nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $skin;\r
  26         \r
  27         static public $action;\r
  28         static public $aOptions;\r
  29         static public $blog;\r
  30         static public $contents;\r
  31         static public $extrahead;\r
  32         static public $headMess;\r
  33         static public $passvar;\r
  34         \r
  35         static private $skinless_actions = array(\r
  36                 'plugindeleteconfirm',\r
  37                 'pluginoptionsupdate',\r
  38                 'blogsettingsupdate',\r
  39                 'settingsupdate',\r
  40                 'addnewlog2',\r
  41                 'additem',\r
  42                 'banlistnewfromitem',\r
  43                 'itemdeleteconfirm',\r
  44                 'itemupdate',\r
  45                 'changemembersettings',\r
  46                 'clearactionlog',\r
  47                 'memberedit',\r
  48                 'login',\r
  49                 \r
  50                 'skinremovetypeconfirm',\r
  51                 'skinclone',\r
  52                 'skindeleteconfirm',\r
  53                 'skinnew',\r
  54                 'skineditgeneral',\r
  55                 'skinupdate',\r
  56                 \r
  57                 'skinieexport',\r
  58                 \r
  59                 'templateupdate',\r
  60                 'templatedeleteconfirm',\r
  61                 'templatenew',\r
  62                 'templateclone',\r
  63                 \r
  64                 'adminskinremovetypeconfirm',\r
  65                 'adminskinclone',\r
  66                 'adminskindeleteconfirm',\r
  67                 'adminskinnew',\r
  68                 'adminskineditgeneral',\r
  69                 'adminskinupdate',\r
  70                 \r
  71                 'adminskinieexport',\r
  72                 \r
  73                 'admintemplateupdate',\r
  74                 'admintemplatedeleteconfirm',\r
  75                 'admintemplatenew',\r
  76                 'admintemplateclone'\r
  77         );\r
  78         \r
  79         static private $ticketless_actions = array(\r
  80                 'showlogin',\r
  81                 'login',\r
  82                 'overview',\r
  83                 'itemlist',\r
  84                 'blogcommentlist',\r
  85                 'bookmarklet',\r
  86                 'blogsettings',\r
  87                 'banlist',\r
  88                 'createaccount',\r
  89                 'deleteblog',\r
  90                 'editmembersettings',\r
  91                 'createaccount',\r
  92                 'forgotpassword',\r
  93                 'browseowncomments',\r
  94                 'createitem',\r
  95                 'itemedit',\r
  96                 'itemmove',\r
  97                 'categoryedit',\r
  98                 'categorydelete',\r
  99                 'manage',\r
 100                 'actionlog',\r
 101                 'settingsedit',\r
 102                 'backupoverview',\r
 103                 'pluginlist',\r
 104                 'createnewlog',\r
 105                 'usermanagement',\r
 106                 'itemcommentlist',\r
 107                 'commentedit',\r
 108                 'commentdelete',\r
 109                 'banlistnewfromitem',\r
 110                 'banlistdelete',\r
 111                 'itemdelete',\r
 112                 'manageteam',\r
 113                 'teamdelete',\r
 114                 'banlistnew',\r
 115                 'memberedit',\r
 116                 'memberdelete',\r
 117                 'pluginhelp',\r
 118                 'pluginoptions',\r
 119                 'plugindelete',\r
 120                 \r
 121                 'activate',\r
 122                 'systemoverview',\r
 123                 'activatesetpwd',\r
 124                 \r
 125                 'skinoverview',\r
 126                 'skinclone',\r
 127                 'skindelete',\r
 128                 'skinedit',\r
 129                 'skinedittype',\r
 130                 'skinnew',\r
 131                 'skinremovetype',\r
 132                 \r
 133                 'skinieoverview',\r
 134                 \r
 135                 'templateoverview',\r
 136                 'templateclone',\r
 137                 'templateedit',\r
 138                 'templatedelete',\r
 139                 \r
 140                 'adminskinoverview',\r
 141                 'adminskinclone',\r
 142                 'adminskindelete',\r
 143                 'adminskinedit',\r
 144                 'adminskinedittype',\r
 145                 'adminskinnew',\r
 146                 'adminskinremovetype',\r
 147                 \r
 148                 'adminskinieoverview',\r
 149                 \r
 150                 'admintemplateoverview',\r
 151                 'admintemplateclone',\r
 152                 'admintemplateedit',\r
 153                 'admintemplatedelete'\r
 154         );\r
 155         \r
 156         /**\r
 157          * NOTE: This is for condition of admin/normal skin actions\r
 158          */\r
 159         static public $adminskin_actions = array(\r
 160                 /* ticketless */\r
 161                 'adminskinoverview',\r
 162                 'adminskinclone',\r
 163                 'adminskindelete',\r
 164                 'adminskinedit',\r
 165                 'adminskinedittype',\r
 166                 'adminskinnew',\r
 167                 'adminskinremovetype',\r
 168                 \r
 169                 'adminskinieoverview',\r
 170                 \r
 171                 'admintemplateoverview',\r
 172                 'admintemplateclone',\r
 173                 'admintemplateedit',\r
 174                 'admintemplatedelete',\r
 175                 \r
 176                 /* ticket needed */\r
 177                 'adminskineditgeneral',\r
 178                 'adminskinupdate',\r
 179                 'adminskindeleteconfirm',\r
 180                 'adminskinremovetypeconfirm',\r
 181                 \r
 182                 'adminskinieoverview',\r
 183                 'adminskiniedoimport',\r
 184                 'adminskinieexport',\r
 185                 'adminskinieimport',\r
 186                 \r
 187                 'admintemplatenew',\r
 188                 'admintemplatedeleteconfirm',\r
 189                 'admintemplateupdate'\r
 190         );\r
 191         \r
 192         static public function initialize()\r
 193         {\r
 194                 global $CONF, $manager, $member;\r
 195                 \r
 196                 /* NOTE: 1. decide which skinid to use */\r
 197                 $skinid = $CONF['AdminSkin'];\r
 198                 if ( $member->isLoggedIn() )\r
 199                 {\r
 200                         $memskin = $member->getAdminSkin();\r
 201                         if ( $memskin && Skin::existsID($memskin))\r
 202                         {\r
 203                                 $skinid = $memskin;\r
 204                         }\r
 205                 }\r
 206                 \r
 207                 /* NOTE: 2. make an instance of skin object */\r
 208                 if ( !Skin::existsID($skinid) )\r
 209                 {\r
 210                         return FALSE;\r
 211                 }\r
 212                 \r
 213                 /* NOTE: 3. initializing each members */\r
 214                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 215                 self::$action           = '';\r
 216                 self::$extrahead        = '';\r
 217                 self::$passvar          = '';\r
 218                 self::$headMess         = '';\r
 219                 self::$aOptions         = '';\r
 220                 return TRUE;\r
 221         }\r
 222         \r
 223         /**\r
 224          * Admin::action()\r
 225          * Executes an action\r
 226          *\r
 227          * @param       string  $action action to be performed\r
 228          * @return      void\r
 229          */\r
 230         static public function action($action)\r
 231         {\r
 232                 global $CONF, $manager, $member;\r
 233                 \r
 234                 /* 1. decide action name */\r
 235                 $customAction = postvar('customaction');\r
 236                 if ( empty($customAction) )\r
 237                 {\r
 238                         $alias = array(\r
 239                                 'login' => 'overview',\r
 240                                 ''              => 'overview',\r
 241                         );\r
 242                 }\r
 243                 else\r
 244                 {\r
 245                         $alias = array(\r
 246                                 'login' => $customAction,\r
 247                                 ''              => $customAction\r
 248                         );\r
 249                 }\r
 250                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 251                 {\r
 252                         $action = $alias[$action];\r
 253                 }\r
 254                 $method_name = "action_{$action}";\r
 255                 self::$action = strtolower($action);\r
 256                 \r
 257                 /* 2. check ticket-needed action */\r
 258                 if ( !in_array(self::$action, self::$ticketless_actions) && !$manager->checkTicket() )\r
 259                 {\r
 260                         self::error(_ERROR_BADTICKET);\r
 261                         return;\r
 262                 }\r
 263                 \r
 264                 /* 3. parse according to the action */\r
 265                 else if ( method_exists('Admin', $method_name) )\r
 266                 {\r
 267                         call_user_func(array(__CLASS__, $method_name));\r
 268                         return;\r
 269                 }\r
 270                 /* 4. parse special admin skin */\r
 271                 elseif ( in_array(self::$action, self::$skinless_actions) )\r
 272                 {\r
 273                         /* TODO: need to be implemented or not?\r
 274                         self::action_parseSpecialskin();\r
 275                         */\r
 276                 }\r
 277                 else\r
 278                 {\r
 279                         self::error(_BADACTION . ENTITY::hsc($action));\r
 280                         return;\r
 281                 }\r
 282                 \r
 283                 return;\r
 284         }\r
 285         \r
 286         /**\r
 287          * Action::action_showlogin()\r
 288          * \r
 289          * @param       void\r
 290          * @return      void\r
 291          */\r
 292         static private function action_showlogin()\r
 293         {\r
 294                 global $error;\r
 295                 self::action_login($error);\r
 296                 return;\r
 297         }\r
 298         \r
 299         /**\r
 300          * Action::action_login()\r
 301          * \r
 302          * @param       string  $msg            message for pageheader\r
 303          * @param       integer $passvars       ???\r
 304          */\r
 305         static private function action_login($msg = '', $passvars = 1)\r
 306         {\r
 307                 global $member;\r
 308                 \r
 309                 // skip to overview when allowed\r
 310                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 311                 {\r
 312                         self::action_overview();\r
 313                         return;\r
 314                 }\r
 315                 \r
 316                 /* TODO: needless variable??? */\r
 317                 self::$passvar = $passvars;\r
 318                 if ( $msg )\r
 319                 {\r
 320                         self::$headMess = $msg;\r
 321                 }\r
 322                 \r
 323                 self::$skin->parse('showlogin');\r
 324         }\r
 325         \r
 326         /**\r
 327          * Action::action_overview()\r
 328          * provides a screen with the overview of the actions available\r
 329          * \r
 330          * @param       string  $msg    message for pageheader\r
 331          * @return      void\r
 332          */\r
 333         static private function action_overview($msg = '')\r
 334         {\r
 335                 if ( $msg )\r
 336                 {\r
 337                         self::$headMess = $msg;\r
 338                 }\r
 339                 \r
 340                 self::$skin->parse('overview');\r
 341                 return;\r
 342         }\r
 343         \r
 344         /**\r
 345          * Admin::action_manage()\r
 346          * \r
 347          * @param       string  $msg    message for pageheader\r
 348          * @retrn       void\r
 349          */\r
 350         static private function action_manage($msg = '')\r
 351         {\r
 352                 global $member;\r
 353                 \r
 354                 if ( $msg )\r
 355                 {\r
 356                         self::$headMess = $msg;\r
 357                 }\r
 358                 $member->isAdmin() or self::disallow();\r
 359                 \r
 360                 self::$skin->parse('manage');\r
 361                 return;\r
 362         }\r
 363         \r
 364         /**\r
 365          * Action::action_itemlist()\r
 366          * \r
 367          * @param       integer id for weblod\r
 368          * @return      void\r
 369          */\r
 370         static private function action_itemlist($blogid = '')\r
 371         {\r
 372                 global $member, $manager, $CONF;\r
 373                 \r
 374                 if ( $blogid == '' )\r
 375                 {\r
 376                         $blogid = intRequestVar('blogid');\r
 377                 }\r
 378                 \r
 379                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 380                 \r
 381                 self::$skin->parse('itemlist');\r
 382                 return;\r
 383         }\r
 384         \r
 385         /**\r
 386          * Action::action_batchitem()\r
 387          * \r
 388          * @param       void\r
 389          * @return      void\r
 390          */\r
 391         static private function action_batchitem()\r
 392         {\r
 393                 global $member, $manager;\r
 394                 \r
 395                 $member->isLoggedIn() or self::disallow();\r
 396                 \r
 397                 $selected       = requestIntArray('batch');\r
 398                 $action         = requestVar('batchaction');\r
 399                 \r
 400                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 401                 {\r
 402                         self::error(_BATCH_NOSELECTION);\r
 403                         return;\r
 404                 }\r
 405                 \r
 406                 // On move: when no destination blog/category chosen, show choice now\r
 407                 $destCatid = intRequestVar('destcatid');\r
 408                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 409                 {\r
 410                         self::batchMoveSelectDestination('item', $selected);\r
 411                 }\r
 412                 \r
 413                 // On delete: check if confirmation has been given\r
 414                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 415                 {\r
 416                         self::batchAskDeleteConfirmation('item', $selected);\r
 417                 }\r
 418                 \r
 419                 self::$skin->parse('batchitem');\r
 420                 return;\r
 421         }\r
 422         \r
 423         /**\r
 424          * Action::action_batchcomment()\r
 425          * \r
 426          * @param       void\r
 427          * @return      void\r
 428          */\r
 429         static private function action_batchcomment()\r
 430         {\r
 431                 global $member;\r
 432                 \r
 433                 $member->isLoggedIn() or self::disallow();\r
 434                 \r
 435                 $selected       = requestIntArray('batch');\r
 436                 $action         = requestVar('batchaction');\r
 437                 \r
 438                 // Show error when no items were selected\r
 439                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 440                 {\r
 441                         self::error(_BATCH_NOSELECTION);\r
 442                         return;\r
 443                 }\r
 444                 \r
 445                 // On delete: check if confirmation has been given\r
 446                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 447                 {\r
 448                         self::batchAskDeleteConfirmation('comment', $selected);\r
 449                 }\r
 450                 \r
 451                 self::$skin->parse('batchcomment');\r
 452                 return;\r
 453         }\r
 454         \r
 455         /**\r
 456          * Admin::action_batchmember()\r
 457          * \r
 458          * @param       void\r
 459          * @return      void\r
 460          */\r
 461         static private function action_batchmember()\r
 462         {\r
 463                 global $member;\r
 464                 \r
 465                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 466                 \r
 467                 $selected       = requestIntArray('batch');\r
 468                 $action         = requestVar('batchaction');\r
 469                 \r
 470                 // Show error when no members selected\r
 471                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 472                 {\r
 473                         self::error(_BATCH_NOSELECTION);\r
 474                         return;\r
 475                 }\r
 476                 \r
 477                 // On delete: check if confirmation has been given\r
 478                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 479                 {\r
 480                         self::batchAskDeleteConfirmation('member',$selected);\r
 481                 }\r
 482                 \r
 483                 self::$skin->parse('batchmember');\r
 484                 return;\r
 485         }\r
 486         \r
 487         /**\r
 488          * Admin::action_batchteam()\r
 489          * \r
 490          * @param       void\r
 491          * @return      void\r
 492          */\r
 493         static private function action_batchteam()\r
 494         {\r
 495                 global $member;\r
 496                 \r
 497                 $blogid = intRequestVar('blogid');\r
 498                 \r
 499                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 500                 \r
 501                 $selected       = requestIntArray('batch');\r
 502                 $action         = requestVar('batchaction');\r
 503                 \r
 504                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 505                 {\r
 506                         self::error(_BATCH_NOSELECTION);\r
 507                         return;\r
 508                 }\r
 509                 \r
 510                 // On delete: check if confirmation has been given\r
 511                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 512                 {\r
 513                         self::batchAskDeleteConfirmation('team',$selected);\r
 514                 }\r
 515                 \r
 516                 self::$skin->parse('batchteam');\r
 517                 return;\r
 518         }\r
 519         \r
 520         /**\r
 521          * Admin::action_batchcategory()\r
 522          * \r
 523          * @param       void\r
 524          * @return      void\r
 525          */\r
 526         static private function action_batchcategory()\r
 527         {\r
 528                 global $member, $manager;\r
 529                 \r
 530                 $member->isLoggedIn() or self::disallow();\r
 531                 \r
 532                 $selected       = requestIntArray('batch');\r
 533                 $action         = requestVar('batchaction');\r
 534                 \r
 535                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 536                 {\r
 537                         self::error(_BATCH_NOSELECTION);\r
 538                         return;\r
 539                 }\r
 540                 \r
 541                 // On move: when no destination blog chosen, show choice now\r
 542                 $destBlogId = intRequestVar('destblogid');\r
 543                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 544                 {\r
 545                         self::batchMoveCategorySelectDestination('category', $selected);\r
 546                 }\r
 547                 \r
 548                 // On delete: check if confirmation has been given\r
 549                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 550                 {\r
 551                         self::batchAskDeleteConfirmation('category', $selected);\r
 552                 }\r
 553                 \r
 554                 self::$skin->parse('batchcategory');\r
 555                 return;\r
 556         }\r
 557         \r
 558         /**\r
 559          * Admin::batchMoveSelectDestination()\r
 560          * \r
 561          * @param       string  $type   type of batch action\r
 562          * @param       integer $ids    needless???\r
 563          * @return      void\r
 564          * \r
 565          * TODO: remove needless argument\r
 566          */\r
 567         static private function batchMoveSelectDestination($type, $ids)\r
 568         {\r
 569                 $_POST['batchmove'] = $type;\r
 570                 self::$skin->parse('batchmove');\r
 571                 return;\r
 572         }\r
 573         \r
 574         /**\r
 575          * Admin::batchMoveCategorySelectDestination()\r
 576          * \r
 577          * @param       string  $type   type of batch action\r
 578          * @param       integer $ids    needless???\r
 579          * @return      void\r
 580          * \r
 581          * TODO: remove needless argument\r
 582          */\r
 583         static private function batchMoveCategorySelectDestination($type, $ids)\r
 584         {\r
 585                 $_POST['batchmove'] = $type;\r
 586                 global $manager;\r
 587                 self::$skin->parse('batchmovecat');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchAskDeleteConfirmation()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchAskDeleteConfirmation($type, $ids)\r
 601         {\r
 602                 self::$skin->parse('batchdelete');\r
 603                 return;\r
 604         }\r
 605         \r
 606         /**\r
 607          * Admin::action_browseownitems()\r
 608          * \r
 609          * @param       void\r
 610          * @return      void\r
 611          */\r
 612         static private function action_browseownitems()\r
 613         {\r
 614                 global $member, $manager, $CONF;\r
 615                 \r
 616                 self::$skin->parse('browseownitems');\r
 617                 return;\r
 618         }\r
 619         \r
 620         /**\r
 621          * Admin::action_itemcommentlist()\r
 622          * Show all the comments for a given item\r
 623          * \r
 624          * @param       integer $itemid ID for item\r
 625          * @return      void\r
 626          */\r
 627         static private function action_itemcommentlist($itemid = '')\r
 628         {\r
 629                 global $member, $manager, $CONF;\r
 630                 \r
 631                 if ( $itemid == '' )\r
 632                 {\r
 633                         $itemid = intRequestVar('itemid');\r
 634                 }\r
 635                 \r
 636                 // only allow if user is allowed to alter item\r
 637                 $member->canAlterItem($itemid) or self::disallow();\r
 638                 \r
 639                 $item =& $manager->getItem($itemid, 1, 1);\r
 640                 $_REQUEST['itemid'] = $item['itemid'];\r
 641                 $_REQUEST['blogid'] = $item['blogid'];\r
 642                 \r
 643                 self::$skin->parse('itemcommentlist');\r
 644                 return;\r
 645         }\r
 646         \r
 647         /**\r
 648          * Admin::action_browseowncomments()\r
 649          * Browse own comments\r
 650          * \r
 651          * @param       void\r
 652          * @return      void\r
 653          */\r
 654         static private function action_browseowncomments()\r
 655         {\r
 656                 self::$skin->parse('browseowncomments');\r
 657                 return;\r
 658         }\r
 659         \r
 660         /**\r
 661          * Admin::action_blogcommentlist()\r
 662          * Browse all comments for a weblog\r
 663          * \r
 664          * @param       integer $blogid ID for weblog\r
 665          * @return      void\r
 666          */\r
 667         static private function action_blogcommentlist($blogid = '')\r
 668         {\r
 669                 global $member, $manager, $CONF;\r
 670                 \r
 671                 if ( $blogid == '' )\r
 672                 {\r
 673                         $blogid = intRequestVar('blogid');\r
 674                 }\r
 675                 else\r
 676                 {\r
 677                         $blogid = intval($blogid);\r
 678                 }\r
 679                 \r
 680                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 681                 \r
 682                 /* TODO: we consider to use the other way insterad of this */\r
 683                 $_REQUEST['blogid'] = $blogid;\r
 684                 \r
 685                 self::$skin->parse('blogcommentlist');\r
 686                 return;\r
 687         }\r
 688         \r
 689         /**\r
 690          * Admin::action_createaccount()\r
 691          * \r
 692          * @param       void\r
 693          * @return      void\r
 694          */\r
 695         static private function action_createaccount()\r
 696         {\r
 697                 global $CONF;\r
 698                 \r
 699                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 700                 {\r
 701                         self::$skin->parse('createaccountdisable');\r
 702                         return;\r
 703                 }\r
 704                 \r
 705                 $name = '';\r
 706                 $realname ='';\r
 707                 $email = '';\r
 708                 $url = '';\r
 709                 \r
 710                 $contents = array(\r
 711                         'name'          => '',\r
 712                         'realname'      => '',\r
 713                         'email'         => '',\r
 714                         'url'           => ''\r
 715                 );\r
 716                 \r
 717                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 718                 {\r
 719                         $action = new Action();\r
 720                         $message = $action->createAccount();\r
 721                         if ( $message === 1 )\r
 722                         {\r
 723                                 self::$headMess = $message;\r
 724                                 self::$skin->parse('createaccountsuccess');\r
 725                                 return;\r
 726                         }\r
 727                         \r
 728                         /* TODO: validation */\r
 729                         if ( array_key_exists('name', $_POST) )\r
 730                         {\r
 731                                 $contents['name'] = $_POST['name'];\r
 732                         }\r
 733                         if ( array_key_exists('realname', $_POST) )\r
 734                         {\r
 735                                 $contents['realname'] = $_POST['realname'];\r
 736                         }\r
 737                         if ( array_key_exists('email', $_POST) )\r
 738                         {\r
 739                                 $contents['email'] = $_POST['email'];\r
 740                         }\r
 741                         if ( array_key_exists('url', $_POST) )\r
 742                         {\r
 743                                 $contents['url'] = $_POST['url'];\r
 744                         }\r
 745                         \r
 746                         self::$contents = $contents;\r
 747                         \r
 748                 }\r
 749                 \r
 750                 self::$skin->parse('createaccountinput');\r
 751                 return;\r
 752         }\r
 753         \r
 754         /**\r
 755          * Admin::action_createitem()\r
 756          * Provide a page to item a new item to the given blog\r
 757          * \r
 758          * @param       void\r
 759          * @return      void\r
 760          */\r
 761         static private function action_createitem()\r
 762         {\r
 763                 global $member, $manager;\r
 764                 \r
 765                 $blogid = intRequestVar('blogid');\r
 766                 \r
 767                 // check if allowed\r
 768                 $member->teamRights($blogid) or self::disallow();\r
 769                 \r
 770                 $blog =& $manager->getBlog($blogid);\r
 771                 $contents = array();\r
 772                 \r
 773                 $data = array(\r
 774                         'blog'          => &$blog,\r
 775                         'contents'      => &$contents\r
 776                 );\r
 777                 $manager->notify('PreAddItemForm', $data);\r
 778                 \r
 779                 if ( $blog->convertBreaks() )\r
 780                 {\r
 781                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 782                         {\r
 783                                 $contents['body'] = removeBreaks($contents['body']);\r
 784                         }\r
 785                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 786                         {\r
 787                                 $contents['more'] = removeBreaks($contents['more']);\r
 788                         }\r
 789                 }\r
 790                 \r
 791                 self::$blog = &$blog;\r
 792                 self::$contents = &$contents;\r
 793                 \r
 794                 self::$skin->parse('createitem');\r
 795                 return;\r
 796         }\r
 797         \r
 798         /**\r
 799          * Admin::action_itemedit()\r
 800          * \r
 801          * @param       void\r
 802          * @return      void\r
 803          */\r
 804         static private function action_itemedit()\r
 805         {\r
 806                 global $member, $manager;\r
 807                 \r
 808                 $itemid = intRequestVar('itemid');\r
 809                 \r
 810                 // only allow if user is allowed to alter item\r
 811                 $member->canAlterItem($itemid) or self::disallow();\r
 812                 \r
 813                 $item =& $manager->getItem($itemid, 1, 1);\r
 814                 $blog =& $manager->getBlog($item['blogid']);\r
 815                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 816                 \r
 817                 if ( $blog->convertBreaks() )\r
 818                 {\r
 819                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 820                         {\r
 821                                 $item['body'] = removeBreaks($item['body']);\r
 822                         }\r
 823                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 824                         {\r
 825                                 $item['more'] = removeBreaks($item['more']);\r
 826                         }\r
 827                 }\r
 828                 \r
 829                 self::$blog = &$blog;\r
 830                 self::$contents = &$item;\r
 831                 \r
 832                 self::$skin->parse('itemedit');\r
 833                 return;\r
 834         }\r
 835         \r
 836         /**\r
 837          * Admin::action_itemupdate()\r
 838          * \r
 839          * @param       void\r
 840          * @return      void\r
 841          */\r
 842         static private function action_itemupdate()\r
 843         {\r
 844                 global $member, $manager, $CONF;\r
 845                 \r
 846                 $itemid = intRequestVar('itemid');\r
 847                 $catid  = postVar('catid');\r
 848                 \r
 849                 // only allow if user is allowed to alter item\r
 850                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 851                 \r
 852                 $actiontype = postVar('actiontype');\r
 853                 \r
 854                 // delete actions are handled by itemdelete (which has confirmation)\r
 855                 if ( $actiontype == 'delete' )\r
 856                 {\r
 857                         self::action_itemdelete();\r
 858                         return;\r
 859                 }\r
 860                 \r
 861                 $body           = postVar('body');\r
 862                 $title          = postVar('title');\r
 863                 $more           = postVar('more');\r
 864                 $closed         = intPostVar('closed');\r
 865                 $draftid        = intPostVar('draftid');\r
 866                 \r
 867                 // default action = add now\r
 868                 if ( !$actiontype )\r
 869                 {\r
 870                         $actiontype='addnow';\r
 871                 }\r
 872                 \r
 873                 // create new category if needed\r
 874                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 875                 {\r
 876                         // get blogid\r
 877                         list($blogid) = sscanf($catid,"newcat-%d");\r
 878                         \r
 879                         // create\r
 880                         $blog =& $manager->getBlog($blogid);\r
 881                         $catid = $blog->createNewCategory();\r
 882                         \r
 883                         // show error when sth goes wrong\r
 884                         if ( !$catid )\r
 885                         {\r
 886                                 self::doError(_ERROR_CATCREATEFAIL);\r
 887                         }\r
 888                 }\r
 889                 \r
 890                 /**\r
 891                  * set some variables based on actiontype\r
 892                  * \r
 893                  * actiontypes:\r
 894                  *      draft items -> addnow, addfuture, adddraft, delete\r
 895                  *      non-draft items -> edit, changedate, delete\r
 896                  * \r
 897                  * variables set:\r
 898                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 899                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 900                  *      $publish: set to 1 when the edited item is not a draft\r
 901                  */\r
 902                 $blogid =  getBlogIDFromItemID($itemid);\r
 903                 $blog =& $manager->getBlog($blogid);\r
 904                 \r
 905                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 906                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 907                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 908                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 909                 {\r
 910                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 911                 }\r
 912                 else\r
 913                 {\r
 914                         $timestamp =0;\r
 915                 }\r
 916                 \r
 917                 // edit the item for real\r
 918                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 919                 \r
 920                 self::updateFuturePosted($blogid);\r
 921                 \r
 922                 if ( $draftid > 0 )\r
 923                 {\r
 924                         // delete permission is checked inside Item::delete()\r
 925                         Item::delete($draftid);\r
 926                 }\r
 927                 \r
 928                 if ( $catid != intPostVar('catid') )\r
 929                 {\r
 930                         self::action_categoryedit(\r
 931                                 $catid,\r
 932                                 $blog->getID(),\r
 933                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 934                         );\r
 935                 }\r
 936                 else\r
 937                 {\r
 938                         // TODO: set start item correctly for itemlist\r
 939                         $item =& $manager->getitem($itemid, 1, 1);\r
 940                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 941                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 942                         $cnt  = DB::getValue($query);\r
 943                         $_REQUEST['start'] = $cnt + 1;\r
 944                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 945                 }\r
 946                 return;\r
 947         }\r
 948         \r
 949         /**\r
 950          * Admin::action_itemdelete()\r
 951          * Delete item\r
 952          * \r
 953          * @param       Void\r
 954          * @return      Void\r
 955          */\r
 956         static private function action_itemdelete()\r
 957         {\r
 958                 global $member, $manager;\r
 959                 \r
 960                 $itemid = intRequestVar('itemid');\r
 961                 \r
 962                 // only allow if user is allowed to alter item\r
 963                 $member->canAlterItem($itemid) or self::disallow();\r
 964                 \r
 965                 if ( !$manager->existsItem($itemid,1,1) )\r
 966                 {\r
 967                         self::error(_ERROR_NOSUCHITEM);\r
 968                         return;\r
 969                 }\r
 970                 \r
 971                 self::$skin->parse('itemdelete');\r
 972                 return;\r
 973         }\r
 974         \r
 975         /**\r
 976          * Admin::action_itemdeleteconfirm()\r
 977          * \r
 978          * @param       void\r
 979          * @return      void\r
 980          */\r
 981         static private function action_itemdeleteconfirm()\r
 982         {\r
 983                 global $member, $manager;\r
 984                 \r
 985                 $itemid = intRequestVar('itemid');\r
 986                 \r
 987                 // only allow if user is allowed to alter item\r
 988                 $member->canAlterItem($itemid) or self::disallow();\r
 989                 \r
 990                 // get item first\r
 991                 $item =& $manager->getItem($itemid, 1, 1);\r
 992                 \r
 993                 // delete item (note: some checks will be performed twice)\r
 994                 self::deleteOneItem($item['itemid']);\r
 995                 \r
 996                 self::action_itemlist($item['blogid']);\r
 997                 return;\r
 998         }\r
 999         \r
1000         /**\r
1001          * Admin::deleteOneItem()\r
1002          * Deletes one item and returns error if something goes wrong\r
1003          * \r
1004          * @param       integer $itemid ID for item\r
1005          * @return      void\r
1006          */\r
1007         static public function deleteOneItem($itemid)\r
1008         {\r
1009                 global $member, $manager;\r
1010                 \r
1011                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1012                 if ( !$member->canAlterItem($itemid) )\r
1013                 {\r
1014                         return _ERROR_DISALLOWED;\r
1015                 }\r
1016                 \r
1017                 // need to get blogid before the item is deleted\r
1018                 $item =& $manager->getItem($itemid, 1, 1);\r
1019                 \r
1020                 $manager->loadClass('ITEM');\r
1021                 Item::delete($item['itemid']);\r
1022                 \r
1023                 // update blog's futureposted\r
1024                 self::updateFuturePosted($item['itemid']);\r
1025                 return;\r
1026         }\r
1027         \r
1028         /**\r
1029          * Admin::updateFuturePosted()\r
1030          * Update a blog's future posted flag\r
1031          * \r
1032          * @param integer $blogid\r
1033          * @return      void\r
1034          */\r
1035         static private function updateFuturePosted($blogid)\r
1036         {\r
1037                 global $manager;\r
1038                 \r
1039                 $blogid                 =  intval($blogid);\r
1040                 $blog                   =& $manager->getBlog($blogid);\r
1041                 $currenttime    =  $blog->getCorrectTime(time());\r
1042                 \r
1043                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1044                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1045                 $result = DB::getResult($query);\r
1046                 \r
1047                 if ( $result->rowCount() > 0 )\r
1048                 {\r
1049                                 $blog->setFuturePost();\r
1050                 }\r
1051                 else\r
1052                 {\r
1053                                 $blog->clearFuturePost();\r
1054                 }\r
1055                 return;\r
1056         }\r
1057 \r
1058         /**\r
1059          * Admin::action_itemmove()\r
1060          * \r
1061          * @param       void\r
1062          * @return      void\r
1063          */\r
1064         static private function action_itemmove()\r
1065         {\r
1066                 global $member, $manager;\r
1067                 \r
1068                 $itemid = intRequestVar('itemid');\r
1069                 \r
1070                 $member->canAlterItem($itemid) or self::disallow();\r
1071                 \r
1072                 self::$skin->parse('itemmove');\r
1073                 return;\r
1074         }\r
1075         \r
1076         /**\r
1077          * Admin::action_itemmoveto()\r
1078          * \r
1079          * @param       void\r
1080          * @return      void\r
1081          */\r
1082         static private function action_itemmoveto()\r
1083         {\r
1084                 global $member, $manager;\r
1085                 \r
1086                 $itemid = intRequestVar('itemid');\r
1087                 $catid = requestVar('catid');\r
1088                 \r
1089                 // create new category if needed\r
1090                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1091                 {\r
1092                         // get blogid\r
1093                         list($blogid) = sscanf($catid,'newcat-%d');\r
1094                         \r
1095                         // create\r
1096                         $blog =& $manager->getBlog($blogid);\r
1097                         $catid = $blog->createNewCategory();\r
1098                         \r
1099                         // show error when sth goes wrong\r
1100                         if ( !$catid )\r
1101                         {\r
1102                                 self::doError(_ERROR_CATCREATEFAIL);\r
1103                         }\r
1104                 }\r
1105                 \r
1106                 // only allow if user is allowed to alter item\r
1107                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1108                 \r
1109                 $old_blogid = getBlogIDFromItemId($itemid);\r
1110                 \r
1111                 Item::move($itemid, $catid);\r
1112                 \r
1113                 // set the futurePosted flag on the blog\r
1114                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1115                 \r
1116                 // reset the futurePosted in case the item is moved from one blog to another\r
1117                 self::updateFuturePosted($old_blogid);\r
1118                 \r
1119                 if ( $catid != intRequestVar('catid') )\r
1120                 {\r
1121                         self::action_categoryedit($catid, $blog->getID());\r
1122                 }\r
1123                 else\r
1124                 {\r
1125                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1126                 }\r
1127                 return;\r
1128         }\r
1129         \r
1130         /**\r
1131          * Admin::moveOneItem()\r
1132          * Moves one item to a given category (category existance should be checked by caller)\r
1133          * errors are returned\r
1134          * \r
1135          * @param       integer $itemid         ID for item\r
1136          * @param       integer $destCatid      ID for category to which the item will be moved\r
1137          * @return      void\r
1138          */\r
1139         static public function moveOneItem($itemid, $destCatid)\r
1140         {\r
1141                 global $member;\r
1142                 \r
1143                 // only allow if user is allowed to move item\r
1144                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1145                 {\r
1146                         return _ERROR_DISALLOWED;\r
1147                 }\r
1148                 \r
1149                 Item::move($itemid, $destCatid);\r
1150                 return;\r
1151         }\r
1152         \r
1153         /**\r
1154          * Admin::action_additem()\r
1155          * Adds a item to the chosen blog\r
1156          * \r
1157          * @param       void\r
1158          * @return      void\r
1159          */\r
1160         static private function action_additem()\r
1161         {\r
1162                 global $manager, $CONF;\r
1163                 \r
1164                 $manager->loadClass('ITEM');\r
1165                 \r
1166                 $result = Item::createFromRequest();\r
1167                 \r
1168                 if ( $result['status'] == 'error' )\r
1169                 {\r
1170                         self::error($result['message']);\r
1171                         return;\r
1172                 }\r
1173                 \r
1174                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1175                 \r
1176                 if ( $result['status'] == 'newcategory' )\r
1177                 {\r
1178                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1179                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1180                 }\r
1181                 else\r
1182                 {\r
1183                         $methodName = 'action_itemlist';\r
1184                         self::action_itemlist($item['blogid']);\r
1185                 }\r
1186                 return;\r
1187         }\r
1188         \r
1189         /**\r
1190          * Admin::action_commentedit()\r
1191          * Allows to edit previously made comments\r
1192          * \r
1193          * @param       void\r
1194          * @return      void\r
1195          */\r
1196         static private function action_commentedit()\r
1197         {\r
1198                 global $member, $manager;\r
1199                 \r
1200                 $commentid = intRequestVar('commentid');\r
1201                 \r
1202                 $member->canAlterComment($commentid) or self::disallow();\r
1203                 \r
1204                 $comment = COMMENT::getComment($commentid);\r
1205                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));\r
1206                 \r
1207                 self::$contents = $comment;\r
1208                 self::$skin->parse('commentedit');\r
1209                 return;\r
1210         }\r
1211         \r
1212         /**\r
1213          * Admin::action_commentupdate()\r
1214          * \r
1215          * @param       void\r
1216          * @return      void\r
1217          */\r
1218         static private function action_commentupdate()\r
1219         {\r
1220                 global $member, $manager;\r
1221                 \r
1222                 $commentid = intRequestVar('commentid');\r
1223                 \r
1224                 $member->canAlterComment($commentid) or self::disallow();\r
1225                 \r
1226                 $url    = postVar('url');\r
1227                 $email  = postVar('email');\r
1228                 $body   = postVar('body');\r
1229                 \r
1230                 // intercept words that are too long\r
1231                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1232                 {\r
1233                         self::error(_ERROR_COMMENT_LONGWORD);\r
1234                         return;\r
1235                 }\r
1236                 \r
1237                 // check length\r
1238                 if ( i18n::strlen($body) < 3 )\r
1239                 {\r
1240                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1241                         return;\r
1242                 }\r
1243                 \r
1244                 if ( i18n::strlen($body) > 5000 )\r
1245                 {\r
1246                         self::error(_ERROR_COMMENT_TOOLONG);\r
1247                         return;\r
1248                 }\r
1249                 \r
1250                 // prepare body\r
1251                 $body = Comment::prepareBody($body);\r
1252                 \r
1253                 // call plugins\r
1254                 $data = array(\r
1255                         'body' => &$body\r
1256                 );\r
1257                 $manager->notify('PreUpdateComment', $data);\r
1258                 \r
1259                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1260                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1261                 DB::execute($query);\r
1262                 \r
1263                 // get itemid\r
1264                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1265                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1266                 \r
1267                 $itemid = DB::getValue($query);\r
1268                 \r
1269                 if ( $member->canAlterItem($itemid) )\r
1270                 {\r
1271                         self::action_itemcommentlist($itemid);\r
1272                 }\r
1273                 else\r
1274                 {\r
1275                         self::action_browseowncomments();\r
1276                 }\r
1277                 return;\r
1278         }\r
1279         \r
1280         /**\r
1281          * Admin::action_commentdelete()\r
1282          * Update comment\r
1283          * \r
1284          * @param       void\r
1285          * @return      void\r
1286          */\r
1287         static private function action_commentdelete()\r
1288         {\r
1289                 global $member, $manager;\r
1290                 \r
1291                 $commentid = intRequestVar('commentid');\r
1292                 $member->canAlterComment($commentid) or self::disallow();\r
1293                 \r
1294                 self::$skin->parse('commentdelete');\r
1295                 return;\r
1296         }\r
1297         \r
1298         /**\r
1299          * Admin::action_commentdeleteconfirm()\r
1300          * \r
1301          * @param       void\r
1302          * @return      void\r
1303          */\r
1304         static private function action_commentdeleteconfirm()\r
1305         {\r
1306                 global $member;\r
1307                 \r
1308                 $commentid = intRequestVar('commentid');\r
1309                 \r
1310                 // get item id first\r
1311                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1312                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1313                 \r
1314                 $itemid = DB::getValue($query);\r
1315                 \r
1316                 $error = self::deleteOneComment($commentid);\r
1317                 if ( $error )\r
1318                 {\r
1319                         self::doError($error);\r
1320                 }\r
1321                 \r
1322                 if ( $member->canAlterItem($itemid) )\r
1323                 {\r
1324                         self::action_itemcommentlist($itemid);\r
1325                 }\r
1326                 else\r
1327                 {\r
1328                         self::action_browseowncomments();\r
1329                 }\r
1330                 return;\r
1331         }\r
1332         \r
1333         /**\r
1334          * Admin::deleteOneComment()\r
1335          * \r
1336          * @param       integer $commentid      ID for comment\r
1337          * @return      void\r
1338          */\r
1339         static public function deleteOneComment($commentid)\r
1340         {\r
1341                 global $member, $manager;\r
1342                 \r
1343                 $commentid = (integer) $commentid;\r
1344                 \r
1345                 if ( !$member->canAlterComment($commentid) )\r
1346                 {\r
1347                         return _ERROR_DISALLOWED;\r
1348                 }\r
1349                 \r
1350                 $data = array(\r
1351                         'commentid' => $commentid\r
1352                 );\r
1353                 \r
1354                 $manager->notify('PreDeleteComment', $data);\r
1355                 \r
1356                 // delete the comments associated with the item\r
1357                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1358                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1359                 DB::execute($query);\r
1360                 \r
1361                 $data = array(\r
1362                         'commentid' => $commentid\r
1363                 );\r
1364                 \r
1365                 $manager->notify('PostDeleteComment', $data);\r
1366                 \r
1367                 return '';\r
1368         }\r
1369         \r
1370         /**\r
1371          * Admin::action_usermanagement()\r
1372          * Usermanagement main\r
1373          * \r
1374          * @param       void\r
1375          * @return      void\r
1376          */\r
1377         static private function action_usermanagement()\r
1378         {\r
1379                 global $member, $manager;\r
1380                 \r
1381                 // check if allowed\r
1382                 $member->isAdmin() or self::disallow();\r
1383                 \r
1384                 self::$skin->parse('usermanagement');\r
1385                 return;\r
1386         }\r
1387         \r
1388         /**\r
1389          * Admin::action_memberedit()\r
1390          * Edit member settings\r
1391          * \r
1392          * @param       void\r
1393          * @return      void\r
1394          */\r
1395         static private function action_memberedit()\r
1396         {\r
1397                 self::action_editmembersettings(intRequestVar('memberid'));\r
1398                 return;\r
1399         }\r
1400         \r
1401         /**\r
1402          * Admin::action_editmembersettings()\r
1403          * \r
1404          * @param       integer $memberid       ID for member\r
1405          * @return      void\r
1406          * \r
1407          */\r
1408         static private function action_editmembersettings($memberid = '')\r
1409         {\r
1410                 global $member, $manager, $CONF;\r
1411                 \r
1412                 if ( $memberid == '' )\r
1413                 {\r
1414                         $memberid = $member->getID();\r
1415                 }\r
1416                 \r
1417                 /* TODO: we should consider to use the other way insterad of this */\r
1418                 $_REQUEST['memberid'] = $memberid;\r
1419                 \r
1420                 // check if allowed\r
1421                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1422                 \r
1423                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
1424                 \r
1425                 self::$skin->parse('editmembersettings');\r
1426                 return;\r
1427         }\r
1428         \r
1429         /**\r
1430          * Admin::action_changemembersettings()\r
1431          * \r
1432          * @param       void\r
1433          * @return      void\r
1434          */\r
1435         static private function action_changemembersettings()\r
1436         {\r
1437                 global $member, $CONF, $manager;\r
1438                 \r
1439                 $memberid = intRequestVar('memberid');\r
1440                 \r
1441                 // check if allowed\r
1442                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1443                 \r
1444                 $name                   = trim(strip_tags(postVar('name')));\r
1445                 $realname               = trim(strip_tags(postVar('realname')));\r
1446                 $password               = postVar('password');\r
1447                 $repeatpassword = postVar('repeatpassword');\r
1448                 $email                  = strip_tags(postVar('email'));\r
1449                 $url                    = strip_tags(postVar('url'));\r
1450                 $adminskin              = intPostVar('adminskin');\r
1451                 $bookmarklet    = intPostVar('bookmarklet');\r
1452                 \r
1453                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1454                 if ( !preg_match('#^https?://#', $url) )\r
1455                 {\r
1456                         $url = 'http://' . $url;\r
1457                 }\r
1458                 \r
1459                 $admin          = postVar('admin');\r
1460                 $canlogin       = postVar('canlogin');\r
1461                 $notes          = strip_tags(postVar('notes'));\r
1462                 $locale         = postVar('locale');\r
1463                 \r
1464                 $mem =& $manager->getMember($memberid);\r
1465                 \r
1466                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1467                 {\r
1468                         if ( !isValidDisplayName($name) )\r
1469                         {\r
1470                                 self::error(_ERROR_BADNAME);\r
1471                                 return;\r
1472                         }\r
1473                         \r
1474                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1475                         {\r
1476                                 self::error(_ERROR_NICKNAMEINUSE);\r
1477                                 return;\r
1478                         }\r
1479                         \r
1480                         if ( $password != $repeatpassword )\r
1481                         {\r
1482                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1483                                 return;\r
1484                         }\r
1485                         \r
1486                         if ( $password && (i18n::strlen($password) < 6) )\r
1487                         {\r
1488                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1489                                 return;\r
1490                         }\r
1491                                 \r
1492                         if ( $password )\r
1493                         {\r
1494                                 $pwdvalid = true;\r
1495                                 $pwderror = '';\r
1496                                 \r
1497                                 $data = array(\r
1498                                         'password'     => $password,\r
1499                                         'errormessage' => &$pwderror,\r
1500                                         'valid'        => &$pwdvalid\r
1501                                 );\r
1502                                 $manager->notify('PrePasswordSet', $data);\r
1503                                 \r
1504                                 if ( !$pwdvalid )\r
1505                                 {\r
1506                                         self::error($pwderror);\r
1507                                         return;\r
1508                                 }\r
1509                         }\r
1510                 }\r
1511                 \r
1512                 if ( !NOTIFICATION::address_validation($email) )\r
1513                 {\r
1514                         self::error(_ERROR_BADMAILADDRESS);\r
1515                         return;\r
1516                 }\r
1517                 if ( !$realname )\r
1518                 {\r
1519                         self::error(_ERROR_REALNAMEMISSING);\r
1520                         return;\r
1521                 }\r
1522                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1523                 {\r
1524                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1525                         return;\r
1526                 }\r
1527                 \r
1528                 // check if there will remain at least one site member with both the logon and admin rights\r
1529                 // (check occurs when taking away one of these rights from such a member)\r
1530                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1531                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1532                         )\r
1533                 {\r
1534                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1535                         if ( $r->rowCount() < 2 )\r
1536                         {\r
1537                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1538                                 return;\r
1539                         }\r
1540                 }\r
1541                 \r
1542                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1543                 {\r
1544                         $mem->setDisplayName($name);\r
1545                         if ( $password )\r
1546                         {\r
1547                                 $mem->setPassword($password);\r
1548                         }\r
1549                 }\r
1550                 \r
1551                 $oldEmail = $mem->getEmail();\r
1552                 \r
1553                 $mem->setRealName($realname);\r
1554                 $mem->setEmail($email);\r
1555                 $mem->setURL($url);\r
1556                 $mem->setNotes($notes);\r
1557                 $mem->setLocale($locale);\r
1558                 $mem->setAdminSkin($adminskin);\r
1559                 $mem->setBookmarklet($bookmarklet);\r
1560 \r
1561                 // only allow super-admins to make changes to the admin status\r
1562                 if ( $member->isAdmin() )\r
1563                 {\r
1564                         $mem->setAdmin($admin);\r
1565                         $mem->setCanLogin($canlogin);\r
1566                 }\r
1567                 \r
1568                 $autosave = postVar('autosave');\r
1569                 $mem->setAutosave($autosave);\r
1570                 \r
1571                 $mem->write();\r
1572                 \r
1573                 // store plugin options\r
1574                 $aOptions = requestArray('plugoption');\r
1575                 NucleusPlugin::apply_plugin_options($aOptions);\r
1576                 $data = array(\r
1577                         'context'  => 'member',\r
1578                         'memberid' => $memberid,\r
1579                         'member'   => &$mem\r
1580                 );\r
1581                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1582                 \r
1583                 // if email changed, generate new password\r
1584                 if ( $oldEmail != $mem->getEmail() )\r
1585                 {\r
1586                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1587                         // logout member\r
1588                         $mem->newCookieKey();\r
1589                         \r
1590                         // only log out if the member being edited is the current member.\r
1591                         if ( $member->getID() == $memberid )\r
1592                         {\r
1593                                 $member->logout();\r
1594                         }\r
1595                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1596                         return;\r
1597                 }\r
1598                 \r
1599                 if ( ($mem->getID() == $member->getID())\r
1600                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1601                 {\r
1602                         $mem->newCookieKey();\r
1603                         $member->logout();\r
1604                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1605                 }\r
1606                 else\r
1607                 {\r
1608                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1609                 }\r
1610                 return;\r
1611         }\r
1612 \r
1613         /**\r
1614          * Admin::action_memberadd()\r
1615          * \r
1616          * @param       void\r
1617          * @return      void\r
1618          * \r
1619          */\r
1620         static private function action_memberadd()\r
1621         {\r
1622                 global $member, $manager;\r
1623                 \r
1624                 // check if allowed\r
1625                 $member->isAdmin() or self::disallow();\r
1626                 \r
1627                 if ( postVar('password') != postVar('repeatpassword') )\r
1628                 {\r
1629                         self::error(_ERROR_PASSWORDMISMATCH);\r
1630                         return;\r
1631                 }\r
1632                 \r
1633                 if ( i18n::strlen(postVar('password')) < 6 )\r
1634                 {\r
1635                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1636                         return;\r
1637                 }\r
1638                 \r
1639                 $res = Member::create(\r
1640                         postVar('name'),\r
1641                         postVar('realname'),\r
1642                         postVar('password'),\r
1643                         postVar('email'),\r
1644                         postVar('url'),\r
1645                         postVar('admin'),\r
1646                         postVar('canlogin'),\r
1647                         postVar('notes')\r
1648                 );\r
1649                 \r
1650                 if ( $res != 1 )\r
1651                 {\r
1652                         self::error($res);\r
1653                         return;\r
1654                 }\r
1655                 \r
1656                 // fire PostRegister event\r
1657                 $newmem = new Member();\r
1658                 $newmem->readFromName(postVar('name'));\r
1659                 $data = array(\r
1660                         'member' => &$newmem\r
1661                 );\r
1662                 $manager->notify('PostRegister', $data);\r
1663                 \r
1664                 self::action_usermanagement();\r
1665                 return;\r
1666         }\r
1667         \r
1668         /**\r
1669          * Admin::action_forgotpassword()\r
1670          * \r
1671          * @param       void\r
1672          * @return      void\r
1673          */\r
1674         static private function action_forgotpassword()\r
1675         {\r
1676                 self::$skin->parse('forgotpassword');\r
1677                 return;\r
1678         }\r
1679         \r
1680         /**\r
1681          * Admin::action_activate()\r
1682          * Account activation\r
1683          * \r
1684          * @param       void\r
1685          * @return      void\r
1686          */\r
1687         static private function action_activate()\r
1688         {\r
1689                 $key = getVar('key');\r
1690                 self::showActivationPage($key);\r
1691                 return;\r
1692         }\r
1693         \r
1694         /**\r
1695          * Admin::showActivationPage()\r
1696          * \r
1697          * @param       void\r
1698          * @return      void\r
1699          */\r
1700         static private function showActivationPage($key, $message = '')\r
1701         {\r
1702                 global $manager;\r
1703                 \r
1704                 // clean up old activation keys\r
1705                 Member::cleanupActivationTable();\r
1706                 \r
1707                 // get activation info\r
1708                 $info = Member::getActivationInfo($key);\r
1709                 \r
1710                 if ( !$info )\r
1711                 {\r
1712                         self::error(_ERROR_ACTIVATE);\r
1713                         return;\r
1714                 }\r
1715                 \r
1716                 $mem =& $manager->getMember($info->vmember);\r
1717                 \r
1718                 if ( !$mem )\r
1719                 {\r
1720                         self::error(_ERROR_ACTIVATE);\r
1721                         return;\r
1722                 }\r
1723                 \r
1724                 /* TODO: we should consider to use the other way insterad of this */\r
1725                 $_POST['ackey']                                 = $key;\r
1726                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1727                 \r
1728                 self::$headMess = $message;\r
1729                 self::$skin->parse('activate');\r
1730                 return;\r
1731         }\r
1732         \r
1733         /**\r
1734          * Admin::action_activatesetpwd()\r
1735          * Account activation - set password part\r
1736          * \r
1737          * @param       void\r
1738          * @return      void\r
1739          */\r
1740         static private function action_activatesetpwd()\r
1741         {\r
1742                 global $manager;\r
1743                 $key = postVar('key');\r
1744                 \r
1745                 // clean up old activation keys\r
1746                 Member::cleanupActivationTable();\r
1747                 \r
1748                 // get activation info\r
1749                 $info = Member::getActivationInfo($key);\r
1750                 \r
1751                 if ( !$info || ($info->type == 'addresschange') )\r
1752                 {\r
1753                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1754                 }\r
1755                 \r
1756                 $mem =& $manager->getMember($info->vmember);\r
1757                 \r
1758                 if ( !$mem )\r
1759                 {\r
1760                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1761                 }\r
1762                 \r
1763                 $password               = postVar('password');\r
1764                 $repeatpassword = postVar('repeatpassword');\r
1765                 \r
1766                 if ( $password != $repeatpassword )\r
1767                 {\r
1768                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1769                 }\r
1770                 \r
1771                 if ( $password && (i18n::strlen($password) < 6) )\r
1772                 {\r
1773                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1774                 }\r
1775                         \r
1776                 if ( $password )\r
1777                 {\r
1778                         $pwdvalid = true;\r
1779                         $pwderror = '';\r
1780                         \r
1781                         $data = array(\r
1782                                 'password'              => $password,\r
1783                                 'errormessage'  => &$pwderror,\r
1784                                 'valid'                 => &$pwdvalid\r
1785                         );\r
1786                         $manager->notify('PrePasswordSet', $data);\r
1787                         if ( !$pwdvalid )\r
1788                         {\r
1789                                 return self::showActivationPage($key,$pwderror);\r
1790                         }\r
1791                 }\r
1792                 \r
1793                 $error = '';\r
1794                 \r
1795                 $data = array(\r
1796                         'type'   => 'activation',\r
1797                         'member' => $mem,\r
1798                         'error'  => &$error\r
1799                 );\r
1800                 $manager->notify('ValidateForm', $data);\r
1801                 if ( $error != '' )\r
1802                 {\r
1803                         return self::showActivationPage($key, $error);\r
1804                 }\r
1805                 \r
1806                 // set password\r
1807                 $mem->setPassword($password);\r
1808                 $mem->write();\r
1809                 \r
1810                 // do the activation\r
1811                 Member::activate($key);\r
1812                 \r
1813                 self::$skin->parse('activatesetpwd');\r
1814                 return;\r
1815         }\r
1816         \r
1817         /**\r
1818          * Admin::action_manageteam()\r
1819          * Manage team\r
1820          * \r
1821          * @param       void\r
1822          * @return      void\r
1823          */\r
1824         static private function action_manageteam()\r
1825         {\r
1826                 global $member, $manager;\r
1827                 \r
1828                 $blogid = intRequestVar('blogid');\r
1829                 \r
1830                 // check if allowed\r
1831                 $member->blogAdminRights($blogid) or self::disallow();\r
1832                 \r
1833                 self::$skin->parse('manageteam');\r
1834                 return;\r
1835         }\r
1836         \r
1837         /**\r
1838          * Admin::action_teamaddmember()\r
1839          * Add member to team\r
1840          * \r
1841          * @param       void\r
1842          * @return      void\r
1843          */\r
1844         static private function action_teamaddmember()\r
1845         {\r
1846                 global $member, $manager;\r
1847                 \r
1848                 $memberid       = intPostVar('memberid');\r
1849                 $blogid         = intPostVar('blogid');\r
1850                 $admin          = intPostVar('admin');\r
1851                 \r
1852                 // check if allowed\r
1853                 $member->blogAdminRights($blogid) or self::disallow();\r
1854                 \r
1855                 $blog =& $manager->getBlog($blogid);\r
1856                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1857                 {\r
1858                         self::error(_ERROR_ALREADYONTEAM);\r
1859                         return;\r
1860                 }\r
1861                 \r
1862                 self::action_manageteam();\r
1863                 return;\r
1864         }\r
1865         \r
1866         /**\r
1867          * Admin::action_teamdelete()\r
1868          * \r
1869          * @param       void\r
1870          * @return      void\r
1871          */\r
1872         static private function action_teamdelete()\r
1873         {\r
1874                 global $member, $manager;\r
1875                 \r
1876                 $memberid       = intRequestVar('memberid');\r
1877                 $blogid         = intRequestVar('blogid');\r
1878                 \r
1879                 // check if allowed\r
1880                 $member->blogAdminRights($blogid) or self::disallow();\r
1881                 \r
1882                 $teammem =& $manager->getMember($memberid);\r
1883                 $blog =& $manager->getBlog($blogid);\r
1884                 \r
1885                 self::$skin->parse('teamdelete');\r
1886                 return;\r
1887         }\r
1888         \r
1889         /**\r
1890          * Admin::action_teamdeleteconfirm()\r
1891          * \r
1892          * @param       void\r
1893          * @return      void\r
1894          */\r
1895         static private function action_teamdeleteconfirm()\r
1896         {\r
1897                 global $member;\r
1898                 \r
1899                 $memberid = intRequestVar('memberid');\r
1900                 $blogid = intRequestVar('blogid');\r
1901                 \r
1902                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1903                 if ( $error )\r
1904                 {\r
1905                         self::error($error);\r
1906                         return;\r
1907                 }\r
1908                 self::action_manageteam();\r
1909                 return;\r
1910         }\r
1911         \r
1912         /**\r
1913          * Admin::deleteOneTeamMember()\r
1914          * \r
1915          * @param       void\r
1916          * @return      void\r
1917          */\r
1918         static public function deleteOneTeamMember($blogid, $memberid)\r
1919         {\r
1920                 global $member, $manager;\r
1921                 \r
1922                 $blogid   = intval($blogid);\r
1923                 $memberid = intval($memberid);\r
1924                 \r
1925                 // check if allowed\r
1926                 if ( !$member->blogAdminRights($blogid) )\r
1927                 {\r
1928                         return _ERROR_DISALLOWED;\r
1929                 }\r
1930                 \r
1931                 // check if: - there remains at least one blog admin\r
1932                 //           - (there remains at least one team member)\r
1933                 $tmem =& $manager->getMember($memberid);\r
1934                 \r
1935                 \r
1936                 $data = array(\r
1937                         'member' => &$tmem,\r
1938                         'blogid' => $blogid\r
1939                 );\r
1940                 $manager->notify('PreDeleteTeamMember', $data);\r
1941                 \r
1942                 if ( $tmem->isBlogAdmin($blogid) )\r
1943                 {\r
1944                         /* TODO: why we did double check? */\r
1945                         // check if there are more blog members left and at least one admin\r
1946                         // (check for at least two admins before deletion)\r
1947                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1948                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1949                         $r     = DB::getResult($query);\r
1950                         if ( $r->rowCount() < 2 )\r
1951                         {\r
1952                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1953                         }\r
1954                 }\r
1955                 \r
1956                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1957                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1958                 DB::execute($query);\r
1959                 \r
1960                 $data = array(\r
1961                         'member' => &$tmem,\r
1962                         'blogid' => $blogid\r
1963                 );\r
1964                 $manager->notify('PostDeleteTeamMember', $data);\r
1965                 \r
1966                 return '';\r
1967         }\r
1968         \r
1969         /**\r
1970          * Admin::action_teamchangeadmin()\r
1971          * \r
1972          * @param       void\r
1973          * @return      void\r
1974          */\r
1975         static private function action_teamchangeadmin()\r
1976         {\r
1977                 global $manager, $member;\r
1978                 \r
1979                 $blogid         = intRequestVar('blogid');\r
1980                 $memberid       = intRequestVar('memberid');\r
1981                 \r
1982                 // check if allowed\r
1983                 $member->blogAdminRights($blogid) or self::disallow();\r
1984                 \r
1985                 $mem =& $manager->getMember($memberid);\r
1986                 \r
1987                 // don't allow when there is only one admin at this moment\r
1988                 if ( $mem->isBlogAdmin($blogid) )\r
1989                 {\r
1990                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1991                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1992                         $r = DB::getResult($query);\r
1993                         if ( $r->rowCount() == 1 )\r
1994                         {\r
1995                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
1996                                 return;\r
1997                         }\r
1998                 }\r
1999                 \r
2000                 if ( $mem->isBlogAdmin($blogid) )\r
2001                 {\r
2002                         $newval = 0;\r
2003                 }\r
2004                 else\r
2005                 {\r
2006                         $newval = 1;\r
2007                 }\r
2008                 \r
2009                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2010                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2011                 DB::execute($query);\r
2012                 \r
2013                 // only show manageteam if member did not change its own admin privileges\r
2014                 if ( $member->isBlogAdmin($blogid) )\r
2015                 {\r
2016                         self::action_manageteam();\r
2017                 }\r
2018                 else\r
2019                 {\r
2020                         self::action_overview(_MSG_ADMINCHANGED);\r
2021                 }\r
2022                 return;\r
2023         }\r
2024         \r
2025         /**\r
2026          * Admin::action_blogsettings()\r
2027          * \r
2028          * @param       void\r
2029          * @return      void\r
2030          */\r
2031         static private function action_blogsettings()\r
2032         {\r
2033                 global $member, $manager;\r
2034                 \r
2035                 $blogid = intRequestVar('blogid');\r
2036                 \r
2037                 // check if allowed\r
2038                 $member->blogAdminRights($blogid) or self::disallow();\r
2039                 \r
2040                 $blog =& $manager->getBlog($blogid);\r
2041                 \r
2042                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2043                 \r
2044                 self::$skin->parse('blogsettings');\r
2045                 return;\r
2046         }\r
2047         \r
2048         /**\r
2049          * Admin::action_categorynew()\r
2050          * \r
2051          * @param       void\r
2052          * @return      void\r
2053          */\r
2054         static private function action_categorynew()\r
2055         {\r
2056                 global $member, $manager;\r
2057                 \r
2058                 $blogid = intRequestVar('blogid');\r
2059                 \r
2060                 $member->blogAdminRights($blogid) or self::disallow();\r
2061                 \r
2062                 $cname = postVar('cname');\r
2063                 $cdesc = postVar('cdesc');\r
2064                 \r
2065                 if ( !isValidCategoryName($cname) )\r
2066                 {\r
2067                         self::error(_ERROR_BADCATEGORYNAME);\r
2068                         return;\r
2069                 }\r
2070                 \r
2071                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2072                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2073                 $res = DB::getResult($query);\r
2074                 if ( $res->rowCount() > 0 )\r
2075                 {\r
2076                         self::error(_ERROR_DUPCATEGORYNAME);\r
2077                         return;\r
2078                 }\r
2079                 \r
2080                 $blog           =& $manager->getBlog($blogid);\r
2081                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2082                 \r
2083                 self::action_blogsettings();\r
2084                 return;\r
2085         }\r
2086         \r
2087         /**\r
2088          * Admin::action_categoryedit()\r
2089          * \r
2090          * @param       void\r
2091          * @return      void\r
2092          */\r
2093         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2094         {\r
2095                 global $member, $manager;\r
2096                 \r
2097                 if ( $blogid == '' )\r
2098                 {\r
2099                         $blogid = intGetVar('blogid');\r
2100                 }\r
2101                 else\r
2102                 {\r
2103                         $blogid = intval($blogid);\r
2104                 }\r
2105                 if ( $catid == '' )\r
2106                 {\r
2107                         $catid = intGetVar('catid');\r
2108                 }\r
2109                 else\r
2110                 {\r
2111                         $catid = intval($catid);\r
2112                 }\r
2113                 \r
2114                 /* TODO: we should consider to use the other way insterad of this */\r
2115                 $_REQUEST['blogid']             = $blogid;\r
2116                 $_REQUEST['catid']              = $catid;\r
2117                 $_REQUEST['desturl']    = $desturl;\r
2118                 $member->blogAdminRights($blogid) or self::disallow();\r
2119                 \r
2120                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2121                 \r
2122                 self::$skin->parse('categoryedit');\r
2123                 return;\r
2124         }\r
2125         \r
2126         /**\r
2127          * Admin::action_categoryupdate()\r
2128          * \r
2129          * @param       void\r
2130          * @return      void\r
2131          */\r
2132         static private function action_categoryupdate()\r
2133         {\r
2134                 global $member, $manager;\r
2135                 \r
2136                 $blogid         = intPostVar('blogid');\r
2137                 $catid          = intPostVar('catid');\r
2138                 $cname          = postVar('cname');\r
2139                 $cdesc          = postVar('cdesc');\r
2140                 $desturl        = postVar('desturl');\r
2141                 \r
2142                 $member->blogAdminRights($blogid) or self::disallow();\r
2143                 \r
2144                 if ( !isValidCategoryName($cname) )\r
2145                 {\r
2146                         self::error(_ERROR_BADCATEGORYNAME);\r
2147                         return;\r
2148                 }\r
2149                 \r
2150                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2151                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2152                 $res    = DB::getResult($query);\r
2153                 if ( $res->rowCount() > 0 )\r
2154                 {\r
2155                         self::error(_ERROR_DUPCATEGORYNAME);\r
2156                         return;\r
2157                 }\r
2158                 \r
2159                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2160                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2161                 DB::execute($query);\r
2162                 \r
2163                 // store plugin options\r
2164                 $aOptions = requestArray('plugoption');\r
2165                 NucleusPlugin::apply_plugin_options($aOptions);\r
2166                 $data = array(\r
2167                         'context'       => 'category',\r
2168                         'catid'         => $catid\r
2169                 );\r
2170                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2171                 \r
2172                 if ( $desturl )\r
2173                 {\r
2174                         redirect($desturl);\r
2175                         return;\r
2176                 }\r
2177                 \r
2178                 self::action_blogsettings();\r
2179                 \r
2180                 return;\r
2181         }\r
2182         \r
2183         /**\r
2184          * Admin::action_categorydelete()\r
2185          * \r
2186          * @param       void\r
2187          * @return      void\r
2188          */\r
2189         static private function action_categorydelete()\r
2190         {\r
2191                 global $member, $manager;\r
2192                 \r
2193                 $blogid = intRequestVar('blogid');\r
2194                 $catid  = intRequestVar('catid');\r
2195                 \r
2196                 $member->blogAdminRights($blogid) or self::disallow();\r
2197                 \r
2198                 $blog =& $manager->getBlog($blogid);\r
2199                 \r
2200                 // check if the category is valid\r
2201                 if ( !$blog->isValidCategory($catid) )\r
2202                 {\r
2203                         self::error(_ERROR_NOSUCHCATEGORY);\r
2204                         return;\r
2205                 }\r
2206                 \r
2207                 // don't allow deletion of default category\r
2208                 if ( $blog->getDefaultCategory() == $catid )\r
2209                 {\r
2210                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2211                         return;\r
2212                 }\r
2213                 \r
2214                 // check if catid is the only category left for blogid\r
2215                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2216                 $query = sprintf($query, sql_table('category'), $blogid);\r
2217                 $res = DB::getResult($query);\r
2218                 if ( $res->rowCount() == 1 )\r
2219                 {\r
2220                         self::error(_ERROR_DELETELASTCATEGORY);\r
2221                         return;\r
2222                 }\r
2223                 \r
2224                 self::$skin->parse('categorydelete');\r
2225                 return;\r
2226         }\r
2227         \r
2228         /**\r
2229          * Admin::action_categorydeleteconfirm()\r
2230          * \r
2231          * @param       void\r
2232          * @return      void\r
2233          */\r
2234         static private function action_categorydeleteconfirm()\r
2235         {\r
2236                 global $member, $manager;\r
2237                 \r
2238                 $blogid = intRequestVar('blogid');\r
2239                 $catid  = intRequestVar('catid');\r
2240                 \r
2241                 $member->blogAdminRights($blogid) or self::disallow();\r
2242                 \r
2243                 $error = self::deleteOneCategory($catid);\r
2244                 if ( $error )\r
2245                 {\r
2246                         self::error($error);\r
2247                         return;\r
2248                 }\r
2249                 \r
2250                 self::action_blogsettings();\r
2251                 return;\r
2252         }\r
2253         \r
2254         /**\r
2255          * Admin::deleteOneCategory()\r
2256          * Delete a category by its id\r
2257          * \r
2258          * @param       String  $catid  category id for deleting\r
2259          * @return      Void\r
2260          */\r
2261         static public function deleteOneCategory($catid)\r
2262         {\r
2263                 global $manager, $member;\r
2264                 \r
2265                 $catid  = intval($catid);\r
2266                 $blogid = getBlogIDFromCatID($catid);\r
2267                 \r
2268                 if ( !$member->blogAdminRights($blogid) )\r
2269                 {\r
2270                         return ERROR_DISALLOWED;\r
2271                 }\r
2272                 \r
2273                 // get blog\r
2274                 $blog =& $manager->getBlog($blogid);\r
2275                 \r
2276                 // check if the category is valid\r
2277                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2278                 {\r
2279                         return _ERROR_NOSUCHCATEGORY;\r
2280                 }\r
2281                 \r
2282                 $destcatid = $blog->getDefaultCategory();\r
2283                 \r
2284                 // don't allow deletion of default category\r
2285                 if ( $blog->getDefaultCategory() == $catid )\r
2286                 {\r
2287                         return _ERROR_DELETEDEFCATEGORY;\r
2288                 }\r
2289                 \r
2290                 // check if catid is the only category left for blogid\r
2291                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2292                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2293                 \r
2294                 $res = DB::getResult($query);\r
2295                 if ( $res->rowCount() == 1 )\r
2296                 {\r
2297                         return _ERROR_DELETELASTCATEGORY;\r
2298                 }\r
2299                 \r
2300                 $data = array('catid' => $catid);\r
2301                 $manager->notify('PreDeleteCategory', $data);\r
2302                 \r
2303                 // change category for all items to the default category\r
2304                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2305                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2306                 DB::execute($query);\r
2307                 \r
2308                 // delete all associated plugin options\r
2309                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2310                 \r
2311                 // delete category\r
2312                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2313                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2314                 DB::execute($query);\r
2315                 \r
2316                 $data = array('catid' => $catid);\r
2317                 $manager->notify('PostDeleteCategory', $data);\r
2318                 return;\r
2319         }\r
2320         \r
2321         /**\r
2322          * Admin::moveOneCategory()\r
2323          * Delete a category by its id\r
2324          * \r
2325          * @param       int     $catid          category id for move\r
2326          * @param       int     $destblogid     blog id for destination\r
2327          * @return      void\r
2328          */\r
2329         static public function moveOneCategory($catid, $destblogid)\r
2330         {\r
2331                 global $manager, $member;\r
2332                 $catid      = intval($catid);\r
2333                 $destblogid = intval($destblogid);\r
2334                 $blogid     = getBlogIDFromCatID($catid);\r
2335                 // mover should have admin rights on both blogs\r
2336                 if (!$member->blogAdminRights($blogid)) {\r
2337                         return _ERROR_DISALLOWED;\r
2338                 }\r
2339                 if (!$member->blogAdminRights($destblogid)) {\r
2340                         return _ERROR_DISALLOWED;\r
2341                 }\r
2342                 // cannot move to self\r
2343                 if ($blogid == $destblogid) {\r
2344                         return _ERROR_MOVETOSELF;\r
2345                 }\r
2346                 // get blogs\r
2347                 $blog     =& $manager->getBlog($blogid);\r
2348                 $destblog =& $manager->getBlog($destblogid);\r
2349                 // check if the category is valid\r
2350                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2351                         return _ERROR_NOSUCHCATEGORY;\r
2352                 }\r
2353                 // don't allow default category to be moved\r
2354                 if ($blog->getDefaultCategory() == $catid) {\r
2355                         return _ERROR_MOVEDEFCATEGORY;\r
2356                 }\r
2357                 $manager->notify(\r
2358                                 'PreMoveCategory',\r
2359                                 array(\r
2360                                                 'catid'      => &$catid,\r
2361                                                 'sourceblog' => &$blog,\r
2362                                                 'destblog'   => &$destblog\r
2363                                 )\r
2364                 );\r
2365                 // update comments table (cblog)\r
2366                 $query = 'SELECT '\r
2367                 . '    inumber '\r
2368                 . 'FROM '\r
2369                 .      sql_table('item') . ' '\r
2370                 . 'WHERE '\r
2371                 . '    icat = %d';\r
2372                 $items = sql_query(sprintf($query, $catid));\r
2373                 while ($oItem = sql_fetch_object($items)) {\r
2374                         $query = 'UPDATE '\r
2375                         .      sql_table('comment') . ' '\r
2376                         . 'SET '\r
2377                         . '    cblog = %d' . ' '\r
2378                         . 'WHERE '\r
2379                         . '    citem = %d';\r
2380                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2381                 }\r
2382         \r
2383                 // update items (iblog)\r
2384                 $query = 'UPDATE '\r
2385                 .      sql_table('item') . ' '\r
2386                 . 'SET '\r
2387                 . '    iblog = %d '\r
2388                 . 'WHERE '\r
2389                 . '    icat = %d';\r
2390                 sql_query(sprintf($query, $destblogid, $catid));\r
2391         \r
2392                 // move category\r
2393                 $query = 'UPDATE '\r
2394                 .      sql_table('category') . ' '\r
2395                 . 'SET '\r
2396                 . '    cblog = %d' . ' '\r
2397                 . 'WHERE '\r
2398                 . '    catid = %d';\r
2399                 sql_query(sprintf($query, $destblogid, $catid));\r
2400                 $manager->notify(\r
2401                                 'PostMoveCategory',\r
2402                                 array(\r
2403                                                 'catid'      => &$catid,\r
2404                                                 'sourceblog' => &$blog,\r
2405                                                 'destblog'   => $destblog\r
2406                                 )\r
2407                 );\r
2408                 return;\r
2409         }\r
2410 \r
2411         /**\r
2412          * Admin::action_blogsettingsupdate\r
2413          * Updating blog settings\r
2414          * \r
2415          * @param       Void\r
2416          * @return      Void\r
2417          */\r
2418         static private function action_blogsettingsupdate()\r
2419         {\r
2420                 global $member, $manager;\r
2421                 \r
2422                 $blogid = intRequestVar('blogid');\r
2423                 \r
2424                 $member->blogAdminRights($blogid) or self::disallow();\r
2425                 \r
2426                 $blog =& $manager->getBlog($blogid);\r
2427                 \r
2428                 $notify_address = trim(postVar('notify'));\r
2429                 $shortname              = trim(postVar('shortname'));\r
2430                 $updatefile             = trim(postVar('update'));\r
2431                 \r
2432                 $notifyComment  = intPostVar('notifyComment');\r
2433                 $notifyVote             = intPostVar('notifyVote');\r
2434                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2435                 \r
2436                 if ( $notifyComment == 0 )\r
2437                 {\r
2438                         $notifyComment = 1;\r
2439                 }\r
2440                 if ( $notifyVote == 0 )\r
2441                 {\r
2442                         $notifyVote = 1;\r
2443                 }\r
2444                 if ( $notifyNewItem == 0 )\r
2445                 {\r
2446                         $notifyNewItem = 1;\r
2447                 }\r
2448                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2449                 \r
2450                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2451                 {\r
2452                         self::error(_ERROR_BADNOTIFY);\r
2453                         return;\r
2454                 }\r
2455                 \r
2456                 if ( !isValidShortName($shortname) )\r
2457                 {\r
2458                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2459                         return;\r
2460                 }\r
2461                 \r
2462                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2463                 {\r
2464                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2465                         return;\r
2466                 }\r
2467                 // check if update file is writable\r
2468                 if ( $updatefile && !is_writeable($updatefile) )\r
2469                 {\r
2470                         self::error(_ERROR_UPDATEFILE);\r
2471                         return;\r
2472                 }\r
2473                 \r
2474                 $blog->setName(trim(postVar('name')));\r
2475                 $blog->setShortName($shortname);\r
2476                 $blog->setNotifyAddress($notify_address);\r
2477                 $blog->setNotifyType($notifyType);\r
2478                 $blog->setMaxComments(postVar('maxcomments'));\r
2479                 $blog->setCommentsEnabled(postVar('comments'));\r
2480                 $blog->setTimeOffset(postVar('timeoffset'));\r
2481                 $blog->setUpdateFile($updatefile);\r
2482                 $blog->setURL(trim(postVar('url')));\r
2483                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2484                 $blog->setDescription(trim(postVar('desc')));\r
2485                 $blog->setPublic(postVar('public'));\r
2486                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2487                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2488                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2489                 $blog->setSearchable(intPostVar('searchable'));\r
2490                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2491                 $blog->writeSettings();\r
2492                 \r
2493                 // store plugin options\r
2494                 $aOptions = requestArray('plugoption');\r
2495                 NucleusPlugin::apply_plugin_options($aOptions);\r
2496                 \r
2497                 $data = array(\r
2498                         'context' => 'blog',\r
2499                         'blogid'  => $blogid,\r
2500                         'blog'    => &$blog\r
2501                 );\r
2502                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2503                 \r
2504                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2505                 return;\r
2506         }\r
2507         \r
2508         /**\r
2509          * Admin::action_deleteblog()\r
2510          * \r
2511          * @param       void\r
2512          * @return      void\r
2513          */\r
2514         static private function action_deleteblog()\r
2515         {\r
2516                 global $member, $CONF, $manager;\r
2517                 \r
2518                 $blogid = intRequestVar('blogid');\r
2519                 \r
2520                 $member->blogAdminRights($blogid) or self::disallow();\r
2521                 \r
2522                 // check if blog is default blog\r
2523                 if ( $CONF['DefaultBlog'] == $blogid )\r
2524                 {\r
2525                         self::error(_ERROR_DELDEFBLOG);\r
2526                         return;\r
2527                 }\r
2528                 \r
2529                 $blog =& $manager->getBlog($blogid);\r
2530                 \r
2531                 self::$skin->parse('deleteblog');\r
2532                 return;\r
2533         }\r
2534         \r
2535         /**\r
2536          * Admin::action_deleteblogconfirm()\r
2537          * Delete Blog\r
2538          * \r
2539          * @param       Void\r
2540          * @return      Void\r
2541          */\r
2542         static private function action_deleteblogconfirm()\r
2543         {\r
2544                 global $member, $CONF, $manager;\r
2545                 \r
2546                 $blogid = intRequestVar('blogid');\r
2547                 \r
2548                 $data = array('blogid' => $blogid);\r
2549                 $manager->notify('PreDeleteBlog', $data);\r
2550                 \r
2551                 $member->blogAdminRights($blogid) or self::disallow();\r
2552                 \r
2553                 // check if blog is default blog\r
2554                 if ( $CONF['DefaultBlog'] == $blogid )\r
2555                 {\r
2556                         self::error(_ERROR_DELDEFBLOG);\r
2557                         return;\r
2558                 }\r
2559                 \r
2560                 // delete all comments\r
2561                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2562                 DB::execute($query);\r
2563                 \r
2564                 // delete all items\r
2565                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2566                 DB::execute($query);\r
2567                 \r
2568                 // delete all team members\r
2569                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2570                 DB::execute($query);\r
2571                 \r
2572                 // delete all bans\r
2573                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2574                 DB::execute($query);\r
2575                 \r
2576                 // delete all categories\r
2577                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2578                 DB::execute($query);\r
2579                 \r
2580                 // delete all associated plugin options\r
2581                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2582                 \r
2583                 // delete the blog itself\r
2584                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2585                 DB::execute($query);\r
2586                 \r
2587                 $data = array('blogid' => $blogid);\r
2588                 $manager->notify('PostDeleteBlog', $data);\r
2589                 \r
2590                 self::action_overview(_DELETED_BLOG);\r
2591                 return;\r
2592         }\r
2593         \r
2594         /**\r
2595          * Admin::action_memberdelete()\r
2596          * \r
2597          * @param       void\r
2598          * @return      void\r
2599          */\r
2600         static private function action_memberdelete()\r
2601         {\r
2602                 global $member, $manager;\r
2603                 \r
2604                 $memberid = intRequestVar('memberid');\r
2605                 \r
2606                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2607                 \r
2608                 $mem =& $manager->getMember($memberid);\r
2609                 \r
2610                 self::$skin->parse('memberdelete');\r
2611                 return;\r
2612         }\r
2613         \r
2614         /**\r
2615          * Admin::action_memberdeleteconfirm()\r
2616          * \r
2617          * @param       void\r
2618          * @return      void\r
2619          */\r
2620         static private function action_memberdeleteconfirm()\r
2621         {\r
2622                 global $member;\r
2623                 \r
2624                 $memberid = intRequestVar('memberid');\r
2625                 \r
2626                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2627                 \r
2628                 $error = self::deleteOneMember($memberid);\r
2629                 if ( $error )\r
2630                 {\r
2631                         self::error($error);\r
2632                         return;\r
2633                 }\r
2634                 \r
2635                 if ( $member->isAdmin() )\r
2636                 {\r
2637                         self::action_usermanagement();\r
2638                         return;\r
2639                 }\r
2640                 else\r
2641                 {\r
2642                         self::action_overview(_DELETED_MEMBER);\r
2643                         return;\r
2644                 }\r
2645                 return;\r
2646         }\r
2647         \r
2648         /**\r
2649          * Admin::deleteOneMember()\r
2650          * Delete a member by id\r
2651          * \r
2652          * @static\r
2653          * @params      Integer $memberid       member id\r
2654          * @return      String  null string or error messages\r
2655          */\r
2656         static public function deleteOneMember($memberid)\r
2657         {\r
2658                 global $manager;\r
2659                 \r
2660                 $memberid = intval($memberid);\r
2661                 $mem =& $manager->getMember($memberid);\r
2662                 \r
2663                 if ( !$mem->canBeDeleted() )\r
2664                 {\r
2665                         return _ERROR_DELETEMEMBER;\r
2666                 }\r
2667                 \r
2668                 $data = array('member' => &$mem);\r
2669                 $manager->notify('PreDeleteMember', $data);\r
2670                 \r
2671                 /* unlink comments from memberid */\r
2672                 if ( $memberid )\r
2673                 {\r
2674                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2675                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2676                         DB::execute($query);\r
2677                 }\r
2678                 \r
2679                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2680                 DB::execute($query);\r
2681                 \r
2682                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2683                 DB::execute($query);\r
2684                 \r
2685                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2686                 DB::execute($query);\r
2687                 \r
2688                 // delete all associated plugin options\r
2689                 NucleusPlugin::delete_option_values('member', $memberid);\r
2690                 \r
2691                 $data = array('member' => &$mem);\r
2692                 $manager->notify('PostDeleteMember', $data);\r
2693                 \r
2694                 return '';\r
2695         }\r
2696         \r
2697         /**\r
2698          * Admin::action_createnewlog()\r
2699          * \r
2700          * @param       void\r
2701          * @return      void\r
2702          */\r
2703         static private function action_createnewlog()\r
2704         {\r
2705                 global $member, $CONF, $manager;\r
2706                 \r
2707                 // Only Super-Admins can do this\r
2708                 $member->isAdmin() or self::disallow();\r
2709                 \r
2710                 self::$skin->parse('createnewlog');\r
2711                 return;\r
2712         }\r
2713         \r
2714         /**\r
2715          * Admin::action_addnewlog()\r
2716          * \r
2717          * @param       void\r
2718          * @return      void\r
2719          */\r
2720         static private function action_addnewlog()\r
2721         {\r
2722                 global $member, $manager, $CONF;\r
2723                 \r
2724                 // Only Super-Admins can do this\r
2725                 $member->isAdmin() or self::disallow();\r
2726                 \r
2727                 $bname                  = trim(postVar('name'));\r
2728                 $bshortname             = trim(postVar('shortname'));\r
2729                 $btimeoffset    = postVar('timeoffset');\r
2730                 $bdesc                  = trim(postVar('desc'));\r
2731                 $bdefskin               = postVar('defskin');\r
2732                 \r
2733                 if ( !isValidShortName($bshortname) )\r
2734                 {\r
2735                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2736                         return;\r
2737                 }\r
2738                 \r
2739                 if ( $manager->existsBlog($bshortname) )\r
2740                 {\r
2741                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2742                         return;\r
2743                 }\r
2744                 \r
2745                 $data = array(\r
2746                         'name'        => &$bname,\r
2747                         'shortname'   => &$bshortname,\r
2748                         'timeoffset'  => &$btimeoffset,\r
2749                         'description' => &$bdesc,\r
2750                         'defaultskin' => &$bdefskin\r
2751                 );\r
2752                 $manager->notify('PreAddBlog', $data);\r
2753                 \r
2754                 // add slashes for sql queries\r
2755                 $bname                  = DB::quoteValue($bname);\r
2756                 $bshortname             = DB::quoteValue($bshortname);\r
2757                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2758                 $bdesc                  = DB::quoteValue($bdesc);\r
2759                 $bdefskin               = DB::quoteValue($bdefskin);\r
2760                 \r
2761                 // create blog\r
2762                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2763                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2764                 DB::execute($query);\r
2765                 \r
2766                 $blogid = DB::getInsertId();\r
2767                 $blog   =& $manager->getBlog($blogid);\r
2768                 \r
2769                 // create new category\r
2770                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2771                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2772                 \r
2773                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2774                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2775                 $catid = DB::getInsertId();\r
2776                 \r
2777                 // set as default category\r
2778                 $blog->setDefaultCategory($catid);\r
2779                 $blog->writeSettings();\r
2780                 \r
2781                 // create team member\r
2782                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2783                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2784                 DB::execute($query);\r
2785                 \r
2786                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2787                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2788                 \r
2789                 $blog->additem(\r
2790                         $blog->getDefaultCategory(),\r
2791                         $itemdeftitle,$itemdefbody,\r
2792                         '',\r
2793                         $blogid,\r
2794                         $member->getID(),\r
2795                         $blog->getCorrectTime(),\r
2796                         0,\r
2797                         0,\r
2798                         0\r
2799                 );\r
2800                 \r
2801                 $data = array('blog' => &$blog);\r
2802                 $manager->notify('PostAddBlog', $data);\r
2803                 \r
2804                 $data = array(\r
2805                         'blog'                  => &$blog,\r
2806                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2807                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2808                         'catid'                 => $catid\r
2809                 );\r
2810                 $manager->notify('PostAddCategory', $data);\r
2811                 \r
2812                 /* TODO: we should consider to use the other way insterad of this */\r
2813                 $_REQUEST['blogid'] = $blogid;\r
2814                 $_REQUEST['catid']  = $catid;\r
2815                 self::$skin->parse('addnewlog');\r
2816                 return;\r
2817         }\r
2818         \r
2819         /**\r
2820          * Admin::action_addnewlog2()\r
2821          * \r
2822          * @param       void\r
2823          * @return      void\r
2824          */\r
2825         static private function action_addnewlog2()\r
2826         {\r
2827                 global $member, $manager;\r
2828                 $blogid = intRequestVar('blogid');\r
2829                 \r
2830                 $member->blogAdminRights($blogid) or self::disallow();\r
2831                 \r
2832                 $burl = requestVar('url');\r
2833                 \r
2834                 $blog =& $manager->getBlog($blogid);\r
2835                 $blog->setURL(trim($burl));\r
2836                 $blog->writeSettings();\r
2837                 \r
2838                 self::action_overview(_MSG_NEWBLOG);\r
2839                 return;\r
2840         }\r
2841         \r
2842         /**\r
2843          * Admin::action_skinieoverview()\r
2844          * \r
2845          * @param       void\r
2846          * @return      void\r
2847          */\r
2848         static private function action_skinieoverview()\r
2849         {\r
2850                 global $member, $DIR_LIBS, $manager;\r
2851                 \r
2852                 $member->isAdmin() or self::disallow();\r
2853                 \r
2854                 include_once($DIR_LIBS . 'skinie.php');\r
2855                 \r
2856                 self::$skin->parse('skinieoverview');\r
2857                 return;\r
2858         }\r
2859         \r
2860         /**\r
2861          * Admin::action_skinieimport()\r
2862          * \r
2863          * @param       void\r
2864          * @return      void\r
2865          */\r
2866         static private function action_skinieimport()\r
2867         {\r
2868                 global $member;\r
2869                 \r
2870                 $member->isAdmin() or self::disallow();\r
2871                 \r
2872                 $skinFileRaw = postVar('skinfile');\r
2873                 $mode = postVar('mode');\r
2874                 \r
2875                 $error = self::skinieimport($mode, $skinFileRaw);\r
2876                 if ( $error )\r
2877                 {\r
2878                         self::error($error);\r
2879                         return;\r
2880                 }\r
2881                 \r
2882                 self::$skin->parse('skinieimport');\r
2883                 return;\r
2884         }\r
2885         \r
2886         /**\r
2887          * Admin::action_skiniedoimport()\r
2888          * \r
2889          * @param       void\r
2890          * @return      void\r
2891          */\r
2892         static private function action_skiniedoimport()\r
2893         {\r
2894                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2895                 \r
2896                 $member->isAdmin() or self::disallow();\r
2897                 \r
2898                 // load skinie class\r
2899                 include_once($DIR_LIBS . 'skinie.php');\r
2900                 \r
2901                 $mode = postVar('mode');\r
2902                 $skinFileRaw = postVar('skinfile');\r
2903                 $allowOverwrite = intPostVar('overwrite');\r
2904                 \r
2905                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);\r
2906                 if ( $error )\r
2907                 {\r
2908                         self::error($msg);\r
2909                         return;\r
2910                 }\r
2911                 \r
2912                 self::$skin->parse('skiniedoimport');\r
2913                 return;\r
2914         }\r
2915         \r
2916         /**\r
2917          * Admin::action_skinieexport()\r
2918          * \r
2919          * @param       void\r
2920          * @return      void\r
2921          */\r
2922         static private function action_skinieexport()\r
2923         {\r
2924                 global $member;\r
2925                 \r
2926                 $member->isAdmin() or self::disallow();\r
2927                 \r
2928                 $aSkins = requestIntArray('skin');\r
2929                 $aTemplates = requestIntArray('template');\r
2930                 $info = postVar('info');\r
2931                 \r
2932                 self::skinieexport($aSkins, $aTemplates, $info);\r
2933                 \r
2934                 return;\r
2935         }\r
2936         \r
2937         /**\r
2938          * Admin::action_templateoverview()\r
2939          * \r
2940          * @param       void\r
2941          * @return      void\r
2942          */\r
2943         static private function action_templateoverview()\r
2944         {\r
2945                 global $member, $manager;\r
2946                 \r
2947                 $member->isAdmin() or self::disallow();\r
2948                 \r
2949                 self::$skin->parse('templateoverview');\r
2950                 return;\r
2951         }\r
2952         \r
2953         /**\r
2954          * Admin::action_templateedit()\r
2955          * \r
2956          * @param       string  $msg    message for pageheader\r
2957          * @return      void\r
2958          */\r
2959         static private function action_templateedit($msg = '')\r
2960         {\r
2961                 global $member, $manager;\r
2962                 if ( $msg )\r
2963                 {\r
2964                         self::$headMess = $msg;\r
2965                 }\r
2966                 \r
2967                 $templateid = intRequestVar('templateid');\r
2968                 \r
2969                 $member->isAdmin() or self::disallow();\r
2970                 \r
2971                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
2972                 self::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
2973                 \r
2974                 self::$skin->parse('templateedit');\r
2975                 return;\r
2976         }\r
2977         \r
2978         /**\r
2979          * Admin::action_templateupdate()\r
2980          * \r
2981          * @param       void\r
2982          * @return      void\r
2983          */\r
2984         static private function action_templateupdate()\r
2985         {\r
2986                 global $member,$manager;\r
2987                 \r
2988                 $templateid = intRequestVar('templateid');\r
2989                 \r
2990                 $member->isAdmin() or self::disallow();\r
2991                 \r
2992                 $name = postVar('tname');\r
2993                 $desc = postVar('tdesc');\r
2994                 \r
2995                 if ( !isValidTemplateName($name) )\r
2996                 {\r
2997                         self::error(_ERROR_BADTEMPLATENAME);\r
2998                         return;\r
2999                 }\r
3000                 \r
3001                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3002                 {\r
3003                         self::error(_ERROR_DUPTEMPLATENAME);\r
3004                         return;\r
3005                 }\r
3006                 \r
3007                 // 1. Remove all template parts\r
3008                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3009                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3010                 DB::execute($query);\r
3011                 \r
3012                 // 2. Update description\r
3013                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3014                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3015                 DB::execute($query);\r
3016                 \r
3017                 // 3. Add non-empty template parts\r
3018                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3019                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3020                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3021                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3022                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3023                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3024                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3025                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3026                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3027                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3028                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3029                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3030                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3031                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3032                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3033                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3034                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3035                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3036                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3037                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3038                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3039                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3040                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3041                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3042                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3043                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3044                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3045                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3046                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3047                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3048                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3049                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3050                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3051                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3052                 \r
3053                 $data = array('fields' => array());\r
3054                 $manager->notify('TemplateExtraFields', $data);\r
3055                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3056                 {\r
3057                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3058                         {\r
3059                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3060                         }\r
3061                 }\r
3062                 \r
3063                 // jump back to template edit\r
3064                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3065                 return;\r
3066         }\r
3067         \r
3068         /**\r
3069          * Admin::addToTemplate()\r
3070          * \r
3071          * @param       Integer $id     ID for template\r
3072          * @param       String  $partname       parts name\r
3073          * @param       String  $content        template contents\r
3074          * @return      Integer record index\r
3075          * \r
3076          */\r
3077         static private function addToTemplate($id, $partname, $content)\r
3078         {\r
3079                 // don't add empty parts:\r
3080                 if ( !trim($content) )\r
3081                 {\r
3082                         return -1;\r
3083                 }\r
3084                 \r
3085                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3086                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3087                 if ( DB::execute($query) === FALSE )\r
3088                 {\r
3089                         $err = DB::getError();\r
3090                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3091                 }\r
3092                 return DB::getInsertId();\r
3093         }\r
3094         \r
3095         /**\r
3096          * Admin::action_templatedelete()\r
3097          * \r
3098          * @param       void\r
3099          * @return      void\r
3100          */\r
3101         static private function action_templatedelete()\r
3102         {\r
3103                 global $member, $manager;\r
3104                 \r
3105                 $member->isAdmin() or self::disallow();\r
3106                 \r
3107                 $templateid = intRequestVar('templateid');\r
3108                 // TODO: check if template can be deleted\r
3109                 \r
3110                 self::$skin->parse('templatedelete');\r
3111                 return;\r
3112         }\r
3113         \r
3114         /**\r
3115          * Admin::action_templatedeleteconfirm()\r
3116          * \r
3117          * @param       void\r
3118          * @return      void\r
3119          */\r
3120         static private function action_templatedeleteconfirm()\r
3121         {\r
3122                 global $member, $manager;\r
3123                 \r
3124                 $templateid = intRequestVar('templateid');\r
3125                 \r
3126                 $member->isAdmin() or self::disallow();\r
3127                 \r
3128                 $data = array('templateid' => $templateid);\r
3129                 $manager->notify('PreDeleteTemplate', $data);\r
3130                 \r
3131                 // 1. delete description\r
3132                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3133                 \r
3134                 // 2. delete parts\r
3135                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3136                 \r
3137                 \r
3138                 $data = array('templateid' => $templateid);\r
3139                 $manager->notify('PostDeleteTemplate', $data);\r
3140                 \r
3141                 self::action_templateoverview();\r
3142                 return;\r
3143         }\r
3144         \r
3145         /**\r
3146          * Admin::action_templatenew()\r
3147          * \r
3148          * @param       void\r
3149          * @return      void\r
3150          */\r
3151         static private function action_templatenew()\r
3152         {\r
3153                 global $member;\r
3154                 \r
3155                 $member->isAdmin() or self::disallow();\r
3156                 \r
3157                 $name = postVar('name');\r
3158                 $desc = postVar('desc');\r
3159                 \r
3160                 if ( !isValidTemplateName($name) )\r
3161                 {\r
3162                         self::error(_ERROR_BADTEMPLATENAME);\r
3163                         return;\r
3164                 }\r
3165                 \r
3166                 if ( Template::exists($name) )\r
3167                 {\r
3168                         self::error(_ERROR_DUPTEMPLATENAME);\r
3169                         return;\r
3170                 }\r
3171                 \r
3172                 $newTemplateId = Template::createNew($name, $desc);\r
3173                 \r
3174                 self::action_templateoverview();\r
3175                 return;\r
3176         }\r
3177         \r
3178         /**\r
3179          * Admin::action_templateclone()\r
3180          * \r
3181          * @param       void\r
3182          * @return      void\r
3183          */\r
3184         static private function action_templateclone()\r
3185         {\r
3186                 global $member;\r
3187                 \r
3188                 $templateid = intRequestVar('templateid');\r
3189                 \r
3190                 $member->isAdmin() or self::disallow();\r
3191                 \r
3192                 // 1. read old template\r
3193                 $name = Template::getNameFromId($templateid);\r
3194                 $desc = Template::getDesc($templateid);\r
3195                 \r
3196                 // 2. create desc thing\r
3197                 $name = "cloned" . $name;\r
3198                 \r
3199                 // if a template with that name already exists:\r
3200                 if ( Template::exists($name) )\r
3201                 {\r
3202                         $i = 1;\r
3203                         while (Template::exists($name . $i))\r
3204                         {\r
3205                                 $i++;\r
3206                         }\r
3207                         $name .= $i;\r
3208                 }\r
3209                 \r
3210                 $newid = Template::createNew($name, $desc);\r
3211                 \r
3212                 // 3. create clone\r
3213                 // go through parts of old template and add them to the new one\r
3214                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3215                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3216                 \r
3217                 $res = DB::getResult($query);\r
3218                 foreach ( $res as $row)\r
3219                 {\r
3220                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3221                 }\r
3222                 \r
3223                 self::action_templateoverview();\r
3224                 return;\r
3225         }\r
3226         \r
3227         /**\r
3228          * Admin::action_admintemplateoverview()\r
3229          * \r
3230          * @param       void\r
3231          * @return      void\r
3232          */\r
3233         static private function action_admintemplateoverview()\r
3234         {\r
3235                 global $member;\r
3236                 $member->isAdmin() or self::disallow();\r
3237                 self::$skin->parse('admntemplateoverview');\r
3238                 return;\r
3239         }\r
3240         \r
3241         /**\r
3242          * Admin::action_admintemplateedit()\r
3243          * \r
3244          * @param       string  $msg    message for pageheader\r
3245          * @return      void\r
3246          */\r
3247         static private function action_admintemplateedit($msg = '')\r
3248         {\r
3249                 global $member, $manager;\r
3250                 if ( $msg )\r
3251                 {\r
3252                         self::$headMess = $msg;\r
3253                 }\r
3254                 $member->isAdmin() or self::disallow();\r
3255                 \r
3256                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3257                 self::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3258                 \r
3259                 self::$skin->parse('admintemplateedit');\r
3260                 return;\r
3261         }\r
3262         \r
3263         /**\r
3264          * Admin::action_admintemplateupdate()\r
3265          * \r
3266          * @param       void\r
3267          * @return      void\r
3268          */\r
3269         static private function action_admintemplateupdate()\r
3270         {\r
3271                 global $member, $manager;\r
3272                 $templateid = intRequestVar('templateid');\r
3273                 $member->isAdmin() or self::disallow();\r
3274                 $name = postVar('tname');\r
3275                 $desc = postVar('tdesc');\r
3276                 \r
3277                 if ( !isValidTemplateName($name) )\r
3278                 {\r
3279                         self::error(_ERROR_BADTEMPLATENAME);\r
3280                         return;\r
3281                 }\r
3282                 \r
3283                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3284                 {\r
3285                         self::error(_ERROR_DUPTEMPLATENAME);\r
3286                         return;\r
3287                 }\r
3288                 \r
3289                 // 1. Remove all template parts\r
3290                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3291                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3292                 DB::execute($query);\r
3293                 \r
3294                 // 2. Update description\r
3295                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3296                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3297                 DB::execute($query);\r
3298                 \r
3299                 // 3. Add non-empty template parts\r
3300                 self::addToTemplate($templateid, 'NORMALSKINLIST_HEAD',                                         postVar('NORMALSKINLIST_HEAD'));\r
3301                 self::addToTemplate($templateid, 'NORMALSKINLIST_BODY',                                         postVar('NORMALSKINLIST_BODY'));\r
3302                 self::addToTemplate($templateid, 'NORMALSKINLIST_FOOT',                                         postVar('NORMALSKINLIST_FOOT'));\r
3303                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                           postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3304                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                         postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3305                 self::addToTemplate($templateid, 'ADMIN_BLOGLINK',                                                      postVar('ADMIN_BLOGLINK'));\r
3306                 self::addToTemplate($templateid, 'ADMIN_BATCHLIST',                                                     postVar('ADMIN_BATCHLIST'));\r
3307                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                       postVar('ACTIVATE_FORGOT_TITLE'));\r
3308                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                        postVar('ACTIVATE_FORGOT_TEXT'));\r
3309                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                     postVar('ACTIVATE_REGISTER_TITLE'));\r
3310                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                      postVar('ACTIVATE_REGISTER_TEXT'));\r
3311                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                       postVar('ACTIVATE_CHANGE_TITLE'));\r
3312                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                        postVar('ACTIVATE_CHANGE_TEXT'));\r
3313                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                            postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3314                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                      postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3315                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                      postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3316                 self::addToTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                        postVar('SPECIALSKINLIST_HEAD'));\r
3317                 self::addToTemplate($templateid, 'SPECIALSKINLIST_BODY',                                        postVar('SPECIALSKINLIST_BODY'));\r
3318                 self::addToTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                        postVar('SPECIALSKINLIST_FOOT'));\r
3319                 self::addToTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                       postVar('SYSTEMINFO_GDSETTINGS'));\r
3320                 self::addToTemplate($templateid, 'BANLIST_DELETED_LIST',                                        postVar('BANLIST_DELETED_LIST'));\r
3321                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                     postVar('INSERT_PLUGOPTION_TITLE'));\r
3322                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                      postVar('INSERT_PLUGOPTION_BODY'));\r
3323                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                           postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3324                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                          postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3325                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                          postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3326                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                          postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3327                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                          postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3328                 self::addToTemplate($templateid, 'SKINIE_EXPORT_LIST',                                          postVar('SKINIE_EXPORT_LIST'));\r
3329                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                       postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3330                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                       postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3331                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                       postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3332                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                        postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3333                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                        postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3334                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                        postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3335                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3336                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3337                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3338                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3339                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3340                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3341                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3342                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3343                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3344                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3345                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3346                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3347                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3348                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3349                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3350                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3351                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3352                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3353                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3354                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3355                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3356                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3357                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3358                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3359                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3360                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3361                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3362                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3363                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3364                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3365                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3366                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3367                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3368                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3369                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3370                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3371                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3372                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3373                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3374                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3375                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3376                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3377                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3378                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3379                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3380                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3381                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3382                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3383                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3384                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3385                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3386                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3387                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3388                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3389                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3390                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3391                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3392                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3393                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3394                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3395                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3396                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3397                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3398                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3399                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3400                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3401                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                      postVar('PLUGIN_QUICKMENU_TITLE'));\r
3402                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                       postVar('PLUGIN_QUICKMENU_HEAD'));\r
3403                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                       postVar('PLUGIN_QUICKMENU_BODY'));\r
3404                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                       postVar('PLUGIN_QUICKMENU_FOOT'));\r
3405                 \r
3406                 $data = array('fields' => array());\r
3407                 $manager->notify('AdminTemplateExtraFields', $data);\r
3408                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3409                 {\r
3410                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3411                         {\r
3412                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3413                         }\r
3414                 }\r
3415                 \r
3416                 // jump back to template edit\r
3417                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3418                 return;\r
3419         }\r
3420         \r
3421         /**\r
3422          * Admin::action_admintemplatedelete()\r
3423          * \r
3424          * @param       void\r
3425          * @return      void\r
3426          */\r
3427         static private function action_admintemplatedelete()\r
3428         {\r
3429                 global $member, $manager;\r
3430                 $member->isAdmin() or self::disallow();\r
3431                 \r
3432                 // TODO: check if template can be deleted\r
3433                 self::$skin->parse('admintemplatedelete');\r
3434                 return;\r
3435         }\r
3436         \r
3437         /**\r
3438          * Admin::action_admintemplatedeleteconfirm()\r
3439          * \r
3440          * @param       void\r
3441          * @return      void\r
3442          */\r
3443         static private function action_admintemplatedeleteconfirm()\r
3444         {\r
3445                 global $member, $manager;\r
3446                 \r
3447                 $templateid = intRequestVar('templateid');\r
3448                 $member->isAdmin() or self::disallow();\r
3449                 \r
3450                 $data = array('templateid' => $templateid);\r
3451                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3452                 \r
3453                 // 1. delete description\r
3454                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3455                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3456                 DB::execute($query);\r
3457                 \r
3458                 // 2. delete parts\r
3459                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3460                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3461                 DB::execute($query);\r
3462                 \r
3463                 $data = array('templateid' => $templateid);\r
3464                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3465                 \r
3466                 self::action_admintemplateoverview();\r
3467                 return;\r
3468         }\r
3469         \r
3470         /**\r
3471          * Admin::action_admintemplatenew()\r
3472          * \r
3473          * @param       void\r
3474          * @return      void\r
3475          */\r
3476         static private function action_admintemplatenew()\r
3477         {\r
3478                 global $member;\r
3479                 $member->isAdmin() or self::disallow();\r
3480                 $name = postVar('name');\r
3481                 $desc = postVar('desc');\r
3482                 \r
3483                 if ( !isValidTemplateName($name) )\r
3484                 {\r
3485                         self::error(_ERROR_BADTEMPLATENAME);\r
3486                         return;\r
3487                 }\r
3488                 else if ( !preg_match('#^admin/#', $name) )\r
3489                 {\r
3490                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3491                         return;\r
3492                 }\r
3493                 else if ( Template::exists($name) )\r
3494                 {\r
3495                         self::error(_ERROR_DUPTEMPLATENAME);\r
3496                         return;\r
3497                 }\r
3498                 \r
3499                 $newTemplateId = Template::createNew($name, $desc);\r
3500                 self::action_admintemplateoverview();\r
3501                 return;\r
3502         }\r
3503         \r
3504         /**\r
3505          * Admin::action_admintemplateclone()\r
3506          * \r
3507          * @param       void\r
3508          * @return      void\r
3509          */\r
3510         static private function action_admintemplateclone()\r
3511         {\r
3512                 global $member;\r
3513                 $templateid = intRequestVar('templateid');\r
3514                 $member->isAdmin() or self::disallow();\r
3515                 \r
3516                 // 1. read old template\r
3517                 $name = Template::getNameFromId($templateid);\r
3518                 $desc = Template::getDesc($templateid);\r
3519                 \r
3520                 // 2. create desc thing\r
3521                 $name = $name . "cloned";\r
3522                 \r
3523                 // if a template with that name already exists:\r
3524                 if ( Template::exists($name) )\r
3525                 {\r
3526                         $i = 1;\r
3527                         while ( Template::exists($name . $i) )\r
3528                         {\r
3529                                 $i++;\r
3530                         }\r
3531                         $name .= $i;\r
3532                 }\r
3533                 \r
3534                 $newid = Template::createNew($name, $desc);\r
3535                 \r
3536                 // 3. create clone\r
3537                 // go through parts of old template and add them to the new one\r
3538                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3539                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3540                 \r
3541                 $res = DB::getResult($query);\r
3542                 foreach ( $res as $row )\r
3543                 {\r
3544                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3545                 }\r
3546                 \r
3547                 self::action_admintemplateoverview();\r
3548                 return;\r
3549         }\r
3550 \r
3551         /**\r
3552          * Admin::action_skinoverview()\r
3553          * \r
3554          * @param       void\r
3555          * @return      void\r
3556          */\r
3557         static private function action_skinoverview()\r
3558         {\r
3559                 global $member, $manager;\r
3560                 \r
3561                 $member->isAdmin() or self::disallow();\r
3562                 \r
3563                 self::$skin->parse('skinoverview');\r
3564                 return;\r
3565         }\r
3566         \r
3567         /**\r
3568          * Admin::action_skinnew()\r
3569          * \r
3570          * @param       void\r
3571          * @return      void\r
3572          */\r
3573         static private function action_skinnew()\r
3574         {\r
3575                 global $member;\r
3576                 \r
3577                 $member->isAdmin() or self::disallow();\r
3578                 \r
3579                 $name = trim(postVar('name'));\r
3580                 $desc = trim(postVar('desc'));\r
3581                 \r
3582                 if ( !isValidSkinName($name) )\r
3583                 {\r
3584                         self::error(_ERROR_BADSKINNAME);\r
3585                         return;\r
3586                 }\r
3587                 else if ( SKIN::exists($name) )\r
3588                 {\r
3589                         self::error(_ERROR_DUPSKINNAME);\r
3590                         return;\r
3591                 }\r
3592                 \r
3593                 SKIN::createNew($name, $desc);\r
3594                 \r
3595                 self::action_skinoverview();\r
3596                 return;\r
3597         }\r
3598         \r
3599         /**\r
3600          * Admin::action_skinedit()\r
3601          * \r
3602          * @param       void\r
3603          * @return      void\r
3604          */\r
3605         static private function action_skinedit()\r
3606         {\r
3607                 global $member;\r
3608                 \r
3609                 $member->isAdmin() or self::disallow();\r
3610                 \r
3611                 self::$skin->parse('skinedit');\r
3612                 return;\r
3613         }\r
3614         \r
3615         /**\r
3616          * Admin::action_skineditgeneral()\r
3617          * \r
3618          * @param       void\r
3619          * @return      void\r
3620          */\r
3621         static private function action_skineditgeneral()\r
3622         {\r
3623                 global $member;\r
3624                 \r
3625                 $skinid = intRequestVar('skinid');\r
3626                 \r
3627                 $member->isAdmin() or self::disallow();\r
3628                 \r
3629                 $error = self::skineditgeneral($skinid);\r
3630                 if ( $error )\r
3631                 {\r
3632                         self::error($error);\r
3633                         return;\r
3634                 }\r
3635                 \r
3636                 self::action_skinedit();\r
3637                 return;\r
3638         }\r
3639         \r
3640         static private function action_skinedittype($msg = '')\r
3641         {\r
3642                 global $member;\r
3643                 \r
3644                 $member->isAdmin() or self::disallow();\r
3645                 \r
3646                 if ( $msg )\r
3647                 {\r
3648                         self::$headMess = $msg;\r
3649                 }\r
3650                 \r
3651                 $type = requestVar('type');\r
3652                 $type = trim($type);\r
3653                 $type = strtolower($type);\r
3654                 \r
3655                 if ( !isValidShortName($type) )\r
3656                 {\r
3657                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3658                         return;\r
3659                 }\r
3660                 \r
3661                 self::$skin->parse('skinedittype');\r
3662                 return;\r
3663         }\r
3664         \r
3665         /**\r
3666          * Admin::action_skinupdate()\r
3667          * \r
3668          * @param       void\r
3669          * @return      void\r
3670          */\r
3671         static private function action_skinupdate()\r
3672         {\r
3673                 global $manager, $member;\r
3674                 \r
3675                 $skinid = intRequestVar('skinid');\r
3676                 $content = trim(postVar('content'));\r
3677                 $type = postVar('type');\r
3678                 \r
3679                 $member->isAdmin() or self::disallow();\r
3680                 \r
3681                 $skin =& $manager->getSKIN($skinid);\r
3682                 $skin->update($type, $content);\r
3683                 \r
3684                 self::action_skinedittype(_SKIN_UPDATED);\r
3685                 return;\r
3686         }\r
3687         \r
3688         /**\r
3689          * Admin::action_skindelete()\r
3690          * \r
3691          * @param       void\r
3692          * @return      void\r
3693          */\r
3694         static private function action_skindelete()\r
3695         {\r
3696                 global $CONF, $member;\r
3697                 \r
3698                 $member->isAdmin() or self::disallow();\r
3699                 \r
3700                 $skinid = intRequestVar('skinid');\r
3701                 \r
3702                 // don't allow default skin to be deleted\r
3703                 if ( $skinid == $CONF['BaseSkin'] )\r
3704                 {\r
3705                         self::error(_ERROR_DEFAULTSKIN);\r
3706                         return;\r
3707                 }\r
3708                 \r
3709                 // don't allow deletion of default skins for blogs\r
3710                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3711                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3712                 \r
3713                 $name = DB::getValue($query);\r
3714                 if ( $name )\r
3715                 {\r
3716                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3717                         return;\r
3718                 }\r
3719                 \r
3720                 self::$skin->parse('skindelete');\r
3721                 return;\r
3722         }\r
3723         \r
3724         /**\r
3725          * Admin::action_skindeleteconfirm()\r
3726          * \r
3727          * @param       void\r
3728          * @return      void\r
3729          */\r
3730         static private function action_skindeleteconfirm()\r
3731         {\r
3732                 global $member, $CONF;\r
3733                 \r
3734                 $member->isAdmin() or self::disallow();\r
3735                 \r
3736                 $skinid = intRequestVar('skinid');\r
3737                 \r
3738                 // don't allow default skin to be deleted\r
3739                 if ( $skinid == $CONF['BaseSkin'] )\r
3740                 {\r
3741                         self::error(_ERROR_DEFAULTSKIN);\r
3742                         return;\r
3743                 }\r
3744                 \r
3745                 // don't allow deletion of default skins for blogs\r
3746                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3747                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3748                 \r
3749                 $name = DB::getValue($query);\r
3750                 if ( $name )\r
3751                                 {\r
3752                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3753                         return;\r
3754                 }\r
3755                 \r
3756                 self::skindeleteconfirm($skinid);\r
3757                 \r
3758                 self::action_skinoverview();\r
3759                 return;\r
3760         }\r
3761         \r
3762         /**\r
3763          * Admin::action_skinremovetype()\r
3764          * \r
3765          * @param       void\r
3766          * @return      void\r
3767          */\r
3768         static private function action_skinremovetype()\r
3769         {\r
3770                 global $member, $CONF;\r
3771                 \r
3772                 $member->isAdmin() or self::disallow();\r
3773                 \r
3774                 $skinid = intRequestVar('skinid');\r
3775                 $skintype = requestVar('type');\r
3776                 \r
3777                 if ( !isValidShortName($skintype) )\r
3778                 {\r
3779                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3780                         return;\r
3781                 }\r
3782                 \r
3783                 self::$skin->parse('skinremovetype');\r
3784                 return;\r
3785         }\r
3786         \r
3787         /**\r
3788          * Admin::action_skinremovetypeconfirm()\r
3789          * \r
3790          * @param       void\r
3791          * @return      void\r
3792          */\r
3793         static private function action_skinremovetypeconfirm()\r
3794         {\r
3795                 global $member;\r
3796                 \r
3797                 $member->isAdmin() or self::disallow();\r
3798                 \r
3799                 $skinid = intRequestVar('skinid');\r
3800                 $skintype = requestVar('type');\r
3801                 \r
3802                 $error = self::skinremovetypeconfirm($skinid, $skintype);\r
3803                 if ( $error )\r
3804                 {\r
3805                         self::error($error);\r
3806                         return;\r
3807                 }\r
3808                 \r
3809                 self::action_skinedit();\r
3810                 return;\r
3811         }\r
3812         \r
3813         /**\r
3814          * Admin::action_skinclone()\r
3815          * \r
3816          * @param       void\r
3817          * @return      void\r
3818          */\r
3819         static private function action_skinclone()\r
3820         {\r
3821                 global $member;\r
3822                 \r
3823                 $member->isAdmin() or self::disallow();\r
3824                 \r
3825                 $skinid = intRequestVar('skinid');\r
3826                 \r
3827                 self::skinclone($skinid);\r
3828                 \r
3829                 self::action_skinoverview();\r
3830                 return;\r
3831         }\r
3832         \r
3833         /**\r
3834          * Admin::action_adminskinoverview()\r
3835          * \r
3836          * @param       void\r
3837          * @return      void\r
3838          */\r
3839         static private function action_adminskinoverview()\r
3840         {\r
3841                 global $member;\r
3842                 \r
3843                 $member->isAdmin() or self::disallow();\r
3844                 \r
3845                 self::$skin->parse('adminskinoverview');\r
3846                 return;\r
3847         }\r
3848         \r
3849         /**\r
3850          * Admin::action_adminskinnew()\r
3851          * \r
3852          * @param       void\r
3853          * @return      void\r
3854          */\r
3855         static private function action_adminskinnew()\r
3856         {\r
3857                 global $member;\r
3858                 \r
3859                 $member->isAdmin() or self::disallow();\r
3860                 \r
3861                 $name = trim(postVar('name'));\r
3862                 $desc = trim(postVar('desc'));\r
3863                 \r
3864                 if ( !isValidSkinName($name) )\r
3865                 {\r
3866                         self::error(_ERROR_BADSKINNAME);\r
3867                         return;\r
3868                 }\r
3869                 else if ( !preg_match('#^admin/#', $name) )\r
3870                 {\r
3871                         self::error(_ERROR_BADADMINSKINNAME);\r
3872                         return;\r
3873                 }\r
3874                 else if ( Skin::exists($name) )\r
3875                 {\r
3876                         self::error(_ERROR_DUPSKINNAME);\r
3877                         return;\r
3878                 }\r
3879                 \r
3880                 Skin::createNew($name, $desc);\r
3881                 \r
3882                 self::action_adminskinoverview();\r
3883                 return;\r
3884         }\r
3885         \r
3886         /**\r
3887          * Admin::action_adminskinedit()\r
3888          * \r
3889          * @param       void\r
3890          * @return      void\r
3891          */\r
3892         static private function action_adminskinedit()\r
3893         {\r
3894                 global $member;\r
3895                 \r
3896                 $member->isAdmin() or self::disallow();\r
3897                 \r
3898                 self::$skin->parse('adminskinedit');\r
3899                 \r
3900                 return;\r
3901         }\r
3902         \r
3903         /**\r
3904          * Admin::action_adminskineditgeneral()\r
3905          * \r
3906          * @param       void\r
3907          * @return      void\r
3908          */\r
3909         static private function action_adminskineditgeneral()\r
3910         {\r
3911                 global $member;\r
3912                 \r
3913                 $skinid = intRequestVar('skinid');\r
3914                 \r
3915                 $member->isAdmin() or self::disallow();\r
3916                 \r
3917                 $error = self::skineditgeneral($skinid, 'AdminActions');\r
3918                 if ( $error )\r
3919                 {\r
3920                         self::error($error);\r
3921                         return;\r
3922                 }\r
3923                 \r
3924                 self::action_adminskinedit();\r
3925                 return;\r
3926         }\r
3927         \r
3928         /**\r
3929          * Admin::action_adminskinedittype()\r
3930          * \r
3931          * @param       string  $msg    message for pageheader\r
3932          * @return      void\r
3933          */\r
3934         static private function action_adminskinedittype($msg = '')\r
3935         {\r
3936                 global $member;\r
3937                 \r
3938                 $member->isAdmin() or self::disallow();\r
3939                 \r
3940                 if ( $msg )\r
3941                 {\r
3942                         self::$headMess = $msg;\r
3943                 }\r
3944                 $type = requestVar('type');\r
3945                 $type = trim($type);\r
3946                 $type = strtolower($type);\r
3947                 \r
3948                 if ( !isValidShortName($type) )\r
3949                 {\r
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3951                         return;\r
3952                 }\r
3953                 \r
3954                 self::$skin->parse('adminskinedittype');\r
3955                 return;\r
3956         }\r
3957         \r
3958         /**\r
3959          * Admin::action_adminskinupdate()\r
3960          * \r
3961          * @param       void\r
3962          * @return      void\r
3963          */\r
3964         static private function action_adminskinupdate()\r
3965         {\r
3966                 global $manager, $member;\r
3967                 \r
3968                 $skinid = intRequestVar('skinid');\r
3969                 $content = trim(postVar('content'));\r
3970                 $type = postVar('type');\r
3971                 \r
3972                 $member->isAdmin() or self::disallow();\r
3973                 \r
3974                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
3975                 $skin->update($type, $content);\r
3976                 \r
3977                 self::action_adminskinedittype(_SKIN_UPDATED);\r
3978                 return;\r
3979         }\r
3980         \r
3981         /**\r
3982          * Admin::action_adminskindelete()\r
3983          * \r
3984          * @param       void\r
3985          * @return      void\r
3986          */\r
3987         static private function action_adminskindelete()\r
3988         {\r
3989                 global $CONF, $member;\r
3990                 \r
3991                 $member->isAdmin() or self::disallow();\r
3992                 \r
3993                 $skinid = intRequestVar('skinid');\r
3994                 \r
3995                 // don't allow default skin to be deleted\r
3996                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )\r
3997                 {\r
3998                         self::error(_ERROR_DEFAULTSKIN);\r
3999                         return;\r
4000                 }\r
4001                 \r
4002                 /* don't allow if someone use it as a default*/\r
4003                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';\r
4004                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));\r
4005                 \r
4006                 $members = array();\r
4007                 while ( $row = $res->fetch() ) {\r
4008                         $members[] = $row['mrealname'];\r
4009                 }\r
4010                 if ( count($members) )\r
4011                 {\r
4012                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));\r
4013                         return;\r
4014                 }\r
4015                 \r
4016                 self::$skin->parse('adminskindelete');\r
4017                 return;\r
4018         }\r
4019 \r
4020         /**\r
4021          * Admin::action_adminskindeleteconfirm()\r
4022          * \r
4023          * @param       void\r
4024          * @return      void\r
4025          */\r
4026         static private function action_adminskindeleteconfirm()\r
4027         {\r
4028                 global $member, $CONF;\r
4029                 \r
4030                 $member->isAdmin() or self::disallow();\r
4031                 \r
4032                 $skinid = intRequestVar('skinid');\r
4033                 \r
4034                 // don't allow default skin to be deleted\r
4035                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )\r
4036                 {\r
4037                         self::error(_ERROR_DEFAULTSKIN);\r
4038                         return;\r
4039                 }\r
4040                 \r
4041                 /* don't allow if someone use it as a default*/\r
4042                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';\r
4043                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));\r
4044                 \r
4045                 $members = array();\r
4046                 while ( $row = $res->fetch() ) {\r
4047                         $members[] = $row['mrealname'];\r
4048                 }\r
4049                 if ( count($members) )\r
4050                 {\r
4051                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));\r
4052                         return;\r
4053                 }\r
4054                 \r
4055                 self::skindeleteconfirm($skinid);\r
4056                 \r
4057                 self::action_adminskinoverview();\r
4058                 return;\r
4059         }\r
4060         \r
4061         /**\r
4062          * Admin::action_adminskinremovetype()\r
4063          * \r
4064          * @param       void\r
4065          * @return      void\r
4066          */\r
4067         static private function action_adminskinremovetype()\r
4068         {\r
4069                 global $member, $CONF;\r
4070 \r
4071                 $member->isAdmin() or self::disallow();\r
4072                 \r
4073                 $skinid = intRequestVar('skinid');\r
4074                 $skintype = requestVar('type');\r
4075                 \r
4076                 if ( !isValidShortName($skintype) )\r
4077                 {\r
4078                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4079                         return;\r
4080                 }\r
4081                 \r
4082                 self::$skin->parse('adminskinremovetype');\r
4083                 return;\r
4084         }\r
4085         \r
4086         /**\r
4087          * Admin::action_adminskinremovetypeconfirm()\r
4088          * \r
4089          * @param       void\r
4090          * @return      void\r
4091          */\r
4092         static private function action_adminskinremovetypeconfirm()\r
4093         {\r
4094                 global $member;\r
4095                 \r
4096                 $member->isAdmin() or self::disallow();\r
4097                 \r
4098                 $skinid = intRequestVar('skinid');\r
4099                 $skintype = requestVar('type');\r
4100                 \r
4101                 $error = self::skinremovetypeconfirm($skinid, $skintype);\r
4102                 if ( $error )\r
4103                 {\r
4104                         self::error($error);\r
4105                         return;\r
4106                 }\r
4107                 \r
4108                 self::action_adminskinedit();\r
4109                 return;\r
4110         }\r
4111 \r
4112         /**\r
4113          * Admin::action_adminskinclone()\r
4114          * \r
4115          * @param       void\r
4116          * @return      void\r
4117          */\r
4118         static private function action_adminskinclone()\r
4119         {\r
4120                 global $member;\r
4121                 \r
4122                 $member->isAdmin() or self::disallow();\r
4123                 \r
4124                 $skinid = intRequestVar('skinid');\r
4125                 \r
4126                 self::skinclone($skinid, 'AdminActions');\r
4127                 \r
4128                 self::action_adminskinoverview();\r
4129                 return;\r
4130         }\r
4131         \r
4132         /**\r
4133          * Admin::action_adminskinieoverview()\r
4134          * \r
4135          * @param       void\r
4136          * @return      void\r
4137          */\r
4138         static private function action_adminskinieoverview()\r
4139         {\r
4140                 global $member;\r
4141                 \r
4142                 $member->isAdmin() or self::disallow();\r
4143                 \r
4144                 self::$skin->parse('adminskinieoverview');\r
4145                 return;\r
4146         }\r
4147 \r
4148         /**\r
4149          * Admin::action_adminskinieimport()\r
4150          * \r
4151          * @param       void\r
4152          * @return      void\r
4153          */\r
4154         static private function action_adminskinieimport()\r
4155         {\r
4156                 global $member;\r
4157                 \r
4158                 $member->isAdmin() or self::disallow();\r
4159                 \r
4160                 $skinFileRaw = postVar('skinfile');\r
4161                 $mode = postVar('mode');\r
4162                 \r
4163                 $error = self::skinieimport($mode, $skinFileRaw);\r
4164                 if ( $error )\r
4165                 {\r
4166                         self::error($error);\r
4167                         return;\r
4168                 }\r
4169                 \r
4170                 if ( !is_object(self::$skin) )\r
4171                 {\r
4172                         self::action_adminskiniedoimport();\r
4173                 }\r
4174                 else\r
4175                 {\r
4176                         self::$skin->parse('adminskinieimport');\r
4177                 }\r
4178                 return;\r
4179         }\r
4180         \r
4181         /**\r
4182          * Admin::action_adminskiniedoimport()\r
4183          * \r
4184          * @param       void\r
4185          * @return      void\r
4186          */\r
4187         static private function action_adminskiniedoimport()\r
4188         {\r
4189                 global $DIR_SKINS, $member;\r
4190                 \r
4191                 $member->isAdmin() or self::disallow();\r
4192                 \r
4193                 $mode = postVar('mode');\r
4194                 $skinFileRaw = postVar('skinfile');\r
4195                 $allowOverwrite = intPostVar('overwrite');\r
4196                 \r
4197                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);\r
4198                 if ( $error )\r
4199                 {\r
4200                         self::error($error);\r
4201                         return;\r
4202                 }\r
4203                 \r
4204                 if ( !is_object(self::$skin) )\r
4205                 {\r
4206                         global $DIR_SKINS;\r
4207                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4208                         $query  = sprintf($query, sql_table('skin_desc'));\r
4209                         $res    = intval(DB::getValue($query));\r
4210                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4211                         $query  = sprintf($query, sql_table('config'), $res);\r
4212                         DB::execute($query);\r
4213                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');\r
4214                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4215                 }\r
4216                 else\r
4217                 {\r
4218                         self::$skin->parse('adminskiniedoimport');\r
4219                 }\r
4220                 return;\r
4221         }\r
4222 \r
4223         /**\r
4224          * Admin::action_adminskinieexport()\r
4225          * \r
4226          * @param       void\r
4227          * @return      void\r
4228          */\r
4229         static private function action_adminskinieexport()\r
4230         {\r
4231                 global $member;\r
4232                 \r
4233                 $member->isAdmin() or self::disallow();\r
4234                 \r
4235                 // load skinie class\r
4236                 $aSkins = requestIntArray('skin');\r
4237                 $aTemplates = requestIntArray('template');\r
4238                 $info = postVar('info');\r
4239                 \r
4240                 self::skinieexport($aSkins, $aTemplates, $info);\r
4241                 \r
4242                 return;\r
4243         }\r
4244         \r
4245         /**\r
4246          * Admin::action_settingsedit()\r
4247          * \r
4248          * @param       Void\r
4249          * @return      Void\r
4250          */\r
4251         static private function action_settingsedit()\r
4252         {\r
4253                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4254                 \r
4255                 $member->isAdmin() or self::disallow();\r
4256                 \r
4257                 self::$skin->parse('settingsedit');\r
4258                 return;\r
4259         }\r
4260         \r
4261         /**\r
4262          * Admin::action_settingsupdate()\r
4263          * Update $CONFIG and redirect\r
4264          * \r
4265          * @param       void\r
4266          * @return      void\r
4267          */\r
4268         static private function action_settingsupdate()\r
4269         {\r
4270                 global $member, $CONF;\r
4271                 \r
4272                 $member->isAdmin() or self::disallow();\r
4273                 \r
4274                 // check if email address for admin is valid\r
4275                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4276                 {\r
4277                         self::error(_ERROR_BADMAILADDRESS);\r
4278                         return;\r
4279                 }\r
4280                 \r
4281                 // save settings\r
4282                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4283                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4284                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4285                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4286                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4287                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4288                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4289                 self::updateConfig('Locale',                    postVar('Locale'));\r
4290                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4291                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4292                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4293                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4294                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4295                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4296                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4297                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4298                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4299                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4300                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4301                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4302                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4303                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4304                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4305                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4306                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4307                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4308                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4309                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4310                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4311                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4312                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4313                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4314                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4315                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4316                 self::updateConfig('AdminSkin',                 postVar('adminskin'));\r
4317                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));\r
4318 \r
4319                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4320                 // note that when changing cookie settings, this redirect might cause the user\r
4321                 // to have to log in again.\r
4322                 getConfig();\r
4323                 redirect($CONF['AdminURL'] . '?action=manage');\r
4324                 return;\r
4325         }\r
4326         \r
4327         /**\r
4328          * Admin::action_systemoverview()\r
4329          * Output system overview\r
4330          * \r
4331          * @param       void\r
4332          * @return      void\r
4333          */\r
4334         static private function action_systemoverview()\r
4335         {\r
4336                 self::$skin->parse('systemoverview');\r
4337                 return;\r
4338         }\r
4339         \r
4340         /**\r
4341          * Admin::updateConfig()\r
4342          * \r
4343          * @param       string  $name   \r
4344          * @param       string  $val    \r
4345          * @return      integer return the ID in which the latest query posted\r
4346          */\r
4347         static private function updateConfig($name, $val)\r
4348         {\r
4349                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4350                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4351                 if ( DB::execute($query) === FALSE )\r
4352                 {\r
4353                         $err = DB::getError();\r
4354                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4355                 }\r
4356                 return DB::getInsertId();\r
4357         }\r
4358         \r
4359         /**\r
4360          * Admin::error()\r
4361          * Error message\r
4362          * \r
4363          * @param       string  $msg    message that will be shown\r
4364          * @return      void\r
4365          */\r
4366         static public function error($msg)\r
4367         {\r
4368                 self::$headMess = $msg;\r
4369                 self::$skin->parse('adminerrorpage');\r
4370                 return;\r
4371         }\r
4372         \r
4373         /**\r
4374          * Admin::disallow()\r
4375          * add error log and show error page \r
4376          * \r
4377          * @param       void\r
4378          * @return      void\r
4379          */\r
4380         static public function disallow()\r
4381         {\r
4382                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4383                 self::error(_ERROR_DISALLOWED);\r
4384                 return;\r
4385         }\r
4386 \r
4387         /**\r
4388          * Admin::action_PluginAdmin()\r
4389          * Output pluginadmin\r
4390          *\r
4391          * @param       string  $skinContents\r
4392          * @param       string  $extrahead\r
4393          * @return      void\r
4394          */\r
4395         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4396         {\r
4397                 self::$extrahead .= $extrahead;\r
4398                 self::$skin->parse('pluginadmin', $skinContents);\r
4399                 return;\r
4400         }\r
4401         \r
4402         /**\r
4403          * Admin::action_bookmarklet()\r
4404          * \r
4405          * @param       void\r
4406          * @return      void\r
4407          */\r
4408         static private function action_bookmarklet()\r
4409         {\r
4410                 global $member, $manager;\r
4411                 \r
4412                 $blogid = intRequestVar('blogid');\r
4413                 $member->teamRights($blogid) or self::disallow();\r
4414                 \r
4415                 self::$skin->parse('bookmarklet');\r
4416                 return;\r
4417         }\r
4418         \r
4419         /**\r
4420          * Admin::action_actionlog()\r
4421          * \r
4422          * @param       void\r
4423          * @return      void\r
4424          */\r
4425         static private function action_actionlog()\r
4426         {\r
4427                 global $member, $manager;\r
4428                 \r
4429                 $member->isAdmin() or self::disallow();\r
4430                 \r
4431                 self::$skin->parse('actionlog');\r
4432                 return;\r
4433         }\r
4434         \r
4435         /**\r
4436          * Admin::action_banlist()\r
4437          * \r
4438          * @param       void\r
4439          * @return      void\r
4440          */\r
4441         static private function action_banlist()\r
4442         {\r
4443                 global $member, $manager;\r
4444                 \r
4445                 $blogid = intRequestVar('blogid');\r
4446                 $member->blogAdminRights($blogid) or self::disallow();\r
4447                 \r
4448                 self::$skin->parse('banlist');\r
4449                 return;\r
4450         }\r
4451         \r
4452         /**\r
4453          * Admin::action_banlistdelete()\r
4454          * \r
4455          * @param       void\r
4456          * @return      void\r
4457          */\r
4458         static private function action_banlistdelete()\r
4459         {\r
4460                 global $member, $manager;\r
4461                 \r
4462                 $blogid = intRequestVar('blogid');\r
4463                 $member->blogAdminRights($blogid) or self::disallow();\r
4464                 \r
4465                 self::$skin->parse('banlistdelete');\r
4466                 return;\r
4467         }\r
4468         \r
4469         /**\r
4470          * Admin::action_banlistdeleteconfirm()\r
4471          * \r
4472          * @param       void\r
4473          * @return      void\r
4474          */\r
4475         static private function action_banlistdeleteconfirm()\r
4476         {\r
4477                 global $member, $manager;\r
4478                 \r
4479                 $blogid         = intPostVar('blogid');\r
4480                 $allblogs       = postVar('allblogs');\r
4481                 $iprange        = postVar('iprange');\r
4482                 \r
4483                 $member->blogAdminRights($blogid) or self::disallow();\r
4484                 \r
4485                 $deleted = array();\r
4486                 \r
4487                 if ( !$allblogs )\r
4488                 {\r
4489                         if ( Ban::removeBan($blogid, $iprange) )\r
4490                         {\r
4491                                 $deleted[] = $blogid;\r
4492                         }\r
4493                 }\r
4494                 else\r
4495                 {\r
4496                         // get blogs fot which member has admin rights\r
4497                         $adminblogs = $member->getAdminBlogs();\r
4498                         foreach ($adminblogs as $blogje)\r
4499                         {\r
4500                                 if ( Ban::removeBan($blogje, $iprange) )\r
4501                                 {\r
4502                                         $deleted[] = $blogje;\r
4503                                 }\r
4504                         }\r
4505                 }\r
4506                 \r
4507                 if ( sizeof($deleted) == 0 )\r
4508                 {\r
4509                         self::error(_ERROR_DELETEBAN);\r
4510                         return;\r
4511                 }\r
4512                 \r
4513                 /* TODO: we should use other ways */\r
4514                 $_REQUEST['delblogs'] = $deleted;\r
4515                 \r
4516                 self::$skin->parse('banlistdeleteconfirm');\r
4517                 return;\r
4518         }\r
4519         \r
4520         /**\r
4521          * Admin::action_banlistnewfromitem()\r
4522          * \r
4523          * @param       void\r
4524          * @return      void\r
4525          */\r
4526         static private function action_banlistnewfromitem()\r
4527         {\r
4528                 global $manager;\r
4529                 \r
4530                 $itemid = intRequestVar('itemid');\r
4531                 $item =& $manager->getItem($itemid, 1, 1);\r
4532                 self::action_banlistnew($item['blogid']);\r
4533                 return;\r
4534         }\r
4535         \r
4536         /**\r
4537          * Admin::action_banlistnew()\r
4538          * \r
4539          * @param       integer $blogid ID for weblog\r
4540          * @return      void\r
4541          */\r
4542         static private function action_banlistnew($blogid = '')\r
4543         {\r
4544                 global $member, $manager;\r
4545                 \r
4546                 if ( $blogid == '' )\r
4547                 {\r
4548                         $blogid = intRequestVar('blogid');\r
4549                 }\r
4550                 \r
4551                 $ip = requestVar('ip');\r
4552                 \r
4553                 $member->blogAdminRights($blogid) or self::disallow();\r
4554                 \r
4555                 /* TODO: we should consider to use the other way instead of this */\r
4556                 $_REQUEST['blogid'] = $blogid;          \r
4557                 \r
4558                 self::$skin->parse('banlistnew');\r
4559                 \r
4560                 return;\r
4561         }\r
4562 \r
4563         /**\r
4564          * Admin::action_banlistadd()\r
4565          * \r
4566          * @param       void\r
4567          * @return      void\r
4568          */\r
4569         static private function action_banlistadd()\r
4570         {\r
4571                 global $member;\r
4572                 \r
4573                 $blogid         = intPostVar('blogid');\r
4574                 $allblogs       = postVar('allblogs');\r
4575                 $iprange        = postVar('iprange');\r
4576                 \r
4577                 if ( $iprange == "custom" )\r
4578                 {\r
4579                         $iprange = postVar('customiprange');\r
4580                 }\r
4581                 $reason   = postVar('reason');\r
4582                 \r
4583                 $member->blogAdminRights($blogid) or self::disallow();\r
4584                 \r
4585                 // TODO: check IP range validity\r
4586                 \r
4587                 if ( !$allblogs )\r
4588                 {\r
4589                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4590                         {\r
4591                                 self::error(_ERROR_ADDBAN);\r
4592                                 return;\r
4593                         }\r
4594                 }\r
4595                 else\r
4596                 {\r
4597                         // get blogs fot which member has admin rights\r
4598                         $adminblogs = $member->getAdminBlogs();\r
4599                         $failed = 0;\r
4600                         foreach ($adminblogs as $blogje)\r
4601                         {\r
4602                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4603                                 {\r
4604                                         $failed = 1;\r
4605                                 }\r
4606                         }\r
4607                         if ( $failed )\r
4608                         {\r
4609                                 self::error(_ERROR_ADDBAN);\r
4610                                 return;\r
4611                         }\r
4612                 }\r
4613                 self::action_banlist();\r
4614                 return;\r
4615         }\r
4616         \r
4617         /**\r
4618          * Admin::action_clearactionlog()\r
4619          * \r
4620          * @param       void\r
4621          * @return      void\r
4622          */\r
4623         static private function action_clearactionlog()\r
4624         {\r
4625                 global $member;\r
4626                 \r
4627                 $member->isAdmin() or self::disallow();\r
4628                 \r
4629                 ActionLog::clear();\r
4630                 \r
4631                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4632                 return;\r
4633         }\r
4634         \r
4635         /**\r
4636          * Admin::action_backupoverview()\r
4637          * \r
4638          * @param       void\r
4639          * @return      void\r
4640          */\r
4641         static private function action_backupoverview()\r
4642         {\r
4643                 global $member, $manager;\r
4644                 \r
4645                 $member->isAdmin() or self::disallow();\r
4646                 \r
4647                 self::$skin->parse('backupoverview');\r
4648                 return;\r
4649         }\r
4650 \r
4651         /**\r
4652          * Admin::action_backupcreate()\r
4653          * create file for backup\r
4654          * \r
4655          * @param               void\r
4656          * @return      void\r
4657          * \r
4658          */\r
4659         static private function action_backupcreate()\r
4660         {\r
4661                 global $member, $DIR_LIBS;\r
4662                 \r
4663                 $member->isAdmin() or self::disallow();\r
4664                 \r
4665                 // use compression ?\r
4666                 $useGzip = (integer) postVar('gzip');\r
4667                 \r
4668                 include($DIR_LIBS . 'backup.php');\r
4669                 \r
4670                 // try to extend time limit\r
4671                 // (creating/restoring dumps might take a while)\r
4672                 @set_time_limit(1200);\r
4673                 \r
4674                 Backup::do_backup($useGzip);\r
4675                 return;\r
4676         }\r
4677         \r
4678         /**\r
4679          * Admin::action_backuprestore()\r
4680          * restoring from uploaded file\r
4681          * \r
4682          * @param               void\r
4683          * @return      void\r
4684          */\r
4685         static private function action_backuprestore()\r
4686         {\r
4687                 global $member, $DIR_LIBS;\r
4688                 \r
4689                 $member->isAdmin() or self::disallow();\r
4690                 \r
4691                 if ( intPostVar('letsgo') != 1 )\r
4692                 {\r
4693                         self::error(_ERROR_BACKUP_NOTSURE);\r
4694                         return;\r
4695                 }\r
4696                 \r
4697                 include($DIR_LIBS . 'backup.php');\r
4698                 \r
4699                 // try to extend time limit\r
4700                 // (creating/restoring dumps might take a while)\r
4701                 @set_time_limit(1200);\r
4702                 \r
4703                 $message = Backup::do_restore();\r
4704                 if ( $message != '' )\r
4705                 {\r
4706                         self::error($message);\r
4707                         return;\r
4708                 }\r
4709                 self::$skin->parse('backuprestore');\r
4710                 return;\r
4711         }\r
4712         \r
4713         /**\r
4714          * Admin::action_pluginlist()\r
4715          * output the list of installed plugins\r
4716          * \r
4717          * @param       void\r
4718          * @return      void\r
4719          * \r
4720          */\r
4721         static private function action_pluginlist()\r
4722         {\r
4723                 global $DIR_PLUGINS, $member, $manager;\r
4724                 \r
4725                 // check if allowed\r
4726                 $member->isAdmin() or self::disallow();\r
4727                 \r
4728                 self::$skin->parse('pluginlist');\r
4729                 return;\r
4730         }\r
4731         \r
4732         /**\r
4733          * Admin::action_pluginhelp()\r
4734          * \r
4735          * @param       void\r
4736          * @return      void\r
4737          */\r
4738         static private function action_pluginhelp()\r
4739         {\r
4740                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
4741                 \r
4742                 // check if allowed\r
4743                 $member->isAdmin() or self::disallow();\r
4744                 \r
4745                 $plugid = intGetVar('plugid');\r
4746                 \r
4747                 if ( !$manager->pidInstalled($plugid) )\r
4748                 {\r
4749                         self::error(_ERROR_NOSUCHPLUGIN);\r
4750                         return;\r
4751                 }\r
4752                 \r
4753                 self::$skin->parse('pluginhelp');\r
4754                 return;\r
4755         }\r
4756         \r
4757         /**\r
4758          * Admin::action_pluginadd()\r
4759          * \r
4760          * @param       Void\r
4761          * @return      Void\r
4762          * \r
4763          */\r
4764         static private function action_pluginadd()\r
4765         {\r
4766                 global $member, $manager, $DIR_PLUGINS;\r
4767                 \r
4768                 // check if allowed\r
4769                 $member->isAdmin() or self::disallow();\r
4770                 \r
4771                 $name = postVar('filename');\r
4772                 \r
4773                 if ( $manager->pluginInstalled($name) )\r
4774                 {\r
4775                         self::error(_ERROR_DUPPLUGIN);\r
4776                         return;\r
4777                 }\r
4778                 \r
4779                 if ( !checkPlugin($name) )\r
4780                 {\r
4781                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
4782                         return;\r
4783                 }\r
4784                 \r
4785                 // get number of currently installed plugins\r
4786                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
4787                 $numCurrent = $res->rowCount();\r
4788                 \r
4789                 // plugin will be added as last one in the list\r
4790                 $newOrder = $numCurrent + 1;\r
4791                 \r
4792                 $data = array('file' => &$name);\r
4793                 $manager->notify('PreAddPlugin', $data);\r
4794                 \r
4795                 // do this before calling getPlugin (in case the plugin id is used there)\r
4796                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
4797                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
4798                 DB::execute($query);\r
4799                 $iPid = DB::getInsertId();\r
4800                 \r
4801                 $manager->clearCachedInfo('installedPlugins');\r
4802                 \r
4803                 // Load the plugin for condition checking and instalation\r
4804                 $plugin =& $manager->getPlugin($name);\r
4805                 \r
4806                 // check if it got loaded (could have failed)\r
4807                 if ( !$plugin )\r
4808                 {\r
4809                         $query = "DELETE FROM %s WHERE pid=%d;";\r
4810                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
4811                         \r
4812                         DB::execute($query);\r
4813                         \r
4814                         $manager->clearCachedInfo('installedPlugins');\r
4815                         self::error(_ERROR_PLUGIN_LOAD);\r
4816                         return;\r
4817                 }\r
4818                 \r
4819                 // check if plugin needs a newer Nucleus version\r
4820                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
4821                 {\r
4822                         // uninstall plugin again...\r
4823                         self::deleteOnePlugin($plugin->getID());\r
4824                         \r
4825                         // ...and show error\r
4826                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
4827                         return;\r
4828                 }\r
4829                 \r
4830                 // check if plugin needs a newer Nucleus version\r
4831                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
4832                 {\r
4833                         // uninstall plugin again...\r
4834                         self::deleteOnePlugin($plugin->getID());\r
4835                         \r
4836                         // ...and show error\r
4837                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
4838                         return;\r
4839                 }\r
4840                 \r
4841                 $pluginList = $plugin->getPluginDep();\r
4842                 foreach ( $pluginList as $pluginName )\r
4843                 {\r
4844                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
4845                         if ($res->rowCount() == 0)\r
4846                         {\r
4847                                 // uninstall plugin again...\r
4848                                 self::deleteOnePlugin($plugin->getID());\r
4849                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
4850                                 return;\r
4851                         }\r
4852                 }\r
4853                 \r
4854                 // call the install method of the plugin\r
4855                 $plugin->install();\r
4856                 \r
4857                 $data = array('plugin' => &$plugin);\r
4858                 $manager->notify('PostAddPlugin', $data);\r
4859                 \r
4860                 // update all events\r
4861                 self::action_pluginupdate();\r
4862                 return;\r
4863         }\r
4864         \r
4865         /**\r
4866          * ADMIN:action_pluginupdate():\r
4867          * \r
4868          * @param       Void\r
4869          * @return      Void\r
4870          * \r
4871          */\r
4872         static private function action_pluginupdate()\r
4873         {\r
4874                 global $member, $manager, $CONF;\r
4875                 \r
4876                 // check if allowed\r
4877                 $member->isAdmin() or self::disallow();\r
4878                 \r
4879                 // delete everything from plugin_events\r
4880                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
4881                 \r
4882                 // loop over all installed plugins\r
4883                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
4884                 foreach ( $res as $row )\r
4885                 {\r
4886                         $pid  =  $row['pid'];\r
4887                         $plug =& $manager->getPlugin($row['pfile']);\r
4888                         if ( $plug )\r
4889                         {\r
4890                                 $eventList = $plug->getEventList();\r
4891                                 foreach ( $eventList as $eventName )\r
4892                                 {\r
4893                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
4894                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
4895                                         DB::execute($query);\r
4896                                 }\r
4897                         }\r
4898                 }\r
4899                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
4900                 return;\r
4901         }\r
4902         \r
4903         /**\r
4904          * Admin::action_plugindelete()\r
4905          * \r
4906          * @param       void\r
4907          * @return      void\r
4908          */\r
4909         static private function action_plugindelete()\r
4910         {\r
4911                 global $member, $manager;\r
4912                 \r
4913                 // check if allowed\r
4914                 $member->isAdmin() or self::disallow();\r
4915                 \r
4916                 $pid = intGetVar('plugid');\r
4917                 \r
4918                 if ( !$manager->pidInstalled($pid) )\r
4919                 {\r
4920                         self::error(_ERROR_NOSUCHPLUGIN);\r
4921                         return;\r
4922                 }\r
4923                 \r
4924                 self::$skin->parse('plugindelete');\r
4925                 return;\r
4926         }\r
4927 \r
4928         /**\r
4929          * Admin::action_plugindeleteconfirm()\r
4930          * \r
4931          * @param       void\r
4932          * @return      void\r
4933          */\r
4934         static private function action_plugindeleteconfirm()\r
4935         {\r
4936                 global $member, $manager, $CONF;\r
4937                 \r
4938                 // check if allowed\r
4939                 $member->isAdmin() or self::disallow();\r
4940                 \r
4941                 $pid = intPostVar('plugid');\r
4942                 \r
4943                 $error = self::deleteOnePlugin($pid, 1);\r
4944                 if ( $error )\r
4945                 {\r
4946                         self::error($error);\r
4947                         return;\r
4948                 }\r
4949                 \r
4950                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
4951                 return;\r
4952         }\r
4953         \r
4954         /**\r
4955          * Admin::deleteOnePlugin()\r
4956          * \r
4957          * @param       integer $pid\r
4958          * @param       boolean $callUninstall\r
4959          * @return      string  empty or message if failed\r
4960          */\r
4961         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
4962         {\r
4963                 global $manager;\r
4964                 \r
4965                 $pid = intval($pid);\r
4966                 \r
4967                 if ( !$manager->pidInstalled($pid) )\r
4968                 {\r
4969                         return _ERROR_NOSUCHPLUGIN;\r
4970                 }\r
4971                 \r
4972                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
4973                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
4974                 $name = DB::getValue($query);\r
4975                 \r
4976                 // check dependency before delete\r
4977                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
4978                 foreach ( $res as $row )\r
4979                 {\r
4980                         $plug =& $manager->getPlugin($row['pfile']);\r
4981                         if ( $plug )\r
4982                         {\r
4983                                 $depList = $plug->getPluginDep();\r
4984                                 foreach ( $depList as $depName )\r
4985                                 {\r
4986                                         if ( $name == $depName )\r
4987                                         {\r
4988                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
4989                                         }\r
4990                                 }\r
4991                         }\r
4992                 }\r
4993                 \r
4994                 $data = array('plugid' => $pid);\r
4995                 $manager->notify('PreDeletePlugin', $data);\r
4996                 \r
4997                 // call the unInstall method of the plugin\r
4998                 if ( $callUninstall )\r
4999                 {\r
5000                         $plugin =& $manager->getPlugin($name);\r
5001                         if ( $plugin )\r
5002                         {\r
5003                                 $plugin->unInstall();\r
5004                         }\r
5005                 }\r
5006                 \r
5007                 // delete all subscriptions\r
5008                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5009                 \r
5010                 // delete all options\r
5011                 // get OIDs from plugin_option_desc\r
5012                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5013                 $aOIDs = array();\r
5014                 foreach ( $res as $row )\r
5015                 {\r
5016                         array_push($aOIDs, $row['oid']);\r
5017                 }\r
5018                 \r
5019                 // delete from plugin_option and plugin_option_desc\r
5020                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5021                 if (count($aOIDs) > 0)\r
5022                 {\r
5023                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5024                 }\r
5025                 \r
5026                 // update order numbers\r
5027                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5028                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5029                 \r
5030                 // delete row\r
5031                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5032                 \r
5033                 $manager->clearCachedInfo('installedPlugins');\r
5034                 $data = array('plugid' => $pid);\r
5035                 $manager->notify('PostDeletePlugin', $data);\r
5036                 \r
5037                 return '';\r
5038         }\r
5039         \r
5040         /**\r
5041          * Admin::action_pluginup()\r
5042          * \r
5043          * @param       void\r
5044          * @return      void\r
5045          */\r
5046         static private function action_pluginup()\r
5047         {\r
5048                 global $member, $manager, $CONF;\r
5049                 \r
5050                 // check if allowed\r
5051                 $member->isAdmin() or self::disallow();\r
5052                 \r
5053                 $plugid = intGetVar('plugid');\r
5054                 \r
5055                 if ( !$manager->pidInstalled($plugid) )\r
5056                 {\r
5057                         self::error(_ERROR_NOSUCHPLUGIN);\r
5058                         return;\r
5059                 }\r
5060                 \r
5061                 // 1. get old order number\r
5062                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5063                 \r
5064                 // 2. calculate new order number\r
5065                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5066                 \r
5067                 // 3. update plug numbers\r
5068                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5069                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5070                 \r
5071                 //self::action_pluginlist();\r
5072                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5073                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5074                 return;\r
5075         }\r
5076         \r
5077         /**\r
5078          * Admin::action_plugindown()\r
5079          * \r
5080          * @param       void\r
5081          * @return      void\r
5082          */\r
5083         static private function action_plugindown()\r
5084         {\r
5085                 global $member, $manager, $CONF;\r
5086                 \r
5087                 // check if allowed\r
5088                 $member->isAdmin() or self::disallow();\r
5089                 \r
5090                 $plugid = intGetVar('plugid');\r
5091                 if ( !$manager->pidInstalled($plugid) )\r
5092                 {\r
5093                         self::error(_ERROR_NOSUCHPLUGIN);\r
5094                         return;\r
5095                 }\r
5096                 \r
5097                 // 1. get old order number\r
5098                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5099                 \r
5100                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5101                 $maxOrder = $res->rowCount();\r
5102                 \r
5103                 // 2. calculate new order number\r
5104                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5105                 \r
5106                 // 3. update plug numbers\r
5107                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5108                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5109                 \r
5110                 //self::action_pluginlist();\r
5111                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5112                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5113                 return;\r
5114         }\r
5115         \r
5116         /**\r
5117          * Admin::action_pluginoptions()\r
5118          * \r
5119          * Output Plugin option page\r
5120          * \r
5121          * @access      public\r
5122          * @param       string $message message when fallbacked\r
5123          * @return      void\r
5124          * \r
5125          */\r
5126         static private function action_pluginoptions($message = '')\r
5127         {\r
5128                 global $member, $manager;\r
5129                 \r
5130                 // check if allowed\r
5131                 $member->isAdmin() or self::disallow();\r
5132                 \r
5133                 $pid = intRequestVar('plugid');\r
5134                 if ( !$manager->pidInstalled($pid) )\r
5135                 {\r
5136                         self::error(_ERROR_NOSUCHPLUGIN);\r
5137                         return;\r
5138                 }\r
5139                 \r
5140                 if ( isset($message) )\r
5141                 {\r
5142                         self::$headMess = $message;\r
5143                 }\r
5144                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5145                 $plugin         = $manager->getPlugin($plugname);\r
5146                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
5147                 \r
5148                 self::$skin->parse('pluginoptions');\r
5149                 return;\r
5150         }\r
5151         \r
5152         /**\r
5153          * Admin::action_pluginoptionsupdate()\r
5154          * \r
5155          * Update plugin options and fallback to plugin option page\r
5156          * \r
5157          * @access      public\r
5158          * @param       void\r
5159          * @return      void\r
5160          */\r
5161         static private function action_pluginoptionsupdate()\r
5162         {\r
5163                 global $member, $manager;\r
5164                 \r
5165                 // check if allowed\r
5166                 $member->isAdmin() or self::disallow();\r
5167                 \r
5168                 $pid = intRequestVar('plugid');\r
5169                 \r
5170                 if ( !$manager->pidInstalled($pid) )\r
5171                 {\r
5172                         self::error(_ERROR_NOSUCHPLUGIN);\r
5173                         return;\r
5174                 }\r
5175                 \r
5176                 $aOptions = requestArray('plugoption');\r
5177                 NucleusPlugin::apply_plugin_options($aOptions);\r
5178                 \r
5179                 $data = array(\r
5180                         'context'       => 'global',\r
5181                         'plugid'        => $pid\r
5182                 );\r
5183                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5184                 \r
5185                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5186                 return;\r
5187         }\r
5188         \r
5189         /**\r
5190          * Admin::skineditgeneral()\r
5191          * \r
5192          * @param       integer $skinid\r
5193          * @param       string  $handler\r
5194          * @return      string  empty or message if failed\r
5195          */\r
5196         static private function skineditgeneral($skinid, $handler='')\r
5197         {\r
5198                 global $manager;\r
5199                 \r
5200                 $name = postVar('name');\r
5201                 $desc = postVar('desc');\r
5202                 $type = postVar('type');\r
5203                 $inc_mode = postVar('inc_mode');\r
5204                 $inc_prefix = postVar('inc_prefix');\r
5205                 \r
5206                 $skin =& $manager->getSkin($skinid, $handler);\r
5207                 \r
5208                 // 1. Some checks\r
5209                 if ( !isValidSkinName($name) )\r
5210                 {\r
5211                         return _ERROR_BADSKINNAME;\r
5212                 }\r
5213                 \r
5214                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
5215                 {\r
5216                         return _ERROR_DUPSKINNAME;\r
5217                 }\r
5218                 \r
5219                 if ( !$type )\r
5220                 {\r
5221                         $type = 'text/html';\r
5222                 }\r
5223                 \r
5224                 if ( !$inc_mode )\r
5225                 {\r
5226                         $inc_mode = 'normal';\r
5227                 }\r
5228                 \r
5229                 // 2. Update description\r
5230                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
5231                 \r
5232                 return '';\r
5233         }\r
5234         /**\r
5235          * Admin::skindeleteconfirm()\r
5236          * \r
5237          * @param       integer $skinid\r
5238          * @return      void\r
5239          */\r
5240         static private function skindeleteconfirm($skinid)\r
5241         {\r
5242                 global $manager;\r
5243                 \r
5244                 if ( !in_array(self::$action, self::$adminskin_actions) )\r
5245                 {\r
5246                         $event_identifier = 'Skin';\r
5247                 }\r
5248                 else\r
5249                 {\r
5250                         $event_identifier = 'AdminSkin';\r
5251                 }\r
5252                 \r
5253                 $manager->notify("PreDelete{$event_identifier}", array('skinid' => $skinid));\r
5254                 \r
5255                 // 1. delete description\r
5256                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
5257                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5258                 DB::execute($query);\r
5259                 \r
5260                 // 2. delete parts\r
5261                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
5262                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
5263                 DB::execute($query);\r
5264                 \r
5265                 $manager->notify("PostDelete{$event_identifier}", array('skinid' => $skinid));\r
5266                 \r
5267                 return;\r
5268         }\r
5269         \r
5270         /**\r
5271          * Admin::skinremovetypeconfirm()\r
5272          * \r
5273          * @param       integer $skinid\r
5274          * @param       string  $skintype\r
5275          * @return      string  empty or message if failed\r
5276          */\r
5277         static private function skinremovetypeconfirm($skinid, $skintype)\r
5278         {\r
5279                 global $manager;\r
5280                 \r
5281                 if ( !in_array(self::$action, self::$adminskin_actions) )\r
5282                 {\r
5283                         $event_identifier = 'Skin';\r
5284                 }\r
5285                 else\r
5286                 {\r
5287                         $event_identifier = 'AdminSkin';\r
5288                 }\r
5289                 \r
5290                 if ( !isValidShortName($skintype) )\r
5291                 {\r
5292                         return _ERROR_SKIN_PARTS_SPECIAL_DELETE;\r
5293                 }\r
5294                 \r
5295                 $data = array(\r
5296                         'skinid'        => $skinid,\r
5297                         'skintype'      => $skintype\r
5298                 );\r
5299                 $manager->notify("PreDelete{$event_identifier}Part", $data);\r
5300                 \r
5301                 // delete part\r
5302                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s;';\r
5303                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
5304                 DB::execute($query);\r
5305                 \r
5306                 $data = array(\r
5307                         'skinid'        => $skinid,\r
5308                         'skintype'      => $skintype\r
5309                 );\r
5310                 $manager->notify("PostDelete{$event_identifier}Part", $data);\r
5311                 \r
5312                 return '';\r
5313         }\r
5314         \r
5315         /**\r
5316          * Admin::skinclone()\r
5317          * \r
5318          * @param       integer $skinid\r
5319          * @param       string  $handler\r
5320          * @return      void\r
5321          */\r
5322         static private function skinclone($skinid, $handler='')\r
5323         {\r
5324                 global $manager;\r
5325                 \r
5326                 // 1. read skin to clone\r
5327                 $skin =& $manager->getSkin($skinid, $handler);\r
5328                 $name = "{$skin->getName()}_clone";\r
5329                 \r
5330                 // if a skin with that name already exists:\r
5331                 if ( Skin::exists($name) )\r
5332                 {\r
5333                         $i = 1;\r
5334                         while ( Skin::exists($name . $i) )\r
5335                         {\r
5336                                 $i++;\r
5337                         }\r
5338                         $name .= $i;\r
5339                 }\r
5340                 \r
5341                 // 2. create skin desc\r
5342                 $newid = Skin::createNew(\r
5343                         $name,\r
5344                         $skin->getDescription(),\r
5345                         $skin->getContentType(),\r
5346                         $skin->getIncludeMode(),\r
5347                         $skin->getIncludePrefix()\r
5348                 );\r
5349                 \r
5350                 // 3. clone\r
5351                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
5352                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
5353                 \r
5354                 $res = DB::getResult($query);\r
5355                 foreach ( $res as $row )\r
5356                 {\r
5357                         $content = $skin->getContentFromDB($row['stype']);\r
5358                         if ( $content )\r
5359                         {\r
5360                                 $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
5361                                 $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($row['stype']));\r
5362                                 DB::execute($query);\r
5363                         }\r
5364                 }\r
5365                 return;\r
5366         }\r
5367         \r
5368         /**\r
5369          * Admin::skinieimport()\r
5370          * \r
5371          * @param       string  $mode\r
5372          * @param       string  $skinFileRaw\r
5373          * @return      string  empty or message if failed\r
5374          */\r
5375         static private function skinieimport($mode, $skinFileRaw)\r
5376         {\r
5377                 global $DIR_LIBS, $DIR_SKINS;\r
5378                 \r
5379                 // load skinie class\r
5380                 include_once($DIR_LIBS . 'skinie.php');\r
5381                 \r
5382                 $importer = new SkinImport();\r
5383                 \r
5384                 // get full filename\r
5385                 if ( $mode == 'file' )\r
5386                 {\r
5387                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
5388                 }\r
5389                 else\r
5390                 {\r
5391                         $skinFile = $skinFileRaw;\r
5392                 }\r
5393                 \r
5394                 // read only metadata\r
5395                 $error = $importer->readFile($skinFile, 1);\r
5396                 if ( $error )\r
5397                 {\r
5398                         unset($importer);\r
5399                         return $error;\r
5400                 }\r
5401                 \r
5402                 self::$contents['mode']         = $mode;\r
5403                 self::$contents['skinfile']     = $skinFileRaw;\r
5404                 self::$contents['skininfo']     = $importer->getInfo();\r
5405                 self::$contents['skinnames']    = $importer->getSkinNames();\r
5406                 self::$contents['tpltnames']    = $importer->getTemplateNames();\r
5407                 \r
5408                 // clashes\r
5409                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
5410                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
5411                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
5412                 \r
5413                 self::$contents['skinclashes'] = $skinNameClashes;\r
5414                 self::$contents['tpltclashes'] = $templateNameClashes;\r
5415                 self::$contents['nameclashes'] = $hasNameClashes ? 1 : 0;\r
5416                 \r
5417                 unset($importer);\r
5418                 return '';\r
5419         }\r
5420         \r
5421         /**\r
5422          * Admin::skinieedoimport()\r
5423          * \r
5424          * @param       string  $mode\r
5425          * @param       string  $skinFileRaw\r
5426          * @param       boolean $allowOverwrite\r
5427          * @return      string  empty   or message if failed\r
5428          */\r
5429         static private function skiniedoimport($mode, $skinFileRaw, $allowOverwrite)\r
5430         {\r
5431                 global $DIR_LIBS, $DIR_SKINS;\r
5432                 \r
5433                 // load skinie class\r
5434                 include_once($DIR_LIBS . 'skinie.php');\r
5435                 \r
5436                 $importer = new SkinImport();\r
5437                 \r
5438                 // get full filename\r
5439                 if ( $mode == 'file' )\r
5440                 {\r
5441                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
5442                 }\r
5443                 else\r
5444                 {\r
5445                         $skinFile = $skinFileRaw;\r
5446                 }\r
5447                 \r
5448                 $error = $importer->readFile($skinFile);\r
5449                 if ( $error )\r
5450                 {\r
5451                         unset($importer);\r
5452                         return $error;\r
5453                 }\r
5454                 \r
5455                 $error = $importer->writeToDatabase($allowOverwrite);\r
5456                 if ( $error )\r
5457                 {\r
5458                         unset($importer);\r
5459                         return $error;\r
5460                 }\r
5461                 \r
5462                 self::$contents['mode']         = $mode;\r
5463                 self::$contents['skinfile']     = $skinFileRaw;\r
5464                 self::$contents['skininfo']     = $importer->getInfo();\r
5465                 self::$contents['skinnames']    = $importer->getSkinNames();\r
5466                 self::$contents['tpltnames']    = $importer->getTemplateNames();\r
5467                 \r
5468                 unset($importer);\r
5469                 return '';\r
5470         }\r
5471         \r
5472         /**\r
5473          * Admin::skinieexport()\r
5474          * \r
5475          * @param       array   $aSkins\r
5476          * @param       array   $aTemplates\r
5477          * @param       string  $info\r
5478          * @return      void\r
5479          */\r
5480         static private function skinieexport($aSkins, $aTemplates, $info)\r
5481         {\r
5482                 global $DIR_LIBS;\r
5483                 \r
5484                 // load skinie class\r
5485                 include_once($DIR_LIBS . 'skinie.php');\r
5486                 \r
5487                 if ( !is_array($aSkins) )\r
5488                 {\r
5489                         $aSkins = array();\r
5490                 }\r
5491                 \r
5492                 if (!is_array($aTemplates))\r
5493                 {\r
5494                         $aTemplates = array();\r
5495                 }\r
5496                 \r
5497                 $skinList = array_keys($aSkins);\r
5498                 $templateList = array_keys($aTemplates);\r
5499                 \r
5500                 $exporter = new SkinExport();\r
5501                 foreach ( $skinList as $skinId )\r
5502                 {\r
5503                         $exporter->addSkin($skinId);\r
5504                 }\r
5505                 foreach ( $templateList as $templateId )\r
5506                 {\r
5507                         $exporter->addTemplate($templateId);\r
5508                 }\r
5509                 $exporter->setInfo($info);\r
5510                 $exporter->export();\r
5511                 \r
5512                 return;\r
5513         }\r
5514         \r
5515         /**\r
5516          * Admin::action_parseSpecialskin()\r
5517          * \r
5518          * @param       void\r
5519          * @return      void\r
5520          */\r
5521         static private function action_parseSpecialskin()\r
5522         {\r
5523                 self::$skin->parse(self::$action);\r
5524                 return;\r
5525         }\r
5526 }\r