nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . ENTITY::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', ENTITY::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.ENTITY::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. ENTITY::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',ENTITY::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',ENTITY::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',ENTITY::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124     /**
1125      * Provide a page to item a new item to the given blog
1126      */
1127     function action_createitem() {
1128         global $member, $manager;
1129
1130         $blogid = intRequestVar('blogid');
1131
1132         // check if allowed
1133         $member->teamRights($blogid) or $this->disallow();
1134
1135         $memberid = $member->getID();
1136
1137         $blog =& $manager->getBlog($blogid);
1138
1139         $this->pagehead();
1140
1141         // generate the add-item form
1142         $formfactory = new PAGEFACTORY($blogid);
1143         $formfactory->createAddForm('admin');
1144
1145         $this->pagefoot();
1146     }
1147
1148     /**
1149      * @todo document this
1150      */
1151     function action_itemedit()
1152         {
1153                 global $member, $manager;
1154
1155                 $itemid = intRequestVar('itemid');
1156
1157                 // only allow if user is allowed to alter item
1158                 $member->canAlterItem($itemid) or $this->disallow();
1159
1160                 $item =& $manager->getItem($itemid, 1, 1);
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1162
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1164
1165                 if ($blog->convertBreaks())
1166                 {
1167                         $item['body'] = removeBreaks($item['body']);
1168                         $item['more'] = removeBreaks($item['more']);
1169                 }
1170
1171                 // form to edit blog items
1172                 $this->pagehead();
1173                 $formfactory = new PAGEFACTORY($blog->getID());
1174                 $formfactory->createEditForm('admin', $item);
1175                 $this->pagefoot();
1176     }
1177
1178     /**
1179      * @todo document this
1180      */
1181     function action_itemupdate() {
1182         global $member, $manager, $CONF;
1183
1184         $itemid = intRequestVar('itemid');
1185         $catid = postVar('catid');
1186
1187         // only allow if user is allowed to alter item
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1189
1190         $actiontype = postVar('actiontype');
1191
1192         // delete actions are handled by itemdelete (which has confirmation)
1193         if ($actiontype == 'delete') {
1194             $this->action_itemdelete();
1195             return;
1196         }
1197
1198         $body   = postVar('body');
1199         $title  = postVar('title');
1200         $more   = postVar('more');
1201         $closed = intPostVar('closed');
1202         $draftid = intPostVar('draftid');
1203
1204         // default action = add now
1205         if (!$actiontype)
1206             $actiontype='addnow';
1207
1208         // create new category if needed
1209         if (strstr($catid,'newcat')) {
1210             // get blogid
1211             list($blogid) = sscanf($catid,"newcat-%d");
1212
1213             // create
1214             $blog =& $manager->getBlog($blogid);
1215             $catid = $blog->createNewCategory();
1216
1217             // show error when sth goes wrong
1218             if (!$catid)
1219                 $this->doError(_ERROR_CATCREATEFAIL);
1220         }
1221
1222         /*
1223             set some variables based on actiontype
1224
1225             actiontypes:
1226                 draft items -> addnow, addfuture, adddraft, delete
1227                 non-draft items -> edit, changedate, delete
1228
1229             variables set:
1230                 $timestamp: set to a nonzero value for future dates or date changes
1231                 $wasdraft: set to 1 when the item used to be a draft item
1232                 $publish: set to 1 when the edited item is not a draft
1233         */
1234         $blogid =  getBlogIDFromItemID($itemid);
1235         $blog   =& $manager->getBlog($blogid);
1236
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1242         } else {
1243             $timestamp =0;
1244         }
1245
1246         // edit the item for real
1247         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1248
1249         $this->updateFuturePosted($blogid);
1250
1251         if ($draftid > 0) {
1252             // delete permission is checked inside ITEM::delete()
1253             ITEM::delete($draftid);
1254         }
1255
1256         // show category edit window when we created a new category
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1258         if ($catid != intPostVar('catid')) {
1259             $this->action_categoryedit(
1260                 $catid,
1261                 $blog->getID(),
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1263             );
1264         } else {
1265             // TODO: set start item correctly for itemlist
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));
1267         }
1268     }
1269
1270     /**
1271      * @todo document this
1272      */
1273     function action_itemdelete() {
1274         global $member, $manager;
1275
1276         $itemid = intRequestVar('itemid');
1277
1278         // only allow if user is allowed to alter item
1279         $member->canAlterItem($itemid) or $this->disallow();
1280
1281         if (!$manager->existsItem($itemid,1,1))
1282             $this->error(_ERROR_NOSUCHITEM);
1283
1284         $item =& $manager->getItem($itemid,1,1);
1285         $title = ENTITY::hsc(strip_tags($item['title']));
1286         $body = strip_tags($item['body']);
1287         $body = ENTITY::hsc(shorten($body,300,'...'));
1288
1289         $this->pagehead();
1290         ?>
1291             <h2><?php echo _DELETE_CONFIRM?></h2>
1292
1293             <p><?php echo _CONFIRMTXT_ITEM?></p>
1294
1295             <div class="note">
1296                 <b>"<?php echo  $title ?>"</b>
1297                 <br />
1298                 <?php echo $body?>
1299             </div>
1300
1301             <form method="post" action="index.php"><div>
1302                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1303                 <?php $manager->addTicketHidden() ?>
1304                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1305                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1306             </div></form>
1307         <?php
1308         $this->pagefoot();
1309     }
1310
1311     /**
1312      * @todo document this
1313      */
1314     function action_itemdeleteconfirm() {
1315         global $member;
1316
1317         $itemid = intRequestVar('itemid');
1318
1319         // only allow if user is allowed to alter item
1320         $member->canAlterItem($itemid) or $this->disallow();
1321
1322         // get blogid first
1323         $blogid = getBlogIdFromItemId($itemid);
1324
1325         // delete item (note: some checks will be performed twice)
1326         $this->deleteOneItem($itemid);
1327
1328         $this->action_itemlist($blogid);
1329     }
1330
1331     /**
1332      * Deletes one item and returns error if something goes wrong
1333      * @param int $itemid
1334      */
1335     function deleteOneItem($itemid) {
1336         global $member, $manager;
1337
1338         // only allow if user is allowed to alter item (also checks if itemid exists)
1339         if (!$member->canAlterItem($itemid))
1340             return _ERROR_DISALLOWED;
1341
1342         // need to get blogid before the item is deleted
1343         $blogid = getBlogIDFromItemId($itemid);
1344
1345         $manager->loadClass('ITEM');
1346         ITEM::delete($itemid);
1347
1348         // update blog's futureposted
1349         $this->updateFuturePosted($blogid);
1350     }
1351
1352     /**
1353      * Update a blog's future posted flag
1354      * @param int $blogid
1355      */
1356     function updateFuturePosted($blogid) {
1357         global $manager;
1358
1359         $blog =& $manager->getBlog($blogid);
1360         $currenttime = $blog->getCorrectTime(time());
1361         $result = sql_query("SELECT * FROM ".sql_table('item').
1362             " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1363         if (sql_num_rows($result) > 0) {
1364                 $blog->setFuturePost();
1365         }
1366         else {
1367                 $blog->clearFuturePost();
1368         }
1369     }
1370
1371     /**
1372      * @todo document this
1373      */
1374     function action_itemmove() {
1375         global $member, $manager;
1376
1377         $itemid = intRequestVar('itemid');
1378
1379         // only allow if user is allowed to alter item
1380         $member->canAlterItem($itemid) or $this->disallow();
1381
1382         $item =& $manager->getItem($itemid,1,1);
1383
1384         $this->pagehead();
1385         ?>
1386             <h2><?php echo _MOVE_TITLE?></h2>
1387             <form method="post" action="index.php"><div>
1388                 <input type="hidden" name="action" value="itemmoveto" />
1389                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1390
1391                 <?php
1392
1393                     $manager->addTicketHidden();
1394                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1395                 ?>
1396
1397                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1398             </div></form>
1399         <?php
1400         $this->pagefoot();
1401     }
1402
1403     /**
1404      * @todo document this
1405      */
1406     function action_itemmoveto() {
1407         global $member, $manager;
1408
1409         $itemid = intRequestVar('itemid');
1410         $catid = requestVar('catid');
1411
1412         // create new category if needed
1413         if (strstr($catid,'newcat')) {
1414             // get blogid
1415             list($blogid) = sscanf($catid,'newcat-%d');
1416
1417             // create
1418             $blog =& $manager->getBlog($blogid);
1419             $catid = $blog->createNewCategory();
1420
1421             // show error when sth goes wrong
1422             if (!$catid)
1423                 $this->doError(_ERROR_CATCREATEFAIL);
1424         }
1425
1426         // only allow if user is allowed to alter item
1427         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1428
1429         $old_blogid = getBlogIDFromItemId($itemid);
1430
1431         ITEM::move($itemid, $catid);
1432
1433         // set the futurePosted flag on the blog
1434         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1435
1436         // reset the futurePosted in case the item is moved from one blog to another
1437         $this->updateFuturePosted($old_blogid);
1438
1439         if ($catid != intRequestVar('catid'))
1440             $this->action_categoryedit($catid, $blog->getID());
1441         else
1442             $this->action_itemlist(getBlogIDFromCatID($catid));
1443     }
1444
1445     /**
1446      * Moves one item to a given category (category existance should be checked by caller)
1447      * errors are returned
1448      * @param int $itemid
1449      * @param int $destCatid category ID to which the item will be moved
1450      */
1451     function moveOneItem($itemid, $destCatid) {
1452         global $member;
1453
1454         // only allow if user is allowed to move item
1455         if (!$member->canUpdateItem($itemid, $destCatid))
1456             return _ERROR_DISALLOWED;
1457
1458         ITEM::move($itemid, $destCatid);
1459     }
1460
1461     /**
1462      * Adds a item to the chosen blog
1463      */
1464     function action_additem() {
1465         global $manager, $CONF;
1466
1467         $manager->loadClass('ITEM');
1468
1469         $result = ITEM::createFromRequest();
1470
1471         if ($result['status'] == 'error')
1472             $this->error($result['message']);
1473
1474         $blogid = getBlogIDFromItemID($result['itemid']);
1475         $blog =& $manager->getBlog($blogid);
1476         $btimestamp = $blog->getCorrectTime();
1477         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1478
1479         if ($result['status'] == 'newcategory') {
1480             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1481             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1482         } else {
1483             $methodName = 'action_itemList';
1484             call_user_func(array(&$this, $methodName), $blogid);
1485         }
1486     }
1487
1488         /**
1489          * Allows to edit previously made comments
1490          **/
1491         function action_commentedit() {
1492
1493                 global $member, $manager;
1494
1495                 $commentid = intRequestVar('commentid');
1496
1497                 $member->canAlterComment($commentid) or $this->disallow();
1498
1499                 $comment = COMMENT::getComment($commentid);
1500
1501                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1502
1503                 // change <br /> to \n
1504                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1505
1506                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1507                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1508
1509         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1510
1511         $this->pagehead();
1512
1513         ?>
1514         <h2><?php echo _EDITC_TITLE?></h2>
1515
1516         <form action="index.php" method="post"><div>
1517
1518         <input type="hidden" name="action" value="commentupdate" />
1519         <?php $manager->addTicketHidden(); ?>
1520         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1521         <table><tr>
1522             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1523         </tr><tr>
1524             <td><?php echo _EDITC_WHO?></td>
1525             <td>
1526             <?php               if ($comment['member'])
1527                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1528                 else
1529                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1530             ?>
1531             </td>
1532         </tr><tr>
1533             <td><?php echo _EDITC_WHEN?></td>
1534             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1535         </tr><tr>
1536             <td><?php echo _EDITC_HOST?></td>
1537             <td><?php echo  $comment['host']; ?></td>
1538         </tr>
1539         <tr>
1540             <td><?php echo _EDITC_URL; ?></td>
1541             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1542         </tr>
1543         <tr>
1544             <td><?php echo _EDITC_EMAIL; ?></td>
1545             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1546         </tr>
1547         <tr>
1548             <td><?php echo _EDITC_TEXT?></td>
1549             <td>
1550                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1551                     echo $comment['body'];
1552                 ?></textarea>
1553             </td>
1554         </tr><tr>
1555             <td><?php echo _EDITC_EDIT?></td>
1556             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1557         </tr></table>
1558
1559         </div></form>
1560         <?php
1561         $this->pagefoot();
1562     }
1563
1564     /**
1565      * @todo document this
1566      */
1567     function action_commentupdate() {
1568         global $member, $manager;
1569
1570         $commentid = intRequestVar('commentid');
1571
1572         $member->canAlterComment($commentid) or $this->disallow();
1573
1574         $url = postVar('url');
1575         $email = postVar('email');
1576         $body = postVar('body');
1577
1578                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1579                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1580                 # important note that '\' must be matched with '\\\\' in preg* expressions
1581
1582                 // intercept words that are too long
1583                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1584                 {
1585                         $this->error(_ERROR_COMMENT_LONGWORD);
1586                 }
1587
1588                 // check length
1589                 if (i18n::strlen($body) < 3)
1590                 {
1591                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1592                 }
1593
1594                 if (i18n::strlen($body) > 5000)
1595                 {
1596                         $this->error(_ERROR_COMMENT_TOOLONG);
1597                 }
1598
1599         // prepare body
1600         $body = COMMENT::prepareBody($body);
1601
1602         // call plugins
1603         $manager->notify('PreUpdateComment',array('body' => &$body));
1604
1605         $query = 'UPDATE ' . sql_table('comment')
1606                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1607                . " WHERE cnumber = " . $commentid;
1608         sql_query($query);
1609
1610         // get itemid
1611         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1612         $o = sql_fetch_object($res);
1613         $itemid = $o->citem;
1614
1615         if ($member->canAlterItem($itemid))
1616             $this->action_itemcommentlist($itemid);
1617         else
1618             $this->action_browseowncomments();
1619
1620     }
1621
1622     /**
1623      * @todo document this
1624      */
1625     function action_commentdelete() {
1626         global $member, $manager;
1627
1628         $commentid = intRequestVar('commentid');
1629
1630         $member->canAlterComment($commentid) or $this->disallow();
1631
1632         $comment = COMMENT::getComment($commentid);
1633
1634         $body = strip_tags($comment['body']);
1635         $body = ENTITY::hsc(shorten($body, 300, '...'));
1636
1637         if ($comment['member'])
1638             $author = $comment['member'];
1639         else
1640             $author = $comment['user'];
1641
1642         $this->pagehead();
1643         ?>
1644
1645             <h2><?php echo _DELETE_CONFIRM?></h2>
1646
1647             <p><?php echo _CONFIRMTXT_COMMENT?></p>
1648
1649             <div class="note">
1650             <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1651             <br />
1652             <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1653             </div>
1654
1655             <form method="post" action="index.php"><div>
1656                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1657                 <?php $manager->addTicketHidden() ?>
1658                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1659                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1660             </div></form>
1661         <?php
1662         $this->pagefoot();
1663     }
1664
1665     /**
1666      * @todo document this
1667      */
1668     function action_commentdeleteconfirm() {
1669         global $member;
1670
1671         $commentid = intRequestVar('commentid');
1672
1673         // get item id first
1674         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1675         $o = sql_fetch_object($res);
1676         $itemid = $o->citem;
1677
1678         $error = $this->deleteOneComment($commentid);
1679         if ($error)
1680             $this->doError($error);
1681
1682         if ($member->canAlterItem($itemid))
1683             $this->action_itemcommentlist($itemid);
1684         else
1685             $this->action_browseowncomments();
1686     }
1687
1688     /**
1689      * @todo document this
1690      */
1691     function deleteOneComment($commentid) {
1692         global $member, $manager;
1693
1694         $commentid = intval($commentid);
1695
1696         if (!$member->canAlterComment($commentid))
1697             return _ERROR_DISALLOWED;
1698
1699         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1700
1701         // delete the comments associated with the item
1702         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1703         sql_query($query);
1704
1705         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1706
1707         return '';
1708     }
1709
1710     /**
1711      * Usermanagement main
1712      */
1713     function action_usermanagement() {
1714         global $member, $manager;
1715
1716         // check if allowed
1717         $member->isAdmin() or $this->disallow();
1718
1719         $this->pagehead();
1720
1721         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1722
1723         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1724
1725         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1726
1727         // show list of members with actions
1728         $query =  'SELECT *'
1729                . ' FROM '.sql_table('member');
1730         $template['content'] = 'memberlist';
1731         $template['tabindex'] = 10;
1732
1733         $manager->loadClass("ENCAPSULATE");
1734         $batch = new BATCH('member');
1735         $batch->showlist($query,'table',$template);
1736
1737         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1738         ?>
1739             <form method="post" action="index.php" name="memberedit"><div>
1740
1741             <input type="hidden" name="action" value="memberadd" />
1742             <?php $manager->addTicketHidden() ?>
1743
1744             <table>
1745             <tr>
1746                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1747             </tr><tr>
1748                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1749                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1750                 </td>
1751                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1752             </tr><tr>
1753                 <td><?php echo _MEMBERS_REALNAME?></td>
1754                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1755             </tr><tr>
1756                 <td><?php echo _MEMBERS_PWD?></td>
1757                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1758             </tr><tr>
1759                 <td><?php echo _MEMBERS_REPPWD?></td>
1760                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1761             </tr><tr>
1762                 <td><?php echo _MEMBERS_EMAIL?></td>
1763                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1764             </tr><tr>
1765                 <td><?php echo _MEMBERS_URL?></td>
1766                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1767             </tr><tr>
1768                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1769                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1770             </tr><tr>
1771                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1772                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1773             </tr><tr>
1774                 <td><?php echo _MEMBERS_NOTES?></td>
1775                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1776             </tr><tr>
1777                 <td><?php echo _MEMBERS_NEW?></td>
1778                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1779             </tr></table>
1780
1781             </div></form>
1782         <?php
1783         $this->pagefoot();
1784     }
1785
1786     /**
1787      * Edit member settings
1788      */
1789     function action_memberedit() {
1790         $this->action_editmembersettings(intRequestVar('memberid'));
1791     }
1792
1793         /**
1794          * @todo document this
1795          */
1796         function action_editmembersettings($memberid = '') {
1797                 global $member, $manager, $CONF;
1798
1799                 if ($memberid == '')
1800                 {
1801                         $memberid = $member->getID();
1802                 }
1803
1804                 // check if allowed
1805                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1806
1807                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1808                 $this->pagehead($extrahead);
1809
1810                 // show message to go back to member overview (only for admins)
1811                 if ($member->isAdmin())
1812                 {
1813                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1814                 }
1815                 else
1816                 {
1817                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1818                 }
1819                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1820
1821                 $mem = MEMBER::createFromID($memberid);
1822                 ?>
1823                 <form method="post" action="index.php" name="memberedit"><div>
1824
1825                 <input type="hidden" name="action" value="changemembersettings" />
1826                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1827                 <?php $manager->addTicketHidden() ?>
1828
1829                 <table><tr>
1830                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1831                 </tr><tr>
1832                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1833                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1834                         </td>
1835                         <td>
1836                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1837                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  ENTITY::hsc($mem->getDisplayName()); ?>" />
1838                         <?php } else {
1839                                 echo ENTITY::hsc($member->getDisplayName());
1840                            }
1841                         ?>
1842                         </td>
1843                 </tr><tr>
1844                         <td><?php echo _MEMBERS_REALNAME?></td>
1845                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  ENTITY::hsc($mem->getRealName()); ?>" /></td>
1846                 </tr><tr>
1847                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1848                         <td><?php echo _MEMBERS_PWD?></td>
1849                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1850                 </tr><tr>
1851                         <td><?php echo _MEMBERS_REPPWD?></td>
1852                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1853                 <?php } ?>
1854                 </tr><tr>
1855                         <td><?php echo _MEMBERS_EMAIL?>
1856                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1857                         </td>
1858                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($mem->getEmail()); ?>" /></td>
1859                 </tr><tr>
1860                         <td><?php echo _MEMBERS_URL?></td>
1861                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getURL()); ?>" /></td>
1862                 <?php // only allow to change this by super-admins
1863                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1864                    if ($member->isAdmin()) {
1865                 ?>
1866                         </tr><tr>
1867                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1868                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1869                         </tr><tr>
1870                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1871                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1872                 <?php } ?>
1873                 </tr><tr>
1874                         <td><?php echo _MEMBERS_NOTES?></td>
1875                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getNotes()); ?>" /></td>
1876                 </tr><tr>
1877                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1878                         </td>
1879                         <td>
1880
1881                                 <select name="deflang" tabindex="85">
1882                                 <?php
1883                                 $locales = i18n::get_available_locale_list();
1884                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1885                                 {
1886                                         echo "<option value=\"\" selected=\"selected\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1887                                 }
1888                                 else
1889                                 {
1890                                         echo "<option value=\"\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1891                                 }
1892
1893                                 foreach( $locales as $locale )
1894                                 {
1895                                         if( $locale == $mem->getLocale() )
1896                                         {
1897                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1898                                         }
1899                                         else
1900                                         {
1901                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1902                                         }
1903                                 }
1904                                 ?>
1905                                 </select>
1906
1907                         </td>
1908                 </tr>
1909                 <tr>
1910                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1911                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1912                 </tr>
1913                 <?php
1914                         // plugin options
1915                         $this->_insertPluginOptions('member',$memberid);
1916                 ?>
1917                 <tr>
1918                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1919                 </tr><tr>
1920                         <td><?php echo _MEMBERS_EDIT?></td>
1921                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1922                 </tr></table>
1923
1924                 </div></form>
1925
1926                 <?php
1927                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1928
1929                         $manager->notify(
1930                                 'MemberSettingsFormExtras',
1931                                 array(
1932                                         'member' => &$mem
1933                                 )
1934                         );
1935                 $this->pagefoot();
1936         }
1937
1938     /**
1939      * @todo document this
1940      */
1941     function action_changemembersettings() {
1942         global $member, $CONF, $manager;
1943
1944         $memberid = intRequestVar('memberid');
1945
1946         // check if allowed
1947         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1948
1949         $name           = trim(strip_tags(postVar('name')));
1950         $realname       = trim(strip_tags(postVar('realname')));
1951         $password       = postVar('password');
1952         $repeatpassword = postVar('repeatpassword');
1953         $email          = strip_tags(postVar('email'));
1954         $url            = strip_tags(postVar('url'));
1955
1956                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1957                 # original eregi: !eregi("^https?://", $url)
1958
1959                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1960                 if (!preg_match('#^https?://#', $url) )
1961                 {
1962                         $url = 'http://' . $url;
1963                 }
1964
1965         $admin          = postVar('admin');
1966         $canlogin       = postVar('canlogin');
1967         $notes          = strip_tags(postVar('notes'));
1968         $locale        = postVar('deflang');
1969
1970         $mem = MEMBER::createFromID($memberid);
1971
1972         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1973
1974             if (!isValidDisplayName($name))
1975                 $this->error(_ERROR_BADNAME);
1976
1977             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1978                 $this->error(_ERROR_NICKNAMEINUSE);
1979
1980             if ($password != $repeatpassword)
1981                 $this->error(_ERROR_PASSWORDMISMATCH);
1982
1983             if ($password && (i18n::strlen($password) < 6))
1984                 $this->error(_ERROR_PASSWORDTOOSHORT);
1985
1986             if ($password) {
1987                                 $pwdvalid = true;
1988                                 $pwderror = '';
1989                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
1990                                 if (!$pwdvalid) {
1991                                         $this->error($pwderror);
1992                                 }
1993                         }
1994                 }
1995
1996                 if ( !NOTIFICATION::address_validation($email) )
1997                 {
1998                         $this->error(_ERROR_BADMAILADDRESS);
1999                 }
2000                 if ( !$realname )
2001                 {
2002                         $this->error(_ERROR_REALNAMEMISSING);
2003                 }
2004         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2005             $this->error(_ERROR_NOSUCHLANGUAGE);
2006
2007         // check if there will remain at least one site member with both the logon and admin rights
2008         // (check occurs when taking away one of these rights from such a member)
2009         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2010              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2011            )
2012         {
2013             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2014             if (sql_num_rows($r) < 2)
2015                 $this->error(_ERROR_ATLEASTONEADMIN);
2016         }
2017
2018         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2019             $mem->setDisplayName($name);
2020             if ($password)
2021                 $mem->setPassword($password);
2022         }
2023
2024         $oldEmail = $mem->getEmail();
2025
2026         $mem->setRealName($realname);
2027         $mem->setEmail($email);
2028         $mem->setURL($url);
2029         $mem->setNotes($notes);
2030         $mem->setLocale($locale);
2031
2032
2033         // only allow super-admins to make changes to the admin status
2034         if ($member->isAdmin()) {
2035             $mem->setAdmin($admin);
2036             $mem->setCanLogin($canlogin);
2037         }
2038
2039         $autosave = postVar ('autosave');
2040         $mem->setAutosave($autosave);
2041
2042         $mem->write();
2043
2044         // store plugin options
2045         $aOptions = requestArray('plugoption');
2046         NucleusPlugin::apply_plugin_options($aOptions);
2047         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2048
2049         // if email changed, generate new password
2050         if ($oldEmail != $mem->getEmail())
2051         {
2052             $mem->sendActivationLink('addresschange', $oldEmail);
2053             // logout member
2054             $mem->newCookieKey();
2055
2056             // only log out if the member being edited is the current member.
2057             if ($member->getID() == $memberid)
2058                 $member->logout();
2059             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2060             return;
2061         }
2062
2063
2064         if (  ( $mem->getID() == $member->getID() )
2065            && ( $mem->getDisplayName() != $member->getDisplayName() )
2066            ) {
2067             $mem->newCookieKey();
2068             $member->logout();
2069             $this->action_login(_MSG_LOGINAGAIN, 0);
2070         } else {
2071             $this->action_overview(_MSG_SETTINGSCHANGED);
2072         }
2073     }
2074
2075     /**
2076      * @todo document this
2077      */
2078     function action_memberadd() {
2079         global $member, $manager;
2080
2081         // check if allowed
2082         $member->isAdmin() or $this->disallow();
2083
2084         if (postVar('password') != postVar('repeatpassword'))
2085             $this->error(_ERROR_PASSWORDMISMATCH);
2086         if (i18n::strlen(postVar('password')) < 6)
2087             $this->error(_ERROR_PASSWORDTOOSHORT);
2088
2089         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2090         if ($res != 1)
2091             $this->error($res);
2092
2093         // fire PostRegister event
2094         $newmem = new MEMBER();
2095         $newmem->readFromName(postVar('name'));
2096         $manager->notify('PostRegister',array('member' => &$newmem));
2097
2098         $this->action_usermanagement();
2099     }
2100
2101     /**
2102      * Account activation
2103      *
2104      * @author dekarma
2105      */
2106     function action_activate() {
2107
2108         $key = getVar('key');
2109         $this->_showActivationPage($key);
2110     }
2111
2112     /**
2113      * @todo document this
2114      */
2115     function _showActivationPage($key, $message = '')
2116     {
2117         global $manager;
2118
2119         // clean up old activation keys
2120         MEMBER::cleanupActivationTable();
2121
2122         // get activation info
2123         $info = MEMBER::getActivationInfo($key);
2124
2125         if (!$info)
2126             $this->error(_ERROR_ACTIVATE);
2127
2128         $mem = MEMBER::createFromId($info->vmember);
2129
2130         if (!$mem)
2131             $this->error(_ERROR_ACTIVATE);
2132
2133         $text = '';
2134         $title = '';
2135         $bNeedsPasswordChange = true;
2136
2137         switch ($info->vtype)
2138         {
2139             case 'forgot':
2140                 $title = _ACTIVATE_FORGOT_TITLE;
2141                 $text = _ACTIVATE_FORGOT_TEXT;
2142                 break;
2143             case 'register':
2144                 $title = _ACTIVATE_REGISTER_TITLE;
2145                 $text = _ACTIVATE_REGISTER_TEXT;
2146                 break;
2147             case 'addresschange':
2148                 $title = _ACTIVATE_CHANGE_TITLE;
2149                 $text = _ACTIVATE_CHANGE_TEXT;
2150                 $bNeedsPasswordChange = false;
2151                 MEMBER::activate($key);
2152                 break;
2153         }
2154
2155         $aVars = array(
2156             'memberName' => ENTITY::hsc($mem->getDisplayName())
2157         );
2158         $title = TEMPLATE::fill($title, $aVars);
2159         $text = TEMPLATE::fill($text, $aVars);
2160
2161         $this->pagehead();
2162
2163             echo '<h2>' , $title, '</h2>';
2164             echo '<p>' , $text, '</p>';
2165
2166             if ($message != '')
2167             {
2168                 echo '<p class="error">',$message,'</p>';
2169             }
2170
2171             if ($bNeedsPasswordChange)
2172             {
2173                 ?>
2174                     <div><form action="index.php" method="post">
2175
2176                         <input type="hidden" name="action" value="activatesetpwd" />
2177                         <?php $manager->addTicketHidden() ?>
2178                         <input type="hidden" name="key" value="<?php echo ENTITY::hsc($key) ?>" />
2179
2180                         <table><tr>
2181                             <td><?php echo _MEMBERS_PWD?></td>
2182                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2183                         </tr><tr>
2184                             <td><?php echo _MEMBERS_REPPWD?></td>
2185                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2186                         <?php
2187
2188                             global $manager;
2189                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2190
2191                         ?>
2192                         </tr><tr>
2193                             <td><?php echo _MEMBERS_SETPWD ?></td>
2194                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2195                         </tr></table>
2196
2197
2198                     </form></div>
2199
2200                 <?php
2201
2202             }
2203
2204         $this->pagefoot();
2205
2206     }
2207
2208     /**
2209      * Account activation - set password part
2210      *
2211      * @author dekarma
2212      */
2213     function action_activatesetpwd() {
2214
2215         $key = postVar('key');
2216
2217         // clean up old activation keys
2218         MEMBER::cleanupActivationTable();
2219
2220         // get activation info
2221         $info = MEMBER::getActivationInfo($key);
2222
2223         if (!$info || ($info->type == 'addresschange'))
2224             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2225
2226         $mem = MEMBER::createFromId($info->vmember);
2227
2228         if (!$mem)
2229             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2230
2231         $password       = postVar('password');
2232         $repeatpassword = postVar('repeatpassword');
2233
2234         if ($password != $repeatpassword)
2235             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2236
2237         if ($password && (i18n::strlen($password) < 6))
2238             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2239
2240         if ($password) {
2241                         $pwdvalid = true;
2242                         $pwderror = '';
2243                         global $manager;
2244                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2245                         if (!$pwdvalid) {
2246                                 return $this->_showActivationPage($key,$pwderror);
2247                         }
2248                 }
2249
2250         $error = '';
2251
2252         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2253         if ($error != '')
2254             return $this->_showActivationPage($key, $error);
2255
2256
2257         // set password
2258         $mem->setPassword($password);
2259         $mem->write();
2260
2261         // do the activation
2262         MEMBER::activate($key);
2263
2264         $this->pagehead();
2265             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2266             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2267         $this->pagefoot();
2268     }
2269
2270     /**
2271      * Manage team
2272      */
2273     function action_manageteam() {
2274         global $member, $manager;
2275
2276         $blogid = intRequestVar('blogid');
2277
2278         // check if allowed
2279         $member->blogAdminRights($blogid) or $this->disallow();
2280
2281         $this->pagehead();
2282
2283         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2284
2285         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2286
2287         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2288
2289
2290
2291         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2292                . ' FROM '.sql_table('member').', '.sql_table('team')
2293                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2294
2295         $template['content'] = 'teamlist';
2296         $template['tabindex'] = 10;
2297
2298         $manager->loadClass("ENCAPSULATE");
2299         $batch = new BATCH('team');
2300         $batch->showlist($query, 'table', $template);
2301
2302         ?>
2303             <h3><?php echo _TEAM_ADDNEW?></h3>
2304
2305             <form method='post' action='index.php'><div>
2306
2307             <input type='hidden' name='action' value='teamaddmember' />
2308             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2309             <?php $manager->addTicketHidden() ?>
2310
2311             <table><tr>
2312                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2313                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2314                     $query =  'SELECT mname as text, mnumber as value'
2315                            . ' FROM '.sql_table('member');
2316
2317                     $template['name'] = 'memberid';
2318                     $template['tabindex'] = 10000;
2319                     showlist($query,'select',$template);
2320                 ?></td>
2321             </tr><tr>
2322                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2323                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2324             </tr><tr>
2325                 <td><?php echo _TEAM_ADD?></td>
2326                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2327             </tr></table>
2328
2329             </div></form>
2330         <?php
2331         $this->pagefoot();
2332     }
2333
2334     /**
2335      * Add member to team
2336      */
2337     function action_teamaddmember() {
2338         global $member, $manager;
2339
2340         $memberid = intPostVar('memberid');
2341         $blogid = intPostVar('blogid');
2342         $admin = intPostVar('admin');
2343
2344         // check if allowed
2345         $member->blogAdminRights($blogid) or $this->disallow();
2346
2347         $blog =& $manager->getBlog($blogid);
2348         if (!$blog->addTeamMember($memberid, $admin))
2349             $this->error(_ERROR_ALREADYONTEAM);
2350
2351         $this->action_manageteam();
2352
2353     }
2354
2355     /**
2356      * @todo document this
2357      */
2358     function action_teamdelete() {
2359         global $member, $manager;
2360
2361         $memberid = intRequestVar('memberid');
2362         $blogid = intRequestVar('blogid');
2363
2364         // check if allowed
2365         $member->blogAdminRights($blogid) or $this->disallow();
2366
2367         $teammem = MEMBER::createFromID($memberid);
2368         $blog =& $manager->getBlog($blogid);
2369
2370         $this->pagehead();
2371         ?>
2372             <h2><?php echo _DELETE_CONFIRM?></h2>
2373
2374             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  ENTITY::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  ENTITY::hsc(strip_tags($blog->getName())) ?></b>
2375             </p>
2376
2377
2378             <form method="post" action="index.php"><div>
2379             <input type="hidden" name="action" value="teamdeleteconfirm" />
2380             <?php $manager->addTicketHidden() ?>
2381             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2382             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2383             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2384             </div></form>
2385         <?php
2386         $this->pagefoot();
2387     }
2388
2389     /**
2390      * @todo document this
2391      */
2392     function action_teamdeleteconfirm() {
2393         global $member;
2394
2395         $memberid = intRequestVar('memberid');
2396         $blogid = intRequestVar('blogid');
2397
2398         $error = $this->deleteOneTeamMember($blogid, $memberid);
2399         if ($error)
2400             $this->error($error);
2401
2402
2403         $this->action_manageteam();
2404     }
2405
2406     /**
2407      * @todo document this
2408      */
2409     function deleteOneTeamMember($blogid, $memberid) {
2410         global $member, $manager;
2411
2412         $blogid = intval($blogid);
2413         $memberid = intval($memberid);
2414
2415         // check if allowed
2416         if (!$member->blogAdminRights($blogid))
2417             return _ERROR_DISALLOWED;
2418
2419         // check if: - there remains at least one blog admin
2420         //           - (there remains at least one team member)
2421         $tmem = MEMBER::createFromID($memberid);
2422
2423         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2424
2425         if ($tmem->isBlogAdmin($blogid)) {
2426             // check if there are more blog members left and at least one admin
2427             // (check for at least two admins before deletion)
2428             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2429             $r = sql_query($query);
2430             if (sql_num_rows($r) < 2)
2431                 return _ERROR_ATLEASTONEBLOGADMIN;
2432         }
2433
2434         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2435         sql_query($query);
2436
2437         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2438
2439         return '';
2440     }
2441
2442     /**
2443      * @todo document this
2444      */
2445     function action_teamchangeadmin() {
2446         global $member;
2447
2448         $blogid = intRequestVar('blogid');
2449         $memberid = intRequestVar('memberid');
2450
2451         // check if allowed
2452         $member->blogAdminRights($blogid) or $this->disallow();
2453
2454         $mem = MEMBER::createFromID($memberid);
2455
2456         // don't allow when there is only one admin at this moment
2457         if ($mem->isBlogAdmin($blogid)) {
2458             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2459             if (sql_num_rows($r) == 1)
2460                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2461         }
2462
2463         if ($mem->isBlogAdmin($blogid))
2464             $newval = 0;
2465         else
2466             $newval = 1;
2467
2468         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2469         sql_query($query);
2470
2471         // only show manageteam if member did not change its own admin privileges
2472         if ($member->isBlogAdmin($blogid))
2473             $this->action_manageteam();
2474         else
2475             $this->action_overview(_MSG_ADMINCHANGED);
2476     }
2477
2478     /**
2479      * @todo document this
2480      */
2481     function action_blogsettings() {
2482         global $member, $manager;
2483
2484         $blogid = intRequestVar('blogid');
2485
2486         // check if allowed
2487         $member->blogAdminRights($blogid) or $this->disallow();
2488
2489         $blog =& $manager->getBlog($blogid);
2490
2491         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2492         $this->pagehead($extrahead);
2493
2494         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2495         ?>
2496         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2497
2498         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2499
2500         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2501         <?php
2502             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2503             $aMemberNames = array();
2504             while ($o = sql_fetch_object($res))
2505                 array_push($aMemberNames, ENTITY::hsc($o->mname) . ' (' . ENTITY::hsc($o->mrealname). ')');
2506             echo implode(',', $aMemberNames);
2507         ?>
2508         </p>
2509
2510
2511
2512         <p>
2513         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2514         </p>
2515
2516         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2517
2518         <form method="post" action="index.php"><div>
2519
2520         <input type="hidden" name="action" value="blogsettingsupdate" />
2521         <?php $manager->addTicketHidden() ?>
2522         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2523         <table><tr>
2524             <td><?php echo _EBLOG_NAME?></td>
2525             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getName()) ?>" /></td>
2526         </tr><tr>
2527             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2528                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2529             </td>
2530             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  ENTITY::hsc($blog->getShortName()) ?>" /></td>
2531         </tr><tr>
2532             <td><?php echo _EBLOG_DESC?></td>
2533             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  ENTITY::hsc($blog->getDescription()) ?>" /></td>
2534         </tr><tr>
2535             <td><?php echo _EBLOG_URL?></td>
2536             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($blog->getURL()) ?>" /></td>
2537         </tr><tr>
2538             <td><?php echo _EBLOG_DEFSKIN?>
2539                 <?php help('blogdefaultskin'); ?>
2540             </td>
2541             <td>
2542                 <?php
2543                     $query =  'SELECT sdname as text, sdnumber as value'
2544                            . ' FROM '.sql_table('skin_desc');
2545                     $template['name'] = 'defskin';
2546                     $template['selected'] = $blog->getDefaultSkin();
2547                     $template['tabindex'] = 50;
2548                     showlist($query,'select',$template);
2549                 ?>
2550
2551             </td>
2552         </tr><tr>
2553             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2554             </td>
2555             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2556         </tr><tr>
2557             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2558             </td>
2559             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2560         </tr><tr>
2561             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2562             </td>
2563             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2564         </tr><tr>
2565             <td><?php echo _EBLOG_ANONYMOUS?>
2566             </td>
2567             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2568         </tr><tr>
2569     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2570          </td>
2571          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2572       </tr><tr>
2573             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2574             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  ENTITY::hsc($blog->getNotifyAddress()); ?>" /></td>
2575         </tr><tr>
2576             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2577             <td>
2578                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2579                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2580                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2581                 <br />
2582                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2583                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2584                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2585                 <br />
2586                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2587                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2588                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2589             </td>
2590         </tr><tr>
2591             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2592             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  ENTITY::hsc($blog->getMaxComments()); ?>" /></td>
2593         </tr><tr>
2594             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2595             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getUpdateFile()) ?>" /></td>
2596         </tr><tr>
2597             <td><?php echo _EBLOG_DEFCAT?></td>
2598             <td>
2599                 <?php
2600                     $query =  'SELECT cname as text, catid as value'
2601                            . ' FROM '.sql_table('category')
2602                            . ' WHERE cblog=' . $blog->getID();
2603                     $template['name'] = 'defcat';
2604                     $template['selected'] = $blog->getDefaultCategory();
2605                     $template['tabindex'] = 110;
2606                     showlist($query,'select',$template);
2607                 ?>
2608             </td>
2609         </tr><tr>
2610             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2611                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2612                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2613                 </td>
2614             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  ENTITY::hsc($blog->getTimeOffset()); ?>" /></td>
2615         </tr><tr>
2616             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2617             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2618         </tr>
2619         <?php
2620             // plugin options
2621             $this->_insertPluginOptions('blog',$blogid);
2622         ?>
2623         <tr>
2624             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2625         </tr><tr>
2626             <td><?php echo _EBLOG_CHANGE?></td>
2627             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2628         </tr></table>
2629
2630         </div></form>
2631
2632         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2633
2634
2635         <?php
2636         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2637         $template['content'] = 'categorylist';
2638         $template['tabindex'] = 200;
2639
2640         $manager->loadClass("ENCAPSULATE");
2641         $batch = new BATCH('category');
2642         $batch->showlist($query,'table',$template);
2643
2644         ?>
2645
2646
2647         <form action="index.php" method="post"><div>
2648         <input name="action" value="categorynew" type="hidden" />
2649         <?php $manager->addTicketHidden() ?>
2650         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2651
2652         <table><tr>
2653             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2654         </tr><tr>
2655             <td><?php echo _EBLOG_CAT_NAME?></td>
2656             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2657         </tr><tr>
2658             <td><?php echo _EBLOG_CAT_DESC?></td>
2659             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2660         </tr><tr>
2661             <td><?php echo _EBLOG_CAT_CREATE?></td>
2662             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2663         </tr></table>
2664
2665         </div></form>
2666
2667         <?php
2668
2669             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2670
2671             $manager->notify(
2672                 'BlogSettingsFormExtras',
2673                 array(
2674                     'blog' => &$blog
2675                 )
2676             );
2677
2678         $this->pagefoot();
2679     }
2680
2681     /**
2682      * @todo document this
2683      */
2684     function action_categorynew() {
2685         global $member, $manager;
2686
2687         $blogid = intRequestVar('blogid');
2688
2689         $member->blogAdminRights($blogid) or $this->disallow();
2690
2691         $cname = postVar('cname');
2692         $cdesc = postVar('cdesc');
2693
2694         if (!isValidCategoryName($cname))
2695             $this->error(_ERROR_BADCATEGORYNAME);
2696
2697         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2698         $res = sql_query($query);
2699         if (sql_num_rows($res) > 0)
2700             $this->error(_ERROR_DUPCATEGORYNAME);
2701
2702         $blog       =& $manager->getBlog($blogid);
2703         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2704
2705         $this->action_blogsettings();
2706     }
2707
2708     /**
2709      * @todo document this
2710      */
2711     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2712         global $member, $manager;
2713
2714         if ($blogid == '')
2715             $blogid = intGetVar('blogid');
2716         else
2717             $blogid = intval($blogid);
2718         if ($catid == '')
2719             $catid = intGetVar('catid');
2720         else
2721             $catid = intval($catid);
2722
2723         $member->blogAdminRights($blogid) or $this->disallow();
2724
2725         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2726         $obj = sql_fetch_object($res);
2727
2728         $cname = $obj->cname;
2729         $cdesc = $obj->cdesc;
2730
2731         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2732         $this->pagehead($extrahead);
2733
2734         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2735
2736         ?>
2737         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo ENTITY::hsc($cname)?>'</h2>
2738         <form method='post' action='index.php'><div>
2739         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2740         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2741         <input name="desturl" type="hidden" value="<?php echo ENTITY::hsc($desturl) ?>" />
2742         <input name="action" type="hidden" value="categoryupdate" />
2743         <?php $manager->addTicketHidden(); ?>
2744
2745         <table><tr>
2746             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2747         </tr><tr>
2748             <td><?php echo _EBLOG_CAT_NAME?></td>
2749             <td><input type="text" name="cname" value="<?php echo ENTITY::hsc($cname)?>" size="40" maxlength="40" /></td>
2750         </tr><tr>
2751             <td><?php echo _EBLOG_CAT_DESC?></td>
2752             <td><input type="text" name="cdesc" value="<?php echo ENTITY::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2753         </tr>
2754         <?php
2755             // insert plugin options
2756             $this->_insertPluginOptions('category',$catid);
2757         ?>
2758         <tr>
2759             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2760         </tr><tr>
2761             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2762             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2763         </tr></table>
2764
2765         </div></form>
2766         <?php
2767         $this->pagefoot();
2768     }
2769
2770     /**
2771      * @todo document this
2772      */
2773     function action_categoryupdate() {
2774         global $member, $manager;
2775
2776         $blogid = intPostVar('blogid');
2777         $catid = intPostVar('catid');
2778         $cname = postVar('cname');
2779         $cdesc = postVar('cdesc');
2780         $desturl = postVar('desturl');
2781
2782         $member->blogAdminRights($blogid) or $this->disallow();
2783
2784         if (!isValidCategoryName($cname))
2785             $this->error(_ERROR_BADCATEGORYNAME);
2786
2787         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2788         $res = sql_query($query);
2789         if (sql_num_rows($res) > 0)
2790             $this->error(_ERROR_DUPCATEGORYNAME);
2791
2792         $query =  'UPDATE '.sql_table('category').' SET'
2793                . " cname='" . sql_real_escape_string($cname) . "',"
2794                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2795                . " WHERE catid=" . $catid;
2796
2797         sql_query($query);
2798
2799         // store plugin options
2800         $aOptions = requestArray('plugoption');
2801         NucleusPlugin::apply_plugin_options($aOptions);
2802         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2803
2804
2805         if ($desturl) {
2806             redirect($desturl);
2807             exit;
2808         } else {
2809             $this->action_blogsettings();
2810         }
2811     }
2812
2813     /**
2814      * @todo document this
2815      */
2816     function action_categorydelete() {
2817         global $member, $manager;
2818
2819         $blogid = intRequestVar('blogid');
2820         $catid = intRequestVar('catid');
2821
2822         $member->blogAdminRights($blogid) or $this->disallow();
2823
2824         $blog =& $manager->getBlog($blogid);
2825
2826         // check if the category is valid
2827         if (!$blog->isValidCategory($catid))
2828             $this->error(_ERROR_NOSUCHCATEGORY);
2829
2830         // don't allow deletion of default category
2831         if ($blog->getDefaultCategory() == $catid)
2832             $this->error(_ERROR_DELETEDEFCATEGORY);
2833
2834         // check if catid is the only category left for blogid
2835         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2836         $res = sql_query($query);
2837         if (sql_num_rows($res) == 1)
2838             $this->error(_ERROR_DELETELASTCATEGORY);
2839
2840
2841         $this->pagehead();
2842         ?>
2843             <h2><?php echo _DELETE_CONFIRM?></h2>
2844
2845             <div>
2846             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  ENTITY::hsc($blog->getCategoryName($catid))?></b>
2847             </div>
2848
2849             <form method="post" action="index.php"><div>
2850             <input type="hidden" name="action" value="categorydeleteconfirm" />
2851             <?php $manager->addTicketHidden() ?>
2852             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2853             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2854             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2855             </div></form>
2856         <?php
2857         $this->pagefoot();
2858     }
2859
2860     /**
2861      * @todo document this
2862      */
2863     function action_categorydeleteconfirm() {
2864         global $member, $manager;
2865
2866         $blogid = intRequestVar('blogid');
2867         $catid = intRequestVar('catid');
2868
2869         $member->blogAdminRights($blogid) or $this->disallow();
2870
2871         $error = $this->deleteOneCategory($catid);
2872         if ($error)
2873             $this->error($error);
2874
2875         $this->action_blogsettings();
2876     }
2877
2878     /**
2879      * @todo document this
2880      */
2881     function deleteOneCategory($catid) {
2882         global $manager, $member;
2883
2884         $catid = intval($catid);
2885
2886         $blogid = getBlogIDFromCatID($catid);
2887
2888         if (!$member->blogAdminRights($blogid))
2889             return ERROR_DISALLOWED;
2890
2891         // get blog
2892         $blog =& $manager->getBlog($blogid);
2893
2894         // check if the category is valid
2895         if (!$blog || !$blog->isValidCategory($catid))
2896             return _ERROR_NOSUCHCATEGORY;
2897
2898         $destcatid = $blog->getDefaultCategory();
2899
2900         // don't allow deletion of default category
2901         if ($blog->getDefaultCategory() == $catid)
2902             return _ERROR_DELETEDEFCATEGORY;
2903
2904         // check if catid is the only category left for blogid
2905         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2906         $res = sql_query($query);
2907         if (sql_num_rows($res) == 1)
2908             return _ERROR_DELETELASTCATEGORY;
2909
2910         $manager->notify('PreDeleteCategory', array('catid' => $catid));
2911
2912         // change category for all items to the default category
2913         $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2914         sql_query($query);
2915
2916         // delete all associated plugin options
2917         NucleusPlugin::_deleteOptionValues('category', $catid);
2918
2919         // delete category
2920         $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2921         sql_query($query);
2922
2923         $manager->notify('PostDeleteCategory', array('catid' => $catid));
2924
2925     }
2926
2927     /**
2928      * @todo document this
2929      */
2930     function moveOneCategory($catid, $destblogid) {
2931         global $manager, $member;
2932
2933         $catid = intval($catid);
2934         $destblogid = intval($destblogid);
2935
2936         $blogid = getBlogIDFromCatID($catid);
2937
2938         // mover should have admin rights on both blogs
2939         if (!$member->blogAdminRights($blogid))
2940             return _ERROR_DISALLOWED;
2941         if (!$member->blogAdminRights($destblogid))
2942             return _ERROR_DISALLOWED;
2943
2944         // cannot move to self
2945         if ($blogid == $destblogid)
2946             return _ERROR_MOVETOSELF;
2947
2948         // get blogs
2949         $blog =& $manager->getBlog($blogid);
2950         $destblog =& $manager->getBlog($destblogid);
2951
2952         // check if the category is valid
2953         if (!$blog || !$blog->isValidCategory($catid))
2954             return _ERROR_NOSUCHCATEGORY;
2955
2956         // don't allow default category to be moved
2957         if ($blog->getDefaultCategory() == $catid)
2958             return _ERROR_MOVEDEFCATEGORY;
2959
2960         $manager->notify(
2961             'PreMoveCategory',
2962             array(
2963                 'catid' => &$catid,
2964                 'sourceblog' => &$blog,
2965                 'destblog' => &$destblog
2966             )
2967         );
2968
2969         // update comments table (cblog)
2970         $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2971         $items = sql_query($query);
2972         while ($oItem = sql_fetch_object($items)) {
2973             sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2974         }
2975
2976         // update items (iblog)
2977         $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2978         sql_query($query);
2979
2980         // move category
2981         $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2982         sql_query($query);
2983
2984         $manager->notify(
2985             'PostMoveCategory',
2986             array(
2987                 'catid' => &$catid,
2988                 'sourceblog' => &$blog,
2989                 'destblog' => $destblog
2990             )
2991         );
2992
2993     }
2994
2995         /**
2996          * ADMIN::action_blogsettingsupdate
2997          * Updating blog settings
2998          *
2999          * @param       Void
3000          * @return      Void
3001          */
3002         function action_blogsettingsupdate()
3003         {
3004                 global $member, $manager;
3005
3006                 $blogid = intRequestVar('blogid');
3007
3008                 $member->blogAdminRights($blogid) or $this->disallow();
3009
3010                 $blog =& $manager->getBlog($blogid);
3011
3012                 $notify_address = trim(postVar('notify'));
3013                 $shortname              = trim(postVar('shortname'));
3014                 $updatefile     = trim(postVar('update'));
3015
3016                 $notifyComment  = intPostVar('notifyComment');
3017                 $notifyVote             = intPostVar('notifyVote');
3018                 $notifyNewItem  = intPostVar('notifyNewItem');
3019
3020                 if ( $notifyComment == 0 )
3021                 {
3022                         $notifyComment = 1;
3023                 }
3024                 if ( $notifyVote == 0 )
3025                 {
3026                         $notifyVote = 1;
3027                 }
3028                 if ( $notifyNewItem == 0 )
3029                 {
3030                         $notifyNewItem = 1;
3031                 }
3032                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3033
3034                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
3035                 {
3036                         $this->error(_ERROR_BADNOTIFY);
3037                 }
3038
3039                 if ( !isValidShortName($shortname) )
3040                 {
3041                         $this->error(_ERROR_BADSHORTBLOGNAME);
3042                 }
3043
3044                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
3045                 {
3046                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3047                 }
3048                 // check if update file is writable
3049                 if ( $updatefile && !is_writeable($updatefile) )
3050                 {
3051                         $this->error(_ERROR_UPDATEFILE);
3052                 }
3053
3054                 $blog->setName(trim(postVar('name')));
3055                 $blog->setShortName($shortname);
3056                 $blog->setNotifyAddress($notify_address);
3057                 $blog->setNotifyType($notifyType);
3058                 $blog->setMaxComments(postVar('maxcomments'));
3059                 $blog->setCommentsEnabled(postVar('comments'));
3060                 $blog->setTimeOffset(postVar('timeoffset'));
3061                 $blog->setUpdateFile($updatefile);
3062                 $blog->setURL(trim(postVar('url')));
3063                 $blog->setDefaultSkin(intPostVar('defskin'));
3064                 $blog->setDescription(trim(postVar('desc')));
3065                 $blog->setPublic(postVar('public'));
3066                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3067                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3068                 $blog->setDefaultCategory(intPostVar('defcat'));
3069                 $blog->setSearchable(intPostVar('searchable'));
3070                 $blog->setEmailRequired(intPostVar('reqemail'));
3071                 $blog->writeSettings();
3072
3073                 // store plugin options
3074                 $aOptions = requestArray('plugoption');
3075                 NucleusPlugin::apply_plugin_options($aOptions);
3076                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3077
3078                 $this->action_overview(_MSG_SETTINGSCHANGED);
3079                 return;
3080         }
3081
3082     /**
3083      * @todo document this
3084      */
3085     function action_deleteblog() {
3086         global $member, $CONF, $manager;
3087
3088         $blogid = intRequestVar('blogid');
3089
3090         $member->blogAdminRights($blogid) or $this->disallow();
3091
3092         // check if blog is default blog
3093         if ($CONF['DefaultBlog'] == $blogid)
3094             $this->error(_ERROR_DELDEFBLOG);
3095
3096         $blog =& $manager->getBlog($blogid);
3097
3098         $this->pagehead();
3099         ?>
3100             <h2><?php echo _DELETE_CONFIRM?></h2>
3101
3102             <p><?php echo _WARNINGTXT_BLOGDEL?>
3103             </p>
3104
3105             <div>
3106             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  ENTITY::hsc($blog->getName())?></b>
3107             </div>
3108
3109             <form method="post" action="index.php"><div>
3110             <input type="hidden" name="action" value="deleteblogconfirm" />
3111             <?php $manager->addTicketHidden() ?>
3112             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3113             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3114             </div></form>
3115         <?php
3116         $this->pagefoot();
3117     }
3118
3119     /**
3120      * @todo document this
3121      */
3122     function action_deleteblogconfirm() {
3123         global $member, $CONF, $manager;
3124
3125         $blogid = intRequestVar('blogid');
3126
3127         $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3128
3129         $member->blogAdminRights($blogid) or $this->disallow();
3130
3131         // check if blog is default blog
3132         if ($CONF['DefaultBlog'] == $blogid)
3133             $this->error(_ERROR_DELDEFBLOG);
3134
3135         // delete all comments
3136         $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3137         sql_query($query);
3138
3139         // delete all items
3140         $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3141         sql_query($query);
3142
3143         // delete all team members
3144         $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3145         sql_query($query);
3146
3147         // delete all bans
3148         $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3149         sql_query($query);
3150
3151         // delete all categories
3152         $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3153         sql_query($query);
3154
3155         // delete all associated plugin options
3156         NucleusPlugin::_deleteOptionValues('blog', $blogid);
3157
3158         // delete the blog itself
3159         $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3160         sql_query($query);
3161
3162         $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3163
3164         $this->action_overview(_DELETED_BLOG);
3165     }
3166
3167     /**
3168      * @todo document this
3169      */
3170     function action_memberdelete() {
3171         global $member, $manager;
3172
3173         $memberid = intRequestVar('memberid');
3174
3175         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3176
3177         $mem = MEMBER::createFromID($memberid);
3178
3179         $this->pagehead();
3180         ?>
3181             <h2><?php echo _DELETE_CONFIRM?></h2>
3182
3183             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo ENTITY::hsc($mem->getDisplayName()) ?></b>
3184             </p>
3185
3186             <p>
3187             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3188             </p>
3189
3190             <form method="post" action="index.php"><div>
3191             <input type="hidden" name="action" value="memberdeleteconfirm" />
3192             <?php $manager->addTicketHidden() ?>
3193             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3194             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3195             </div></form>
3196         <?php
3197         $this->pagefoot();
3198     }
3199
3200     /**
3201      * @todo document this
3202      */
3203     function action_memberdeleteconfirm() {
3204         global $member;
3205
3206         $memberid = intRequestVar('memberid');
3207
3208         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3209
3210         $error = $this->deleteOneMember($memberid);
3211         if ($error)
3212             $this->error($error);
3213
3214         if ($member->isAdmin())
3215             $this->action_usermanagement();
3216         else
3217             $this->action_overview(_DELETED_MEMBER);
3218     }
3219
3220     /**
3221      * @static
3222      * @todo document this
3223      */
3224     function deleteOneMember($memberid) {
3225         global $manager;
3226
3227         $memberid = intval($memberid);
3228         $mem = MEMBER::createFromID($memberid);
3229
3230         if (!$mem->canBeDeleted())
3231             return _ERROR_DELETEMEMBER;
3232
3233         $manager->notify('PreDeleteMember', array('member' => &$mem));
3234
3235         /* unlink comments from memberid */
3236         if ($memberid) {
3237             $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. sql_real_escape_string($mem->getDisplayName())
3238                         .'" WHERE cmember='.$memberid;
3239             sql_query($query);
3240         }
3241
3242         $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3243         sql_query($query);
3244
3245         $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3246         sql_query($query);
3247
3248         $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3249         sql_query($query);
3250
3251         // delete all associated plugin options
3252         NucleusPlugin::_deleteOptionValues('member', $memberid);
3253
3254         $manager->notify('PostDeleteMember', array('member' => &$mem));
3255
3256         return '';
3257     }
3258
3259     /**
3260      * @todo document this
3261      */
3262     function action_createnewlog() {
3263         global $member, $CONF, $manager;
3264
3265         // Only Super-Admins can do this
3266         $member->isAdmin() or $this->disallow();
3267
3268         $this->pagehead();
3269
3270         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3271         ?>
3272         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3273
3274         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3275
3276         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3277
3278         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3279
3280         <ol>
3281             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3282             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3283         </ol>
3284
3285         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3286
3287         <p>
3288         <?php echo _EBLOG_CREATE_TEXT?>
3289         </p>
3290
3291         <form method="post" action="index.php"><div>
3292
3293         <input type="hidden" name="action" value="addnewlog" />
3294         <?php $manager->addTicketHidden() ?>
3295
3296
3297         <table><tr>
3298             <td><?php echo _EBLOG_NAME?></td>
3299             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3300         </tr><tr>
3301             <td><?php echo _EBLOG_SHORTNAME?>
3302                 <?php help('shortblogname'); ?>
3303             </td>
3304             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3305         </tr><tr>
3306             <td><?php echo _EBLOG_DESC?></td>
3307             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3308         </tr><tr>
3309             <td><?php echo _EBLOG_DEFSKIN?>
3310                 <?php help('blogdefaultskin'); ?>
3311             </td>
3312             <td>
3313                 <?php
3314                     $query =  'SELECT sdname as text, sdnumber as value'
3315                            . ' FROM '.sql_table('skin_desc');
3316                     $template['name'] = 'defskin';
3317                     $template['tabindex'] = 50;
3318                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3319                     showlist($query,'select',$template);
3320                 ?>
3321             </td>
3322         </tr><tr>
3323             <td><?php echo _EBLOG_OFFSET?>
3324                 <?php help('blogtimeoffset'); ?>
3325                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3326             </td>
3327             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3328         </tr><tr>
3329             <td><?php echo _EBLOG_ADMIN?>
3330                 <?php help('teamadmin'); ?>
3331             </td>
3332             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3333         </tr><tr>
3334             <td><?php echo _EBLOG_CREATE?></td>
3335             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3336         </tr></table>
3337
3338         </div></form>
3339         <?php
3340         $this->pagefoot();
3341     }
3342
3343     /**
3344      * @todo document this
3345      */
3346     function action_addnewlog() {
3347         global $member, $manager, $CONF;
3348
3349         // Only Super-Admins can do this
3350         $member->isAdmin() or $this->disallow();
3351
3352         $bname          = trim(postVar('name'));
3353         $bshortname     = trim(postVar('shortname'));
3354         $btimeoffset    = postVar('timeoffset');
3355         $bdesc          = trim(postVar('desc'));
3356         $bdefskin       = postVar('defskin');
3357
3358         if (!isValidShortName($bshortname))
3359             $this->error(_ERROR_BADSHORTBLOGNAME);
3360
3361         if ($manager->existsBlog($bshortname))
3362             $this->error(_ERROR_DUPSHORTBLOGNAME);
3363
3364         $manager->notify(
3365             'PreAddBlog',
3366             array(
3367                 'name' => &$bname,
3368                 'shortname' => &$bshortname,
3369                 'timeoffset' => &$btimeoffset,
3370                 'description' => &$bdesc,
3371                 'defaultskin' => &$bdefskin
3372             )
3373         );
3374
3375
3376         // add slashes for sql queries
3377         $bname =        sql_real_escape_string($bname);
3378         $bshortname =   sql_real_escape_string($bshortname);
3379         $btimeoffset =  sql_real_escape_string($btimeoffset);
3380         $bdesc =        sql_real_escape_string($bdesc);
3381         $bdefskin =     sql_real_escape_string($bdefskin);
3382
3383         // create blog
3384         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3385         sql_query($query);
3386         $blogid = sql_insert_id();
3387         $blog   =& $manager->getBlog($blogid);
3388
3389         // create new category
3390         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3391         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3392         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3393         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3394 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3395 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3396         $catid = sql_insert_id();
3397
3398         // set as default category
3399         $blog->setDefaultCategory($catid);
3400         $blog->writeSettings();
3401
3402         // create team member
3403         $memberid = $member->getID();
3404         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3405         sql_query($query);
3406
3407         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3408         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3409
3410         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3411         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3412
3413
3414
3415         $manager->notify(
3416             'PostAddBlog',
3417             array(
3418                 'blog' => &$blog
3419             )
3420         );
3421
3422         $manager->notify(
3423             'PostAddCategory',
3424             array(
3425                 'blog' => &$blog,
3426                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3427                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3428                 'catid' => $catid
3429             )
3430         );
3431
3432         $this->pagehead();
3433         ?>
3434         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3435
3436         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, ENTITY::hsc($bname)) ?></p>
3437
3438         <ol>
3439             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, ENTITY::hsc($bshortname)) ?></a></li>
3440             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3441         </ol>
3442
3443         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, ENTITY::hsc($bshortname)) ?></a></h3>
3444
3445         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, ENTITY::hsc($bshortname)) ?></p>
3446 <pre><code>&lt;?php
3447
3448 $CONF['Self'] = '<b><?php echo ENTITY::hsc($bshortname)?>.php</b>';
3449
3450 include('<i>./config.php</i>');
3451
3452 selectBlog('<b><?php echo ENTITY::hsc($bshortname)?></b>');
3453 selector();
3454
3455 ?&gt;</code></pre>
3456
3457         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3458
3459         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3460
3461         <form action="index.php" method="post"><div>
3462             <input type="hidden" name="action" value="addnewlog2" />
3463             <?php $manager->addTicketHidden() ?>
3464             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3465             <table><tr>
3466                 <td><?php echo _EBLOG_URL?></td>
3467                 <td><input name="url" maxlength="100" size="40" value="<?php echo ENTITY::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3468             </tr><tr>
3469                 <td><?php echo _EBLOG_CREATE?></td>
3470                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3471             </tr></table>
3472         </div></form>
3473
3474         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3475
3476         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3477
3478         <form action="index.php" method="post"><div>
3479             <input type="hidden" name="action" value="addnewlog2" />
3480             <?php $manager->addTicketHidden() ?>
3481             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3482             <table><tr>
3483                 <td><?php echo _EBLOG_URL?></td>
3484                 <td><input name="url" maxlength="100" size="40" /></td>
3485             </tr><tr>
3486                 <td><?php echo _EBLOG_CREATE?></td>
3487                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3488             </tr></table>
3489         </div></form>
3490
3491         <?php       $this->pagefoot();
3492
3493     }
3494
3495     /**
3496      * @todo document this
3497      */
3498     function action_addnewlog2() {
3499         global $member, $manager;
3500
3501         $member->blogAdminRights($blogid) or $this->disallow();
3502
3503         $burl   = requestVar('url');
3504         $blogid = intRequestVar('blogid');
3505
3506         $blog =& $manager->getBlog($blogid);
3507         $blog->setURL(trim($burl));
3508         $blog->writeSettings();
3509
3510         $this->action_overview(_MSG_NEWBLOG);
3511     }
3512
3513     /**
3514      * @todo document this
3515      */
3516     function action_skinieoverview() {
3517         global $member, $DIR_LIBS, $manager;
3518
3519         $member->isAdmin() or $this->disallow();
3520
3521         // load skinie class
3522         include_once($DIR_LIBS . 'skinie.php');
3523
3524         $this->pagehead();
3525
3526         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3527
3528     ?>
3529         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3530
3531                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3532                 <?php                   global $DIR_SKINS;
3533
3534                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3535
3536                     if (sizeof($candidates) > 0) {
3537                         ?>
3538                             <form method="post" action="index.php"><div>
3539                                 <input type="hidden" name="action" value="skinieimport" />
3540                                 <?php $manager->addTicketHidden() ?>
3541                                 <input type="hidden" name="mode" value="file" />
3542                                 <select name="skinfile" id="skinie_import_local">
3543                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3544                                         $html = ENTITY::hsc($skinfile);
3545                                         echo '<option value="',$html,'">',$skinname,'</option>';
3546                                     }
3547                                 ?>
3548                                 </select>
3549                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3550                             </div></form>
3551                         <?php                   } else {
3552                         echo _SKINIE_NOCANDIDATES;
3553                     }
3554                 ?>
3555                 </p>
3556
3557                 <p><em><?php echo _OR?></em></p>
3558
3559                 <form method="post" action="index.php"><p>
3560                     <?php $manager->addTicketHidden() ?>
3561                     <input type="hidden" name="action" value="skinieimport" />
3562                     <input type="hidden" name="mode" value="url" />
3563                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3564                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3565                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3566                 </p></form>
3567
3568
3569         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3570         <form method="post" action="index.php"><div>
3571             <input type="hidden" name="action" value="skinieexport" />
3572             <?php $manager->addTicketHidden() ?>
3573
3574             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3575
3576             <table><tr>
3577                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3578             </tr><tr>
3579     <?php       // show list of skins
3580         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3581         while ($skinObj = sql_fetch_object($res)) {
3582             $id = 'skinexp' . $skinObj->sdnumber;
3583             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3584             echo '<label for="',$id,'">',ENTITY::hsc($skinObj->sdname),'</label></td>';
3585             echo '<td>',ENTITY::hsc($skinObj->sddesc),'</td>';
3586             echo '</tr><tr>';
3587         }
3588
3589         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3590
3591         // show list of templates
3592         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3593         while ($templateObj = sql_fetch_object($res)) {
3594             $id = 'templateexp' . $templateObj->tdnumber;
3595             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3596             echo '<label for="',$id,'">',ENTITY::hsc($templateObj->tdname),'</label></td>';
3597             echo '<td>',ENTITY::hsc($templateObj->tddesc),'</td>';
3598             echo '</tr><tr>';
3599         }
3600
3601     ?>
3602                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3603             </tr><tr>
3604                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3605             </tr><tr>
3606                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3607             </tr><tr>
3608                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3609             </tr></table>
3610         </div></form>
3611
3612     <?php
3613         $this->pagefoot();
3614
3615     }
3616
3617     /**
3618      * @todo document this
3619      */
3620     function action_skinieimport() {
3621         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3622
3623         $member->isAdmin() or $this->disallow();
3624
3625         // load skinie class
3626         include_once($DIR_LIBS . 'skinie.php');
3627
3628         $skinFileRaw= postVar('skinfile');
3629         $mode       = postVar('mode');
3630
3631         $importer = new SKINIMPORT();
3632
3633         // get full filename
3634         if ($mode == 'file')
3635         {
3636             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3637
3638             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3639             if (!file_exists($skinFile))
3640                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3641         } else {
3642             $skinFile = $skinFileRaw;
3643         }
3644
3645         // read only metadata
3646         $error = $importer->readFile($skinFile, 1);
3647
3648         // clashes
3649         $skinNameClashes = $importer->checkSkinNameClashes();
3650         $templateNameClashes = $importer->checkTemplateNameClashes();
3651         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3652
3653         if ($error) $this->error($error);
3654
3655         $this->pagehead();
3656
3657         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3658         ?>
3659         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3660
3661         <ul>
3662             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3663             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3664             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3665             <?php
3666                 if ($hasNameClashes)
3667                 {
3668             ?>
3669             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3670             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3671             <?php
3672                 } // if (hasNameClashes)
3673             ?>
3674         </ul>
3675
3676         <form method="post" action="index.php"><div>
3677             <input type="hidden" name="action" value="skiniedoimport" />
3678             <?php $manager->addTicketHidden() ?>
3679             <input type="hidden" name="skinfile" value="<?php echo ENTITY::hsc(postVar('skinfile'))?>" />
3680             <input type="hidden" name="mode" value="<?php echo ENTITY::hsc($mode)?>" />
3681             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3682             <?php
3683                 if ($hasNameClashes)
3684                 {
3685             ?>
3686             <br />
3687             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3688             <?php
3689                 } // if (hasNameClashes)
3690             ?>
3691         </div></form>
3692
3693
3694         <?php
3695         $this->pagefoot();
3696     }
3697
3698     /**
3699      * @todo document this
3700      */
3701     function action_skiniedoimport() {
3702         global $member, $DIR_LIBS, $DIR_SKINS;
3703
3704         $member->isAdmin() or $this->disallow();
3705
3706         // load skinie class
3707         include_once($DIR_LIBS . 'skinie.php');
3708
3709         $skinFileRaw= postVar('skinfile');
3710         $mode       = postVar('mode');
3711
3712         $allowOverwrite = intPostVar('overwrite');
3713
3714         // get full filename
3715         if ($mode == 'file')
3716         {
3717             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3718
3719             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3720             if (!file_exists($skinFile))
3721                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3722
3723         } else {
3724             $skinFile = $skinFileRaw;
3725         }
3726
3727         $importer = new SKINIMPORT();
3728
3729         $error = $importer->readFile($skinFile);
3730
3731         if ($error)
3732             $this->error($error);
3733
3734         $error = $importer->writeToDatabase($allowOverwrite);
3735
3736         if ($error)
3737             $this->error($error);
3738
3739         $this->pagehead();
3740
3741         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3742     ?>
3743         <h2><?php echo _SKINIE_DONE?></h2>
3744
3745         <ul>
3746             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3747             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3748             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3749         </ul>
3750
3751     <?php       $this->pagefoot();
3752
3753     }
3754
3755     /**
3756      * @todo document this
3757      */
3758     function action_skinieexport() {
3759         global $member, $DIR_LIBS;
3760
3761         $member->isAdmin() or $this->disallow();
3762
3763         // load skinie class
3764         include_once($DIR_LIBS . 'skinie.php');
3765
3766         $aSkins = requestIntArray('skin');
3767         $aTemplates = requestIntArray('template');
3768
3769         if (!is_array($aTemplates)) $aTemplates = array();
3770         if (!is_array($aSkins)) $aSkins = array();
3771
3772         $skinList = array_keys($aSkins);
3773         $templateList = array_keys($aTemplates);
3774
3775         $info = postVar('info');
3776
3777         $exporter = new SKINEXPORT();
3778         foreach ($skinList as $skinId) {
3779             $exporter->addSkin($skinId);
3780         }
3781         foreach ($templateList as $templateId) {
3782             $exporter->addTemplate($templateId);
3783         }
3784         $exporter->setInfo($info);
3785
3786         $exporter->export();
3787     }
3788
3789     /**
3790      * @todo document this
3791      */
3792     function action_templateoverview() {
3793         global $member, $manager;
3794
3795         $member->isAdmin() or $this->disallow();
3796
3797         $this->pagehead();
3798
3799         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3800
3801         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3802         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3803
3804         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3805         $template['content'] = 'templatelist';
3806         $template['tabindex'] = 10;
3807         showlist($query,'table',$template);
3808
3809         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3810
3811         ?>
3812         <form method="post" action="index.php"><div>
3813
3814         <input name="action" value="templatenew" type="hidden" />
3815         <?php $manager->addTicketHidden() ?>
3816         <table><tr>
3817             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3818             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3819         </tr><tr>
3820             <td><?php echo _TEMPLATE_DESC?></td>
3821             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3822         </tr><tr>
3823             <td><?php echo _TEMPLATE_CREATE?></td>
3824             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3825         </tr></table>
3826
3827         </div></form>
3828
3829         <?php
3830         $this->pagefoot();
3831     }
3832
3833     /**
3834      * @todo document this
3835      */
3836     function action_templateedit($msg = '') {
3837         global $member, $manager;
3838
3839         $templateid = intRequestVar('templateid');
3840
3841         $member->isAdmin() or $this->disallow();
3842
3843         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3844         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3845
3846         $this->pagehead($extrahead);
3847
3848         $templatename = TEMPLATE::getNameFromId($templateid);
3849         $templatedescription = TEMPLATE::getDesc($templateid);
3850         $template =& $manager->getTemplate($templatename);
3851
3852         ?>
3853         <p>
3854         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3855         </p>
3856
3857         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  ENTITY::hsc($templatename); ?>'</h2>
3858
3859         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3860         ?>
3861
3862         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3863
3864         <form method="post" action="index.php">
3865         <div>
3866
3867         <input type="hidden" name="action" value="templateupdate" />
3868         <?php $manager->addTicketHidden() ?>
3869         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3870
3871         <table><tr>
3872             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3873         </tr><tr>
3874             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3875             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  ENTITY::hsc($templatename) ?>" /></td>
3876         </tr><tr>
3877             <td><?php echo _TEMPLATE_DESC?></td>
3878             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  ENTITY::hsc($templatedescription) ?>" /></td>
3879         </tr><tr>
3880             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3881         </tr><tr>
3882             <td><?php echo _TEMPLATE_UPDATE?></td>
3883             <td>
3884                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3885                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3886             </td>
3887         </tr><tr>
3888             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3889 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3890     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3891     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3892     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3893     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3894     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3895 ?>
3896         </tr><tr>
3897             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3898 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3899     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3900     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3901     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3902     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3903     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3904     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3905 ?>
3906         </tr><tr>
3907             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3908 <?php
3909     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3910 ?>
3911         </tr><tr>
3912             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3913 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3914 ?>
3915         </tr><tr>
3916             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3917 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3918     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3919     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3920 ?>
3921         </tr><tr>
3922             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3923 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3924     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3925     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3926 ?>
3927         </tr><tr>
3928             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3929 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3930     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3931     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3932 ?>
3933         </tr><tr>
3934             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3935 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3936     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3937     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3938     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3939     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3940 ?>
3941         </tr><tr>
3942             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3943 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3944     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3945     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3946 ?>
3947         </tr><tr>
3948             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3949 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3950     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3951 ?>
3952         </tr><tr>
3953             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3954 <?php
3955         $tab = 600;
3956         $pluginfields = array();
3957         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3958
3959         foreach ($pluginfields as $pfkey=>$pfvalue) {
3960             echo "</tr><tr>\n";
3961             echo '<th colspan="2">' . ENTITY::hen($pfkey) . "</th>\n";
3962             foreach ($pfvalue as $pffield=>$pfdesc) {
3963                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3964             }
3965         }
3966 ?>
3967         </tr><tr>
3968             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3969         </tr><tr>
3970             <td><?php echo _TEMPLATE_UPDATE?></td>
3971             <td>
3972                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3973                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3974             </td>
3975         </tr></table>
3976
3977         </div>
3978         </form>
3979         <?php
3980         $this->pagefoot();
3981     }
3982
3983     /**
3984      * @todo document this
3985      */
3986     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3987         static $count = 1;
3988         if (!isset($template[$name])) $template[$name] = '';
3989     ?>
3990         </tr><tr>
3991             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3992             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  ENTITY::hsc($template[$name]); ?></textarea></td>
3993     <?php       $count++;
3994     }
3995
3996     /**
3997      * @todo document this
3998      */
3999     function action_templateupdate() {
4000         global $member,$manager;
4001
4002         $templateid = intRequestVar('templateid');
4003
4004         $member->isAdmin() or $this->disallow();
4005
4006         $name = postVar('tname');
4007         $desc = postVar('tdesc');
4008
4009         if (!isValidTemplateName($name))
4010             $this->error(_ERROR_BADTEMPLATENAME);
4011
4012         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
4013             $this->error(_ERROR_DUPTEMPLATENAME);
4014
4015
4016         $name = sql_real_escape_string($name);
4017         $desc = sql_real_escape_string($desc);
4018
4019         // 1. Remove all template parts
4020         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4021         sql_query($query);
4022
4023         // 2. Update description
4024         $query =  'UPDATE '.sql_table('template_desc').' SET'
4025                . " tdname='" . $name . "',"
4026                . " tddesc='" . $desc . "'"
4027                . " WHERE tdnumber=" . $templateid;
4028         sql_query($query);
4029
4030         // 3. Add non-empty template parts
4031         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4032         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4033         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4034         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4035         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4036         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4037         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4038         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4039         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4040         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4041         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4042         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4043         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4044         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4045         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4046         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4047         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4048         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4049         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4050         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4051         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4052         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4053         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4054         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4055         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4056         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4057         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4058         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4059         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4060         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4061         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4062         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4063         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4064         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4065
4066         $pluginfields = array();
4067         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4068         foreach ($pluginfields as $pfkey=>$pfvalue) {
4069             foreach ($pfvalue as $pffield=>$pfdesc) {
4070                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4071             }
4072         }
4073
4074         // jump back to template edit
4075         $this->action_templateedit(_TEMPLATE_UPDATED);
4076
4077     }
4078
4079     /**
4080      * @todo document this
4081      */
4082     function addToTemplate($id, $partname, $content) {
4083         $partname = sql_real_escape_string($partname);
4084         $content = sql_real_escape_string($content);
4085
4086         $id = intval($id);
4087
4088         // don't add empty parts:
4089         if (!trim($content)) return -1;
4090
4091         $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
4092                . "VALUES ($id, '$partname', '$content')";
4093         sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4094         return sql_insert_id();
4095     }
4096
4097     /**
4098      * @todo document this
4099      */
4100     function action_templatedelete() {
4101         global $member, $manager;
4102
4103         $member->isAdmin() or $this->disallow();
4104
4105         $templateid = intRequestVar('templateid');
4106         // TODO: check if template can be deleted
4107
4108         $this->pagehead();
4109
4110         $name = TEMPLATE::getNameFromId($templateid);
4111         $desc = TEMPLATE::getDesc($templateid);
4112
4113         ?>
4114             <h2><?php echo _DELETE_CONFIRM?></h2>
4115
4116             <p>
4117             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo ENTITY::hsc($name)?></b> (<?php echo  ENTITY::hsc($desc) ?>)
4118             </p>
4119
4120             <form method="post" action="index.php"><div>
4121                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4122                 <?php $manager->addTicketHidden() ?>
4123                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4124                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4125             </div></form>
4126         <?php
4127         $this->pagefoot();
4128     }
4129
4130     /**
4131      * @todo document this
4132      */
4133     function action_templatedeleteconfirm() {
4134         global $member, $manager;
4135
4136         $templateid = intRequestVar('templateid');
4137
4138         $member->isAdmin() or $this->disallow();
4139
4140         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4141
4142         // 1. delete description
4143         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4144
4145         // 2. delete parts
4146         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4147
4148         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4149
4150         $this->action_templateoverview();
4151     }
4152
4153     /**
4154      * @todo document this
4155      */
4156     function action_templatenew() {
4157         global $member;
4158
4159         $member->isAdmin() or $this->disallow();
4160
4161         $name = postVar('name');
4162         $desc = postVar('desc');
4163
4164         if (!isValidTemplateName($name))
4165             $this->error(_ERROR_BADTEMPLATENAME);
4166
4167         if (TEMPLATE::exists($name))
4168             $this->error(_ERROR_DUPTEMPLATENAME);
4169
4170         $newTemplateId = TEMPLATE::createNew($name, $desc);
4171
4172         $this->action_templateoverview();
4173     }
4174
4175     /**
4176      * @todo document this
4177      */
4178     function action_templateclone() {
4179         global $member;
4180
4181         $templateid = intRequestVar('templateid');
4182
4183         $member->isAdmin() or $this->disallow();
4184
4185         // 1. read old template
4186         $name = TEMPLATE::getNameFromId($templateid);
4187         $desc = TEMPLATE::getDesc($templateid);
4188
4189         // 2. create desc thing
4190         $name = "cloned" . $name;
4191
4192         // if a template with that name already exists:
4193         if (TEMPLATE::exists($name)) {
4194             $i = 1;
4195             while (TEMPLATE::exists($name . $i))
4196                 $i++;
4197             $name .= $i;
4198         }
4199
4200         $newid = TEMPLATE::createNew($name, $desc);
4201
4202         // 3. create clone
4203         // go through parts of old template and add them to the new one
4204         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4205         while ($o = sql_fetch_object($res)) {
4206             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4207         }
4208
4209         $this->action_templateoverview();
4210     }
4211
4212     /**
4213      * @todo document this
4214      */
4215     function action_skinoverview() {
4216         global $member, $manager;
4217
4218         $member->isAdmin() or $this->disallow();
4219
4220         $this->pagehead();
4221
4222         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4223
4224         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4225
4226         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4227
4228         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4229         $template['content'] = 'skinlist';
4230         $template['tabindex'] = 10;
4231         showlist($query,'table',$template);
4232
4233         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4234
4235         ?>
4236         <form method="post" action="index.php">
4237         <div>
4238
4239         <input name="action" value="skinnew" type="hidden" />
4240         <?php $manager->addTicketHidden() ?>
4241         <table><tr>
4242             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4243             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4244         </tr><tr>
4245             <td><?php echo _SKIN_DESC?></td>
4246             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4247         </tr><tr>
4248             <td><?php echo _SKIN_CREATE?></td>
4249             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4250         </tr></table>
4251
4252         </div>
4253         </form>
4254
4255         <?php
4256         $this->pagefoot();
4257     }
4258
4259     /**
4260      * @todo document this
4261      */
4262     function action_skinnew() {
4263         global $member;
4264
4265         $member->isAdmin() or $this->disallow();
4266
4267         $name = trim(postVar('name'));
4268         $desc = trim(postVar('desc'));
4269
4270         if (!isValidSkinName($name))
4271             $this->error(_ERROR_BADSKINNAME);
4272
4273         if (SKIN::exists($name))
4274             $this->error(_ERROR_DUPSKINNAME);
4275
4276         $newId = SKIN::createNew($name, $desc);
4277
4278         $this->action_skinoverview();
4279     }
4280
4281     /**
4282      * @todo document this
4283      */
4284     function action_skinedit() {
4285         global $member, $manager;
4286
4287         $skinid = intRequestVar('skinid');
4288
4289         $member->isAdmin() or $this->disallow();
4290
4291         $skin = new SKIN($skinid);
4292
4293         $this->pagehead();
4294         ?>
4295         <p>
4296             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4297         </p>
4298         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4299
4300         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4301         <?php echo _SKIN_PARTS_MSG?>
4302         <ul>
4303             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4304             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4305             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4306             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4307             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4308             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4309             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4310             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4311         </ul>
4312
4313         <?php
4314
4315         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4316         $res = sql_query($query);
4317
4318         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4319         echo '<form method="get" action="index.php">' . "\r\n";
4320         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4321         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4322         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4323         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4324         echo '</form>' . "\r\n";
4325
4326         if ($res && sql_num_rows($res) > 0) {
4327             echo '<ul>';
4328             $tabstart = 75;
4329
4330             while ($row = sql_fetch_assoc($res)) {
4331                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">' . ENTITY::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4332             }
4333
4334             echo '</ul>';
4335         }
4336
4337         ?>
4338
4339         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4340         <form method="post" action="index.php">
4341         <div>
4342
4343         <input type="hidden" name="action" value="skineditgeneral" />
4344         <?php $manager->addTicketHidden() ?>
4345         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4346         <table><tr>
4347             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4348             <td><input name="name" tabindex="90" value="<?php echo  ENTITY::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4349         </tr><tr>
4350             <td><?php echo _SKIN_DESC?></td>
4351             <td><input name="desc" tabindex="100" value="<?php echo  ENTITY::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4352         </tr><tr>
4353             <td><?php echo _SKIN_TYPE?></td>
4354             <td><input name="type" tabindex="110" value="<?php echo  ENTITY::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4355         </tr><tr>
4356             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4357             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4358         </tr><tr>
4359             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4360             <td><input name="inc_prefix" tabindex="130" value="<?php echo  ENTITY::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4361         </tr><tr>
4362             <td><?php echo _SKIN_CHANGE?></td>
4363             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4364         </tr></table>
4365
4366         </div>
4367         </form>
4368
4369
4370         <?php       $this->pagefoot();
4371     }
4372
4373     /**
4374      * @todo document this
4375      */
4376     function action_skineditgeneral() {
4377         global $member;
4378
4379         $skinid = intRequestVar('skinid');
4380
4381         $member->isAdmin() or $this->disallow();
4382
4383         $name = postVar('name');
4384         $desc = postVar('desc');
4385         $type = postVar('type');
4386         $inc_mode = postVar('inc_mode');
4387         $inc_prefix = postVar('inc_prefix');
4388
4389         $skin = new SKIN($skinid);
4390
4391         // 1. Some checks
4392         if (!isValidSkinName($name))
4393             $this->error(_ERROR_BADSKINNAME);
4394
4395         if (($skin->getName() != $name) && SKIN::exists($name))
4396             $this->error(_ERROR_DUPSKINNAME);
4397
4398         if (!$type) $type = 'text/html';
4399         if (!$inc_mode) $inc_mode = 'normal';
4400
4401         // 2. Update description
4402         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4403
4404         $this->action_skinedit();
4405
4406     }
4407
4408     /**
4409      * @todo document this
4410      */
4411     function action_skinedittype($msg = '') {
4412         global $member, $manager;
4413
4414         $skinid = intRequestVar('skinid');
4415         $type = requestVar('type');
4416
4417         $member->isAdmin() or $this->disallow();
4418
4419         $type = trim($type);
4420         $type = strtolower($type);
4421
4422         if (!isValidShortName($type)) {
4423             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4424         }
4425
4426         $skin = new SKIN($skinid);
4427
4428         $friendlyNames = SKIN::getFriendlyNames();
4429
4430         $this->pagehead();
4431         ?>
4432         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4433
4434         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo ENTITY::hsc($skin->getName()) ?>': <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4435
4436         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4437         ?>
4438
4439
4440         <form method="post" action="index.php">
4441         <div>
4442
4443         <input type="hidden" name="action" value="skinupdate" />
4444         <?php $manager->addTicketHidden() ?>
4445         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4446         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4447
4448         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4449         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4450         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4451         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4452             help('skinpart' . $type);
4453         } else {
4454             help('skinpartspecial');
4455         }?>
4456         <br />
4457
4458         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  ENTITY::hsc($skin->getContent($type)) ?></textarea>
4459
4460         <br />
4461         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4462         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4463         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4464
4465         <br /><br />
4466         <?php echo _SKIN_ALLOWEDVARS?>
4467         <?php           $actions = SKIN::getAllowedActionsForType($type);
4468
4469             sort($actions);
4470
4471             while ($current = array_shift($actions)) {
4472                 // skip deprecated vars
4473                 if ($current == 'ifcat') continue;
4474                 if ($current == 'imagetext') continue;
4475                 if ($current == 'vars') continue;
4476
4477                 echo helplink('skinvar-' . $current) . "$current</a>";
4478                 if (count($actions) != 0) echo ", ";
4479             }
4480         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4481         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4482         showlist($query,'table',array('content'=>'shortblognames'));
4483         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4484         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4485         showlist($query,'table',array('content'=>'shortnames'));
4486         echo '</div></form>';
4487         $this->pagefoot();
4488     }
4489
4490     /**
4491      * @todo document this
4492      */
4493     function action_skinupdate() {
4494         global $member;
4495
4496         $skinid = intRequestVar('skinid');
4497         $content = trim(postVar('content'));
4498         $type = postVar('type');
4499
4500         $member->isAdmin() or $this->disallow();
4501
4502         $skin = new SKIN($skinid);
4503         $skin->update($type, $content);
4504
4505         $this->action_skinedittype(_SKIN_UPDATED);
4506     }
4507
4508     /**
4509      * @todo document this
4510      */
4511     function action_skindelete() {
4512         global $member, $manager, $CONF;
4513
4514         $skinid = intRequestVar('skinid');
4515
4516         $member->isAdmin() or $this->disallow();
4517
4518         // don't allow default skin to be deleted
4519         if ($skinid == $CONF['BaseSkin'])
4520             $this->error(_ERROR_DEFAULTSKIN);
4521
4522         // don't allow deletion of default skins for blogs
4523         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4524         $r = sql_query($query);
4525         if ($o = sql_fetch_object($r))
4526             $this->error(_ERROR_SKINDEFDELETE . ENTITY::hsc($o->bname));
4527
4528         $this->pagehead();
4529
4530         $skin = new SKIN($skinid);
4531         $name = $skin->getName();
4532         $desc = $skin->getDescription();
4533
4534         ?>
4535             <h2><?php echo _DELETE_CONFIRM?></h2>
4536
4537             <p>
4538                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo ENTITY::hsc($name) ?></b> (<?php echo  ENTITY::hsc($desc)?>)
4539             </p>
4540
4541             <form method="post" action="index.php"><div>
4542                 <input type="hidden" name="action" value="skindeleteconfirm" />
4543                 <?php $manager->addTicketHidden() ?>
4544                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4545                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4546             </div></form>
4547         <?php
4548         $this->pagefoot();
4549     }
4550
4551     /**
4552      * @todo document this
4553      */
4554     function action_skindeleteconfirm() {
4555         global $member, $CONF, $manager;
4556
4557         $skinid = intRequestVar('skinid');
4558
4559         $member->isAdmin() or $this->disallow();
4560
4561         // don't allow default skin to be deleted
4562         if ($skinid == $CONF['BaseSkin'])
4563             $this->error(_ERROR_DEFAULTSKIN);
4564
4565         // don't allow deletion of default skins for blogs
4566         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4567         $r = sql_query($query);
4568         if ($o = sql_fetch_object($r))
4569             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4570
4571         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4572
4573         // 1. delete description
4574         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4575
4576         // 2. delete parts
4577         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4578
4579         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4580
4581         $this->action_skinoverview();
4582     }
4583
4584     /**
4585      * @todo document this
4586      */
4587     function action_skinremovetype() {
4588         global $member, $manager, $CONF;
4589
4590         $skinid = intRequestVar('skinid');
4591         $skintype = requestVar('type');
4592
4593         if (!isValidShortName($skintype)) {
4594             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4595         }
4596
4597         $member->isAdmin() or $this->disallow();
4598
4599         // don't allow default skinparts to be deleted
4600         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4601             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4602         }
4603
4604         $this->pagehead();
4605
4606         $skin = new SKIN($skinid);
4607         $name = $skin->getName();
4608         $desc = $skin->getDescription();
4609
4610         ?>
4611             <h2><?php echo _DELETE_CONFIRM?></h2>
4612
4613             <p>
4614                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo ENTITY::hsc($skintype); ?> (<?php echo ENTITY::hsc($name); ?>)</b> (<?php echo  ENTITY::hsc($desc)?>)
4615             </p>
4616
4617             <form method="post" action="index.php"><div>
4618                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4619                 <?php $manager->addTicketHidden() ?>
4620                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4621                 <input type="hidden" name="type" value="<?php echo ENTITY::hsc($skintype); ?>" />
4622                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4623             </div></form>
4624         <?php
4625         $this->pagefoot();
4626     }
4627
4628     /**
4629      * @todo document this
4630      */
4631     function action_skinremovetypeconfirm() {
4632         global $member, $CONF, $manager;
4633
4634         $skinid = intRequestVar('skinid');
4635         $skintype = requestVar('type');
4636
4637         if (!isValidShortName($skintype)) {
4638             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4639         }
4640
4641         $member->isAdmin() or $this->disallow();
4642
4643         // don't allow default skinparts to be deleted
4644         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4645             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4646         }
4647
4648         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4649
4650         // delete part
4651         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4652
4653         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4654
4655         $this->action_skinedit();
4656     }
4657
4658     /**
4659      * @todo document this
4660      */
4661     function action_skinclone() {
4662         global $member;
4663
4664         $skinid = intRequestVar('skinid');
4665
4666         $member->isAdmin() or $this->disallow();
4667
4668         // 1. read skin to clone
4669         $skin = new SKIN($skinid);
4670
4671         $name = "clone_" . $skin->getName();
4672
4673         // if a skin with that name already exists:
4674         if (SKIN::exists($name)) {
4675             $i = 1;
4676             while (SKIN::exists($name . $i))
4677                 $i++;
4678             $name .= $i;
4679         }
4680
4681         // 2. create skin desc
4682         $newid = SKIN::createNew(
4683             $name,
4684             $skin->getDescription(),
4685             $skin->getContentType(),
4686             $skin->getIncludeMode(),
4687             $skin->getIncludePrefix()
4688         );
4689
4690
4691         // 3. clone
4692         /*
4693         $this->skinclonetype($skin, $newid, 'index');
4694         $this->skinclonetype($skin, $newid, 'item');
4695         $this->skinclonetype($skin, $newid, 'archivelist');
4696         $this->skinclonetype($skin, $newid, 'archive');
4697         $this->skinclonetype($skin, $newid, 'search');
4698         $this->skinclonetype($skin, $newid, 'error');
4699         $this->skinclonetype($skin, $newid, 'member');
4700         $this->skinclonetype($skin, $newid, 'imagepopup');
4701         */
4702
4703         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4704         $res = sql_query($query);
4705         while ($row = sql_fetch_assoc($res)) {
4706             $this->skinclonetype($skin, $newid, $row['stype']);
4707         }
4708
4709         $this->action_skinoverview();
4710
4711     }
4712
4713     /**
4714      * @todo document this
4715      */
4716     function skinclonetype($skin, $newid, $type) {
4717         $newid = intval($newid);
4718         $content = $skin->getContent($type);
4719         if ($content) {
4720             $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
4721             sql_query($query);
4722         }
4723     }
4724
4725     /**
4726      * @todo document this
4727      */
4728     function action_settingsedit() {
4729         global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4730
4731         $member->isAdmin() or $this->disallow();
4732
4733         $this->pagehead();
4734
4735         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4736         ?>
4737
4738         <h2><?php echo _SETTINGS_TITLE?></h2>
4739
4740         <form action="index.php" method="post">
4741         <div>
4742
4743         <input type="hidden" name="action" value="settingsupdate" />
4744         <?php $manager->addTicketHidden() ?>
4745
4746         <table><tr>
4747             <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4748         </tr><tr>
4749             <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4750             <td>
4751                 <?php
4752                     $query =  'SELECT bname as text, bnumber as value'
4753                            . ' FROM '.sql_table('blog');
4754                     $template['name'] = 'DefaultBlog';
4755                     $template['selected'] = $CONF['DefaultBlog'];
4756                     $template['tabindex'] = 10;
4757                     showlist($query,'select',$template);
4758                 ?>
4759             </td>
4760         </tr><tr>
4761             <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4762             <td>
4763                 <?php
4764                     $query =  'SELECT sdname as text, sdnumber as value'
4765                            . ' FROM '.sql_table('skin_desc');
4766                     $template['name'] = 'BaseSkin';
4767                     $template['selected'] = $CONF['BaseSkin'];
4768                     $template['tabindex'] = 1;
4769                     showlist($query,'select',$template);
4770                 ?>
4771             </td>
4772         </tr><tr>
4773             <td><?php echo _SETTINGS_ADMINMAIL?></td>
4774             <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminEmail']) ?>" /></td>
4775         </tr><tr>
4776             <td><?php echo _SETTINGS_SITENAME?></td>
4777             <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  ENTITY::hsc($CONF['SiteName']) ?>" /></td>
4778         </tr><tr>
4779             <td><?php echo _SETTINGS_SITEURL?></td>
4780             <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  ENTITY::hsc($CONF['IndexURL']) ?>" /></td>
4781         </tr><tr>
4782             <td><?php echo _SETTINGS_ADMINURL?></td>
4783             <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminURL']) ?>" /></td>
4784         </tr><tr>
4785             <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4786             <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  ENTITY::hsc($CONF['PluginURL']) ?>" /></td>
4787         </tr><tr>
4788             <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4789             <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  ENTITY::hsc($CONF['SkinsURL']) ?>" /></td>
4790         </tr><tr>
4791             <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4792             <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  ENTITY::hsc($CONF['ActionURL']) ?>" /></td>
4793         </tr><tr>
4794             <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4795             </td>
4796             <td>
4797                 <select name="Language" tabindex="10050">
4798                         <?php
4799                                 $locales = i18n::get_available_locale_list();
4800                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4801                                 {
4802                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4803                                 }
4804                                 else
4805                                 {
4806                                         echo "<option value=\"\">en_Latn_US</option>\n";
4807                                 }
4808
4809                                 foreach ( $locales as $locale )
4810                                 {
4811                                         if ( $locale == 'en_Latn_US' )
4812                                         {
4813                                                 continue;
4814                                         }
4815                                         if ( $locale == i18n::get_current_locale() )
4816                                         {
4817                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4818                                         }
4819                                         else
4820                                         {
4821                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4822                                         }
4823                                 }
4824                         ?>
4825                         </select>
4826
4827             </td>
4828         </tr><tr>
4829             <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4830             </td>
4831             <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4832                     <br />
4833                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  ENTITY::hsc($CONF['DisableSiteURL'])?>" />
4834             </td>
4835         </tr><tr>
4836             <td><?php echo _SETTINGS_DIRS?></td>
4837             <td><?php echo  ENTITY::hsc($DIR_NUCLEUS) ?>
4838                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4839         </tr><tr>
4840             <td><?php echo _SETTINGS_DBLOGIN?></td>
4841             <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4842         </tr><tr>
4843             <td>
4844             <?php
4845                 echo _SETTINGS_JSTOOLBAR
4846                 /* =_SETTINGS_DISABLEJS
4847
4848                     I temporary changed the meaning of DisableJsTools, until I can find a good
4849                     way to select the javascript version to use
4850
4851                     now, its:
4852                         0 : IE
4853                         1 : all javascript disabled
4854                         2 : 'simpler' javascript (for mozilla/opera/mac)
4855                 */
4856                ?>
4857             </td>
4858             <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4859                 <select name="DisableJsTools" tabindex="10075">
4860             <?php                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4861                     echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4862                     $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4863                     echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4864                     $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4865                     echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4866             ?>
4867                 </select>
4868             </td>
4869         </tr><tr>
4870             <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4871                        <td><?php
4872
4873                        $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4874                               'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4875
4876                        echo ' ', _SETTINGS_URLMODE_HELP;
4877
4878                              ?>
4879
4880                        </td>
4881         </tr><tr>
4882             <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4883                        <td><?php
4884
4885                         $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4886
4887                              ?>
4888
4889                        </td>
4890         </tr><tr>
4891             <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4892             <td>
4893             <?php
4894                 if (!array_key_exists('DefaultListSize',$CONF)) {
4895                     sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4896                     $CONF['DefaultListSize'] = 10;
4897                 }
4898             ?>
4899                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  ENTITY::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4900             </td>
4901         </tr><tr>
4902             <td><?php echo _SETTINGS_ADMINCSS?>
4903             </td>
4904             <td>
4905
4906                 <select name="AdminCSS" tabindex="10080">
4907                 <?php               // show a dropdown list of all available admin css files
4908                 global $DIR_NUCLEUS;
4909
4910                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4911
4912                                 while ($filename = readdir($dirhandle) )
4913                                 {
4914
4915                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4916                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4917
4918                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4919                                         {
4920
4921                                                 $name = $matches[1];
4922                                                 echo "<option value=\"$name\"";
4923
4924                                                 if ($name == $CONF['AdminCSS'])
4925                                                 {
4926                                                         echo " selected=\"selected\"";
4927                                                 }
4928
4929                                                 echo ">$name</option>";
4930
4931                                         }
4932
4933                                 }
4934
4935                                 closedir($dirhandle);
4936
4937                                 ?>
4938                                 </select>
4939
4940             </td>
4941         </tr><tr>
4942             <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4943         </tr><tr>
4944             <td><?php echo _SETTINGS_MEDIADIR?></td>
4945             <td><?php echo  ENTITY::hsc($DIR_MEDIA) ?>
4946                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4947                 <?php                   if (!is_dir($DIR_MEDIA))
4948                         echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4949                     if (!is_readable($DIR_MEDIA))
4950                         echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4951                     if (!is_writeable($DIR_MEDIA))
4952                         echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4953                 ?>
4954             </td>
4955         </tr><tr>
4956             <td><?php echo _SETTINGS_MEDIAURL?></td>
4957             <td>
4958                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  ENTITY::hsc($CONF['MediaURL']) ?>" />
4959             </td>
4960         </tr><tr>
4961             <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4962             <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4963         </tr><tr>
4964             <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4965             <td>
4966                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  ENTITY::hsc($CONF['AllowedTypes']) ?>" />
4967             </td>
4968         </tr><tr>
4969             <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4970             <td>
4971                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  ENTITY::hsc($CONF['MaxUploadSize']) ?>" />
4972             </td>
4973         </tr><tr>
4974             <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4975             <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4976
4977         </tr><tr>
4978             <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4979         </tr><tr>
4980             <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4981             <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4982         </tr><tr>
4983             <td><?php echo _SETTINGS_ALLOWCREATE?>
4984                 <?php help('allowaccountcreation'); ?>
4985             </td>
4986             <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4987             </td>
4988         </tr><tr>
4989             <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4990                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4991             </td>
4992             <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4993             </td>
4994         </tr><tr>
4995             <td><?php echo _SETTINGS_MEMBERMSGS?>
4996                 <?php help('messageservice'); ?>
4997             </td>
4998             <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4999             </td>
5000         </tr><tr>
5001             <td><?php echo _SETTINGS_NONMEMBERMSGS?>
5002                 <?php help('messageservice'); ?>
5003             </td>
5004             <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5005             </td>
5006         </tr><tr>
5007             <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5008                 <?php help('protectmemnames'); ?>
5009             </td>
5010             <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5011             </td>
5012
5013
5014
5015         </tr><tr>
5016             <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5017         </tr><tr>
5018             <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5019             <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePrefix'])?>" /></td>
5020         </tr><tr>
5021             <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5022             <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  ENTITY::hsc($CONF['CookieDomain'])?>" /></td>
5023         </tr><tr>
5024             <td><?php echo _SETTINGS_COOKIEPATH?></td>
5025             <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePath'])?>" /></td>
5026         </tr><tr>
5027             <td><?php echo _SETTINGS_COOKIESECURE?></td>
5028             <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5029         </tr><tr>
5030             <td><?php echo _SETTINGS_COOKIELIFE?></td>
5031             <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5032                               1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5033             </td>
5034         </tr><tr>
5035             <td><?php echo _SETTINGS_LASTVISIT?></td>
5036             <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5037
5038
5039
5040         </tr><tr>
5041             <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5042         </tr><tr>
5043             <td><?php echo _SETTINGS_UPDATE?></td>
5044             <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5045         </tr></table>
5046
5047         </div>
5048         </form>
5049
5050         <?php
5051             echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5052
5053             $manager->notify(
5054                 'GeneralSettingsFormExtras',
5055                 array()
5056             );
5057
5058         $this->pagefoot();
5059     }
5060
5061         /**
5062          * ADMIN::action_settingsupdate()
5063          * Update $CONFIG and redirect
5064          *
5065          * @param       void
5066          * @return      void
5067          */
5068         function action_settingsupdate() {
5069                 global $member, $CONF;
5070
5071                 $member->isAdmin() or $this->disallow();
5072
5073                 // check if email address for admin is valid
5074                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5075                 {
5076                         $this->error(_ERROR_BADMAILADDRESS);
5077                 }
5078
5079                 // save settings
5080                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5081                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5082                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5083                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5084                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5085                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5086                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5087                 $this->updateConfig('Language',            postVar('Language'));
5088                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5089                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5090                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5091                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5092                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5093                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5094                 $this->updateConfig('SiteName',          postVar('SiteName'));
5095                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5096                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5097                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5098                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5099                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5100                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5101                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5102                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5103                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5104                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5105                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5106                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5107                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5108                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5109                 $this->updateConfig('URLMode',            postVar('URLMode'));
5110                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5111                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5112                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5113                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5114
5115                 // load new config and redirect (this way, the new language will be used is necessary)
5116                 // note that when changing cookie settings, this redirect might cause the user
5117                 // to have to log in again.
5118                 getConfig();
5119                 redirect($CONF['AdminURL'] . '?action=manage');
5120                 exit;
5121         }
5122
5123         /**
5124          * ADMIN::action_systemoverview()
5125          * Output system overview
5126          *
5127          * @param       void
5128          * @return      void
5129          */
5130         function action_systemoverview()
5131         {
5132                 global $member, $nucleus, $CONF;
5133
5134                 $this->pagehead();
5135
5136                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5137
5138                 if ( $member->isLoggedIn() && $member->isAdmin() )
5139                 {
5140                         // Information about the used PHP and MySQL installation
5141                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5142
5143                         // Version of PHP MySQL
5144                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5145                         echo "<thead>\n";
5146                         echo "<tr>\n";
5147                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5148                         echo "</tr>\n";
5149                         echo "</thead>\n";
5150                         echo "<tbody>\n";
5151                         echo "<tr>\n";
5152                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5153                         echo '<td>' . phpversion() . "</td>\n";
5154                         echo "</tr>\n";
5155                         echo "<tr>\n";
5156                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5157                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5158                         echo "</tr>\n";
5159                         echo "</tbody>\n";
5160                         echo "</table>\n\n";
5161
5162                         // Important PHP settings
5163                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5164                         echo "<thead>\n";
5165                         echo "<tr>\n";
5166                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5167                         echo "</tr>\n";
5168                         echo "</thead>\n";
5169                         echo "<tbody>\n";
5170                         echo "<tr>\n";
5171                         echo '<td>magic_quotes_gpc' . "</td>\n";
5172                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5173                         echo '<td>' . $mqg . "</td>\n";
5174                         echo "</tr>\n";
5175                         echo "<tr>\n";
5176                         echo '<td>magic_quotes_runtime' . "</td>\n";
5177                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5178                         echo '<td>' . $mqr . "</td>\n";
5179                         echo "</tr>\n";
5180                         echo "<tr>\n";
5181                         echo '<td>register_globals' . "</td>\n";
5182                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5183                         echo '<td>' . $rg . "</td>\n";
5184                         echo "</tr>\n";
5185                         echo "</tbody>\n";
5186                         echo "</table>\n\n";
5187
5188                         // Information about GD library
5189                         $gdinfo = gd_info();
5190                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5191                         echo "<thead>\n";
5192                         echo "<tr>\n";
5193                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5194                         echo "</tr>\n";
5195                         echo "</thead>\n";
5196                         echo "<tbody>\n";
5197                         foreach ( $gdinfo as $key=>$value )
5198                         {
5199                                 if ( is_bool($value) )
5200                                 {
5201                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5202                                 }
5203                                 else
5204                                 {
5205                                         $value = ENTITY::hsc($value);
5206                                 }
5207                                 echo "<tr>\n";
5208                                 echo '<td>' . $key . "</td>\n";
5209                                 echo '<td>' . $value . "</td>\n";
5210                                 echo "</tr>\n";
5211                         }
5212                         echo "</tbody>\n";
5213                         echo "</table>\n\n";
5214
5215                         // Check if special modules are loaded
5216                         ob_start();
5217                         phpinfo(INFO_MODULES);
5218                         $im = ob_get_contents();
5219                         ob_clean();
5220                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5221                         echo "<thead>\n";
5222                         echo "<tr>";
5223                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5224                         echo "</tr>\n";
5225                         echo "<tbody>\n";
5226                         echo "<tr>\n";
5227                         echo '<td>mod_rewrite' . "</td>\n";
5228                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5229                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5230                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5231                         echo '<td>' . $modrewrite . "</td>\n";
5232                         echo "</tr>\n";
5233                         echo "</tbody>\n";
5234                         echo "</table>\n\n";
5235
5236                         // Information about the used Nucleus CMS
5237                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5238                         global $nucleus;
5239                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5240                         $np = getNucleusPatchLevel();
5241                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5242                         echo "<thead>\n";
5243                         echo "<tr>\n";
5244                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5245                         echo "</tr>\n";
5246                         echo "</thead>\n";
5247                         echo "<tbody>\n";
5248                         echo "<tr>\n";
5249                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5250                         echo '<td>' . $nv . "</td>\n";
5251                         echo "</tr>\n";
5252                         echo "<tr>\n";
5253                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5254                         echo '<td>' . $np . "</td>\n";
5255                         echo "</tr>\n";
5256                         echo "</tbody>\n";
5257                         echo "</table>\n\n";
5258
5259                         // Important settings of the installation
5260                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5261                         echo "<thead>\n";
5262                         echo "<tr>\n";
5263                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5264                         echo "</tr>\n";
5265                         echo "</thead>\n";
5266                         echo "<tbody>\n";
5267                         echo "<tr>\n";
5268                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5269                         echo '<td>' . $CONF['Self'] . "</td>\n";
5270                         echo "</tr>\n";
5271                         echo "<tr>\n";
5272                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5273                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5274                         echo "</tr>\n";
5275                         echo "<tr>\n";
5276                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5277                         $ohs = $CONF['alertOnHeadersSent'] ?
5278                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5279                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5280                         echo '<td>' . $ohs . "</td>\n";
5281                         echo "</tr>\n";
5282                         echo "<tr>\n";
5283                         echo "<td>i18n::get_current_charset()</td>\n";
5284                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5285                         echo "</tr>\n";
5286                         echo "</tbody>\n";
5287                         echo "</table>\n\n";
5288
5289                         // Link to the online version test at the Nucleus CMS website
5290                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5291                         if ( $nucleus['codename'] != '')
5292                         {
5293                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5294                         }
5295                         else
5296                         {
5297                                 $codenamestring = '';
5298                         }
5299                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5300                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5301                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5302                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5303                         echo '</a>';
5304                 }
5305                 else
5306                 {
5307                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5308                 }
5309                 $this->pagefoot();
5310         }
5311
5312         /**
5313          * ADMIN::updateConfig()
5314          *
5315          * @param       string  $name
5316          * @param       string  $val
5317          * @return      integer return the ID in which the latest query posted
5318          */
5319         function updateConfig($name, $val)
5320         {
5321                 $name = sql_real_escape_string($name);
5322                 $val = trim(sql_real_escape_string($val));
5323
5324                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5325                 $query = sprintf($query, sql_table('config'), $val, $name);
5326                 sql_query($query) or die("Query error: " . sql_error());
5327                 return sql_insert_id();
5328         }
5329
5330         /**
5331          * Error message
5332          * @param string $msg message that will be shown
5333          */
5334         function error($msg)
5335         {
5336                 $this->pagehead();
5337
5338                 echo "<h2>Error!</h2>\n";
5339                 echo $msg;
5340                 echo "<br />\n";
5341                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5342                 $this->pagefoot();
5343                 exit;
5344         }
5345
5346         /**
5347          * ADMIN::disallow()
5348          * add error log and show error page
5349          *
5350          * @param       void
5351          * @return      void
5352          */
5353         function disallow()
5354         {
5355                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5356                 $this->error(_ERROR_DISALLOWED);
5357         }
5358
5359         /**
5360          * ADMIN::pagehead()
5361          * Output admin page head
5362          *
5363          * @param       void
5364          * @return      void
5365          */
5366         function pagehead($extrahead = '')
5367         {
5368                 global $member, $nucleus, $CONF, $manager;
5369
5370                 $manager->notify(
5371                         'AdminPrePageHead',
5372                         array(
5373                                 'extrahead' => &$extrahead,
5374                                 'action' => $this->action));
5375
5376                 $baseUrl = ENTITY::hsc($CONF['AdminURL']);
5377                 if ( !array_key_exists('AdminCSS',$CONF) )
5378                 {
5379                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5380                         $CONF['AdminCSS'] = 'original';
5381                 }
5382
5383                 /* HTTP 1.1 application for no caching */
5384                 header("Cache-Control: no-cache, must-revalidate");
5385                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5386
5387                 $root_element = 'html';
5388                 $charset = i18n::get_current_charset();
5389                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5390
5391                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5392                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5393                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5394                 echo "<head>\n";
5395                 echo '<title>' . ENTITY::hsc($CONF['SiteName']) . " - Admin</title>\n";
5396                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5397                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5398                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5399                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5400                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5401                 echo "{$extrahead}\n";
5402                 echo "</head>\n\n";
5403                 echo "<body>\n";
5404                 echo "<div id=\"adminwrapper\">\n";
5405                 echo "<div class=\"header\">\n";
5406                 echo '<h1>' . ENTITY::hsc($CONF['SiteName']) . "</h1>\n";
5407                 echo "</div>\n";
5408                 echo "<div id=\"container\">\n";
5409                 echo "<div id=\"content\">\n";
5410                 echo "<div class=\"loginname\">\n";
5411                 if ( $member->isLoggedIn() )
5412                 {
5413                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5414                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5415                 }
5416                 else
5417                 {
5418                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5419                 }
5420                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5421                 echo '(';
5422
5423                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5424                 {
5425                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5426                 }
5427                 else
5428                 {
5429                         $codenamestring = '';
5430                 }
5431
5432                 if ( $member->isLoggedIn() && $member->isAdmin() )
5433                 {
5434                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5435                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5436
5437                         $newestVersion = getLatestVersion();
5438                         $newestCompare = str_replace('/','.',$newestVersion);
5439                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5440                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5441                         {
5442                                 echo "<br />\n";
5443                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5444                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5445                                 echo "</a>";
5446                         }
5447                 }
5448                 else
5449                 {
5450                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5451                 }
5452                 echo ')';
5453                 echo '</div>';
5454                 return;
5455         }
5456
5457         /**
5458          * ADMIN::pagefoot()
5459          * Output admin page foot include quickmenu
5460          *
5461          * @param       void
5462          * @return      void
5463          */
5464         function pagefoot()
5465         {
5466                 global $action, $member, $manager;
5467
5468                 $manager->notify(
5469                         'AdminPrePageFoot',
5470                         array('action' => $this->action)
5471                 );
5472
5473                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5474                 {
5475                         echo '<h2>' . _LOGOUT . "</h2>\n";
5476                         echo "<ul>\n";
5477                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5478                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5479                         echo "</ul>\n";
5480                 }
5481
5482                 echo "<div class=\"foot\">\n";
5483                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5484                 echo '-';
5485                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5486                 echo "</div>\n";
5487
5488                 echo "<!-- content -->\n";
5489                 echo "<div id=\"quickmenu\">\n";
5490
5491                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5492                 {
5493                         echo "<ul>\n";
5494                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5495                         echo "</ul>\n";
5496
5497                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5498                         echo "<form method=\"get\" action=\"index.php\">\n";
5499                         echo "<p>\n";
5500                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5501
5502                         $showAll = requestVar('showall');
5503
5504                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5505                         {
5506                                 // Super-Admins have access to all blogs! (no add item support though)
5507                                 $query =  'SELECT bnumber as value, bname as text'
5508                                                 . ' FROM ' . sql_table('blog')
5509                                                 . ' ORDER BY bname';
5510                         }
5511                         else
5512                         {
5513                                 $query =  'SELECT bnumber as value, bname as text'
5514                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5515                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5516                                                 . ' ORDER BY bname';
5517                         }
5518                         $template['name'] = 'blogid';
5519                         $template['tabindex'] = 15000;
5520                         $template['extra'] = _QMENU_ADD_SELECT;
5521                         $template['selected'] = -1;
5522                         $template['shorten'] = 10;
5523                         $template['shortenel'] = '';
5524                         $template['javascript'] = 'onchange="return form.submit()"';
5525                         showlist($query,'select',$template);
5526
5527                         echo "</p>\n";
5528                         echo "</form>\n";
5529
5530                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5531                         echo "<ul>\n";
5532                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5533                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5534                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5535                         echo "</ul>\n";
5536
5537                         // ---- general settings ----
5538                         if ( $member->isAdmin() )
5539                         {
5540                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5541                                 echo "<ul>\n";
5542                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5543                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5544                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5545                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5546                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5547                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5548                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5549                                 echo "</ul>\n";
5550
5551                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5552                                 echo "<ul>\n";
5553                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5554                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5555                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5556                                 echo "</ul>\n";
5557                         }
5558
5559                         $aPluginExtras = array();
5560                         $manager->notify(
5561                                 'QuickMenu',
5562                                 array(
5563                                         'options' => &$aPluginExtras));
5564
5565                         if ( count($aPluginExtras) > 0 )
5566                         {
5567                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5568                                 echo "<ul>\n";
5569                                 foreach ( $aPluginExtras as $aInfo )
5570                                 {
5571                                         echo '<li><a href="' . ENTITY::hsc($aInfo['url']) . '" title="' . ENTITY::hsc($aInfo['tooltip']) . '">' . ENTITY::hsc($aInfo['title']) . "</a></li>\n";
5572                                 }
5573                                 echo "</ul>\n";
5574                         }
5575                 }
5576                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5577                 {
5578
5579                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5580                 }
5581                 else
5582                 {
5583                         // introduction text on login screen
5584                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5585                 }
5586
5587                 echo "<!-- quickmenu -->\n";
5588                 echo "</div>\n";
5589
5590                 echo "<!-- content -->\n";
5591                 echo "</div>\n";
5592
5593                 echo "<!-- container -->\n";
5594                 echo "</div>\n";
5595
5596                 echo "<!-- adminwrapper -->\n";
5597                 echo "</div>\n";
5598
5599                 echo "</body>\n";
5600                 echo "</html>\n";
5601                 return;
5602         }
5603
5604     /**
5605      * @todo document this
5606      */
5607     function action_regfile() {
5608         global $member, $CONF;
5609
5610         $blogid = intRequestVar('blogid');
5611
5612         $member->teamRights($blogid) or $this->disallow();
5613
5614         // header-code stolen from phpMyAdmin
5615         // REGEDIT and bookmarklet code stolen from GreyMatter
5616
5617         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5618
5619
5620         header('Content-Type: application/octetstream');
5621         header('Content-Disposition: filename="nucleus.reg"');
5622         header('Pragma: no-cache');
5623         header('Expires: 0');
5624
5625         echo "REGEDIT4\n";
5626         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5627         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5628         echo '"contexts"=hex:31';
5629     }
5630
5631     /**
5632      * @todo document this
5633      */
5634     function action_bookmarklet() {
5635         global $member, $manager;
5636
5637         $blogid = intRequestVar('blogid');
5638
5639         $member->teamRights($blogid) or $this->disallow();
5640
5641         $blog =& $manager->getBlog($blogid);
5642         $bm = getBookmarklet($blogid);
5643
5644         $this->pagehead();
5645
5646         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5647
5648         ?>
5649
5650         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5651
5652         <p>
5653         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5654         </p>
5655
5656         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5657         <p>
5658             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5659             <br />
5660             <br />
5661             <?php echo '<a href="' . ENTITY::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, ENTITY::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5662         </p>
5663
5664         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5665         <p>
5666             <?php
5667                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5668                 $url = $manager->addTicketToUrl($url);
5669             ?>
5670             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . ENTITY::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5671         </p>
5672
5673         <p>
5674             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5675         </p>
5676
5677         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5678         <p>
5679             <?php echo _BOOKMARKLET_DELETEBAR ?>
5680         </p>
5681
5682         <p>
5683             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5684         </p>
5685
5686         <ol>
5687             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5688             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5689             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5690             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5691             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5692         </ol>
5693
5694         <?php
5695         $this->pagefoot();
5696
5697     }
5698
5699     /**
5700      * @todo document this
5701      */
5702     function action_actionlog() {
5703         global $member, $manager;
5704
5705         $member->isAdmin() or $this->disallow();
5706
5707         $this->pagehead();
5708
5709         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5710
5711         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5712
5713         ?>
5714             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5715             <p><a href="<?php echo ENTITY::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5716         <?php
5717         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5718
5719         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5720         $template['content'] = 'actionlist';
5721         $amount = showlist($query,'table',$template);
5722
5723         $this->pagefoot();
5724
5725     }
5726
5727     /**
5728      * @todo document this
5729      */
5730     function action_banlist() {
5731         global $member, $manager;
5732
5733         $blogid = intRequestVar('blogid');
5734
5735         $member->blogAdminRights($blogid) or $this->disallow();
5736
5737         $blog =& $manager->getBlog($blogid);
5738
5739         $this->pagehead();
5740
5741         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5742
5743         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5744
5745         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5746         $template['content'] = 'banlist';
5747         $amount = showlist($query,'table',$template);
5748
5749         if ($amount == 0)
5750             echo _BAN_NONE;
5751
5752         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5753         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5754
5755
5756         $this->pagefoot();
5757
5758     }
5759
5760     /**
5761      * @todo document this
5762      */
5763     function action_banlistdelete() {
5764         global $member, $manager;
5765
5766         $blogid = intRequestVar('blogid');
5767         $iprange = requestVar('iprange');
5768
5769         $member->blogAdminRights($blogid) or $this->disallow();
5770
5771         $blog =& $manager->getBlog($blogid);
5772         $banBlogName =  ENTITY::hsc($blog->getName());
5773
5774         $this->pagehead();
5775         ?>
5776             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5777
5778             <form method="post" action="index.php">
5779
5780             <h3><?php echo _BAN_IPRANGE?></h3>
5781
5782             <p>
5783                 <?php echo _CONFIRMTXT_BAN?> <?php echo ENTITY::hsc($iprange) ?>
5784                 <input name="iprange" type="hidden" value="<?php echo ENTITY::hsc($iprange)?>" />
5785             </p>
5786
5787             <h3><?php echo _BAN_BLOGS?></h3>
5788
5789             <div>
5790                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5791                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5792                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5793                 <br />
5794                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5795             </div>
5796
5797             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5798
5799             <div>
5800                 <?php $manager->addTicketHidden() ?>
5801                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5802                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5803             </div>
5804
5805             </form>
5806         <?php
5807         $this->pagefoot();
5808     }
5809
5810     /**
5811      * @todo document this
5812      */
5813     function action_banlistdeleteconfirm() {
5814         global $member, $manager;
5815
5816         $blogid = intPostVar('blogid');
5817         $allblogs = postVar('allblogs');
5818         $iprange = postVar('iprange');
5819
5820         $member->blogAdminRights($blogid) or $this->disallow();
5821
5822         $deleted = array();
5823
5824         if (!$allblogs) {
5825             if (BAN::removeBan($blogid, $iprange))
5826                 array_push($deleted, $blogid);
5827         } else {
5828             // get blogs fot which member has admin rights
5829             $adminblogs = $member->getAdminBlogs();
5830             foreach ($adminblogs as $blogje) {
5831                 if (BAN::removeBan($blogje, $iprange))
5832                     array_push($deleted, $blogje);
5833             }
5834         }
5835
5836         if (sizeof($deleted) == 0)
5837             $this->error(_ERROR_DELETEBAN);
5838
5839         $this->pagehead();
5840
5841         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5842         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5843         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5844
5845         echo "<ul>";
5846         foreach ($deleted as $delblog) {
5847             $b =& $manager->getBlog($delblog);
5848             echo "<li>" . ENTITY::hsc($b->getName()). "</li>";
5849         }
5850         echo "</ul>";
5851
5852         $this->pagefoot();
5853
5854     }
5855
5856     /**
5857      * @todo document this
5858      */
5859     function action_banlistnewfromitem() {
5860         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5861     }
5862
5863     /**
5864      * @todo document this
5865      */
5866     function action_banlistnew($blogid = '') {
5867         global $member, $manager;
5868
5869         if ($blogid == '')
5870             $blogid = intRequestVar('blogid');
5871
5872         $ip = requestVar('ip');
5873
5874         $member->blogAdminRights($blogid) or $this->disallow();
5875
5876         $blog =& $manager->getBlog($blogid);
5877
5878         $this->pagehead();
5879         ?>
5880         <h2><?php echo _BAN_ADD_TITLE?></h2>
5881
5882
5883         <form method="post" action="index.php">
5884
5885         <h3><?php echo _BAN_IPRANGE?></h3>
5886
5887         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5888
5889         <div class="note">
5890             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5891             <?php echo _BAN_EXAMPLE_TEXT ?>
5892         </div>
5893
5894         <div>
5895         <?php
5896         if ($ip) {
5897             $iprangeVal = ENTITY::hsc($ip);
5898         ?>
5899             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5900             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5901             <br />
5902             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5903             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5904             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5905         <?php
5906         } else {
5907             echo "<input name='iprange' value='custom' type='hidden' />";
5908             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5909         }
5910         ?>
5911         </div>
5912
5913         <h3><?php echo _BAN_BLOGS?></h3>
5914
5915         <p><?php echo _BAN_BLOGS_TEXT?></p>
5916
5917         <div>
5918             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5919             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo ENTITY::hsc($blog->getName())?>'</label>
5920             <br />
5921             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5922         </div>
5923
5924         <h3><?php echo _BAN_REASON_TITLE?></h3>
5925
5926         <p><?php echo _BAN_REASON_TEXT?></p>
5927
5928         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5929
5930         <h3><?php echo _BAN_ADD_TITLE?></h3>
5931
5932         <div>
5933             <input name="action" type="hidden" value="banlistadd" />
5934             <?php $manager->addTicketHidden() ?>
5935             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5936         </div>
5937
5938         </form>
5939
5940         <?php       $this->pagefoot();
5941     }
5942
5943     /**
5944      * @todo document this
5945      */
5946     function action_banlistadd() {
5947         global $member;
5948
5949         $blogid =       intPostVar('blogid');
5950         $allblogs =     postVar('allblogs');
5951         $iprange =      postVar('iprange');
5952         if ($iprange == "custom")
5953             $iprange = postVar('customiprange');
5954         $reason =       postVar('reason');
5955
5956         $member->blogAdminRights($blogid) or $this->disallow();
5957
5958         // TODO: check IP range validity
5959
5960         if (!$allblogs) {
5961             if (!BAN::addBan($blogid, $iprange, $reason))
5962                 $this->error(_ERROR_ADDBAN);
5963         } else {
5964             // get blogs fot which member has admin rights
5965             $adminblogs = $member->getAdminBlogs();
5966             $failed = 0;
5967             foreach ($adminblogs as $blogje) {
5968                 if (!BAN::addBan($blogje, $iprange, $reason))
5969                     $failed = 1;
5970             }
5971             if ($failed)
5972                 $this->error(_ERROR_ADDBAN);
5973         }
5974
5975         $this->action_banlist();
5976
5977     }
5978
5979     /**
5980      * @todo document this
5981      */
5982     function action_clearactionlog() {
5983         global $member;
5984
5985         $member->isAdmin() or $this->disallow();
5986
5987         ACTIONLOG::clear();
5988
5989         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5990     }
5991
5992     /**
5993      * @todo document this
5994      */
5995     function action_backupoverview() {
5996         global $member, $manager;
5997
5998         $member->isAdmin() or $this->disallow();
5999
6000         $this->pagehead();
6001
6002         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6003         ?>
6004         <h2><?php echo _BACKUPS_TITLE?></h2>
6005
6006         <h3><?php echo _BACKUP_TITLE?></h3>
6007
6008         <p><?php echo _BACKUP_INTRO?></p>
6009
6010         <form method="post" action="index.php"><p>
6011         <input type="hidden" name="action" value="backupcreate" />
6012         <?php $manager->addTicketHidden() ?>
6013
6014         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
6015         <br />
6016         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
6017         <br /><br />
6018         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
6019
6020         </p></form>
6021
6022         <div class="note"><?php echo _BACKUP_NOTE?></div>
6023
6024
6025         <h3><?php echo _RESTORE_TITLE?></h3>
6026
6027         <div class="note"><?php echo _RESTORE_NOTE?></div>
6028
6029         <p><?php echo _RESTORE_INTRO?></p>
6030
6031         <form method="post" action="index.php" enctype="multipart/form-data"><p>
6032             <input type="hidden" name="action" value="backuprestore" />
6033             <?php $manager->addTicketHidden() ?>
6034             <input name="backup_file" type="file" tabindex="30" />
6035             <br /><br />
6036             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6037             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6038             <br /><?php echo _RESTORE_WARNING?>
6039         </p></form>
6040
6041         <?php       $this->pagefoot();
6042     }
6043
6044     /**
6045      * @todo document this
6046      */
6047     function action_backupcreate() {
6048         global $member, $DIR_LIBS;
6049
6050         $member->isAdmin() or $this->disallow();
6051
6052         // use compression ?
6053         $useGzip = intval(postVar('gzip'));
6054
6055         include($DIR_LIBS . 'backup.php');
6056
6057         // try to extend time limit
6058         // (creating/restoring dumps might take a while)
6059         @set_time_limit(1200);
6060
6061         $bu = new Backup();
6062         $bu->do_backup($useGzip);
6063         exit;
6064     }
6065
6066     /**
6067      * @todo document this
6068      */
6069     function action_backuprestore() {
6070         global $member, $DIR_LIBS;
6071
6072         $member->isAdmin() or $this->disallow();
6073
6074         if (intPostVar('letsgo') != 1)
6075             $this->error(_ERROR_BACKUP_NOTSURE);
6076
6077         include($DIR_LIBS . 'backup.php');
6078
6079         // try to extend time limit
6080         // (creating/restoring dumps might take a while)
6081         @set_time_limit(1200);
6082
6083         $bu = new Backup();
6084         $message = $bu->do_restore();
6085         if ($message != '')
6086             $this->error($message);
6087
6088         $this->pagehead();
6089         ?>
6090         <h2><?php echo _RESTORE_COMPLETE?></h2>
6091         <?php       $this->pagefoot();
6092
6093     }
6094
6095     /**
6096      * @todo document this
6097      */
6098     function action_pluginlist() {
6099         global $member, $manager;
6100
6101         // check if allowed
6102         $member->isAdmin() or $this->disallow();
6103
6104         $this->pagehead();
6105
6106         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6107
6108         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6109
6110         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6111
6112
6113         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6114
6115         $template['content'] = 'pluginlist';
6116         $template['tabindex'] = 10;
6117         showlist($query, 'table', $template);
6118
6119 ?>
6120                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6121
6122                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6123
6124                         <form method="post" action="index.php"><div>
6125                                 <input type="hidden" name="action" value="pluginupdate" />
6126                                 <?php $manager->addTicketHidden() ?>
6127                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6128                         </div></form>
6129
6130                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6131
6132 <?php
6133                 // find a list of possibly non-installed plugins
6134                 $candidates = array();
6135
6136                 global $DIR_PLUGINS;
6137
6138                 $dirhandle = opendir($DIR_PLUGINS);
6139
6140                 while ($filename = readdir($dirhandle) )
6141                 {
6142
6143                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6144                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6145
6146                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6147                         {
6148
6149                                 $name = $matches[1];
6150                                 // only show in list when not yet installed
6151                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6152
6153                                 if (sql_num_rows($res) == 0)
6154                                 {
6155                                         array_push($candidates, $name);
6156                                 }
6157
6158                         }
6159
6160                 }
6161
6162                 closedir($dirhandle);
6163
6164                 if (sizeof($candidates) > 0)
6165                 {
6166 ?>
6167                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6168
6169                         <form method='post' action='index.php'><div>
6170                                 <input type='hidden' name='action' value='pluginadd' />
6171                                 <?php $manager->addTicketHidden() ?>
6172                                 <select name="filename" tabindex="30">
6173 <?php
6174                         foreach($candidates as $name)
6175                         {
6176                                 echo '<option value="NP_',$name,'">',ENTITY::hsc($name),'</option>';
6177                         }
6178 ?>
6179                                 </select>
6180                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6181                         </div></form>
6182
6183 <?php
6184                 }
6185                 else
6186                 {
6187                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6188                 }
6189
6190                 $this->pagefoot();
6191
6192         }
6193
6194     /**
6195      * @todo document this
6196      */
6197     function action_pluginhelp() {
6198         global $member, $manager, $DIR_PLUGINS, $CONF;
6199
6200         // check if allowed
6201         $member->isAdmin() or $this->disallow();
6202
6203         $plugid = intGetVar('plugid');
6204
6205         if (!$manager->pidInstalled($plugid))
6206             $this->error(_ERROR_NOSUCHPLUGIN);
6207
6208         $plugName = getPluginNameFromPid($plugid);
6209
6210         $this->pagehead();
6211
6212         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6213
6214         echo '<h2>',_PLUGS_HELP_TITLE,': ',ENTITY::hsc($plugName),'</h2>';
6215
6216         $plug =& $manager->getPlugin($plugName);
6217         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6218
6219         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6220             @readfile($helpFile);
6221         } else {
6222             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6223             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6224         }
6225
6226
6227         $this->pagefoot();
6228     }
6229
6230     /**
6231      * @todo document this
6232      */
6233     function action_pluginadd() {
6234         global $member, $manager, $DIR_PLUGINS;
6235
6236         // check if allowed
6237         $member->isAdmin() or $this->disallow();
6238
6239         $name = postVar('filename');
6240
6241         if ($manager->pluginInstalled($name))
6242             $this->error(_ERROR_DUPPLUGIN);
6243         if (!checkPlugin($name))
6244             $this->error(_ERROR_PLUGFILEERROR . ' (' . ENTITY::hsc($name) . ')');
6245
6246         // get number of currently installed plugins
6247         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6248         $numCurrent = sql_num_rows($res);
6249
6250         // plugin will be added as last one in the list
6251         $newOrder = $numCurrent + 1;
6252
6253         $manager->notify(
6254             'PreAddPlugin',
6255             array(
6256                 'file' => &$name
6257             )
6258         );
6259
6260         // do this before calling getPlugin (in case the plugin id is used there)
6261         $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6262         sql_query($query);
6263         $iPid = sql_insert_id();
6264
6265         $manager->clearCachedInfo('installedPlugins');
6266
6267         // Load the plugin for condition checking and instalation
6268         $plugin =& $manager->getPlugin($name);
6269
6270         // check if it got loaded (could have failed)
6271         if (!$plugin)
6272         {
6273             sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6274             $manager->clearCachedInfo('installedPlugins');
6275             $this->error(_ERROR_PLUGIN_LOAD);
6276         }
6277
6278         // check if plugin needs a newer Nucleus version
6279         if (getNucleusVersion() < $plugin->getMinNucleusVersion())
6280         {
6281             // uninstall plugin again...
6282             $this->deleteOnePlugin($plugin->getID());
6283
6284             // ...and show error
6285             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc($plugin->getMinNucleusVersion()));
6286         }
6287
6288         // check if plugin needs a newer Nucleus version
6289         if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
6290         {
6291             // uninstall plugin again...
6292             $this->deleteOnePlugin($plugin->getID());
6293
6294             // ...and show error
6295             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6296         }
6297
6298         $pluginList = $plugin->getPluginDep();
6299         foreach ($pluginList as $pluginName)
6300         {
6301
6302             $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6303             if (sql_num_rows($res) == 0)
6304             {
6305                 // uninstall plugin again...
6306                 $this->deleteOnePlugin($plugin->getID());
6307
6308                 $this->error(sprintf(_ERROR_INSREQPLUGIN, ENTITY::hsc($pluginName)));
6309             }
6310         }
6311
6312         // call the install method of the plugin
6313         $plugin->install();
6314
6315         $manager->notify(
6316             'PostAddPlugin',
6317             array(
6318                 'plugin' => &$plugin
6319             )
6320         );
6321
6322         // update all events
6323         $this->action_pluginupdate();
6324     }
6325
6326     /**
6327      * @todo document this
6328      */
6329     function action_pluginupdate() {
6330         global $member, $manager, $CONF;
6331
6332         // check if allowed
6333         $member->isAdmin() or $this->disallow();
6334
6335         // delete everything from plugin_events
6336         sql_query('DELETE FROM '.sql_table('plugin_event'));
6337
6338         // loop over all installed plugins
6339         $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6340         while($o = sql_fetch_object($res)) {
6341             $pid = $o->pid;
6342             $plug =& $manager->getPlugin($o->pfile);
6343             if ($plug)
6344             {
6345                 $eventList = $plug->getEventList();
6346                 foreach ($eventList as $eventName)
6347                     sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
6348             }
6349         }
6350
6351         redirect($CONF['AdminURL'] . '?action=pluginlist');
6352 //              $this->action_pluginlist();
6353     }
6354
6355     /**
6356      * @todo document this
6357      */
6358     function action_plugindelete() {
6359         global $member, $manager;
6360
6361         // check if allowed
6362         $member->isAdmin() or $this->disallow();
6363
6364         $pid = intGetVar('plugid');
6365
6366         if (!$manager->pidInstalled($pid))
6367             $this->error(_ERROR_NOSUCHPLUGIN);
6368
6369         $this->pagehead();
6370         ?>
6371             <h2><?php echo _DELETE_CONFIRM?></h2>
6372
6373             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6374
6375             <form method="post" action="index.php"><div>
6376             <?php $manager->addTicketHidden() ?>
6377             <input type="hidden" name="action" value="plugindeleteconfirm" />
6378             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6379             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6380             </div></form>
6381         <?php
6382         $this->pagefoot();
6383     }
6384
6385     /**
6386      * @todo document this
6387      */
6388     function action_plugindeleteconfirm() {
6389         global $member, $manager, $CONF;
6390
6391         // check if allowed
6392         $member->isAdmin() or $this->disallow();
6393
6394         $pid = intPostVar('plugid');
6395
6396         $error = $this->deleteOnePlugin($pid, 1);
6397         if ($error) {
6398             $this->error($error);
6399         }
6400
6401         redirect($CONF['AdminURL'] . '?action=pluginlist');
6402 //              $this->action_pluginlist();
6403     }
6404
6405     /**
6406      * @todo document this
6407      */
6408     function deleteOnePlugin($pid, $callUninstall = 0) {
6409         global $manager;
6410
6411         $pid = intval($pid);
6412
6413         if (!$manager->pidInstalled($pid))
6414             return _ERROR_NOSUCHPLUGIN;
6415
6416         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6417
6418 /*              // call the unInstall method of the plugin
6419         if ($callUninstall) {
6420             $plugin =& $manager->getPlugin($name);
6421             if ($plugin) $plugin->unInstall();
6422         }*/
6423
6424         // check dependency before delete
6425         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6426         while($o = sql_fetch_object($res)) {
6427             $plug =& $manager->getPlugin($o->pfile);
6428             if ($plug)
6429             {
6430                 $depList = $plug->getPluginDep();
6431                 foreach ($depList as $depName)
6432                 {
6433                     if ($name == $depName)
6434                     {
6435                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6436                     }
6437                 }
6438             }
6439         }
6440
6441         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6442
6443         // call the unInstall method of the plugin
6444         if ($callUninstall) {
6445             $plugin =& $manager->getPlugin($name);
6446             if ($plugin) $plugin->unInstall();
6447         }
6448
6449         // delete all subscriptions
6450         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6451
6452         // delete all options
6453         // get OIDs from plugin_option_desc
6454         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6455         $aOIDs = array();
6456         while ($o = sql_fetch_object($res)) {
6457             array_push($aOIDs, $o->oid);
6458         }
6459
6460         // delete from plugin_option and plugin_option_desc
6461         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6462         if (count($aOIDs) > 0)
6463             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6464
6465         // update order numbers
6466         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6467         $o = sql_fetch_object($res);
6468         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6469
6470         // delete row
6471         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6472
6473         $manager->clearCachedInfo('installedPlugins');
6474         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6475
6476         return '';
6477     }
6478
6479     /**
6480      * @todo document this
6481      */
6482     function action_pluginup() {
6483         global $member, $manager, $CONF;
6484
6485         // check if allowed
6486         $member->isAdmin() or $this->disallow();
6487
6488         $plugid = intGetVar('plugid');
6489
6490         if (!$manager->pidInstalled($plugid))
6491             $this->error(_ERROR_NOSUCHPLUGIN);
6492
6493         // 1. get old order number
6494         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6495         $o = sql_fetch_object($res);
6496         $oldOrder = $o->porder;
6497
6498         // 2. calculate new order number
6499         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6500
6501         // 3. update plug numbers
6502         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6503         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6504
6505         //$this->action_pluginlist();
6506         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6507         redirect($CONF['AdminURL'] . '?action=pluginlist');
6508     }
6509
6510     /**
6511      * @todo document this
6512      */
6513     function action_plugindown() {
6514         global $member, $manager, $CONF;
6515
6516         // check if allowed
6517         $member->isAdmin() or $this->disallow();
6518
6519         $plugid = intGetVar('plugid');
6520         if (!$manager->pidInstalled($plugid))
6521             $this->error(_ERROR_NOSUCHPLUGIN);
6522
6523         // 1. get old order number
6524         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6525         $o = sql_fetch_object($res);
6526         $oldOrder = $o->porder;
6527
6528         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6529         $maxOrder = sql_num_rows($res);
6530
6531         // 2. calculate new order number
6532         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6533
6534         // 3. update plug numbers
6535         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6536         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6537
6538         //$this->action_pluginlist();
6539         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6540         redirect($CONF['AdminURL'] . '?action=pluginlist');
6541     }
6542
6543         /**
6544          * ADMIN::action_pluginoptions()
6545          *
6546          * Output Plugin option page
6547          *
6548          * @access      public
6549          * @param       string $message message when fallbacked
6550          * @return      void
6551          *
6552          */
6553         public function action_pluginoptions($message = '')
6554         {
6555                 global $member, $manager;
6556
6557                 // check if allowed
6558                 $member->isAdmin() or $this->disallow();
6559
6560                 $pid = (integer) requestVar('plugid');
6561                 if ( !$manager->pidInstalled($pid) )
6562                 {
6563                         $this->error(_ERROR_NOSUCHPLUGIN);
6564                 }
6565
6566                 $pname = getPluginNameFromPid($pid);
6567
6568                 /* just for including translation */
6569                 $manager->getPlugin($pname);
6570
6571                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6572                 $this->pagehead($extrahead);
6573                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6574                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($pname)) . "</h2>\n";
6575
6576                 if ( isset($message) )
6577                 {
6578                         echo $message;
6579                 }
6580
6581                 echo "<form action=\"index.php\" method=\"post\">\n";
6582                 echo "<div>\n";
6583                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6584                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6585                 $manager->addTicketHidden();
6586
6587                 $aOptions = array();
6588                 $aOIDs = array();
6589                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6590                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6591                 $result = sql_query($query);
6592                 while ( $object = sql_fetch_object($result) )
6593                 {
6594                         array_push($aOIDs, $object->oid);
6595                         $aOptions[$object->oid] = array(
6596                                                 'oid' => $object->oid,
6597                                                 'value' => $object->odef,
6598                                                 'name' => $object->oname,
6599                                                 'description' => $object->odesc,
6600                                                 'type' => $object->otype,
6601                                                 'typeinfo' => $object->oextra,
6602                                                 'contextid' => 0
6603                         );
6604                 }
6605                 // fill out actual values
6606                 if ( count($aOIDs) > 0 )
6607                 {
6608                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6609                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6610                         $result = sql_query($query);
6611                         while ( $object = sql_fetch_object($result) )
6612                         {
6613                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6614                         }
6615                 }
6616
6617                 // call plugins
6618                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6619                 $manager->notify('PrePluginOptionsEdit',$data);
6620
6621                 $template['content'] = 'plugoptionlist';
6622                 $amount = showlist($aOptions,'table',$template);
6623                 if ( $amount == 0 )
6624                 {
6625                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6626                 }
6627                 echo "</div>\n";
6628                 echo "</form>\n";
6629                 $this->pagefoot();
6630
6631                 return;
6632         }
6633
6634         /**
6635          * ADMIN::action_pluginoptionsupdate()
6636          *
6637          * Update plugin options and fallback to plugin option page
6638          *
6639          * @access      public
6640          * @param       void
6641          * @return      void
6642          */
6643         public function action_pluginoptionsupdate()
6644         {
6645                 global $member, $manager;
6646
6647                 // check if allowed
6648                 $member->isAdmin() or $this->disallow();
6649
6650                 $pid = (integer) requestVar('plugid');
6651                 if ( !$manager->pidInstalled($pid) )
6652                 {
6653                         $this->error(_ERROR_NOSUCHPLUGIN);
6654                 }
6655
6656                 $aOptions = requestArray('plugoption');
6657                 NucleusPlugin::apply_plugin_options($aOptions);
6658
6659                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6660
6661                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6662                 return;
6663         }
6664
6665         /**
6666          * ADMIN::_insertPluginOptions()
6667          *
6668          * Output plugin option field
6669          *
6670          * @access      public
6671          * @param string        $context        plugin option context
6672          * @param integer       $contextid      plugin option context id
6673          * @return      void
6674          */
6675         public function _insertPluginOptions($context, $contextid = 0)
6676         {
6677                 // get all current values for this contextid
6678                 // (note: this might contain doubles for overlapping contextids)
6679                 $aIdToValue = array();
6680                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6681                 while ( $object = sql_fetch_object($res) )
6682                 {
6683                         $aIdToValue[$object->oid] = $object->ovalue;
6684                 }
6685
6686                 // get list of oids per pid
6687                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6688                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6689                 $res = sql_query($query);
6690                 $aOptions = array();
6691                 while ( $object = sql_fetch_object($res) )
6692                 {
6693                         if (in_array($object->oid, array_keys($aIdToValue)))
6694                         {
6695                                 $value = $aIdToValue[$object->oid];
6696                         }
6697                         else
6698                         {
6699                                 $value = $object->odef;
6700                         }
6701
6702                         array_push($aOptions, array(
6703                                 'pid' => $object->pid,
6704                                 'pfile' => $object->pfile,
6705                                 'oid' => $object->oid,
6706                                 'value' => $value,
6707                                 'name' => $object->oname,
6708                                 'description' => $object->odesc,
6709                                 'type' => $object->otype,
6710                                 'typeinfo' => $object->oextra,
6711                                 'contextid' => $contextid,
6712                                 'extra' => ''));
6713                 }
6714
6715                 global $manager;
6716                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6717
6718                 $iPrevPid = -1;
6719                 foreach ($aOptions as $aOption)
6720                 {
6721                         // new plugin?
6722                         if ( $iPrevPid != $aOption['pid'] )
6723                         {
6724                                 $iPrevPid = $aOption['pid'];
6725                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6726                                 {
6727                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6728                                 }
6729                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($aOption['pfile'])).'</th></tr>';
6730                         }
6731
6732                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6733                         if ( @$meta['access'] != 'hidden' )
6734                         {
6735                                 echo '<tr>';
6736                                 listplug_plugOptionRow($aOption);
6737                                 echo '</tr>';
6738                         }
6739                 }
6740                 return;
6741         }
6742
6743         /**
6744          * ADMIN::input_yesno()
6745          * Output input elements with radio attribute for yes/no options
6746          *
6747          * @param       string  $name   name attribute
6748          * @param       string  $value_current  current value attribute
6749          * @param       integer $tabindex       tab index
6750          * @param       string  $value_yes      value attribute for yes option
6751          * @param       string  $value_no       value attribute for no option
6752          * @param       string  $text_yes       child text element for yes option
6753          * @param       string  $text_no        child text element for no option
6754          * @param       boolean $isAdmin        have admin right or not
6755          * @return      void
6756          */
6757         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6758         {
6759                 $id = preg_replace('#\[|\]#', '-', $name);
6760                 $id_yes = $id . $value_yes;
6761                 $id_no  = $id . $value_no;
6762
6763                 /* yes option */
6764                 echo '<input type="radio" id="' . ENTITY::hsc($id_yes) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_yes) . '"';
6765                 if ( $name=="admin" )
6766                 {
6767                         echo ' onclick="selectCanLogin(true);"';
6768                 }
6769                 if ( $value_current == $value_yes )
6770                 {
6771                         echo " tabindex='$tabindex' checked='checked'";
6772                 }
6773                 echo " />\n";
6774                 echo '<label for="' . ENTITY::hsc($id_yes) . '">' . ENTITY::hsc($text_yes) . "</label>\n";
6775
6776                 /* no option */
6777                 echo '<input type="radio" id="' . ENTITY::hsc($id_no) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_no) . '"';
6778                 if ( $name=="admin" )
6779                 {
6780                         echo ' onclick="selectCanLogin(false);"';
6781                 }
6782                 if ( $value_current != $value_yes )
6783                 {
6784                         echo " tabindex='$tabindex' checked='checked'";
6785                 }
6786                 if ($isAdmin && $name=="canlogin")
6787                 {
6788                         echo ' disabled="disabled"';
6789                 }
6790                 echo " />\n";
6791                 echo '<label for="' . ENTITY::hsc($id_no) . '">' . ENTITY::hsc($text_no) . "</label>\n";
6792
6793                 return;
6794         }
6795 }