--- index.php	2005-02-22 17:39:21.000000000 -0800
+++ /home/john/hostmaster/modules/massmailer/engines/phplist/phplist/admin/index.php	2006-03-13 21:31:27.000000000 -0800
@@ -1,6 +1,6 @@
 <?php
 
-ob_start();
+@ob_start();
 $er = error_reporting(0);
 # check for commandline and cli version
 if (!isset($_SERVER["SERVER_NAME"]) && !PHP_SAPI == "cli") {
@@ -9,20 +9,18 @@
 
 if (!ini_get("register_globals") || ini_get("register_globals") == "off") {
   # fix register globals, for now, should be phased out gradually
-  # sure, this gets around the entire reason that register globals
+  # sure, this gets around the entire reason that regLANGUAGE_SWITCHister globals
   # should be off, but going through three years of code takes a long time....
 
-  # don't do this for developers so they get to work it out properly
   foreach ($_REQUEST as $key => $val) {
     $$key = $val;
-#    print "$key = $val<br/>";
   }
 }
 
 require_once dirname(__FILE__) .'/commonlib/lib/magic_quotes.php';
 
 # setup commandline
-if (PHP_SAPI == "cli") {
+if (php_sapi_name() == "cli") {
   for ($i=0; $i<$_SERVER['argc']; $i++) {
     $my_args = array();
     if (ereg("(.*)=(.*)",$_SERVER['argv'][$i], $my_args)) {
@@ -43,15 +41,15 @@
 if (isset($_SERVER["ConfigFile"]) && is_file($_SERVER["ConfigFile"])) {
   print '<!-- using '.$_SERVER["ConfigFile"].'-->'."\n";
   include $_SERVER["ConfigFile"];
-} elseif (is_file($cline["c"])) {
+} elseif (isset($cline["c"]) && is_file($cline["c"])) {
   print '<!-- using '.$cline["c"].' -->'."\n";
   include $cline["c"];
 } elseif (isset($_ENV["CONFIG"]) && is_file($_ENV["CONFIG"])) {
 #  print '<!-- using '.$_ENV["CONFIG"].'-->'."\n";
   include $_ENV["CONFIG"];
-} elseif (is_file("../config/config.php")) {
-  print '<!-- using ../config/config.php -->'."\n";
-  include "../config/config.php";
+} elseif (is_file("../../config.php")) {
+  print '<!-- using ../../config.php -->'."\n";
+  include "../../config.php";
 } else {
   print "Error, cannot find config file\n";
   exit;
@@ -63,31 +61,37 @@
 $GLOBALS["pagestats"]["time_start"] = $now["sec"] * 1000000 + $now["usec"];
 $GLOBALS["pagestats"]["number_of_queries"] = 0;
 
-if (isset($GLOBALS["developer_email"])) {
-  error_reporting(E_ALL);
+if (!$GLOBALS["commandline"] && isset($GLOBALS["developer_email"]) && $_SERVER['HTTP_HOST'] != 'cvs.phplist.com' && !empty($GLOBALS['show_dev_errors'])) {
+  error_reporting(E_ALL | E_NOTICE);
+  ini_set('display_errors',1);
+  foreach ($_REQUEST as $key => $val) {
+      unset($$key);
+  }
+  #error_reporting(0);
 } else {
-	error_reporting($er);
+#  error_reporting($er);
+  error_reporting(0);
 }
 
 # load all required files
+require_once dirname(__FILE__).'/init.php';
 require_once dirname(__FILE__).'/'.$GLOBALS["database_module"];
 require_once dirname(__FILE__)."/../texts/english.inc";
 include_once dirname(__FILE__)."/../texts/".$GLOBALS["language_module"];
 require_once dirname(__FILE__)."/defaultconfig.inc";
 require_once dirname(__FILE__).'/connect.php';
 include_once dirname(__FILE__)."/languages.php";
+include_once dirname(__FILE__)."/lib.php";
 require_once dirname(__FILE__)."/commonlib/lib/interfacelib.php";
 include_once dirname(__FILE__)."/pagetop.php";
 
-# check whether Pear HTTP/Request is available
-$er = error_reporting(0);
-include_once "HTTP/Request.php";
-$has_pear_http_request = class_exists('HTTP_Request');
-error_reporting($er);
-
 if ($GLOBALS["commandline"]) {
-  if (!in_array($_SERVER["USER"],$GLOBALS["commandline_users"])) {
-    clineError("Sorry, You (".$_SERVER["USER"].") do not have sufficient permissions to run this script");
+  if (!isset($_SERVER["USER"]) && sizeof($GLOBALS["commandline_users"])) {
+    clineError("USER environment variable is not defined, cannot do access check. Please make sure USER is defined.");
+    exit;
+  }
+  if (is_array($GLOBALS["commandline_users"]) && sizeof($GLOBALS["commandline_users"]) && !in_array($_SERVER["USER"],$GLOBALS["commandline_users"])) {
+    clineError("Sorry, You (".$_SERVER["USER"].") do not have sufficient permissions to run phplist on commandline");
     exit;
   }
   $GLOBALS["require_login"] = 0;
@@ -117,7 +121,7 @@
   $page = $_GET['page'];
 preg_match("/([\w_]+)/",$page,$regs);
 $page = $regs[1];
-if (!is_file($page.'.php')) {
+if (!is_file($page.'.php') && !isset($_GET['pi'])) {
   $page = 'home';
 }
 
@@ -135,7 +139,7 @@
 }
 
 $page_title = NAME;
-include_once dirname(__FILE__)."/lan/".$adminlanguage["iso"]."/pagetitles.php";
+@include_once dirname(__FILE__)."/lan/".$_SESSION['adminlanguage']['iso']."/pagetitles.php";
 
 print '<script language="javascript" type="text/javascript" src="js/select_style.js"></script>';
 print '<meta http-equiv="Cache-Control" content="no-cache, must-revalidate">';           // HTTP/1.1
@@ -146,33 +150,31 @@
 print "$page_title</title>";
 
 if (isset($GLOBALS["require_login"]) && $GLOBALS["require_login"]) {
-	if (!empty($GLOBALS["SessionTableName"])) {
-  	require_once dirname(__FILE__).'/sessionlib.php';
-  }
-  session_start();
   if ($GLOBALS["admin_auth_module"] && is_file("auth/".$GLOBALS["admin_auth_module"])) {
-		require_once "auth/".$GLOBALS["admin_auth_module"];
+    require_once "auth/".$GLOBALS["admin_auth_module"];
   } elseif ($GLOBALS["admin_auth_module"] && is_file($GLOBALS["admin_auth_module"])) {
-		require_once $GLOBALS["admin_auth_module"];
+    require_once $GLOBALS["admin_auth_module"];
   } else {
-  	if ($GLOBALS["admin_auth_module"]) {
-    	logEvent("Warning: unable to use ".$GLOBALS["admin_auth_module"]. " for admin authentication, reverting back to phplist authentication");
+    if ($GLOBALS["admin_auth_module"]) {
+      logEvent("Warning: unable to use ".$GLOBALS["admin_auth_module"]. " for admin authentication, reverting back to phplist authentication");
       $GLOBALS["admin_auth_module"] = 'phplist_auth.inc';
     }
-  	require_once 'auth/phplist_auth.inc';
+    require_once 'auth/phplist_auth.inc';
   }
   if (class_exists('admin_auth')) {
-	  $GLOBALS["admin_auth"] = new admin_auth();
+    $GLOBALS["admin_auth"] = new admin_auth();
   } else {
-  	print Fatal_Error($GLOBALS['I18N']->get('admininitfailure'));
+    print Fatal_Error($GLOBALS['I18N']->get('admininitfailure'));
     return;
   }
   if ((!isset($_SESSION["adminloggedin"]) || !$_SESSION["adminloggedin"]) && isset($_REQUEST["login"]) && isset($_REQUEST["password"])) {
-  	$loginresult = $GLOBALS["admin_auth"]->validateLogin($_REQUEST["login"],$_REQUEST["password"]);
+    $loginresult = $GLOBALS["admin_auth"]->validateLogin($_REQUEST["login"],$_REQUEST["password"]);
     if (!$loginresult[0]) {
       $_SESSION["adminloggedin"] = "";
       $_SESSION["logindetails"] = "";
       $page = "login";
+      logEvent(sprintf($GLOBALS['I18N']->get('invalid login from %s, tried logging in as %s'),$_SERVER['REMOTE_ADDR'],$_REQUEST["login"]));
+      $msg = $loginresult[1];
     } else {
       $_SESSION["adminloggedin"] = $_SERVER["REMOTE_ADDR"];
       $_SESSION["logindetails"] = array(
@@ -185,25 +187,29 @@
       }
     }
   } elseif (isset($_REQUEST["forgotpassword"])) {
-  	$pass = $GLOBALS["admin_auth"]->getPassword($_REQUEST["forgotpassword"]);
+    $pass = $GLOBALS["admin_auth"]->getPassword($_REQUEST["forgotpassword"]);
     if ($pass) {
       sendMail ($_REQUEST["forgotpassword"],$GLOBALS['I18N']->get('yourpassword'),"\n\n".$GLOBALS['I18N']->get('yourpasswordis')." $pass");
       $msg = $GLOBALS['I18N']->get('passwordsent');
+      logEvent(sprintf($GLOBALS['I18N']->get('successful password request from %s for %s'),$_SERVER['REMOTE_ADDR'],$_REQUEST["forgotpassword"]));
     } else {
-    	$msg = $GLOBALS['I18N']->get('cannotsendpassword');
+      $msg = $GLOBALS['I18N']->get('cannotsendpassword');
+      logEvent(sprintf($GLOBALS['I18N']->get('failed password request from %s for %s'),$_SERVER['REMOTE_ADDR'],$_REQUEST["forgotpassword"]));
     }
     $page = "login";
   } elseif (!isset($_SESSION["adminloggedin"]) || !$_SESSION["adminloggedin"]) {
-  	#$msg = 'Not logged in';
-  	$page = "login";
+    #$msg = 'Not logged in';
+    $page = "login";
   } elseif (CHECK_SESSIONIP && $_SESSION["adminloggedin"] && $_SESSION["adminloggedin"] != $_SERVER["REMOTE_ADDR"]) {
+    logEvent(sprintf($GLOBALS['I18N']->get('login ip invalid from %s for %s (was %s)'),$_SERVER['REMOTE_ADDR'],$_SESSION["logindetails"]['adminname'],$_SESSION["adminloggedin"]));
     $msg = $GLOBALS['I18N']->get('ipchanged');
     $_SESSION["adminloggedin"] = "";
     $_SESSION["logindetails"] = "";
     $page = "login";
-	} elseif ($_SESSION["adminloggedin"] && $_SESSION["logindetails"]) {
-  	$validate = $GLOBALS["admin_auth"]->validateAccount($_SESSION["logindetails"]["id"]);
+  } elseif ($_SESSION["adminloggedin"] && $_SESSION["logindetails"]) {
+    $validate = $GLOBALS["admin_auth"]->validateAccount($_SESSION["logindetails"]["id"]);
     if (!$validate[0]) {
+      logEvent(sprintf($GLOBALS['I18N']->get('invalidated login from %s for %s (error %s)'),$_SERVER['REMOTE_ADDR'],$_SESSION["logindetails"]['adminname'],$validate[1]));
       $_SESSION["adminloggedin"] = "";
       $_SESSION["logindetails"] = "";
       $page = "login";
@@ -212,8 +218,9 @@
   }
 }
 
+$include = '';
 include "header.inc";
-if ($page != "") {
+if ($page != '') {
   preg_match("/([\w_]+)/",$page,$regs);
   $include = $regs[1];
   $include .= ".php";
@@ -234,12 +241,29 @@
     } elseif ($hr <= 18) {
       $greeting = $GLOBALS['I18N']->get('goodafternoon');
     } else {
-       $greeting = $GLOBALS['I18N']->get('goodevening');
-     }
+      $greeting = $GLOBALS['I18N']->get('goodevening');
+    }
   }
   print '<div><font style="font-size : 12px;font-family : Arial, Helvetica, sans-serif;  font-weight : bold;"> '.$greeting." ".adminName($_SESSION["logindetails"]["id"]). "</font></div>";
-  if ($page != "logout")
-  print '<div align="right">'.PageLink2("logout",$GLOBALS['I18N']->get('logout')).'</div>';
+  if ($page != "logout") {
+    print '<div align="right">'.PageLink2("logout",$GLOBALS['I18N']->get('logout'));
+  }
+  print '</div>';
+}
+if (LANGUAGE_SWITCH) {
+  $ls = '<div align="right" id="languageswitch"><br/><form name="languageswitch" method="post" style="margin: 0; padding: 0">';
+  $ls .= '<select name="setlanguage" onChange="document.languageswitch.submit()" style="width: 100px; font-size: 10px; color: #666666">';
+  $lancount = 0;
+  foreach ($GLOBALS['LANGUAGES'] as $iso => $rec) {
+    if (is_dir(dirname(__FILE__).'/lan/'.$iso)) {
+      $ls .= sprintf('<option value="%s" %s>%s</option>',$iso,$_SESSION['adminlanguage']['iso'] == $iso ? 'selected':'',$rec[0]);
+      $lancount++;
+    }
+  }
+  $ls .= '</select></form></div>';
+  if ($lancount > 1) {
+    print $ls;
+  }
 }
 
 if ($page != "login") {
@@ -276,8 +300,8 @@
 }
 
 # include some information
-if (is_file("info/".$adminlanguage["info"]."/$include")) {
-  @include "info/".$adminlanguage["info"]."/$include";
+if (is_file("info/".$_SESSION['adminlanguage']['info']."/$include")) {
+  @include "info/".$_SESSION['adminlanguage']['info']."/$include";
 } else {
 #  print "Not a file: "."info/".$adminlanguage["info"]."/$include";
 }
@@ -305,10 +329,10 @@
 }
 clearstatcache();
 if (checkAccess($page,"") || $page == 'about') {
-  if (is_file($include) || is_link($include)) {
+  if (!$_GET['pi'] && (is_file($include) || is_link($include))) {
     # check whether there is a language file to include
-    if (is_file("lan/".$adminlanguage["iso"]."/".$include)) {
-      include "lan/".$adminlanguage["iso"]."/".$include;
+    if (is_file("lan/".$_SESSION['adminlanguage']['iso']."/".$include)) {
+      include "lan/".$_SESSION['adminlanguage']['iso']."/".$include;
     }
   #  print "Including $include<br/>";
 
@@ -320,22 +344,26 @@
       print Error("cannot parse $include");
       print '<p>Sorry, an error occurred. This is a bug. Please <a href="http://mantis.tincan.co.uk">report the bug to the Bug Tracker</a><br/>Sorry for the inconvenience</a></p>';
     } else {
-      @include "$include";
+      if (isset($GLOBALS['developer_email'])) {
+        include $include;
+      } else {
+        @include $include;
+      }
     }
   #  print "End of inclusion<br/>";
-  } elseif ($_GET["pi"] && is_object($GLOBALS["plugins"][$_GET["pi"]])) {
+  } elseif ($_GET['pi'] && isset($GLOBALS['plugins']) && is_array($GLOBALS['plugins']) && is_object($GLOBALS['plugins'][$_GET['pi']])) {
     $plugin = $GLOBALS["plugins"][$_GET["pi"]];
     $menu = $plugin->adminmenu();
-    if (is_file($plugin->coderoot . "$include")) {
-      include ($plugin->coderoot . "$include");
-    } elseif ($include == "main.php") {
+    if (is_file($plugin->coderoot . $include)) {
+      include ($plugin->coderoot . $include);
+    } elseif ($include == 'main.php') {
       print '<h1>'.$plugin->name.'</h1><ul>';
       foreach ($menu as $page => $desc) {
         print '<li>'.PageLink2($page,$desc).'</li>';
       }
       print '</ul>';
     } else {
-      print "$page -&gt; ".$I18N->get("pagenotfoundinplugin").'<br/>';
+      print '<br/>'."$page -&gt; ".$I18N->get("pagenotfoundinplugin").'<br/>';#.' '.$plugin->coderoot.$include.'<br/>';
       #print $plugin->coderoot . "$include";
     }
   } else {
@@ -361,8 +389,8 @@
   print $GLOBALS["pagestats"]["number_of_queries"]." db queries in $elapsed seconds";
   print '</font>';
   if (isset($GLOBALS["statslog"])) {
-    if ($fp = fopen($GLOBALS["statslog"],"a")) {
-      fwrite($fp,getenv("REQUEST_URI")."\t".$GLOBALS["pagestats"]["number_of_queries"]."\t$elapsed\n");
+    if ($fp = @fopen($GLOBALS["statslog"],"a")) {
+      @fwrite($fp,getenv("REQUEST_URI")."\t".$GLOBALS["pagestats"]["number_of_queries"]."\t$elapsed\n");
     }
   }
 #  print '-->';
@@ -372,8 +400,10 @@
   ob_clean();
   exit;
 } elseif (!isset($_GET["omitall"])) {
-  ob_end_flush();
-  include "footer.inc";
+  if (!$GLOBALS['compression_used']) {
+    ob_end_flush();
+  }
+  include_once "footer.inc";
 }
 
 function parseCline() {
--- phplist-2.10.2/public_html/lists/admin/index.php	2005-10-27 18:29:56.000000000 -0700
+++ hostmaster/modules/massmailer/engines/phplist/phplist/admin/index.php	2006-03-13 21:31:27.000000000 -0800
@@ -47,9 +47,9 @@
 } elseif (isset($_ENV["CONFIG"]) && is_file($_ENV["CONFIG"])) {
 #  print '<!-- using '.$_ENV["CONFIG"].'-->'."\n";
   include $_ENV["CONFIG"];
-} elseif (is_file("../config/config.php")) {
-  print '<!-- using ../config/config.php -->'."\n";
-  include "../config/config.php";
+} elseif (is_file("../../config.php")) {
+  print '<!-- using ../../config.php -->'."\n";
+  include "../../config.php";
 } else {
   print "Error, cannot find config file\n";
   exit;
--- phplist-2.10.2/public_html/lists/admin/index.php	2005-10-27 18:29:56.000000000 -0700
+++ /home/john/hostmaster/modules/massmailer/engines/phplist/phplist/admin/index.php	2006-03-13 21:56:36.000000000 -0800
@@ -47,9 +47,9 @@
 } elseif (isset($_ENV["CONFIG"]) && is_file($_ENV["CONFIG"])) {
 #  print '<!-- using '.$_ENV["CONFIG"].'-->'."\n";
   include $_ENV["CONFIG"];
-} elseif (is_file("../config/config.php")) {
-  print '<!-- using ../config/config.php -->'."\n";
-  include "../config/config.php";
+} elseif (is_file("../../config.php")) {
+  print '<!-- using ../../config.php -->'."\n";
+  include "../../config.php";
 } else {
   print "Error, cannot find config file\n";
   exit;