misuzu/public/manage/index.php

<?php
require_once '../../misuzu.php';

$generalPerms = perms_get_user(MSZ_PERMS_GENERAL, user_session_current('user_id', 0));

switch ($_GET['v'] ?? null) {
    default:
    case 'overview':
        echo tpl_render('manage.general.overview');
        break;

    case 'logs':
        if (!perms_check($generalPerms, MSZ_PERM_GENERAL_VIEW_LOGS)) {
            echo render_error(403);
            break;
        }

        $logsPagination = pagination_create(audit_log_count(), 50);
        $logsOffset = pagination_offset($logsPagination, pagination_param());

        if (!pagination_is_valid_offset($logsOffset)) {
            echo render_error(404);
            break;
        }

        $logs = audit_log_list($logsOffset, $logsPagination['range']);

        echo tpl_render('manage.general.logs', [
            'global_logs' => $logs,
            'global_logs_pagination' => $logsPagination,
            'global_logs_strings' => MSZ_AUDIT_LOG_STRINGS,
        ]);
        break;

    case 'emoticons':
        if (!perms_check($generalPerms, MSZ_PERM_GENERAL_MANAGE_EMOTICONS)) {
            echo render_error(403);
            break;
        }

        echo tpl_render('manage.general.emoticons');
        break;

    case 'settings':
        if (!perms_check($generalPerms, MSZ_PERM_GENERAL_MANAGE_SETTINGS)) {
            echo render_error(403);
            break;
        }

        echo tpl_render('manage.general.settings');
        break;

    case 'blacklist':
        if (!perms_check($generalPerms, MSZ_PERM_GENERAL_MANAGE_BLACKLIST)) {
            echo render_error(403);
            break;
        }

        $notices = [];

        if (!empty($_POST)) {
            if (!csrf_verify('ip_blacklist', $_POST['csrf'] ?? '')) {
                $notices[] = 'Verification failed.';
            } else {
                header(csrf_http_header('ip_blacklist'));

                if (!empty($_POST['blacklist']['remove']) && is_array($_POST['blacklist']['remove'])) {
                    foreach ($_POST['blacklist']['remove'] as $cidr) {
                        if (!ip_blacklist_remove($cidr)) {
                            $notices[] = sprintf('Failed to remove "%s" from the blacklist.', $cidr);
                        }
                    }
                }

                if (!empty($_POST['blacklist']['add']) && is_string($_POST['blacklist']['add'])) {
                    $cidrs = explode("\n", $_POST['blacklist']['add']);

                    foreach ($cidrs as $cidr) {
                        $cidr = trim($cidr);

                        if (empty($cidr)) {
                            continue;
                        }

                        if (!ip_blacklist_add($cidr)) {
                            $notices[] = sprintf('Failed to add "%s" to the blacklist.', $cidr);
                        }
                    }
                }
            }
        }

        echo tpl_render('manage.general.blacklist', [
            'notices' => $notices,
            'blacklist' => ip_blacklist_list(),
        ]);
        break;
}