nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . ENTITY::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', ENTITY::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.ENTITY::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. ENTITY::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',ENTITY::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',ENTITY::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',ENTITY::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124     /**
1125      * Provide a page to item a new item to the given blog
1126      */
1127     function action_createitem() {
1128         global $member, $manager;
1129
1130         $blogid = intRequestVar('blogid');
1131
1132         // check if allowed
1133         $member->teamRights($blogid) or $this->disallow();
1134
1135         $memberid = $member->getID();
1136
1137         $blog =& $manager->getBlog($blogid);
1138
1139         $this->pagehead();
1140
1141         // generate the add-item form
1142         $formfactory = new PAGEFACTORY($blogid);
1143         $formfactory->createAddForm('admin');
1144
1145         $this->pagefoot();
1146     }
1147
1148     /**
1149      * @todo document this
1150      */
1151     function action_itemedit()
1152         {
1153                 global $member, $manager;
1154
1155                 $itemid = intRequestVar('itemid');
1156
1157                 // only allow if user is allowed to alter item
1158                 $member->canAlterItem($itemid) or $this->disallow();
1159
1160                 $item =& $manager->getItem($itemid, 1, 1);
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1162
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1164
1165                 if ($blog->convertBreaks())
1166                 {
1167                         $item['body'] = removeBreaks($item['body']);
1168                         $item['more'] = removeBreaks($item['more']);
1169                 }
1170
1171                 // form to edit blog items
1172                 $this->pagehead();
1173                 $formfactory = new PAGEFACTORY($blog->getID());
1174                 $formfactory->createEditForm('admin', $item);
1175                 $this->pagefoot();
1176     }
1177
1178     /**
1179      * @todo document this
1180      */
1181     function action_itemupdate() {
1182         global $member, $manager, $CONF;
1183
1184         $itemid = intRequestVar('itemid');
1185         $catid = postVar('catid');
1186
1187         // only allow if user is allowed to alter item
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1189
1190         $actiontype = postVar('actiontype');
1191
1192         // delete actions are handled by itemdelete (which has confirmation)
1193         if ($actiontype == 'delete') {
1194             $this->action_itemdelete();
1195             return;
1196         }
1197
1198         $body   = postVar('body');
1199         $title  = postVar('title');
1200         $more   = postVar('more');
1201         $closed = intPostVar('closed');
1202         $draftid = intPostVar('draftid');
1203
1204         // default action = add now
1205         if (!$actiontype)
1206             $actiontype='addnow';
1207
1208         // create new category if needed
1209         if (strstr($catid,'newcat')) {
1210             // get blogid
1211             list($blogid) = sscanf($catid,"newcat-%d");
1212
1213             // create
1214             $blog =& $manager->getBlog($blogid);
1215             $catid = $blog->createNewCategory();
1216
1217             // show error when sth goes wrong
1218             if (!$catid)
1219                 $this->doError(_ERROR_CATCREATEFAIL);
1220         }
1221
1222         /*
1223             set some variables based on actiontype
1224
1225             actiontypes:
1226                 draft items -> addnow, addfuture, adddraft, delete
1227                 non-draft items -> edit, changedate, delete
1228
1229             variables set:
1230                 $timestamp: set to a nonzero value for future dates or date changes
1231                 $wasdraft: set to 1 when the item used to be a draft item
1232                 $publish: set to 1 when the edited item is not a draft
1233         */
1234         $blogid =  getBlogIDFromItemID($itemid);
1235         $blog   =& $manager->getBlog($blogid);
1236
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1242         } else {
1243             $timestamp =0;
1244         }
1245
1246         // edit the item for real
1247         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1248
1249         $this->updateFuturePosted($blogid);
1250
1251         if ($draftid > 0) {
1252             // delete permission is checked inside ITEM::delete()
1253             ITEM::delete($draftid);
1254         }
1255
1256         // show category edit window when we created a new category
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1258         if ($catid != intPostVar('catid')) {
1259             $this->action_categoryedit(
1260                 $catid,
1261                 $blog->getID(),
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1263             );
1264         } else {
1265             // TODO: set start item correctly for itemlist
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));
1267         }
1268     }
1269
1270         /**
1271          * ADMIN::action_itemdelete()
1272          * Delete item
1273          *
1274          * @param       Void
1275          * @return      Void
1276          */
1277         function action_itemdelete()
1278         {
1279                 global $member, $manager;
1280
1281                 $itemid = intRequestVar('itemid');
1282
1283                 // only allow if user is allowed to alter item
1284                 $member->canAlterItem($itemid) or $this->disallow();
1285
1286                 if ( !$manager->existsItem($itemid,1,1) )
1287                 {
1288                         $this->error(_ERROR_NOSUCHITEM);
1289                 }
1290
1291                 $item =& $manager->getItem($itemid,1,1);
1292                 $title = ENTITY::hsc(strip_tags($item['title']));
1293                 $body = strip_tags($item['body']);
1294                 $body = ENTITY::hsc(ENTITY::shorten($body,300,'...'));
1295
1296                 $this->pagehead();
1297                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1298                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";
1299                 echo "<div class=\"note\">\n";
1300                 echo "<b>{$title}</b>\n";
1301                 echo "<br />\n";
1302                 echo "{$body}\n";
1303                 echo "</div>\n";
1304                 echo "<form method=\"post\" action=\"index.php\">\n";
1305                 echo "<div>\n";
1306                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";
1307                 echo $manager->addTicketHidden() . "\n";
1308                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";
1309                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";
1310                 echo "</div>\n";
1311                 echo "</form>\n";
1312                 $this->pagefoot();
1313                 return;
1314         }
1315
1316     /**
1317      * @todo document this
1318      */
1319     function action_itemdeleteconfirm() {
1320         global $member;
1321
1322         $itemid = intRequestVar('itemid');
1323
1324         // only allow if user is allowed to alter item
1325         $member->canAlterItem($itemid) or $this->disallow();
1326
1327         // get blogid first
1328         $blogid = getBlogIdFromItemId($itemid);
1329
1330         // delete item (note: some checks will be performed twice)
1331         $this->deleteOneItem($itemid);
1332
1333         $this->action_itemlist($blogid);
1334     }
1335
1336     /**
1337      * Deletes one item and returns error if something goes wrong
1338      * @param int $itemid
1339      */
1340     function deleteOneItem($itemid) {
1341         global $member, $manager;
1342
1343         // only allow if user is allowed to alter item (also checks if itemid exists)
1344         if (!$member->canAlterItem($itemid))
1345             return _ERROR_DISALLOWED;
1346
1347         // need to get blogid before the item is deleted
1348         $blogid = getBlogIDFromItemId($itemid);
1349
1350         $manager->loadClass('ITEM');
1351         ITEM::delete($itemid);
1352
1353         // update blog's futureposted
1354         $this->updateFuturePosted($blogid);
1355     }
1356
1357     /**
1358      * Update a blog's future posted flag
1359      * @param int $blogid
1360      */
1361     function updateFuturePosted($blogid) {
1362         global $manager;
1363
1364         $blog =& $manager->getBlog($blogid);
1365         $currenttime = $blog->getCorrectTime(time());
1366         $result = sql_query("SELECT * FROM ".sql_table('item').
1367             " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1368         if (sql_num_rows($result) > 0) {
1369                 $blog->setFuturePost();
1370         }
1371         else {
1372                 $blog->clearFuturePost();
1373         }
1374     }
1375
1376     /**
1377      * @todo document this
1378      */
1379     function action_itemmove() {
1380         global $member, $manager;
1381
1382         $itemid = intRequestVar('itemid');
1383
1384         // only allow if user is allowed to alter item
1385         $member->canAlterItem($itemid) or $this->disallow();
1386
1387         $item =& $manager->getItem($itemid,1,1);
1388
1389         $this->pagehead();
1390         ?>
1391             <h2><?php echo _MOVE_TITLE?></h2>
1392             <form method="post" action="index.php"><div>
1393                 <input type="hidden" name="action" value="itemmoveto" />
1394                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1395
1396                 <?php
1397
1398                     $manager->addTicketHidden();
1399                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1400                 ?>
1401
1402                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1403             </div></form>
1404         <?php
1405         $this->pagefoot();
1406     }
1407
1408     /**
1409      * @todo document this
1410      */
1411     function action_itemmoveto() {
1412         global $member, $manager;
1413
1414         $itemid = intRequestVar('itemid');
1415         $catid = requestVar('catid');
1416
1417         // create new category if needed
1418         if (strstr($catid,'newcat')) {
1419             // get blogid
1420             list($blogid) = sscanf($catid,'newcat-%d');
1421
1422             // create
1423             $blog =& $manager->getBlog($blogid);
1424             $catid = $blog->createNewCategory();
1425
1426             // show error when sth goes wrong
1427             if (!$catid)
1428                 $this->doError(_ERROR_CATCREATEFAIL);
1429         }
1430
1431         // only allow if user is allowed to alter item
1432         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1433
1434         $old_blogid = getBlogIDFromItemId($itemid);
1435
1436         ITEM::move($itemid, $catid);
1437
1438         // set the futurePosted flag on the blog
1439         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1440
1441         // reset the futurePosted in case the item is moved from one blog to another
1442         $this->updateFuturePosted($old_blogid);
1443
1444         if ($catid != intRequestVar('catid'))
1445             $this->action_categoryedit($catid, $blog->getID());
1446         else
1447             $this->action_itemlist(getBlogIDFromCatID($catid));
1448     }
1449
1450     /**
1451      * Moves one item to a given category (category existance should be checked by caller)
1452      * errors are returned
1453      * @param int $itemid
1454      * @param int $destCatid category ID to which the item will be moved
1455      */
1456     function moveOneItem($itemid, $destCatid) {
1457         global $member;
1458
1459         // only allow if user is allowed to move item
1460         if (!$member->canUpdateItem($itemid, $destCatid))
1461             return _ERROR_DISALLOWED;
1462
1463         ITEM::move($itemid, $destCatid);
1464     }
1465
1466     /**
1467      * Adds a item to the chosen blog
1468      */
1469     function action_additem() {
1470         global $manager, $CONF;
1471
1472         $manager->loadClass('ITEM');
1473
1474         $result = ITEM::createFromRequest();
1475
1476         if ($result['status'] == 'error')
1477             $this->error($result['message']);
1478
1479         $blogid = getBlogIDFromItemID($result['itemid']);
1480         $blog =& $manager->getBlog($blogid);
1481         $btimestamp = $blog->getCorrectTime();
1482         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1483
1484         if ($result['status'] == 'newcategory') {
1485             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1486             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1487         } else {
1488             $methodName = 'action_itemList';
1489             call_user_func(array(&$this, $methodName), $blogid);
1490         }
1491     }
1492
1493         /**
1494          * Allows to edit previously made comments
1495          **/
1496         function action_commentedit() {
1497
1498                 global $member, $manager;
1499
1500                 $commentid = intRequestVar('commentid');
1501
1502                 $member->canAlterComment($commentid) or $this->disallow();
1503
1504                 $comment = COMMENT::getComment($commentid);
1505
1506                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1507
1508                 // change <br /> to \n
1509                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1510
1511                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1512                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1513
1514         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1515
1516         $this->pagehead();
1517
1518         ?>
1519         <h2><?php echo _EDITC_TITLE?></h2>
1520
1521         <form action="index.php" method="post"><div>
1522
1523         <input type="hidden" name="action" value="commentupdate" />
1524         <?php $manager->addTicketHidden(); ?>
1525         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1526         <table><tr>
1527             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1528         </tr><tr>
1529             <td><?php echo _EDITC_WHO?></td>
1530             <td>
1531             <?php               if ($comment['member'])
1532                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1533                 else
1534                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1535             ?>
1536             </td>
1537         </tr><tr>
1538             <td><?php echo _EDITC_WHEN?></td>
1539             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1540         </tr><tr>
1541             <td><?php echo _EDITC_HOST?></td>
1542             <td><?php echo  $comment['host']; ?></td>
1543         </tr>
1544         <tr>
1545             <td><?php echo _EDITC_URL; ?></td>
1546             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1547         </tr>
1548         <tr>
1549             <td><?php echo _EDITC_EMAIL; ?></td>
1550             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1551         </tr>
1552         <tr>
1553             <td><?php echo _EDITC_TEXT?></td>
1554             <td>
1555                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1556                     echo $comment['body'];
1557                 ?></textarea>
1558             </td>
1559         </tr><tr>
1560             <td><?php echo _EDITC_EDIT?></td>
1561             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1562         </tr></table>
1563
1564         </div></form>
1565         <?php
1566         $this->pagefoot();
1567     }
1568
1569     /**
1570      * @todo document this
1571      */
1572     function action_commentupdate() {
1573         global $member, $manager;
1574
1575         $commentid = intRequestVar('commentid');
1576
1577         $member->canAlterComment($commentid) or $this->disallow();
1578
1579         $url = postVar('url');
1580         $email = postVar('email');
1581         $body = postVar('body');
1582
1583                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1584                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1585                 # important note that '\' must be matched with '\\\\' in preg* expressions
1586
1587                 // intercept words that are too long
1588                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1589                 {
1590                         $this->error(_ERROR_COMMENT_LONGWORD);
1591                 }
1592
1593                 // check length
1594                 if (i18n::strlen($body) < 3)
1595                 {
1596                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1597                 }
1598
1599                 if (i18n::strlen($body) > 5000)
1600                 {
1601                         $this->error(_ERROR_COMMENT_TOOLONG);
1602                 }
1603
1604         // prepare body
1605         $body = COMMENT::prepareBody($body);
1606
1607         // call plugins
1608         $manager->notify('PreUpdateComment',array('body' => &$body));
1609
1610         $query = 'UPDATE ' . sql_table('comment')
1611                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1612                . " WHERE cnumber = " . $commentid;
1613         sql_query($query);
1614
1615         // get itemid
1616         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1617         $o = sql_fetch_object($res);
1618         $itemid = $o->citem;
1619
1620         if ($member->canAlterItem($itemid))
1621             $this->action_itemcommentlist($itemid);
1622         else
1623             $this->action_browseowncomments();
1624
1625     }
1626
1627         /**
1628          * ADMIN::action_commentdelete()
1629          * Update comment
1630          *
1631          * @param       Void
1632          * @return      Void
1633          */
1634         function action_commentdelete()
1635         {
1636                 global $member, $manager;
1637
1638                 $commentid = intRequestVar('commentid');
1639                 $member->canAlterComment($commentid) or $this->disallow();
1640                 $comment = COMMENT::getComment($commentid);
1641
1642                 $body = strip_tags($comment['body']);
1643                 $body = ENTITY::hsc(ENTITY::shorten($body, 300, '...'));
1644
1645                 if ( $comment['member'] )
1646                 {
1647                         $author = $comment['member'];
1648                 }
1649                 else
1650                 {
1651                         $author = $comment['user'];
1652                 }
1653
1654                 $this->pagehead();
1655
1656                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1657                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";
1658                 echo "<div class=\"note\">\n";
1659                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";
1660                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";
1661                 echo "</div>\n";
1662                 echo "<form method=\"post\" action=\"index.php\">\n";
1663                 echo "<div>\n";
1664                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";
1665                 echo $manager->addTicketHidden() . "\n";
1666                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";
1667                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";
1668                 echo "</div>\n";
1669                 echo "</form>\n";
1670                 $this->pagefoot();
1671                 return;
1672         }
1673
1674     /**
1675      * @todo document this
1676      */
1677     function action_commentdeleteconfirm() {
1678         global $member;
1679
1680         $commentid = intRequestVar('commentid');
1681
1682         // get item id first
1683         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1684         $o = sql_fetch_object($res);
1685         $itemid = $o->citem;
1686
1687         $error = $this->deleteOneComment($commentid);
1688         if ($error)
1689             $this->doError($error);
1690
1691         if ($member->canAlterItem($itemid))
1692             $this->action_itemcommentlist($itemid);
1693         else
1694             $this->action_browseowncomments();
1695     }
1696
1697     /**
1698      * @todo document this
1699      */
1700     function deleteOneComment($commentid) {
1701         global $member, $manager;
1702
1703         $commentid = intval($commentid);
1704
1705         if (!$member->canAlterComment($commentid))
1706             return _ERROR_DISALLOWED;
1707
1708         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1709
1710         // delete the comments associated with the item
1711         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1712         sql_query($query);
1713
1714         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1715
1716         return '';
1717     }
1718
1719     /**
1720      * Usermanagement main
1721      */
1722     function action_usermanagement() {
1723         global $member, $manager;
1724
1725         // check if allowed
1726         $member->isAdmin() or $this->disallow();
1727
1728         $this->pagehead();
1729
1730         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1731
1732         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1733
1734         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1735
1736         // show list of members with actions
1737         $query =  'SELECT *'
1738                . ' FROM '.sql_table('member');
1739         $template['content'] = 'memberlist';
1740         $template['tabindex'] = 10;
1741
1742         $manager->loadClass("ENCAPSULATE");
1743         $batch = new BATCH('member');
1744         $batch->showlist($query,'table',$template);
1745
1746         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1747         ?>
1748             <form method="post" action="index.php" name="memberedit"><div>
1749
1750             <input type="hidden" name="action" value="memberadd" />
1751             <?php $manager->addTicketHidden() ?>
1752
1753             <table>
1754             <tr>
1755                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1756             </tr><tr>
1757                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1758                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1759                 </td>
1760                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1761             </tr><tr>
1762                 <td><?php echo _MEMBERS_REALNAME?></td>
1763                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1764             </tr><tr>
1765                 <td><?php echo _MEMBERS_PWD?></td>
1766                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1767             </tr><tr>
1768                 <td><?php echo _MEMBERS_REPPWD?></td>
1769                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1770             </tr><tr>
1771                 <td><?php echo _MEMBERS_EMAIL?></td>
1772                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1773             </tr><tr>
1774                 <td><?php echo _MEMBERS_URL?></td>
1775                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1776             </tr><tr>
1777                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1778                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1779             </tr><tr>
1780                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1781                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1782             </tr><tr>
1783                 <td><?php echo _MEMBERS_NOTES?></td>
1784                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1785             </tr><tr>
1786                 <td><?php echo _MEMBERS_NEW?></td>
1787                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1788             </tr></table>
1789
1790             </div></form>
1791         <?php
1792         $this->pagefoot();
1793     }
1794
1795     /**
1796      * Edit member settings
1797      */
1798     function action_memberedit() {
1799         $this->action_editmembersettings(intRequestVar('memberid'));
1800     }
1801
1802         /**
1803          * @todo document this
1804          */
1805         function action_editmembersettings($memberid = '') {
1806                 global $member, $manager, $CONF;
1807
1808                 if ($memberid == '')
1809                 {
1810                         $memberid = $member->getID();
1811                 }
1812
1813                 // check if allowed
1814                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1815
1816                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1817                 $this->pagehead($extrahead);
1818
1819                 // show message to go back to member overview (only for admins)
1820                 if ($member->isAdmin())
1821                 {
1822                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1823                 }
1824                 else
1825                 {
1826                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1827                 }
1828                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1829
1830                 $mem = MEMBER::createFromID($memberid);
1831                 ?>
1832                 <form method="post" action="index.php" name="memberedit"><div>
1833
1834                 <input type="hidden" name="action" value="changemembersettings" />
1835                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1836                 <?php $manager->addTicketHidden() ?>
1837
1838                 <table><tr>
1839                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1840                 </tr><tr>
1841                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1842                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1843                         </td>
1844                         <td>
1845                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1846                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  ENTITY::hsc($mem->getDisplayName()); ?>" />
1847                         <?php } else {
1848                                 echo ENTITY::hsc($member->getDisplayName());
1849                            }
1850                         ?>
1851                         </td>
1852                 </tr><tr>
1853                         <td><?php echo _MEMBERS_REALNAME?></td>
1854                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  ENTITY::hsc($mem->getRealName()); ?>" /></td>
1855                 </tr><tr>
1856                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1857                         <td><?php echo _MEMBERS_PWD?></td>
1858                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1859                 </tr><tr>
1860                         <td><?php echo _MEMBERS_REPPWD?></td>
1861                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1862                 <?php } ?>
1863                 </tr><tr>
1864                         <td><?php echo _MEMBERS_EMAIL?>
1865                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1866                         </td>
1867                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($mem->getEmail()); ?>" /></td>
1868                 </tr><tr>
1869                         <td><?php echo _MEMBERS_URL?></td>
1870                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getURL()); ?>" /></td>
1871                 <?php // only allow to change this by super-admins
1872                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1873                    if ($member->isAdmin()) {
1874                 ?>
1875                         </tr><tr>
1876                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1877                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1878                         </tr><tr>
1879                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1880                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1881                 <?php } ?>
1882                 </tr><tr>
1883                         <td><?php echo _MEMBERS_NOTES?></td>
1884                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getNotes()); ?>" /></td>
1885                 </tr><tr>
1886                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>
1887                         </td>
1888                         <td>
1889
1890                                 <select name="locale" tabindex="85">
1891                                 <?php
1892                                 $locales = i18n::get_available_locale_list();
1893                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1894                                 {
1895                                         echo "<option value=\"\" selected=\"selected\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1896                                 }
1897                                 else
1898                                 {
1899                                         echo "<option value=\"\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1900                                 }
1901
1902                                 foreach( $locales as $locale )
1903                                 {
1904                                         if( $locale == $mem->getLocale() )
1905                                         {
1906                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1907                                         }
1908                                         else
1909                                         {
1910                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1911                                         }
1912                                 }
1913                                 ?>
1914                                 </select>
1915
1916                         </td>
1917                 </tr>
1918                 <tr>
1919                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1920                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1921                 </tr>
1922                 <?php
1923                         // plugin options
1924                         $this->_insertPluginOptions('member',$memberid);
1925                 ?>
1926                 <tr>
1927                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1928                 </tr><tr>
1929                         <td><?php echo _MEMBERS_EDIT?></td>
1930                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1931                 </tr></table>
1932
1933                 </div></form>
1934
1935                 <?php
1936                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1937
1938                         $manager->notify(
1939                                 'MemberSettingsFormExtras',
1940                                 array(
1941                                         'member' => &$mem
1942                                 )
1943                         );
1944                 $this->pagefoot();
1945         }
1946
1947     /**
1948      * @todo document this
1949      */
1950     function action_changemembersettings() {
1951         global $member, $CONF, $manager;
1952
1953         $memberid = intRequestVar('memberid');
1954
1955         // check if allowed
1956         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1957
1958         $name           = trim(strip_tags(postVar('name')));
1959         $realname       = trim(strip_tags(postVar('realname')));
1960         $password       = postVar('password');
1961         $repeatpassword = postVar('repeatpassword');
1962         $email          = strip_tags(postVar('email'));
1963         $url            = strip_tags(postVar('url'));
1964
1965                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1966                 # original eregi: !eregi("^https?://", $url)
1967
1968                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1969                 if (!preg_match('#^https?://#', $url) )
1970                 {
1971                         $url = 'http://' . $url;
1972                 }
1973
1974         $admin          = postVar('admin');
1975         $canlogin       = postVar('canlogin');
1976         $notes          = strip_tags(postVar('notes'));
1977         $locale        = postVar('locale');
1978
1979         $mem = MEMBER::createFromID($memberid);
1980
1981         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1982
1983             if (!isValidDisplayName($name))
1984                 $this->error(_ERROR_BADNAME);
1985
1986             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1987                 $this->error(_ERROR_NICKNAMEINUSE);
1988
1989             if ($password != $repeatpassword)
1990                 $this->error(_ERROR_PASSWORDMISMATCH);
1991
1992             if ($password && (i18n::strlen($password) < 6))
1993                 $this->error(_ERROR_PASSWORDTOOSHORT);
1994
1995             if ($password) {
1996                                 $pwdvalid = true;
1997                                 $pwderror = '';
1998                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
1999                                 if (!$pwdvalid) {
2000                                         $this->error($pwderror);
2001                                 }
2002                         }
2003                 }
2004
2005                 if ( !NOTIFICATION::address_validation($email) )
2006                 {
2007                         $this->error(_ERROR_BADMAILADDRESS);
2008                 }
2009                 if ( !$realname )
2010                 {
2011                         $this->error(_ERROR_REALNAMEMISSING);
2012                 }
2013         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2014             $this->error(_ERROR_NOSUCHTRANSLATION);
2015
2016         // check if there will remain at least one site member with both the logon and admin rights
2017         // (check occurs when taking away one of these rights from such a member)
2018         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2019              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2020            )
2021         {
2022             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2023             if (sql_num_rows($r) < 2)
2024                 $this->error(_ERROR_ATLEASTONEADMIN);
2025         }
2026
2027         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2028             $mem->setDisplayName($name);
2029             if ($password)
2030                 $mem->setPassword($password);
2031         }
2032
2033         $oldEmail = $mem->getEmail();
2034
2035         $mem->setRealName($realname);
2036         $mem->setEmail($email);
2037         $mem->setURL($url);
2038         $mem->setNotes($notes);
2039         $mem->setLocale($locale);
2040
2041
2042         // only allow super-admins to make changes to the admin status
2043         if ($member->isAdmin()) {
2044             $mem->setAdmin($admin);
2045             $mem->setCanLogin($canlogin);
2046         }
2047
2048         $autosave = postVar ('autosave');
2049         $mem->setAutosave($autosave);
2050
2051         $mem->write();
2052
2053         // store plugin options
2054         $aOptions = requestArray('plugoption');
2055         NucleusPlugin::apply_plugin_options($aOptions);
2056         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2057
2058         // if email changed, generate new password
2059         if ($oldEmail != $mem->getEmail())
2060         {
2061             $mem->sendActivationLink('addresschange', $oldEmail);
2062             // logout member
2063             $mem->newCookieKey();
2064
2065             // only log out if the member being edited is the current member.
2066             if ($member->getID() == $memberid)
2067                 $member->logout();
2068             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2069             return;
2070         }
2071
2072
2073         if (  ( $mem->getID() == $member->getID() )
2074            && ( $mem->getDisplayName() != $member->getDisplayName() )
2075            ) {
2076             $mem->newCookieKey();
2077             $member->logout();
2078             $this->action_login(_MSG_LOGINAGAIN, 0);
2079         } else {
2080             $this->action_overview(_MSG_SETTINGSCHANGED);
2081         }
2082     }
2083
2084     /**
2085      * @todo document this
2086      */
2087     function action_memberadd() {
2088         global $member, $manager;
2089
2090         // check if allowed
2091         $member->isAdmin() or $this->disallow();
2092
2093         if (postVar('password') != postVar('repeatpassword'))
2094             $this->error(_ERROR_PASSWORDMISMATCH);
2095         if (i18n::strlen(postVar('password')) < 6)
2096             $this->error(_ERROR_PASSWORDTOOSHORT);
2097
2098         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2099         if ($res != 1)
2100             $this->error($res);
2101
2102         // fire PostRegister event
2103         $newmem = new MEMBER();
2104         $newmem->readFromName(postVar('name'));
2105         $manager->notify('PostRegister',array('member' => &$newmem));
2106
2107         $this->action_usermanagement();
2108     }
2109
2110     /**
2111      * Account activation
2112      *
2113      * @author dekarma
2114      */
2115     function action_activate() {
2116
2117         $key = getVar('key');
2118         $this->_showActivationPage($key);
2119     }
2120
2121     /**
2122      * @todo document this
2123      */
2124     function _showActivationPage($key, $message = '')
2125     {
2126         global $manager;
2127
2128         // clean up old activation keys
2129         MEMBER::cleanupActivationTable();
2130
2131         // get activation info
2132         $info = MEMBER::getActivationInfo($key);
2133
2134         if (!$info)
2135             $this->error(_ERROR_ACTIVATE);
2136
2137         $mem = MEMBER::createFromId($info->vmember);
2138
2139         if (!$mem)
2140             $this->error(_ERROR_ACTIVATE);
2141
2142         $text = '';
2143         $title = '';
2144         $bNeedsPasswordChange = true;
2145
2146         switch ($info->vtype)
2147         {
2148             case 'forgot':
2149                 $title = _ACTIVATE_FORGOT_TITLE;
2150                 $text = _ACTIVATE_FORGOT_TEXT;
2151                 break;
2152             case 'register':
2153                 $title = _ACTIVATE_REGISTER_TITLE;
2154                 $text = _ACTIVATE_REGISTER_TEXT;
2155                 break;
2156             case 'addresschange':
2157                 $title = _ACTIVATE_CHANGE_TITLE;
2158                 $text = _ACTIVATE_CHANGE_TEXT;
2159                 $bNeedsPasswordChange = false;
2160                 MEMBER::activate($key);
2161                 break;
2162         }
2163
2164         $aVars = array(
2165             'memberName' => ENTITY::hsc($mem->getDisplayName())
2166         );
2167         $title = TEMPLATE::fill($title, $aVars);
2168         $text = TEMPLATE::fill($text, $aVars);
2169
2170         $this->pagehead();
2171
2172             echo '<h2>' , $title, '</h2>';
2173             echo '<p>' , $text, '</p>';
2174
2175             if ($message != '')
2176             {
2177                 echo '<p class="error">',$message,'</p>';
2178             }
2179
2180             if ($bNeedsPasswordChange)
2181             {
2182                 ?>
2183                     <div><form action="index.php" method="post">
2184
2185                         <input type="hidden" name="action" value="activatesetpwd" />
2186                         <?php $manager->addTicketHidden() ?>
2187                         <input type="hidden" name="key" value="<?php echo ENTITY::hsc($key) ?>" />
2188
2189                         <table><tr>
2190                             <td><?php echo _MEMBERS_PWD?></td>
2191                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2192                         </tr><tr>
2193                             <td><?php echo _MEMBERS_REPPWD?></td>
2194                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2195                         <?php
2196
2197                             global $manager;
2198                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2199
2200                         ?>
2201                         </tr><tr>
2202                             <td><?php echo _MEMBERS_SETPWD ?></td>
2203                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2204                         </tr></table>
2205
2206
2207                     </form></div>
2208
2209                 <?php
2210
2211             }
2212
2213         $this->pagefoot();
2214
2215     }
2216
2217     /**
2218      * Account activation - set password part
2219      *
2220      * @author dekarma
2221      */
2222     function action_activatesetpwd() {
2223
2224         $key = postVar('key');
2225
2226         // clean up old activation keys
2227         MEMBER::cleanupActivationTable();
2228
2229         // get activation info
2230         $info = MEMBER::getActivationInfo($key);
2231
2232         if (!$info || ($info->type == 'addresschange'))
2233             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2234
2235         $mem = MEMBER::createFromId($info->vmember);
2236
2237         if (!$mem)
2238             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2239
2240         $password       = postVar('password');
2241         $repeatpassword = postVar('repeatpassword');
2242
2243         if ($password != $repeatpassword)
2244             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2245
2246         if ($password && (i18n::strlen($password) < 6))
2247             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2248
2249         if ($password) {
2250                         $pwdvalid = true;
2251                         $pwderror = '';
2252                         global $manager;
2253                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2254                         if (!$pwdvalid) {
2255                                 return $this->_showActivationPage($key,$pwderror);
2256                         }
2257                 }
2258
2259         $error = '';
2260
2261         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2262         if ($error != '')
2263             return $this->_showActivationPage($key, $error);
2264
2265
2266         // set password
2267         $mem->setPassword($password);
2268         $mem->write();
2269
2270         // do the activation
2271         MEMBER::activate($key);
2272
2273         $this->pagehead();
2274             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2275             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2276         $this->pagefoot();
2277     }
2278
2279     /**
2280      * Manage team
2281      */
2282     function action_manageteam() {
2283         global $member, $manager;
2284
2285         $blogid = intRequestVar('blogid');
2286
2287         // check if allowed
2288         $member->blogAdminRights($blogid) or $this->disallow();
2289
2290         $this->pagehead();
2291
2292         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2293
2294         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2295
2296         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2297
2298
2299
2300         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2301                . ' FROM '.sql_table('member').', '.sql_table('team')
2302                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2303
2304         $template['content'] = 'teamlist';
2305         $template['tabindex'] = 10;
2306
2307         $manager->loadClass("ENCAPSULATE");
2308         $batch = new BATCH('team');
2309         $batch->showlist($query, 'table', $template);
2310
2311         ?>
2312             <h3><?php echo _TEAM_ADDNEW?></h3>
2313
2314             <form method='post' action='index.php'><div>
2315
2316             <input type='hidden' name='action' value='teamaddmember' />
2317             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2318             <?php $manager->addTicketHidden() ?>
2319
2320             <table><tr>
2321                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2322                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2323                     $query =  'SELECT mname as text, mnumber as value'
2324                            . ' FROM '.sql_table('member');
2325
2326                     $template['name'] = 'memberid';
2327                     $template['tabindex'] = 10000;
2328                     showlist($query,'select',$template);
2329                 ?></td>
2330             </tr><tr>
2331                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2332                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2333             </tr><tr>
2334                 <td><?php echo _TEAM_ADD?></td>
2335                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2336             </tr></table>
2337
2338             </div></form>
2339         <?php
2340         $this->pagefoot();
2341     }
2342
2343     /**
2344      * Add member to team
2345      */
2346     function action_teamaddmember() {
2347         global $member, $manager;
2348
2349         $memberid = intPostVar('memberid');
2350         $blogid = intPostVar('blogid');
2351         $admin = intPostVar('admin');
2352
2353         // check if allowed
2354         $member->blogAdminRights($blogid) or $this->disallow();
2355
2356         $blog =& $manager->getBlog($blogid);
2357         if (!$blog->addTeamMember($memberid, $admin))
2358             $this->error(_ERROR_ALREADYONTEAM);
2359
2360         $this->action_manageteam();
2361
2362     }
2363
2364     /**
2365      * @todo document this
2366      */
2367     function action_teamdelete() {
2368         global $member, $manager;
2369
2370         $memberid = intRequestVar('memberid');
2371         $blogid = intRequestVar('blogid');
2372
2373         // check if allowed
2374         $member->blogAdminRights($blogid) or $this->disallow();
2375
2376         $teammem = MEMBER::createFromID($memberid);
2377         $blog =& $manager->getBlog($blogid);
2378
2379         $this->pagehead();
2380         ?>
2381             <h2><?php echo _DELETE_CONFIRM?></h2>
2382
2383             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  ENTITY::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  ENTITY::hsc(strip_tags($blog->getName())) ?></b>
2384             </p>
2385
2386
2387             <form method="post" action="index.php"><div>
2388             <input type="hidden" name="action" value="teamdeleteconfirm" />
2389             <?php $manager->addTicketHidden() ?>
2390             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2391             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2392             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2393             </div></form>
2394         <?php
2395         $this->pagefoot();
2396     }
2397
2398     /**
2399      * @todo document this
2400      */
2401     function action_teamdeleteconfirm() {
2402         global $member;
2403
2404         $memberid = intRequestVar('memberid');
2405         $blogid = intRequestVar('blogid');
2406
2407         $error = $this->deleteOneTeamMember($blogid, $memberid);
2408         if ($error)
2409             $this->error($error);
2410
2411
2412         $this->action_manageteam();
2413     }
2414
2415     /**
2416      * @todo document this
2417      */
2418     function deleteOneTeamMember($blogid, $memberid) {
2419         global $member, $manager;
2420
2421         $blogid = intval($blogid);
2422         $memberid = intval($memberid);
2423
2424         // check if allowed
2425         if (!$member->blogAdminRights($blogid))
2426             return _ERROR_DISALLOWED;
2427
2428         // check if: - there remains at least one blog admin
2429         //           - (there remains at least one team member)
2430         $tmem = MEMBER::createFromID($memberid);
2431
2432         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2433
2434         if ($tmem->isBlogAdmin($blogid)) {
2435             // check if there are more blog members left and at least one admin
2436             // (check for at least two admins before deletion)
2437             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2438             $r = sql_query($query);
2439             if (sql_num_rows($r) < 2)
2440                 return _ERROR_ATLEASTONEBLOGADMIN;
2441         }
2442
2443         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2444         sql_query($query);
2445
2446         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2447
2448         return '';
2449     }
2450
2451     /**
2452      * @todo document this
2453      */
2454     function action_teamchangeadmin() {
2455         global $member;
2456
2457         $blogid = intRequestVar('blogid');
2458         $memberid = intRequestVar('memberid');
2459
2460         // check if allowed
2461         $member->blogAdminRights($blogid) or $this->disallow();
2462
2463         $mem = MEMBER::createFromID($memberid);
2464
2465         // don't allow when there is only one admin at this moment
2466         if ($mem->isBlogAdmin($blogid)) {
2467             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2468             if (sql_num_rows($r) == 1)
2469                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2470         }
2471
2472         if ($mem->isBlogAdmin($blogid))
2473             $newval = 0;
2474         else
2475             $newval = 1;
2476
2477         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2478         sql_query($query);
2479
2480         // only show manageteam if member did not change its own admin privileges
2481         if ($member->isBlogAdmin($blogid))
2482             $this->action_manageteam();
2483         else
2484             $this->action_overview(_MSG_ADMINCHANGED);
2485     }
2486
2487     /**
2488      * @todo document this
2489      */
2490     function action_blogsettings() {
2491         global $member, $manager;
2492
2493         $blogid = intRequestVar('blogid');
2494
2495         // check if allowed
2496         $member->blogAdminRights($blogid) or $this->disallow();
2497
2498         $blog =& $manager->getBlog($blogid);
2499
2500         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2501         $this->pagehead($extrahead);
2502
2503         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2504         ?>
2505         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2506
2507         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2508
2509         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2510         <?php
2511             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2512             $aMemberNames = array();
2513             while ($o = sql_fetch_object($res))
2514                 array_push($aMemberNames, ENTITY::hsc($o->mname) . ' (' . ENTITY::hsc($o->mrealname). ')');
2515             echo implode(',', $aMemberNames);
2516         ?>
2517         </p>
2518
2519
2520
2521         <p>
2522         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2523         </p>
2524
2525         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2526
2527         <form method="post" action="index.php"><div>
2528
2529         <input type="hidden" name="action" value="blogsettingsupdate" />
2530         <?php $manager->addTicketHidden() ?>
2531         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2532         <table><tr>
2533             <td><?php echo _EBLOG_NAME?></td>
2534             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getName()) ?>" /></td>
2535         </tr><tr>
2536             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2537                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2538             </td>
2539             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  ENTITY::hsc($blog->getShortName()) ?>" /></td>
2540         </tr><tr>
2541             <td><?php echo _EBLOG_DESC?></td>
2542             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  ENTITY::hsc($blog->getDescription()) ?>" /></td>
2543         </tr><tr>
2544             <td><?php echo _EBLOG_URL?></td>
2545             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($blog->getURL()) ?>" /></td>
2546         </tr><tr>
2547             <td><?php echo _EBLOG_DEFSKIN?>
2548                 <?php help('blogdefaultskin'); ?>
2549             </td>
2550             <td>
2551                 <?php
2552                     $query =  'SELECT sdname as text, sdnumber as value'
2553                            . ' FROM '.sql_table('skin_desc');
2554                     $template['name'] = 'defskin';
2555                     $template['selected'] = $blog->getDefaultSkin();
2556                     $template['tabindex'] = 50;
2557                     showlist($query,'select',$template);
2558                 ?>
2559
2560             </td>
2561         </tr><tr>
2562             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2563             </td>
2564             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2565         </tr><tr>
2566             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2567             </td>
2568             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2569         </tr><tr>
2570             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2571             </td>
2572             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2573         </tr><tr>
2574             <td><?php echo _EBLOG_ANONYMOUS?>
2575             </td>
2576             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2577         </tr><tr>
2578     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2579          </td>
2580          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2581       </tr><tr>
2582             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2583             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  ENTITY::hsc($blog->getNotifyAddress()); ?>" /></td>
2584         </tr><tr>
2585             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2586             <td>
2587                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2588                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2589                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2590                 <br />
2591                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2592                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2593                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2594                 <br />
2595                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2596                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2597                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2598             </td>
2599         </tr><tr>
2600             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2601             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  ENTITY::hsc($blog->getMaxComments()); ?>" /></td>
2602         </tr><tr>
2603             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2604             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getUpdateFile()) ?>" /></td>
2605         </tr><tr>
2606             <td><?php echo _EBLOG_DEFCAT?></td>
2607             <td>
2608                 <?php
2609                     $query =  'SELECT cname as text, catid as value'
2610                            . ' FROM '.sql_table('category')
2611                            . ' WHERE cblog=' . $blog->getID();
2612                     $template['name'] = 'defcat';
2613                     $template['selected'] = $blog->getDefaultCategory();
2614                     $template['tabindex'] = 110;
2615                     showlist($query,'select',$template);
2616                 ?>
2617             </td>
2618         </tr><tr>
2619             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2620                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2621                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2622                 </td>
2623             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  ENTITY::hsc($blog->getTimeOffset()); ?>" /></td>
2624         </tr><tr>
2625             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2626             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2627         </tr>
2628         <?php
2629             // plugin options
2630             $this->_insertPluginOptions('blog',$blogid);
2631         ?>
2632         <tr>
2633             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2634         </tr><tr>
2635             <td><?php echo _EBLOG_CHANGE?></td>
2636             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2637         </tr></table>
2638
2639         </div></form>
2640
2641         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2642
2643
2644         <?php
2645         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2646         $template['content'] = 'categorylist';
2647         $template['tabindex'] = 200;
2648
2649         $manager->loadClass("ENCAPSULATE");
2650         $batch = new BATCH('category');
2651         $batch->showlist($query,'table',$template);
2652
2653         ?>
2654
2655
2656         <form action="index.php" method="post"><div>
2657         <input name="action" value="categorynew" type="hidden" />
2658         <?php $manager->addTicketHidden() ?>
2659         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2660
2661         <table><tr>
2662             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2663         </tr><tr>
2664             <td><?php echo _EBLOG_CAT_NAME?></td>
2665             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2666         </tr><tr>
2667             <td><?php echo _EBLOG_CAT_DESC?></td>
2668             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2669         </tr><tr>
2670             <td><?php echo _EBLOG_CAT_CREATE?></td>
2671             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2672         </tr></table>
2673
2674         </div></form>
2675
2676         <?php
2677
2678             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2679
2680             $manager->notify(
2681                 'BlogSettingsFormExtras',
2682                 array(
2683                     'blog' => &$blog
2684                 )
2685             );
2686
2687         $this->pagefoot();
2688     }
2689
2690     /**
2691      * @todo document this
2692      */
2693     function action_categorynew() {
2694         global $member, $manager;
2695
2696         $blogid = intRequestVar('blogid');
2697
2698         $member->blogAdminRights($blogid) or $this->disallow();
2699
2700         $cname = postVar('cname');
2701         $cdesc = postVar('cdesc');
2702
2703         if (!isValidCategoryName($cname))
2704             $this->error(_ERROR_BADCATEGORYNAME);
2705
2706         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2707         $res = sql_query($query);
2708         if (sql_num_rows($res) > 0)
2709             $this->error(_ERROR_DUPCATEGORYNAME);
2710
2711         $blog       =& $manager->getBlog($blogid);
2712         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2713
2714         $this->action_blogsettings();
2715     }
2716
2717     /**
2718      * @todo document this
2719      */
2720     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2721         global $member, $manager;
2722
2723         if ($blogid == '')
2724             $blogid = intGetVar('blogid');
2725         else
2726             $blogid = intval($blogid);
2727         if ($catid == '')
2728             $catid = intGetVar('catid');
2729         else
2730             $catid = intval($catid);
2731
2732         $member->blogAdminRights($blogid) or $this->disallow();
2733
2734         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2735         $obj = sql_fetch_object($res);
2736
2737         $cname = $obj->cname;
2738         $cdesc = $obj->cdesc;
2739
2740         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2741         $this->pagehead($extrahead);
2742
2743         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2744
2745         ?>
2746         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo ENTITY::hsc($cname)?>'</h2>
2747         <form method='post' action='index.php'><div>
2748         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2749         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2750         <input name="desturl" type="hidden" value="<?php echo ENTITY::hsc($desturl) ?>" />
2751         <input name="action" type="hidden" value="categoryupdate" />
2752         <?php $manager->addTicketHidden(); ?>
2753
2754         <table><tr>
2755             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2756         </tr><tr>
2757             <td><?php echo _EBLOG_CAT_NAME?></td>
2758             <td><input type="text" name="cname" value="<?php echo ENTITY::hsc($cname)?>" size="40" maxlength="40" /></td>
2759         </tr><tr>
2760             <td><?php echo _EBLOG_CAT_DESC?></td>
2761             <td><input type="text" name="cdesc" value="<?php echo ENTITY::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2762         </tr>
2763         <?php
2764             // insert plugin options
2765             $this->_insertPluginOptions('category',$catid);
2766         ?>
2767         <tr>
2768             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2769         </tr><tr>
2770             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2771             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2772         </tr></table>
2773
2774         </div></form>
2775         <?php
2776         $this->pagefoot();
2777     }
2778
2779     /**
2780      * @todo document this
2781      */
2782     function action_categoryupdate() {
2783         global $member, $manager;
2784
2785         $blogid = intPostVar('blogid');
2786         $catid = intPostVar('catid');
2787         $cname = postVar('cname');
2788         $cdesc = postVar('cdesc');
2789         $desturl = postVar('desturl');
2790
2791         $member->blogAdminRights($blogid) or $this->disallow();
2792
2793         if (!isValidCategoryName($cname))
2794             $this->error(_ERROR_BADCATEGORYNAME);
2795
2796         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2797         $res = sql_query($query);
2798         if (sql_num_rows($res) > 0)
2799             $this->error(_ERROR_DUPCATEGORYNAME);
2800
2801         $query =  'UPDATE '.sql_table('category').' SET'
2802                . " cname='" . sql_real_escape_string($cname) . "',"
2803                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2804                . " WHERE catid=" . $catid;
2805
2806         sql_query($query);
2807
2808         // store plugin options
2809         $aOptions = requestArray('plugoption');
2810         NucleusPlugin::apply_plugin_options($aOptions);
2811         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2812
2813
2814         if ($desturl) {
2815             redirect($desturl);
2816             exit;
2817         } else {
2818             $this->action_blogsettings();
2819         }
2820     }
2821
2822     /**
2823      * @todo document this
2824      */
2825     function action_categorydelete() {
2826         global $member, $manager;
2827
2828         $blogid = intRequestVar('blogid');
2829         $catid = intRequestVar('catid');
2830
2831         $member->blogAdminRights($blogid) or $this->disallow();
2832
2833         $blog =& $manager->getBlog($blogid);
2834
2835         // check if the category is valid
2836         if (!$blog->isValidCategory($catid))
2837             $this->error(_ERROR_NOSUCHCATEGORY);
2838
2839         // don't allow deletion of default category
2840         if ($blog->getDefaultCategory() == $catid)
2841             $this->error(_ERROR_DELETEDEFCATEGORY);
2842
2843         // check if catid is the only category left for blogid
2844         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2845         $res = sql_query($query);
2846         if (sql_num_rows($res) == 1)
2847             $this->error(_ERROR_DELETELASTCATEGORY);
2848
2849
2850         $this->pagehead();
2851         ?>
2852             <h2><?php echo _DELETE_CONFIRM?></h2>
2853
2854             <div>
2855             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  ENTITY::hsc($blog->getCategoryName($catid))?></b>
2856             </div>
2857
2858             <form method="post" action="index.php"><div>
2859             <input type="hidden" name="action" value="categorydeleteconfirm" />
2860             <?php $manager->addTicketHidden() ?>
2861             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2862             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2863             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2864             </div></form>
2865         <?php
2866         $this->pagefoot();
2867     }
2868
2869     /**
2870      * @todo document this
2871      */
2872     function action_categorydeleteconfirm() {
2873         global $member, $manager;
2874
2875         $blogid = intRequestVar('blogid');
2876         $catid = intRequestVar('catid');
2877
2878         $member->blogAdminRights($blogid) or $this->disallow();
2879
2880         $error = $this->deleteOneCategory($catid);
2881         if ($error)
2882             $this->error($error);
2883
2884         $this->action_blogsettings();
2885     }
2886
2887         /**
2888          * ADMIN::deleteOneCategory()
2889          * Delete a category by its id
2890          *
2891          * @param       String  $catid  category id for deleting
2892          * @return      Void
2893          */
2894         function deleteOneCategory($catid)
2895         {
2896                 global $manager, $member;
2897
2898                 $catid = intval($catid);
2899                 $blogid = getBlogIDFromCatID($catid);
2900
2901                 if ( !$member->blogAdminRights($blogid) )
2902                 {
2903                         return ERROR_DISALLOWED;
2904                 }
2905
2906                 // get blog
2907                 $blog =& $manager->getBlog($blogid);
2908
2909                 // check if the category is valid
2910                 if ( !$blog || !$blog->isValidCategory($catid) )
2911                 {
2912                         return _ERROR_NOSUCHCATEGORY;
2913                 }
2914
2915                 $destcatid = $blog->getDefaultCategory();
2916
2917                 // don't allow deletion of default category
2918                 if ( $blog->getDefaultCategory() == $catid )
2919                 {
2920                         return _ERROR_DELETEDEFCATEGORY;
2921                 }
2922
2923                 // check if catid is the only category left for blogid
2924                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2925                 $res = sql_query($query);
2926                 if ( sql_num_rows($res) == 1 )
2927                 {
2928                         return _ERROR_DELETELASTCATEGORY;
2929                 }
2930
2931                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2932
2933                 // change category for all items to the default category
2934                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2935                 sql_query($query);
2936
2937                 // delete all associated plugin options
2938                 NucleusPlugin::delete_option_values('category', $catid);
2939
2940                 // delete category
2941                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2942                 sql_query($query);
2943
2944                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2945                 return;
2946         }
2947
2948         /**
2949          * ADMIN::action_blogsettingsupdate
2950          * Updating blog settings
2951          *
2952          * @param       Void
2953          * @return      Void
2954          */
2955         function action_blogsettingsupdate()
2956         {
2957                 global $member, $manager;
2958
2959                 $blogid = intRequestVar('blogid');
2960
2961                 $member->blogAdminRights($blogid) or $this->disallow();
2962
2963                 $blog =& $manager->getBlog($blogid);
2964
2965                 $notify_address = trim(postVar('notify'));
2966                 $shortname              = trim(postVar('shortname'));
2967                 $updatefile     = trim(postVar('update'));
2968
2969                 $notifyComment  = intPostVar('notifyComment');
2970                 $notifyVote             = intPostVar('notifyVote');
2971                 $notifyNewItem  = intPostVar('notifyNewItem');
2972
2973                 if ( $notifyComment == 0 )
2974                 {
2975                         $notifyComment = 1;
2976                 }
2977                 if ( $notifyVote == 0 )
2978                 {
2979                         $notifyVote = 1;
2980                 }
2981                 if ( $notifyNewItem == 0 )
2982                 {
2983                         $notifyNewItem = 1;
2984                 }
2985                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2986
2987                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2988                 {
2989                         $this->error(_ERROR_BADNOTIFY);
2990                 }
2991
2992                 if ( !isValidShortName($shortname) )
2993                 {
2994                         $this->error(_ERROR_BADSHORTBLOGNAME);
2995                 }
2996
2997                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2998                 {
2999                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3000                 }
3001                 // check if update file is writable
3002                 if ( $updatefile && !is_writeable($updatefile) )
3003                 {
3004                         $this->error(_ERROR_UPDATEFILE);
3005                 }
3006
3007                 $blog->setName(trim(postVar('name')));
3008                 $blog->setShortName($shortname);
3009                 $blog->setNotifyAddress($notify_address);
3010                 $blog->setNotifyType($notifyType);
3011                 $blog->setMaxComments(postVar('maxcomments'));
3012                 $blog->setCommentsEnabled(postVar('comments'));
3013                 $blog->setTimeOffset(postVar('timeoffset'));
3014                 $blog->setUpdateFile($updatefile);
3015                 $blog->setURL(trim(postVar('url')));
3016                 $blog->setDefaultSkin(intPostVar('defskin'));
3017                 $blog->setDescription(trim(postVar('desc')));
3018                 $blog->setPublic(postVar('public'));
3019                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3020                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3021                 $blog->setDefaultCategory(intPostVar('defcat'));
3022                 $blog->setSearchable(intPostVar('searchable'));
3023                 $blog->setEmailRequired(intPostVar('reqemail'));
3024                 $blog->writeSettings();
3025
3026                 // store plugin options
3027                 $aOptions = requestArray('plugoption');
3028                 NucleusPlugin::apply_plugin_options($aOptions);
3029                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3030
3031                 $this->action_overview(_MSG_SETTINGSCHANGED);
3032                 return;
3033         }
3034
3035     /**
3036      * @todo document this
3037      */
3038     function action_deleteblog() {
3039         global $member, $CONF, $manager;
3040
3041         $blogid = intRequestVar('blogid');
3042
3043         $member->blogAdminRights($blogid) or $this->disallow();
3044
3045         // check if blog is default blog
3046         if ($CONF['DefaultBlog'] == $blogid)
3047             $this->error(_ERROR_DELDEFBLOG);
3048
3049         $blog =& $manager->getBlog($blogid);
3050
3051         $this->pagehead();
3052         ?>
3053             <h2><?php echo _DELETE_CONFIRM?></h2>
3054
3055             <p><?php echo _WARNINGTXT_BLOGDEL?>
3056             </p>
3057
3058             <div>
3059             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  ENTITY::hsc($blog->getName())?></b>
3060             </div>
3061
3062             <form method="post" action="index.php"><div>
3063             <input type="hidden" name="action" value="deleteblogconfirm" />
3064             <?php $manager->addTicketHidden() ?>
3065             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3066             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3067             </div></form>
3068         <?php
3069         $this->pagefoot();
3070     }
3071
3072         /**
3073          * ADMIN::action_deleteblogconfirm()
3074          * Delete Blog
3075          *
3076          * @param       Void
3077          * @return      Void
3078          */
3079         function action_deleteblogconfirm()
3080         {
3081                 global $member, $CONF, $manager;
3082
3083                 $blogid = intRequestVar('blogid');
3084                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3085                 $member->blogAdminRights($blogid) or $this->disallow();
3086
3087                 // check if blog is default blog
3088                 if ( $CONF['DefaultBlog'] == $blogid )
3089                 {
3090                         $this->error(_ERROR_DELDEFBLOG);
3091                 }
3092
3093                 // delete all comments
3094                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3095                 sql_query($query);
3096
3097                 // delete all items
3098                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3099                 sql_query($query);
3100
3101                 // delete all team members
3102                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3103                 sql_query($query);
3104
3105                 // delete all bans
3106                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3107                 sql_query($query);
3108
3109                 // delete all categories
3110                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3111                 sql_query($query);
3112
3113                 // delete all associated plugin options
3114                 NucleusPlugin::delete_option_values('blog', $blogid);
3115
3116                 // delete the blog itself
3117                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3118                 sql_query($query);
3119
3120                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3121
3122                 $this->action_overview(_DELETED_BLOG);
3123                 return;
3124         }
3125
3126     /**
3127      * @todo document this
3128      */
3129     function action_memberdelete() {
3130         global $member, $manager;
3131
3132         $memberid = intRequestVar('memberid');
3133
3134         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3135
3136         $mem = MEMBER::createFromID($memberid);
3137
3138         $this->pagehead();
3139         ?>
3140             <h2><?php echo _DELETE_CONFIRM?></h2>
3141
3142             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo ENTITY::hsc($mem->getDisplayName()) ?></b>
3143             </p>
3144
3145             <p>
3146             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3147             </p>
3148
3149             <form method="post" action="index.php"><div>
3150             <input type="hidden" name="action" value="memberdeleteconfirm" />
3151             <?php $manager->addTicketHidden() ?>
3152             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3153             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3154             </div></form>
3155         <?php
3156         $this->pagefoot();
3157     }
3158
3159     /**
3160      * @todo document this
3161      */
3162     function action_memberdeleteconfirm() {
3163         global $member;
3164
3165         $memberid = intRequestVar('memberid');
3166
3167         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3168
3169         $error = $this->deleteOneMember($memberid);
3170         if ($error)
3171             $this->error($error);
3172
3173         if ($member->isAdmin())
3174             $this->action_usermanagement();
3175         else
3176             $this->action_overview(_DELETED_MEMBER);
3177     }
3178
3179         /**
3180          * ADMIN::deleteOneMember()
3181          * Delete a member by id
3182          *
3183          * @static
3184          * @params      Integer $memberid       member id
3185          * @return      String  null string or error messages
3186          */
3187         function deleteOneMember($memberid)
3188         {
3189                 global $manager;
3190
3191                 $memberid = intval($memberid);
3192                 $mem = MEMBER::createFromID($memberid);
3193
3194                 if ( !$mem->canBeDeleted() )
3195                 {
3196                         return _ERROR_DELETEMEMBER;
3197                 }
3198
3199                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3200
3201                 /* unlink comments from memberid */
3202                 if ( $memberid )
3203                 {
3204                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3205                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3206                         sql_query($query);
3207                 }
3208
3209                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3210                 sql_query($query);
3211
3212                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3213                 sql_query($query);
3214
3215                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3216                 sql_query($query);
3217
3218                 // delete all associated plugin options
3219                 NucleusPlugin::delete_option_values('member', $memberid);
3220
3221                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3222
3223                 return '';
3224         }
3225
3226     /**
3227      * @todo document this
3228      */
3229     function action_createnewlog() {
3230         global $member, $CONF, $manager;
3231
3232         // Only Super-Admins can do this
3233         $member->isAdmin() or $this->disallow();
3234
3235         $this->pagehead();
3236
3237         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3238         ?>
3239         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3240
3241         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3242
3243         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3244
3245         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3246
3247         <ol>
3248             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3249             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3250         </ol>
3251
3252         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3253
3254         <p>
3255         <?php echo _EBLOG_CREATE_TEXT?>
3256         </p>
3257
3258         <form method="post" action="index.php"><div>
3259
3260         <input type="hidden" name="action" value="addnewlog" />
3261         <?php $manager->addTicketHidden() ?>
3262
3263
3264         <table><tr>
3265             <td><?php echo _EBLOG_NAME?></td>
3266             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3267         </tr><tr>
3268             <td><?php echo _EBLOG_SHORTNAME?>
3269                 <?php help('shortblogname'); ?>
3270             </td>
3271             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3272         </tr><tr>
3273             <td><?php echo _EBLOG_DESC?></td>
3274             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3275         </tr><tr>
3276             <td><?php echo _EBLOG_DEFSKIN?>
3277                 <?php help('blogdefaultskin'); ?>
3278             </td>
3279             <td>
3280                 <?php
3281                     $query =  'SELECT sdname as text, sdnumber as value'
3282                            . ' FROM '.sql_table('skin_desc');
3283                     $template['name'] = 'defskin';
3284                     $template['tabindex'] = 50;
3285                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3286                     showlist($query,'select',$template);
3287                 ?>
3288             </td>
3289         </tr><tr>
3290             <td><?php echo _EBLOG_OFFSET?>
3291                 <?php help('blogtimeoffset'); ?>
3292                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3293             </td>
3294             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3295         </tr><tr>
3296             <td><?php echo _EBLOG_ADMIN?>
3297                 <?php help('teamadmin'); ?>
3298             </td>
3299             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3300         </tr><tr>
3301             <td><?php echo _EBLOG_CREATE?></td>
3302             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3303         </tr></table>
3304
3305         </div></form>
3306         <?php
3307         $this->pagefoot();
3308     }
3309
3310     /**
3311      * @todo document this
3312      */
3313     function action_addnewlog() {
3314         global $member, $manager, $CONF;
3315
3316         // Only Super-Admins can do this
3317         $member->isAdmin() or $this->disallow();
3318
3319         $bname          = trim(postVar('name'));
3320         $bshortname     = trim(postVar('shortname'));
3321         $btimeoffset    = postVar('timeoffset');
3322         $bdesc          = trim(postVar('desc'));
3323         $bdefskin       = postVar('defskin');
3324
3325         if (!isValidShortName($bshortname))
3326             $this->error(_ERROR_BADSHORTBLOGNAME);
3327
3328         if ($manager->existsBlog($bshortname))
3329             $this->error(_ERROR_DUPSHORTBLOGNAME);
3330
3331         $manager->notify(
3332             'PreAddBlog',
3333             array(
3334                 'name' => &$bname,
3335                 'shortname' => &$bshortname,
3336                 'timeoffset' => &$btimeoffset,
3337                 'description' => &$bdesc,
3338                 'defaultskin' => &$bdefskin
3339             )
3340         );
3341
3342
3343         // add slashes for sql queries
3344         $bname =        sql_real_escape_string($bname);
3345         $bshortname =   sql_real_escape_string($bshortname);
3346         $btimeoffset =  sql_real_escape_string($btimeoffset);
3347         $bdesc =        sql_real_escape_string($bdesc);
3348         $bdefskin =     sql_real_escape_string($bdefskin);
3349
3350         // create blog
3351         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3352         sql_query($query);
3353         $blogid = sql_insert_id();
3354         $blog   =& $manager->getBlog($blogid);
3355
3356         // create new category
3357         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3358         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3359         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3360         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3361 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3362 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3363         $catid = sql_insert_id();
3364
3365         // set as default category
3366         $blog->setDefaultCategory($catid);
3367         $blog->writeSettings();
3368
3369         // create team member
3370         $memberid = $member->getID();
3371         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3372         sql_query($query);
3373
3374         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3375         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3376
3377         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3378         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3379
3380
3381
3382         $manager->notify(
3383             'PostAddBlog',
3384             array(
3385                 'blog' => &$blog
3386             )
3387         );
3388
3389         $manager->notify(
3390             'PostAddCategory',
3391             array(
3392                 'blog' => &$blog,
3393                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3394                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3395                 'catid' => $catid
3396             )
3397         );
3398
3399         $this->pagehead();
3400         ?>
3401         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3402
3403         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, ENTITY::hsc($bname)) ?></p>
3404
3405         <ol>
3406             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, ENTITY::hsc($bshortname)) ?></a></li>
3407             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3408         </ol>
3409
3410         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, ENTITY::hsc($bshortname)) ?></a></h3>
3411
3412         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, ENTITY::hsc($bshortname)) ?></p>
3413 <pre><code>&lt;?php
3414
3415 $CONF['Self'] = '<b><?php echo ENTITY::hsc($bshortname)?>.php</b>';
3416
3417 include('<i>./config.php</i>');
3418
3419 selectBlog('<b><?php echo ENTITY::hsc($bshortname)?></b>');
3420 selector();
3421
3422 ?&gt;</code></pre>
3423
3424         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3425
3426         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3427
3428         <form action="index.php" method="post"><div>
3429             <input type="hidden" name="action" value="addnewlog2" />
3430             <?php $manager->addTicketHidden() ?>
3431             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3432             <table><tr>
3433                 <td><?php echo _EBLOG_URL?></td>
3434                 <td><input name="url" maxlength="100" size="40" value="<?php echo ENTITY::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3435             </tr><tr>
3436                 <td><?php echo _EBLOG_CREATE?></td>
3437                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3438             </tr></table>
3439         </div></form>
3440
3441         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3442
3443         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3444
3445         <form action="index.php" method="post"><div>
3446             <input type="hidden" name="action" value="addnewlog2" />
3447             <?php $manager->addTicketHidden() ?>
3448             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3449             <table><tr>
3450                 <td><?php echo _EBLOG_URL?></td>
3451                 <td><input name="url" maxlength="100" size="40" /></td>
3452             </tr><tr>
3453                 <td><?php echo _EBLOG_CREATE?></td>
3454                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3455             </tr></table>
3456         </div></form>
3457
3458         <?php       $this->pagefoot();
3459
3460     }
3461
3462     /**
3463      * @todo document this
3464      */
3465     function action_addnewlog2() {
3466         global $member, $manager;
3467
3468         $member->blogAdminRights($blogid) or $this->disallow();
3469
3470         $burl   = requestVar('url');
3471         $blogid = intRequestVar('blogid');
3472
3473         $blog =& $manager->getBlog($blogid);
3474         $blog->setURL(trim($burl));
3475         $blog->writeSettings();
3476
3477         $this->action_overview(_MSG_NEWBLOG);
3478     }
3479
3480     /**
3481      * @todo document this
3482      */
3483     function action_skinieoverview() {
3484         global $member, $DIR_LIBS, $manager;
3485
3486         $member->isAdmin() or $this->disallow();
3487
3488         // load skinie class
3489         include_once($DIR_LIBS . 'skinie.php');
3490
3491         $this->pagehead();
3492
3493         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3494
3495     ?>
3496         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3497
3498                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3499                 <?php                   global $DIR_SKINS;
3500
3501                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3502
3503                     if (sizeof($candidates) > 0) {
3504                         ?>
3505                             <form method="post" action="index.php"><div>
3506                                 <input type="hidden" name="action" value="skinieimport" />
3507                                 <?php $manager->addTicketHidden() ?>
3508                                 <input type="hidden" name="mode" value="file" />
3509                                 <select name="skinfile" id="skinie_import_local">
3510                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3511                                         $html = ENTITY::hsc($skinfile);
3512                                         echo '<option value="',$html,'">',$skinname,'</option>';
3513                                     }
3514                                 ?>
3515                                 </select>
3516                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3517                             </div></form>
3518                         <?php                   } else {
3519                         echo _SKINIE_NOCANDIDATES;
3520                     }
3521                 ?>
3522                 </p>
3523
3524                 <p><em><?php echo _OR?></em></p>
3525
3526                 <form method="post" action="index.php"><p>
3527                     <?php $manager->addTicketHidden() ?>
3528                     <input type="hidden" name="action" value="skinieimport" />
3529                     <input type="hidden" name="mode" value="url" />
3530                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3531                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3532                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3533                 </p></form>
3534
3535
3536         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3537         <form method="post" action="index.php"><div>
3538             <input type="hidden" name="action" value="skinieexport" />
3539             <?php $manager->addTicketHidden() ?>
3540
3541             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3542
3543             <table><tr>
3544                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3545             </tr><tr>
3546     <?php       // show list of skins
3547         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3548         while ($skinObj = sql_fetch_object($res)) {
3549             $id = 'skinexp' . $skinObj->sdnumber;
3550             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3551             echo '<label for="',$id,'">',ENTITY::hsc($skinObj->sdname),'</label></td>';
3552             echo '<td>',ENTITY::hsc($skinObj->sddesc),'</td>';
3553             echo '</tr><tr>';
3554         }
3555
3556         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3557
3558         // show list of templates
3559         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3560         while ($templateObj = sql_fetch_object($res)) {
3561             $id = 'templateexp' . $templateObj->tdnumber;
3562             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3563             echo '<label for="',$id,'">',ENTITY::hsc($templateObj->tdname),'</label></td>';
3564             echo '<td>',ENTITY::hsc($templateObj->tddesc),'</td>';
3565             echo '</tr><tr>';
3566         }
3567
3568     ?>
3569                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3570             </tr><tr>
3571                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3572             </tr><tr>
3573                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3574             </tr><tr>
3575                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3576             </tr></table>
3577         </div></form>
3578
3579     <?php
3580         $this->pagefoot();
3581
3582     }
3583
3584     /**
3585      * @todo document this
3586      */
3587     function action_skinieimport() {
3588         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3589
3590         $member->isAdmin() or $this->disallow();
3591
3592         // load skinie class
3593         include_once($DIR_LIBS . 'skinie.php');
3594
3595         $skinFileRaw= postVar('skinfile');
3596         $mode       = postVar('mode');
3597
3598         $importer = new SKINIMPORT();
3599
3600         // get full filename
3601         if ($mode == 'file')
3602         {
3603             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3604
3605             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3606             if (!file_exists($skinFile))
3607                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3608         } else {
3609             $skinFile = $skinFileRaw;
3610         }
3611
3612         // read only metadata
3613         $error = $importer->readFile($skinFile, 1);
3614
3615         // clashes
3616         $skinNameClashes = $importer->checkSkinNameClashes();
3617         $templateNameClashes = $importer->checkTemplateNameClashes();
3618         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3619
3620         if ($error) $this->error($error);
3621
3622         $this->pagehead();
3623
3624         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3625         ?>
3626         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3627
3628         <ul>
3629             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3630             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3631             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3632             <?php
3633                 if ($hasNameClashes)
3634                 {
3635             ?>
3636             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3637             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3638             <?php
3639                 } // if (hasNameClashes)
3640             ?>
3641         </ul>
3642
3643         <form method="post" action="index.php"><div>
3644             <input type="hidden" name="action" value="skiniedoimport" />
3645             <?php $manager->addTicketHidden() ?>
3646             <input type="hidden" name="skinfile" value="<?php echo ENTITY::hsc(postVar('skinfile'))?>" />
3647             <input type="hidden" name="mode" value="<?php echo ENTITY::hsc($mode)?>" />
3648             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3649             <?php
3650                 if ($hasNameClashes)
3651                 {
3652             ?>
3653             <br />
3654             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3655             <?php
3656                 } // if (hasNameClashes)
3657             ?>
3658         </div></form>
3659
3660
3661         <?php
3662         $this->pagefoot();
3663     }
3664
3665     /**
3666      * @todo document this
3667      */
3668     function action_skiniedoimport() {
3669         global $member, $DIR_LIBS, $DIR_SKINS;
3670
3671         $member->isAdmin() or $this->disallow();
3672
3673         // load skinie class
3674         include_once($DIR_LIBS . 'skinie.php');
3675
3676         $skinFileRaw= postVar('skinfile');
3677         $mode       = postVar('mode');
3678
3679         $allowOverwrite = intPostVar('overwrite');
3680
3681         // get full filename
3682         if ($mode == 'file')
3683         {
3684             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3685
3686             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3687             if (!file_exists($skinFile))
3688                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3689
3690         } else {
3691             $skinFile = $skinFileRaw;
3692         }
3693
3694         $importer = new SKINIMPORT();
3695
3696         $error = $importer->readFile($skinFile);
3697
3698         if ($error)
3699             $this->error($error);
3700
3701         $error = $importer->writeToDatabase($allowOverwrite);
3702
3703         if ($error)
3704             $this->error($error);
3705
3706         $this->pagehead();
3707
3708         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3709     ?>
3710         <h2><?php echo _SKINIE_DONE?></h2>
3711
3712         <ul>
3713             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3714             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3715             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3716         </ul>
3717
3718     <?php       $this->pagefoot();
3719
3720     }
3721
3722     /**
3723      * @todo document this
3724      */
3725     function action_skinieexport() {
3726         global $member, $DIR_LIBS;
3727
3728         $member->isAdmin() or $this->disallow();
3729
3730         // load skinie class
3731         include_once($DIR_LIBS . 'skinie.php');
3732
3733         $aSkins = requestIntArray('skin');
3734         $aTemplates = requestIntArray('template');
3735
3736         if (!is_array($aTemplates)) $aTemplates = array();
3737         if (!is_array($aSkins)) $aSkins = array();
3738
3739         $skinList = array_keys($aSkins);
3740         $templateList = array_keys($aTemplates);
3741
3742         $info = postVar('info');
3743
3744         $exporter = new SKINEXPORT();
3745         foreach ($skinList as $skinId) {
3746             $exporter->addSkin($skinId);
3747         }
3748         foreach ($templateList as $templateId) {
3749             $exporter->addTemplate($templateId);
3750         }
3751         $exporter->setInfo($info);
3752
3753         $exporter->export();
3754     }
3755
3756     /**
3757      * @todo document this
3758      */
3759     function action_templateoverview() {
3760         global $member, $manager;
3761
3762         $member->isAdmin() or $this->disallow();
3763
3764         $this->pagehead();
3765
3766         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3767
3768         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3769         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3770
3771         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3772         $template['content'] = 'templatelist';
3773         $template['tabindex'] = 10;
3774         showlist($query,'table',$template);
3775
3776         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3777
3778         ?>
3779         <form method="post" action="index.php"><div>
3780
3781         <input name="action" value="templatenew" type="hidden" />
3782         <?php $manager->addTicketHidden() ?>
3783         <table><tr>
3784             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3785             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3786         </tr><tr>
3787             <td><?php echo _TEMPLATE_DESC?></td>
3788             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3789         </tr><tr>
3790             <td><?php echo _TEMPLATE_CREATE?></td>
3791             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3792         </tr></table>
3793
3794         </div></form>
3795
3796         <?php
3797         $this->pagefoot();
3798     }
3799
3800     /**
3801      * @todo document this
3802      */
3803     function action_templateedit($msg = '') {
3804         global $member, $manager;
3805
3806         $templateid = intRequestVar('templateid');
3807
3808         $member->isAdmin() or $this->disallow();
3809
3810         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3811         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3812
3813         $this->pagehead($extrahead);
3814
3815         $templatename = TEMPLATE::getNameFromId($templateid);
3816         $templatedescription = TEMPLATE::getDesc($templateid);
3817         $template =& $manager->getTemplate($templatename);
3818
3819         ?>
3820         <p>
3821         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3822         </p>
3823
3824         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  ENTITY::hsc($templatename); ?>'</h2>
3825
3826         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3827         ?>
3828
3829         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3830
3831         <form method="post" action="index.php">
3832         <div>
3833
3834         <input type="hidden" name="action" value="templateupdate" />
3835         <?php $manager->addTicketHidden() ?>
3836         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3837
3838         <table><tr>
3839             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3840         </tr><tr>
3841             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3842             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  ENTITY::hsc($templatename) ?>" /></td>
3843         </tr><tr>
3844             <td><?php echo _TEMPLATE_DESC?></td>
3845             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  ENTITY::hsc($templatedescription) ?>" /></td>
3846         </tr><tr>
3847             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3848         </tr><tr>
3849             <td><?php echo _TEMPLATE_UPDATE?></td>
3850             <td>
3851                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3852                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3853             </td>
3854         </tr><tr>
3855             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3856 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3857     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3858     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3859     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3860     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3861     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3862 ?>
3863         </tr><tr>
3864             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3865 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3866     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3867     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3868     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3869     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3870     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3871     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3872 ?>
3873         </tr><tr>
3874             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3875 <?php
3876     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3877 ?>
3878         </tr><tr>
3879             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3880 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3881 ?>
3882         </tr><tr>
3883             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3884 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3885     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3886     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3887 ?>
3888         </tr><tr>
3889             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3890 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3891     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3892     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3893 ?>
3894         </tr><tr>
3895             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3896 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3897     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3898     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3899 ?>
3900         </tr><tr>
3901             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3902 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3903     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3904     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3905     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3906     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3907 ?>
3908         </tr><tr>
3909             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3910 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3911     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3912     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3913 ?>
3914         </tr><tr>
3915             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3916 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3917     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3918 ?>
3919         </tr><tr>
3920             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3921 <?php
3922         $tab = 600;
3923         $pluginfields = array();
3924         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3925
3926         foreach ($pluginfields as $pfkey=>$pfvalue) {
3927             echo "</tr><tr>\n";
3928             echo '<th colspan="2">' . ENTITY::hen($pfkey) . "</th>\n";
3929             foreach ($pfvalue as $pffield=>$pfdesc) {
3930                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3931             }
3932         }
3933 ?>
3934         </tr><tr>
3935             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3936         </tr><tr>
3937             <td><?php echo _TEMPLATE_UPDATE?></td>
3938             <td>
3939                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3940                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3941             </td>
3942         </tr></table>
3943
3944         </div>
3945         </form>
3946         <?php
3947         $this->pagefoot();
3948     }
3949
3950     /**
3951      * @todo document this
3952      */
3953     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3954         static $count = 1;
3955         if (!isset($template[$name])) $template[$name] = '';
3956     ?>
3957         </tr><tr>
3958             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3959             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  ENTITY::hsc($template[$name]); ?></textarea></td>
3960     <?php       $count++;
3961     }
3962
3963     /**
3964      * @todo document this
3965      */
3966     function action_templateupdate() {
3967         global $member,$manager;
3968
3969         $templateid = intRequestVar('templateid');
3970
3971         $member->isAdmin() or $this->disallow();
3972
3973         $name = postVar('tname');
3974         $desc = postVar('tdesc');
3975
3976         if (!isValidTemplateName($name))
3977             $this->error(_ERROR_BADTEMPLATENAME);
3978
3979         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3980             $this->error(_ERROR_DUPTEMPLATENAME);
3981
3982
3983         $name = sql_real_escape_string($name);
3984         $desc = sql_real_escape_string($desc);
3985
3986         // 1. Remove all template parts
3987         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3988         sql_query($query);
3989
3990         // 2. Update description
3991         $query =  'UPDATE '.sql_table('template_desc').' SET'
3992                . " tdname='" . $name . "',"
3993                . " tddesc='" . $desc . "'"
3994                . " WHERE tdnumber=" . $templateid;
3995         sql_query($query);
3996
3997         // 3. Add non-empty template parts
3998         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3999         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4000         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4001         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4002         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4003         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4004         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4005         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4006         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4007         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4008         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4009         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4010         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4011         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4012         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4013         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4014         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4015         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4016         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4017         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4018         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4019         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4020         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4021         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4022         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4023         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4024         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4025         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4026         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4027         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4028         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4029         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4030         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4031         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4032
4033         $pluginfields = array();
4034         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4035         foreach ($pluginfields as $pfkey=>$pfvalue) {
4036             foreach ($pfvalue as $pffield=>$pfdesc) {
4037                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4038             }
4039         }
4040
4041         // jump back to template edit
4042         $this->action_templateedit(_TEMPLATE_UPDATED);
4043
4044     }
4045
4046     /**
4047      * @todo document this
4048      */
4049     function addToTemplate($id, $partname, $content) {
4050         $partname = sql_real_escape_string($partname);
4051         $content = sql_real_escape_string($content);
4052
4053         $id = intval($id);
4054
4055         // don't add empty parts:
4056         if (!trim($content)) return -1;
4057
4058         $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
4059                . "VALUES ($id, '$partname', '$content')";
4060         sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4061         return sql_insert_id();
4062     }
4063
4064     /**
4065      * @todo document this
4066      */
4067     function action_templatedelete() {
4068         global $member, $manager;
4069
4070         $member->isAdmin() or $this->disallow();
4071
4072         $templateid = intRequestVar('templateid');
4073         // TODO: check if template can be deleted
4074
4075         $this->pagehead();
4076
4077         $name = TEMPLATE::getNameFromId($templateid);
4078         $desc = TEMPLATE::getDesc($templateid);
4079
4080         ?>
4081             <h2><?php echo _DELETE_CONFIRM?></h2>
4082
4083             <p>
4084             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo ENTITY::hsc($name)?></b> (<?php echo  ENTITY::hsc($desc) ?>)
4085             </p>
4086
4087             <form method="post" action="index.php"><div>
4088                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4089                 <?php $manager->addTicketHidden() ?>
4090                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4091                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4092             </div></form>
4093         <?php
4094         $this->pagefoot();
4095     }
4096
4097     /**
4098      * @todo document this
4099      */
4100     function action_templatedeleteconfirm() {
4101         global $member, $manager;
4102
4103         $templateid = intRequestVar('templateid');
4104
4105         $member->isAdmin() or $this->disallow();
4106
4107         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4108
4109         // 1. delete description
4110         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4111
4112         // 2. delete parts
4113         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4114
4115         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4116
4117         $this->action_templateoverview();
4118     }
4119
4120     /**
4121      * @todo document this
4122      */
4123     function action_templatenew() {
4124         global $member;
4125
4126         $member->isAdmin() or $this->disallow();
4127
4128         $name = postVar('name');
4129         $desc = postVar('desc');
4130
4131         if (!isValidTemplateName($name))
4132             $this->error(_ERROR_BADTEMPLATENAME);
4133
4134         if (TEMPLATE::exists($name))
4135             $this->error(_ERROR_DUPTEMPLATENAME);
4136
4137         $newTemplateId = TEMPLATE::createNew($name, $desc);
4138
4139         $this->action_templateoverview();
4140     }
4141
4142     /**
4143      * @todo document this
4144      */
4145     function action_templateclone() {
4146         global $member;
4147
4148         $templateid = intRequestVar('templateid');
4149
4150         $member->isAdmin() or $this->disallow();
4151
4152         // 1. read old template
4153         $name = TEMPLATE::getNameFromId($templateid);
4154         $desc = TEMPLATE::getDesc($templateid);
4155
4156         // 2. create desc thing
4157         $name = "cloned" . $name;
4158
4159         // if a template with that name already exists:
4160         if (TEMPLATE::exists($name)) {
4161             $i = 1;
4162             while (TEMPLATE::exists($name . $i))
4163                 $i++;
4164             $name .= $i;
4165         }
4166
4167         $newid = TEMPLATE::createNew($name, $desc);
4168
4169         // 3. create clone
4170         // go through parts of old template and add them to the new one
4171         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4172         while ($o = sql_fetch_object($res)) {
4173             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4174         }
4175
4176         $this->action_templateoverview();
4177     }
4178
4179     /**
4180      * @todo document this
4181      */
4182     function action_skinoverview() {
4183         global $member, $manager;
4184
4185         $member->isAdmin() or $this->disallow();
4186
4187         $this->pagehead();
4188
4189         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4190
4191         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4192
4193         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4194
4195         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4196         $template['content'] = 'skinlist';
4197         $template['tabindex'] = 10;
4198         showlist($query,'table',$template);
4199
4200         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4201
4202         ?>
4203         <form method="post" action="index.php">
4204         <div>
4205
4206         <input name="action" value="skinnew" type="hidden" />
4207         <?php $manager->addTicketHidden() ?>
4208         <table><tr>
4209             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4210             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4211         </tr><tr>
4212             <td><?php echo _SKIN_DESC?></td>
4213             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4214         </tr><tr>
4215             <td><?php echo _SKIN_CREATE?></td>
4216             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4217         </tr></table>
4218
4219         </div>
4220         </form>
4221
4222         <?php
4223         $this->pagefoot();
4224     }
4225
4226     /**
4227      * @todo document this
4228      */
4229     function action_skinnew() {
4230         global $member;
4231
4232         $member->isAdmin() or $this->disallow();
4233
4234         $name = trim(postVar('name'));
4235         $desc = trim(postVar('desc'));
4236
4237         if (!isValidSkinName($name))
4238             $this->error(_ERROR_BADSKINNAME);
4239
4240         if (SKIN::exists($name))
4241             $this->error(_ERROR_DUPSKINNAME);
4242
4243         $newId = SKIN::createNew($name, $desc);
4244
4245         $this->action_skinoverview();
4246     }
4247
4248     /**
4249      * @todo document this
4250      */
4251     function action_skinedit() {
4252         global $member, $manager;
4253
4254         $skinid = intRequestVar('skinid');
4255
4256         $member->isAdmin() or $this->disallow();
4257
4258         $skin = new SKIN($skinid);
4259
4260         $this->pagehead();
4261         ?>
4262         <p>
4263             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4264         </p>
4265         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4266
4267         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4268         <?php echo _SKIN_PARTS_MSG?>
4269         <ul>
4270             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4271             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4272             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4273             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4274             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4275             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4276             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4277             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4278         </ul>
4279
4280         <?php
4281
4282         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4283         $res = sql_query($query);
4284
4285         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4286         echo '<form method="get" action="index.php">' . "\r\n";
4287         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4288         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4289         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4290         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4291         echo '</form>' . "\r\n";
4292
4293         if ($res && sql_num_rows($res) > 0) {
4294             echo '<ul>';
4295             $tabstart = 75;
4296
4297             while ($row = sql_fetch_assoc($res)) {
4298                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">' . ENTITY::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4299             }
4300
4301             echo '</ul>';
4302         }
4303
4304         ?>
4305
4306         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4307         <form method="post" action="index.php">
4308         <div>
4309
4310         <input type="hidden" name="action" value="skineditgeneral" />
4311         <?php $manager->addTicketHidden() ?>
4312         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4313         <table><tr>
4314             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4315             <td><input name="name" tabindex="90" value="<?php echo  ENTITY::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4316         </tr><tr>
4317             <td><?php echo _SKIN_DESC?></td>
4318             <td><input name="desc" tabindex="100" value="<?php echo  ENTITY::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4319         </tr><tr>
4320             <td><?php echo _SKIN_TYPE?></td>
4321             <td><input name="type" tabindex="110" value="<?php echo  ENTITY::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4322         </tr><tr>
4323             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4324             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4325         </tr><tr>
4326             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4327             <td><input name="inc_prefix" tabindex="130" value="<?php echo  ENTITY::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4328         </tr><tr>
4329             <td><?php echo _SKIN_CHANGE?></td>
4330             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4331         </tr></table>
4332
4333         </div>
4334         </form>
4335
4336
4337         <?php       $this->pagefoot();
4338     }
4339
4340     /**
4341      * @todo document this
4342      */
4343     function action_skineditgeneral() {
4344         global $member;
4345
4346         $skinid = intRequestVar('skinid');
4347
4348         $member->isAdmin() or $this->disallow();
4349
4350         $name = postVar('name');
4351         $desc = postVar('desc');
4352         $type = postVar('type');
4353         $inc_mode = postVar('inc_mode');
4354         $inc_prefix = postVar('inc_prefix');
4355
4356         $skin = new SKIN($skinid);
4357
4358         // 1. Some checks
4359         if (!isValidSkinName($name))
4360             $this->error(_ERROR_BADSKINNAME);
4361
4362         if (($skin->getName() != $name) && SKIN::exists($name))
4363             $this->error(_ERROR_DUPSKINNAME);
4364
4365         if (!$type) $type = 'text/html';
4366         if (!$inc_mode) $inc_mode = 'normal';
4367
4368         // 2. Update description
4369         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4370
4371         $this->action_skinedit();
4372
4373     }
4374
4375     /**
4376      * @todo document this
4377      */
4378     function action_skinedittype($msg = '') {
4379         global $member, $manager;
4380
4381         $skinid = intRequestVar('skinid');
4382         $type = requestVar('type');
4383
4384         $member->isAdmin() or $this->disallow();
4385
4386         $type = trim($type);
4387         $type = strtolower($type);
4388
4389         if (!isValidShortName($type)) {
4390             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4391         }
4392
4393         $skin = new SKIN($skinid);
4394
4395         $friendlyNames = SKIN::getFriendlyNames();
4396
4397         $this->pagehead();
4398         ?>
4399         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4400
4401         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo ENTITY::hsc($skin->getName()) ?>': <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4402
4403         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4404         ?>
4405
4406
4407         <form method="post" action="index.php">
4408         <div>
4409
4410         <input type="hidden" name="action" value="skinupdate" />
4411         <?php $manager->addTicketHidden() ?>
4412         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4413         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4414
4415         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4416         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4417         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4418         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4419             help('skinpart' . $type);
4420         } else {
4421             help('skinpartspecial');
4422         }?>
4423         <br />
4424
4425         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  ENTITY::hsc($skin->getContent($type)) ?></textarea>
4426
4427         <br />
4428         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4429         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4430         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4431
4432         <br /><br />
4433         <?php echo _SKIN_ALLOWEDVARS?>
4434         <?php           $actions = SKIN::getAllowedActionsForType($type);
4435
4436             sort($actions);
4437
4438             while ($current = array_shift($actions)) {
4439                 // skip deprecated vars
4440                 if ($current == 'ifcat') continue;
4441                 if ($current == 'imagetext') continue;
4442                 if ($current == 'vars') continue;
4443
4444                 echo helplink('skinvar-' . $current) . "$current</a>";
4445                 if (count($actions) != 0) echo ", ";
4446             }
4447         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4448         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4449         showlist($query,'table',array('content'=>'shortblognames'));
4450         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4451         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4452         showlist($query,'table',array('content'=>'shortnames'));
4453         echo '</div></form>';
4454         $this->pagefoot();
4455     }
4456
4457     /**
4458      * @todo document this
4459      */
4460     function action_skinupdate() {
4461         global $member;
4462
4463         $skinid = intRequestVar('skinid');
4464         $content = trim(postVar('content'));
4465         $type = postVar('type');
4466
4467         $member->isAdmin() or $this->disallow();
4468
4469         $skin = new SKIN($skinid);
4470         $skin->update($type, $content);
4471
4472         $this->action_skinedittype(_SKIN_UPDATED);
4473     }
4474
4475     /**
4476      * @todo document this
4477      */
4478     function action_skindelete() {
4479         global $member, $manager, $CONF;
4480
4481         $skinid = intRequestVar('skinid');
4482
4483         $member->isAdmin() or $this->disallow();
4484
4485         // don't allow default skin to be deleted
4486         if ($skinid == $CONF['BaseSkin'])
4487             $this->error(_ERROR_DEFAULTSKIN);
4488
4489         // don't allow deletion of default skins for blogs
4490         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4491         $r = sql_query($query);
4492         if ($o = sql_fetch_object($r))
4493             $this->error(_ERROR_SKINDEFDELETE . ENTITY::hsc($o->bname));
4494
4495         $this->pagehead();
4496
4497         $skin = new SKIN($skinid);
4498         $name = $skin->getName();
4499         $desc = $skin->getDescription();
4500
4501         ?>
4502             <h2><?php echo _DELETE_CONFIRM?></h2>
4503
4504             <p>
4505                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo ENTITY::hsc($name) ?></b> (<?php echo  ENTITY::hsc($desc)?>)
4506             </p>
4507
4508             <form method="post" action="index.php"><div>
4509                 <input type="hidden" name="action" value="skindeleteconfirm" />
4510                 <?php $manager->addTicketHidden() ?>
4511                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4512                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4513             </div></form>
4514         <?php
4515         $this->pagefoot();
4516     }
4517
4518     /**
4519      * @todo document this
4520      */
4521     function action_skindeleteconfirm() {
4522         global $member, $CONF, $manager;
4523
4524         $skinid = intRequestVar('skinid');
4525
4526         $member->isAdmin() or $this->disallow();
4527
4528         // don't allow default skin to be deleted
4529         if ($skinid == $CONF['BaseSkin'])
4530             $this->error(_ERROR_DEFAULTSKIN);
4531
4532         // don't allow deletion of default skins for blogs
4533         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4534         $r = sql_query($query);
4535         if ($o = sql_fetch_object($r))
4536             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4537
4538         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4539
4540         // 1. delete description
4541         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4542
4543         // 2. delete parts
4544         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4545
4546         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4547
4548         $this->action_skinoverview();
4549     }
4550
4551     /**
4552      * @todo document this
4553      */
4554     function action_skinremovetype() {
4555         global $member, $manager, $CONF;
4556
4557         $skinid = intRequestVar('skinid');
4558         $skintype = requestVar('type');
4559
4560         if (!isValidShortName($skintype)) {
4561             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4562         }
4563
4564         $member->isAdmin() or $this->disallow();
4565
4566         // don't allow default skinparts to be deleted
4567         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4568             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4569         }
4570
4571         $this->pagehead();
4572
4573         $skin = new SKIN($skinid);
4574         $name = $skin->getName();
4575         $desc = $skin->getDescription();
4576
4577         ?>
4578             <h2><?php echo _DELETE_CONFIRM?></h2>
4579
4580             <p>
4581                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo ENTITY::hsc($skintype); ?> (<?php echo ENTITY::hsc($name); ?>)</b> (<?php echo  ENTITY::hsc($desc)?>)
4582             </p>
4583
4584             <form method="post" action="index.php"><div>
4585                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4586                 <?php $manager->addTicketHidden() ?>
4587                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4588                 <input type="hidden" name="type" value="<?php echo ENTITY::hsc($skintype); ?>" />
4589                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4590             </div></form>
4591         <?php
4592         $this->pagefoot();
4593     }
4594
4595     /**
4596      * @todo document this
4597      */
4598     function action_skinremovetypeconfirm() {
4599         global $member, $CONF, $manager;
4600
4601         $skinid = intRequestVar('skinid');
4602         $skintype = requestVar('type');
4603
4604         if (!isValidShortName($skintype)) {
4605             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4606         }
4607
4608         $member->isAdmin() or $this->disallow();
4609
4610         // don't allow default skinparts to be deleted
4611         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4612             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4613         }
4614
4615         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4616
4617         // delete part
4618         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4619
4620         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4621
4622         $this->action_skinedit();
4623     }
4624
4625     /**
4626      * @todo document this
4627      */
4628     function action_skinclone() {
4629         global $member;
4630
4631         $skinid = intRequestVar('skinid');
4632
4633         $member->isAdmin() or $this->disallow();
4634
4635         // 1. read skin to clone
4636         $skin = new SKIN($skinid);
4637
4638         $name = "clone_" . $skin->getName();
4639
4640         // if a skin with that name already exists:
4641         if (SKIN::exists($name)) {
4642             $i = 1;
4643             while (SKIN::exists($name . $i))
4644                 $i++;
4645             $name .= $i;
4646         }
4647
4648         // 2. create skin desc
4649         $newid = SKIN::createNew(
4650             $name,
4651             $skin->getDescription(),
4652             $skin->getContentType(),
4653             $skin->getIncludeMode(),
4654             $skin->getIncludePrefix()
4655         );
4656
4657
4658         // 3. clone
4659         /*
4660         $this->skinclonetype($skin, $newid, 'index');
4661         $this->skinclonetype($skin, $newid, 'item');
4662         $this->skinclonetype($skin, $newid, 'archivelist');
4663         $this->skinclonetype($skin, $newid, 'archive');
4664         $this->skinclonetype($skin, $newid, 'search');
4665         $this->skinclonetype($skin, $newid, 'error');
4666         $this->skinclonetype($skin, $newid, 'member');
4667         $this->skinclonetype($skin, $newid, 'imagepopup');
4668         */
4669
4670         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4671         $res = sql_query($query);
4672         while ($row = sql_fetch_assoc($res)) {
4673             $this->skinclonetype($skin, $newid, $row['stype']);
4674         }
4675
4676         $this->action_skinoverview();
4677
4678     }
4679
4680     /**
4681      * @todo document this
4682      */
4683     function skinclonetype($skin, $newid, $type) {
4684         $newid = intval($newid);
4685         $content = $skin->getContent($type);
4686         if ($content) {
4687             $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
4688             sql_query($query);
4689         }
4690     }
4691
4692     /**
4693      * @todo document this
4694      */
4695     function action_settingsedit() {
4696         global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4697
4698         $member->isAdmin() or $this->disallow();
4699
4700         $this->pagehead();
4701
4702         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4703         ?>
4704
4705         <h2><?php echo _SETTINGS_TITLE?></h2>
4706
4707         <form action="index.php" method="post">
4708         <div>
4709
4710         <input type="hidden" name="action" value="settingsupdate" />
4711         <?php $manager->addTicketHidden() ?>
4712
4713         <table><tr>
4714             <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4715         </tr><tr>
4716             <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4717             <td>
4718                 <?php
4719                     $query =  'SELECT bname as text, bnumber as value'
4720                            . ' FROM '.sql_table('blog');
4721                     $template['name'] = 'DefaultBlog';
4722                     $template['selected'] = $CONF['DefaultBlog'];
4723                     $template['tabindex'] = 10;
4724                     showlist($query,'select',$template);
4725                 ?>
4726             </td>
4727         </tr><tr>
4728             <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4729             <td>
4730                 <?php
4731                     $query =  'SELECT sdname as text, sdnumber as value'
4732                            . ' FROM '.sql_table('skin_desc');
4733                     $template['name'] = 'BaseSkin';
4734                     $template['selected'] = $CONF['BaseSkin'];
4735                     $template['tabindex'] = 1;
4736                     showlist($query,'select',$template);
4737                 ?>
4738             </td>
4739         </tr><tr>
4740             <td><?php echo _SETTINGS_ADMINMAIL?></td>
4741             <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminEmail']) ?>" /></td>
4742         </tr><tr>
4743             <td><?php echo _SETTINGS_SITENAME?></td>
4744             <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  ENTITY::hsc($CONF['SiteName']) ?>" /></td>
4745         </tr><tr>
4746             <td><?php echo _SETTINGS_SITEURL?></td>
4747             <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  ENTITY::hsc($CONF['IndexURL']) ?>" /></td>
4748         </tr><tr>
4749             <td><?php echo _SETTINGS_ADMINURL?></td>
4750             <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminURL']) ?>" /></td>
4751         </tr><tr>
4752             <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4753             <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  ENTITY::hsc($CONF['PluginURL']) ?>" /></td>
4754         </tr><tr>
4755             <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4756             <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  ENTITY::hsc($CONF['SkinsURL']) ?>" /></td>
4757         </tr><tr>
4758             <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4759             <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  ENTITY::hsc($CONF['ActionURL']) ?>" /></td>
4760         </tr><tr>
4761             <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>
4762             </td>
4763             <td>
4764                 <select name="Locale" tabindex="10050">
4765                         <?php
4766                                 $locales = i18n::get_available_locale_list();
4767                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4768                                 {
4769                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4770                                 }
4771                                 else
4772                                 {
4773                                         echo "<option value=\"\">en_Latn_US</option>\n";
4774                                 }
4775
4776                                 foreach ( $locales as $locale )
4777                                 {
4778                                         if ( $locale == 'en_Latn_US' )
4779                                         {
4780                                                 continue;
4781                                         }
4782                                         if ( $locale == i18n::get_current_locale() )
4783                                         {
4784                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4785                                         }
4786                                         else
4787                                         {
4788                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4789                                         }
4790                                 }
4791                         ?>
4792                         </select>
4793
4794             </td>
4795         </tr><tr>
4796             <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4797             </td>
4798             <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4799                     <br />
4800                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  ENTITY::hsc($CONF['DisableSiteURL'])?>" />
4801             </td>
4802         </tr><tr>
4803             <td><?php echo _SETTINGS_DIRS?></td>
4804             <td><?php echo  ENTITY::hsc($DIR_NUCLEUS) ?>
4805                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4806         </tr><tr>
4807             <td><?php echo _SETTINGS_DBLOGIN?></td>
4808             <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4809         </tr><tr>
4810             <td>
4811             <?php
4812                 echo _SETTINGS_JSTOOLBAR
4813                 /* =_SETTINGS_DISABLEJS
4814
4815                     I temporary changed the meaning of DisableJsTools, until I can find a good
4816                     way to select the javascript version to use
4817
4818                     now, its:
4819                         0 : IE
4820                         1 : all javascript disabled
4821                         2 : 'simpler' javascript (for mozilla/opera/mac)
4822                 */
4823                ?>
4824             </td>
4825             <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4826                 <select name="DisableJsTools" tabindex="10075">
4827             <?php                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4828                     echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4829                     $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4830                     echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4831                     $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4832                     echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4833             ?>
4834                 </select>
4835             </td>
4836         </tr><tr>
4837             <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4838                        <td><?php
4839
4840                        $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4841                               'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4842
4843                        echo ' ', _SETTINGS_URLMODE_HELP;
4844
4845                              ?>
4846
4847                        </td>
4848         </tr><tr>
4849             <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4850                        <td><?php
4851
4852                         $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4853
4854                              ?>
4855
4856                        </td>
4857         </tr><tr>
4858             <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4859             <td>
4860             <?php
4861                 if (!array_key_exists('DefaultListSize',$CONF)) {
4862                     sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4863                     $CONF['DefaultListSize'] = 10;
4864                 }
4865             ?>
4866                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  ENTITY::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4867             </td>
4868         </tr><tr>
4869             <td><?php echo _SETTINGS_ADMINCSS?>
4870             </td>
4871             <td>
4872
4873                 <select name="AdminCSS" tabindex="10080">
4874                 <?php               // show a dropdown list of all available admin css files
4875                 global $DIR_NUCLEUS;
4876
4877                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4878
4879                                 while ($filename = readdir($dirhandle) )
4880                                 {
4881
4882                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4883                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4884
4885                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4886                                         {
4887
4888                                                 $name = $matches[1];
4889                                                 echo "<option value=\"$name\"";
4890
4891                                                 if ($name == $CONF['AdminCSS'])
4892                                                 {
4893                                                         echo " selected=\"selected\"";
4894                                                 }
4895
4896                                                 echo ">$name</option>";
4897
4898                                         }
4899
4900                                 }
4901
4902                                 closedir($dirhandle);
4903
4904                                 ?>
4905                                 </select>
4906
4907             </td>
4908         </tr><tr>
4909             <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4910         </tr><tr>
4911             <td><?php echo _SETTINGS_MEDIADIR?></td>
4912             <td><?php echo  ENTITY::hsc($DIR_MEDIA) ?>
4913                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4914                 <?php                   if (!is_dir($DIR_MEDIA))
4915                         echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4916                     if (!is_readable($DIR_MEDIA))
4917                         echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4918                     if (!is_writeable($DIR_MEDIA))
4919                         echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4920                 ?>
4921             </td>
4922         </tr><tr>
4923             <td><?php echo _SETTINGS_MEDIAURL?></td>
4924             <td>
4925                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  ENTITY::hsc($CONF['MediaURL']) ?>" />
4926             </td>
4927         </tr><tr>
4928             <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4929             <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4930         </tr><tr>
4931             <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4932             <td>
4933                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  ENTITY::hsc($CONF['AllowedTypes']) ?>" />
4934             </td>
4935         </tr><tr>
4936             <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4937             <td>
4938                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  ENTITY::hsc($CONF['MaxUploadSize']) ?>" />
4939             </td>
4940         </tr><tr>
4941             <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4942             <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4943
4944         </tr><tr>
4945             <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4946         </tr><tr>
4947             <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4948             <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4949         </tr><tr>
4950             <td><?php echo _SETTINGS_ALLOWCREATE?>
4951                 <?php help('allowaccountcreation'); ?>
4952             </td>
4953             <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4954             </td>
4955         </tr><tr>
4956             <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4957                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4958             </td>
4959             <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4960             </td>
4961         </tr><tr>
4962             <td><?php echo _SETTINGS_MEMBERMSGS?>
4963                 <?php help('messageservice'); ?>
4964             </td>
4965             <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4966             </td>
4967         </tr><tr>
4968             <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4969                 <?php help('messageservice'); ?>
4970             </td>
4971             <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4972             </td>
4973         </tr><tr>
4974             <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4975                 <?php help('protectmemnames'); ?>
4976             </td>
4977             <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4978             </td>
4979
4980
4981
4982         </tr><tr>
4983             <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4984         </tr><tr>
4985             <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4986             <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePrefix'])?>" /></td>
4987         </tr><tr>
4988             <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4989             <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  ENTITY::hsc($CONF['CookieDomain'])?>" /></td>
4990         </tr><tr>
4991             <td><?php echo _SETTINGS_COOKIEPATH?></td>
4992             <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePath'])?>" /></td>
4993         </tr><tr>
4994             <td><?php echo _SETTINGS_COOKIESECURE?></td>
4995             <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4996         </tr><tr>
4997             <td><?php echo _SETTINGS_COOKIELIFE?></td>
4998             <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4999                               1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5000             </td>
5001         </tr><tr>
5002             <td><?php echo _SETTINGS_LASTVISIT?></td>
5003             <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5004
5005
5006
5007         </tr><tr>
5008             <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5009         </tr><tr>
5010             <td><?php echo _SETTINGS_UPDATE?></td>
5011             <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5012         </tr></table>
5013
5014         </div>
5015         </form>
5016
5017         <?php
5018             echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5019
5020             $manager->notify(
5021                 'GeneralSettingsFormExtras',
5022                 array()
5023             );
5024
5025         $this->pagefoot();
5026     }
5027
5028         /**
5029          * ADMIN::action_settingsupdate()
5030          * Update $CONFIG and redirect
5031          *
5032          * @param       void
5033          * @return      void
5034          */
5035         function action_settingsupdate() {
5036                 global $member, $CONF;
5037
5038                 $member->isAdmin() or $this->disallow();
5039
5040                 // check if email address for admin is valid
5041                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5042                 {
5043                         $this->error(_ERROR_BADMAILADDRESS);
5044                 }
5045
5046                 // save settings
5047                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5048                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5049                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5050                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5051                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5052                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5053                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5054                 $this->updateConfig('Locale',              postVar('Locale'));
5055                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5056                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5057                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5058                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5059                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5060                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5061                 $this->updateConfig('SiteName',          postVar('SiteName'));
5062                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5063                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5064                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5065                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5066                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5067                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5068                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5069                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5070                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5071                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5072                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5073                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5074                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5075                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5076                 $this->updateConfig('URLMode',            postVar('URLMode'));
5077                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5078                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5079                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5080                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5081
5082                 // load new config and redirect (this way, the new locale will be used is necessary)
5083                 // note that when changing cookie settings, this redirect might cause the user
5084                 // to have to log in again.
5085                 getConfig();
5086                 redirect($CONF['AdminURL'] . '?action=manage');
5087                 exit;
5088         }
5089
5090         /**
5091          * ADMIN::action_systemoverview()
5092          * Output system overview
5093          *
5094          * @param       void
5095          * @return      void
5096          */
5097         function action_systemoverview()
5098         {
5099                 global $member, $nucleus, $CONF;
5100
5101                 $this->pagehead();
5102
5103                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5104
5105                 if ( $member->isLoggedIn() && $member->isAdmin() )
5106                 {
5107                         // Information about the used PHP and MySQL installation
5108                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5109
5110                         // Version of PHP MySQL
5111                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5112                         echo "<thead>\n";
5113                         echo "<tr>\n";
5114                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5115                         echo "</tr>\n";
5116                         echo "</thead>\n";
5117                         echo "<tbody>\n";
5118                         echo "<tr>\n";
5119                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5120                         echo '<td>' . phpversion() . "</td>\n";
5121                         echo "</tr>\n";
5122                         echo "<tr>\n";
5123                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5124                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5125                         echo "</tr>\n";
5126                         echo "</tbody>\n";
5127                         echo "</table>\n\n";
5128
5129                         // Important PHP settings
5130                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5131                         echo "<thead>\n";
5132                         echo "<tr>\n";
5133                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5134                         echo "</tr>\n";
5135                         echo "</thead>\n";
5136                         echo "<tbody>\n";
5137                         echo "<tr>\n";
5138                         echo '<td>magic_quotes_gpc' . "</td>\n";
5139                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5140                         echo '<td>' . $mqg . "</td>\n";
5141                         echo "</tr>\n";
5142                         echo "<tr>\n";
5143                         echo '<td>magic_quotes_runtime' . "</td>\n";
5144                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5145                         echo '<td>' . $mqr . "</td>\n";
5146                         echo "</tr>\n";
5147                         echo "<tr>\n";
5148                         echo '<td>register_globals' . "</td>\n";
5149                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5150                         echo '<td>' . $rg . "</td>\n";
5151                         echo "</tr>\n";
5152                         echo "</tbody>\n";
5153                         echo "</table>\n\n";
5154
5155                         // Information about GD library
5156                         $gdinfo = gd_info();
5157                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5158                         echo "<thead>\n";
5159                         echo "<tr>\n";
5160                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5161                         echo "</tr>\n";
5162                         echo "</thead>\n";
5163                         echo "<tbody>\n";
5164                         foreach ( $gdinfo as $key=>$value )
5165                         {
5166                                 if ( is_bool($value) )
5167                                 {
5168                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5169                                 }
5170                                 else
5171                                 {
5172                                         $value = ENTITY::hsc($value);
5173                                 }
5174                                 echo "<tr>\n";
5175                                 echo '<td>' . $key . "</td>\n";
5176                                 echo '<td>' . $value . "</td>\n";
5177                                 echo "</tr>\n";
5178                         }
5179                         echo "</tbody>\n";
5180                         echo "</table>\n\n";
5181
5182                         // Check if special modules are loaded
5183                         ob_start();
5184                         phpinfo(INFO_MODULES);
5185                         $im = ob_get_contents();
5186                         ob_clean();
5187                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5188                         echo "<thead>\n";
5189                         echo "<tr>";
5190                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5191                         echo "</tr>\n";
5192                         echo "<tbody>\n";
5193                         echo "<tr>\n";
5194                         echo '<td>mod_rewrite' . "</td>\n";
5195                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5196                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5197                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5198                         echo '<td>' . $modrewrite . "</td>\n";
5199                         echo "</tr>\n";
5200                         echo "</tbody>\n";
5201                         echo "</table>\n\n";
5202
5203                         // Information about the used Nucleus CMS
5204                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5205                         global $nucleus;
5206                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5207                         $np = getNucleusPatchLevel();
5208                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5209                         echo "<thead>\n";
5210                         echo "<tr>\n";
5211                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5212                         echo "</tr>\n";
5213                         echo "</thead>\n";
5214                         echo "<tbody>\n";
5215                         echo "<tr>\n";
5216                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5217                         echo '<td>' . $nv . "</td>\n";
5218                         echo "</tr>\n";
5219                         echo "<tr>\n";
5220                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5221                         echo '<td>' . $np . "</td>\n";
5222                         echo "</tr>\n";
5223                         echo "</tbody>\n";
5224                         echo "</table>\n\n";
5225
5226                         // Important settings of the installation
5227                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5228                         echo "<thead>\n";
5229                         echo "<tr>\n";
5230                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5231                         echo "</tr>\n";
5232                         echo "</thead>\n";
5233                         echo "<tbody>\n";
5234                         echo "<tr>\n";
5235                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5236                         echo '<td>' . $CONF['Self'] . "</td>\n";
5237                         echo "</tr>\n";
5238                         echo "<tr>\n";
5239                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5240                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5241                         echo "</tr>\n";
5242                         echo "<tr>\n";
5243                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5244                         $ohs = $CONF['alertOnHeadersSent'] ?
5245                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5246                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5247                         echo '<td>' . $ohs . "</td>\n";
5248                         echo "</tr>\n";
5249                         echo "<tr>\n";
5250                         echo "<td>i18n::get_current_charset()</td>\n";
5251                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5252                         echo "</tr>\n";
5253                         echo "</tbody>\n";
5254                         echo "</table>\n\n";
5255
5256                         // Link to the online version test at the Nucleus CMS website
5257                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5258                         if ( $nucleus['codename'] != '')
5259                         {
5260                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5261                         }
5262                         else
5263                         {
5264                                 $codenamestring = '';
5265                         }
5266                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5267                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5268                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5269                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5270                         echo '</a>';
5271                 }
5272                 else
5273                 {
5274                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5275                 }
5276                 $this->pagefoot();
5277         }
5278
5279         /**
5280          * ADMIN::updateConfig()
5281          *
5282          * @param       string  $name
5283          * @param       string  $val
5284          * @return      integer return the ID in which the latest query posted
5285          */
5286         function updateConfig($name, $val)
5287         {
5288                 $name = sql_real_escape_string($name);
5289                 $val = trim(sql_real_escape_string($val));
5290
5291                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5292                 $query = sprintf($query, sql_table('config'), $val, $name);
5293                 sql_query($query) or die("Query error: " . sql_error());
5294                 return sql_insert_id();
5295         }
5296
5297         /**
5298          * Error message
5299          * @param string $msg message that will be shown
5300          */
5301         function error($msg)
5302         {
5303                 $this->pagehead();
5304
5305                 echo "<h2>Error!</h2>\n";
5306                 echo $msg;
5307                 echo "<br />\n";
5308                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5309                 $this->pagefoot();
5310                 exit;
5311         }
5312
5313         /**
5314          * ADMIN::disallow()
5315          * add error log and show error page
5316          *
5317          * @param       void
5318          * @return      void
5319          */
5320         function disallow()
5321         {
5322                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5323                 $this->error(_ERROR_DISALLOWED);
5324         }
5325
5326         /**
5327          * ADMIN::pagehead()
5328          * Output admin page head
5329          *
5330          * @param       void
5331          * @return      void
5332          */
5333         function pagehead($extrahead = '')
5334         {
5335                 global $member, $nucleus, $CONF, $manager;
5336
5337                 $manager->notify(
5338                         'AdminPrePageHead',
5339                         array(
5340                                 'extrahead' => &$extrahead,
5341                                 'action' => $this->action));
5342
5343                 $baseUrl = ENTITY::hsc($CONF['AdminURL']);
5344                 if ( !array_key_exists('AdminCSS',$CONF) )
5345                 {
5346                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5347                         $CONF['AdminCSS'] = 'original';
5348                 }
5349
5350                 /* HTTP 1.1 application for no caching */
5351                 header("Cache-Control: no-cache, must-revalidate");
5352                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5353
5354                 $root_element = 'html';
5355                 $charset = i18n::get_current_charset();
5356                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5357
5358                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5359                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5360                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5361                 echo "<head>\n";
5362                 echo '<title>' . ENTITY::hsc($CONF['SiteName']) . " - Admin</title>\n";
5363                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5364                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5365                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5366                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5367                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5368                 echo "{$extrahead}\n";
5369                 echo "</head>\n\n";
5370                 echo "<body>\n";
5371                 echo "<div id=\"adminwrapper\">\n";
5372                 echo "<div class=\"header\">\n";
5373                 echo '<h1>' . ENTITY::hsc($CONF['SiteName']) . "</h1>\n";
5374                 echo "</div>\n";
5375                 echo "<div id=\"container\">\n";
5376                 echo "<div id=\"content\">\n";
5377                 echo "<div class=\"loginname\">\n";
5378                 if ( $member->isLoggedIn() )
5379                 {
5380                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5381                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5382                 }
5383                 else
5384                 {
5385                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5386                 }
5387                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5388                 echo '(';
5389
5390                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5391                 {
5392                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5393                 }
5394                 else
5395                 {
5396                         $codenamestring = '';
5397                 }
5398
5399                 if ( $member->isLoggedIn() && $member->isAdmin() )
5400                 {
5401                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5402                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5403
5404                         $newestVersion = getLatestVersion();
5405                         $newestCompare = str_replace('/','.',$newestVersion);
5406                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5407                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5408                         {
5409                                 echo "<br />\n";
5410                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5411                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5412                                 echo "</a>";
5413                         }
5414                 }
5415                 else
5416                 {
5417                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5418                 }
5419                 echo ')';
5420                 echo '</div>';
5421                 return;
5422         }
5423
5424         /**
5425          * ADMIN::pagefoot()
5426          * Output admin page foot include quickmenu
5427          *
5428          * @param       void
5429          * @return      void
5430          */
5431         function pagefoot()
5432         {
5433                 global $action, $member, $manager;
5434
5435                 $manager->notify(
5436                         'AdminPrePageFoot',
5437                         array('action' => $this->action)
5438                 );
5439
5440                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5441                 {
5442                         echo '<h2>' . _LOGOUT . "</h2>\n";
5443                         echo "<ul>\n";
5444                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5445                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5446                         echo "</ul>\n";
5447                 }
5448
5449                 echo "<div class=\"foot\">\n";
5450                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5451                 echo '-';
5452                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5453                 echo "</div>\n";
5454
5455                 echo "<!-- content -->\n";
5456                 echo "<div id=\"quickmenu\">\n";
5457
5458                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5459                 {
5460                         echo "<ul>\n";
5461                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5462                         echo "</ul>\n";
5463
5464                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5465                         echo "<form method=\"get\" action=\"index.php\">\n";
5466                         echo "<p>\n";
5467                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5468
5469                         $showAll = requestVar('showall');
5470
5471                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5472                         {
5473                                 // Super-Admins have access to all blogs! (no add item support though)
5474                                 $query =  'SELECT bnumber as value, bname as text'
5475                                                 . ' FROM ' . sql_table('blog')
5476                                                 . ' ORDER BY bname';
5477                         }
5478                         else
5479                         {
5480                                 $query =  'SELECT bnumber as value, bname as text'
5481                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5482                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5483                                                 . ' ORDER BY bname';
5484                         }
5485                         $template['name'] = 'blogid';
5486                         $template['tabindex'] = 15000;
5487                         $template['extra'] = _QMENU_ADD_SELECT;
5488                         $template['selected'] = -1;
5489                         $template['shorten'] = 10;
5490                         $template['shortenel'] = '';
5491                         $template['javascript'] = 'onchange="return form.submit()"';
5492                         showlist($query,'select',$template);
5493
5494                         echo "</p>\n";
5495                         echo "</form>\n";
5496
5497                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5498                         echo "<ul>\n";
5499                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5500                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5501                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5502                         echo "</ul>\n";
5503
5504                         // ---- general settings ----
5505                         if ( $member->isAdmin() )
5506                         {
5507                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5508                                 echo "<ul>\n";
5509                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5510                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5511                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5512                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5513                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5514                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5515                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5516                                 echo "</ul>\n";
5517
5518                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5519                                 echo "<ul>\n";
5520                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5521                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5522                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5523                                 echo "</ul>\n";
5524                         }
5525
5526                         $aPluginExtras = array();
5527                         $manager->notify(
5528                                 'QuickMenu',
5529                                 array(
5530                                         'options' => &$aPluginExtras));
5531
5532                         if ( count($aPluginExtras) > 0 )
5533                         {
5534                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5535                                 echo "<ul>\n";
5536                                 foreach ( $aPluginExtras as $aInfo )
5537                                 {
5538                                         echo '<li><a href="' . ENTITY::hsc($aInfo['url']) . '" title="' . ENTITY::hsc($aInfo['tooltip']) . '">' . ENTITY::hsc($aInfo['title']) . "</a></li>\n";
5539                                 }
5540                                 echo "</ul>\n";
5541                         }
5542                 }
5543                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5544                 {
5545
5546                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5547                 }
5548                 else
5549                 {
5550                         // introduction text on login screen
5551                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5552                 }
5553
5554                 echo "<!-- quickmenu -->\n";
5555                 echo "</div>\n";
5556
5557                 echo "<!-- content -->\n";
5558                 echo "</div>\n";
5559
5560                 echo "<!-- container -->\n";
5561                 echo "</div>\n";
5562
5563                 echo "<!-- adminwrapper -->\n";
5564                 echo "</div>\n";
5565
5566                 echo "</body>\n";
5567                 echo "</html>\n";
5568                 return;
5569         }
5570
5571     /**
5572      * @todo document this
5573      */
5574     function action_regfile() {
5575         global $member, $CONF;
5576
5577         $blogid = intRequestVar('blogid');
5578
5579         $member->teamRights($blogid) or $this->disallow();
5580
5581         // header-code stolen from phpMyAdmin
5582         // REGEDIT and bookmarklet code stolen from GreyMatter
5583
5584         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5585
5586
5587         header('Content-Type: application/octetstream');
5588         header('Content-Disposition: filename="nucleus.reg"');
5589         header('Pragma: no-cache');
5590         header('Expires: 0');
5591
5592         echo "REGEDIT4\n";
5593         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5594         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5595         echo '"contexts"=hex:31';
5596     }
5597
5598     /**
5599      * @todo document this
5600      */
5601     function action_bookmarklet() {
5602         global $member, $manager;
5603
5604         $blogid = intRequestVar('blogid');
5605
5606         $member->teamRights($blogid) or $this->disallow();
5607
5608         $blog =& $manager->getBlog($blogid);
5609         $bm = getBookmarklet($blogid);
5610
5611         $this->pagehead();
5612
5613         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5614
5615         ?>
5616
5617         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5618
5619         <p>
5620         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5621         </p>
5622
5623         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5624         <p>
5625             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5626             <br />
5627             <br />
5628             <?php echo '<a href="' . ENTITY::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, ENTITY::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5629         </p>
5630
5631         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5632         <p>
5633             <?php
5634                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5635                 $url = $manager->addTicketToUrl($url);
5636             ?>
5637             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . ENTITY::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5638         </p>
5639
5640         <p>
5641             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5642         </p>
5643
5644         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5645         <p>
5646             <?php echo _BOOKMARKLET_DELETEBAR ?>
5647         </p>
5648
5649         <p>
5650             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5651         </p>
5652
5653         <ol>
5654             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5655             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5656             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5657             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5658             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5659         </ol>
5660
5661         <?php
5662         $this->pagefoot();
5663
5664     }
5665
5666     /**
5667      * @todo document this
5668      */
5669     function action_actionlog() {
5670         global $member, $manager;
5671
5672         $member->isAdmin() or $this->disallow();
5673
5674         $this->pagehead();
5675
5676         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5677
5678         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5679
5680         ?>
5681             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5682             <p><a href="<?php echo ENTITY::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5683         <?php
5684         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5685
5686         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5687         $template['content'] = 'actionlist';
5688         $amount = showlist($query,'table',$template);
5689
5690         $this->pagefoot();
5691
5692     }
5693
5694     /**
5695      * @todo document this
5696      */
5697     function action_banlist() {
5698         global $member, $manager;
5699
5700         $blogid = intRequestVar('blogid');
5701
5702         $member->blogAdminRights($blogid) or $this->disallow();
5703
5704         $blog =& $manager->getBlog($blogid);
5705
5706         $this->pagehead();
5707
5708         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5709
5710         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5711
5712         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5713         $template['content'] = 'banlist';
5714         $amount = showlist($query,'table',$template);
5715
5716         if ($amount == 0)
5717             echo _BAN_NONE;
5718
5719         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5720         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5721
5722
5723         $this->pagefoot();
5724
5725     }
5726
5727     /**
5728      * @todo document this
5729      */
5730     function action_banlistdelete() {
5731         global $member, $manager;
5732
5733         $blogid = intRequestVar('blogid');
5734         $iprange = requestVar('iprange');
5735
5736         $member->blogAdminRights($blogid) or $this->disallow();
5737
5738         $blog =& $manager->getBlog($blogid);
5739         $banBlogName =  ENTITY::hsc($blog->getName());
5740
5741         $this->pagehead();
5742         ?>
5743             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5744
5745             <form method="post" action="index.php">
5746
5747             <h3><?php echo _BAN_IPRANGE?></h3>
5748
5749             <p>
5750                 <?php echo _CONFIRMTXT_BAN?> <?php echo ENTITY::hsc($iprange) ?>
5751                 <input name="iprange" type="hidden" value="<?php echo ENTITY::hsc($iprange)?>" />
5752             </p>
5753
5754             <h3><?php echo _BAN_BLOGS?></h3>
5755
5756             <div>
5757                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5758                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5759                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5760                 <br />
5761                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5762             </div>
5763
5764             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5765
5766             <div>
5767                 <?php $manager->addTicketHidden() ?>
5768                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5769                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5770             </div>
5771
5772             </form>
5773         <?php
5774         $this->pagefoot();
5775     }
5776
5777     /**
5778      * @todo document this
5779      */
5780     function action_banlistdeleteconfirm() {
5781         global $member, $manager;
5782
5783         $blogid = intPostVar('blogid');
5784         $allblogs = postVar('allblogs');
5785         $iprange = postVar('iprange');
5786
5787         $member->blogAdminRights($blogid) or $this->disallow();
5788
5789         $deleted = array();
5790
5791         if (!$allblogs) {
5792             if (BAN::removeBan($blogid, $iprange))
5793                 array_push($deleted, $blogid);
5794         } else {
5795             // get blogs fot which member has admin rights
5796             $adminblogs = $member->getAdminBlogs();
5797             foreach ($adminblogs as $blogje) {
5798                 if (BAN::removeBan($blogje, $iprange))
5799                     array_push($deleted, $blogje);
5800             }
5801         }
5802
5803         if (sizeof($deleted) == 0)
5804             $this->error(_ERROR_DELETEBAN);
5805
5806         $this->pagehead();
5807
5808         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5809         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5810         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5811
5812         echo "<ul>";
5813         foreach ($deleted as $delblog) {
5814             $b =& $manager->getBlog($delblog);
5815             echo "<li>" . ENTITY::hsc($b->getName()). "</li>";
5816         }
5817         echo "</ul>";
5818
5819         $this->pagefoot();
5820
5821     }
5822
5823     /**
5824      * @todo document this
5825      */
5826     function action_banlistnewfromitem() {
5827         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5828     }
5829
5830     /**
5831      * @todo document this
5832      */
5833     function action_banlistnew($blogid = '') {
5834         global $member, $manager;
5835
5836         if ($blogid == '')
5837             $blogid = intRequestVar('blogid');
5838
5839         $ip = requestVar('ip');
5840
5841         $member->blogAdminRights($blogid) or $this->disallow();
5842
5843         $blog =& $manager->getBlog($blogid);
5844
5845         $this->pagehead();
5846         ?>
5847         <h2><?php echo _BAN_ADD_TITLE?></h2>
5848
5849
5850         <form method="post" action="index.php">
5851
5852         <h3><?php echo _BAN_IPRANGE?></h3>
5853
5854         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5855
5856         <div class="note">
5857             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5858             <?php echo _BAN_EXAMPLE_TEXT ?>
5859         </div>
5860
5861         <div>
5862         <?php
5863         if ($ip) {
5864             $iprangeVal = ENTITY::hsc($ip);
5865         ?>
5866             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5867             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5868             <br />
5869             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5870             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5871             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5872         <?php
5873         } else {
5874             echo "<input name='iprange' value='custom' type='hidden' />";
5875             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5876         }
5877         ?>
5878         </div>
5879
5880         <h3><?php echo _BAN_BLOGS?></h3>
5881
5882         <p><?php echo _BAN_BLOGS_TEXT?></p>
5883
5884         <div>
5885             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5886             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo ENTITY::hsc($blog->getName())?>'</label>
5887             <br />
5888             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5889         </div>
5890
5891         <h3><?php echo _BAN_REASON_TITLE?></h3>
5892
5893         <p><?php echo _BAN_REASON_TEXT?></p>
5894
5895         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5896
5897         <h3><?php echo _BAN_ADD_TITLE?></h3>
5898
5899         <div>
5900             <input name="action" type="hidden" value="banlistadd" />
5901             <?php $manager->addTicketHidden() ?>
5902             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5903         </div>
5904
5905         </form>
5906
5907         <?php       $this->pagefoot();
5908     }
5909
5910     /**
5911      * @todo document this
5912      */
5913     function action_banlistadd() {
5914         global $member;
5915
5916         $blogid =       intPostVar('blogid');
5917         $allblogs =     postVar('allblogs');
5918         $iprange =      postVar('iprange');
5919         if ($iprange == "custom")
5920             $iprange = postVar('customiprange');
5921         $reason =       postVar('reason');
5922
5923         $member->blogAdminRights($blogid) or $this->disallow();
5924
5925         // TODO: check IP range validity
5926
5927         if (!$allblogs) {
5928             if (!BAN::addBan($blogid, $iprange, $reason))
5929                 $this->error(_ERROR_ADDBAN);
5930         } else {
5931             // get blogs fot which member has admin rights
5932             $adminblogs = $member->getAdminBlogs();
5933             $failed = 0;
5934             foreach ($adminblogs as $blogje) {
5935                 if (!BAN::addBan($blogje, $iprange, $reason))
5936                     $failed = 1;
5937             }
5938             if ($failed)
5939                 $this->error(_ERROR_ADDBAN);
5940         }
5941
5942         $this->action_banlist();
5943
5944     }
5945
5946     /**
5947      * @todo document this
5948      */
5949     function action_clearactionlog() {
5950         global $member;
5951
5952         $member->isAdmin() or $this->disallow();
5953
5954         ACTIONLOG::clear();
5955
5956         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5957     }
5958
5959     /**
5960      * @todo document this
5961      */
5962     function action_backupoverview() {
5963         global $member, $manager;
5964
5965         $member->isAdmin() or $this->disallow();
5966
5967         $this->pagehead();
5968
5969         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5970         ?>
5971         <h2><?php echo _BACKUPS_TITLE?></h2>
5972
5973         <h3><?php echo _BACKUP_TITLE?></h3>
5974
5975         <p><?php echo _BACKUP_INTRO?></p>
5976
5977         <form method="post" action="index.php"><p>
5978         <input type="hidden" name="action" value="backupcreate" />
5979         <?php $manager->addTicketHidden() ?>
5980
5981         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5982         <br />
5983         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5984         <br /><br />
5985         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5986
5987         </p></form>
5988
5989         <div class="note"><?php echo _BACKUP_NOTE?></div>
5990
5991
5992         <h3><?php echo _RESTORE_TITLE?></h3>
5993
5994         <div class="note"><?php echo _RESTORE_NOTE?></div>
5995
5996         <p><?php echo _RESTORE_INTRO?></p>
5997
5998         <form method="post" action="index.php" enctype="multipart/form-data"><p>
5999             <input type="hidden" name="action" value="backuprestore" />
6000             <?php $manager->addTicketHidden() ?>
6001             <input name="backup_file" type="file" tabindex="30" />
6002             <br /><br />
6003             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6004             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6005             <br /><?php echo _RESTORE_WARNING?>
6006         </p></form>
6007
6008         <?php       $this->pagefoot();
6009     }
6010
6011     /**
6012      * @todo document this
6013      */
6014     function action_backupcreate() {
6015         global $member, $DIR_LIBS;
6016
6017         $member->isAdmin() or $this->disallow();
6018
6019         // use compression ?
6020         $useGzip = intval(postVar('gzip'));
6021
6022         include($DIR_LIBS . 'backup.php');
6023
6024         // try to extend time limit
6025         // (creating/restoring dumps might take a while)
6026         @set_time_limit(1200);
6027
6028         $bu = new Backup();
6029         $bu->do_backup($useGzip);
6030         exit;
6031     }
6032
6033     /**
6034      * @todo document this
6035      */
6036     function action_backuprestore() {
6037         global $member, $DIR_LIBS;
6038
6039         $member->isAdmin() or $this->disallow();
6040
6041         if (intPostVar('letsgo') != 1)
6042             $this->error(_ERROR_BACKUP_NOTSURE);
6043
6044         include($DIR_LIBS . 'backup.php');
6045
6046         // try to extend time limit
6047         // (creating/restoring dumps might take a while)
6048         @set_time_limit(1200);
6049
6050         $bu = new Backup();
6051         $message = $bu->do_restore();
6052         if ($message != '')
6053             $this->error($message);
6054
6055         $this->pagehead();
6056         ?>
6057         <h2><?php echo _RESTORE_COMPLETE?></h2>
6058         <?php       $this->pagefoot();
6059
6060     }
6061
6062     /**
6063      * @todo document this
6064      */
6065     function action_pluginlist() {
6066         global $member, $manager;
6067
6068         // check if allowed
6069         $member->isAdmin() or $this->disallow();
6070
6071         $this->pagehead();
6072
6073         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6074
6075         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6076
6077         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6078
6079
6080         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6081
6082         $template['content'] = 'pluginlist';
6083         $template['tabindex'] = 10;
6084         showlist($query, 'table', $template);
6085
6086 ?>
6087                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6088
6089                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6090
6091                         <form method="post" action="index.php"><div>
6092                                 <input type="hidden" name="action" value="pluginupdate" />
6093                                 <?php $manager->addTicketHidden() ?>
6094                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6095                         </div></form>
6096
6097                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6098
6099 <?php
6100                 // find a list of possibly non-installed plugins
6101                 $candidates = array();
6102
6103                 global $DIR_PLUGINS;
6104
6105                 $dirhandle = opendir($DIR_PLUGINS);
6106
6107                 while ($filename = readdir($dirhandle) )
6108                 {
6109
6110                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6111                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6112
6113                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6114                         {
6115
6116                                 $name = $matches[1];
6117                                 // only show in list when not yet installed
6118                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6119
6120                                 if (sql_num_rows($res) == 0)
6121                                 {
6122                                         array_push($candidates, $name);
6123                                 }
6124
6125                         }
6126
6127                 }
6128
6129                 closedir($dirhandle);
6130
6131                 if (sizeof($candidates) > 0)
6132                 {
6133 ?>
6134                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6135
6136                         <form method='post' action='index.php'><div>
6137                                 <input type='hidden' name='action' value='pluginadd' />
6138                                 <?php $manager->addTicketHidden() ?>
6139                                 <select name="filename" tabindex="30">
6140 <?php
6141                         foreach($candidates as $name)
6142                         {
6143                                 echo '<option value="NP_',$name,'">',ENTITY::hsc($name),'</option>';
6144                         }
6145 ?>
6146                                 </select>
6147                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6148                         </div></form>
6149
6150 <?php
6151                 }
6152                 else
6153                 {
6154                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6155                 }
6156
6157                 $this->pagefoot();
6158
6159         }
6160
6161     /**
6162      * @todo document this
6163      */
6164     function action_pluginhelp() {
6165         global $member, $manager, $DIR_PLUGINS, $CONF;
6166
6167         // check if allowed
6168         $member->isAdmin() or $this->disallow();
6169
6170         $plugid = intGetVar('plugid');
6171
6172         if (!$manager->pidInstalled($plugid))
6173             $this->error(_ERROR_NOSUCHPLUGIN);
6174
6175         $plugName = getPluginNameFromPid($plugid);
6176
6177         $this->pagehead();
6178
6179         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6180
6181         echo '<h2>',_PLUGS_HELP_TITLE,': ',ENTITY::hsc($plugName),'</h2>';
6182
6183         $plug =& $manager->getPlugin($plugName);
6184         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6185
6186         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6187             @readfile($helpFile);
6188         } else {
6189             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6190             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6191         }
6192
6193
6194         $this->pagefoot();
6195     }
6196
6197     /**
6198      * @todo document this
6199      */
6200     function action_pluginadd() {
6201         global $member, $manager, $DIR_PLUGINS;
6202
6203         // check if allowed
6204         $member->isAdmin() or $this->disallow();
6205
6206         $name = postVar('filename');
6207
6208         if ($manager->pluginInstalled($name))
6209             $this->error(_ERROR_DUPPLUGIN);
6210         if (!checkPlugin($name))
6211             $this->error(_ERROR_PLUGFILEERROR . ' (' . ENTITY::hsc($name) . ')');
6212
6213         // get number of currently installed plugins
6214         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6215         $numCurrent = sql_num_rows($res);
6216
6217         // plugin will be added as last one in the list
6218         $newOrder = $numCurrent + 1;
6219
6220         $manager->notify(
6221             'PreAddPlugin',
6222             array(
6223                 'file' => &$name
6224             )
6225         );
6226
6227         // do this before calling getPlugin (in case the plugin id is used there)
6228         $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6229         sql_query($query);
6230         $iPid = sql_insert_id();
6231
6232         $manager->clearCachedInfo('installedPlugins');
6233
6234         // Load the plugin for condition checking and instalation
6235         $plugin =& $manager->getPlugin($name);
6236
6237         // check if it got loaded (could have failed)
6238         if (!$plugin)
6239         {
6240             sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6241             $manager->clearCachedInfo('installedPlugins');
6242             $this->error(_ERROR_PLUGIN_LOAD);
6243         }
6244
6245         // check if plugin needs a newer Nucleus version
6246         if (getNucleusVersion() < $plugin->getMinNucleusVersion())
6247         {
6248             // uninstall plugin again...
6249             $this->deleteOnePlugin($plugin->getID());
6250
6251             // ...and show error
6252             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc($plugin->getMinNucleusVersion()));
6253         }
6254
6255         // check if plugin needs a newer Nucleus version
6256         if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
6257         {
6258             // uninstall plugin again...
6259             $this->deleteOnePlugin($plugin->getID());
6260
6261             // ...and show error
6262             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6263         }
6264
6265         $pluginList = $plugin->getPluginDep();
6266         foreach ($pluginList as $pluginName)
6267         {
6268
6269             $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6270             if (sql_num_rows($res) == 0)
6271             {
6272                 // uninstall plugin again...
6273                 $this->deleteOnePlugin($plugin->getID());
6274
6275                 $this->error(sprintf(_ERROR_INSREQPLUGIN, ENTITY::hsc($pluginName)));
6276             }
6277         }
6278
6279         // call the install method of the plugin
6280         $plugin->install();
6281
6282         $manager->notify(
6283             'PostAddPlugin',
6284             array(
6285                 'plugin' => &$plugin
6286             )
6287         );
6288
6289         // update all events
6290         $this->action_pluginupdate();
6291     }
6292
6293     /**
6294      * @todo document this
6295      */
6296     function action_pluginupdate() {
6297         global $member, $manager, $CONF;
6298
6299         // check if allowed
6300         $member->isAdmin() or $this->disallow();
6301
6302         // delete everything from plugin_events
6303         sql_query('DELETE FROM '.sql_table('plugin_event'));
6304
6305         // loop over all installed plugins
6306         $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6307         while($o = sql_fetch_object($res)) {
6308             $pid = $o->pid;
6309             $plug =& $manager->getPlugin($o->pfile);
6310             if ($plug)
6311             {
6312                 $eventList = $plug->getEventList();
6313                 foreach ($eventList as $eventName)
6314                     sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
6315             }
6316         }
6317
6318         redirect($CONF['AdminURL'] . '?action=pluginlist');
6319 //              $this->action_pluginlist();
6320     }
6321
6322     /**
6323      * @todo document this
6324      */
6325     function action_plugindelete() {
6326         global $member, $manager;
6327
6328         // check if allowed
6329         $member->isAdmin() or $this->disallow();
6330
6331         $pid = intGetVar('plugid');
6332
6333         if (!$manager->pidInstalled($pid))
6334             $this->error(_ERROR_NOSUCHPLUGIN);
6335
6336         $this->pagehead();
6337         ?>
6338             <h2><?php echo _DELETE_CONFIRM?></h2>
6339
6340             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6341
6342             <form method="post" action="index.php"><div>
6343             <?php $manager->addTicketHidden() ?>
6344             <input type="hidden" name="action" value="plugindeleteconfirm" />
6345             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6346             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6347             </div></form>
6348         <?php
6349         $this->pagefoot();
6350     }
6351
6352     /**
6353      * @todo document this
6354      */
6355     function action_plugindeleteconfirm() {
6356         global $member, $manager, $CONF;
6357
6358         // check if allowed
6359         $member->isAdmin() or $this->disallow();
6360
6361         $pid = intPostVar('plugid');
6362
6363         $error = $this->deleteOnePlugin($pid, 1);
6364         if ($error) {
6365             $this->error($error);
6366         }
6367
6368         redirect($CONF['AdminURL'] . '?action=pluginlist');
6369 //              $this->action_pluginlist();
6370     }
6371
6372     /**
6373      * @todo document this
6374      */
6375     function deleteOnePlugin($pid, $callUninstall = 0) {
6376         global $manager;
6377
6378         $pid = intval($pid);
6379
6380         if (!$manager->pidInstalled($pid))
6381             return _ERROR_NOSUCHPLUGIN;
6382
6383         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6384
6385 /*              // call the unInstall method of the plugin
6386         if ($callUninstall) {
6387             $plugin =& $manager->getPlugin($name);
6388             if ($plugin) $plugin->unInstall();
6389         }*/
6390
6391         // check dependency before delete
6392         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6393         while($o = sql_fetch_object($res)) {
6394             $plug =& $manager->getPlugin($o->pfile);
6395             if ($plug)
6396             {
6397                 $depList = $plug->getPluginDep();
6398                 foreach ($depList as $depName)
6399                 {
6400                     if ($name == $depName)
6401                     {
6402                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6403                     }
6404                 }
6405             }
6406         }
6407
6408         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6409
6410         // call the unInstall method of the plugin
6411         if ($callUninstall) {
6412             $plugin =& $manager->getPlugin($name);
6413             if ($plugin) $plugin->unInstall();
6414         }
6415
6416         // delete all subscriptions
6417         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6418
6419         // delete all options
6420         // get OIDs from plugin_option_desc
6421         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6422         $aOIDs = array();
6423         while ($o = sql_fetch_object($res)) {
6424             array_push($aOIDs, $o->oid);
6425         }
6426
6427         // delete from plugin_option and plugin_option_desc
6428         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6429         if (count($aOIDs) > 0)
6430             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6431
6432         // update order numbers
6433         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6434         $o = sql_fetch_object($res);
6435         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6436
6437         // delete row
6438         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6439
6440         $manager->clearCachedInfo('installedPlugins');
6441         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6442
6443         return '';
6444     }
6445
6446     /**
6447      * @todo document this
6448      */
6449     function action_pluginup() {
6450         global $member, $manager, $CONF;
6451
6452         // check if allowed
6453         $member->isAdmin() or $this->disallow();
6454
6455         $plugid = intGetVar('plugid');
6456
6457         if (!$manager->pidInstalled($plugid))
6458             $this->error(_ERROR_NOSUCHPLUGIN);
6459
6460         // 1. get old order number
6461         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6462         $o = sql_fetch_object($res);
6463         $oldOrder = $o->porder;
6464
6465         // 2. calculate new order number
6466         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6467
6468         // 3. update plug numbers
6469         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6470         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6471
6472         //$this->action_pluginlist();
6473         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6474         redirect($CONF['AdminURL'] . '?action=pluginlist');
6475     }
6476
6477     /**
6478      * @todo document this
6479      */
6480     function action_plugindown() {
6481         global $member, $manager, $CONF;
6482
6483         // check if allowed
6484         $member->isAdmin() or $this->disallow();
6485
6486         $plugid = intGetVar('plugid');
6487         if (!$manager->pidInstalled($plugid))
6488             $this->error(_ERROR_NOSUCHPLUGIN);
6489
6490         // 1. get old order number
6491         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6492         $o = sql_fetch_object($res);
6493         $oldOrder = $o->porder;
6494
6495         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6496         $maxOrder = sql_num_rows($res);
6497
6498         // 2. calculate new order number
6499         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6500
6501         // 3. update plug numbers
6502         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6503         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6504
6505         //$this->action_pluginlist();
6506         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6507         redirect($CONF['AdminURL'] . '?action=pluginlist');
6508     }
6509
6510         /**
6511          * ADMIN::action_pluginoptions()
6512          *
6513          * Output Plugin option page
6514          *
6515          * @access      public
6516          * @param       string $message message when fallbacked
6517          * @return      void
6518          *
6519          */
6520         public function action_pluginoptions($message = '')
6521         {
6522                 global $member, $manager;
6523
6524                 // check if allowed
6525                 $member->isAdmin() or $this->disallow();
6526
6527                 $pid = (integer) requestVar('plugid');
6528                 if ( !$manager->pidInstalled($pid) )
6529                 {
6530                         $this->error(_ERROR_NOSUCHPLUGIN);
6531                 }
6532
6533                 $pname = getPluginNameFromPid($pid);
6534
6535                 /* just for including translation */
6536                 $manager->getPlugin($pname);
6537
6538                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6539                 $this->pagehead($extrahead);
6540                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6541                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($pname)) . "</h2>\n";
6542
6543                 if ( isset($message) )
6544                 {
6545                         echo $message;
6546                 }
6547
6548                 echo "<form action=\"index.php\" method=\"post\">\n";
6549                 echo "<div>\n";
6550                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6551                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6552                 $manager->addTicketHidden();
6553
6554                 $aOptions = array();
6555                 $aOIDs = array();
6556                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6557                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6558                 $result = sql_query($query);
6559                 while ( $object = sql_fetch_object($result) )
6560                 {
6561                         array_push($aOIDs, $object->oid);
6562                         $aOptions[$object->oid] = array(
6563                                                 'oid' => $object->oid,
6564                                                 'value' => $object->odef,
6565                                                 'name' => $object->oname,
6566                                                 'description' => $object->odesc,
6567                                                 'type' => $object->otype,
6568                                                 'typeinfo' => $object->oextra,
6569                                                 'contextid' => 0
6570                         );
6571                 }
6572                 // fill out actual values
6573                 if ( count($aOIDs) > 0 )
6574                 {
6575                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6576                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6577                         $result = sql_query($query);
6578                         while ( $object = sql_fetch_object($result) )
6579                         {
6580                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6581                         }
6582                 }
6583
6584                 // call plugins
6585                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6586                 $manager->notify('PrePluginOptionsEdit',$data);
6587
6588                 $template['content'] = 'plugoptionlist';
6589                 $amount = showlist($aOptions,'table',$template);
6590                 if ( $amount == 0 )
6591                 {
6592                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6593                 }
6594                 echo "</div>\n";
6595                 echo "</form>\n";
6596                 $this->pagefoot();
6597
6598                 return;
6599         }
6600
6601         /**
6602          * ADMIN::action_pluginoptionsupdate()
6603          *
6604          * Update plugin options and fallback to plugin option page
6605          *
6606          * @access      public
6607          * @param       void
6608          * @return      void
6609          */
6610         public function action_pluginoptionsupdate()
6611         {
6612                 global $member, $manager;
6613
6614                 // check if allowed
6615                 $member->isAdmin() or $this->disallow();
6616
6617                 $pid = (integer) requestVar('plugid');
6618                 if ( !$manager->pidInstalled($pid) )
6619                 {
6620                         $this->error(_ERROR_NOSUCHPLUGIN);
6621                 }
6622
6623                 $aOptions = requestArray('plugoption');
6624                 NucleusPlugin::apply_plugin_options($aOptions);
6625
6626                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6627
6628                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6629                 return;
6630         }
6631
6632         /**
6633          * ADMIN::_insertPluginOptions()
6634          *
6635          * Output plugin option field
6636          *
6637          * @access      public
6638          * @param string        $context        plugin option context
6639          * @param integer       $contextid      plugin option context id
6640          * @return      void
6641          */
6642         public function _insertPluginOptions($context, $contextid = 0)
6643         {
6644                 // get all current values for this contextid
6645                 // (note: this might contain doubles for overlapping contextids)
6646                 $aIdToValue = array();
6647                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6648                 while ( $object = sql_fetch_object($res) )
6649                 {
6650                         $aIdToValue[$object->oid] = $object->ovalue;
6651                 }
6652
6653                 // get list of oids per pid
6654                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6655                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6656                 $res = sql_query($query);
6657                 $aOptions = array();
6658                 while ( $object = sql_fetch_object($res) )
6659                 {
6660                         if (in_array($object->oid, array_keys($aIdToValue)))
6661                         {
6662                                 $value = $aIdToValue[$object->oid];
6663                         }
6664                         else
6665                         {
6666                                 $value = $object->odef;
6667                         }
6668
6669                         array_push($aOptions, array(
6670                                 'pid' => $object->pid,
6671                                 'pfile' => $object->pfile,
6672                                 'oid' => $object->oid,
6673                                 'value' => $value,
6674                                 'name' => $object->oname,
6675                                 'description' => $object->odesc,
6676                                 'type' => $object->otype,
6677                                 'typeinfo' => $object->oextra,
6678                                 'contextid' => $contextid,
6679                                 'extra' => ''));
6680                 }
6681
6682                 global $manager;
6683                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6684
6685                 $iPrevPid = -1;
6686                 foreach ($aOptions as $aOption)
6687                 {
6688                         // new plugin?
6689                         if ( $iPrevPid != $aOption['pid'] )
6690                         {
6691                                 $iPrevPid = $aOption['pid'];
6692                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6693                                 {
6694                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6695                                 }
6696                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($aOption['pfile'])).'</th></tr>';
6697                         }
6698
6699                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6700                         if ( @$meta['access'] != 'hidden' )
6701                         {
6702                                 echo '<tr>';
6703                                 listplug_plugOptionRow($aOption);
6704                                 echo '</tr>';
6705                         }
6706                 }
6707                 return;
6708         }
6709
6710         /**
6711          * ADMIN::input_yesno()
6712          * Output input elements with radio attribute for yes/no options
6713          *
6714          * @param       string  $name   name attribute
6715          * @param       string  $value_current  current value attribute
6716          * @param       integer $tabindex       tab index
6717          * @param       string  $value_yes      value attribute for yes option
6718          * @param       string  $value_no       value attribute for no option
6719          * @param       string  $text_yes       child text element for yes option
6720          * @param       string  $text_no        child text element for no option
6721          * @param       boolean $isAdmin        have admin right or not
6722          * @return      void
6723          */
6724         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6725         {
6726                 $id = preg_replace('#\[|\]#', '-', $name);
6727                 $id_yes = $id . $value_yes;
6728                 $id_no  = $id . $value_no;
6729
6730                 /* yes option */
6731                 echo '<input type="radio" id="' . ENTITY::hsc($id_yes) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_yes) . '"';
6732                 if ( $name=="admin" )
6733                 {
6734                         echo ' onclick="selectCanLogin(true);"';
6735                 }
6736                 if ( $value_current == $value_yes )
6737                 {
6738                         echo " tabindex='$tabindex' checked='checked'";
6739                 }
6740                 echo " />\n";
6741                 echo '<label for="' . ENTITY::hsc($id_yes) . '">' . ENTITY::hsc($text_yes) . "</label>\n";
6742
6743                 /* no option */
6744                 echo '<input type="radio" id="' . ENTITY::hsc($id_no) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_no) . '"';
6745                 if ( $name=="admin" )
6746                 {
6747                         echo ' onclick="selectCanLogin(false);"';
6748                 }
6749                 if ( $value_current != $value_yes )
6750                 {
6751                         echo " tabindex='$tabindex' checked='checked'";
6752                 }
6753                 if ($isAdmin && $name=="canlogin")
6754                 {
6755                         echo ' disabled="disabled"';
6756                 }
6757                 echo " />\n";
6758                 echo '<label for="' . ENTITY::hsc($id_no) . '">' . ENTITY::hsc($text_no) . "</label>\n";
6759
6760                 return;
6761         }
6762 }