;
138	$wpdb->zp_add_acc_arr = $temp_arr;
139
140	// Insert new list item into the list:
141	$wpdb->query(
142	$wpdb->prepare(
143	$wpdb->zp_add_acc_query,
144	$wpdb->zp_add_acc_arr
145	)
146	);
147
148	// Display success XML
149	$xml .= "<result success='true' api_user_id='".$api_user_id."' public_key='".$public_key."' />\n";
150	}
151
152	// DISPLAY ERRORS
153	else
154	{
155	$xml .= "<result success='false' />\n";
156	$xml .= "<citation>\n";
157	$xml .= "<errors>\n";
158	foreach ($errors as $field => $error)
159	if ($error[0] == 1)
160	$xml .= $error[1]."\n";
161	$xml .= "</errors>\n";
162	$xml .= "</citation>\n";
163	}
164	}
165
166
167	// +----------------+
168	// \| DELETE ACCOUNT \|
169	// +----------------+
170
171	elseif ( isset($_GET['action_type'])
172	&& $_GET['action_type'] == "delete_account" )
173	{
174	if ( preg_match("/^\\d+\$/", sanitize_text_field(wp_unslash($_GET['api_user_id']))) )
175	{
176	$api_user_id = sanitize_text_field(wp_unslash($_GET['api_user_id']));
177
178	$wpdb->query(
179	$wpdb->prepare(
180	"
181	DELETE FROM `".$wpdb->prefix."zotpress`
182	WHERE `api_user_id`=%s
183	",
184	array($api_user_id)
185	)
186	);
187	zotpress_clear_cache_for_user ($wpdb, $api_user_id);
188
189	// Check if default account
190	if ( get_option("Zotpress_DefaultAccount")
191	&& get_option("Zotpress_DefaultAccount") == $api_user_id )
192	delete_option( "Zotpress_DefaultAccount" );
193
194	$total_accounts = $wpdb->get_var( "SELECT COUNT(*) FROM ".$wpdb->prefix."zotpress;" );
195
196	// Display success XML
197	$xml .= "<result success='true' total_accounts='".$total_accounts."' />\n";
198	$xml .= "<account id='".$api_user_id."' type='delete' />\n";
199
200	$wpdb->flush();
201	unset($api_user_id);
202	}
203	else // die
204	{
205	exit();
206	}
207	}
208
209
210	// +-------------+
211	// \| CLEAR CACHE \|
212	// +-------------+
213
214	elseif ( isset($_GET['action_type'])
215	&& $_GET['action_type'] == "clear_cache" )
216	{
217	if ( preg_match("/^\\d+\$/", sanitize_text_field(wp_unslash($_GET['api_user_id']))) )
218	{
219	$api_user_id = sanitize_text_field(wp_unslash($_GET['api_user_id']));
220
221	// Clear the cache
222	zotpress_clear_cache_for_user ($wpdb, $api_user_id);
223
224	// Display success XML
225	$xml .= "<result success='true' cache_cleared='true' />\n";
226	$xml .= "<account id='".$api_user_id."' type='cache' />\n";
227
228	$wpdb->flush();
229	unset($api_user_id);
230	}
231	else // die
232	{
233	exit();
234	}
235	}
236
237
238	// +---------------------+
239	// \| SET DEFAULT ACCOUNT \|
240	// +---------------------+
241
242	elseif ( isset($_GET['action_type'])
243	&& $_GET['action_type'] == "default_account" )
244	{
245	$errors = array("account_empty"=>array(0,"<strong>Account</strong> was left blank."),
246	"account_format"=>array(0,"<strong>Account</strong> was incorrectly formatted."));
247
248	// Check the post variables and record errors
249	if ( trim(sanitize_text_field(wp_unslash($_GET['api_user_id']))) != '' )
250	if ( preg_match('/^[\'0-9a-zA-Z -_]+$/', stripslashes(sanitize_text_field(wp_unslash($_GET['api_user_id'])))) == 1 )
251	$account = str_replace("'","",str_replace(" ","",trim(urldecode(sanitize_text_field(wp_unslash($_GET['api_user_id']))))));
252	else
253	$errors['account_format'][0] = 1;
254	else
255	$errors['account_empty'][0] = 1;
256
257	// CHECK ERRORS
258	$errorCheck = false;
259
260	foreach ( $errors as $field => $error ) {
261	if ( $error[0] == 1 ) {
262	$errorCheck = true;
263	break;
264	}
265	}
266
267	// SET DEFAULT ACCOUNT
268	if ( $errorCheck === false )
269	{
270	update_option( "Zotpress_DefaultAccount", $account );
271	$xml .= "<result success='true' account='".$account."' />\n";
272	}
273	}
274
275
276	// +-------------------+
277	// \| SET DEFAULT STYLE \|
278	// +-------------------+
279
280	elseif ( isset($_GET['action_type'])
281	&& $_GET['action_type'] == "default_style" )
282	{
283	$errors = array("style_empty"=>array(0,"<strong>Style</strong> was left blank."),
284	"style_format"=>array(0,"<strong>Style</strong> was incorrectly formatted."));
285
286	// Check the post variables and record errors
287	if ( isset($_GET['style'])
288	&& trim(sanitize_text_field(wp_unslash($_GET['style']))) != '' )
289	if ( preg_match('/^[\'0-9a-zA-Z -_]+$/', stripslashes(sanitize_text_field(wp_unslash($_GET['style'])))) == 1 )
290	$style = str_replace("'", "", str_replace(" ", "", trim(urldecode(sanitize_text_field(wp_unslash($_GET['style']))))));
291	else
292	$errors['style_format'][0] = 1;
293	else
294	$errors['style_empty'][0] = 1;
295
296	// CHECK ERRORS
297	$errorCheck = false;
298
299	foreach ( $errors as $field => $error ) {
300	if ($error[0] == 1) {
301	$errorCheck = true;
302	break;
303	}
304	}
305
306	// SET DEFAULT ACCOUNT
307	if ( $errorCheck === false )
308	{
309	// Update style list
310	if ( strpos(get_option("Zotpress_StyleList"), $style) === false )
311	update_option( "Zotpress_StyleList", get_option("Zotpress_StyleList") . ", " . $style);
312
313	// Update default style
314	update_option("Zotpress_DefaultStyle", $style);
315	$xml .= "<result success='true' style='".$style."' />\n";
316	}
317	}
318
319
320	// +-------------------------+
321	// \| SET DEFAULT CACHE TIMER \|
322	// +-------------------------+
323
324	elseif ( isset($_GET['action_type'])
325	&& $_GET['action_type'] == "default_cachetimer" )
326	{
327	// $xml .= "<result success='true' cache_timer='".$_GET['cache_timer']."' />\n";
328
329	$errors = array("cachetimer_empty"=>array(0,"<strong>Cache Timer</strong> was left blank."),
330	"cachetimer_format"=>array(0,"<strong>Cache Timer</strong> was incorrectly formatted."));
331
332	// Check the post variables and record errors
333	if ( trim(sanitize_text_field(wp_unslash($_GET['cache_timer']))) != '' )
334	if ( preg_match('/^[\'0-9]+$/', stripslashes(sanitize_text_field(wp_unslash($_GET['cache_timer'])))) == 1 )
335	$cache_timer = str_replace("'","",str_replace(" ","",trim(urldecode(sanitize_text_field(wp_unslash($_GET['cache_timer']))))));
336	else
337	$errors['cachetimer_format'][0] = 1;
338	else
339	$errors['cachetimer_empty'][0] = 1;
340
341	// CHECK ERRORS
342	$errorCheck = false;
343
344	foreach ( $errors as $field => $error ) {
345	if ( $error[0] == 1 ) {
346	$errorCheck = true;
347	break;
348	}
349	}
350
351	// SET DEFAULT CACHE TIMER
352	if ( $errorCheck === false )
353	{
354	update_option( "Zotpress_DefaultCacheTimer", $cache_timer );
355	$xml .= "<result success='true' cache_timer='".$cache_timer."' />\n";
356	}
357	}
358
359
360	// +------------------------------+
361	// \| SET REFERENCE WIDGET FOR CPT \|
362	// +------------------------------+
363
364	elseif ( isset($_GET['action_type'])
365	&& $_GET['action_type'] == "ref_widget_cpt" )
366	{
367	$errors = array("cpt_empty"=>array(0,"<strong>Content Type</strong> was left blank."),
368	"cpt_format"=>array(0,"<strong>Content Type</strong> was incorrectly formatted."));
369
370	// Check the post variables and record errors
371	if ( isset($_GET['cpt'])
372	&& trim(sanitize_text_field(wp_unslash($_GET['cpt']))) != '' )
373	if ( preg_match('/^[\'0-9a-zA-Z -_,]+$/', stripslashes(sanitize_text_field(wp_unslash($_GET['cpt'])))) == 1 )
374	$cpt = trim(sanitize_text_field(wp_unslash($_GET['cpt'])));
375	else
376	$errors['cpt_format'][0] = 1;
377	else
378	$errors['cpt_empty'][0] = 1;
379
380	// CHECK ERRORS
381	$errorCheck = false;
382
383	foreach ( $errors as $field => $error ) {
384	if ( $error[0] == 1 ) {
385	$errorCheck = true;
386	break;
387	}
388	}
389
390	// SET DEFAULT CPT
391	if ( $errorCheck === false )
392	{
393	update_option("Zotpress_DefaultCPT", $cpt);
394	$xml .= "<result success='true' cpt='".$cpt."' />\n";
395	}
396	}
397
398
399	// +----------------+
400	// \| RESET ZOTPRESS \|
401	// +----------------+
402
403	elseif ( isset($_GET['action_type'])
404	&& $_GET['action_type'] == "reset" )
405	{
406	$errors = array("reset_empty" => array(0, "<strong>Reset</strong> was left blank."));
407
408	// Check the post variables and record errors
409	if ( isset($_GET['reset'])
410	&& trim(sanitize_text_field(wp_unslash($_GET['reset']))) == 'true' )
411	$reset = sanitize_text_field(wp_unslash($_GET['reset']));
412	else
413	$errors['reset_empty'][0] = 1;
414
415	// CHECK ERRORS
416	$errorCheck = false;
417
418	foreach ( $errors as $field => $error ) {
419	if ( $error[0] == 1 ) {
420	$errorCheck = true;
421	break;
422	}
423	}
424
425	if ( $errorCheck === false )
426	{
427	global $wpdb;
428	global $current_user;
429
430	// Drop all tables except accounts/main
431	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress;");
432	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_oauth;");
433	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroItems;");
434	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroCollections;");
435	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroTags;");
436	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroRelItemColl;");
437	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroRelItemTags;");
438	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_cache ;");
439	$wpdb->query("DROP TABLE IF EXISTS ".$wpdb->prefix."zotpress_zoteroItemImages ;");
440
441	delete_option( 'Zotpress_cache_version' );
442	delete_option( 'Zotpress_DefaultCPT' );
443	delete_option( 'Zotpress_DefaultAccount' );
444	delete_option( 'Zotpress_DefaultEditor' );
445	delete_option( 'Zotpress_DefaultStyle' );
446	delete_option( 'Zotpress_StyleList' );
447	delete_option( 'Zotpress_update_version' );
448	delete_option( 'Zotpress_main_db_version' );
449	delete_option( 'Zotpress_oauth_db_version' );
450	delete_option( 'Zotpress_zoteroItems_db_version' );
451	delete_option( 'Zotpress_zoteroCollections_db_version' );
452	delete_option( 'Zotpress_zoteroTags_db_version' );
453	delete_option( 'Zotpress_zoteroRelItemColl_db_version' );
454	delete_option( 'Zotpress_zoteroRelItemTags_db_version' );
455	delete_option( 'Zotpress_zoteroItemImages_db_version' );
456	delete_option( 'Zotpress_update_notice_dismissed' );
457	delete_option( 'Zotpress_zoteroItemImages_db_version' );
458
459	delete_user_meta( $current_user->ID, 'zotpress_5_2_ignore_notice' );
460	delete_user_meta( $current_user->ID, 'zotpress_survey_notice_ignore' );
461
462	$xml .= "<result success='true' reset='complete' />\n";
463	}
464	}
465
466
467	// +-----------+
468	// \| ADD IMAGE \|
469	// +-----------+
470
471	elseif ( isset($_GET['action_type'])
472	&& $_GET['action_type'] == "add_image" )
473	{
474	// Set up error array
475	$errors = array(
476	"item_key_blank"=>array(0,"<strong>Entry ID</strong> was left blank or formatted incorrectly."),
477	"image_id_blank"=>array(0,"<strong>Image ID</strong> was left blank or formatted incorrectly."),
478	"api_user_id_blank"=>array(0,"<strong>API User ID</strong> was left blank or formatted incorrectly.")
479	);
480
481	// BASIC VARS
482	$api_user_id = false;
483	if ( preg_match("/^\\d+\$/", sanitize_text_field(wp_unslash($_GET['api_user_id']))) )
484	$api_user_id = htmlentities(trim(sanitize_text_field(wp_unslash($_GET['api_user_id']))));
485	else
486	$errors['api_user_id_blank'][0] = 1;
487
488	$item_key = false;
489	if ( isset($_GET['item_key'])
490	&& preg_match("/^[a-zA-Z0-9]+$/", sanitize_text_field(wp_unslash($_GET['item_key']))) )
491	$item_key = htmlentities(trim(sanitize_text_field(wp_unslash($_GET['item_key']))));
492	else
493	$errors['item_key_blank'][0] = 1;
494
495	$image_id = false;
496	if ( isset($_GET['image_id'])
497	&& preg_match("/^\\d+\$/", sanitize_text_field(wp_unslash($_GET['image_id']))) )
498	$image_id = htmlentities(trim(sanitize_text_field(wp_unslash($_GET['image_id']))));
499	else
500	$errors['image_id_blank'][0] = 1;
501
502	// CHECK ERRORS
503	$errorCheck = false;
504
505	foreach ( $errors as $field => $error ) {
506	if ( $error[0] == 1 ) {
507	$errorCheck = true;
508	break;
509	}
510	}
511
512	// SET FEATURED IMAGE
513	if ( $errorCheck == false )
514	{
515	$wpdb->query(
516	$wpdb->prepare(
517	"
518	INSERT INTO ".$wpdb->prefix."zotpress_zoteroItemImages (api_user_id, item_key, image)
519	VALUES (%s, %s, %s)
520	ON DUPLICATE KEY UPDATE image=%s
521	",
522	$api_user_id, $item_key, $image_id, $image_id
523	)
524	);
525
526	$xml .= "<result success='true' citation_id='".$item_key."' />\n";
527	}
528
529	// DISPLAY ERRORS
530	else
531	{
532	$xml .= "<result success='false' />\n";
533	$xml .= "<citation>\n";
534	$xml .= "<errors>\n";
535	foreach ( $errors as $field => $error )
536	if ( $error[0] == 1 )
537	$xml .= $error[1]."\n";
538	$xml .= "</errors>\n";
539	$xml .= "</citation>\n";
540	}
541	}
542
543
544	// +--------------+
545	// \| REMOVE IMAGE \|
546	// +--------------+
547
548	elseif ( isset($_GET['action_type'])
549	&& $_GET['action_type'] == "remove_image" )
550	{
551	// Set up error array
552	$errors = array(
553	"item_key_blank"=>array(0,"<strong>Item Key</strong> was left blank or formatted incorrectly."),
554	"api_user_id_blank"=>array(0,"<strong>API User ID</strong> was left blank or formatted incorrectly.")
555	);
556
557	// BASIC VARS
558	$item_key = false;
559	if ( isset($_GET['item_key'])
560	&& preg_match("/^[A-Z0-9]+$/", sanitize_text_field(wp_unslash($_GET['item_key']))) )
561	$item_key = htmlentities(trim(sanitize_text_field(wp_unslash($_GET['item_key']))));
562	else
563	$errors['item_key_blank'][0] = 1;
564
565	$api_user_id = false;
566	if ( isset($_GET['api_user_id'])
567	&& preg_match("/^[A-Z0-9]+$/", sanitize_text_field(wp_unslash($_GET['api_user_id']))) )
568	$api_user_id = htmlentities(trim(sanitize_text_field(wp_unslash($_GET['api_user_id']))));
569	else
570	$errors['api_user_id_blank'][0] = 1;
571
572	// CHECK FOR ERRORS
573	$errorCheck = false;
574	foreach ( $errors as $field => $error ) {
575	if ( $error[0] == 1 ) {
576	$errorCheck = true;
577	break;
578	}
579	}
580
581	// REMOVE FEATURED IMAGE
582	if ( $errorCheck == false )
583	{
584	$wpdb->query(
585	$wpdb->prepare(
586	"
587	DELETE FROM ".$wpdb->prefix."zotpress_zoteroItemImages
588	WHERE item_key=%s AND api_user_id=%s
589	",
590	$item_key, $api_user_id
591	)
592	);
593
594	$xml .= "<result success='true' item_key='".$item_key."' />\n";
595	}
596
597
598	// +----------------+
599	// \| Display errors \|
600	// +----------------+
601
602	else
603	{
604	$xml .= "<result success='false' />\n";
605	$xml .= "<citation>\n";
606	$xml .= "<errors>\n";
607	foreach ( $errors as $field => $error )
608	if ( $error[0] == 1 )
609	$xml .= $error[1]."\n";
610	$xml .= "</errors>\n";
611	$xml .= "</citation>\n";
612	}
613	}
614
615	} // Check roles
616
617
618	// +-------------+
619	// \| Display XML \|
620	// +-------------+
621
622	header('Content-Type: application/xml; charset=ISO-8859-1');
623	echo "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n";
624	echo "<accounts>\n";
625	echo wp_kses(
626	$xml,
627	array(
628	'result' => array(
629	'success' => array(),
630	'item_key' => array(),
631	'reset' => array(),
632	'cpt' => array(),
633	'cache_timer' => array(),
634	'api_user_id' => array(),
635	'public_key' => array(),
636	'total_accounts' => array(),
637	'cache_cleared' => array(),
638	'citation_id' => array(),
639	'account' => array(),
640	'accounts' => array(),
641	'style' => array(),
642	),
643	'citation' => array(
644	'id' => array(),
645	'class' => array(),
646	'style' => array(),
647	'name' => array(),
648	),
649	'account' => array(
650	'id' => array(),
651	'type' => array(),
652	),
653	'errors' => array(),
654	)
655	);
656	echo "</accounts>";
657
658	$wpdb->flush();
659
660	exit();
661	}
662
663	add_action( 'wp_ajax_zpAccountsViaAJAX', 'Zotpress_process_accounts_AJAX' );
664
665	// ADMIN ------------------------------------------------------------------------------------------
666
667	?>