path: root/cgi/manage.py

# coding=utf-8
import _mysql
import os
import cgi
import shutil
import imaplib
import poplib
import datetime

from database import *
from settings import Settings
from framework import *
from formatting import *
from template import *
from post import *

def manage(self, path_split):
  page = ''
  validated = False
  administrator = False
  moderator = True
  skiptemplate = False
  staff_account = None
  
  if 'username' in self.formdata and 'password' in self.formdata:
    # If no admin accounts available, create admin:admin
    first_admin = FetchOne("SELECT 1 FROM `staff` WHERE `rights` = 0 LIMIT 1", 0)
    if not first_admin:
      InsertDb("INSERT INTO `staff` (`username`, `password`, `added`, `rights`) VALUES ('admin', '" + _mysql.escape_string(genPasswdHash("admin")) + "', 0, 0)")

    staff_account = verifyPasswd(self.formdata['username'], self.formdata['password'])
    if staff_account:
      session_uuid = newSession(staff_account['id'])
      setCookie(self, 'weabot_manage', session_uuid)
      UpdateDb('DELETE FROM `logs` WHERE `timestamp` < ' + str(timestamp() - 604800)) # one week
    else:
      page += _('Incorrect username/password.')
      logAction('', 'Failed log-in. U:'+_mysql.escape_string(self.formdata['username'])+' IP:'+self.environ["REMOTE_ADDR"])
  else:
    # Validate existing session
    manage_cookie = getCookie(self, 'weabot_manage')
    if manage_cookie:
      staff_account = validateSession(manage_cookie)
      if not staff_account:
        page += "La sesión ha expirado. Por favor ingresa tus credenciales nuevamente."
        deleteCookie(self, 'weabot_manage')
  
  if staff_account:
    validated = True
    if 'session_id' in staff_account:
      renewSession(staff_account['session_id'])
    
    if staff_account['rights'] in ['0', '1', '2']:
      administrator = True
    if staff_account['rights'] == '2':
      moderator = False
    UpdateDb('UPDATE `staff` SET `lastactive` = ' + str(timestamp()) + ' WHERE `id` = ' + staff_account['id'] + ' LIMIT 1')
  
  if not validated:
    template_filename = "login.html"
    template_values = {}
  else:
    if len(path_split) > 2:
      if path_split[2] == 'rebuild':
        if not administrator:
          return
        
        try:
          board_dir = path_split[3]
        except:
          board_dir = ''
        
        if board_dir == '':
          template_filename = "rebuild.html"
          template_values = {'boards': boardlist()}
        else:
          everything = ("everything" in self.formdata)
          if board_dir == '!ALL':
            t1 = time.time()
            boards = FetchAll('SELECT `dir` FROM `boards` WHERE secret = 0')
            for board in boards:
              board = setBoard(board['dir'])
              regenerateBoard(everything)
            
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('all boards'), 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % _('all boards'))
          elif board_dir == '!BBS':
            t1 = time.time()
            boards = FetchAll('SELECT `dir` FROM `boards` WHERE `board_type` = 1')
            for board in boards:
              board = setBoard(board['dir'])
              regenerateBoard(everything)
            
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('all boards'), 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % _('all boards'))
          elif board_dir == '!IB':
            t1 = time.time()
            boards = FetchAll('SELECT `dir` FROM `boards` WHERE `board_type` = 1')
            for board in boards:
              board = setBoard(board['dir'])
              regenerateBoard(everything)
            
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('all boards'), 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % _('all boards'))
          elif board_dir == '!HOME':
            t1 = time.time()
            regenerateHome()
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('home'), 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % _('home'))
          elif board_dir == '!NEWS':
            t1 = time.time()
            regenerateNews()
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('news'), 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % _('news'))
          elif board_dir == '!KAKO':
            t1 = time.time()
            boards = FetchAll('SELECT `dir` FROM `boards` WHERE archive = 1')
            for board in boards:
              board = setBoard(board['dir'])
              regenerateKako()
            
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': 'kako', 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], _('Rebuilt %s') % 'kako')
          elif board_dir == '!HTACCESS':
            t1 = time.time()
            if regenerateAccess():
              message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': _('htaccess'), 'time': timeTaken(t1, time.time())}
              logAction(staff_account['username'], _('Rebuilt %s') % _('htaccess'))
            else:
              message = _('htaccess regeneration deactivated by sysop.')
          else:
            t1 = time.time()
            board = setBoard(board_dir)
            regenerateBoard(everything)
            
            message = _('Rebuilt %(board)s in %(time)s seconds.') % {'board': '/' + board['dir'] + '/', 'time': timeTaken(t1, time.time())}
            logAction(staff_account['username'], 'Rebuilt /' + board['dir'] + '/')
          
          template_filename = "message.html"
      elif path_split[2] == 'mod':
        if not moderator:
          return

        try:
          board = setBoard(path_split[3])
        except:
          board = ""

        if not board:
          template_filename = "mod.html"
          template_values = {"mode": 1, 'boards': boardlist()}
        elif self.formdata.get("thread"):
          parentid = int(self.formdata["thread"])
          posts = FetchAll('SELECT id, timestamp, timestamp_formatted, name, message, file, thumb, IS_DELETED, locked, subject, length, INET_NTOA(ip) AS ip FROM `posts` WHERE (parentid = %d OR id = %d) AND boardid = %s ORDER BY `id` ASC' % (parentid, parentid, board['id']))
          template_filename = "mod.html"
          template_values = {"mode": 3, "dir": board["dir"], "posts": posts}
        else:
          threads = FetchAll("SELECT * FROM `posts` WHERE boardid = %s AND parentid = 0 ORDER BY `bumped` DESC" % board["id"])
          template_filename = "mod.html"
          template_values = {"mode": 2, "dir": board["dir"], "threads": threads}
      elif path_split[2] == "recent":
          posts = FetchAll("SELECT posts.id, posts.subject, dir, boards.board_type, parentid, file, thumb, timestamp_formatted, timestamp, posts.message, INET_NTOA(ip) AS ip, posts.name, email, tripcode, boards.name AS board_name FROM posts INNER JOIN boards ON posts.boardid = boards.id WHERE posts.timestamp > UNIX_TIMESTAMP() - 86400 ORDER BY timestamp DESC")
          template_filename = "recent.html"
          template_values = {"posts": posts}
      elif path_split[2] == 'staff':
        if staff_account['rights'] != '0':
          return
        action_taken = False
        
        if len(path_split) > 3:
          if path_split[3] == 'add' or path_split[3] == 'edit':
            member = None
            member_username = ''
            member_rights = '3'
            
            if path_split[3] == 'edit':
              if len(path_split) > 4:
                member = FetchOne('SELECT * FROM `staff` WHERE `id` = ' + _mysql.escape_string(path_split[4]) + ' LIMIT 1')
                if member:
                  member_username = member['username']
                  member_rights = member['rights']
                  action = 'edit/' + member['id']
                  
                  try:
                    if self.formdata.get('user'):
                      if self.formdata['rights'] in ['0', '1', '2', '3']:
                        action_taken = True
                        
                        UpdateDb("UPDATE `staff` SET `username` = '" + _mysql.escape_string(self.formdata['user']) + "', `rights` = " + self.formdata['rights'] + " WHERE `id` = " + member['id'] + " LIMIT 1")
                        message = _('Staff member updated.')
                        logAction(staff_account['username'], _('Updated staff account for %s') % self.formdata['user'])
                        template_filename = "message.html"
                  except:
                    pass
            else:
              action = 'add'
              try:
                if self.formdata.get('user') and self.formdata.get('pass'):
                  username_taken = FetchOne('SELECT * FROM `staff` WHERE `username` = \'' + _mysql.escape_string(self.formdata['user']) + '\' LIMIT 1')
                  if not username_taken:
                    if self.formdata['rights'] in ['0', '1', '2', '3']:
                      action_taken = True
                      pass_hash = genPasswdHash(self.formdata['pass'])

                      InsertDb("INSERT INTO `staff` (`username`, `password`, `added`, `rights`) VALUES ('" + _mysql.escape_string(self.formdata['user']) + "', '" + _mysql.escape_string(pass_hash) + "', " + str(timestamp()) + ", " + self.formdata['rights'] + ")")
                      message = _('Staff member added.')
                      logAction(staff_account['username'], 'Added staff account for ' + self.formdata['user'])
                      
                      template_filename = "message.html"
                  else:
                    action_taken = True
                    message = _('That username is already in use.')
                    template_filename = "message.html"
              except:
                pass

            if not action_taken:
              action_taken = True

              if action == 'add':
                submit = 'Agregar'
              else:
                submit = 'Editar'
              
              template_filename = "staff.html"
              template_values = {'mode': 1,
				'action': action,
				'member': member,
				'member_username': member_username,
				'member_rights': member_rights,
				'submit': submit}
          elif path_split[3] == 'delete':
            if not moderator:
              return

            action_taken = True
            message = '<a href="' + Settings.CGI_URL + 'manage/staff/delete_confirmed/' + path_split[4] + '">' + _('Click here to confirm the deletion of that staff member') + '</a>'
            template_filename = "message.html"
          elif path_split[3] == 'delete_confirmed':
            if not moderator:
              return
              
            try:
              action_taken = True
              member = FetchOne('SELECT `username` FROM `staff` WHERE `id` = ' + _mysql.escape_string(path_split[4]) + ' LIMIT 1')
              if member:
                UpdateDb('DELETE FROM `staff` WHERE `id` = ' + _mysql.escape_string(path_split[4]) + ' LIMIT 1')
                message = 'Staff member deleted.'
                template_filename = "message.html"
                logAction(staff_account['username'], _('Deleted staff account for %s') % member['username'])
              else:
                message = _('Unable to locate a staff account with that ID.')
                template_filename = "message.html"
            except:
              pass
              
        if not action_taken:
          staff = FetchAll('SELECT * FROM `staff` ORDER BY `rights`')
          for member in staff:
            if member['rights'] == '0':
              member ['rights'] = _('Super-administrator')
            elif member['rights'] == '1':
              member ['rights'] = _('Administrator')
            elif member['rights'] == '2':
              member ['rights'] = _('Developer')
            elif member['rights'] == '3':
              member ['rights'] = _('Moderator')
            if member['lastactive'] != '0':
              member['lastactivestamp'] = member['lastactive']
              member['lastactive'] = formatTimestamp(member['lastactive'])
            else:
              member['lastactive'] = _('Never')
              member['lastactivestamp'] = '0'
          template_filename = "staff.html"
          template_values = {'mode': 0, 'staff': staff}
      elif path_split[2] == 'delete':
        if not moderator:
          return
          
        do_ban = False
        try:
          if self.formdata['ban'] == 'true':
            do_ban = True
        except:
          pass
        
        template_filename = "delete.html"
        template_values = {'do_ban': do_ban, 'curboard': path_split[3], 'postid': path_split[4]}
      elif path_split[2] == 'delete_confirmed':
        if not moderator:
          return
          
        do_ban = self.formdata.get('ban')
        permanently = self.formdata.get('perma')
        imageonly = self.formdata.get('imageonly')
        
        board = setBoard(path_split[3])
        postid = int(path_split[4])
        post = FetchOne('SELECT id, message, parentid, INET_NTOA(ip) AS ip FROM posts WHERE boardid = %s AND id = %s' % (board['id'], postid))
        
        if not permanently:
          deletePost(path_split[4], None, '2', imageonly)
        else:
          deletePost(path_split[4], None, '0', imageonly)
        regenerateHome()
            
        # Borrar denuncias
        UpdateDb("DELETE FROM `reports` WHERE `postid` = '"+_mysql.escape_string(path_split[4])+"'")
        boards = FetchAll('SELECT `name`, `dir` FROM `boards` ORDER BY `dir`')
      
        if imageonly:
          message = 'Archivo de post /%s/%s eliminado.' % (board['dir'], post['id'])
        elif permanently or post["parentid"] == '0':
          message = 'Post /%s/%s eliminado permanentemente.' % (board['dir'], post['id'])
        else:
          message = 'Post /%s/%s enviado a la papelera.' % (board['dir'], post['id'])
        template_filename = "message.html"
        logAction(staff_account['username'], message + ' Contenido: ' + post['message'] + ' IP: ' + post['ip'])
      
        if do_ban:
          message = _('Redirecting to ban page...') + '<meta http-equiv="refresh" content="0;url=' + Settings.CGI_URL + 'manage/ban?ip=' + post['ip'] + '" />'
          template_filename = "message.html"
      elif path_split[2] == 'lock':
        setLocked = 0
        
        # Nos vamos al board y ubicamos el post
        board = setBoard(path_split[3])
        post = FetchOne('SELECT `parentid`, `locked` FROM `posts` WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[4]) + '\' LIMIT 1')
        if not post:
          message = _('Unable to locate a post with that ID.')
          template_filename = "message.html"
        else:
          if post['parentid'] != '0':
            message = _('Post is not a thread opener.')
            template_filename = "message.html"
          else:
            if post['locked'] == '0':
              # Cerrar si esta abierto
              setLocked = 1
            else:
              # Abrir si esta cerrado
              setLocked = 0
            
            UpdateDb("UPDATE `posts` SET `locked` = %d WHERE `boardid` = '%s' AND `id` = '%s' LIMIT 1" % (setLocked, board["id"], _mysql.escape_string(path_split[4])))
            threadUpdated(path_split[4])
          if setLocked == 1:
            message = _('Thread successfully closed.')
            logAction(staff_account['username'], _('Closed thread %s') % ('/' + path_split[3] + '/' + path_split[4]))
          else:
            message = _('Thread successfully opened.')
            logAction(staff_account['username'], _('Opened thread %s') % ('/' + path_split[3] + '/' + path_split[4]))
          template_filename = "message.html"
      elif path_split[2] == 'permasage':
        setPermasaged = 0
        
        # Nos vamos al board y ubicamos el post
        board = setBoard(path_split[3])
        post = FetchOne('SELECT `parentid`, `locked` FROM `posts` WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[4]) + '\' LIMIT 1')
        if not post:
          message = 'Unable to locate a post with that ID.'
          template_filename = "message.html"
        elif post['locked'] == '1':
          message = 'Solo se puede aplicar permasage en un hilo abierto.'
          template_filename = "message.html"
        else:
          if post['parentid'] != '0':
            message = 'Post is not a thread opener.'
            template_filename = "message.html"
          else:
            if post['locked'] == '2':
              # Sacar permasage
              setPermasaged = 0
            else:
              # Colocar permasage
              setPermasaged = 2
            
            UpdateDb("UPDATE `posts` SET `locked` = %d WHERE `boardid` = '%s' AND `id` = '%s' LIMIT 1" % (setPermasaged, board["id"], _mysql.escape_string(path_split[4])))
            regenerateFrontPages()
            threadUpdated(path_split[4])
          
          if setPermasaged == 2:
            message = 'Thread successfully permasaged.'
            logAction(staff_account['username'], 'Enabled permasage in thread /' + path_split[3] + '/' + path_split[4])
          else:
            message = 'Thread successfully un-permasaged.'
            logAction(staff_account['username'], 'Disabled permasage in thread /' + path_split[3] + '/' + path_split[4])
          template_filename = "message.html"
      elif path_split[2] == 'move':
        if not moderator:
          return

        oldboardid = ""
        oldthread = ""
        newboardid = ""
        try:
          oldboardid = path_split[3]
          oldthread = path_split[4]
          newboardid = path_split[5]
        except:
          pass

        try:
          oldboardid = self.formdata['oldboardid']
          oldthread = self.formdata['oldthread']
          newboardid = self.formdata['newboardid']
        except:
          pass

        if oldboardid and oldthread and newboardid:
          message = "import"
          import shutil
          message += "ok"
          
          board = setBoard(oldboardid)
          oldboard = board['dir']
          oldboardsubject = board['subject']
          oldboardname = random.choice(board["anonymous"].split('|'))
          
          # get old posts
          posts = FetchAll("SELECT * FROM `posts` WHERE (`id` = {0} OR `parentid` = {0}) AND `boardid` = {1} ORDER BY id ASC".format(oldthread, board['id']))
          
          # switch to new board
          board = setBoard(newboardid)
          newboard = board['dir']
          
          refs = {}
          moved_files = []
          moved_thumbs = []
          moved_cats = []
          newthreadid = 0
          newthread = 0
          num = 1
          
          message = "from total: %s<br>" % len(posts)
          template_filename = "message.html"
          
          for p in posts:
            # save old post ID
            old_id = p['id']
            is_op = bool(p['parentid'] == '0')
            
            # copy post object but without ID and target boardid
            post = Post()
            post.post = p
            post.post.pop("id")
            post["boardid"] = board['id']
            post["parentid"] = newthreadid
            
            # save the files we need to move if any
            if post['IS_DELETED'] == '0':
              if post['file']:
                moved_files.append(post['file'])
              if post['thumb']:
                moved_thumbs.append(post['thumb'])
                if is_op:
                  moved_cats.append(post['thumb'])

            # fix subject if necessary
            if post['subject'] and post['subject'] == oldboardsubject:
              post['subject'] = board['subject']

            # fix new default name
            if post['name'] == oldboardname:
              post['name'] = board['anonymous']

            # fix date and (re)add post ID if necessary
            post['timestamp_formatted'] = formatTimestamp(post['timestamp'])
            if board["useid"] != '0':
              if post["parentid"]:
                tym = parent_time
              else:
                tym = post["timestamp"]
              post['timestamp_formatted'] += ' ID:' + iphash(inet_ntoa(long(post['ip'])), post, tym, board["useid"], False, '', False, False, (board["countrycode"] in ['1', '2']))

            # insert new post and get its new ID
            new_id = post.insert()

            # save the reference (BBS = post number, IB = new ID)
            refs[old_id] = num if board['board_type'] == '1' else new_id

            # this was an OP
            message += "newthread = %s parentid = %s<br>" % (newthreadid, p['parentid'])
            if is_op:
              oldthread = old_id
              newthreadid = new_id
              oldbumped = post["bumped"]
              
              # BBS = new thread timestamp, IB = new thread ID
              newthread = post['timestamp'] if board['board_type'] == '1' else new_id
              parent_time = post['timestamp']
            
            # log it
            message += "%s -> %s<br>" % (old_id, new_id)
            
            num += 1
            
          # fix anchors
          for old, new in refs.iteritems():
            old_url = "/{oldboard}/res/{oldthread}.html#{oldpost}\">&gt;&gt;{oldpost}</a>".format(oldboard=oldboard, oldthread=oldthread, oldpost=old)
            
            if board['board_type'] == '1':
              new_url = "/{newboard}/read/{newthread}/{newpost}\">&gt;&gt;{newpost}</a>".format(newboard=newboard, newthread=newthread, newpost=new)
            else:
              new_url = "/{newboard}/res/{newthread}.html#{newpost}\">&gt;&gt;{newpost}</a>".format(newboard=newboard, newthread=newthread, newpost=new)
            
            sql = "UPDATE `posts` SET `message` = REPLACE(message, '{old}', '{new}') WHERE `boardid` = {newboardid} AND (`id` = {newthreadid} OR `parentid` = {newthreadid})".format(old=old_url, new=new_url, newboardid=board['id'], newthreadid=newthreadid)
            message += sql + "<br>"
            UpdateDb(sql)
          
          # copy files
          for file in moved_files:
            if not os.path.isfile(Settings.IMAGES_DIR + newboard + "/src/" + file):
              shutil.copyfile(Settings.IMAGES_DIR + oldboard + "/src/" + file, Settings.IMAGES_DIR + newboard + "/src/" + file)
          for thumb in moved_thumbs:
            if not os.path.isfile(Settings.IMAGES_DIR + newboard + "/thumb/" + thumb):
              shutil.copyfile(Settings.IMAGES_DIR + oldboard + "/thumb/" + thumb, Settings.IMAGES_DIR + newboard + "/thumb/" + thumb)
            if not os.path.isfile(Settings.IMAGES_DIR + newboard + "/mobile/" + thumb):
              shutil.copyfile(Settings.IMAGES_DIR + oldboard + "/mobile/" + thumb, Settings.IMAGES_DIR + newboard + "/mobile/" + thumb)
          for cat in moved_cats:
            try:
              if not os.path.isfile(Settings.IMAGES_DIR + newboard + "/cat/" + thumb):
                shutil.copyfile(Settings.IMAGES_DIR + oldboard + "/cat/" + thumb, Settings.IMAGES_DIR + newboard + "/cat/" + thumb)
            except:
              pass

          # lock original, set expiration to 1 day
          exp = timestamp()+86400
          exp_format = datetime.datetime.fromtimestamp(exp).strftime("%d/%m")
          sql = "UPDATE `posts` SET `locked`=1, `expires`={exp}, `expires_formatted`=\"{exp_format}\" WHERE `boardid`=\"{oldboard}\" AND id=\"{oldthread}\"".format(exp=exp,exp_format=exp_format,oldboard=oldboardid,oldthread=oldthread)
          UpdateDb(sql)
       
          # insert notice message
          if 'msg' in self.formdata:
            leavemsg = True
            board = setBoard(oldboard)
            
            if board['board_type'] == '1':
              thread_url = "/{newboard}/read/{newthread}".format(newboard=newboard, newthread=newthread)
            else:
              thread_url = "/{newboard}/res/{newthread}.html".format(newboard=newboard, newthread=newthread)
            
            notice_post = Post(board["id"])
            notice_post["parentid"] = oldthread
            if board['board_type'] == "0":
              notice_post["subject"] = "Aviso"
            notice_post["name"] = "Sistema"
            notice_post["message"] = "El hilo ha sido movido a <a href=\"{url}\">/{newboard}/{newthread}</a>.".format(url=thread_url, newboard=newboard, newthread=newthread)
            notice_post["timestamp"] = timestamp()+1
            notice_post["timestamp_formatted"] = "Hilo movido"
            notice_post["bumped"] = oldbumped
            notice_post.insert()
            regenerateFrontPages()
            regenerateThreadPage(oldthread)
            
          # regenerate again (fix?)
          board = setBoard(newboardid)
          regenerateFrontPages()
          regenerateThreadPage(newthreadid)

          message += "done"
          
          logAction(staff_account['username'], "Movido hilo %s/%s a %s/%s." % (oldboard, oldthread, newboard, newthread))
        else:
          template_filename = "move.html"
          template_values = {'boards': boardlist(), 'oldboardid': oldboardid, 'oldthread': oldthread}
      elif path_split[2] == 'ban':
        if not moderator:
          return
      
        if len(path_split) > 4:
          board = setBoard(path_split[3])
          post = FetchOne('SELECT `ip` FROM `posts` WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[4]) + '\' LIMIT 1')
          formatted_ip = inet_ntoa(long(post['ip']))
          #Creo que esto no deberia ir aqui... -> UpdateDb('UPDATE `posts` SET `banned` = 1 WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[4]) + '\'')
          if not post:
            message = _('Unable to locate a post with that ID.')
            template_filename = "message.html"
          else:
            message = '<meta http-equiv="refresh" content="0;url=' + Settings.CGI_URL + 'manage/ban?ip=' + formatted_ip + '" />Espere...'
            template_filename = "message.html"
        else:
          #if path_split[3] == '':
          try:
            ip = self.formdata['ip']
          except:
            ip = ''
          try:
            netmask = insnetmask = self.formdata['netmask']
            if netmask == '255.255.255.255':
              insnetmask = ''
          except:
            netmask = instnetmask = ''
          #else:
          #  ip = path_split[3]
          if ip != '':
            try:
              reason = self.formdata['reason']
            except:
              reason = None
            if reason is not None:
              if self.formdata['seconds'] != '0':
                until = str(timestamp() + int(self.formdata['seconds']))
              else:
                until = '0'
              where = ''
              if 'board_all' not in self.formdata.keys():
                where = []
                boards = FetchAll('SELECT `dir` FROM `boards`')
                for board in boards:
                  keyname = 'board_' + board['dir']
                  if keyname in self.formdata.keys():
                    if self.formdata[keyname] == "1":
                      where.append(board['dir'])
                if len(where) > 0:
                  where = pickle.dumps(where)
                else:
                  self.error(_("You must select where the ban shall be placed"))
                  return

              if 'edit' in self.formdata.keys():
                UpdateDb("DELETE FROM `bans` WHERE `id` = '" + _mysql.escape_string(self.formdata['edit']) + "' LIMIT 1")
              else:
                ban = FetchOne("SELECT `id` FROM `bans` WHERE `ip` = '" + _mysql.escape_string(ip) + "' AND `boards` = '" + _mysql.escape_string(where) + "' LIMIT 1")
                if ban:
                  self.error(_('There is already an identical ban for this IP.') + '<a href="'+Settings.CGI_URL+'manage/ban/' + ip + '?edit=' + ban['id']+'">' + _('Edit') + '</a>')
                  return
              
              # Blind mode
              if 'blind' in self.formdata.keys() and self.formdata['blind'] == '1':
                blind = '1'
              else:
                blind = '0'
              
              # Banear sin mensaje
              InsertDb("INSERT INTO `bans` (`ip`, `netmask`, `boards`, `added`, `until`, `staff`, `reason`, `note`, `blind`) VALUES (INET_ATON('" + _mysql.escape_string(ip) + "') & INET_ATON('"+_mysql.escape_string(netmask)+"'), INET_ATON('"+_mysql.escape_string(insnetmask)+"'), '" + _mysql.escape_string(where) + "', " + str(timestamp()) + ", " + until + ", '" + _mysql.escape_string(staff_account['username']) + "', '" + _mysql.escape_string(self.formdata['reason']) + "', '" + _mysql.escape_string(self.formdata['note']) + "', '"+blind+"')")
              
              regenerateAccess()
              if 'edit' in self.formdata.keys():
                message = _('Ban successfully edited.')
                action = 'Edited ban for ' + ip
              else:
                message = _('Ban successfully placed.')
                action = 'Banned ' + ip
                if until != '0':
                  action += ' until ' + formatTimestamp(until)
                else:
                  action += ' permanently'
              logAction(staff_account['username'], action)
              template_filename = 'message.html'
            else:
              startvalues = {'where': [],
                             'netmask': '255.255.255.255',
                             'reason': '',
                             'note': '',
                             'message': '(GET OUT)',
                             'seconds': '0',
                             'blind': '1'}
              edit_id = 0
              if 'edit' in self.formdata.keys():
                edit_id = self.formdata['edit']
                ban = FetchOne("SELECT `id`, INET_NTOA(`ip`) AS 'ip', CASE WHEN `netmask` IS NULL THEN '255.255.255.255' ELSE INET_NTOA(`netmask`) END AS 'netmask', boards, added, until, staff, reason, note, blind FROM `bans` WHERE `id` = '" + _mysql.escape_string(edit_id) + "' ORDER BY `added` DESC")
                if ban:
                  if ban['boards'] == '':
                    where = ''
                  else:
                    where = pickle.loads(ban['boards'])
                  if ban['until'] == '0':
                    until = 0
                  else:
                    until = int(ban['until']) - timestamp()
                  startvalues = {'where': where,
                    'netmask': ban['netmask'],
                    'reason': ban['reason'],
                    'note': ban['note'],
                    'seconds': str(until),
                    'blind': ban['blind']
                  }
                else:
                  edit_id = 0
              
              template_filename = "bans.html"
              template_values = {'mode': 1,
                'boards': boardlist(),
                'ip': ip,
                'startvalues': startvalues,
                'edit_id': edit_id}
      elif path_split[2] == 'bans':
        if not moderator:
          return
          
        action_taken = False
        if len(path_split) > 4:
          if path_split[3] == 'delete':
            ip = FetchOne("SELECT INET_NTOA(`ip`) AS 'ip' FROM `bans` WHERE `id` = '" + _mysql.escape_string(path_split[4]) + "' LIMIT 1", 0)[0]
            if ip != '':
              # Delete ban
              UpdateDb('DELETE FROM `bans` WHERE `id` = ' + _mysql.escape_string(path_split[4]) + ' LIMIT 1')
              regenerateAccess()
              message = _('Ban successfully deleted.')
              template_filename = "message.html"
              logAction(staff_account['username'], _('Deleted ban for %s') % ip)
            else:
              message = _('There was a problem while deleting that ban.  It may have already been removed, or recently expired.')
              template_filename = "message.html"
            
        if not action_taken:
          bans = FetchAll("SELECT `id`, INET_NTOA(`ip`) AS 'ip', CASE WHEN `netmask` IS NULL THEN '255.255.255.255' ELSE INET_NTOA(`netmask`) END AS 'netmask', boards, added, until, staff, reason, note, blind FROM `bans` ORDER BY `added` DESC")
          if bans:
            for ban in bans:
              if ban['boards'] == '':
                ban['boards'] = _('All boards')
              else:
                where = pickle.loads(ban['boards'])
                if len(where) > 1:
                  ban['boards'] = '/' + '/, /'.join(where) + '/'
                else:
                  ban['boards'] = '/' + where[0] + '/'
              ban['added'] = formatTimestamp(ban['added'])
              if ban['until'] == '0':
                ban['until'] = _('Does not expire')
              else:
                ban['until'] = formatTimestamp(ban['until'])
              if ban['blind'] == '1':
                ban['blind'] = 'Sí'
              else:
                ban['blind'] = 'No'
          template_filename = "bans.html"
          template_values = {'mode': 0, 'bans': bans}
      elif path_split[2] == 'changepassword':
        form_submitted = False
        try:
          if self.formdata['oldpassword'] != '' and self.formdata['newpassword'] != '' and self.formdata['newpassword2'] != '':
            form_submitted = True
        except:
          pass
        if form_submitted:
          if verifyPasswd(staff_account['username'], self.formdata['oldpassword']):
            if self.formdata['newpassword'] == self.formdata['newpassword2']:
              UpdateDb('UPDATE `staff` SET `password` = \'' + genPasswdHash(self.formdata['newpassword']) + '\' WHERE `id` = ' + staff_account['id'] + ' LIMIT 1')
              message = _('Password successfully changed.  Please log out and log back in.')
              template_filename = "message.html"
            else:
              message = _('Passwords did not match.')
              template_filename = "message.html"
          else:
            message = _('Current password incorrect.')
            template_filename = "message.html"
        else:
          template_filename = "changepassword.html"
          template_values = {}
      elif path_split[2] == 'board':
        if not administrator:
          return
        
        if len(path_split) > 3:
          board = setBoard(path_split[3])
          form_submitted = False
          try:
            if self.formdata['name'] != '':
              form_submitted = True
          except:
            pass
          if form_submitted:
            # Update board settings
            board['name'] = self.formdata['name']
            board['longname'] = self.formdata['longname']
            board['subname'] = self.formdata['subname']
            board['anonymous'] = self.formdata['anonymous']
            board['subject'] = self.formdata['subject']
            board['message'] = self.formdata['message']
            switchBoard(self.formdata['type'])
            board['board_type'] = self.formdata['type']
            board['useid'] = self.formdata['useid']
            board['slip'] = self.formdata['slip']
            board['countrycode'] = self.formdata['countrycode']
            if 'recyclebin' in self.formdata.keys():
              board['recyclebin'] = '1'
            else:
              board['recyclebin'] = '0'
            if 'disable_name' in self.formdata.keys():
              board['disable_name'] = '1'
            else:
              board['disable_name'] = '0'
            if 'disable_subject' in self.formdata.keys():
              board['disable_subject'] = '1'
            else:
              board['disable_subject'] = '0'
            if 'secret' in self.formdata.keys():
              board['secret'] = '1'
            else:
              board['secret'] = '0'
            if 'locked' in self.formdata.keys():
              board['locked'] = '1'
            else:
              board['locked'] = '0'
            board['postarea_desc'] = self.formdata['postarea_desc']
            if 'allow_noimage' in self.formdata.keys():
              board['allow_noimage'] = '1'
            else:
              board['allow_noimage'] = '0'
            if 'allow_images' in self.formdata.keys():
              board['allow_images'] = '1'
            else:
              board['allow_images'] = '0'
            if 'allow_image_replies' in self.formdata.keys():
              board['allow_image_replies'] = '1'
            else:
              board['allow_image_replies'] = '0'
            if 'allow_spoilers' in self.formdata.keys():
              board['allow_spoilers'] = '1'
            else:
              board['allow_spoilers'] = '0'
            if 'allow_oekaki' in self.formdata.keys():
              board['allow_oekaki'] = '1'
            else:
              board['allow_oekaki'] = '0'
            if 'archive' in self.formdata.keys():
              board['archive'] = '1'
            else:
              board['archive'] = '0'
            board['postarea_extra'] = self.formdata['postarea_extra']
            board['force_css'] = self.formdata['force_css']
            
            # Update file types
            UpdateDb("DELETE FROM `boards_filetypes` WHERE `boardid` = %s" % board['id'])
            for filetype in filetypelist():
              if 'filetype'+filetype['ext'] in self.formdata.keys():
                UpdateDb("INSERT INTO `boards_filetypes` VALUES (%s, %s)" % (board['id'], filetype['id']))

            try:
              board['numthreads'] = int(self.formdata['numthreads'])
            except:
              raise UserError, _("Max threads shown must be numeric.")

            try:
              board['numcont'] = int(self.formdata['numcont'])
            except:
              raise UserError, _("Max replies shown must be numeric.")

            try:
              board['numline'] = int(self.formdata['numline'])
            except:
              raise UserError, _("Max lines shown must be numeric.")

            try:
              board['thumb_px'] = int(self.formdata['thumb_px'])
            except:
              raise UserError, _("Max thumb dimensions must be numeric.")
              
            try:
              board['maxsize'] = int(self.formdata['maxsize'])
            except:
              raise UserError, _("Max size must be numeric.")
              
            try:
              board['maxage'] = int(self.formdata['maxage'])
            except:
              raise UserError, _("Max age must be numeric.")
            
            try:
              board['maxinactive'] = int(self.formdata['maxinactive'])
            except:
              raise UserError, _("Max inactivity must be numeric.")

            try:
              board['threadsecs'] = int(self.formdata['threadsecs'])
            except:
              raise UserError, _("Time between new threads must be numeric.")

            try:
              board['postsecs'] = int(self.formdata['postsecs'])
            except:
              raise UserError, _("Time between replies must be numeric.")

            updateBoardSettings()
            message = _('Board options successfully updated.') + ' <a href="'+Settings.CGI_URL+'manage/rebuild/'+board['dir']+'">'+_('Rebuild')+'</a>'
            template_filename = "message.html"
            logAction(staff_account['username'], _('Updated options for /%s/') % board['dir'])
          else:
            template_filename = "boardoptions.html"
            template_values = {'mode': 1, 'boardopts': board, 'filetypes': filetypelist(), 'supported_filetypes': board['filetypes_ext']}
        else:
          # List all boards
          template_filename = "boardoptions.html"
          template_values = {'mode': 0, 'boards': boardlist()}
      elif path_split[2] == 'recyclebin':
        if not administrator:
          return
        
        message = None
        if len(path_split) > 5:
          if path_split[4] == 'restore':
            board = setBoard(path_split[5])

            post = FetchOne('SELECT `parentid` FROM `posts` WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[6]) + '\' LIMIT 1')
            if not post:
              message = _('Unable to locate a post with that ID.') + '<br />'
              template_filename = "message.html"
            else:
              UpdateDb('UPDATE `posts` SET `IS_DELETED` = 0 WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[6]) + '\' LIMIT 1')
              if post['parentid'] != '0':
                threadUpdated(post['parentid'])
              else:
                regenerateFrontPages()
                
              message = _('Post successfully restored.')
              logAction(staff_account['username'], _('Restored post %s') % ('/' + path_split[5] + '/' + path_split[6]))
            
          if path_split[4] == 'delete':
            board = setBoard(path_split[5])
            post = FetchOne('SELECT id, parentid, message, INET_NTOA(ip) AS ip FROM `posts` WHERE `boardid` = ' + board['id'] + ' AND `id` = \'' + _mysql.escape_string(path_split[6]) + '\' LIMIT 1')
            if not post:
              message = _('Unable to locate a post with that ID.')
            else:
              deletePost(path_split[6], None)
              
              if post['parentid'] != '0':
                threadUpdated(post['parentid'])
              else:
                regenerateFrontPages()
                
              message = "Eliminado post %s permanentemente." % ('/' + board['dir'] + '/' + post['id'])
              logAction(staff_account['username'], message + ' Contenido: ' + post['message'] + ' IP: ' + post['ip'])
        
        # Delete more than 1 post
        if 'deleteall' in self.formdata.keys():
          return # TODO
          deleted = 0
          for key in self.formdata.keys():
            if key[:2] == '!i':
              dir = key[2:].split('/')[0] # Board where the post is
              postid = key[2:].split('/')[1] # Post to delete
              
              # Delete post start
              post = FetchOne('SELECT `parentid`, `dir` FROM `posts` INNER JOIN `boards` ON posts.boardid = boards.id WHERE `dir` = \'' + _mysql.escape_string(dir) + '\' AND posts.id = \'' + _mysql.escape_string(postid) + '\' LIMIT 1')
              if not post:
                message = _('Unable to locate a post with that ID.')
              else:
                board = setBoard(dir)
                deletePost(int(postid), None)
                if post['parentid'] != '0':
                  threadUpdated(post['parentid'])
                else:
                  regenerateFrontPages()
                deleted += 1
              # Delete post end
          
          logAction(staff_account['username'], _('Permadeleted %s post(s).') % str(deleted))
          message = _('Permadeleted %s post(s).') % str(deleted)
        
        ## Start
        import math
        pagesize = float(Settings.RECYCLEBIN_POSTS_PER_PAGE)
        
        try:
          currentpage = int(path_split[3])
        except:
          currentpage = 0
        
        skip = False
        if 'type' in self.formdata.keys():
          type = int(self.formdata["type"])
        else:
          type = 0
        
        # Generate board list
        boards = FetchAll('SELECT `name`, `dir` FROM `boards` ORDER BY `dir`')
        for board in boards:
          if 'board' in self.formdata.keys() and self.formdata['board'] == board['dir']:
            board['checked'] = True
          else:
            board['checked'] = False
        
        # Get type filter
        if type != 0:
          type_condition = "= " + str(type)
        else:
          type_condition = "!= 0"
        
        # Table
        if 'board' in self.formdata.keys() and self.formdata['board'] != 'all':
          cboard = self.formdata['board']
          posts = FetchAll("SELECT posts.id, posts.timestamp, timestamp_formatted, IS_DELETED, INET_NTOA(posts.ip) as ip, posts.message, dir, boardid FROM `posts` INNER JOIN `boards` ON boardid = boards.id WHERE `dir` = '%s' AND IS_DELETED %s ORDER BY `timestamp` DESC LIMIT %d, %d" % (_mysql.escape_string(self.formdata['board']), _mysql.escape_string(type_condition), currentpage*pagesize, pagesize))
          try:
            totals = FetchOne("SELECT COUNT(id) FROM `posts` WHERE IS_DELETED %s AND `boardid` = %s" % (_mysql.escape_string(type_condition), _mysql.escape_string(posts[0]['boardid'])), 0)
          except:
            skip = True
        else:
          cboard = 'all'
          posts = FetchAll("SELECT posts.id, posts.timestamp, timestamp_formatted, IS_DELETED, posts.ip, posts.message, dir FROM `posts` INNER JOIN `boards` ON boardid = boards.id WHERE IS_DELETED %s ORDER BY `timestamp` DESC LIMIT %d, %d" % (_mysql.escape_string(type_condition), currentpage*pagesize, pagesize))
          totals = FetchOne("SELECT COUNT(id) FROM `posts` WHERE IS_DELETED %s" % _mysql.escape_string(type_condition), 0)
        
        template_filename = "recyclebin.html"
        template_values = {'message': message,
         'type': type,
         'boards': boards,
         'skip': skip}
       
        if not skip:
          # Calculate number of pages
          total = int(totals[0])
          pages = int(math.ceil(total / pagesize))
          
          # Create delete form
          if 'board' in self.formdata.keys():
            board = self.formdata['board']
          else:
            board = None
          
          navigator = ''
          if currentpage > 0:
            navigator += '<a href="'+Settings.CGI_URL+'manage/recyclebin/'+str(currentpage-1)+'?type='+str(type)+'&amp;board='+cboard+'">&lt;</a> '
          else:
            navigator += '&lt; '
          
          for i in range(pages):
            if i != currentpage:
              navigator += '<a href="'+Settings.CGI_URL+'manage/recyclebin/'+str(i)+'?type='+str(type)+'&amp;board='+cboard+'">'+str(i)+'</a> '
            else:
              navigator += str(i)+' '
            
          if currentpage < (pages-1):
            navigator += '<a href="'+Settings.CGI_URL+'manage/recyclebin/'+str(currentpage+1)+'?type='+str(type)+'&amp;board='+cboard+'">&gt;</a> '
          else:
            navigator += '&gt; '
          
          template_values.update({'currentpage': currentpage,
            'curboard': board,
            'posts': posts,
            'navigator': navigator})
        # End recyclebin
      elif path_split[2] == 'lockboard':
        if not administrator:
          return
        
        try:
          board_dir = path_split[3]
        except:
          board_dir = ''
        
        if board_dir == '':
          template_filename = "lockboard.html"
          template_values = {'boards': boardlist()}
      elif path_split[2] == 'boardlock':
        board = setBoard(path_split[3])
        if int(board['locked']):
          # Si esta cerrado... abrir
          board['locked'] = 0
          updateBoardSettings()
          message = _('Board opened successfully.')
          template_filename = "message.html"
        else:
          # Si esta abierta, cerrar
          board['locked'] = 1
          updateBoardSettings()
          message = _('Board closed successfully.')
          template_filename = "message.html"
      elif path_split[2] == 'addboard':
        if not administrator:
          return
        
        action_taken = False
        board_dir = ''
        
        try:
          if self.formdata['name'] != '':
            board_dir = self.formdata['dir']
        except:
          pass

        if board_dir != '':
          action_taken = True
          board_exists = FetchOne('SELECT * FROM `boards` WHERE `dir` = \'' + _mysql.escape_string(board_dir) + '\' LIMIT 1')
          if not board_exists:
            os.mkdir(Settings.ROOT_DIR + board_dir)
            os.mkdir(Settings.ROOT_DIR + board_dir + '/res')
            if not os.path.exists(Settings.IMAGES_DIR + board_dir):
              os.mkdir(Settings.IMAGES_DIR + board_dir)
            os.mkdir(Settings.IMAGES_DIR + board_dir + '/src')
            os.mkdir(Settings.IMAGES_DIR + board_dir + '/thumb')
            os.mkdir(Settings.IMAGES_DIR + board_dir + '/mobile')
            os.mkdir(Settings.IMAGES_DIR + board_dir + '/cat')
            if os.path.exists(Settings.ROOT_DIR + board_dir) and os.path.isdir(Settings.ROOT_DIR + board_dir):
              UpdateDb('INSERT INTO `boards` (`dir`, `name`) VALUES (\'' + _mysql.escape_string(board_dir) + '\', \'' + _mysql.escape_string(self.formdata['name']) + '\')')
              board = setBoard(board_dir)
              f = open(Settings.ROOT_DIR + board['dir'] + '/.htaccess', 'w')
              try:
                f.write('DirectoryIndex index.html')
              finally:
                f.close()
              regenerateFrontPages()
              message = _('Board added')
              template_filename = "message.html"
              logAction(staff_account['username'], _('Added board %s') % ('/' + board['dir'] + '/'))
            else:
              message = _('There was a problem while making the directories.')
              template_filename = "message.html"
          else:
            message = _('There is already a board with that directory.')
            template_filename = "message.html"

        if not action_taken:
          template_filename = "addboard.html"
          template_values = {}
      elif path_split[2] == 'trim':
        if not administrator:
          return
        board = setBoard(path_split[3])
        trimThreads()
        self.output = "done trimming"
        return
      elif path_split[2] == 'setexpires':
        board = setBoard(path_split[3])
        parentid = int(path_split[4])
        days = int(path_split[5])
        t = time.time()
        
        expires = int(t) + (days * 86400)
        date_format = '%d/%m'
        expires_formatted = datetime.datetime.fromtimestamp(expires).strftime(date_format)
        
        sql = "UPDATE posts SET expires = timestamp + (%s * 86400), expires_formatted = FROM_UNIXTIME((timestamp + (%s * 86400)), '%s') WHERE boardid = %s AND id = %s" % (str(days), str(days), date_format, board["id"], str(parentid))
        UpdateDb(sql)
        
        self.output = "done " + sql
        return
      elif path_split[2] == 'fixflood':
        if not administrator:
          return
        board = setBoard('zonavip')
        threads = FetchAll("SELECT * FROM posts WHERE boardid = %s AND parentid = 0 AND subject LIKE 'querido mod%%'" % board['id'])
        for thread in threads:
          self.output += "%s<br>" % thread['id']
          #deletePost(thread['id'], None)
        return
      elif path_split[2] == 'fixico':
        board = setBoard(path_split[3])
        
        threads = FetchAll("SELECT * FROM posts WHERE boardid = %s AND parentid = 0 AND message NOT LIKE '<img%%'" % board['id'])
        for t in threads:
          img_src = '<img src="%s" alt="ico" /><br />' % getRandomIco()
          newmessage = img_src + t["message"]
          #UpdateDb("UPDATE posts SET message = '%s' WHERE boardid = %s AND id = %s" % (_mysql.escape_string(newmessage), board['id'], t['id']))
          
        self.output = repr(threads)
        return
      elif path_split[2] == 'fixkako':
        board = setBoard(path_split[3])
        
        threads = FetchAll('SELECT * FROM archive WHERE boardid = %s ORDER BY timestamp DESC' % board['id'])
        for item in threads:
          t = time.time()
          self.output += item['timestamp'] + '<br />'
          fname = Settings.ROOT_DIR + board["dir"] + "/kako/" + str(item["timestamp"]) + ".json"
          if os.path.isfile(fname):
            import json
            with open(fname) as f:
              thread = json.load(f)
            thread['posts'] = [dict(zip(thread['keys'], row)) for row in thread['posts']]
            template_fname = "txt_archive.html"
            
            post_preview = cut_home_msg(thread['posts'][0]['message'], 0)
            page = renderTemplate("txt_archive.html", {"threads": [thread], "preview": post_preview}, False)
            with open(Settings.ROOT_DIR + board["dir"] + "/kako/" + str(thread['timestamp']) + ".html", "w") as f:
              f.write(page)
              
            self.output += 'done' + str(time.time() - t) + '<br />'
          else:
            self.output += 'El hilo no existe.<br />'
      elif path_split[2] == 'fixexpires':
        board = setBoard(path_split[3])
        
        if int(board["maxage"]):
          date_format = '%d/%m'
          date_format_y = '%m/%Y'
          if int(board["maxage"]) >= 365:
            date_format = date_format_y
          sql = "UPDATE posts SET expires = timestamp + (%s * 86400), expires_formatted = FROM_UNIXTIME((timestamp + (%s * 86400)), '%s') WHERE boardid = %s AND parentid = 0" % (board["maxage"], board["maxage"], date_format, board["id"])
          UpdateDb(sql)
        
          alert_time = int(round(int(board['maxage']) * Settings.MAX_AGE_ALERT))
          sql = "UPDATE posts SET expires_alert = CASE WHEN UNIX_TIMESTAMP() > (expires - %d*86400) THEN 1 ELSE 0 END WHERE boardid = %s AND parentid = 0" % (alert_time, board["id"])
          UpdateDb(sql)
        else:
          sql = "UPDATE posts SET expires = 0, expires_formatted = '', expires_alert = 0 WHERE boardid = %s AND parentid = 0" % (board["id"])
          UpdateDb(sql)
        
        self.output = "done"
        return
      elif path_split[2] == 'fixid':
        board = setBoard(path_split[3])
        posts = FetchAll('SELECT * FROM `posts` WHERE `boardid` = %s' % board['id'])
        self.output = "total: %d<br />" % len(posts)
        for post in posts:
          new_timestamp_formatted = formatTimestamp(post['timestamp'])
          tim = 0
          if board["useid"] != '0':
            new_timestamp_formatted += ' ID:' + iphash(post['ip'], '', tim, '1', False, False, False, '0')
          self.output += "%s - %s <br />" % (post['id'], new_timestamp_formatted)
          query = "UPDATE `posts` SET timestamp_formatted = '%s' WHERE boardid = '%s' AND id = '%s'" % (new_timestamp_formatted, board['id'], post['id'])
          UpdateDb(query)
        return
      elif path_split[2] == 'fixname':
        board = setBoard(path_split[3])
        #posts = FetchAll('SELECT * FROM `posts` WHERE `boardid` = %s' % board['id'])
        posts = FetchAll('SELECT * FROM `posts` WHERE `name` LIKE \'%s\'' % '%%')
        new_name = board['anonymous']
        self.output = new_name + "<br />"
        for post in posts:
          self.output += "%s<br />" % (post['id'])
          query = "UPDATE `posts` SET `name` = '%s' WHERE boardid = '%s' AND id = '%s'" % (new_name, board['id'], post['id'])
          UpdateDb(query)
        return
      elif path_split[2] == 'setsub':
        board = setBoard(path_split[3])
        thread = FetchOne('SELECT * FROM `posts` WHERE `parentid` = 0 AND `boardid` = %s' % board['id'])
        subject = str(path_split[4])
        self.output = subject + "->" + thread['id'] + "<br />"
        query = "UPDATE `posts` SET `subject` = '%s' WHERE boardid = '%s' AND id = '%s'" % (subject, board['id'], thread['id'])
        UpdateDb(query)
        return
      elif path_split[2] == 'fixlength':
        board = setBoard(path_split[3])
        threads = FetchAll('SELECT * FROM `posts` WHERE parentid = 0 AND `boardid` = %s' % board['id'])
        for t in threads:
          length = threadNumReplies(t['id'])
          UpdateDb('UPDATE posts SET length = %d WHERE boardid = %s AND id = %s' % (length, board['id'], t['id']))
        
        self.output='done'
        return
      elif path_split[2] == 'archive':
        t = time.time()
        board = setBoard(path_split[3])
        postid = int(path_split[4])
        archiveThread(postid)
        self.output = "todo ok %s" % str(time.time() - t)
      elif path_split[2] == 'filters':
        action_taken = False
        if len(path_split) > 3 and path_split[3] == 'add':
          if "add" in self.formdata.keys():
            edit_id = 0
            if 'edit' in self.formdata.keys():
              edit_id = int(self.formdata['edit'])
            
            # We decide what type of filter it is.
            # 0: Word / 1: Name/Trip
            filter_type = int(self.formdata["type"])
            filter_action = int(self.formdata["action"])
            filter_from = ''
            filter_tripcode = ''
            
            # I don't like pickles... oh well.
            where = ''
            if 'board_all' not in self.formdata.keys():
              where = []
              boards = FetchAll('SELECT `dir` FROM `boards`')
              for board in boards:
                keyname = 'board_' + board['dir']
                if keyname in self.formdata.keys():
                  if self.formdata[keyname] == "1":
                    where.append(board['dir'])
              if len(where) > 0:
                where = _mysql.escape_string(pickle.dumps(where))
              else:
                self.error(_("You must select what board the filter will affect"))
                return
            
            if filter_type == 0:
              # Word filter
              if len(self.formdata["word"]) > 0:
                filter_from = _mysql.escape_string(cgi.escape(self.formdata["word"]))
              else:
                self.error(_("You must enter a word."))
                return
            elif filter_type == 1:
              # Name/trip filter
              can_add = False
              if len(self.formdata["name"]) > 0:
                filter_from = _mysql.escape_string(self.formdata["name"])
                can_add = True
              if len(self.formdata["trip"]) > 0:
                filter_tripcode = _mysql.escape_string(self.formdata["trip"])
                can_add = True
              if not can_add:
                self.error(_("You must enter a name and/or a tripcode."))
                return
            
            # Action
            sql_query = ''
            filter_reason = ''
            if len(self.formdata["reason"]) > 0:
              filter_reason = _mysql.escape_string(self.formdata["reason"])
            if filter_action == 0:
              # Cancel post
              sql_query = "INSERT INTO `filters` (`id`, `boards`, `type`, `action`, `from`, `from_trip`, `reason`, `added`, `staff`) VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')" % \
                          (edit_id, where, str(filter_type), str(filter_action), filter_from, filter_tripcode, filter_reason, str(timestamp()), _mysql.escape_string(staff_account['username']))
            elif filter_action == 1:
              # Change to
              if len(self.formdata["changeto"]) > 0:
                filter_to = _mysql.escape_string(self.formdata["changeto"])
                sql_query = "INSERT INTO `filters` (`id`, `boards`, `type`, `action`, `from`, `from_trip`, `reason`, `to`, `added`, `staff`) VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')" % \
                          (edit_id, where, str(filter_type), str(filter_action), filter_from, filter_tripcode, filter_reason, filter_to, str(timestamp()), _mysql.escape_string(staff_account['username']))
              else:
                self.error(_("You must enter a word to change to."))
                return
            elif filter_action == 2:
              # Ban
              filter_seconds = '0'
              if len(self.formdata["seconds"]) > 0:
                filter_seconds = _mysql.escape_string(self.formdata["seconds"])
              if "blind" in self.formdata.keys() and self.formdata["blind"] == '1':
                filter_blind = '1'
              else:
                filter_blind = '2'

              sql_query = "INSERT INTO `filters` (`id`, `boards`, `type`, `action`, `from`, `from_trip`, `reason`, `seconds`, `blind`, `added`, `staff`) VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')" % \
                          (edit_id, where, str(filter_type), str(filter_action), filter_from, filter_tripcode, filter_reason, filter_seconds, filter_blind, str(timestamp()), _mysql.escape_string(staff_account['username']))
            elif filter_action == 3:
              # Redirect URL
              if len(self.formdata['redirect_url']) > 0:
                redirect_url = _mysql.escape_string(self.formdata['redirect_url'])
                redirect_time = 0
                try:
                  redirect_time = int(self.formdata['redirect_time'])
                except:
                  pass
              else:
                self.error(_("You must enter a URL to redirect to."))
                return
            
              sql_query = "INSERT INTO `filters` (`id`, `boards`, `type`, `action`, `from`, `from_trip`, `reason`, `redirect_url`, `redirect_time`, `added`, `staff`) VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')" % \
                          (edit_id, where, str(filter_type), str(filter_action), filter_from, filter_tripcode, filter_reason, redirect_url, str(redirect_time), str(timestamp()), _mysql.escape_string(staff_account['username']))
            # DO QUERY!
            if edit_id > 0:
              UpdateDb("DELETE FROM `filters` WHERE `id` = %s" % str(edit_id))
              UpdateDb(sql_query)
              message = 'Filter edited.'
            else:
              filt = FetchOne("SELECT `id` FROM `filters` WHERE `boards` = '%s' AND `type` = '%s' AND `from` = '%s'" % (where, str(filter_type), filter_from))
              if not filt:
                UpdateDb(sql_query)
                message = 'Filter added.'
              else:
                message = 'This filter already exists here:' + ' <a href="'+Settings.CGI_URL+'manage/filters/add?edit='+filt['id']+'">edit</a>'
            action_taken = True
            template_filename = "message.html"
          else:
            # Create add form
            edit_id = 0
            if 'edit' in self.formdata.keys() and int(self.formdata['edit']) > 0:
              # Load values
              edit_id = int(self.formdata['edit'])
              filt = FetchOne("SELECT * FROM `filters` WHERE `id` = %s LIMIT 1" % str(edit_id))
              if filt['boards'] == '':
                where = ''
              else:
                where = pickle.loads(filt['boards'])
              startvalues = {'type': filt['type'],
                             'trip': filt['from_trip'],
                             'where': where,
                             'action': filt['action'],
                             'changeto': cgi.escape(filt['to'], True),
                             'reason': filt['reason'],
                             'seconds': filt['seconds'],
                             'blind': filt['blind'],
                             'redirect_url': filt['redirect_url'],
                             'redirect_time': filt['redirect_time'],}
              if filt['type'] == '1':
                startvalues['name'] = filt['from']
                startvalues['word'] = ''
              else:
                startvalues['name'] = ''
                startvalues['word'] = filt['from']
            else:
              startvalues = {'type': '0',
                             'word': '',
                             'name': '',
                             'trip': '',
                             'where': [],
                             'action': '0',
                             'changeto': '',
                             'reason': _('Forbidden word'),
                             'seconds': '0',
                             'blind': '1',
                             'redirect_url': 'http://',
                             'redirect_time': '5'}
                           
            if edit_id > 0:
              submit = "Editar Filtro"
            else:
              submit = "Agregar filtro"
            
            action_taken = True
            template_filename = "filters.html"
            template_values = {'mode': 1,
              'edit_id': edit_id,
              'boards': boardlist(),
              'startvalues': startvalues,
              'submit': submit}
        elif len(path_split) > 4 and path_split[3] == 'delete':
          delid = int(path_split[4])
          UpdateDb("DELETE FROM `filters` WHERE id = '%s' LIMIT 1" % str(delid))
          message = _('Deleted filter %s.') % str(delid)
          template_filename = "message.html"
          action_taken = True
          
        if not action_taken:       
          filters = FetchAll("SELECT * FROM `filters` ORDER BY `added` DESC")
          for filter in filters:
            if filter['boards'] == '':
              filter['boards'] = _('All boards')
            else:
              where = pickle.loads(filter['boards'])
              if len(where) > 1:
                filter['boards'] = '/' + '/, /'.join(where) + '/'
              else:
                filter['boards'] = '/' + where[0] + '/'
            if filter['type'] == '0':
              filter['type_formatted'] = _('Word:') + ' <b>' + cgi.escape(filter['from']) + '</b>'
            elif filter['type'] == '1':
              filter['type_formatted'] = _('Name/Tripcode:')+' '
              if filter['from'] != '':
                filter['type_formatted'] += '<b class="name">' + filter['from'] + '</b>'
              if filter['from_trip'] != '':
                filter['type_formatted'] += '<span class="trip">' + filter['from_trip'] + '</span>'
            else:
              filter['type_formatted'] = '?'
            if filter['action'] == '0':
              filter ['action_formatted'] = _('Abort post')
            elif filter['action'] == '1':
              filter ['action_formatted'] = _('Change to:') + ' <b>' + cgi.escape(filter['to']) + '</b>'
            elif filter['action'] == '2':
              if filter['blind'] == '1':
                blind = _('Yes')
              else:
                blind = _('No')
              filter ['action_formatted'] = _('Autoban:') + '<br />' + \
                      (_('Length:')+' <i>%s</i><br />'+_('Blind:')+' <i>%s</i>') % (filter['seconds'], blind)
            elif filter['action'] == '3':
              filter ['action_formatted'] = (_('Redirect to:')+' %s ('+_('in %s secs')+')') % (filter['redirect_url'], filter['redirect_time'])
            else:
              filter ['action_formatted'] = '?'
            filter['added'] = formatTimestamp(filter['added'])
            
          template_filename = "filters.html"
          template_values = {'mode': 0, 'filters': filters}
      elif path_split[2] == 'logs':
        if staff_account['rights'] != '0' and staff_account['rights'] != '2':
          return

        logs = FetchAll('SELECT * FROM `logs` ORDER BY `timestamp` DESC')
        for log in logs:
          log['timestamp_formatted'] = formatTimestamp(log['timestamp'])
        template_filename = "logs.html"
        template_values = {'logs': logs}
      elif path_split[2] == 'logout':
        message = _('Logging out...') + '<meta http-equiv="refresh" content="0;url=' + Settings.CGI_URL + 'manage" />'
        deleteCookie(self, 'weabot_manage')
        deleteSession(staff_account['session_id'])
        template_filename = "message.html"
      elif path_split[2] == 'quotes':
        # Quotes for the post screen
        if "save" in self.formdata.keys():
          try:
            f = open('quotes.conf', 'w')
            f.write(self.formdata["data"])
            f.close()
            message = 'Datos guardados.'
            template_filename = "message.html"
          except:
            message = 'Error al guardar datos.'
            template_filename = "message.html"
        try:
          f = open('quotes.conf', 'r')
          data = cgi.escape(f.read(1048576), True)
          f.close()
          template_filename = "quotes.html"
          template_values = {'data': data}
        except:
          message = 'Error al leer datos.'
          template_filename = 'message.html'
      elif path_split[2] == 'recent_images':
        try:
          if int(self.formdata['images']) > 100:
            images = '100'
          else:
            images = self.formdata['images']
          posts = FetchAll('SELECT * FROM `posts` INNER JOIN `boards` ON boardid = boards.id WHERE CHAR_LENGTH(`thumb`) > 0 ORDER BY `timestamp` DESC LIMIT ' + _mysql.escape_string(images))
        except:
          posts = FetchAll('SELECT * FROM `posts` INNER JOIN `boards` ON boardid = boards.id WHERE CHAR_LENGTH(`thumb`) > 0 ORDER BY `timestamp` DESC LIMIT 10')
        template_filename = "recent_images.html"
        template_values = {'posts': posts}
      elif path_split[2] == 'news':
        if not administrator:
          return
        
        type = 1
        if 'type' in self.formdata:
          type = int(self.formdata['type'])
          
        if type > 2:
          raise UserError, "Tipo no soportado"
        
        # canal del home
        if len(path_split) > 3:
          if path_split[3] == 'add':
            t = datetime.datetime.now()
              
            # Insertar el nuevo post
            title = ''
            message = self.formdata["message"].replace("\n", "<br />")
            
            # Titulo
            if 'title' in self.formdata:
              title = self.formdata["title"]
              
            # Post anonimo
            if 'anonymous' in self.formdata.keys() and self.formdata['anonymous'] == '1':
              to_name = "Staff ★"
            else:
              to_name = "%s ★" % staff_account['username']
            timestamp_formatted = formatDate(t)
            if type > 0:
              timestamp_formatted = re.sub(r"\(.+", "", timestamp_formatted)
            else:
              timestamp_formatted = re.sub(r"\(...\)", " ", timestamp_formatted)
            
            UpdateDb("INSERT INTO `news` (type, staffid, staff_name, title, message, name, timestamp, timestamp_formatted) VALUES (%d, '%s', '%s', '%s', '%s', '%s', '%d', '%s')" % (type, staff_account['id'], staff_account['username'], _mysql.escape_string(title), _mysql.escape_string(message), to_name, timestamp(t), timestamp_formatted))
            
            regenerateNews()
            regenerateHome()
            message = _("Added successfully.")
            template_filename = "message.html"
          if path_split[3] == 'delete':
            # Eliminar un post
            id = int(path_split[4])
            UpdateDb("DELETE FROM `news` WHERE id = %d AND type = %d" % (id, type))
            regenerateNews()
            regenerateHome()
            message = _("Deleted successfully.")
            template_filename = "message.html"
        else:
          posts = FetchAll("SELECT * FROM `news` WHERE type = %d ORDER BY `timestamp` DESC" % type)
          template_filename = "news.html"
          template_values = {'action': type, 'posts': posts}
      elif path_split[2] == 'newschannel':
        #if not administrator:
        #  return
        
        if len(path_split) > 3:
          if path_split[3] == 'add':
            t = datetime.datetime.now()
            # Delete old posts
            #posts = FetchAll("SELECT `id` FROM `news` WHERE `type` = '1' ORDER BY `timestamp` DESC LIMIT "+str(Settings.MODNEWS_MAX_POSTS)+",30")
            #for post in posts:
            #  UpdateDb("DELETE FROM `news` WHERE id = " + post['id'] + " AND `type` = '0'")
              
            # Insert new post
            message = ''
            try:
              # Cut long lines
              message = self.formdata["message"]
              message = clickableURLs(cgi.escape(message).rstrip()[0:8000])
              message = onlyAllowedHTML(message)
              if Settings.USE_MARKDOWN:
                message = markdown(message)
              if not Settings.USE_MARKDOWN:
                message = message.replace("\n", "<br />")
            except:
              pass
            
            # If it's preferred to remain anonymous...
            if 'anonymous' in self.formdata.keys() and self.formdata['anonymous'] == '1':
              to_name = "Staff ★"
            else:
              to_name = "%s ★" % staff_account['username']
            timestamp_formatted = formatDate(t)
            
            UpdateDb("INSERT INTO `news` (type, staffid, staff_name, title, message, name, timestamp, timestamp_formatted) VALUES ('0', '%s', '%s', '%s', '%s', '%s', '%d', '%s')" % (staff_account['id'], staff_account['username'], _mysql.escape_string(self.formdata['title']), _mysql.escape_string(message), to_name, timestamp(t), timestamp_formatted))
            
            message = _("Added successfully.")
            template_filename = "message.html"
          if path_split[3] == 'delete':            
            if not administrator:
              # We check that if he's not admin, he shouldn't be able to delete other people's posts
              post = FetchOne("SELECT `staffid` FROM `news` WHERE id = '"+_mysql.escape_string(path_split[4])+"' AND type = '0'")
              if post['staffid'] != staff_account['id']:
                self.error(_('That post is not yours.'))
                return
            
            # Delete!
            UpdateDb("DELETE FROM `news` WHERE id = '" + _mysql.escape_string(path_split[4]) + "' AND type = '0'")
            message = _("Deleted successfully.")
            template_filename = "message.html"
        else:
          # If he's not admin, show only his own posts
          if administrator:
            posts = FetchAll("SELECT * FROM `news` WHERE type = '0' ORDER BY `timestamp` DESC")
          else:
            posts = FetchAll("SELECT * FROM `news` WHERE staffid = '"+staff_account['id']+"' AND type = '0' ORDER BY `timestamp` DESC")
          
          template_filename = "news.html"
          template_values = {'action': 'newschannel', 'posts': posts}
      elif path_split[2] == 'reports':
        if not moderator:
          return
        
        message = None
        import math
        pagesize = float(Settings.REPORTS_PER_PAGE)
        totals = FetchOne("SELECT COUNT(id) FROM `reports`")
        total = int(totals['COUNT(id)'])
        pages = int(math.ceil(total / pagesize))
        
        try:
          currentpage = int(path_split[3])
        except:
          currentpage = 0
        
        if len(path_split) > 4:
          if path_split[4] == 'ignore':
            # Delete report
            UpdateDb("DELETE FROM `reports` WHERE `id` = '"+_mysql.escape_string(path_split[5])+"'")
            message = _('Report %s ignored.') % path_split[5]
        if 'ignore' in self.formdata.keys():
          ignored = 0
          if 'board' in self.formdata.keys() and self.formdata['board'] != 'all':
            reports = FetchAll("SELECT `id` FROM `reports` WHERE `board` = '%s' ORDER BY `timestamp` DESC LIMIT %d, %d" % (_mysql.escape_string(self.formdata['board']), currentpage*pagesize, pagesize))
          else:
            reports = FetchAll("SELECT `id` FROM `reports` ORDER BY `timestamp` DESC LIMIT %d, %d" % (currentpage*pagesize, pagesize))
          
          for report in reports:
            keyname = 'i' + report['id']
            if keyname in self.formdata.keys():
              # Ignore here
              UpdateDb("DELETE FROM `reports` WHERE `id` = '"+_mysql.escape_string(report['id'])+"'")
              ignored += 1
              
          message = _('Ignored %s report(s).') % str(ignored)
        
        # Generate board list
        boards = FetchAll('SELECT `name`, `dir` FROM `boards` ORDER BY `dir`')
        for board in boards:
          if 'board' in self.formdata.keys() and self.formdata['board'] == board['dir']:
            board['checked'] = True
          else:
            board['checked'] = False
        
        # Tabla
        if 'board' in self.formdata.keys() and self.formdata['board'] != 'all':
          reports = FetchAll("SELECT id, timestamp, timestamp_formatted, postid, parentid, link, board, INET_NTOA(ip) AS ip, reason, reporterip FROM `reports` WHERE `board` = '%s' ORDER BY `timestamp` DESC LIMIT %d, %d" % (_mysql.escape_string(self.formdata['board']), currentpage*pagesize, pagesize))
        else:
          reports = FetchAll("SELECT id, timestamp, timestamp_formatted, postid, parentid, link, board, INET_NTOA(ip) AS ip, reason, reporterip FROM `reports` ORDER BY `timestamp` DESC LIMIT %d, %d" % (currentpage*pagesize, pagesize))
        
        if 'board' in self.formdata.keys():
          curboard = self.formdata['board']
        else:
          curboard = None
          
        #for report in reports:
        #  if report['parentid'] == '0':
        #    report['link'] = Settings.BOARDS_URL + report['board'] + '/res/' + report['postid'] + '.html#' + report['postid']
        #  else:
        #    report['link'] = Settings.BOARDS_URL + report['board'] + '/res/' + report['parentid'] + '.html#' + report['postid']

        navigator = ''
        if currentpage > 0:
          navigator += '<a href="'+Settings.CGI_URL+'manage/reports/'+str(currentpage-1)+'">&lt;</a> '
        else:
          navigator += '&lt; '
        
        for i in range(pages):
          if i != currentpage:
            navigator += '<a href="'+Settings.CGI_URL+'manage/reports/'+str(i)+'">'+str(i)+'</a> '
          else:
            navigator += str(i)+' '
          
        if currentpage < (pages-1):
          navigator += '<a href="'+Settings.CGI_URL+'manage/reports/'+str(currentpage+1)+'">&gt;</a> '
        else:
          navigator += '&gt; '
        
        template_filename = "reports.html"
        template_values = {'message': message,
          'boards': boards,
          'reports': reports,
          'currentpage': currentpage,
          'curboard': curboard,
          'navigator': navigator}
      # Show by IP
      elif path_split[2] == 'ipshow':
        if not moderator:
          return
          
        if 'ip' in self.formdata.keys():
          # If an IP was given...
          if self.formdata['ip'] != '':
            formatted_ip = str(inet_aton(self.formdata['ip']))
            posts = FetchAll("SELECT posts.*, boards.dir, boards.board_type, boards.subject AS default_subject FROM `posts` JOIN `boards` ON boards.id = posts.boardid WHERE ip = '%s' ORDER BY posts.timestamp DESC" % _mysql.escape_string(formatted_ip))
            if '.' in self.formdata['ip']:
              ip = self.formdata['ip']
            else:
              ip = inet_ntoa(long(self.formdata['ip']))
            template_filename = "ipshow.html"
            template_values = {"mode": 1, "ip": ip, "host": getHost(ip), "country": getCountry(ip), "tor": addressIsTor(ip), "posts": posts}
            logAction(staff_account['username'], "ipshow on {}".format(ip))
        else:
          # Generate form
          template_filename = "ipshow.html"
          template_values = {"mode": 0}
      elif path_split[2] == 'ipdelete':
        if not moderator:
          return
        
        # Delete by IP
        if 'ip' in self.formdata.keys():
          # If an IP was given...
          if self.formdata['ip'] != '':
            where = []
            if 'board_all' not in self.formdata.keys():
              # If he chose boards separately, add them to a list
              boards = FetchAll('SELECT `id`, `dir` FROM `boards`')
              for board in boards:
                keyname = 'board_' + board['dir']
                if keyname in self.formdata.keys():
                  if self.formdata[keyname] == "1":
                    where.append(board)
            else:
              # If all boards were selected="selected", all them all to the list
              where = FetchAll('SELECT `id`, `dir` FROM `boards`')
            
            # If no board was chosen
            if len(where) <= 0:
              self.error(_("Select a board first."))
              return
              
            deletedPostsTotal = 0
            ip = inet_aton(self.formdata['ip'])
            deletedPosts = 0
            for theboard in where:
              board = setBoard(theboard['dir'])
              isDeletedOP = False
              
              # delete all starting posts first
              op_posts = FetchAll("SELECT `id`, `message` FROM posts WHERE parentid = 0 AND boardid = '" + board['id'] + "' AND ip = " + str(ip))
              for post in op_posts:
                deletePost(post['id'], None)
                
                deletedPosts += 1
                deletedPostsTotal += 1
              
              replies = FetchAll("SELECT `id`, `message`, `parentid` FROM posts WHERE parentid != 0 AND boardid = '" + board['id'] + "' AND ip = " + str(ip))
              for post in replies:
                deletePost(post['id'], None, '2')
                
                deletedPosts += 1
                deletedPostsTotal += 1
              
              regenerateHome()
              
              if deletedPosts > 0:
                message = '%(posts)s post(s) were deleted from %(board)s.' % {'posts': str(deletedPosts), 'board': '/' + board['dir'] + '/'}
                template_filename = "message.html"
                #logAction(staff_account['username'], '%(posts)s post(s) were deleted from %(board)s. IP: %(ip)s' % \
                #  {'posts': str(deletedPosts),
                #   'board': '/' + board['dir'] + '/',
                #   'ip': self.formdata['ip']})
          else:
            self.error(_("Please enter an IP first."))
            return
          
          message = 'In total %(posts)s from IP %(ip)s were deleted.' % {'posts': str(deletedPosts), 'ip': self.formdata['ip']}
          logAction(staff_account['username'], message)
          template_filename = "message.html"
        else:  
          # Generate form...
          template_filename = "ipdelete.html"
          template_values = {'boards': boardlist()}
      elif path_split[2] == 'search':
        if not administrator:
          return
        search_logs = FetchAll('SELECT `id`,`timestamp`,`keyword`,`ita`,INET_NTOA(`ip`) AS `ip`,`res` FROM `search_log` ORDER BY `timestamp` DESC LIMIT 250')
        for log in search_logs:
          #log['ip'] = str(inet_ntoa(log['ip']))
          log['timestamp_formatted'] = formatTimestamp(log['timestamp'])
          if log['keyword'].startswith('k '):
            log['keyword'] = log['keyword'][2:]
            log['archive'] = True
          else:
            log['archive'] = False
        template_filename = "search.html"
        template_values = {'search': search_logs}
    else:
      # Main page.
      reports = FetchOne("SELECT COUNT(1) FROM `reports`", 0)[0]
      posts = FetchAll("SELECT * FROM `news` WHERE type = '0' ORDER BY `timestamp` DESC")
      
      template_filename = "manage.html"
      template_values = {'reports': reports, 'posts': posts}

  if not skiptemplate:
    try:
      if template_filename == 'message.html':
        template_values = {'message': message}
    except:
      template_filename = 'message.html'
      template_values = {'message': '???'}
      
    template_values.update({
      'title': 'Manage',
      'validated': validated,
      'page': page,
    })
    
    if validated:
      template_values.update({
        'username': staff_account['username'],
        'site_title': Settings.SITE_TITLE,
        'rights': staff_account['rights'],
        'administrator': administrator,
        'added': formatTimestamp(staff_account['added']),
      })
    
    self.output += renderTemplate("manage/" + template_filename, template_values)
  
def switchBoard(new_type):
  board = Settings._.BOARD

  if new_type == board['board_type']:
    return

  kako_dir = os.path.join(Settings.ROOT_DIR, board['dir'], 'kako')
  res_dir = os.path.join(Settings.ROOT_DIR, board['dir'], 'res')
  
  if new_type == '0':
    # Switching to Imageboard
    # Delete kako if empty
    if os.path.exists(kako_dir) and not os.listdir(kako_dir):
      os.rmdir(kako_dir)
  elif new_type == '1':
    # Switching to Textboard
    # Make kako dir
    if not os.path.exists(kako_dir):
      os.mkdir(kako_dir)
  
  # Clean res dir
  cleanDir(res_dir, ext="html")

def newSession(staff_id):
  import uuid
  session_uuid = uuid.uuid4().hex
  
  param_session_id = _mysql.escape_string(session_uuid)
  param_expires = timestamp() + Settings.SESSION_TIME
  param_staff_id = int(staff_id)
  
  InsertDb("INSERT INTO `session` (`session_id`, `expires`, `staff_id`) VALUES (UNHEX('%s'), %d, %d)" % 
    (param_session_id, param_expires, param_staff_id))
    
  return session_uuid

def validateSession(session_id):
  cleanSessions()
  
  param_session_id = _mysql.escape_string(session_id)
  param_now = timestamp()
  session = FetchOne(
    "SELECT HEX(session_id) as session_id, id, username, rights, added FROM `session` "
    "INNER JOIN `staff` ON `session`.`staff_id` = `staff`.`id` "
    "WHERE `session_id` = UNHEX('%s')" %
    (param_session_id))
  
  if session:
    return session
  
  return None

def renewSession(session_id):
  param_session_id = _mysql.escape_string(session_id)
  param_expires = timestamp() + Settings.SESSION_TIME
  
  UpdateDb("UPDATE `session` SET expires = %d WHERE session_id = UNHEX('%s')" %
    (param_expires, param_session_id))

def deleteSession(session_id):
  param_session_id = _mysql.escape_string(session_id)
  
  UpdateDb("DELETE FROM `session` WHERE session_id = UNHEX('%s')" % param_session_id)
    
def cleanSessions():
  param_now = timestamp()
  
  UpdateDb("DELETE FROM `session` WHERE expires <= %d" % param_now)

def logAction(staff, action):
  InsertDb("INSERT INTO `logs` (`timestamp`, `staff`, `action`) VALUES (" + str(timestamp()) + ", '" + _mysql.escape_string(staff) + "\', \'" + _mysql.escape_string(action) + "\')")

def genPasswdHash(string):
  import argon2
  ph = argon2.PasswordHasher()
  
  return ph.hash(string)

def verifyPasswd(username, passwd):
  import argon2
  ph = argon2.PasswordHasher()
  
  param_username = _mysql.escape_string(username)
  staff_account = FetchOne("SELECT * FROM staff WHERE username = '%s'" % param_username)
  if not staff_account:
    return None
  
  try:
    ph.verify(staff_account['password'], passwd)
  except argon2.exceptions.VerifyMismatchError:
    return None
  except argon2.exceptions.InvalidHash:
    raise UserError, "Hash obsoleto o inválido. Por favor contacte al administrador."
    
  if ph.check_needs_rehash(staff_account['password']):
    param_new_hash = ph.hash(staff_acount['password'])
    UpdateDb("UPDATE staff SET password = '%s' WHERE id = %s" %
      (param_new_hash, staff_account['id']))
  
  return staff_account

def boardlist():
  boards = FetchAll('SELECT * FROM `boards` ORDER BY `board_type`, `dir`')
  return boards
  
def filetypelist():
  filetypes = FetchAll('SELECT * FROM `filetypes` ORDER BY `ext` ASC')
  return filetypes