nucleus/libs/ADMIN.php

   1 <?php
   2 /**
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18  */
  19
  20 if ( !function_exists('requestVar') ) exit;
  21 require_once dirname(__FILE__) . '/showlist.php';
  22
  23 class Admin
  24 {
  25         static private $skin;
  26
  27         static public $action;
  28         static public $aOptions;
  29         static public $blog;
  30         static public $contents;
  31         static public $extrahead;
  32         static public $headMess;
  33         static public $passvar;
  34
  35         static private $skinless_actions = array(
  36                 'plugindeleteconfirm',
  37                 'pluginoptionsupdate',
  38                 'blogsettingsupdate',
  39                 'settingsupdate',
  40                 'addnewlog2',
  41                 'additem',
  42                 'banlistnewfromitem',
  43                 'itemdeleteconfirm',
  44                 'itemupdate',
  45                 'changemembersettings',
  46                 'clearactionlog',
  47                 'memberedit',
  48                 'login',
  49
  50                 'skinremovetypeconfirm',
  51                 'skinclone',
  52                 'skindeleteconfirm',
  53                 'skinnew',
  54                 'skineditgeneral',
  55                 'skinupdate',
  56
  57                 'skinieexport',
  58
  59                 'templateupdate',
  60                 'templatedeleteconfirm',
  61                 'templatenew',
  62                 'templateclone',
  63
  64                 'adminskinremovetypeconfirm',
  65                 'adminskinclone',
  66                 'adminskindeleteconfirm',
  67                 'adminskinnew',
  68                 'adminskineditgeneral',
  69                 'adminskinupdate',
  70
  71                 'adminskinieexport',
  72
  73                 'admintemplateupdate',
  74                 'admintemplatedeleteconfirm',
  75                 'admintemplatenew',
  76                 'admintemplateclone'
  77         );
  78
  79         static private $ticketless_actions = array(
  80                 'showlogin',
  81                 'login',
  82                 'overview',
  83                 'itemlist',
  84                 'blogcommentlist',
  85                 'bookmarklet',
  86                 'blogsettings',
  87                 'banlist',
  88                 'createaccount',
  89                 'deleteblog',
  90                 'editmembersettings',
  91                 'createaccount',
  92                 'forgotpassword',
  93                 'browseowncomments',
  94                 'createitem',
  95                 'browseownitems',
  96                 'itemedit',
  97                 'itemmove',
  98                 'categoryedit',
  99                 'categorydelete',
 100                 'manage',
 101                 'actionlog',
 102                 'settingsedit',
 103                 'backupoverview',
 104                 'pluginlist',
 105                 'createnewlog',
 106                 'usermanagement',
 107                 'itemcommentlist',
 108                 'commentedit',
 109                 'commentdelete',
 110                 'banlistnewfromitem',
 111                 'banlistdelete',
 112                 'itemdelete',
 113                 'manageteam',
 114                 'teamdelete',
 115                 'banlistnew',
 116                 'memberedit',
 117                 'memberdelete',
 118                 'pluginhelp',
 119                 'pluginoptions',
 120                 'plugindelete',
 121
 122                 'activate',
 123                 'systemoverview',
 124                 'activatesetpwd',
 125
 126                 'skinoverview',
 127                 'skinclone',
 128                 'skindelete',
 129                 'skinedit',
 130                 'skinedittype',
 131                 'skinnew',
 132                 'skinremovetype',
 133
 134                 'skinieoverview',
 135
 136                 'templateoverview',
 137                 'templateclone',
 138                 'templateedit',
 139                 'templatedelete',
 140
 141                 'adminskinoverview',
 142                 'adminskinclone',
 143                 'adminskindelete',
 144                 'adminskinedit',
 145                 'adminskinedittype',
 146                 'adminskinnew',
 147                 'adminskinremovetype',
 148
 149                 'adminskinieoverview',
 150
 151                 'admintemplateoverview',
 152                 'admintemplateclone',
 153                 'admintemplateedit',
 154                 'admintemplatedelete'
 155         );
 156
 157         /**
 158          * NOTE: This is for condition of admin/normal skin actions
 159          */
 160         static public $adminskin_actions = array(
 161                 /* ticketless */
 162                 'adminskinoverview',
 163                 'adminskinclone',
 164                 'adminskindelete',
 165                 'adminskinedit',
 166                 'adminskinedittype',
 167                 'adminskinnew',
 168                 'adminskinremovetype',
 169
 170                 'adminskinieoverview',
 171
 172                 'admintemplateoverview',
 173                 'admintemplateclone',
 174                 'admintemplateedit',
 175                 'admintemplatedelete',
 176
 177                 /* ticket needed */
 178                 'adminskineditgeneral',
 179                 'adminskinupdate',
 180                 'adminskindeleteconfirm',
 181                 'adminskinremovetypeconfirm',
 182
 183                 'adminskinieoverview',
 184                 'adminskiniedoimport',
 185                 'adminskinieexport',
 186                 'adminskinieimport',
 187
 188                 'admintemplatenew',
 189                 'admintemplatedeleteconfirm',
 190                 'admintemplateupdate'
 191         );
 192
 193         static public function initialize()
 194         {
 195                 global $CONF, $manager, $member;
 196
 197                 /* NOTE: 1. decide which skinid to use */
 198                 $skinid = $CONF['AdminSkin'];
 199                 if ( $member->isLoggedIn() )
 200                 {
 201                         $memskin = $member->getAdminSkin();
 202                         if ( $memskin && Skin::existsID($memskin))
 203                         {
 204                                 $skinid = $memskin;
 205                         }
 206                 }
 207
 208                 /* NOTE: 2. make an instance of skin object */
 209                 if ( !Skin::existsID($skinid) )
 210                 {
 211                         return FALSE;
 212                 }
 213
 214                 /* NOTE: 3. initializing each members */
 215                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
 216                 self::$action           = '';
 217                 self::$extrahead        = '';
 218                 self::$passvar          = '';
 219                 self::$headMess         = '';
 220                 self::$aOptions         = '';
 221                 return TRUE;
 222         }
 223
 224         /**
 225          * Admin::action()
 226          * Executes an action
 227          *
 228          * @param       string  $action action to be performed
 229          * @return      void
 230          */
 231         static public function action($action)
 232         {
 233                 global $CONF, $manager, $member;
 234
 235                 /* 1. decide action name */
 236                 $customAction = postvar('customaction');
 237                 if ( empty($customAction) )
 238                 {
 239                         $alias = array(
 240                                 'login' => 'overview',
 241                                 ''              => 'overview',
 242                         );
 243                 }
 244                 else
 245                 {
 246                         $alias = array(
 247                                 'login' => $customAction,
 248                                 ''              => $customAction
 249                         );
 250                 }
 251                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )
 252                 {
 253                         $action = $alias[$action];
 254                 }
 255                 $method_name = "action_{$action}";
 256                 self::$action = strtolower($action);
 257
 258                 /* 2. check ticket-needed action */
 259                 if ( !in_array(self::$action, self::$ticketless_actions) && !$manager->checkTicket() )
 260                 {
 261                         self::error(_ERROR_BADTICKET);
 262                         return;
 263                 }
 264
 265                 /* 3. parse according to the action */
 266                 else if ( method_exists('Admin', $method_name) )
 267                 {
 268                         call_user_func(array(__CLASS__, $method_name));
 269                         return;
 270                 }
 271                 /* 4. parse special admin skin */
 272                 elseif ( in_array(self::$action, self::$skinless_actions) )
 273                 {
 274                         /* TODO: need to be implemented or not?
 275                         self::action_parseSpecialskin();
 276                         */
 277                 }
 278                 else
 279                 {
 280                         self::error(_BADACTION . ENTITY::hsc($action));
 281                         return;
 282                 }
 283
 284                 return;
 285         }
 286
 287         /**
 288          * Action::action_showlogin()
 289          *
 290          * @param       void
 291          * @return      void
 292          */
 293         static private function action_showlogin()
 294         {
 295                 global $error;
 296                 self::action_login($error);
 297                 return;
 298         }
 299
 300         /**
 301          * Action::action_login()
 302          *
 303          * @param       string  $msg            message for pageheader
 304          * @param       integer $passvars       ???
 305          */
 306         static private function action_login($msg = '', $passvars = 1)
 307         {
 308                 global $member;
 309
 310                 // skip to overview when allowed
 311                 if ( $member->isLoggedIn() && $member->canLogin() )
 312                 {
 313                         self::action_overview();
 314                         return;
 315                 }
 316
 317                 /* TODO: needless variable??? */
 318                 self::$passvar = $passvars;
 319                 if ( $msg )
 320                 {
 321                         self::$headMess = $msg;
 322                 }
 323
 324                 self::$skin->parse('showlogin');
 325         }
 326
 327         /**
 328          * Action::action_overview()
 329          * provides a screen with the overview of the actions available
 330          *
 331          * @param       string  $msg    message for pageheader
 332          * @return      void
 333          */
 334         static private function action_overview($msg = '')
 335         {
 336                 if ( $msg )
 337                 {
 338                         self::$headMess = $msg;
 339                 }
 340
 341                 self::$skin->parse('overview');
 342                 return;
 343         }
 344
 345         /**
 346          * Admin::action_manage()
 347          *
 348          * @param       string  $msg    message for pageheader
 349          * @retrn       void
 350          */
 351         static private function action_manage($msg = '')
 352         {
 353                 global $member;
 354
 355                 if ( $msg )
 356                 {
 357                         self::$headMess = $msg;
 358                 }
 359                 $member->isAdmin() or self::disallow();
 360
 361                 self::$skin->parse('manage');
 362                 return;
 363         }
 364
 365         /**
 366          * Action::action_itemlist()
 367          *
 368          * @param       integer id for weblod
 369          * @return      void
 370          */
 371         static private function action_itemlist($blogid = '')
 372         {
 373                 global $member, $manager, $CONF;
 374
 375                 if ( $blogid == '' )
 376                 {
 377                         $blogid = intRequestVar('blogid');
 378                 }
 379
 380                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 381
 382                 self::$skin->parse('itemlist');
 383                 return;
 384         }
 385
 386         /**
 387          * Action::action_batchitem()
 388          *
 389          * @param       void
 390          * @return      void
 391          */
 392         static private function action_batchitem()
 393         {
 394                 global $member, $manager;
 395
 396                 $member->isLoggedIn() or self::disallow();
 397
 398                 $selected       = requestIntArray('batch');
 399                 $action         = requestVar('batchaction');
 400
 401                 if ( !is_array($selected) || sizeof($selected) == 0 )
 402                 {
 403                         self::error(_BATCH_NOSELECTION);
 404                         return;
 405                 }
 406
 407                 // On move: when no destination blog/category chosen, show choice now
 408                 $destCatid = intRequestVar('destcatid');
 409                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )
 410                 {
 411                         self::batchMoveSelectDestination('item', $selected);
 412                 }
 413
 414                 // On delete: check if confirmation has been given
 415                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 416                 {
 417                         self::batchAskDeleteConfirmation('item', $selected);
 418                 }
 419
 420                 self::$skin->parse('batchitem');
 421                 return;
 422         }
 423
 424         /**
 425          * Action::action_batchcomment()
 426          *
 427          * @param       void
 428          * @return      void
 429          */
 430         static private function action_batchcomment()
 431         {
 432                 global $member;
 433
 434                 $member->isLoggedIn() or self::disallow();
 435
 436                 $selected       = requestIntArray('batch');
 437                 $action         = requestVar('batchaction');
 438
 439                 // Show error when no items were selected
 440                 if ( !is_array($selected) || sizeof($selected) == 0 )
 441                 {
 442                         self::error(_BATCH_NOSELECTION);
 443                         return;
 444                 }
 445
 446                 // On delete: check if confirmation has been given
 447                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 448                 {
 449                         self::batchAskDeleteConfirmation('comment', $selected);
 450                 }
 451
 452                 self::$skin->parse('batchcomment');
 453                 return;
 454         }
 455
 456         /**
 457          * Admin::action_batchmember()
 458          *
 459          * @param       void
 460          * @return      void
 461          */
 462         static private function action_batchmember()
 463         {
 464                 global $member;
 465
 466                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();
 467
 468                 $selected       = requestIntArray('batch');
 469                 $action         = requestVar('batchaction');
 470
 471                 // Show error when no members selected
 472                 if ( !is_array($selected) || sizeof($selected) == 0 )
 473                 {
 474                         self::error(_BATCH_NOSELECTION);
 475                         return;
 476                 }
 477
 478                 // On delete: check if confirmation has been given
 479                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 480                 {
 481                         self::batchAskDeleteConfirmation('member',$selected);
 482                 }
 483
 484                 self::$skin->parse('batchmember');
 485                 return;
 486         }
 487
 488         /**
 489          * Admin::action_batchteam()
 490          *
 491          * @param       void
 492          * @return      void
 493          */
 494         static private function action_batchteam()
 495         {
 496                 global $member;
 497
 498                 $blogid = intRequestVar('blogid');
 499
 500                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();
 501
 502                 $selected       = requestIntArray('batch');
 503                 $action         = requestVar('batchaction');
 504
 505                 if ( !is_array($selected) || sizeof($selected) == 0 )
 506                 {
 507                         self::error(_BATCH_NOSELECTION);
 508                         return;
 509                 }
 510
 511                 // On delete: check if confirmation has been given
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 513                 {
 514                         self::batchAskDeleteConfirmation('team',$selected);
 515                 }
 516
 517                 self::$skin->parse('batchteam');
 518                 return;
 519         }
 520
 521         /**
 522          * Admin::action_batchcategory()
 523          *
 524          * @param       void
 525          * @return      void
 526          */
 527         static private function action_batchcategory()
 528         {
 529                 global $member, $manager;
 530
 531                 $member->isLoggedIn() or self::disallow();
 532
 533                 $selected       = requestIntArray('batch');
 534                 $action         = requestVar('batchaction');
 535
 536                 if ( !is_array($selected) || sizeof($selected) == 0 )
 537                 {
 538                         self::error(_BATCH_NOSELECTION);
 539                         return;
 540                 }
 541
 542                 // On move: when no destination blog chosen, show choice now
 543                 $destBlogId = intRequestVar('destblogid');
 544                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )
 545                 {
 546                         self::batchMoveCategorySelectDestination('category', $selected);
 547                 }
 548
 549                 // On delete: check if confirmation has been given
 550                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 551                 {
 552                         self::batchAskDeleteConfirmation('category', $selected);
 553                 }
 554
 555                 self::$skin->parse('batchcategory');
 556                 return;
 557         }
 558
 559         /**
 560          * Admin::batchMoveSelectDestination()
 561          *
 562          * @param       string  $type   type of batch action
 563          * @param       integer $ids    needless???
 564          * @return      void
 565          *
 566          * TODO: remove needless argument
 567          */
 568         static private function batchMoveSelectDestination($type, $ids)
 569         {
 570                 $_POST['batchmove'] = $type;
 571                 self::$skin->parse('batchmove');
 572                 return;
 573         }
 574
 575         /**
 576          * Admin::batchMoveCategorySelectDestination()
 577          *
 578          * @param       string  $type   type of batch action
 579          * @param       integer $ids    needless???
 580          * @return      void
 581          *
 582          * TODO: remove needless argument
 583          */
 584         static private function batchMoveCategorySelectDestination($type, $ids)
 585         {
 586                 $_POST['batchmove'] = $type;
 587                 global $manager;
 588                 self::$skin->parse('batchmovecat');
 589                 return;
 590         }
 591
 592         /**
 593          * Admin::batchAskDeleteConfirmation()
 594          *
 595          * @param       string  $type   type of batch action
 596          * @param       integer $ids    needless???
 597          * @return      void
 598          *
 599          * TODO: remove needless argument
 600          */
 601         static private function batchAskDeleteConfirmation($type, $ids)
 602         {
 603                 self::$skin->parse('batchdelete');
 604                 return;
 605         }
 606
 607         /**
 608          * Admin::action_browseownitems()
 609          *
 610          * @param       void
 611          * @return      void
 612          */
 613         static private function action_browseownitems()
 614         {
 615                 global $member, $manager, $CONF;
 616
 617                 self::$skin->parse('browseownitems');
 618                 return;
 619         }
 620
 621         /**
 622          * Admin::action_itemcommentlist()
 623          * Show all the comments for a given item
 624          *
 625          * @param       integer $itemid ID for item
 626          * @return      void
 627          */
 628         static private function action_itemcommentlist($itemid = '')
 629         {
 630                 global $member, $manager, $CONF;
 631
 632                 if ( $itemid == '' )
 633                 {
 634                         $itemid = intRequestVar('itemid');
 635                 }
 636
 637                 // only allow if user is allowed to alter item
 638                 $member->canAlterItem($itemid) or self::disallow();
 639
 640                 $item =& $manager->getItem($itemid, 1, 1);
 641                 $_REQUEST['itemid'] = $item['itemid'];
 642                 $_REQUEST['blogid'] = $item['blogid'];
 643
 644                 self::$skin->parse('itemcommentlist');
 645                 return;
 646         }
 647
 648         /**
 649          * Admin::action_browseowncomments()
 650          * Browse own comments
 651          *
 652          * @param       void
 653          * @return      void
 654          */
 655         static private function action_browseowncomments()
 656         {
 657                 self::$skin->parse('browseowncomments');
 658                 return;
 659         }
 660
 661         /**
 662          * Admin::action_blogcommentlist()
 663          * Browse all comments for a weblog
 664          *
 665          * @param       integer $blogid ID for weblog
 666          * @return      void
 667          */
 668         static private function action_blogcommentlist($blogid = '')
 669         {
 670                 global $member, $manager, $CONF;
 671
 672                 if ( $blogid == '' )
 673                 {
 674                         $blogid = intRequestVar('blogid');
 675                 }
 676                 else
 677                 {
 678                         $blogid = intval($blogid);
 679                 }
 680
 681                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 682
 683                 /* TODO: we consider to use the other way insterad of this */
 684                 $_REQUEST['blogid'] = $blogid;
 685
 686                 self::$skin->parse('blogcommentlist');
 687                 return;
 688         }
 689
 690         /**
 691          * Admin::action_createaccount()
 692          *
 693          * @param       void
 694          * @return      void
 695          */
 696         static private function action_createaccount()
 697         {
 698                 global $CONF;
 699
 700                 if ( $CONF['AllowMemberCreate'] != 1 )
 701                 {
 702                         self::$skin->parse('createaccountdisable');
 703                         return;
 704                 }
 705
 706                 $name = '';
 707                 $realname ='';
 708                 $email = '';
 709                 $url = '';
 710
 711                 $contents = array(
 712                         'name'          => '',
 713                         'realname'      => '',
 714                         'email'         => '',
 715                         'url'           => ''
 716                 );
 717
 718                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )
 719                 {
 720                         $action = new Action();
 721                         $message = $action->createAccount();
 722                         if ( $message === 1 )
 723                         {
 724                                 self::$headMess = $message;
 725                                 self::$skin->parse('createaccountsuccess');
 726                                 return;
 727                         }
 728
 729                         /* TODO: validation */
 730                         if ( array_key_exists('name', $_POST) )
 731                         {
 732                                 $contents['name'] = $_POST['name'];
 733                         }
 734                         if ( array_key_exists('realname', $_POST) )
 735                         {
 736                                 $contents['realname'] = $_POST['realname'];
 737                         }
 738                         if ( array_key_exists('email', $_POST) )
 739                         {
 740                                 $contents['email'] = $_POST['email'];
 741                         }
 742                         if ( array_key_exists('url', $_POST) )
 743                         {
 744                                 $contents['url'] = $_POST['url'];
 745                         }
 746
 747                         self::$contents = $contents;
 748
 749                 }
 750
 751                 self::$skin->parse('createaccountinput');
 752                 return;
 753         }
 754
 755         /**
 756          * Admin::action_createitem()
 757          * Provide a page to item a new item to the given blog
 758          *
 759          * @param       void
 760          * @return      void
 761          */
 762         static private function action_createitem()
 763         {
 764                 global $member, $manager;
 765
 766                 $blogid = intRequestVar('blogid');
 767
 768                 // check if allowed
 769                 $member->teamRights($blogid) or self::disallow();
 770
 771                 $blog =& $manager->getBlog($blogid);
 772                 $contents = array();
 773
 774                 $data = array(
 775                         'blog'          => &$blog,
 776                         'contents'      => &$contents
 777                 );
 778                 $manager->notify('PreAddItemForm', $data);
 779
 780                 if ( $blog->convertBreaks() )
 781                 {
 782                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )
 783                         {
 784                                 $contents['body'] = removeBreaks($contents['body']);
 785                         }
 786                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )
 787                         {
 788                                 $contents['more'] = removeBreaks($contents['more']);
 789                         }
 790                 }
 791
 792                 self::$blog = &$blog;
 793                 self::$contents = &$contents;
 794
 795                 self::$skin->parse('createitem');
 796                 return;
 797         }
 798
 799         /**
 800          * Admin::action_itemedit()
 801          *
 802          * @param       void
 803          * @return      void
 804          */
 805         static private function action_itemedit()
 806         {
 807                 global $member, $manager;
 808
 809                 $itemid = intRequestVar('itemid');
 810
 811                 // only allow if user is allowed to alter item
 812                 $member->canAlterItem($itemid) or self::disallow();
 813
 814                 $item =& $manager->getItem($itemid, 1, 1);
 815                 $blog =& $manager->getBlog($item['blogid']);
 816                 $data = array('blog'=> &$blog, 'item' => &$item);
 817                 $manager->notify('PrepareItemForEdit', $data);
 818
 819                 if ( $blog->convertBreaks() )
 820                 {
 821                         if ( array_key_exists('body', $item) && !empty($item['body']) )
 822                         {
 823                                 $item['body'] = removeBreaks($item['body']);
 824                         }
 825                         if ( array_key_exists('more', $item) && !empty($item['more']) )
 826                         {
 827                                 $item['more'] = removeBreaks($item['more']);
 828                         }
 829                 }
 830
 831                 self::$blog = &$blog;
 832                 self::$contents = &$item;
 833
 834                 self::$skin->parse('itemedit');
 835                 return;
 836         }
 837
 838         /**
 839          * Admin::action_itemupdate()
 840          *
 841          * @param       void
 842          * @return      void
 843          */
 844         static private function action_itemupdate()
 845         {
 846                 global $member, $manager, $CONF;
 847
 848                 $itemid = intRequestVar('itemid');
 849                 $catid  = postVar('catid');
 850
 851                 // only allow if user is allowed to alter item
 852                 $member->canUpdateItem($itemid, $catid) or self::disallow();
 853
 854                 $actiontype = postVar('actiontype');
 855
 856                 // delete actions are handled by itemdelete (which has confirmation)
 857                 if ( $actiontype == 'delete' )
 858                 {
 859                         self::action_itemdelete();
 860                         return;
 861                 }
 862
 863                 $body           = postVar('body');
 864                 $title          = postVar('title');
 865                 $more           = postVar('more');
 866                 $closed         = intPostVar('closed');
 867                 $draftid        = intPostVar('draftid');
 868
 869                 // default action = add now
 870                 if ( !$actiontype )
 871                 {
 872                         $actiontype='addnow';
 873                 }
 874
 875                 // create new category if needed
 876                 if ( i18n::strpos($catid,'newcat') === 0 )
 877                 {
 878                         // get blogid
 879                         list($blogid) = sscanf($catid,"newcat-%d");
 880
 881                         // create
 882                         $blog =& $manager->getBlog($blogid);
 883                         $catid = $blog->createNewCategory();
 884
 885                         // show error when sth goes wrong
 886                         if ( !$catid )
 887                         {
 888                                 self::doError(_ERROR_CATCREATEFAIL);
 889                         }
 890                 }
 891
 892                 /**
 893                  * set some variables based on actiontype
 894                  *
 895                  * actiontypes:
 896                  *      draft items -> addnow, addfuture, adddraft, delete
 897                  *      non-draft items -> edit, changedate, delete
 898                  *
 899                  * variables set:
 900                  *      $timestamp: set to a nonzero value for future dates or date changes
 901                  *      $wasdraft: set to 1 when the item used to be a draft item
 902                  *      $publish: set to 1 when the edited item is not a draft
 903                  */
 904                 $blogid =  getBlogIDFromItemID($itemid);
 905                 $blog =& $manager->getBlog($blogid);
 906
 907                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');
 908                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
 909                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
 910                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )
 911                 {
 912                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
 913                 }
 914                 else
 915                 {
 916                         $timestamp =0;
 917                 }
 918
 919                 // edit the item for real
 920                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
 921
 922                 self::updateFuturePosted($blogid);
 923
 924                 if ( $draftid > 0 )
 925                 {
 926                         // delete permission is checked inside Item::delete()
 927                         Item::delete($draftid);
 928                 }
 929
 930                 if ( $catid != intPostVar('catid') )
 931                 {
 932                         self::action_categoryedit(
 933                                 $catid,
 934                                 $blog->getID(),
 935                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
 936                         );
 937                 }
 938                 else
 939                 {
 940                         // TODO: set start item correctly for itemlist
 941                         $item =& $manager->getitem($itemid, 1, 1);
 942                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";
 943                         $query = sprintf($query, sql_table('item'), $item['timestamp']);
 944                         $cnt  = DB::getValue($query);
 945                         $_REQUEST['start'] = $cnt + 1;
 946                         self::action_itemlist(getBlogIDFromItemID($itemid));
 947                 }
 948                 return;
 949         }
 950
 951         /**
 952          * Admin::action_itemdelete()
 953          * Delete item
 954          *
 955          * @param       Void
 956          * @return      Void
 957          */
 958         static private function action_itemdelete()
 959         {
 960                 global $member, $manager;
 961
 962                 $itemid = intRequestVar('itemid');
 963
 964                 // only allow if user is allowed to alter item
 965                 $member->canAlterItem($itemid) or self::disallow();
 966
 967                 if ( !$manager->existsItem($itemid,1,1) )
 968                 {
 969                         self::error(_ERROR_NOSUCHITEM);
 970                         return;
 971                 }
 972
 973                 self::$skin->parse('itemdelete');
 974                 return;
 975         }
 976
 977         /**
 978          * Admin::action_itemdeleteconfirm()
 979          *
 980          * @param       void
 981          * @return      void
 982          */
 983         static private function action_itemdeleteconfirm()
 984         {
 985                 global $member, $manager;
 986
 987                 $itemid = intRequestVar('itemid');
 988
 989                 // only allow if user is allowed to alter item
 990                 $member->canAlterItem($itemid) or self::disallow();
 991
 992                 // get item first
 993                 $item =& $manager->getItem($itemid, 1, 1);
 994
 995                 // delete item (note: some checks will be performed twice)
 996                 self::deleteOneItem($item['itemid']);
 997
 998                 self::action_itemlist($item['blogid']);
 999                 return;
1000         }
1001
1002         /**
1003          * Admin::deleteOneItem()
1004          * Deletes one item and returns error if something goes wrong
1005          *
1006          * @param       integer $itemid ID for item
1007          * @return      void
1008          */
1009         static public function deleteOneItem($itemid)
1010         {
1011                 global $member, $manager;
1012
1013                 // only allow if user is allowed to alter item (also checks if itemid exists)
1014                 if ( !$member->canAlterItem($itemid) )
1015                 {
1016                         return _ERROR_DISALLOWED;
1017                 }
1018
1019                 // need to get blogid before the item is deleted
1020                 $item =& $manager->getItem($itemid, 1, 1);
1021
1022                 $manager->loadClass('ITEM');
1023                 Item::delete($item['itemid']);
1024
1025                 // update blog's futureposted
1026                 self::updateFuturePosted($item['itemid']);
1027                 return;
1028         }
1029
1030         /**
1031          * Admin::updateFuturePosted()
1032          * Update a blog's future posted flag
1033          *
1034          * @param integer $blogid
1035          * @return      void
1036          */
1037         static private function updateFuturePosted($blogid)
1038         {
1039                 global $manager;
1040
1041                 $blogid                 =  intval($blogid);
1042                 $blog                   =& $manager->getBlog($blogid);
1043                 $currenttime    =  $blog->getCorrectTime(time());
1044
1045                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1046                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1047                 $result = DB::getResult($query);
1048
1049                 if ( $result->rowCount() > 0 )
1050                 {
1051                                 $blog->setFuturePost();
1052                 }
1053                 else
1054                 {
1055                                 $blog->clearFuturePost();
1056                 }
1057                 return;
1058         }
1059
1060         /**
1061          * Admin::action_itemmove()
1062          *
1063          * @param       void
1064          * @return      void
1065          */
1066         static private function action_itemmove()
1067         {
1068                 global $member, $manager;
1069
1070                 $itemid = intRequestVar('itemid');
1071
1072                 $member->canAlterItem($itemid) or self::disallow();
1073
1074                 self::$skin->parse('itemmove');
1075                 return;
1076         }
1077
1078         /**
1079          * Admin::action_itemmoveto()
1080          *
1081          * @param       void
1082          * @return      void
1083          */
1084         static private function action_itemmoveto()
1085         {
1086                 global $member, $manager;
1087
1088                 $itemid = intRequestVar('itemid');
1089                 $catid = requestVar('catid');
1090
1091                 // create new category if needed
1092                 if ( i18n::strpos($catid,'newcat') === 0 )
1093                 {
1094                         // get blogid
1095                         list($blogid) = sscanf($catid,'newcat-%d');
1096
1097                         // create
1098                         $blog =& $manager->getBlog($blogid);
1099                         $catid = $blog->createNewCategory();
1100
1101                         // show error when sth goes wrong
1102                         if ( !$catid )
1103                         {
1104                                 self::doError(_ERROR_CATCREATEFAIL);
1105                         }
1106                 }
1107
1108                 // only allow if user is allowed to alter item
1109                 $member->canUpdateItem($itemid, $catid) or self::disallow();
1110
1111                 $old_blogid = getBlogIDFromItemId($itemid);
1112
1113                 Item::move($itemid, $catid);
1114
1115                 // set the futurePosted flag on the blog
1116                 self::updateFuturePosted(getBlogIDFromItemId($itemid));
1117
1118                 // reset the futurePosted in case the item is moved from one blog to another
1119                 self::updateFuturePosted($old_blogid);
1120
1121                 if ( $catid != intRequestVar('catid') )
1122                 {
1123                         self::action_categoryedit($catid, $blog->getID());
1124                 }
1125                 else
1126                 {
1127                         self::action_itemlist(getBlogIDFromCatID($catid));
1128                 }
1129                 return;
1130         }
1131
1132         /**
1133          * Admin::moveOneItem()
1134          * Moves one item to a given category (category existance should be checked by caller)
1135          * errors are returned
1136          *
1137          * @param       integer $itemid         ID for item
1138          * @param       integer $destCatid      ID for category to which the item will be moved
1139          * @return      void
1140          */
1141         static public function moveOneItem($itemid, $destCatid)
1142         {
1143                 global $member;
1144
1145                 // only allow if user is allowed to move item
1146                 if ( !$member->canUpdateItem($itemid, $destCatid) )
1147                 {
1148                         return _ERROR_DISALLOWED;
1149                 }
1150
1151                 Item::move($itemid, $destCatid);
1152                 return;
1153         }
1154
1155         /**
1156          * Admin::action_additem()
1157          * Adds a item to the chosen blog
1158          *
1159          * @param       void
1160          * @return      void
1161          */
1162         static private function action_additem()
1163         {
1164                 global $manager, $CONF;
1165
1166                 $manager->loadClass('ITEM');
1167
1168                 $result = Item::createFromRequest();
1169
1170                 if ( $result['status'] == 'error' )
1171                 {
1172                         self::error($result['message']);
1173                         return;
1174                 }
1175
1176                 $item =& $manager->getItem($result['itemid'], 0, 0);
1177
1178                 if ( $result['status'] == 'newcategory' )
1179                 {
1180                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);
1181                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);
1182                 }
1183                 else
1184                 {
1185                         $methodName = 'action_itemlist';
1186                         self::action_itemlist($item['blogid']);
1187                 }
1188                 return;
1189         }
1190
1191         /**
1192          * Admin::action_commentedit()
1193          * Allows to edit previously made comments
1194          *
1195          * @param       void
1196          * @return      void
1197          */
1198         static private function action_commentedit()
1199         {
1200                 global $member, $manager;
1201
1202                 $commentid = intRequestVar('commentid');
1203
1204                 $member->canAlterComment($commentid) or self::disallow();
1205
1206                 $comment = Comment::getComment($commentid);
1207                 $data = array('comment' => &$comment);
1208                 $manager->notify('PrepareCommentForEdit', $data);
1209
1210                 self::$contents = $comment;
1211                 self::$skin->parse('commentedit');
1212                 return;
1213         }
1214
1215         /**
1216          * Admin::action_commentupdate()
1217          *
1218          * @param       void
1219          * @return      void
1220          */
1221         static private function action_commentupdate()
1222         {
1223                 global $member, $manager;
1224
1225                 $commentid = intRequestVar('commentid');
1226
1227                 $member->canAlterComment($commentid) or self::disallow();
1228
1229                 $url    = postVar('url');
1230                 $email  = postVar('email');
1231                 $body   = postVar('body');
1232
1233                 // intercept words that are too long
1234                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1235                 {
1236                         self::error(_ERROR_COMMENT_LONGWORD);
1237                         return;
1238                 }
1239
1240                 // check length
1241                 if ( i18n::strlen($body) < 3 )
1242                 {
1243                         self::error(_ERROR_COMMENT_NOCOMMENT);
1244                         return;
1245                 }
1246
1247                 if ( i18n::strlen($body) > 5000 )
1248                 {
1249                         self::error(_ERROR_COMMENT_TOOLONG);
1250                         return;
1251                 }
1252
1253                 // prepare body
1254                 $body = Comment::prepareBody($body);
1255
1256                 // call plugins
1257                 $data = array(
1258                         'body' => &$body
1259                 );
1260                 $manager->notify('PreUpdateComment', $data);
1261
1262                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";
1263                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);
1264                 DB::execute($query);
1265
1266                 // get itemid
1267                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1268                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1269
1270                 $itemid = DB::getValue($query);
1271
1272                 if ( $member->canAlterItem($itemid) )
1273                 {
1274                         self::action_itemcommentlist($itemid);
1275                 }
1276                 else
1277                 {
1278                         self::action_browseowncomments();
1279                 }
1280                 return;
1281         }
1282
1283         /**
1284          * Admin::action_commentdelete()
1285          * Update comment
1286          *
1287          * @param       void
1288          * @return      void
1289          */
1290         static private function action_commentdelete()
1291         {
1292                 global $member, $manager;
1293
1294                 $commentid = intRequestVar('commentid');
1295                 $member->canAlterComment($commentid) or self::disallow();
1296
1297                 self::$skin->parse('commentdelete');
1298                 return;
1299         }
1300
1301         /**
1302          * Admin::action_commentdeleteconfirm()
1303          *
1304          * @param       void
1305          * @return      void
1306          */
1307         static private function action_commentdeleteconfirm()
1308         {
1309                 global $member;
1310
1311                 $commentid = intRequestVar('commentid');
1312
1313                 // get item id first
1314                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1315                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1316
1317                 $itemid = DB::getValue($query);
1318
1319                 $error = self::deleteOneComment($commentid);
1320                 if ( $error )
1321                 {
1322                         self::doError($error);
1323                 }
1324
1325                 if ( $member->canAlterItem($itemid) )
1326                 {
1327                         self::action_itemcommentlist($itemid);
1328                 }
1329                 else
1330                 {
1331                         self::action_browseowncomments();
1332                 }
1333                 return;
1334         }
1335
1336         /**
1337          * Admin::deleteOneComment()
1338          *
1339          * @param       integer $commentid      ID for comment
1340          * @return      void
1341          */
1342         static public function deleteOneComment($commentid)
1343         {
1344                 global $member, $manager;
1345
1346                 $commentid = (integer) $commentid;
1347
1348                 if ( !$member->canAlterComment($commentid) )
1349                 {
1350                         return _ERROR_DISALLOWED;
1351                 }
1352
1353                 $data = array(
1354                         'commentid' => $commentid
1355                 );
1356
1357                 $manager->notify('PreDeleteComment', $data);
1358
1359                 // delete the comments associated with the item
1360                 $query = "DELETE FROM %s WHERE cnumber=%d;";
1361                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1362                 DB::execute($query);
1363
1364                 $data = array(
1365                         'commentid' => $commentid
1366                 );
1367
1368                 $manager->notify('PostDeleteComment', $data);
1369
1370                 return '';
1371         }
1372
1373         /**
1374          * Admin::action_usermanagement()
1375          * Usermanagement main
1376          *
1377          * @param       void
1378          * @return      void
1379          */
1380         static private function action_usermanagement()
1381         {
1382                 global $member, $manager;
1383
1384                 // check if allowed
1385                 $member->isAdmin() or self::disallow();
1386
1387                 self::$skin->parse('usermanagement');
1388                 return;
1389         }
1390
1391         /**
1392          * Admin::action_memberedit()
1393          * Edit member settings
1394          *
1395          * @param       void
1396          * @return      void
1397          */
1398         static private function action_memberedit()
1399         {
1400                 self::action_editmembersettings(intRequestVar('memberid'));
1401                 return;
1402         }
1403
1404         /**
1405          * Admin::action_editmembersettings()
1406          *
1407          * @param       integer $memberid       ID for member
1408          * @return      void
1409          *
1410          */
1411         static private function action_editmembersettings($memberid = '')
1412         {
1413                 global $member, $manager, $CONF;
1414
1415                 if ( $memberid == '' )
1416                 {
1417                         $memberid = $member->getID();
1418                 }
1419
1420                 /* TODO: we should consider to use the other way insterad of this */
1421                 $_REQUEST['memberid'] = $memberid;
1422
1423                 // check if allowed
1424                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1425
1426                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
1427
1428                 self::$skin->parse('editmembersettings');
1429                 return;
1430         }
1431
1432         /**
1433          * Admin::action_changemembersettings()
1434          *
1435          * @param       void
1436          * @return      void
1437          */
1438         static private function action_changemembersettings()
1439         {
1440                 global $member, $CONF, $manager;
1441
1442                 $memberid = intRequestVar('memberid');
1443
1444                 // check if allowed
1445                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1446
1447                 $name                   = trim(strip_tags(postVar('name')));
1448                 $realname               = trim(strip_tags(postVar('realname')));
1449                 $password               = postVar('password');
1450                 $repeatpassword = postVar('repeatpassword');
1451                 $email                  = strip_tags(postVar('email'));
1452                 $url                    = strip_tags(postVar('url'));
1453                 $adminskin              = intPostVar('adminskin');
1454                 $bookmarklet    = intPostVar('bookmarklet');
1455
1456                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1457                 if ( !preg_match('#^https?://#', $url) )
1458                 {
1459                         $url = 'http://' . $url;
1460                 }
1461
1462                 $admin          = postVar('admin');
1463                 $canlogin       = postVar('canlogin');
1464                 $notes          = strip_tags(postVar('notes'));
1465                 $locale         = postVar('locale');
1466
1467                 $mem =& $manager->getMember($memberid);
1468
1469                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1470                 {
1471                         if ( !isValidDisplayName($name) )
1472                         {
1473                                 self::error(_ERROR_BADNAME);
1474                                 return;
1475                         }
1476
1477                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )
1478                         {
1479                                 self::error(_ERROR_NICKNAMEINUSE);
1480                                 return;
1481                         }
1482
1483                         if ( $password != $repeatpassword )
1484                         {
1485                                 self::error(_ERROR_PASSWORDMISMATCH);
1486                                 return;
1487                         }
1488
1489                         if ( $password && (i18n::strlen($password) < 6) )
1490                         {
1491                                 self::error(_ERROR_PASSWORDTOOSHORT);
1492                                 return;
1493                         }
1494
1495                         if ( $password )
1496                         {
1497                                 $pwdvalid = true;
1498                                 $pwderror = '';
1499
1500                                 $data = array(
1501                                         'password'     => $password,
1502                                         'errormessage' => &$pwderror,
1503                                         'valid'        => &$pwdvalid
1504                                 );
1505                                 $manager->notify('PrePasswordSet', $data);
1506
1507                                 if ( !$pwdvalid )
1508                                 {
1509                                         self::error($pwderror);
1510                                         return;
1511                                 }
1512                         }
1513                 }
1514
1515                 if ( !NOTIFICATION::address_validation($email) )
1516                 {
1517                         self::error(_ERROR_BADMAILADDRESS);
1518                         return;
1519                 }
1520                 if ( !$realname )
1521                 {
1522                         self::error(_ERROR_REALNAMEMISSING);
1523                         return;
1524                 }
1525                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
1526                 {
1527                         self::error(_ERROR_NOSUCHTRANSLATION);
1528                         return;
1529                 }
1530
1531                 // check if there will remain at least one site member with both the logon and admin rights
1532                 // (check occurs when taking away one of these rights from such a member)
1533                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1534                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1535                         )
1536                 {
1537                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1538                         if ( $r->rowCount() < 2 )
1539                         {
1540                                 self::error(_ERROR_ATLEASTONEADMIN);
1541                                 return;
1542                         }
1543                 }
1544
1545                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1546                 {
1547                         $mem->setDisplayName($name);
1548                         if ( $password )
1549                         {
1550                                 $mem->setPassword($password);
1551                         }
1552                 }
1553
1554                 $oldEmail = $mem->getEmail();
1555
1556                 $mem->setRealName($realname);
1557                 $mem->setEmail($email);
1558                 $mem->setURL($url);
1559                 $mem->setNotes($notes);
1560                 $mem->setLocale($locale);
1561                 $mem->setAdminSkin($adminskin);
1562                 $mem->setBookmarklet($bookmarklet);
1563
1564                 // only allow super-admins to make changes to the admin status
1565                 if ( $member->isAdmin() )
1566                 {
1567                         $mem->setAdmin($admin);
1568                         $mem->setCanLogin($canlogin);
1569                 }
1570
1571                 $autosave = postVar('autosave');
1572                 $mem->setAutosave($autosave);
1573
1574                 $mem->write();
1575
1576                 // store plugin options
1577                 $aOptions = requestArray('plugoption');
1578                 NucleusPlugin::apply_plugin_options($aOptions);
1579                 $data = array(
1580                         'context'  => 'member',
1581                         'memberid' => $memberid,
1582                         'member'   => &$mem
1583                 );
1584                 $manager->notify('PostPluginOptionsUpdate', $data);
1585
1586                 // if email changed, generate new password
1587                 if ( $oldEmail != $mem->getEmail() )
1588                 {
1589                         $mem->sendActivationLink('addresschange', $oldEmail);
1590                         // logout member
1591                         $mem->newCookieKey();
1592
1593                         // only log out if the member being edited is the current member.
1594                         if ( $member->getID() == $memberid )
1595                         {
1596                                 $member->logout();
1597                         }
1598                         self::action_login(_MSG_ACTIVATION_SENT, 0);
1599                         return;
1600                 }
1601
1602                 if ( ($mem->getID() == $member->getID())
1603                         && ($mem->getDisplayName() != $member->getDisplayName()) )
1604                 {
1605                         $mem->newCookieKey();
1606                         $member->logout();
1607                         self::action_login(_MSG_LOGINAGAIN, 0);
1608                 }
1609                 else
1610                 {
1611                         self::action_overview(_MSG_SETTINGSCHANGED);
1612                 }
1613                 return;
1614         }
1615
1616         /**
1617          * Admin::action_memberadd()
1618          *
1619          * @param       void
1620          * @return      void
1621          *
1622          */
1623         static private function action_memberadd()
1624         {
1625                 global $member, $manager;
1626
1627                 // check if allowed
1628                 $member->isAdmin() or self::disallow();
1629
1630                 if ( postVar('password') != postVar('repeatpassword') )
1631                 {
1632                         self::error(_ERROR_PASSWORDMISMATCH);
1633                         return;
1634                 }
1635
1636                 if ( i18n::strlen(postVar('password')) < 6 )
1637                 {
1638                         self::error(_ERROR_PASSWORDTOOSHORT);
1639                         return;
1640                 }
1641
1642                 $res = Member::create(
1643                         postVar('name'),
1644                         postVar('realname'),
1645                         postVar('password'),
1646                         postVar('email'),
1647                         postVar('url'),
1648                         postVar('admin'),
1649                         postVar('canlogin'),
1650                         postVar('notes')
1651                 );
1652
1653                 if ( $res != 1 )
1654                 {
1655                         self::error($res);
1656                         return;
1657                 }
1658
1659                 // fire PostRegister event
1660                 $newmem = new Member();
1661                 $newmem->readFromName(postVar('name'));
1662                 $data = array(
1663                         'member' => &$newmem
1664                 );
1665                 $manager->notify('PostRegister', $data);
1666
1667                 self::action_usermanagement();
1668                 return;
1669         }
1670
1671         /**
1672          * Admin::action_forgotpassword()
1673          *
1674          * @param       void
1675          * @return      void
1676          */
1677         static private function action_forgotpassword()
1678         {
1679                 self::$skin->parse('forgotpassword');
1680                 return;
1681         }
1682
1683         /**
1684          * Admin::action_activate()
1685          * Account activation
1686          *
1687          * @param       void
1688          * @return      void
1689          */
1690         static private function action_activate()
1691         {
1692                 $key = getVar('key');
1693                 self::showActivationPage($key);
1694                 return;
1695         }
1696
1697         /**
1698          * Admin::showActivationPage()
1699          *
1700          * @param       void
1701          * @return      void
1702          */
1703         static private function showActivationPage($key, $message = '')
1704         {
1705                 global $manager;
1706
1707                 // clean up old activation keys
1708                 Member::cleanupActivationTable();
1709
1710                 // get activation info
1711                 $info = Member::getActivationInfo($key);
1712
1713                 if ( !$info )
1714                 {
1715                         self::error(_ERROR_ACTIVATE);
1716                         return;
1717                 }
1718
1719                 $mem =& $manager->getMember($info->vmember);
1720
1721                 if ( !$mem )
1722                 {
1723                         self::error(_ERROR_ACTIVATE);
1724                         return;
1725                 }
1726
1727                 /* TODO: we should consider to use the other way insterad of this */
1728                 $_POST['ackey']                                 = $key;
1729                 $_POST['bNeedsPasswordChange']  = TRUE;
1730
1731                 self::$headMess = $message;
1732                 self::$skin->parse('activate');
1733                 return;
1734         }
1735
1736         /**
1737          * Admin::action_activatesetpwd()
1738          * Account activation - set password part
1739          *
1740          * @param       void
1741          * @return      void
1742          */
1743         static private function action_activatesetpwd()
1744         {
1745                 global $manager;
1746                 $key = postVar('key');
1747
1748                 // clean up old activation keys
1749                 Member::cleanupActivationTable();
1750
1751                 // get activation info
1752                 $info = Member::getActivationInfo($key);
1753
1754                 if ( !$info || ($info->type == 'addresschange') )
1755                 {
1756                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1757                 }
1758
1759                 $mem =& $manager->getMember($info->vmember);
1760
1761                 if ( !$mem )
1762                 {
1763                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1764                 }
1765
1766                 $password               = postVar('password');
1767                 $repeatpassword = postVar('repeatpassword');
1768
1769                 if ( $password != $repeatpassword )
1770                 {
1771                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);
1772                 }
1773
1774                 if ( $password && (i18n::strlen($password) < 6) )
1775                 {
1776                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
1777                 }
1778
1779                 if ( $password )
1780                 {
1781                         $pwdvalid = true;
1782                         $pwderror = '';
1783
1784                         $data = array(
1785                                 'password'              => $password,
1786                                 'errormessage'  => &$pwderror,
1787                                 'valid'                 => &$pwdvalid
1788                         );
1789                         $manager->notify('PrePasswordSet', $data);
1790                         if ( !$pwdvalid )
1791                         {
1792                                 return self::showActivationPage($key,$pwderror);
1793                         }
1794                 }
1795
1796                 $error = '';
1797
1798                 $data = array(
1799                         'type'   => 'activation',
1800                         'member' => $mem,
1801                         'error'  => &$error
1802                 );
1803                 $manager->notify('ValidateForm', $data);
1804                 if ( $error != '' )
1805                 {
1806                         return self::showActivationPage($key, $error);
1807                 }
1808
1809                 // set password
1810                 $mem->setPassword($password);
1811                 $mem->write();
1812
1813                 // do the activation
1814                 Member::activate($key);
1815
1816                 self::$skin->parse('activatesetpwd');
1817                 return;
1818         }
1819
1820         /**
1821          * Admin::action_manageteam()
1822          * Manage team
1823          *
1824          * @param       void
1825          * @return      void
1826          */
1827         static private function action_manageteam()
1828         {
1829                 global $member, $manager;
1830
1831                 $blogid = intRequestVar('blogid');
1832
1833                 // check if allowed
1834                 $member->blogAdminRights($blogid) or self::disallow();
1835
1836                 self::$skin->parse('manageteam');
1837                 return;
1838         }
1839
1840         /**
1841          * Admin::action_teamaddmember()
1842          * Add member to team
1843          *
1844          * @param       void
1845          * @return      void
1846          */
1847         static private function action_teamaddmember()
1848         {
1849                 global $member, $manager;
1850
1851                 $memberid       = intPostVar('memberid');
1852                 $blogid         = intPostVar('blogid');
1853                 $admin          = intPostVar('admin');
1854
1855                 // check if allowed
1856                 $member->blogAdminRights($blogid) or self::disallow();
1857
1858                 $blog =& $manager->getBlog($blogid);
1859                 if ( !$blog->addTeamMember($memberid, $admin) )
1860                 {
1861                         self::error(_ERROR_ALREADYONTEAM);
1862                         return;
1863                 }
1864
1865                 self::action_manageteam();
1866                 return;
1867         }
1868
1869         /**
1870          * Admin::action_teamdelete()
1871          *
1872          * @param       void
1873          * @return      void
1874          */
1875         static private function action_teamdelete()
1876         {
1877                 global $member, $manager;
1878
1879                 $memberid       = intRequestVar('memberid');
1880                 $blogid         = intRequestVar('blogid');
1881
1882                 // check if allowed
1883                 $member->blogAdminRights($blogid) or self::disallow();
1884
1885                 $teammem =& $manager->getMember($memberid);
1886                 $blog =& $manager->getBlog($blogid);
1887
1888                 self::$skin->parse('teamdelete');
1889                 return;
1890         }
1891
1892         /**
1893          * Admin::action_teamdeleteconfirm()
1894          *
1895          * @param       void
1896          * @return      void
1897          */
1898         static private function action_teamdeleteconfirm()
1899         {
1900                 global $member;
1901
1902                 $memberid = intRequestVar('memberid');
1903                 $blogid = intRequestVar('blogid');
1904
1905                 $error = self::deleteOneTeamMember($blogid, $memberid);
1906                 if ( $error )
1907                 {
1908                         self::error($error);
1909                         return;
1910                 }
1911                 self::action_manageteam();
1912                 return;
1913         }
1914
1915         /**
1916          * Admin::deleteOneTeamMember()
1917          *
1918          * @param       void
1919          * @return      void
1920          */
1921         static public function deleteOneTeamMember($blogid, $memberid)
1922         {
1923                 global $member, $manager;
1924
1925                 $blogid   = intval($blogid);
1926                 $memberid = intval($memberid);
1927
1928                 // check if allowed
1929                 if ( !$member->blogAdminRights($blogid) )
1930                 {
1931                         return _ERROR_DISALLOWED;
1932                 }
1933
1934                 // check if: - there remains at least one blog admin
1935                 //           - (there remains at least one team member)
1936                 $tmem =& $manager->getMember($memberid);
1937
1938
1939                 $data = array(
1940                         'member' => &$tmem,
1941                         'blogid' => $blogid
1942                 );
1943                 $manager->notify('PreDeleteTeamMember', $data);
1944
1945                 if ( $tmem->isBlogAdmin($blogid) )
1946                 {
1947                         /* TODO: why we did double check? */
1948                         // check if there are more blog members left and at least one admin
1949                         // (check for at least two admins before deletion)
1950                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";
1951                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1952                         $r     = DB::getResult($query);
1953                         if ( $r->rowCount() < 2 )
1954                         {
1955                                 return _ERROR_ATLEASTONEBLOGADMIN;
1956                         }
1957                 }
1958
1959                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";
1960                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);
1961                 DB::execute($query);
1962
1963                 $data = array(
1964                         'member' => &$tmem,
1965                         'blogid' => $blogid
1966                 );
1967                 $manager->notify('PostDeleteTeamMember', $data);
1968
1969                 return '';
1970         }
1971
1972         /**
1973          * Admin::action_teamchangeadmin()
1974          *
1975          * @param       void
1976          * @return      void
1977          */
1978         static private function action_teamchangeadmin()
1979         {
1980                 global $manager, $member;
1981
1982                 $blogid         = intRequestVar('blogid');
1983                 $memberid       = intRequestVar('memberid');
1984
1985                 // check if allowed
1986                 $member->blogAdminRights($blogid) or self::disallow();
1987
1988                 $mem =& $manager->getMember($memberid);
1989
1990                 // don't allow when there is only one admin at this moment
1991                 if ( $mem->isBlogAdmin($blogid) )
1992                 {
1993                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";
1994                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1995                         $r = DB::getResult($query);
1996                         if ( $r->rowCount() == 1 )
1997                         {
1998                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);
1999                                 return;
2000                         }
2001                 }
2002
2003                 if ( $mem->isBlogAdmin($blogid) )
2004                 {
2005                         $newval = 0;
2006                 }
2007                 else
2008                 {
2009                         $newval = 1;
2010                 }
2011
2012                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";
2013                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);
2014                 DB::execute($query);
2015
2016                 // only show manageteam if member did not change its own admin privileges
2017                 if ( $member->isBlogAdmin($blogid) )
2018                 {
2019                         self::action_manageteam();
2020                 }
2021                 else
2022                 {
2023                         self::action_overview(_MSG_ADMINCHANGED);
2024                 }
2025                 return;
2026         }
2027
2028         /**
2029          * Admin::action_blogsettings()
2030          *
2031          * @param       void
2032          * @return      void
2033          */
2034         static private function action_blogsettings()
2035         {
2036                 global $member, $manager;
2037
2038                 $blogid = intRequestVar('blogid');
2039
2040                 // check if allowed
2041                 $member->blogAdminRights($blogid) or self::disallow();
2042
2043                 $blog =& $manager->getBlog($blogid);
2044
2045                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2046
2047                 self::$skin->parse('blogsettings');
2048                 return;
2049         }
2050
2051         /**
2052          * Admin::action_categorynew()
2053          *
2054          * @param       void
2055          * @return      void
2056          */
2057         static private function action_categorynew()
2058         {
2059                 global $member, $manager;
2060
2061                 $blogid = intRequestVar('blogid');
2062
2063                 $member->blogAdminRights($blogid) or self::disallow();
2064
2065                 $cname = postVar('cname');
2066                 $cdesc = postVar('cdesc');
2067
2068                 if ( !isValidCategoryName($cname) )
2069                 {
2070                         self::error(_ERROR_BADCATEGORYNAME);
2071                         return;
2072                 }
2073
2074                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";
2075                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);
2076                 $res = DB::getResult($query);
2077                 if ( $res->rowCount() > 0 )
2078                 {
2079                         self::error(_ERROR_DUPCATEGORYNAME);
2080                         return;
2081                 }
2082
2083                 $blog           =& $manager->getBlog($blogid);
2084                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2085
2086                 self::action_blogsettings();
2087                 return;
2088         }
2089
2090         /**
2091          * Admin::action_categoryedit()
2092          *
2093          * @param       void
2094          * @return      void
2095          */
2096         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')
2097         {
2098                 global $member, $manager;
2099
2100                 if ( $blogid == '' )
2101                 {
2102                         $blogid = intGetVar('blogid');
2103                 }
2104                 else
2105                 {
2106                         $blogid = intval($blogid);
2107                 }
2108                 if ( $catid == '' )
2109                 {
2110                         $catid = intGetVar('catid');
2111                 }
2112                 else
2113                 {
2114                         $catid = intval($catid);
2115                 }
2116
2117                 /* TODO: we should consider to use the other way insterad of this */
2118                 $_REQUEST['blogid']             = $blogid;
2119                 $_REQUEST['catid']              = $catid;
2120                 $_REQUEST['desturl']    = $desturl;
2121                 $member->blogAdminRights($blogid) or self::disallow();
2122
2123                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2124
2125                 self::$skin->parse('categoryedit');
2126                 return;
2127         }
2128
2129         /**
2130          * Admin::action_categoryupdate()
2131          *
2132          * @param       void
2133          * @return      void
2134          */
2135         static private function action_categoryupdate()
2136         {
2137                 global $member, $manager;
2138
2139                 $blogid         = intPostVar('blogid');
2140                 $catid          = intPostVar('catid');
2141                 $cname          = postVar('cname');
2142                 $cdesc          = postVar('cdesc');
2143                 $desturl        = postVar('desturl');
2144
2145                 $member->blogAdminRights($blogid) or self::disallow();
2146
2147                 if ( !isValidCategoryName($cname) )
2148                 {
2149                         self::error(_ERROR_BADCATEGORYNAME);
2150                         return;
2151                 }
2152
2153                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";
2154                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);
2155                 $res    = DB::getResult($query);
2156                 if ( $res->rowCount() > 0 )
2157                 {
2158                         self::error(_ERROR_DUPCATEGORYNAME);
2159                         return;
2160                 }
2161
2162                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";
2163                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);
2164                 DB::execute($query);
2165
2166                 // store plugin options
2167                 $aOptions = requestArray('plugoption');
2168                 NucleusPlugin::apply_plugin_options($aOptions);
2169                 $data = array(
2170                         'context'       => 'category',
2171                         'catid'         => $catid
2172                 );
2173                 $manager->notify('PostPluginOptionsUpdate', $data);
2174
2175                 if ( $desturl )
2176                 {
2177                         redirect($desturl);
2178                         return;
2179                 }
2180
2181                 self::action_blogsettings();
2182
2183                 return;
2184         }
2185
2186         /**
2187          * Admin::action_categorydelete()
2188          *
2189          * @param       void
2190          * @return      void
2191          */
2192         static private function action_categorydelete()
2193         {
2194                 global $member, $manager;
2195
2196                 $blogid = intRequestVar('blogid');
2197                 $catid  = intRequestVar('catid');
2198
2199                 $member->blogAdminRights($blogid) or self::disallow();
2200
2201                 $blog =& $manager->getBlog($blogid);
2202
2203                 // check if the category is valid
2204                 if ( !$blog->isValidCategory($catid) )
2205                 {
2206                         self::error(_ERROR_NOSUCHCATEGORY);
2207                         return;
2208                 }
2209
2210                 // don't allow deletion of default category
2211                 if ( $blog->getDefaultCategory() == $catid )
2212                 {
2213                         self::error(_ERROR_DELETEDEFCATEGORY);
2214                         return;
2215                 }
2216
2217                 // check if catid is the only category left for blogid
2218                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2219                 $query = sprintf($query, sql_table('category'), $blogid);
2220                 $res = DB::getResult($query);
2221                 if ( $res->rowCount() == 1 )
2222                 {
2223                         self::error(_ERROR_DELETELASTCATEGORY);
2224                         return;
2225                 }
2226
2227                 self::$skin->parse('categorydelete');
2228                 return;
2229         }
2230
2231         /**
2232          * Admin::action_categorydeleteconfirm()
2233          *
2234          * @param       void
2235          * @return      void
2236          */
2237         static private function action_categorydeleteconfirm()
2238         {
2239                 global $member, $manager;
2240
2241                 $blogid = intRequestVar('blogid');
2242                 $catid  = intRequestVar('catid');
2243
2244                 $member->blogAdminRights($blogid) or self::disallow();
2245
2246                 $error = self::deleteOneCategory($catid);
2247                 if ( $error )
2248                 {
2249                         self::error($error);
2250                         return;
2251                 }
2252
2253                 self::action_blogsettings();
2254                 return;
2255         }
2256
2257         /**
2258          * Admin::deleteOneCategory()
2259          * Delete a category by its id
2260          *
2261          * @param       String  $catid  category id for deleting
2262          * @return      Void
2263          */
2264         static public function deleteOneCategory($catid)
2265         {
2266                 global $manager, $member;
2267
2268                 $catid  = intval($catid);
2269                 $blogid = getBlogIDFromCatID($catid);
2270
2271                 if ( !$member->blogAdminRights($blogid) )
2272                 {
2273                         return ERROR_DISALLOWED;
2274                 }
2275
2276                 // get blog
2277                 $blog =& $manager->getBlog($blogid);
2278
2279                 // check if the category is valid
2280                 if ( !$blog || !$blog->isValidCategory($catid) )
2281                 {
2282                         return _ERROR_NOSUCHCATEGORY;
2283                 }
2284
2285                 $destcatid = $blog->getDefaultCategory();
2286
2287                 // don't allow deletion of default category
2288                 if ( $blog->getDefaultCategory() == $catid )
2289                 {
2290                         return _ERROR_DELETEDEFCATEGORY;
2291                 }
2292
2293                 // check if catid is the only category left for blogid
2294                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2295                 $query = sprintf($query, sql_table('category'), (integer) $blogid);
2296
2297                 $res = DB::getResult($query);
2298                 if ( $res->rowCount() == 1 )
2299                 {
2300                         return _ERROR_DELETELASTCATEGORY;
2301                 }
2302
2303                 $data = array('catid' => $catid);
2304                 $manager->notify('PreDeleteCategory', $data);
2305
2306                 // change category for all items to the default category
2307                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";
2308                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);
2309                 DB::execute($query);
2310
2311                 // delete all associated plugin options
2312                 NucleusPlugin::delete_option_values('category', (integer) $catid);
2313
2314                 // delete category
2315                 $query = "DELETE FROM %s WHERE catid=%d;";
2316                 $query = sprintf($query, sql_table('category'), (integer) $catid);
2317                 DB::execute($query);
2318
2319                 $data = array('catid' => $catid);
2320                 $manager->notify('PostDeleteCategory', $data);
2321                 return;
2322         }
2323
2324         /**
2325          * Admin::moveOneCategory()
2326          * Delete a category by its id
2327          *
2328          * @param       int     $catid          category id for move
2329          * @param       int     $destblogid     blog id for destination
2330          * @return      void
2331          */
2332         static public function moveOneCategory($catid, $destblogid)
2333         {
2334                 global $manager, $member;
2335                 $catid      = intval($catid);
2336                 $destblogid = intval($destblogid);
2337                 $blogid     = getBlogIDFromCatID($catid);
2338                 // mover should have admin rights on both blogs
2339                 if (!$member->blogAdminRights($blogid)) {
2340                         return _ERROR_DISALLOWED;
2341                 }
2342                 if (!$member->blogAdminRights($destblogid)) {
2343                         return _ERROR_DISALLOWED;
2344                 }
2345                 // cannot move to self
2346                 if ($blogid == $destblogid) {
2347                         return _ERROR_MOVETOSELF;
2348                 }
2349                 // get blogs
2350                 $blog     =& $manager->getBlog($blogid);
2351                 $destblog =& $manager->getBlog($destblogid);
2352                 // check if the category is valid
2353                 if (!$blog || !$blog->isValidCategory($catid)) {
2354                         return _ERROR_NOSUCHCATEGORY;
2355                 }
2356                 // don't allow default category to be moved
2357                 if ($blog->getDefaultCategory() == $catid) {
2358                         return _ERROR_MOVEDEFCATEGORY;
2359                 }
2360                 $data = array(
2361                         'catid'                 => &$catid,
2362                         'sourceblog'    => &$blog,
2363                         'destblog'              => &$destblog
2364                 );
2365                 $manager->notify('PreMoveCategory', $data);
2366                 // update comments table (cblog)
2367                 $query = 'SELECT '
2368                 . '    inumber '
2369                 . 'FROM '
2370                 .      sql_table('item') . ' '
2371                 . 'WHERE '
2372                 . '    icat = %d';
2373                 $items = sql_query(sprintf($query, $catid));
2374                 while ($oItem = sql_fetch_object($items)) {
2375                         $query = 'UPDATE '
2376                         .      sql_table('comment') . ' '
2377                         . 'SET '
2378                         . '    cblog = %d' . ' '
2379                         . 'WHERE '
2380                         . '    citem = %d';
2381                         sql_query(sprintf($query, $destblogid, $oItem->inumber));
2382                 }
2383
2384                 // update items (iblog)
2385                 $query = 'UPDATE '
2386                 .      sql_table('item') . ' '
2387                 . 'SET '
2388                 . '    iblog = %d '
2389                 . 'WHERE '
2390                 . '    icat = %d';
2391                 sql_query(sprintf($query, $destblogid, $catid));
2392
2393                 // move category
2394                 $query = 'UPDATE '
2395                 .      sql_table('category') . ' '
2396                 . 'SET '
2397                 . '    cblog = %d' . ' '
2398                 . 'WHERE '
2399                 . '    catid = %d';
2400                 sql_query(sprintf($query, $destblogid, $catid));
2401
2402                 $data = array(
2403                         'catid'                 => &$catid,
2404                         'sourceblog'    => &$blog,
2405                         'destblog'              =>  $destblog
2406                 );
2407                 $manager->notify('PostMoveCategory', $data);
2408                 return;
2409         }
2410
2411         /**
2412          * Admin::action_blogsettingsupdate
2413          * Updating blog settings
2414          *
2415          * @param       Void
2416          * @return      Void
2417          */
2418         static private function action_blogsettingsupdate()
2419         {
2420                 global $member, $manager;
2421
2422                 $blogid = intRequestVar('blogid');
2423
2424                 $member->blogAdminRights($blogid) or self::disallow();
2425
2426                 $blog =& $manager->getBlog($blogid);
2427
2428                 $notify_address = trim(postVar('notify'));
2429                 $shortname              = trim(postVar('shortname'));
2430                 $updatefile             = trim(postVar('update'));
2431
2432                 $notifyComment  = intPostVar('notifyComment');
2433                 $notifyVote             = intPostVar('notifyVote');
2434                 $notifyNewItem  = intPostVar('notifyNewItem');
2435
2436                 if ( $notifyComment == 0 )
2437                 {
2438                         $notifyComment = 1;
2439                 }
2440                 if ( $notifyVote == 0 )
2441                 {
2442                         $notifyVote = 1;
2443                 }
2444                 if ( $notifyNewItem == 0 )
2445                 {
2446                         $notifyNewItem = 1;
2447                 }
2448                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2449
2450                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2451                 {
2452                         self::error(_ERROR_BADNOTIFY);
2453                         return;
2454                 }
2455
2456                 if ( !isValidShortName($shortname) )
2457                 {
2458                         self::error(_ERROR_BADSHORTBLOGNAME);
2459                         return;
2460                 }
2461
2462                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2463                 {
2464                         self::error(_ERROR_DUPSHORTBLOGNAME);
2465                         return;
2466                 }
2467                 // check if update file is writable
2468                 if ( $updatefile && !is_writeable($updatefile) )
2469                 {
2470                         self::error(_ERROR_UPDATEFILE);
2471                         return;
2472                 }
2473
2474                 $blog->setName(trim(postVar('name')));
2475                 $blog->setShortName($shortname);
2476                 $blog->setNotifyAddress($notify_address);
2477                 $blog->setNotifyType($notifyType);
2478                 $blog->setMaxComments(postVar('maxcomments'));
2479                 $blog->setCommentsEnabled(postVar('comments'));
2480                 $blog->setTimeOffset(postVar('timeoffset'));
2481                 $blog->setUpdateFile($updatefile);
2482                 $blog->setURL(trim(postVar('url')));
2483                 $blog->setDefaultSkin(intPostVar('defskin'));
2484                 $blog->setDescription(trim(postVar('desc')));
2485                 $blog->setPublic(postVar('public'));
2486                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2487                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2488                 $blog->setDefaultCategory(intPostVar('defcat'));
2489                 $blog->setSearchable(intPostVar('searchable'));
2490                 $blog->setEmailRequired(intPostVar('reqemail'));
2491                 $blog->writeSettings();
2492
2493                 // store plugin options
2494                 $aOptions = requestArray('plugoption');
2495                 NucleusPlugin::apply_plugin_options($aOptions);
2496
2497                 $data = array(
2498                         'context' => 'blog',
2499                         'blogid'  => $blogid,
2500                         'blog'    => &$blog
2501                 );
2502                 $manager->notify('PostPluginOptionsUpdate', $data);
2503
2504                 self::action_overview(_MSG_SETTINGSCHANGED);
2505                 return;
2506         }
2507
2508         /**
2509          * Admin::action_deleteblog()
2510          *
2511          * @param       void
2512          * @return      void
2513          */
2514         static private function action_deleteblog()
2515         {
2516                 global $member, $CONF, $manager;
2517
2518                 $blogid = intRequestVar('blogid');
2519
2520                 $member->blogAdminRights($blogid) or self::disallow();
2521
2522                 // check if blog is default blog
2523                 if ( $CONF['DefaultBlog'] == $blogid )
2524                 {
2525                         self::error(_ERROR_DELDEFBLOG);
2526                         return;
2527                 }
2528
2529                 $blog =& $manager->getBlog($blogid);
2530
2531                 self::$skin->parse('deleteblog');
2532                 return;
2533         }
2534
2535         /**
2536          * Admin::action_deleteblogconfirm()
2537          * Delete Blog
2538          *
2539          * @param       Void
2540          * @return      Void
2541          */
2542         static private function action_deleteblogconfirm()
2543         {
2544                 global $member, $CONF, $manager;
2545
2546                 $blogid = intRequestVar('blogid');
2547
2548                 $data = array('blogid' => $blogid);
2549                 $manager->notify('PreDeleteBlog', $data);
2550
2551                 $member->blogAdminRights($blogid) or self::disallow();
2552
2553                 // check if blog is default blog
2554                 if ( $CONF['DefaultBlog'] == $blogid )
2555                 {
2556                         self::error(_ERROR_DELDEFBLOG);
2557                         return;
2558                 }
2559
2560                 // delete all comments
2561                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;
2562                 DB::execute($query);
2563
2564                 // delete all items
2565                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;
2566                 DB::execute($query);
2567
2568                 // delete all team members
2569                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;
2570                 DB::execute($query);
2571
2572                 // delete all bans
2573                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;
2574                 DB::execute($query);
2575
2576                 // delete all categories
2577                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;
2578                 DB::execute($query);
2579
2580                 // delete all associated plugin options
2581                 NucleusPlugin::delete_option_values('blog', $blogid);
2582
2583                 // delete the blog itself
2584                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;
2585                 DB::execute($query);
2586
2587                 $data = array('blogid' => $blogid);
2588                 $manager->notify('PostDeleteBlog', $data);
2589
2590                 self::action_overview(_DELETED_BLOG);
2591                 return;
2592         }
2593
2594         /**
2595          * Admin::action_memberdelete()
2596          *
2597          * @param       void
2598          * @return      void
2599          */
2600         static private function action_memberdelete()
2601         {
2602                 global $member, $manager;
2603
2604                 $memberid = intRequestVar('memberid');
2605
2606                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2607
2608                 $mem =& $manager->getMember($memberid);
2609
2610                 self::$skin->parse('memberdelete');
2611                 return;
2612         }
2613
2614         /**
2615          * Admin::action_memberdeleteconfirm()
2616          *
2617          * @param       void
2618          * @return      void
2619          */
2620         static private function action_memberdeleteconfirm()
2621         {
2622                 global $member;
2623
2624                 $memberid = intRequestVar('memberid');
2625
2626                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2627
2628                 $error = self::deleteOneMember($memberid);
2629                 if ( $error )
2630                 {
2631                         self::error($error);
2632                         return;
2633                 }
2634
2635                 if ( $member->isAdmin() )
2636                 {
2637                         self::action_usermanagement();
2638                         return;
2639                 }
2640                 else
2641                 {
2642                         self::action_overview(_DELETED_MEMBER);
2643                         return;
2644                 }
2645                 return;
2646         }
2647
2648         /**
2649          * Admin::deleteOneMember()
2650          * Delete a member by id
2651          *
2652          * @static
2653          * @params      Integer $memberid       member id
2654          * @return      String  null string or error messages
2655          */
2656         static public function deleteOneMember($memberid)
2657         {
2658                 global $manager;
2659
2660                 $memberid = intval($memberid);
2661                 $mem =& $manager->getMember($memberid);
2662
2663                 if ( !$mem->canBeDeleted() )
2664                 {
2665                         return _ERROR_DELETEMEMBER;
2666                 }
2667
2668                 $data = array('member' => &$mem);
2669                 $manager->notify('PreDeleteMember', $data);
2670
2671                 /* unlink comments from memberid */
2672                 if ( $memberid )
2673                 {
2674                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";
2675                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);
2676                         DB::execute($query);
2677                 }
2678
2679                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;
2680                 DB::execute($query);
2681
2682                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;
2683                 DB::execute($query);
2684
2685                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;
2686                 DB::execute($query);
2687
2688                 // delete all associated plugin options
2689                 NucleusPlugin::delete_option_values('member', $memberid);
2690
2691                 $data = array('member' => &$mem);
2692                 $manager->notify('PostDeleteMember', $data);
2693
2694                 return '';
2695         }
2696
2697         /**
2698          * Admin::action_createnewlog()
2699          *
2700          * @param       void
2701          * @return      void
2702          */
2703         static private function action_createnewlog()
2704         {
2705                 global $member, $CONF, $manager;
2706
2707                 // Only Super-Admins can do this
2708                 $member->isAdmin() or self::disallow();
2709
2710                 self::$skin->parse('createnewlog');
2711                 return;
2712         }
2713
2714         /**
2715          * Admin::action_addnewlog()
2716          *
2717          * @param       void
2718          * @return      void
2719          */
2720         static private function action_addnewlog()
2721         {
2722                 global $member, $manager, $CONF;
2723
2724                 // Only Super-Admins can do this
2725                 $member->isAdmin() or self::disallow();
2726
2727                 $bname                  = trim(postVar('name'));
2728                 $bshortname             = trim(postVar('shortname'));
2729                 $btimeoffset    = postVar('timeoffset');
2730                 $bdesc                  = trim(postVar('desc'));
2731                 $bdefskin               = postVar('defskin');
2732
2733                 if ( !isValidShortName($bshortname) )
2734                 {
2735                         self::error(_ERROR_BADSHORTBLOGNAME);
2736                         return;
2737                 }
2738
2739                 if ( $manager->existsBlog($bshortname) )
2740                 {
2741                         self::error(_ERROR_DUPSHORTBLOGNAME);
2742                         return;
2743                 }
2744
2745                 $data = array(
2746                         'name'        => &$bname,
2747                         'shortname'   => &$bshortname,
2748                         'timeoffset'  => &$btimeoffset,
2749                         'description' => &$bdesc,
2750                         'defaultskin' => &$bdefskin
2751                 );
2752                 $manager->notify('PreAddBlog', $data);
2753
2754                 // add slashes for sql queries
2755                 $bname                  = DB::quoteValue($bname);
2756                 $bshortname             = DB::quoteValue($bshortname);
2757                 $btimeoffset    = DB::quoteValue($btimeoffset);
2758                 $bdesc                  = DB::quoteValue($bdesc);
2759                 $bdefskin               = DB::quoteValue($bdefskin);
2760
2761                 // create blog
2762                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";
2763                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);
2764                 DB::execute($query);
2765
2766                 $blogid = DB::getInsertId();
2767                 $blog   =& $manager->getBlog($blogid);
2768
2769                 // create new category
2770                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);
2771                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);
2772
2773                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';
2774                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));
2775                 $catid = DB::getInsertId();
2776
2777                 // set as default category
2778                 $blog->setDefaultCategory($catid);
2779                 $blog->writeSettings();
2780
2781                 // create team member
2782                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";
2783                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);
2784                 DB::execute($query);
2785
2786                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
2787                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');
2788
2789                 $blog->additem(
2790                         $blog->getDefaultCategory(),
2791                         $itemdeftitle,$itemdefbody,
2792                         '',
2793                         $blogid,
2794                         $member->getID(),
2795                         $blog->getCorrectTime(),
2796                         0,
2797                         0,
2798                         0
2799                 );
2800
2801                 $data = array('blog' => &$blog);
2802                 $manager->notify('PostAddBlog', $data);
2803
2804                 $data = array(
2805                         'blog'                  => &$blog,
2806                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,
2807                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,
2808                         'catid'                 => $catid
2809                 );
2810                 $manager->notify('PostAddCategory', $data);
2811
2812                 /* TODO: we should consider to use the other way insterad of this */
2813                 $_REQUEST['blogid'] = $blogid;
2814                 $_REQUEST['catid']  = $catid;
2815                 self::$skin->parse('addnewlog');
2816                 return;
2817         }
2818
2819         /**
2820          * Admin::action_addnewlog2()
2821          *
2822          * @param       void
2823          * @return      void
2824          */
2825         static private function action_addnewlog2()
2826         {
2827                 global $member, $manager;
2828                 $blogid = intRequestVar('blogid');
2829
2830                 $member->blogAdminRights($blogid) or self::disallow();
2831
2832                 $burl = requestVar('url');
2833
2834                 $blog =& $manager->getBlog($blogid);
2835                 $blog->setURL(trim($burl));
2836                 $blog->writeSettings();
2837
2838                 self::action_overview(_MSG_NEWBLOG);
2839                 return;
2840         }
2841
2842         /**
2843          * Admin::action_skinieoverview()
2844          *
2845          * @param       void
2846          * @return      void
2847          */
2848         static private function action_skinieoverview()
2849         {
2850                 global $member, $DIR_LIBS, $manager;
2851
2852                 $member->isAdmin() or self::disallow();
2853
2854                 include_once($DIR_LIBS . 'skinie.php');
2855
2856                 self::$skin->parse('skinieoverview');
2857                 return;
2858         }
2859
2860         /**
2861          * Admin::action_skinieimport()
2862          *
2863          * @param       void
2864          * @return      void
2865          */
2866         static private function action_skinieimport()
2867         {
2868                 global $member;
2869
2870                 $member->isAdmin() or self::disallow();
2871
2872                 $skinFileRaw = postVar('skinfile');
2873                 $mode = postVar('mode');
2874
2875                 $error = self::skinieimport($mode, $skinFileRaw);
2876                 if ( $error )
2877                 {
2878                         self::error($error);
2879                         return;
2880                 }
2881
2882                 self::$skin->parse('skinieimport');
2883                 return;
2884         }
2885
2886         /**
2887          * Admin::action_skiniedoimport()
2888          *
2889          * @param       void
2890          * @return      void
2891          */
2892         static private function action_skiniedoimport()
2893         {
2894                 global $member, $DIR_LIBS, $DIR_SKINS;
2895
2896                 $member->isAdmin() or self::disallow();
2897
2898                 // load skinie class
2899                 include_once($DIR_LIBS . 'skinie.php');
2900
2901                 $mode = postVar('mode');
2902                 $skinFileRaw = postVar('skinfile');
2903                 $allowOverwrite = intPostVar('overwrite');
2904
2905                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
2906                 if ( $error )
2907                 {
2908                         self::error($msg);
2909                         return;
2910                 }
2911
2912                 self::$skin->parse('skiniedoimport');
2913                 return;
2914         }
2915
2916         /**
2917          * Admin::action_skinieexport()
2918          *
2919          * @param       void
2920          * @return      void
2921          */
2922         static private function action_skinieexport()
2923         {
2924                 global $member;
2925
2926                 $member->isAdmin() or self::disallow();
2927
2928                 $aSkins = requestIntArray('skin');
2929                 $aTemplates = requestIntArray('template');
2930                 $info = postVar('info');
2931
2932                 self::skinieexport($aSkins, $aTemplates, $info);
2933
2934                 return;
2935         }
2936
2937         /**
2938          * Admin::action_templateoverview()
2939          *
2940          * @param       void
2941          * @return      void
2942          */
2943         static private function action_templateoverview()
2944         {
2945                 global $member, $manager;
2946
2947                 $member->isAdmin() or self::disallow();
2948
2949                 self::$skin->parse('templateoverview');
2950                 return;
2951         }
2952
2953         /**
2954          * Admin::action_templateedit()
2955          *
2956          * @param       string  $msg    message for pageheader
2957          * @return      void
2958          */
2959         static private function action_templateedit($msg = '')
2960         {
2961                 global $member, $manager;
2962                 if ( $msg )
2963                 {
2964                         self::$headMess = $msg;
2965                 }
2966
2967                 $templateid = intRequestVar('templateid');
2968
2969                 $member->isAdmin() or self::disallow();
2970
2971                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/templateEdit.js)%>\"></script>\n";
2972                 self::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";
2973
2974                 self::$skin->parse('templateedit');
2975                 return;
2976         }
2977
2978         /**
2979          * Admin::action_templateupdate()
2980          *
2981          * @param       void
2982          * @return      void
2983          */
2984         static private function action_templateupdate()
2985         {
2986                 global $member,$manager;
2987
2988                 $templateid = intRequestVar('templateid');
2989
2990                 $member->isAdmin() or self::disallow();
2991
2992                 $name = postVar('tname');
2993                 $desc = postVar('tdesc');
2994
2995                 if ( !isValidTemplateName($name) )
2996                 {
2997                         self::error(_ERROR_BADTEMPLATENAME);
2998                         return;
2999                 }
3000
3001                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3002                 {
3003                         self::error(_ERROR_DUPTEMPLATENAME);
3004                         return;
3005                 }
3006
3007                 // 1. Remove all template parts
3008                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3009                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3010                 DB::execute($query);
3011
3012                 // 2. Update description
3013                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3014                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3015                 DB::execute($query);
3016
3017                 // 3. Add non-empty template parts
3018                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));
3019                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));
3020                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));
3021                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));
3022                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));
3023                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));
3024                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));
3025                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));
3026                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));
3027                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));
3028                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));
3029                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));
3030                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));
3031                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));
3032                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));
3033                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));
3034                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3035                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));
3036                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));
3037                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));
3038                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));
3039                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));
3040                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));
3041                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));
3042                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));
3043                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));
3044                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));
3045                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));
3046                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));
3047                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3048                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));
3049                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));
3050                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));
3051
3052                 $data = array('fields' => array());
3053                 $manager->notify('TemplateExtraFields', $data);
3054                 foreach ( $data['fields'] as $pfkey=>$pfvalue )
3055                 {
3056                         foreach ( $pfvalue as $pffield => $pfdesc )
3057                         {
3058                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3059                         }
3060                 }
3061
3062                 // jump back to template edit
3063                 self::action_templateedit(_TEMPLATE_UPDATED);
3064                 return;
3065         }
3066
3067         /**
3068          * Admin::addToTemplate()
3069          *
3070          * @param       Integer $id     ID for template
3071          * @param       String  $partname       parts name
3072          * @param       String  $content        template contents
3073          * @return      Integer record index
3074          *
3075          */
3076         static private function addToTemplate($id, $partname, $content)
3077         {
3078                 // don't add empty parts:
3079                 if ( !trim($content) )
3080                 {
3081                         return -1;
3082                 }
3083
3084                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";
3085                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));
3086                 if ( DB::execute($query) === FALSE )
3087                 {
3088                         $err = DB::getError();
3089                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
3090                 }
3091                 return DB::getInsertId();
3092         }
3093
3094         /**
3095          * Admin::action_templatedelete()
3096          *
3097          * @param       void
3098          * @return      void
3099          */
3100         static private function action_templatedelete()
3101         {
3102                 global $member, $manager;
3103
3104                 $member->isAdmin() or self::disallow();
3105
3106                 $templateid = intRequestVar('templateid');
3107                 // TODO: check if template can be deleted
3108
3109                 self::$skin->parse('templatedelete');
3110                 return;
3111         }
3112
3113         /**
3114          * Admin::action_templatedeleteconfirm()
3115          *
3116          * @param       void
3117          * @return      void
3118          */
3119         static private function action_templatedeleteconfirm()
3120         {
3121                 global $member, $manager;
3122
3123                 $templateid = intRequestVar('templateid');
3124
3125                 $member->isAdmin() or self::disallow();
3126
3127                 $data = array('templateid' => $templateid);
3128                 $manager->notify('PreDeleteTemplate', $data);
3129
3130                 // 1. delete description
3131                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);
3132
3133                 // 2. delete parts
3134                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);
3135
3136
3137                 $data = array('templateid' => $templateid);
3138                 $manager->notify('PostDeleteTemplate', $data);
3139
3140                 self::action_templateoverview();
3141                 return;
3142         }
3143
3144         /**
3145          * Admin::action_templatenew()
3146          *
3147          * @param       void
3148          * @return      void
3149          */
3150         static private function action_templatenew()
3151         {
3152                 global $member;
3153
3154                 $member->isAdmin() or self::disallow();
3155
3156                 $name = postVar('name');
3157                 $desc = postVar('desc');
3158
3159                 if ( !isValidTemplateName($name) )
3160                 {
3161                         self::error(_ERROR_BADTEMPLATENAME);
3162                         return;
3163                 }
3164
3165                 if ( Template::exists($name) )
3166                 {
3167                         self::error(_ERROR_DUPTEMPLATENAME);
3168                         return;
3169                 }
3170
3171                 $newTemplateId = Template::createNew($name, $desc);
3172
3173                 self::action_templateoverview();
3174                 return;
3175         }
3176
3177         /**
3178          * Admin::action_templateclone()
3179          *
3180          * @param       void
3181          * @return      void
3182          */
3183         static private function action_templateclone()
3184         {
3185                 global $member;
3186
3187                 $templateid = intRequestVar('templateid');
3188
3189                 $member->isAdmin() or self::disallow();
3190
3191                 // 1. read old template
3192                 $name = Template::getNameFromId($templateid);
3193                 $desc = Template::getDesc($templateid);
3194
3195                 // 2. create desc thing
3196                 $name = "cloned" . $name;
3197
3198                 // if a template with that name already exists:
3199                 if ( Template::exists($name) )
3200                 {
3201                         $i = 1;
3202                         while (Template::exists($name . $i))
3203                         {
3204                                 $i++;
3205                         }
3206                         $name .= $i;
3207                 }
3208
3209                 $newid = Template::createNew($name, $desc);
3210
3211                 // 3. create clone
3212                 // go through parts of old template and add them to the new one
3213                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3214                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3215
3216                 $res = DB::getResult($query);
3217                 foreach ( $res as $row)
3218                 {
3219                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3220                 }
3221
3222                 self::action_templateoverview();
3223                 return;
3224         }
3225
3226         /**
3227          * Admin::action_admintemplateoverview()
3228          *
3229          * @param       void
3230          * @return      void
3231          */
3232         static private function action_admintemplateoverview()
3233         {
3234                 global $member;
3235                 $member->isAdmin() or self::disallow();
3236                 self::$skin->parse('admntemplateoverview');
3237                 return;
3238         }
3239
3240         /**
3241          * Admin::action_admintemplateedit()
3242          *
3243          * @param       string  $msg    message for pageheader
3244          * @return      void
3245          */
3246         static private function action_admintemplateedit($msg = '')
3247         {
3248                 global $member, $manager;
3249                 if ( $msg )
3250                 {
3251                         self::$headMess = $msg;
3252                 }
3253                 $member->isAdmin() or self::disallow();
3254
3255                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/templateEdit.js)%>\"></script>\n";
3256                 self::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";
3257
3258                 self::$skin->parse('admintemplateedit');
3259                 return;
3260         }
3261
3262         /**
3263          * Admin::action_admintemplateupdate()
3264          *
3265          * @param       void
3266          * @return      void
3267          */
3268         static private function action_admintemplateupdate()
3269         {
3270                 global $member, $manager;
3271                 $templateid = intRequestVar('templateid');
3272                 $member->isAdmin() or self::disallow();
3273                 $name = postVar('tname');
3274                 $desc = postVar('tdesc');
3275
3276                 if ( !isValidTemplateName($name) )
3277                 {
3278                         self::error(_ERROR_BADTEMPLATENAME);
3279                         return;
3280                 }
3281
3282                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3283                 {
3284                         self::error(_ERROR_DUPTEMPLATENAME);
3285                         return;
3286                 }
3287
3288                 // 1. Remove all template parts
3289                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3290                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3291                 DB::execute($query);
3292
3293                 // 2. Update description
3294                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3295                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3296                 DB::execute($query);
3297
3298                 // 3. Add non-empty template parts
3299                 self::addToTemplate($templateid, 'NORMALSKINLIST_HEAD',                                         postVar('NORMALSKINLIST_HEAD'));
3300                 self::addToTemplate($templateid, 'NORMALSKINLIST_BODY',                                         postVar('NORMALSKINLIST_BODY'));
3301                 self::addToTemplate($templateid, 'NORMALSKINLIST_FOOT',                                         postVar('NORMALSKINLIST_FOOT'));
3302                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                           postVar('ADMIN_CUSTOMHELPLINK_ICON'));
3303                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                         postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));
3304                 self::addToTemplate($templateid, 'ADMIN_BLOGLINK',                                                      postVar('ADMIN_BLOGLINK'));
3305                 self::addToTemplate($templateid, 'ADMIN_BATCHLIST',                                                     postVar('ADMIN_BATCHLIST'));
3306                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                       postVar('ACTIVATE_FORGOT_TITLE'));
3307                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                        postVar('ACTIVATE_FORGOT_TEXT'));
3308                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                     postVar('ACTIVATE_REGISTER_TITLE'));
3309                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                      postVar('ACTIVATE_REGISTER_TEXT'));
3310                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                       postVar('ACTIVATE_CHANGE_TITLE'));
3311                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                        postVar('ACTIVATE_CHANGE_TEXT'));
3312                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                            postVar('TEMPLATE_EDIT_EXPLUGNAME'));
3313                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                      postVar('TEMPLATE_EDIT_ROW_HEAD'));
3314                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                      postVar('TEMPLATE_EDIT_ROW_TAIL'));
3315                 self::addToTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                        postVar('SPECIALSKINLIST_HEAD'));
3316                 self::addToTemplate($templateid, 'SPECIALSKINLIST_BODY',                                        postVar('SPECIALSKINLIST_BODY'));
3317                 self::addToTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                        postVar('SPECIALSKINLIST_FOOT'));
3318                 self::addToTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                       postVar('SYSTEMINFO_GDSETTINGS'));
3319                 self::addToTemplate($templateid, 'BANLIST_DELETED_LIST',                                        postVar('BANLIST_DELETED_LIST'));
3320                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                     postVar('INSERT_PLUGOPTION_TITLE'));
3321                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                      postVar('INSERT_PLUGOPTION_BODY'));
3322                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                           postVar('INPUTYESNO_TEMPLATE_ADMIN'));
3323                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                          postVar('INPUTYESNO_TEMPLATE_NORMAL'));
3324                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                          postVar('ADMIN_SPECIALSKINLIST_HEAD'));
3325                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                          postVar('ADMIN_SPECIALSKINLIST_BODY'));
3326                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                          postVar('ADMIN_SPECIALSKINLIST_FOOT'));
3327                 self::addToTemplate($templateid, 'SKINIE_EXPORT_LIST',                                          postVar('SKINIE_EXPORT_LIST'));
3328                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                       postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));
3329                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                       postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));
3330                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                       postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));
3331                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                        postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));
3332                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                        postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));
3333                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                        postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));
3334                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));
3335                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));
3336                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));
3337                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));
3338                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));
3339                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));
3340                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));
3341                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));
3342                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));
3343                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));
3344                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));
3345                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));
3346                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));
3347                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));
3348                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));
3349                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));
3350                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));
3351                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));
3352                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));
3353                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));
3354                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));
3355                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));
3356                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));
3357                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));
3358                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));
3359                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));
3360                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));
3361                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));
3362                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));
3363                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));
3364                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));
3365                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));
3366                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));
3367                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));
3368                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));
3369                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));
3370                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));
3371                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));
3372                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));
3373                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));
3374                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));
3375                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));
3376                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));
3377                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));
3378                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));
3379                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));
3380                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));
3381                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));
3382                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));
3383                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));
3384                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));
3385                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));
3386                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));
3387                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));
3388                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));
3389                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));
3390                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));
3391                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));
3392                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));
3393                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));
3394                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));
3395                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));
3396                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));
3397                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));
3398                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));
3399                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));
3400                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                      postVar('PLUGIN_QUICKMENU_TITLE'));
3401                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                       postVar('PLUGIN_QUICKMENU_HEAD'));
3402                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                       postVar('PLUGIN_QUICKMENU_BODY'));
3403                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                       postVar('PLUGIN_QUICKMENU_FOOT'));
3404
3405                 $data = array('fields' => array());
3406                 $manager->notify('AdminTemplateExtraFields', $data);
3407                 foreach ( $data['fields'] as $pfkey => $pfvalue )
3408                 {
3409                         foreach ( $pfvalue as $pffield => $pfdesc )
3410                         {
3411                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3412                         }
3413                 }
3414
3415                 // jump back to template edit
3416                 self::action_admintemplateedit(_TEMPLATE_UPDATED);
3417                 return;
3418         }
3419
3420         /**
3421          * Admin::action_admintemplatedelete()
3422          *
3423          * @param       void
3424          * @return      void
3425          */
3426         static private function action_admintemplatedelete()
3427         {
3428                 global $member, $manager;
3429                 $member->isAdmin() or self::disallow();
3430
3431                 // TODO: check if template can be deleted
3432                 self::$skin->parse('admintemplatedelete');
3433                 return;
3434         }
3435
3436         /**
3437          * Admin::action_admintemplatedeleteconfirm()
3438          *
3439          * @param       void
3440          * @return      void
3441          */
3442         static private function action_admintemplatedeleteconfirm()
3443         {
3444                 global $member, $manager;
3445
3446                 $templateid = intRequestVar('templateid');
3447                 $member->isAdmin() or self::disallow();
3448
3449                 $data = array('templateid' => $templateid);
3450                 $manager->notify('PreDeleteAdminTemplate', $data);
3451
3452                 // 1. delete description
3453                 $query = "DELETE FROM %s WHERE tdnumber=%s;";
3454                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);
3455                 DB::execute($query);
3456
3457                 // 2. delete parts
3458                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3459                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3460                 DB::execute($query);
3461
3462                 $data = array('templateid' => $templateid);
3463                 $manager->notify('PostDeleteAdminTemplate', $data);
3464
3465                 self::action_admintemplateoverview();
3466                 return;
3467         }
3468
3469         /**
3470          * Admin::action_admintemplatenew()
3471          *
3472          * @param       void
3473          * @return      void
3474          */
3475         static private function action_admintemplatenew()
3476         {
3477                 global $member;
3478                 $member->isAdmin() or self::disallow();
3479                 $name = postVar('name');
3480                 $desc = postVar('desc');
3481
3482                 if ( !isValidTemplateName($name) )
3483                 {
3484                         self::error(_ERROR_BADTEMPLATENAME);
3485                         return;
3486                 }
3487                 else if ( !preg_match('#^admin/#', $name) )
3488                 {
3489                         self::error(_ERROR_BADADMINTEMPLATENAME);
3490                         return;
3491                 }
3492                 else if ( Template::exists($name) )
3493                 {
3494                         self::error(_ERROR_DUPTEMPLATENAME);
3495                         return;
3496                 }
3497
3498                 $newTemplateId = Template::createNew($name, $desc);
3499                 self::action_admintemplateoverview();
3500                 return;
3501         }
3502
3503         /**
3504          * Admin::action_admintemplateclone()
3505          *
3506          * @param       void
3507          * @return      void
3508          */
3509         static private function action_admintemplateclone()
3510         {
3511                 global $member;
3512                 $templateid = intRequestVar('templateid');
3513                 $member->isAdmin() or self::disallow();
3514
3515                 // 1. read old template
3516                 $name = Template::getNameFromId($templateid);
3517                 $desc = Template::getDesc($templateid);
3518
3519                 // 2. create desc thing
3520                 $name = $name . "cloned";
3521
3522                 // if a template with that name already exists:
3523                 if ( Template::exists($name) )
3524                 {
3525                         $i = 1;
3526                         while ( Template::exists($name . $i) )
3527                         {
3528                                 $i++;
3529                         }
3530                         $name .= $i;
3531                 }
3532
3533                 $newid = Template::createNew($name, $desc);
3534
3535                 // 3. create clone
3536                 // go through parts of old template and add them to the new one
3537                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3538                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3539
3540                 $res = DB::getResult($query);
3541                 foreach ( $res as $row )
3542                 {
3543                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3544                 }
3545
3546                 self::action_admintemplateoverview();
3547                 return;
3548         }
3549
3550         /**
3551          * Admin::action_skinoverview()
3552          *
3553          * @param       void
3554          * @return      void
3555          */
3556         static private function action_skinoverview()
3557         {
3558                 global $member, $manager;
3559
3560                 $member->isAdmin() or self::disallow();
3561
3562                 self::$skin->parse('skinoverview');
3563                 return;
3564         }
3565
3566         /**
3567          * Admin::action_skinnew()
3568          *
3569          * @param       void
3570          * @return      void
3571          */
3572         static private function action_skinnew()
3573         {
3574                 global $member;
3575
3576                 $member->isAdmin() or self::disallow();
3577
3578                 $name = trim(postVar('name'));
3579                 $desc = trim(postVar('desc'));
3580
3581                 if ( !isValidSkinName($name) )
3582                 {
3583                         self::error(_ERROR_BADSKINNAME);
3584                         return;
3585                 }
3586                 else if ( SKIN::exists($name) )
3587                 {
3588                         self::error(_ERROR_DUPSKINNAME);
3589                         return;
3590                 }
3591
3592                 SKIN::createNew($name, $desc);
3593
3594                 self::action_skinoverview();
3595                 return;
3596         }
3597
3598         /**
3599          * Admin::action_skinedit()
3600          *
3601          * @param       void
3602          * @return      void
3603          */
3604         static private function action_skinedit()
3605         {
3606                 global $member;
3607
3608                 $member->isAdmin() or self::disallow();
3609
3610                 self::$skin->parse('skinedit');
3611                 return;
3612         }
3613
3614         /**
3615          * Admin::action_skineditgeneral()
3616          *
3617          * @param       void
3618          * @return      void
3619          */
3620         static private function action_skineditgeneral()
3621         {
3622                 global $member;
3623
3624                 $skinid = intRequestVar('skinid');
3625
3626                 $member->isAdmin() or self::disallow();
3627
3628                 $error = self::skineditgeneral($skinid);
3629                 if ( $error )
3630                 {
3631                         self::error($error);
3632                         return;
3633                 }
3634
3635                 self::action_skinedit();
3636                 return;
3637         }
3638
3639         static private function action_skinedittype($msg = '')
3640         {
3641                 global $member;
3642
3643                 $member->isAdmin() or self::disallow();
3644
3645                 if ( $msg )
3646                 {
3647                         self::$headMess = $msg;
3648                 }
3649
3650                 $type = requestVar('type');
3651                 $type = trim($type);
3652                 $type = strtolower($type);
3653
3654                 if ( !isValidShortName($type) )
3655                 {
3656                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3657                         return;
3658                 }
3659
3660                 self::$skin->parse('skinedittype');
3661                 return;
3662         }
3663
3664         /**
3665          * Admin::action_skinupdate()
3666          *
3667          * @param       void
3668          * @return      void
3669          */
3670         static private function action_skinupdate()
3671         {
3672                 global $manager, $member;
3673
3674                 $skinid = intRequestVar('skinid');
3675                 $content = trim(postVar('content'));
3676                 $type = postVar('type');
3677
3678                 $member->isAdmin() or self::disallow();
3679
3680                 $skin =& $manager->getSKIN($skinid);
3681                 $skin->update($type, $content);
3682
3683                 self::action_skinedittype(_SKIN_UPDATED);
3684                 return;
3685         }
3686
3687         /**
3688          * Admin::action_skindelete()
3689          *
3690          * @param       void
3691          * @return      void
3692          */
3693         static private function action_skindelete()
3694         {
3695                 global $CONF, $member;
3696
3697                 $member->isAdmin() or self::disallow();
3698
3699                 $skinid = intRequestVar('skinid');
3700
3701                 // don't allow default skin to be deleted
3702                 if ( $skinid == $CONF['BaseSkin'] )
3703                 {
3704                         self::error(_ERROR_DEFAULTSKIN);
3705                         return;
3706                 }
3707
3708                 // don't allow deletion of default skins for blogs
3709                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";
3710                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3711
3712                 $name = DB::getValue($query);
3713                 if ( $name )
3714                 {
3715                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3716                         return;
3717                 }
3718
3719                 self::$skin->parse('skindelete');
3720                 return;
3721         }
3722
3723         /**
3724          * Admin::action_skindeleteconfirm()
3725          *
3726          * @param       void
3727          * @return      void
3728          */
3729         static private function action_skindeleteconfirm()
3730         {
3731                 global $member, $CONF;
3732
3733                 $member->isAdmin() or self::disallow();
3734
3735                 $skinid = intRequestVar('skinid');
3736
3737                 // don't allow default skin to be deleted
3738                 if ( $skinid == $CONF['BaseSkin'] )
3739                 {
3740                         self::error(_ERROR_DEFAULTSKIN);
3741                         return;
3742                 }
3743
3744                 // don't allow deletion of default skins for blogs
3745                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";
3746                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3747
3748                 $name = DB::getValue($query);
3749                 if ( $name )
3750                                 {
3751                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3752                         return;
3753                 }
3754
3755                 self::skindeleteconfirm($skinid);
3756
3757                 self::action_skinoverview();
3758                 return;
3759         }
3760
3761         /**
3762          * Admin::action_skinremovetype()
3763          *
3764          * @param       void
3765          * @return      void
3766          */
3767         static private function action_skinremovetype()
3768         {
3769                 global $member, $CONF;
3770
3771                 $member->isAdmin() or self::disallow();
3772
3773                 $skinid = intRequestVar('skinid');
3774                 $skintype = requestVar('type');
3775
3776                 if ( !isValidShortName($skintype) )
3777                 {
3778                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
3779                         return;
3780                 }
3781
3782                 self::$skin->parse('skinremovetype');
3783                 return;
3784         }
3785
3786         /**
3787          * Admin::action_skinremovetypeconfirm()
3788          *
3789          * @param       void
3790          * @return      void
3791          */
3792         static private function action_skinremovetypeconfirm()
3793         {
3794                 global $member;
3795
3796                 $member->isAdmin() or self::disallow();
3797
3798                 $skinid = intRequestVar('skinid');
3799                 $skintype = requestVar('type');
3800
3801                 $error = self::skinremovetypeconfirm($skinid, $skintype);
3802                 if ( $error )
3803                 {
3804                         self::error($error);
3805                         return;
3806                 }
3807
3808                 self::action_skinedit();
3809                 return;
3810         }
3811
3812         /**
3813          * Admin::action_skinclone()
3814          *
3815          * @param       void
3816          * @return      void
3817          */
3818         static private function action_skinclone()
3819         {
3820                 global $member;
3821
3822                 $member->isAdmin() or self::disallow();
3823
3824                 $skinid = intRequestVar('skinid');
3825
3826                 self::skinclone($skinid);
3827
3828                 self::action_skinoverview();
3829                 return;
3830         }
3831
3832         /**
3833          * Admin::action_adminskinoverview()
3834          *
3835          * @param       void
3836          * @return      void
3837          */
3838         static private function action_adminskinoverview()
3839         {
3840                 global $member;
3841
3842                 $member->isAdmin() or self::disallow();
3843
3844                 self::$skin->parse('adminskinoverview');
3845                 return;
3846         }
3847
3848         /**
3849          * Admin::action_adminskinnew()
3850          *
3851          * @param       void
3852          * @return      void
3853          */
3854         static private function action_adminskinnew()
3855         {
3856                 global $member;
3857
3858                 $member->isAdmin() or self::disallow();
3859
3860                 $name = trim(postVar('name'));
3861                 $desc = trim(postVar('desc'));
3862
3863                 if ( !isValidSkinName($name) )
3864                 {
3865                         self::error(_ERROR_BADSKINNAME);
3866                         return;
3867                 }
3868                 else if ( !preg_match('#^admin/#', $name) )
3869                 {
3870                         self::error(_ERROR_BADADMINSKINNAME);
3871                         return;
3872                 }
3873                 else if ( Skin::exists($name) )
3874                 {
3875                         self::error(_ERROR_DUPSKINNAME);
3876                         return;
3877                 }
3878
3879                 Skin::createNew($name, $desc);
3880
3881                 self::action_adminskinoverview();
3882                 return;
3883         }
3884
3885         /**
3886          * Admin::action_adminskinedit()
3887          *
3888          * @param       void
3889          * @return      void
3890          */
3891         static private function action_adminskinedit()
3892         {
3893                 global $member;
3894
3895                 $member->isAdmin() or self::disallow();
3896
3897                 self::$skin->parse('adminskinedit');
3898
3899                 return;
3900         }
3901
3902         /**
3903          * Admin::action_adminskineditgeneral()
3904          *
3905          * @param       void
3906          * @return      void
3907          */
3908         static private function action_adminskineditgeneral()
3909         {
3910                 global $member;
3911
3912                 $skinid = intRequestVar('skinid');
3913
3914                 $member->isAdmin() or self::disallow();
3915
3916                 $error = self::skineditgeneral($skinid, 'AdminActions');
3917                 if ( $error )
3918                 {
3919                         self::error($error);
3920                         return;
3921                 }
3922
3923                 self::action_adminskinedit();
3924                 return;
3925         }
3926
3927         /**
3928          * Admin::action_adminskinedittype()
3929          *
3930          * @param       string  $msg    message for pageheader
3931          * @return      void
3932          */
3933         static private function action_adminskinedittype($msg = '')
3934         {
3935                 global $member;
3936
3937                 $member->isAdmin() or self::disallow();
3938
3939                 if ( $msg )
3940                 {
3941                         self::$headMess = $msg;
3942                 }
3943                 $type = requestVar('type');
3944                 $type = trim($type);
3945                 $type = strtolower($type);
3946
3947                 if ( !isValidShortName($type) )
3948                 {
3949                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3950                         return;
3951                 }
3952
3953                 self::$skin->parse('adminskinedittype');
3954                 return;
3955         }
3956
3957         /**
3958          * Admin::action_adminskinupdate()
3959          *
3960          * @param       void
3961          * @return      void
3962          */
3963         static private function action_adminskinupdate()
3964         {
3965                 global $manager, $member;
3966
3967                 $skinid = intRequestVar('skinid');
3968                 $content = trim(postVar('content'));
3969                 $type = postVar('type');
3970
3971                 $member->isAdmin() or self::disallow();
3972
3973                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
3974                 $skin->update($type, $content);
3975
3976                 self::action_adminskinedittype(_SKIN_UPDATED);
3977                 return;
3978         }
3979
3980         /**
3981          * Admin::action_adminskindelete()
3982          *
3983          * @param       void
3984          * @return      void
3985          */
3986         static private function action_adminskindelete()
3987         {
3988                 global $CONF, $member;
3989
3990                 $member->isAdmin() or self::disallow();
3991
3992                 $skinid = intRequestVar('skinid');
3993
3994                 // don't allow default skin to be deleted
3995                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
3996                 {
3997                         self::error(_ERROR_DEFAULTSKIN);
3998                         return;
3999                 }
4000
4001                 /* don't allow if someone use it as a default*/
4002                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4003                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4004
4005                 $members = array();
4006                 while ( $row = $res->fetch() ) {
4007                         $members[] = $row['mrealname'];
4008                 }
4009                 if ( count($members) )
4010                 {
4011                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4012                         return;
4013                 }
4014
4015                 self::$skin->parse('adminskindelete');
4016                 return;
4017         }
4018
4019         /**
4020          * Admin::action_adminskindeleteconfirm()
4021          *
4022          * @param       void
4023          * @return      void
4024          */
4025         static private function action_adminskindeleteconfirm()
4026         {
4027                 global $member, $CONF;
4028
4029                 $member->isAdmin() or self::disallow();
4030
4031                 $skinid = intRequestVar('skinid');
4032
4033                 // don't allow default skin to be deleted
4034                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
4035                 {
4036                         self::error(_ERROR_DEFAULTSKIN);
4037                         return;
4038                 }
4039
4040                 /* don't allow if someone use it as a default*/
4041                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4042                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4043
4044                 $members = array();
4045                 while ( $row = $res->fetch() ) {
4046                         $members[] = $row['mrealname'];
4047                 }
4048                 if ( count($members) )
4049                 {
4050                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4051                         return;
4052                 }
4053
4054                 self::skindeleteconfirm($skinid);
4055
4056                 self::action_adminskinoverview();
4057                 return;
4058         }
4059
4060         /**
4061          * Admin::action_adminskinremovetype()
4062          *
4063          * @param       void
4064          * @return      void
4065          */
4066         static private function action_adminskinremovetype()
4067         {
4068                 global $member, $CONF;
4069
4070                 $member->isAdmin() or self::disallow();
4071
4072                 $skinid = intRequestVar('skinid');
4073                 $skintype = requestVar('type');
4074
4075                 if ( !isValidShortName($skintype) )
4076                 {
4077                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4078                         return;
4079                 }
4080
4081                 self::$skin->parse('adminskinremovetype');
4082                 return;
4083         }
4084
4085         /**
4086          * Admin::action_adminskinremovetypeconfirm()
4087          *
4088          * @param       void
4089          * @return      void
4090          */
4091         static private function action_adminskinremovetypeconfirm()
4092         {
4093                 global $member;
4094
4095                 $member->isAdmin() or self::disallow();
4096
4097                 $skinid = intRequestVar('skinid');
4098                 $skintype = requestVar('type');
4099
4100                 $error = self::skinremovetypeconfirm($skinid, $skintype);
4101                 if ( $error )
4102                 {
4103                         self::error($error);
4104                         return;
4105                 }
4106
4107                 self::action_adminskinedit();
4108                 return;
4109         }
4110
4111         /**
4112          * Admin::action_adminskinclone()
4113          *
4114          * @param       void
4115          * @return      void
4116          */
4117         static private function action_adminskinclone()
4118         {
4119                 global $member;
4120
4121                 $member->isAdmin() or self::disallow();
4122
4123                 $skinid = intRequestVar('skinid');
4124
4125                 self::skinclone($skinid, 'AdminActions');
4126
4127                 self::action_adminskinoverview();
4128                 return;
4129         }
4130
4131         /**
4132          * Admin::action_adminskinieoverview()
4133          *
4134          * @param       void
4135          * @return      void
4136          */
4137         static private function action_adminskinieoverview()
4138         {
4139                 global $member;
4140
4141                 $member->isAdmin() or self::disallow();
4142
4143                 self::$skin->parse('adminskinieoverview');
4144                 return;
4145         }
4146
4147         /**
4148          * Admin::action_adminskinieimport()
4149          *
4150          * @param       void
4151          * @return      void
4152          */
4153         static private function action_adminskinieimport()
4154         {
4155                 global $member;
4156
4157                 $member->isAdmin() or self::disallow();
4158
4159                 $skinFileRaw = postVar('skinfile');
4160                 $mode = postVar('mode');
4161
4162                 $error = self::skinieimport($mode, $skinFileRaw);
4163                 if ( $error )
4164                 {
4165                         self::error($error);
4166                         return;
4167                 }
4168
4169                 if ( !is_object(self::$skin) )
4170                 {
4171                         self::action_adminskiniedoimport();
4172                 }
4173                 else
4174                 {
4175                         self::$skin->parse('adminskinieimport');
4176                 }
4177                 return;
4178         }
4179
4180         /**
4181          * Admin::action_adminskiniedoimport()
4182          *
4183          * @param       void
4184          * @return      void
4185          */
4186         static private function action_adminskiniedoimport()
4187         {
4188                 global $DIR_SKINS, $member;
4189
4190                 $member->isAdmin() or self::disallow();
4191
4192                 $mode = postVar('mode');
4193                 $skinFileRaw = postVar('skinfile');
4194                 $allowOverwrite = intPostVar('overwrite');
4195
4196                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
4197                 if ( $error )
4198                 {
4199                         self::error($error);
4200                         return;
4201                 }
4202
4203                 if ( !is_object(self::$skin) )
4204                 {
4205                         global $DIR_SKINS;
4206                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";
4207                         $query  = sprintf($query, sql_table('skin_desc'));
4208                         $res    = intval(DB::getValue($query));
4209                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";
4210                         $query  = sprintf($query, sql_table('config'), $res);
4211                         DB::execute($query);
4212                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');
4213                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');
4214                 }
4215                 else
4216                 {
4217                         self::$skin->parse('adminskiniedoimport');
4218                 }
4219                 return;
4220         }
4221
4222         /**
4223          * Admin::action_adminskinieexport()
4224          *
4225          * @param       void
4226          * @return      void
4227          */
4228         static private function action_adminskinieexport()
4229         {
4230                 global $member;
4231
4232                 $member->isAdmin() or self::disallow();
4233
4234                 // load skinie class
4235                 $aSkins = requestIntArray('skin');
4236                 $aTemplates = requestIntArray('template');
4237                 $info = postVar('info');
4238
4239                 self::skinieexport($aSkins, $aTemplates, $info);
4240
4241                 return;
4242         }
4243
4244         /**
4245          * Admin::action_settingsedit()
4246          *
4247          * @param       Void
4248          * @return      Void
4249          */
4250         static private function action_settingsedit()
4251         {
4252                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4253
4254                 $member->isAdmin() or self::disallow();
4255
4256                 self::$skin->parse('settingsedit');
4257                 return;
4258         }
4259
4260         /**
4261          * Admin::action_settingsupdate()
4262          * Update $CONFIG and redirect
4263          *
4264          * @param       void
4265          * @return      void
4266          */
4267         static private function action_settingsupdate()
4268         {
4269                 global $member, $CONF;
4270
4271                 $member->isAdmin() or self::disallow();
4272
4273                 // check if email address for admin is valid
4274                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
4275                 {
4276                         self::error(_ERROR_BADMAILADDRESS);
4277                         return;
4278                 }
4279
4280                 // save settings
4281                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));
4282                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));
4283                 self::updateConfig('IndexURL',                  postVar('IndexURL'));
4284                 self::updateConfig('AdminURL',                  postVar('AdminURL'));
4285                 self::updateConfig('PluginURL',                 postVar('PluginURL'));
4286                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));
4287                 self::updateConfig('ActionURL',                 postVar('ActionURL'));
4288                 self::updateConfig('Locale',                    postVar('Locale'));
4289                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));
4290                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));
4291                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));
4292                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));
4293                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));
4294                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));
4295                 self::updateConfig('SiteName',                  postVar('SiteName'));
4296                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));
4297                 self::updateConfig('DisableSite',               postVar('DisableSite'));
4298                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));
4299                 self::updateConfig('LastVisit',                 postVar('LastVisit'));
4300                 self::updateConfig('MediaURL',                  postVar('MediaURL'));
4301                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));
4302                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));
4303                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));
4304                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));
4305                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));
4306                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));
4307                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));
4308                 self::updateConfig('CookiePath',                postVar('CookiePath'));
4309                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));
4310                 self::updateConfig('URLMode',                   postVar('URLMode'));
4311                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));
4312                 self::updateConfig('DebugVars',                 postVar('DebugVars'));
4313                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));
4314                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));
4315                 self::updateConfig('AdminSkin',                 postVar('adminskin'));
4316                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));
4317
4318                 // load new config and redirect (this way, the new locale will be used is necessary)
4319                 // note that when changing cookie settings, this redirect might cause the user
4320                 // to have to log in again.
4321                 getConfig();
4322                 redirect($CONF['AdminURL'] . '?action=manage');
4323                 return;
4324         }
4325
4326         /**
4327          * Admin::action_systemoverview()
4328          * Output system overview
4329          *
4330          * @param       void
4331          * @return      void
4332          */
4333         static private function action_systemoverview()
4334         {
4335                 self::$skin->parse('systemoverview');
4336                 return;
4337         }
4338
4339         /**
4340          * Admin::updateConfig()
4341          *
4342          * @param       string  $name
4343          * @param       string  $val
4344          * @return      integer return the ID in which the latest query posted
4345          */
4346         static private function updateConfig($name, $val)
4347         {
4348                 $query = "UPDATE %s SET value=%s WHERE name=%s";
4349                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));
4350                 if ( DB::execute($query) === FALSE )
4351                 {
4352                         $err = DB::getError();
4353                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
4354                 }
4355                 return DB::getInsertId();
4356         }
4357
4358         /**
4359          * Admin::error()
4360          * Error message
4361          *
4362          * @param       string  $msg    message that will be shown
4363          * @return      void
4364          */
4365         static public function error($msg)
4366         {
4367                 self::$headMess = $msg;
4368                 self::$skin->parse('adminerrorpage');
4369                 return;
4370         }
4371
4372         /**
4373          * Admin::disallow()
4374          * add error log and show error page
4375          *
4376          * @param       void
4377          * @return      void
4378          */
4379         static public function disallow()
4380         {
4381                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4382                 self::error(_ERROR_DISALLOWED);
4383                 return;
4384         }
4385
4386         /**
4387          * Admin::action_PluginAdmin()
4388          * Output pluginadmin
4389          *
4390          * @param       string  $skinContents
4391          * @param       string  $extrahead
4392          * @return      void
4393          */
4394         static public function action_PluginAdmin($skinContents, $extrahead = '')
4395         {
4396                 self::$extrahead .= $extrahead;
4397                 self::$skin->parse('pluginadmin', $skinContents);
4398                 return;
4399         }
4400
4401         /**
4402          * Admin::action_bookmarklet()
4403          *
4404          * @param       void
4405          * @return      void
4406          */
4407         static private function action_bookmarklet()
4408         {
4409                 global $member, $manager;
4410
4411                 $blogid = intRequestVar('blogid');
4412                 $member->teamRights($blogid) or self::disallow();
4413
4414                 self::$skin->parse('bookmarklet');
4415                 return;
4416         }
4417
4418         /**
4419          * Admin::action_actionlog()
4420          *
4421          * @param       void
4422          * @return      void
4423          */
4424         static private function action_actionlog()
4425         {
4426                 global $member, $manager;
4427
4428                 $member->isAdmin() or self::disallow();
4429
4430                 self::$skin->parse('actionlog');
4431                 return;
4432         }
4433
4434         /**
4435          * Admin::action_banlist()
4436          *
4437          * @param       void
4438          * @return      void
4439          */
4440         static private function action_banlist()
4441         {
4442                 global $member, $manager;
4443
4444                 $blogid = intRequestVar('blogid');
4445                 $member->blogAdminRights($blogid) or self::disallow();
4446
4447                 self::$skin->parse('banlist');
4448                 return;
4449         }
4450
4451         /**
4452          * Admin::action_banlistdelete()
4453          *
4454          * @param       void
4455          * @return      void
4456          */
4457         static private function action_banlistdelete()
4458         {
4459                 global $member, $manager;
4460
4461                 $blogid = intRequestVar('blogid');
4462                 $member->blogAdminRights($blogid) or self::disallow();
4463
4464                 self::$skin->parse('banlistdelete');
4465                 return;
4466         }
4467
4468         /**
4469          * Admin::action_banlistdeleteconfirm()
4470          *
4471          * @param       void
4472          * @return      void
4473          */
4474         static private function action_banlistdeleteconfirm()
4475         {
4476                 global $member, $manager;
4477
4478                 $blogid         = intPostVar('blogid');
4479                 $allblogs       = postVar('allblogs');
4480                 $iprange        = postVar('iprange');
4481
4482                 $member->blogAdminRights($blogid) or self::disallow();
4483
4484                 $deleted = array();
4485
4486                 if ( !$allblogs )
4487                 {
4488                         if ( Ban::removeBan($blogid, $iprange) )
4489                         {
4490                                 $deleted[] = $blogid;
4491                         }
4492                 }
4493                 else
4494                 {
4495                         // get blogs fot which member has admin rights
4496                         $adminblogs = $member->getAdminBlogs();
4497                         foreach ($adminblogs as $blogje)
4498                         {
4499                                 if ( Ban::removeBan($blogje, $iprange) )
4500                                 {
4501                                         $deleted[] = $blogje;
4502                                 }
4503                         }
4504                 }
4505
4506                 if ( sizeof($deleted) == 0 )
4507                 {
4508                         self::error(_ERROR_DELETEBAN);
4509                         return;
4510                 }
4511
4512                 /* TODO: we should use other ways */
4513                 $_REQUEST['delblogs'] = $deleted;
4514
4515                 self::$skin->parse('banlistdeleteconfirm');
4516                 return;
4517         }
4518
4519         /**
4520          * Admin::action_banlistnewfromitem()
4521          *
4522          * @param       void
4523          * @return      void
4524          */
4525         static private function action_banlistnewfromitem()
4526         {
4527                 global $manager;
4528
4529                 $itemid = intRequestVar('itemid');
4530                 $item =& $manager->getItem($itemid, 1, 1);
4531                 self::action_banlistnew($item['blogid']);
4532                 return;
4533         }
4534
4535         /**
4536          * Admin::action_banlistnew()
4537          *
4538          * @param       integer $blogid ID for weblog
4539          * @return      void
4540          */
4541         static private function action_banlistnew($blogid = '')
4542         {
4543                 global $member, $manager;
4544
4545                 if ( $blogid == '' )
4546                 {
4547                         $blogid = intRequestVar('blogid');
4548                 }
4549
4550                 $ip = requestVar('ip');
4551
4552                 $member->blogAdminRights($blogid) or self::disallow();
4553
4554                 /* TODO: we should consider to use the other way instead of this */
4555                 $_REQUEST['blogid'] = $blogid;
4556
4557                 self::$skin->parse('banlistnew');
4558
4559                 return;
4560         }
4561
4562         /**
4563          * Admin::action_banlistadd()
4564          *
4565          * @param       void
4566          * @return      void
4567          */
4568         static private function action_banlistadd()
4569         {
4570                 global $member;
4571
4572                 $blogid         = intPostVar('blogid');
4573                 $allblogs       = postVar('allblogs');
4574                 $iprange        = postVar('iprange');
4575
4576                 if ( $iprange == "custom" )
4577                 {
4578                         $iprange = postVar('customiprange');
4579                 }
4580                 $reason   = postVar('reason');
4581
4582                 $member->blogAdminRights($blogid) or self::disallow();
4583
4584                 // TODO: check IP range validity
4585
4586                 if ( !$allblogs )
4587                 {
4588                         if ( !Ban::addBan($blogid, $iprange, $reason) )
4589                         {
4590                                 self::error(_ERROR_ADDBAN);
4591                                 return;
4592                         }
4593                 }
4594                 else
4595                 {
4596                         // get blogs fot which member has admin rights
4597                         $adminblogs = $member->getAdminBlogs();
4598                         $failed = 0;
4599                         foreach ($adminblogs as $blogje)
4600                         {
4601                                 if ( !Ban::addBan($blogje, $iprange, $reason) )
4602                                 {
4603                                         $failed = 1;
4604                                 }
4605                         }
4606                         if ( $failed )
4607                         {
4608                                 self::error(_ERROR_ADDBAN);
4609                                 return;
4610                         }
4611                 }
4612                 self::action_banlist();
4613                 return;
4614         }
4615
4616         /**
4617          * Admin::action_clearactionlog()
4618          *
4619          * @param       void
4620          * @return      void
4621          */
4622         static private function action_clearactionlog()
4623         {
4624                 global $member;
4625
4626                 $member->isAdmin() or self::disallow();
4627
4628                 ActionLog::clear();
4629
4630                 self::action_manage(_MSG_ACTIONLOGCLEARED);
4631                 return;
4632         }
4633
4634         /**
4635          * Admin::action_backupoverview()
4636          *
4637          * @param       void
4638          * @return      void
4639          */
4640         static private function action_backupoverview()
4641         {
4642                 global $member, $manager;
4643
4644                 $member->isAdmin() or self::disallow();
4645
4646                 self::$skin->parse('backupoverview');
4647                 return;
4648         }
4649
4650         /**
4651          * Admin::action_backupcreate()
4652          * create file for backup
4653          *
4654          * @param               void
4655          * @return      void
4656          *
4657          */
4658         static private function action_backupcreate()
4659         {
4660                 global $member, $DIR_LIBS;
4661
4662                 $member->isAdmin() or self::disallow();
4663
4664                 // use compression ?
4665                 $useGzip = (integer) postVar('gzip');
4666
4667                 include($DIR_LIBS . 'backup.php');
4668
4669                 // try to extend time limit
4670                 // (creating/restoring dumps might take a while)
4671                 @set_time_limit(1200);
4672
4673                 Backup::do_backup($useGzip);
4674                 return;
4675         }
4676
4677         /**
4678          * Admin::action_backuprestore()
4679          * restoring from uploaded file
4680          *
4681          * @param               void
4682          * @return      void
4683          */
4684         static private function action_backuprestore()
4685         {
4686                 global $member, $DIR_LIBS;
4687
4688                 $member->isAdmin() or self::disallow();
4689
4690                 if ( intPostVar('letsgo') != 1 )
4691                 {
4692                         self::error(_ERROR_BACKUP_NOTSURE);
4693                         return;
4694                 }
4695
4696                 include($DIR_LIBS . 'backup.php');
4697
4698                 // try to extend time limit
4699                 // (creating/restoring dumps might take a while)
4700                 @set_time_limit(1200);
4701
4702                 $message = Backup::do_restore();
4703                 if ( $message != '' )
4704                 {
4705                         self::error($message);
4706                         return;
4707                 }
4708                 self::$skin->parse('backuprestore');
4709                 return;
4710         }
4711
4712         /**
4713          * Admin::action_pluginlist()
4714          * output the list of installed plugins
4715          *
4716          * @param       void
4717          * @return      void
4718          *
4719          */
4720         static private function action_pluginlist()
4721         {
4722                 global $DIR_PLUGINS, $member, $manager;
4723
4724                 // check if allowed
4725                 $member->isAdmin() or self::disallow();
4726
4727                 self::$skin->parse('pluginlist');
4728                 return;
4729         }
4730
4731         /**
4732          * Admin::action_pluginhelp()
4733          *
4734          * @param       void
4735          * @return      void
4736          */
4737         static private function action_pluginhelp()
4738         {
4739                 global $member, $manager, $DIR_PLUGINS, $CONF;
4740
4741                 // check if allowed
4742                 $member->isAdmin() or self::disallow();
4743
4744                 $plugid = intGetVar('plugid');
4745
4746                 if ( !$manager->pidInstalled($plugid) )
4747                 {
4748                         self::error(_ERROR_NOSUCHPLUGIN);
4749                         return;
4750                 }
4751
4752                 self::$skin->parse('pluginhelp');
4753                 return;
4754         }
4755
4756         /**
4757          * Admin::action_pluginadd()
4758          *
4759          * @param       Void
4760          * @return      Void
4761          *
4762          */
4763         static private function action_pluginadd()
4764         {
4765                 global $member, $manager, $DIR_PLUGINS;
4766
4767                 // check if allowed
4768                 $member->isAdmin() or self::disallow();
4769
4770                 $name = postVar('filename');
4771
4772                 if ( $manager->pluginInstalled($name) )
4773                 {
4774                         self::error(_ERROR_DUPPLUGIN);
4775                         return;
4776                 }
4777
4778                 if ( !checkPlugin($name) )
4779                 {
4780                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
4781                         return;
4782                 }
4783
4784                 // get number of currently installed plugins
4785                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
4786                 $numCurrent = $res->rowCount();
4787
4788                 // plugin will be added as last one in the list
4789                 $newOrder = $numCurrent + 1;
4790
4791                 $data = array('file' => &$name);
4792                 $manager->notify('PreAddPlugin', $data);
4793
4794                 // do this before calling getPlugin (in case the plugin id is used there)
4795                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";
4796                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));
4797                 DB::execute($query);
4798                 $iPid = DB::getInsertId();
4799
4800                 $manager->clearCachedInfo('installedPlugins');
4801
4802                 // Load the plugin for condition checking and instalation
4803                 $plugin =& $manager->getPlugin($name);
4804
4805                 // check if it got loaded (could have failed)
4806                 if ( !$plugin )
4807                 {
4808                         $query = "DELETE FROM %s WHERE pid=%d;";
4809                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);
4810
4811                         DB::execute($query);
4812
4813                         $manager->clearCachedInfo('installedPlugins');
4814                         self::error(_ERROR_PLUGIN_LOAD);
4815                         return;
4816                 }
4817
4818                 // check if plugin needs a newer Nucleus version
4819                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
4820                 {
4821                         // uninstall plugin again...
4822                         self::deleteOnePlugin($plugin->getID());
4823
4824                         // ...and show error
4825                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
4826                         return;
4827                 }
4828
4829                 // check if plugin needs a newer Nucleus version
4830                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
4831                 {
4832                         // uninstall plugin again...
4833                         self::deleteOnePlugin($plugin->getID());
4834
4835                         // ...and show error
4836                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
4837                         return;
4838                 }
4839
4840                 $pluginList = $plugin->getPluginDep();
4841                 foreach ( $pluginList as $pluginName )
4842                 {
4843                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));
4844                         if ($res->rowCount() == 0)
4845                         {
4846                                 // uninstall plugin again...
4847                                 self::deleteOnePlugin($plugin->getID());
4848                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
4849                                 return;
4850                         }
4851                 }
4852
4853                 // call the install method of the plugin
4854                 $plugin->install();
4855
4856                 $data = array('plugin' => &$plugin);
4857                 $manager->notify('PostAddPlugin', $data);
4858
4859                 // update all events
4860                 self::action_pluginupdate();
4861                 return;
4862         }
4863
4864         /**
4865          * ADMIN:action_pluginupdate():
4866          *
4867          * @param       Void
4868          * @return      Void
4869          *
4870          */
4871         static private function action_pluginupdate()
4872         {
4873                 global $member, $manager, $CONF;
4874
4875                 // check if allowed
4876                 $member->isAdmin() or self::disallow();
4877
4878                 // delete everything from plugin_events
4879                 DB::execute('DELETE FROM '.sql_table('plugin_event'));
4880
4881                 // loop over all installed plugins
4882                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));
4883                 foreach ( $res as $row )
4884                 {
4885                         $pid  =  $row['pid'];
4886                         $plug =& $manager->getPlugin($row['pfile']);
4887                         if ( $plug )
4888                         {
4889                                 $eventList = $plug->getEventList();
4890                                 foreach ( $eventList as $eventName )
4891                                 {
4892                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";
4893                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));
4894                                         DB::execute($query);
4895                                 }
4896                         }
4897                 }
4898                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4899                 return;
4900         }
4901
4902         /**
4903          * Admin::action_plugindelete()
4904          *
4905          * @param       void
4906          * @return      void
4907          */
4908         static private function action_plugindelete()
4909         {
4910                 global $member, $manager;
4911
4912                 // check if allowed
4913                 $member->isAdmin() or self::disallow();
4914
4915                 $pid = intGetVar('plugid');
4916
4917                 if ( !$manager->pidInstalled($pid) )
4918                 {
4919                         self::error(_ERROR_NOSUCHPLUGIN);
4920                         return;
4921                 }
4922
4923                 self::$skin->parse('plugindelete');
4924                 return;
4925         }
4926
4927         /**
4928          * Admin::action_plugindeleteconfirm()
4929          *
4930          * @param       void
4931          * @return      void
4932          */
4933         static private function action_plugindeleteconfirm()
4934         {
4935                 global $member, $manager, $CONF;
4936
4937                 // check if allowed
4938                 $member->isAdmin() or self::disallow();
4939
4940                 $pid = intPostVar('plugid');
4941
4942                 $error = self::deleteOnePlugin($pid, 1);
4943                 if ( $error )
4944                 {
4945                         self::error($error);
4946                         return;
4947                 }
4948
4949                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4950                 return;
4951         }
4952
4953         /**
4954          * Admin::deleteOnePlugin()
4955          *
4956          * @param       integer $pid
4957          * @param       boolean $callUninstall
4958          * @return      string  empty or message if failed
4959          */
4960         static public function deleteOnePlugin($pid, $callUninstall = 0)
4961         {
4962                 global $manager;
4963
4964                 $pid = intval($pid);
4965
4966                 if ( !$manager->pidInstalled($pid) )
4967                 {
4968                         return _ERROR_NOSUCHPLUGIN;
4969                 }
4970
4971                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";
4972                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);
4973                 $name = DB::getValue($query);
4974
4975                 // check dependency before delete
4976                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));
4977                 foreach ( $res as $row )
4978                 {
4979                         $plug =& $manager->getPlugin($row['pfile']);
4980                         if ( $plug )
4981                         {
4982                                 $depList = $plug->getPluginDep();
4983                                 foreach ( $depList as $depName )
4984                                 {
4985                                         if ( $name == $depName )
4986                                         {
4987                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);
4988                                         }
4989                                 }
4990                         }
4991                 }
4992
4993                 $data = array('plugid' => $pid);
4994                 $manager->notify('PreDeletePlugin', $data);
4995
4996                 // call the unInstall method of the plugin
4997                 if ( $callUninstall )
4998                 {
4999                         $plugin =& $manager->getPlugin($name);
5000                         if ( $plugin )
5001                         {
5002                                 $plugin->unInstall();
5003                         }
5004                 }
5005
5006                 // delete all subscriptions
5007                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);
5008
5009                 // delete all options
5010                 // get OIDs from plugin_option_desc
5011                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5012                 $aOIDs = array();
5013                 foreach ( $res as $row )
5014                 {
5015                         array_push($aOIDs, $row['oid']);
5016                 }
5017
5018                 // delete from plugin_option and plugin_option_desc
5019                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5020                 if (count($aOIDs) > 0)
5021                 {
5022                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');
5023                 }
5024
5025                 // update order numbers
5026                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5027                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);
5028
5029                 // delete row
5030                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5031
5032                 $manager->clearCachedInfo('installedPlugins');
5033                 $data = array('plugid' => $pid);
5034                 $manager->notify('PostDeletePlugin', $data);
5035
5036                 return '';
5037         }
5038
5039         /**
5040          * Admin::action_pluginup()
5041          *
5042          * @param       void
5043          * @return      void
5044          */
5045         static private function action_pluginup()
5046         {
5047                 global $member, $manager, $CONF;
5048
5049                 // check if allowed
5050                 $member->isAdmin() or self::disallow();
5051
5052                 $plugid = intGetVar('plugid');
5053
5054                 if ( !$manager->pidInstalled($plugid) )
5055                 {
5056                         self::error(_ERROR_NOSUCHPLUGIN);
5057                         return;
5058                 }
5059
5060                 // 1. get old order number
5061                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5062
5063                 // 2. calculate new order number
5064                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5065
5066                 // 3. update plug numbers
5067                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5068                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5069
5070                 //self::action_pluginlist();
5071                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5072                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5073                 return;
5074         }
5075
5076         /**
5077          * Admin::action_plugindown()
5078          *
5079          * @param       void
5080          * @return      void
5081          */
5082         static private function action_plugindown()
5083         {
5084                 global $member, $manager, $CONF;
5085
5086                 // check if allowed
5087                 $member->isAdmin() or self::disallow();
5088
5089                 $plugid = intGetVar('plugid');
5090                 if ( !$manager->pidInstalled($plugid) )
5091                 {
5092                         self::error(_ERROR_NOSUCHPLUGIN);
5093                         return;
5094                 }
5095
5096                 // 1. get old order number
5097                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5098
5099                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
5100                 $maxOrder = $res->rowCount();
5101
5102                 // 2. calculate new order number
5103                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
5104
5105                 // 3. update plug numbers
5106                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5107                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5108
5109                 //self::action_pluginlist();
5110                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5111                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5112                 return;
5113         }
5114
5115         /**
5116          * Admin::action_pluginoptions()
5117          *
5118          * Output Plugin option page
5119          *
5120          * @access      public
5121          * @param       string $message message when fallbacked
5122          * @return      void
5123          *
5124          */
5125         static private function action_pluginoptions($message = '')
5126         {
5127                 global $member, $manager;
5128
5129                 // check if allowed
5130                 $member->isAdmin() or self::disallow();
5131
5132                 $pid = intRequestVar('plugid');
5133                 if ( !$manager->pidInstalled($pid) )
5134                 {
5135                         self::error(_ERROR_NOSUCHPLUGIN);
5136                         return;
5137                 }
5138
5139                 if ( isset($message) )
5140                 {
5141                         self::$headMess = $message;
5142                 }
5143                 $plugname       = $manager->getPluginNameFromPid($pid);
5144                 $plugin         = $manager->getPlugin($plugname);
5145                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
5146
5147                 self::$skin->parse('pluginoptions');
5148                 return;
5149         }
5150
5151         /**
5152          * Admin::action_pluginoptionsupdate()
5153          *
5154          * Update plugin options and fallback to plugin option page
5155          *
5156          * @access      public
5157          * @param       void
5158          * @return      void
5159          */
5160         static private function action_pluginoptionsupdate()
5161         {
5162                 global $member, $manager;
5163
5164                 // check if allowed
5165                 $member->isAdmin() or self::disallow();
5166
5167                 $pid = intRequestVar('plugid');
5168
5169                 if ( !$manager->pidInstalled($pid) )
5170                 {
5171                         self::error(_ERROR_NOSUCHPLUGIN);
5172                         return;
5173                 }
5174
5175                 $aOptions = requestArray('plugoption');
5176                 NucleusPlugin::apply_plugin_options($aOptions);
5177
5178                 $data = array(
5179                         'context'       => 'global',
5180                         'plugid'        => $pid
5181                 );
5182                 $manager->notify('PostPluginOptionsUpdate', $data);
5183
5184                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
5185                 return;
5186         }
5187
5188         /**
5189          * Admin::skineditgeneral()
5190          *
5191          * @param       integer $skinid
5192          * @param       string  $handler
5193          * @return      string  empty or message if failed
5194          */
5195         static private function skineditgeneral($skinid, $handler='')
5196         {
5197                 global $manager;
5198
5199                 $name = postVar('name');
5200                 $desc = postVar('desc');
5201                 $type = postVar('type');
5202                 $inc_mode = postVar('inc_mode');
5203                 $inc_prefix = postVar('inc_prefix');
5204
5205                 $skin =& $manager->getSkin($skinid, $handler);
5206
5207                 // 1. Some checks
5208                 if ( !isValidSkinName($name) )
5209                 {
5210                         return _ERROR_BADSKINNAME;
5211                 }
5212
5213                 if ( ($skin->getName() != $name) && SKIN::exists($name) )
5214                 {
5215                         return _ERROR_DUPSKINNAME;
5216                 }
5217
5218                 if ( !$type )
5219                 {
5220                         $type = 'text/html';
5221                 }
5222
5223                 if ( !$inc_mode )
5224                 {
5225                         $inc_mode = 'normal';
5226                 }
5227
5228                 // 2. Update description
5229                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
5230
5231                 return '';
5232         }
5233         /**
5234          * Admin::skindeleteconfirm()
5235          *
5236          * @param       integer $skinid
5237          * @return      void
5238          */
5239         static private function skindeleteconfirm($skinid)
5240         {
5241                 global $manager;
5242
5243                 if ( !in_array(self::$action, self::$adminskin_actions) )
5244                 {
5245                         $event_identifier = 'Skin';
5246                 }
5247                 else
5248                 {
5249                         $event_identifier = 'AdminSkin';
5250                 }
5251
5252                 $data = array('skinid' => $skinid);
5253                 $manager->notify("PreDelete{$event_identifier}", $data);
5254
5255                 // 1. delete description
5256                 $query = "DELETE FROM %s WHERE sdnumber=%d;";
5257                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);
5258                 DB::execute($query);
5259
5260                 // 2. delete parts
5261                 $query = "DELETE FROM %s WHERE sdesc=%d;";
5262                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5263                 DB::execute($query);
5264
5265                 $manager->notify("PostDelete{$event_identifier}", $data);
5266
5267                 return;
5268         }
5269
5270         /**
5271          * Admin::skinremovetypeconfirm()
5272          *
5273          * @param       integer $skinid
5274          * @param       string  $skintype
5275          * @return      string  empty or message if failed
5276          */
5277         static private function skinremovetypeconfirm($skinid, $skintype)
5278         {
5279                 global $manager;
5280
5281                 if ( !in_array(self::$action, self::$adminskin_actions) )
5282                 {
5283                         $event_identifier = 'Skin';
5284                 }
5285                 else
5286                 {
5287                         $event_identifier = 'AdminSkin';
5288                 }
5289
5290                 if ( !isValidShortName($skintype) )
5291                 {
5292                         return _ERROR_SKIN_PARTS_SPECIAL_DELETE;
5293                 }
5294
5295                 $data = array(
5296                         'skinid'        => $skinid,
5297                         'skintype'      => $skintype
5298                 );
5299                 $manager->notify("PreDelete{$event_identifier}Part", $data);
5300
5301                 // delete part
5302                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s;';
5303                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );
5304                 DB::execute($query);
5305
5306                 $data = array(
5307                         'skinid'        => $skinid,
5308                         'skintype'      => $skintype
5309                 );
5310                 $manager->notify("PostDelete{$event_identifier}Part", $data);
5311
5312                 return '';
5313         }
5314
5315         /**
5316          * Admin::skinclone()
5317          *
5318          * @param       integer $skinid
5319          * @param       string  $handler
5320          * @return      void
5321          */
5322         static private function skinclone($skinid, $handler='')
5323         {
5324                 global $manager;
5325
5326                 // 1. read skin to clone
5327                 $skin =& $manager->getSkin($skinid, $handler);
5328                 $name = "{$skin->getName()}_clone";
5329
5330                 // if a skin with that name already exists:
5331                 if ( Skin::exists($name) )
5332                 {
5333                         $i = 1;
5334                         while ( Skin::exists($name . $i) )
5335                         {
5336                                 $i++;
5337                         }
5338                         $name .= $i;
5339                 }
5340
5341                 // 2. create skin desc
5342                 $newid = Skin::createNew(
5343                         $name,
5344                         $skin->getDescription(),
5345                         $skin->getContentType(),
5346                         $skin->getIncludeMode(),
5347                         $skin->getIncludePrefix()
5348                 );
5349
5350                 // 3. clone
5351                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";
5352                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5353
5354                 $res = DB::getResult($query);
5355                 foreach ( $res as $row )
5356                 {
5357                         $content = $skin->getContentFromDB($row['stype']);
5358                         if ( $content )
5359                         {
5360                                 $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";
5361                                 $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($row['stype']));
5362                                 DB::execute($query);
5363                         }
5364                 }
5365                 return;
5366         }
5367
5368         /**
5369          * Admin::skinieimport()
5370          *
5371          * @param       string  $mode
5372          * @param       string  $skinFileRaw
5373          * @return      string  empty or message if failed
5374          */
5375         static private function skinieimport($mode, $skinFileRaw)
5376         {
5377                 global $DIR_LIBS, $DIR_SKINS;
5378
5379                 // load skinie class
5380                 include_once($DIR_LIBS . 'skinie.php');
5381
5382                 $importer = new SkinImport();
5383
5384                 // get full filename
5385                 if ( $mode == 'file' )
5386                 {
5387                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5388                 }
5389                 else
5390                 {
5391                         $skinFile = $skinFileRaw;
5392                 }
5393
5394                 // read only metadata
5395                 $error = $importer->readFile($skinFile, 1);
5396                 if ( $error )
5397                 {
5398                         unset($importer);
5399                         return $error;
5400                 }
5401
5402                 self::$contents['mode']         = $mode;
5403                 self::$contents['skinfile']     = $skinFileRaw;
5404                 self::$contents['skininfo']     = $importer->getInfo();
5405                 self::$contents['skinnames']    = $importer->getSkinNames();
5406                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5407
5408                 // clashes
5409                 $skinNameClashes                = $importer->checkSkinNameClashes();
5410                 $templateNameClashes    = $importer->checkTemplateNameClashes();
5411                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
5412
5413                 self::$contents['skinclashes'] = $skinNameClashes;
5414                 self::$contents['tpltclashes'] = $templateNameClashes;
5415                 self::$contents['nameclashes'] = $hasNameClashes ? 1 : 0;
5416
5417                 unset($importer);
5418                 return '';
5419         }
5420
5421         /**
5422          * Admin::skinieedoimport()
5423          *
5424          * @param       string  $mode
5425          * @param       string  $skinFileRaw
5426          * @param       boolean $allowOverwrite
5427          * @return      string  empty   or message if failed
5428          */
5429         static private function skiniedoimport($mode, $skinFileRaw, $allowOverwrite)
5430         {
5431                 global $DIR_LIBS, $DIR_SKINS;
5432
5433                 // load skinie class
5434                 include_once($DIR_LIBS . 'skinie.php');
5435
5436                 $importer = new SkinImport();
5437
5438                 // get full filename
5439                 if ( $mode == 'file' )
5440                 {
5441                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5442                 }
5443                 else
5444                 {
5445                         $skinFile = $skinFileRaw;
5446                 }
5447
5448                 $error = $importer->readFile($skinFile);
5449                 if ( $error )
5450                 {
5451                         unset($importer);
5452                         return $error;
5453                 }
5454
5455                 $error = $importer->writeToDatabase($allowOverwrite);
5456                 if ( $error )
5457                 {
5458                         unset($importer);
5459                         return $error;
5460                 }
5461
5462                 self::$contents['mode']         = $mode;
5463                 self::$contents['skinfile']     = $skinFileRaw;
5464                 self::$contents['skininfo']     = $importer->getInfo();
5465                 self::$contents['skinnames']    = $importer->getSkinNames();
5466                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5467
5468                 unset($importer);
5469                 return '';
5470         }
5471
5472         /**
5473          * Admin::skinieexport()
5474          *
5475          * @param       array   $aSkins
5476          * @param       array   $aTemplates
5477          * @param       string  $info
5478          * @return      void
5479          */
5480         static private function skinieexport($aSkins, $aTemplates, $info)
5481         {
5482                 global $DIR_LIBS;
5483
5484                 // load skinie class
5485                 include_once($DIR_LIBS . 'skinie.php');
5486
5487                 if ( !is_array($aSkins) )
5488                 {
5489                         $aSkins = array();
5490                 }
5491
5492                 if (!is_array($aTemplates))
5493                 {
5494                         $aTemplates = array();
5495                 }
5496
5497                 $skinList = array_keys($aSkins);
5498                 $templateList = array_keys($aTemplates);
5499
5500                 $exporter = new SkinExport();
5501                 foreach ( $skinList as $skinId )
5502                 {
5503                         $exporter->addSkin($skinId);
5504                 }
5505                 foreach ( $templateList as $templateId )
5506                 {
5507                         $exporter->addTemplate($templateId);
5508                 }
5509                 $exporter->setInfo($info);
5510                 $exporter->export();
5511
5512                 return;
5513         }
5514
5515         /**
5516          * Admin::action_parseSpecialskin()
5517          *
5518          * @param       void
5519          * @return      void
5520          */
5521         static private function action_parseSpecialskin()
5522         {
5523                 self::$skin->parse(self::$action);
5524                 return;
5525         }
5526 }