nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static private $action;\r
  31         static private $skin;\r
  32         static private $extrahead;\r
  33         static private $passvar;\r
  34         static private $headMess;\r
  35         static private $aOptions;\r
  36         \r
  37         /**\r
  38          * Admin::$edit_actions\r
  39          */\r
  40         static private $edit_actions = array(\r
  41                 'adminskinoverview',\r
  42                 'adminskinieoverview',\r
  43                 'adminskinedittype',\r
  44                 'adminskinremovetype',\r
  45                 'adminskindelete',\r
  46                 'adminskinedit',\r
  47                 'adminskinieimport',\r
  48                 'adminskiniedoimport',\r
  49                 'admintemplateedit',\r
  50                 'admintemplateoverview',\r
  51                 'admintemplatedelete'\r
  52         );\r
  53         \r
  54         /**\r
  55          * Admin::$skinless_actions\r
  56          */\r
  57         static private $skinless_actions = array(\r
  58                 'plugindeleteconfirm',\r
  59                 'pluginoptionsupdate',\r
  60                 'skinremovetypeconfirm',\r
  61                 'skinclone',\r
  62                 'skindeleteconfirm',\r
  63                 'skinnew',\r
  64                 'skineditgeneral',\r
  65                 'skinieexport',\r
  66                 'skinupdate',\r
  67                 'templateupdate',\r
  68                 'templatedeleteconfirm',\r
  69                 'templatenew',\r
  70                 'templateclone',\r
  71                 'adminskinremovetypeconfirm',\r
  72                 'adminskinclone',\r
  73                 'adminskindeleteconfirm',\r
  74                 'adminskinnew',\r
  75                 'adminskineditgeneral',\r
  76                 'adminskinieexport',\r
  77                 'adminskinupdate',\r
  78                 'admintemplateupdate',\r
  79                 'admintemplatedeleteconfirm',\r
  80                 'admintemplatenew',\r
  81                 'admintemplateclone',\r
  82                 'blogsettingsupdate',\r
  83                 'settingsupdate',\r
  84                 'addnewlog2',\r
  85                 'additem',\r
  86                 'itemdeleteconfirm',\r
  87                 'itemupdate',\r
  88                 'changemembersettings',\r
  89                 'clearactionlog',\r
  90                 'memberedit'\r
  91         );\r
  92         \r
  93         static private $actions_needless_to_check = array(\r
  94                 'showlogin',\r
  95                 'login',\r
  96                 'overview',\r
  97                 'itemlist',\r
  98                 'blogcommentlist',\r
  99                 'bookmarklet',\r
 100                 'blogsettings',\r
 101                 'banlist',\r
 102                 'deleteblog',\r
 103                 'editmembersettings',\r
 104                 'browseownitems',\r
 105                 'browseowncomments',\r
 106                 'createitem',\r
 107                 'itemedit',\r
 108                 'itemmove',\r
 109                 'categoryedit',\r
 110                 'categorydelete',\r
 111                 'manage',\r
 112                 'actionlog',\r
 113                 'settingsedit',\r
 114                 'backupoverview',\r
 115                 'pluginlist',\r
 116                 'createnewlog',\r
 117                 'usermanagement',\r
 118                 'skinoverview',\r
 119                 'templateoverview',\r
 120                 'skinieoverview',\r
 121                 'itemcommentlist',\r
 122                 'commentedit',\r
 123                 'commentdelete',\r
 124                 'banlistnewfromitem',\r
 125                 'banlistdelete',\r
 126                 'itemdelete',\r
 127                 'manageteam',\r
 128                 'teamdelete',\r
 129                 'banlistnew',\r
 130                 'memberedit',\r
 131                 'memberdelete',\r
 132                 'pluginhelp',\r
 133                 'pluginoptions',\r
 134                 'plugindelete',\r
 135                 'skinedittype',\r
 136                 'skinremovetype',\r
 137                 'skindelete',\r
 138                 'skinedit',\r
 139                 'templateedit',\r
 140                 'templatedelete',\r
 141                 'activate',\r
 142                 'systemoverview',\r
 143                 'activatesetpwd',\r
 144         );\r
 145         \r
 146         static public function initialize()\r
 147         {\r
 148                 global $CONF;\r
 149                 \r
 150                 /* NOTE: 1. decide which skinid to use */\r
 151                 $skinid = $CONF['DefaultAdminSkin'];\r
 152                 /*\r
 153                  * NOTE: this is temporary escaped because not implemented yet\r
 154                 if (isset($member) && $member->isLoggedIn())\r
 155                 {\r
 156                         $memskin = $member->getAdminSkin();\r
 157                         if ( $memskin )\r
 158                         {\r
 159                                 $skinid = $memskin;\r
 160                         }\r
 161                 }\r
 162                 */\r
 163                 \r
 164                 /* NOTE: 2. make an instance of skin object */\r
 165                 if ( !Skin::existsID($skinid) )\r
 166                 {\r
 167                         return FALSE;\r
 168                 }\r
 169                 \r
 170                 /* NOTE: 3. initializing each members */\r
 171                 self::$skin                     = new Skin($skinid, 'Skin', 'AdminSkin');\r
 172                 self::$action           = '';\r
 173                 self::$extrahead        = '';\r
 174                 self::$passvar          = '';\r
 175                 self::$headMess         = '';\r
 176                 self::$aOptions         = '';\r
 177                 return TRUE;\r
 178         }\r
 179         \r
 180         /**\r
 181          * Admin::action()\r
 182          * Executes an action\r
 183          *\r
 184          * @param       string  $action action to be performed\r
 185          * @return      void\r
 186          */\r
 187         static public function action($action)\r
 188         {\r
 189                 global $CONF, $DIR_LIBS, $manager, $member;\r
 190                 \r
 191                 /* 1. decide action name */\r
 192                 $customAction = postvar('customaction');\r
 193                 if ( !empty($customAction) )\r
 194                 {\r
 195                         $alias = array(\r
 196                                 'login' => $customAction,\r
 197                                 ''              => $customAction\r
 198                         );\r
 199                 }\r
 200                 else\r
 201                 {\r
 202                         $alias = array(\r
 203                                 'login' => 'overview',\r
 204                                 ''              => 'overview'\r
 205                         );\r
 206                 }\r
 207                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 208                 {\r
 209                         $action = $alias[$action];\r
 210                 }\r
 211                 $methodName = "action_{$action}";\r
 212                 self::$action = strtolower($action);\r
 213                 \r
 214                 /* 2. check the action */\r
 215                 $synonimActions = array(\r
 216                         'banlistnewfromitem',\r
 217                         'memberedit',\r
 218                         'login',\r
 219                 );\r
 220                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 221                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 222                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 223                 {\r
 224                         if (!$manager->checkTicket())\r
 225                         {\r
 226                                 self::error(_ERROR_BADTICKET);\r
 227                         }\r
 228                 }\r
 229                 \r
 230                 /* 3. parse according to the action */\r
 231                 if ( !method_exists(self, $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 232                 {\r
 233                         /* TODO: what is this?\r
 234                         self::action_parseSpecialskin();\r
 235                         */\r
 236                 }\r
 237                 elseif ( method_exists(self, $methodName) )\r
 238                 {\r
 239                         call_user_func(array(self, $methodName));\r
 240                 }\r
 241                 else if ( self::existsSkinContents('adminerrorpage') )\r
 242                 {\r
 243                         self::error(_BADACTION . ENTITY::hsc($action));\r
 244                 }\r
 245                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 246                 {\r
 247                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 248                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 249                         {\r
 250                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 251                         }\r
 252                 }\r
 253                 else\r
 254                 {\r
 255                         self::error(_BADACTION . ENTITY::hsc($action));\r
 256                 }\r
 257                 exit;\r
 258         }\r
 259         \r
 260         /**\r
 261          * Action::existsSkinContents()\r
 262          * Check skin contents\r
 263          *\r
 264          * @param       string  $action action type\r
 265          * @return      boolean\r
 266          */\r
 267         static private function existsSkinContents($action)\r
 268         {\r
 269                 $in_array  = in_array($action, self::$skinless_actions);\r
 270                 \r
 271                 if ( $in_array )\r
 272                 {\r
 273                         return $in_array;\r
 274                 }\r
 275                 else\r
 276                 {\r
 277                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 278                         /* TODO: skinid should be a default */\r
 279                         if ( !is_object(self::$skin) )\r
 280                         {\r
 281                                 return quickQuery(sprintf($query, 1, sql_real_escape_string($action)));\r
 282                         }\r
 283                         else\r
 284                         {\r
 285                                 return quickQuery(sprintf($query, self::$skin->id, sql_real_escape_string($action)));\r
 286                         }\r
 287                 }\r
 288                 return;\r
 289         }\r
 290         \r
 291         /**\r
 292          * Action::specialActionsAllow()\r
 293          * Check exists specialskinparts\r
 294          *\r
 295          * @param       string  $action action type\r
 296          * @return boolean\r
 297          */\r
 298         static private function specialActionsAllow($action)\r
 299         {\r
 300                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 301                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 302                 return quickQuery($query);\r
 303         }\r
 304         \r
 305         /**\r
 306          * Action::action_showlogin()\r
 307          * \r
 308          * @param       void\r
 309          * @return      void\r
 310          */\r
 311         static private function action_showlogin()\r
 312         {\r
 313                 global $error;\r
 314                 self::$action_login($error);\r
 315                 return;\r
 316         }\r
 317         \r
 318         /**\r
 319          * Action::action_login()\r
 320          * \r
 321          * @param       string  $msg            message for pageheader\r
 322          * @param       integer $passvars       ???\r
 323          */\r
 324         static private function action_login($msg = '', $passvars = 1)\r
 325         {\r
 326                 global $member;\r
 327                 \r
 328                 // skip to overview when allowed\r
 329                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 330                 {\r
 331                         self::$action_overview();\r
 332                         exit;\r
 333                 }\r
 334                 \r
 335                 /* TODO: needless variable??? */\r
 336                 self::$passvar = $passvars;\r
 337                 if ( $msg )\r
 338                 {\r
 339                         self::$headMess = $msg;\r
 340                 }\r
 341                 \r
 342                 self::pagehead();\r
 343                 self::$skin->parse('showlogin');\r
 344                 self::pagefoot();\r
 345         }\r
 346         \r
 347         /**\r
 348          * Action::action_overview()\r
 349          * provides a screen with the overview of the actions available\r
 350          * \r
 351          * @param       string  $msg    message for pageheader\r
 352          * @return      void\r
 353          */\r
 354         static private function action_overview($msg = '')\r
 355         {\r
 356                 if ( $msg )\r
 357                 {\r
 358                         self::$headMess = $msg;\r
 359                 }\r
 360                 \r
 361                 self::pagehead();\r
 362                 self::$skin->parse('overview');\r
 363                 self::pagefoot();\r
 364                 return;\r
 365         }\r
 366         \r
 367         /**\r
 368          * Admin::action_manage()\r
 369          * \r
 370          * @param       string  $msg    message for pageheader\r
 371          * @retrn       void\r
 372          */\r
 373         static private function action_manage($msg = '')\r
 374         {\r
 375                 global $member;\r
 376                 \r
 377                 if ( $msg )\r
 378                 {\r
 379                         self::$headMess = $msg;\r
 380                 }\r
 381                 $member->isAdmin() or self::disallow();\r
 382                 \r
 383                 self::pagehead();\r
 384                 self::$skin->parse('manage');\r
 385                 self::pagefoot();\r
 386                 return;\r
 387         }\r
 388         \r
 389         /**\r
 390          * Action::action_itemlist()\r
 391          * \r
 392          * @param       integer id for weblod\r
 393          * @return      void\r
 394          */\r
 395         static private function action_itemlist($blogid = '')\r
 396         {\r
 397                 global $member, $manager, $CONF;\r
 398                 \r
 399                 if ( $blogid == '' )\r
 400                 {\r
 401                         $blogid = intRequestVar('blogid');\r
 402                 }\r
 403                 \r
 404                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 405                 \r
 406                 self::pagehead();\r
 407                 self::$skin->parse('itemlist');\r
 408                 self::pagefoot();\r
 409                 return;\r
 410         }\r
 411         \r
 412         /**\r
 413          * Action::action_batchitem()\r
 414          * \r
 415          * @param       void\r
 416          * @return      void\r
 417          */\r
 418         static private function action_batchitem()\r
 419         {\r
 420                 global $member, $manager;\r
 421                 \r
 422                 $member->isLoggedIn() or self::disallow();\r
 423                 \r
 424                 $selected       = requestIntArray('batch');\r
 425                 $action         = requestVar('batchaction');\r
 426                 \r
 427                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 428                 {\r
 429                         self::error(_BATCH_NOSELECTION);\r
 430                 }\r
 431                 \r
 432                 // On move: when no destination blog/category chosen, show choice now\r
 433                 $destCatid = intRequestVar('destcatid');\r
 434                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 435                 {\r
 436                         self::batchMoveSelectDestination('item', $selected);\r
 437                 }\r
 438                 \r
 439                 // On delete: check if confirmation has been given\r
 440                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 441                 {\r
 442                         self::batchAskDeleteConfirmation('item', $selected);\r
 443                 }\r
 444                 \r
 445                 self::pagehead();\r
 446                 self::$skin->parse('batchitem');\r
 447                 self::pagefoot();\r
 448                 return;\r
 449         }\r
 450         \r
 451         /**\r
 452          * Action::action_batchcomment()\r
 453          * \r
 454          * @param       void\r
 455          * @return      void\r
 456          */\r
 457         static private function action_batchcomment()\r
 458         {\r
 459                 global $member;\r
 460                 \r
 461                 $member->isLoggedIn() or self::disallow();\r
 462                 \r
 463                 $selected       = requestIntArray('batch');\r
 464                 $action         = requestVar('batchaction');\r
 465                 \r
 466                 // Show error when no items were selected\r
 467                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 468                 {\r
 469                         self::error(_BATCH_NOSELECTION);\r
 470                 }\r
 471                 \r
 472                 // On delete: check if confirmation has been given\r
 473                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 474                 {\r
 475                         self::batchAskDeleteConfirmation('comment',$selected);\r
 476                 }\r
 477                 \r
 478                 self::pagehead();\r
 479                 self::$skin->parse('batchcomment');\r
 480                 self::pagefoot();\r
 481                 return;\r
 482         }\r
 483         \r
 484         /**\r
 485          * Admin::action_batchmember()\r
 486          * \r
 487          * @param       void\r
 488          * @return      void\r
 489          */\r
 490         static private function action_batchmember()\r
 491         {\r
 492                 global $member;\r
 493                 \r
 494                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 495                 \r
 496                 $selected       = requestIntArray('batch');\r
 497                 $action         = requestVar('batchaction');\r
 498                 \r
 499                 // Show error when no members selected\r
 500                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 501                 {\r
 502                         self::error(_BATCH_NOSELECTION);\r
 503                 }\r
 504                 \r
 505                 // On delete: check if confirmation has been given\r
 506                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 507                 {\r
 508                         self::batchAskDeleteConfirmation('member',$selected);\r
 509                 }\r
 510                 \r
 511                 self::pagehead();\r
 512                 self::$skin->parse('batchmember');\r
 513                 self::pagefoot();\r
 514                 return;\r
 515         }\r
 516         \r
 517         /**\r
 518          * Admin::action_batchteam()\r
 519          * \r
 520          * @param       void\r
 521          * @return      void\r
 522          */\r
 523         static private function action_batchteam()\r
 524         {\r
 525                 global $member;\r
 526                 \r
 527                 $blogid = intRequestVar('blogid');\r
 528                 \r
 529                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 530                 \r
 531                 $selected       = requestIntArray('batch');\r
 532                 $action         = requestVar('batchaction');\r
 533                 \r
 534                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 535                 {\r
 536                         self::error(_BATCH_NOSELECTION);\r
 537                 }\r
 538                 \r
 539                 // On delete: check if confirmation has been given\r
 540                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 541                 {\r
 542                         self::batchAskDeleteConfirmation('team',$selected);\r
 543                 }\r
 544                 \r
 545                 self::pagehead();\r
 546                 self::$skin->parse('batchteam');\r
 547                 self::pagefoot();\r
 548                 return;\r
 549         }\r
 550         \r
 551         /**\r
 552          * Admin::action_batchcategory()\r
 553          * \r
 554          * @param       void\r
 555          * @return      void\r
 556          */\r
 557         static private function action_batchcategory()\r
 558         {\r
 559                 global $member, $manager;\r
 560                 \r
 561                 $member->isLoggedIn() or self::disallow();\r
 562                 \r
 563                 $selected       = requestIntArray('batch');\r
 564                 $action         = requestVar('batchaction');\r
 565                 \r
 566                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 567                 {\r
 568                         self::error(_BATCH_NOSELECTION);\r
 569                 }\r
 570                 \r
 571                 // On move: when no destination blog chosen, show choice now\r
 572                 $destBlogId = intRequestVar('destblogid');\r
 573                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 574                 {\r
 575                         self::batchMoveCategorySelectDestination('category', $selected);\r
 576                 }\r
 577                 \r
 578                 // On delete: check if confirmation has been given\r
 579                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 580                 {\r
 581                         self::batchAskDeleteConfirmation('category', $selected);\r
 582                 }\r
 583                 \r
 584                 self::pagehead();\r
 585                 self::$skin->parse('batchcategory');\r
 586                 self::pagefoot();\r
 587                 return;\r
 588         }\r
 589         \r
 590         /**\r
 591          * Admin::batchMoveSelectDestination()\r
 592          * \r
 593          * @param       string  $type   type of batch action\r
 594          * @param       integer $ids    needless???\r
 595          * @return      void\r
 596          * \r
 597          * TODO: remove needless argument\r
 598          */\r
 599         static private function batchMoveSelectDestination($type, $ids)\r
 600         {\r
 601                 $_POST['batchmove'] = $type;\r
 602                 self::pagehead();\r
 603                 self::$skin->parse('batchmove');\r
 604                 self::pagefoot();\r
 605                 return;\r
 606         }\r
 607         \r
 608         /**\r
 609          * Admin::batchMoveCategorySelectDestination()\r
 610          * \r
 611          * @param       string  $type   type of batch action\r
 612          * @param       integer $ids    needless???\r
 613          * @return      void\r
 614          * \r
 615          * TODO: remove needless argument\r
 616          */\r
 617         static private function batchMoveCategorySelectDestination($type, $ids)\r
 618         {\r
 619                 $_POST['batchmove'] = $type;\r
 620                 global $manager;\r
 621                 self::pagehead();\r
 622                 self::$skin->parse('batchmovecat');\r
 623                 self::pagefoot();\r
 624                 return;\r
 625         }\r
 626         \r
 627         /**\r
 628          * Admin::batchAskDeleteConfirmation()\r
 629          * \r
 630          * @param       string  $type   type of batch action\r
 631          * @param       integer $ids    needless???\r
 632          * @return      void\r
 633          * \r
 634          * TODO: remove needless argument\r
 635          */\r
 636         static private function batchAskDeleteConfirmation($type, $ids)\r
 637         {\r
 638                 self::pagehead();\r
 639                 self::$skin->parse('batchdelete');\r
 640                 self::pagefoot();\r
 641                 return;\r
 642         }\r
 643         \r
 644         /**\r
 645          * Admin::selectBlogCategory()\r
 646          * Inserts a HTML select element with choices for all categories to which the current\r
 647          * member has access\r
 648          *\r
 649          * @see function selectBlog\r
 650          * @param       string  $name                           name of weblod\r
 651          * @param       integer $selected                       \r
 652          * @param       integer $tabindex                       \r
 653          * @param       integer $showNewCat                     \r
 654          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 655          * @return      void\r
 656          *\r
 657          * NOTE: callback from AdminAction\r
 658          */\r
 659         static private function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 660         {\r
 661                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 662                 return;\r
 663         }\r
 664         \r
 665         /**\r
 666          * Admin::selectBlog()\r
 667          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 668          *      mode = 'blog' => shows blognames and values are blogids\r
 669          *      mode = 'category' => show category names and values are catids\r
 670          *\r
 671          * @param       string  $name                           name of weblod\r
 672          * @param       string  $mode                           \r
 673          * @param       integer $selected                       \r
 674          * @param       integer $tabindex                       \r
 675          * @param       integer $showNewCat                     \r
 676          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 677          * @param $iForcedBlogInclude\r
 678          *      ID of a blog that always needs to be included, without checking if the\r
 679          *      member is on the blog team (-1 = none)\r
 680          * @return      void\r
 681          */\r
 682         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 683         {\r
 684                 global $member, $CONF;\r
 685                 \r
 686                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 687                 $aBlogIds = array();\r
 688                 if ( $iForcedBlogInclude != -1 )\r
 689                 {\r
 690                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 691                 }\r
 692                 \r
 693                 if ( ($member->isAdmin()) && ($CONF['ShowAllBlogs']) )\r
 694                 {\r
 695                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 696                         $query = sprintf($query, sql_table('blog'));\r
 697                 }\r
 698                 else\r
 699                 {\r
 700                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 701                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 702                 }\r
 703                 \r
 704                 $rblogids = sql_query($query);\r
 705                 while ($o = sql_fetch_object($rblogids))\r
 706                 {\r
 707                         if ( $o->bnumber != $iForcedBlogInclude )\r
 708                         {\r
 709                                 $aBlogIds[] = intval($o->bnumber);\r
 710                         }\r
 711                 }\r
 712                 \r
 713                 if ( count($aBlogIds) == 0 )\r
 714                 {\r
 715                         return;\r
 716                 }\r
 717                 \r
 718                 /* TODO: we should consider to use the other way instead of this */\r
 719                 $_REQUEST['selectData'] = array(\r
 720                         'name'                  => $name,\r
 721                         'tabindex'              => $tabindex,\r
 722                         'mode'                  => $mode,\r
 723                         'selected'              => $selected,\r
 724                         'showNewCat'    => $showNewCat,\r
 725                         'aBlogIds'              => $aBlogIds,\r
 726                 );\r
 727                 self::$skin->parse('blogselectbox');\r
 728                 return;\r
 729         }\r
 730         \r
 731         /**\r
 732          * Admin::action_browseownitems()\r
 733          * \r
 734          * @param       void\r
 735          * @return      void\r
 736          */\r
 737         static private function action_browseownitems()\r
 738         {\r
 739                 global $member, $manager, $CONF;\r
 740                 \r
 741                 self::pagehead();\r
 742                 self::$skin->parse('browseownitems');\r
 743                 self::pagefoot();\r
 744                 return;\r
 745         }\r
 746         \r
 747         /**\r
 748          * Admin::action_itemcommentlist()\r
 749          * Show all the comments for a given item\r
 750          * \r
 751          * @param       integer $itemid ID for item\r
 752          * @return      void\r
 753          */\r
 754         static private function action_itemcommentlist($itemid = '')\r
 755         {\r
 756                 global $member, $manager, $CONF;\r
 757                 \r
 758                 if ( $itemid == '' )\r
 759                 {\r
 760                         $itemid = intRequestVar('itemid');\r
 761                 }\r
 762                 \r
 763                 /* TODO: we consider to use the other way insterad of this */\r
 764                 $_REQUEST['itemid'] = $itemid;\r
 765                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 766                 \r
 767                 // only allow if user is allowed to alter item\r
 768                 $member->canAlterItem($itemid) or self::disallow();\r
 769                 \r
 770                 $blogid = getBlogIdFromItemId($itemid);\r
 771                 \r
 772                 self::pagehead();\r
 773                 self::$skin->parse('itemcommentlist');\r
 774                 self::pagefoot();\r
 775                 return;\r
 776         }\r
 777         \r
 778         /**\r
 779          * Admin::action_browseowncomments()\r
 780          * Browse own comments\r
 781          * \r
 782          * @param       void\r
 783          * @return      void\r
 784          */\r
 785         static private function action_browseowncomments()\r
 786         {\r
 787                 self::pagehead();\r
 788                 self::$skin->parse('browseowncomments');\r
 789                 self::pagefoot();\r
 790                 return;\r
 791         }\r
 792         \r
 793         /**\r
 794          * Admin::action_blogcommentlist()\r
 795          * Browse all comments for a weblog\r
 796          * \r
 797          * @param       integer $blogid ID for weblog\r
 798          * @return      void\r
 799          */\r
 800         static private function action_blogcommentlist($blogid = '')\r
 801         {\r
 802                 global $member, $manager, $CONF;\r
 803                 \r
 804                 if ( $blogid == '' )\r
 805                 {\r
 806                         $blogid = intRequestVar('blogid');\r
 807                 }\r
 808                 else\r
 809                 {\r
 810                         $blogid = intval($blogid);\r
 811                 }\r
 812                 \r
 813                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 814                 \r
 815                 /* TODO: we consider to use the other way insterad of this */\r
 816                 $_REQUEST['blogid'] = $blogid;\r
 817                 \r
 818                 self::pagehead();\r
 819                 self::$skin->parse('blogcommentlist');\r
 820                 self::pagefoot();\r
 821                 return;\r
 822         }\r
 823         \r
 824         /**\r
 825          * Admin::action_createitem()\r
 826          * Provide a page to item a new item to the given blog\r
 827          * \r
 828          * @param       void\r
 829          * @return      void\r
 830          */\r
 831         static private function action_createitem()\r
 832         {\r
 833                 global $member, $manager;\r
 834                 \r
 835                 $blogid = intRequestVar('blogid');\r
 836                 \r
 837                 // check if allowed\r
 838                 $member->teamRights($blogid) or self::disallow();\r
 839                 \r
 840                 $memberid = $member->getID();\r
 841                 \r
 842                 $blog =& $manager->getBlog($blogid);\r
 843                 \r
 844                 self::pagehead();\r
 845                 self::$skin->parse('createitem');\r
 846                 self::pagefoot();\r
 847                 return;\r
 848         }\r
 849         \r
 850         /**\r
 851          * Admin::action_itemedit()\r
 852          * \r
 853          * @param       void\r
 854          * @return      void\r
 855          */\r
 856         static private function action_itemedit()\r
 857         {\r
 858                 global $member, $manager;\r
 859                 \r
 860                 $itemid = intRequestVar('itemid');\r
 861                 \r
 862                 // only allow if user is allowed to alter item\r
 863                 $member->canAlterItem($itemid) or self::disallow();\r
 864                 \r
 865                 $item =& $manager->getItem($itemid, 1, 1);\r
 866                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
 867                 \r
 868                 self::pagehead();\r
 869                 self::$skin->parse('itemedit');\r
 870                 self::pagefoot();\r
 871                 return;\r
 872         }\r
 873         \r
 874         /**\r
 875          * Admin::action_itemupdate()\r
 876          * \r
 877          * @param       void\r
 878          * @return      void\r
 879          */\r
 880         static private function action_itemupdate()\r
 881         {\r
 882                 global $member, $manager, $CONF;\r
 883                 \r
 884                 $itemid = intRequestVar('itemid');\r
 885                 $catid  = postVar('catid');\r
 886                 \r
 887                 // only allow if user is allowed to alter item\r
 888                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 889                 \r
 890                 $actiontype = postVar('actiontype');\r
 891                 \r
 892                 // delete actions are handled by itemdelete (which has confirmation)\r
 893                 if ( $actiontype == 'delete' )\r
 894                 {\r
 895                         self::$action_itemdelete();\r
 896                         return;\r
 897                 }\r
 898                 \r
 899                 $body           = postVar('body');\r
 900                 $title          = postVar('title');\r
 901                 $more           = postVar('more');\r
 902                 $closed         = intPostVar('closed');\r
 903                 $draftid        = intPostVar('draftid');\r
 904                 \r
 905                 // default action = add now\r
 906                 if ( !$actiontype )\r
 907                 {\r
 908                         $actiontype='addnow';\r
 909                 }\r
 910                 \r
 911                 // create new category if needed\r
 912                 if ( strstr($catid,'newcat') )\r
 913                 {\r
 914                         // get blogid\r
 915                         list($blogid) = sscanf($catid,"newcat-%d");\r
 916                         \r
 917                         // create\r
 918                         $blog =& $manager->getBlog($blogid);\r
 919                         $catid = $blog->createNewCategory();\r
 920                         \r
 921                         // show error when sth goes wrong\r
 922                         if ( !$catid )\r
 923                         {\r
 924                                 self::doError(_ERROR_CATCREATEFAIL);\r
 925                         }\r
 926                 }\r
 927                 \r
 928                 /*\r
 929                         set some variables based on actiontype\r
 930 \r
 931                         actiontypes:\r
 932                                 draft items -> addnow, addfuture, adddraft, delete\r
 933                                 non-draft items -> edit, changedate, delete\r
 934 \r
 935                         variables set:\r
 936                                 $timestamp: set to a nonzero value for future dates or date changes\r
 937                                 $wasdraft: set to 1 when the item used to be a draft item\r
 938                                 $publish: set to 1 when the edited item is not a draft\r
 939          */\r
 940                 $blogid =  getBlogIDFromItemID($itemid);\r
 941                 $blog   =& $manager->getBlog($blogid);\r
 942                 \r
 943                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 944                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 945                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 946                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 947                 {\r
 948                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 949                 }\r
 950                 else\r
 951                 {\r
 952                         $timestamp =0;\r
 953                 }\r
 954                 \r
 955                 // edit the item for real\r
 956                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 957                 \r
 958                 self::updateFuturePosted($blogid);\r
 959                 \r
 960                 if ( $draftid > 0 )\r
 961                 {\r
 962                         // delete permission is checked inside Item::delete()\r
 963                         Item::delete($draftid);\r
 964                 }\r
 965                 \r
 966                 if ( $catid != intPostVar('catid') )\r
 967                 {\r
 968                         self::$action_categoryedit(\r
 969                                 $catid,\r
 970                                 $blog->getID(),\r
 971                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 972                         );\r
 973                 }\r
 974                 else\r
 975                 {\r
 976                         // TODO: set start item correctly for itemlist\r
 977                         $item = Item::getItem($itemid, 0, 0);\r
 978                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 979                         $_REQUEST['start'] = $cnt + 1;\r
 980                         self::$action_itemlist(getBlogIDFromItemID($itemid));\r
 981                 }\r
 982                 return;\r
 983         }\r
 984         \r
 985         /**\r
 986          * Admin::action_itemdelete()\r
 987          * Delete item\r
 988          * \r
 989          * @param       Void\r
 990          * @return      Void\r
 991          */\r
 992         static private function action_itemdelete()\r
 993         {\r
 994                 global $member, $manager;\r
 995                 \r
 996                 $itemid = intRequestVar('itemid');\r
 997                 \r
 998                 // only allow if user is allowed to alter item\r
 999                 $member->canAlterItem($itemid) or self::disallow();\r
1000                 \r
1001                 if ( !$manager->existsItem($itemid,1,1) )\r
1002                 {\r
1003                         self::error(_ERROR_NOSUCHITEM);\r
1004                 }\r
1005                 \r
1006                 self::pagehead();\r
1007                 self::$skin->parse('itemdelete');\r
1008                 self::pagefoot();\r
1009                 return;\r
1010         }\r
1011         \r
1012         /**\r
1013          * Admin::action_itemdeleteconfirm()\r
1014          * \r
1015          * @param       void\r
1016          * @return      void\r
1017          */\r
1018         static private function action_itemdeleteconfirm()\r
1019         {\r
1020                 global $member;\r
1021                 \r
1022                 $itemid = intRequestVar('itemid');\r
1023                 \r
1024                 // only allow if user is allowed to alter item\r
1025                 $member->canAlterItem($itemid) or self::disallow();\r
1026                 \r
1027                 // get blogid first\r
1028                 $blogid = getBlogIdFromItemId($itemid);\r
1029                 \r
1030                 // delete item (note: some checks will be performed twice)\r
1031                 self::deleteOneItem($itemid);\r
1032                 \r
1033                 self::$action_itemlist($blogid);\r
1034                 return;\r
1035         }\r
1036         \r
1037         /**\r
1038          * Admin::deleteOneItem()\r
1039          * Deletes one item and returns error if something goes wrong\r
1040          * \r
1041          * @param       integer $itemid ID for item\r
1042          * @return      void\r
1043          */\r
1044         static private function deleteOneItem($itemid)\r
1045         {\r
1046                 global $member, $manager;\r
1047                 \r
1048                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1049                 if ( !$member->canAlterItem($itemid) )\r
1050                 {\r
1051                         return _ERROR_DISALLOWED;\r
1052                 }\r
1053                 \r
1054                 // need to get blogid before the item is deleted\r
1055                 $blogid = getBlogIDFromItemId($itemid);\r
1056                 \r
1057                 $manager->loadClass('ITEM');\r
1058                 Item::delete($itemid);\r
1059                 \r
1060                 // update blog's futureposted\r
1061                 self::updateFuturePosted($blogid);\r
1062                 return;\r
1063         }\r
1064         \r
1065         /**\r
1066          * Admin::updateFuturePosted()\r
1067          * Update a blog's future posted flag\r
1068          * \r
1069          * @param integer $blogid\r
1070          * @return      void\r
1071          */\r
1072         static private function updateFuturePosted($blogid)\r
1073         {\r
1074                 global $manager;\r
1075                 \r
1076                 $blogid                 =  intval($blogid);\r
1077                 $blog                   =& $manager->getBlog($blogid);\r
1078                 $currenttime    =  $blog->getCorrectTime(time());\r
1079                 \r
1080                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1081                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1082                 $result = sql_query($query);\r
1083                 \r
1084                 if ( sql_num_rows($result) > 0 )\r
1085                 {\r
1086                                 $blog->setFuturePost();\r
1087                 }\r
1088                 else\r
1089                 {\r
1090                                 $blog->clearFuturePost();\r
1091                 }\r
1092                 return;\r
1093         }\r
1094 \r
1095         /**\r
1096          * Admin::action_itemmove()\r
1097          * \r
1098          * @param       void\r
1099          * @return      void\r
1100          */\r
1101         static private function action_itemmove()\r
1102         {\r
1103                 global $member, $manager;\r
1104                 \r
1105                 $itemid = intRequestVar('itemid');\r
1106                 \r
1107                 $member->canAlterItem($itemid) or self::disallow();\r
1108                 \r
1109                 self::pagehead();\r
1110                 self::$skin->parse('itemmove');\r
1111                 self::pagefoot();\r
1112                 return;\r
1113         }\r
1114         \r
1115         /**\r
1116          * Admin::action_itemmoveto()\r
1117          * \r
1118          * @param       void\r
1119          * @return      void\r
1120          */\r
1121         static private function action_itemmoveto()\r
1122         {\r
1123                 global $member, $manager;\r
1124                 \r
1125                 $itemid = intRequestVar('itemid');\r
1126                 $catid = requestVar('catid');\r
1127                 \r
1128                 // create new category if needed\r
1129                 if ( strstr($catid,'newcat') )\r
1130                 {\r
1131                         // get blogid\r
1132                         list($blogid) = sscanf($catid,'newcat-%d');\r
1133                         \r
1134                         // create\r
1135                         $blog =& $manager->getBlog($blogid);\r
1136                         $catid = $blog->createNewCategory();\r
1137                         \r
1138                         // show error when sth goes wrong\r
1139                         if ( !$catid )\r
1140                         {\r
1141                                 self::doError(_ERROR_CATCREATEFAIL);\r
1142                         }\r
1143                 }\r
1144                 \r
1145                 // only allow if user is allowed to alter item\r
1146                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1147                 \r
1148                 $old_blogid = getBlogIDFromItemId($itemid);\r
1149                 \r
1150                 Item::move($itemid, $catid);\r
1151                 \r
1152                 // set the futurePosted flag on the blog\r
1153                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1154                 \r
1155                 // reset the futurePosted in case the item is moved from one blog to another\r
1156                 self::updateFuturePosted($old_blogid);\r
1157                 \r
1158                 if ( $catid != intRequestVar('catid') )\r
1159                 {\r
1160                         self::$action_categoryedit($catid, $blog->getID());\r
1161                 }\r
1162                 else\r
1163                 {\r
1164                         self::$action_itemlist(getBlogIDFromCatID($catid));\r
1165                 }\r
1166                 return;\r
1167         }\r
1168         \r
1169         /**\r
1170          * Admin::moveOneItem()\r
1171          * Moves one item to a given category (category existance should be checked by caller)\r
1172          * errors are returned\r
1173          * \r
1174          * @param       integer $itemid         ID for item\r
1175          * @param       integer $destCatid      ID for category to which the item will be moved\r
1176          * @return      void\r
1177          */\r
1178         static private function moveOneItem($itemid, $destCatid)\r
1179         {\r
1180                 global $member;\r
1181                 \r
1182                 // only allow if user is allowed to move item\r
1183                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1184                 {\r
1185                         return _ERROR_DISALLOWED;\r
1186                 }\r
1187                 \r
1188                 Item::move($itemid, $destCatid);\r
1189                 return;\r
1190         }\r
1191         \r
1192         /**\r
1193          * Admin::action_additem()\r
1194          * Adds a item to the chosen blog\r
1195          * \r
1196          * @param       void\r
1197          * @return      void\r
1198          */\r
1199         static private function action_additem()\r
1200         {\r
1201                 global $manager, $CONF;\r
1202                 \r
1203                 $manager->loadClass('ITEM');\r
1204                 \r
1205                 $result = Item::createFromRequest();\r
1206                 \r
1207                 if ( $result['status'] == 'error' )\r
1208                 {\r
1209                         self::error($result['message']);\r
1210                 }\r
1211                 \r
1212                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1213                 $blog           =& $manager->getBlog($blogid);\r
1214                 $btimestamp     =  $blog->getCorrectTime();\r
1215                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1216                 \r
1217                 if ( $result['status'] == 'newcategory' )\r
1218                 {\r
1219                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1220                         self::$action_categoryedit($result['catid'], $blogid, $distURI);\r
1221                 }\r
1222                 else\r
1223                 {\r
1224                         $methodName = 'action_itemList';\r
1225                         call_user_func(array(&$this, $methodName), $blogid);\r
1226                 }\r
1227                 return;\r
1228         }\r
1229         \r
1230         /**\r
1231          * Admin::action_commentedit()\r
1232          * Allows to edit previously made comments\r
1233          * \r
1234          * @param       void\r
1235          * @return      void\r
1236          */\r
1237         static private function action_commentedit()\r
1238         {\r
1239                 global $member, $manager;\r
1240                 \r
1241                 $commentid = intRequestVar('commentid');\r
1242                 \r
1243                 $member->canAlterComment($commentid) or self::disallow();\r
1244                 \r
1245                 self::pagehead();\r
1246                 self::$skin->parse('commentedit');\r
1247                 self::pagefoot();\r
1248                 return;\r
1249         }\r
1250         \r
1251         /**\r
1252          * Admin::action_commentupdate()\r
1253          * \r
1254          * @param       void\r
1255          * @return      void\r
1256          */\r
1257         static private function action_commentupdate()\r
1258         {\r
1259                 global $member, $manager;\r
1260                 \r
1261                 $commentid = intRequestVar('commentid');\r
1262                 \r
1263                 $member->canAlterComment($commentid) or self::disallow();\r
1264                 \r
1265                 $url    = postVar('url');\r
1266                 $email  = postVar('email');\r
1267                 $body   = postVar('body');\r
1268                 \r
1269                 // intercept words that are too long\r
1270                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1271                 {\r
1272                         self::error(_ERROR_COMMENT_LONGWORD);\r
1273                 }\r
1274                 \r
1275                 // check length\r
1276                 if ( i18n::strlen($body) < 3 )\r
1277                 {\r
1278                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1279                 }\r
1280                 \r
1281                 if ( i18n::strlen($body) > 5000 )\r
1282                 {\r
1283                         self::error(_ERROR_COMMENT_TOOLONG);\r
1284                 }\r
1285                 \r
1286                 // prepare body\r
1287                 $body = Comment::prepareBody($body);\r
1288                 \r
1289                 // call plugins\r
1290                 $data = array(\r
1291                         'body' => &$body\r
1292                 );\r
1293                 $manager->notify('PreUpdateComment', $data);\r
1294                 \r
1295                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1296                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1297                 sql_query($query);\r
1298                 \r
1299                 // get itemid\r
1300                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1301                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1302                 \r
1303                 $res    = sql_query($query);\r
1304                 $o              = sql_fetch_object($res);\r
1305                 $itemid = $o->citem;\r
1306                 \r
1307                 if ( $member->canAlterItem($itemid) )\r
1308                 {\r
1309                         self::$action_itemcommentlist($itemid);\r
1310                 }\r
1311                 else\r
1312                 {\r
1313                         self::$action_browseowncomments();\r
1314                 }\r
1315                 return;\r
1316         }\r
1317         \r
1318         /**\r
1319          * Admin::action_commentdelete()\r
1320          * Update comment\r
1321          * \r
1322          * @param       void\r
1323          * @return      void\r
1324          */\r
1325         static private function action_commentdelete()\r
1326         {\r
1327                 global $member, $manager;\r
1328                 \r
1329                 $commentid = intRequestVar('commentid');\r
1330                 $member->canAlterComment($commentid) or self::disallow();\r
1331                 \r
1332                 self::pagehead();\r
1333                 self::$skin->parse('commentdelete');\r
1334                 self::pagefoot();\r
1335                 return;\r
1336         }\r
1337         \r
1338         /**\r
1339          * Admin::action_commentdeleteconfirm()\r
1340          * \r
1341          * @param       void\r
1342          * @return      void\r
1343          */\r
1344         static private function action_commentdeleteconfirm()\r
1345         {\r
1346                 global $member;\r
1347                 \r
1348                 $commentid = intRequestVar('commentid');\r
1349                 \r
1350                 // get item id first\r
1351                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1352                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1353                 \r
1354                 $res = sql_query($query);\r
1355                 $o = sql_fetch_object($res);\r
1356                 $itemid = $o->citem;\r
1357                 \r
1358                 $error = self::deleteOneComment($commentid);\r
1359                 if ( $error )\r
1360                 {\r
1361                         self::doError($error);\r
1362                 }\r
1363                 \r
1364                 if ( $member->canAlterItem($itemid) )\r
1365                 {\r
1366                         self::$action_itemcommentlist($itemid);\r
1367                 }\r
1368                 else\r
1369                 {\r
1370                         self::$action_browseowncomments();\r
1371                 }\r
1372                 return;\r
1373         }\r
1374         \r
1375         /**\r
1376          * Admin::deleteOneComment()\r
1377          * \r
1378          * @param       integer $commentid      ID for comment\r
1379          * @return      void\r
1380          */\r
1381         static private function deleteOneComment($commentid)\r
1382         {\r
1383                 global $member, $manager;\r
1384                 \r
1385                 $commentid = (integer) $commentid;\r
1386                 \r
1387                 if ( !$member->canAlterComment($commentid) )\r
1388                 {\r
1389                         return _ERROR_DISALLOWED;\r
1390                 }\r
1391                 \r
1392                 $data = array(\r
1393                         'commentid' => $commentid\r
1394                 );\r
1395                 \r
1396                 $manager->notify('PreDeleteComment', $data);\r
1397                 \r
1398                 // delete the comments associated with the item\r
1399                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1400                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1401                 sql_query($query);\r
1402                 \r
1403                 $data = array(\r
1404                         'commentid' => $commentid\r
1405                 );\r
1406                 \r
1407                 $manager->notify('PostDeleteComment', $data);\r
1408                 \r
1409                 return '';\r
1410         }\r
1411         \r
1412         /**\r
1413          * Admin::action_usermanagement()\r
1414          * Usermanagement main\r
1415          * \r
1416          * @param       void\r
1417          * @return      void\r
1418          */\r
1419         static private function action_usermanagement()\r
1420         {\r
1421                 global $member, $manager;\r
1422                 \r
1423                 // check if allowed\r
1424                 $member->isAdmin() or self::disallow();\r
1425                 \r
1426                 self::pagehead();\r
1427                 self::$skin->parse('usermanagement');\r
1428                 self::pagefoot();\r
1429                 return;\r
1430         }\r
1431         \r
1432         /**\r
1433          * Admin::action_memberedit()\r
1434          * Edit member settings\r
1435          * \r
1436          * @param       void\r
1437          * @return      void\r
1438          */\r
1439         static private function action_memberedit()\r
1440         {\r
1441                 self::$action_editmembersettings(intRequestVar('memberid'));\r
1442                 return;\r
1443         }\r
1444         \r
1445         /**\r
1446          * Admin::action_editmembersettings()\r
1447          * \r
1448          * @param       integer $memberid       ID for member\r
1449          * @return      void\r
1450          * \r
1451          */\r
1452         static private function action_editmembersettings($memberid = '')\r
1453         {\r
1454                 global $member, $manager, $CONF;\r
1455                 \r
1456                 if ( $memberid == '' )\r
1457                 {\r
1458                         $memberid = $member->getID();\r
1459                 }\r
1460                 \r
1461                 /* TODO: we should consider to use the other way insterad of this */\r
1462                 $_REQUEST['memberid'] = $memberid;\r
1463                 \r
1464                 // check if allowed\r
1465                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1466                 \r
1467                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1468                 self::pagehead($extrahead);\r
1469                 self::$skin->parse('editmembersettings');\r
1470                 self::pagefoot();\r
1471                 return;\r
1472         }\r
1473         \r
1474         /**\r
1475          * Admin::action_changemembersettings()\r
1476          * \r
1477          * @param       void\r
1478          * @return      void\r
1479          */\r
1480         static private function action_changemembersettings()\r
1481         {\r
1482                 global $member, $CONF, $manager;\r
1483                 \r
1484                 $memberid = intRequestVar('memberid');\r
1485                 \r
1486                 // check if allowed\r
1487                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1488                 \r
1489                 $name                   = trim(strip_tags(postVar('name')));\r
1490                 $realname               = trim(strip_tags(postVar('realname')));\r
1491                 $password               = postVar('password');\r
1492                 $repeatpassword = postVar('repeatpassword');\r
1493                 $email                  = strip_tags(postVar('email'));\r
1494                 $url                    = strip_tags(postVar('url'));\r
1495                 $adminskin              = intPostVar('adminskin');\r
1496                 \r
1497                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1498                 if ( !preg_match('#^https?://#', $url) )\r
1499                 {\r
1500                         $url = 'http://' . $url;\r
1501                 }\r
1502                 \r
1503                 $admin          = postVar('admin');\r
1504                 $canlogin       = postVar('canlogin');\r
1505                 $notes          = strip_tags(postVar('notes'));\r
1506                 $locale         = postVar('locale');\r
1507                 \r
1508                 $mem = Member::createFromID($memberid);\r
1509                 \r
1510                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1511                 {\r
1512                         if ( !isValidDisplayName($name) )\r
1513                         {\r
1514                                 self::error(_ERROR_BADNAME);\r
1515                         }\r
1516                         \r
1517                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1518                         {\r
1519                                 self::error(_ERROR_NICKNAMEINUSE);\r
1520                         }\r
1521                         \r
1522                         if ( $password != $repeatpassword )\r
1523                         {\r
1524                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1525                         }\r
1526                         \r
1527                         if ( $password && (i18n::strlen($password) < 6) )\r
1528                         {\r
1529                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1530                         }\r
1531                                 \r
1532                         if ( $password )\r
1533                         {\r
1534                                 $pwdvalid = true;\r
1535                                 $pwderror = '';\r
1536                                 \r
1537                                 $data = array(\r
1538                                         'password'     => $password,\r
1539                                         'errormessage' => &$pwderror,\r
1540                                         'valid'        => &$pwdvalid\r
1541                                 );\r
1542                                 $manager->notify('PrePasswordSet', $data);\r
1543                                 \r
1544                                 if ( !$pwdvalid )\r
1545                                 {\r
1546                                         self::error($pwderror);\r
1547                                 }\r
1548                         }\r
1549                 }\r
1550                 \r
1551                 if ( !NOTIFICATION::address_validation($email) )\r
1552                 {\r
1553                         self::error(_ERROR_BADMAILADDRESS);\r
1554                 }\r
1555                 if ( !$realname )\r
1556                 {\r
1557                         self::error(_ERROR_REALNAMEMISSING);\r
1558                 }\r
1559                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1560                 {\r
1561                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1562                 }\r
1563                 \r
1564                 // check if there will remain at least one site member with both the logon and admin rights\r
1565                 // (check occurs when taking away one of these rights from such a member)\r
1566                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1567                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1568                         )\r
1569                 {\r
1570                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1571                         if ( sql_num_rows($r) < 2 )\r
1572                         {\r
1573                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1574                         }\r
1575                 }\r
1576                 \r
1577                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1578                 {\r
1579                         $mem->setDisplayName($name);\r
1580                         if ( $password )\r
1581                         {\r
1582                                 $mem->setPassword($password);\r
1583                         }\r
1584                 }\r
1585                 \r
1586                 $oldEmail = $mem->getEmail();\r
1587                 \r
1588                 $mem->setRealName($realname);\r
1589                 $mem->setEmail($email);\r
1590                 $mem->setURL($url);\r
1591                 $mem->setNotes($notes);\r
1592                 $mem->setLocale($locale);\r
1593                 \r
1594                 // only allow super-admins to make changes to the admin status\r
1595                 if ( $member->isAdmin() )\r
1596                 {\r
1597                         $mem->setAdmin($admin);\r
1598                         $mem->setCanLogin($canlogin);\r
1599                 }\r
1600                 \r
1601                 $autosave = postVar('autosave');\r
1602                 $mem->setAutosave($autosave);\r
1603                 \r
1604                 $mem->write();\r
1605                 \r
1606                 // store plugin options\r
1607                 $aOptions = requestArray('plugoption');\r
1608                 NucleusPlugin::apply_plugin_options($aOptions);\r
1609                 $data = array(\r
1610                         'context'  => 'member',\r
1611                         'memberid' => $memberid,\r
1612                         'member'   => &$mem\r
1613                 );\r
1614                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1615                 \r
1616                 // if email changed, generate new password\r
1617                 if ( $oldEmail != $mem->getEmail() )\r
1618                 {\r
1619                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1620                         // logout member\r
1621                         $mem->newCookieKey();\r
1622                         \r
1623                         // only log out if the member being edited is the current member.\r
1624                         if ( $member->getID() == $memberid )\r
1625                         {\r
1626                                 $member->logout();\r
1627                         }\r
1628                         self::$action_login(_MSG_ACTIVATION_SENT, 0);\r
1629                         return;\r
1630                 }\r
1631                 \r
1632                 if ( ($mem->getID() == $member->getID())\r
1633                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1634                 {\r
1635                         $mem->newCookieKey();\r
1636                         $member->logout();\r
1637                         self::$action_login(_MSG_LOGINAGAIN, 0);\r
1638                 }\r
1639                 else\r
1640                 {\r
1641                         self::$action_overview(_MSG_SETTINGSCHANGED);\r
1642                 }\r
1643                 return;\r
1644         }\r
1645 \r
1646         /**\r
1647          * Admin::action_memberadd()\r
1648          * \r
1649          * @param       void\r
1650          * @return      void\r
1651          * \r
1652          */\r
1653         static private function action_memberadd()\r
1654         {\r
1655                 global $member, $manager;\r
1656                 \r
1657                 // check if allowed\r
1658                 $member->isAdmin() or self::disallow();\r
1659                 \r
1660                 if ( postVar('password') != postVar('repeatpassword') )\r
1661                 {\r
1662                         self::error(_ERROR_PASSWORDMISMATCH);\r
1663                 }\r
1664                 \r
1665                 if ( i18n::strlen(postVar('password')) < 6 )\r
1666                 {\r
1667                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1668                 }\r
1669                 \r
1670                 $res = Member::create(\r
1671                         postVar('name'),\r
1672                         postVar('realname'),\r
1673                         postVar('password'),\r
1674                         postVar('email'),\r
1675                         postVar('url'),\r
1676                         postVar('admin'),\r
1677                         postVar('canlogin'),\r
1678                         postVar('notes')\r
1679                 );\r
1680                 \r
1681                 if ( $res != 1 )\r
1682                 {\r
1683                         self::error($res);\r
1684                 }\r
1685                 \r
1686                 // fire PostRegister event\r
1687                 $newmem = new Member();\r
1688                 $newmem->readFromName(postVar('name'));\r
1689                 $data = array(\r
1690                         'member' => &$newmem\r
1691                 );\r
1692                 $manager->notify('PostRegister', $data);\r
1693                 \r
1694                 self::$action_usermanagement();\r
1695                 return;\r
1696         }\r
1697         \r
1698         /**\r
1699          * Admin::action_activate()\r
1700          * Account activation\r
1701          * \r
1702          * @param       void\r
1703          * @return      void\r
1704          */\r
1705         static private function action_activate()\r
1706         {\r
1707                 $key = getVar('key');\r
1708                 self::showActivationPage($key);\r
1709                 return;\r
1710         }\r
1711         \r
1712         /**\r
1713          * Admin::showActivationPage()\r
1714          * \r
1715          * @param       void\r
1716          * @return      void\r
1717          */\r
1718         static private function showActivationPage($key, $message = '')\r
1719         {\r
1720                 global $manager;\r
1721                 \r
1722                 // clean up old activation keys\r
1723                 Member::cleanupActivationTable();\r
1724                 \r
1725                 // get activation info\r
1726                 $info = Member::getActivationInfo($key);\r
1727                 \r
1728                 if ( !$info )\r
1729                 {\r
1730                         self::error(_ERROR_ACTIVATE);\r
1731                 }\r
1732                 \r
1733                 $mem = Member::createFromId($info->vmember);\r
1734                 \r
1735                 if ( !$mem )\r
1736                 {\r
1737                         self::error(_ERROR_ACTIVATE);\r
1738                 }\r
1739                 \r
1740                 /* TODO: we should consider to use the other way insterad of this */\r
1741                 $_POST['ackey']                                 = $key;\r
1742                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1743                 \r
1744                 self::$headMess = $message;\r
1745                 self::pagehead();\r
1746                 self::$skin->parse('activate');\r
1747                 self::pagefoot();\r
1748                 return;\r
1749         }\r
1750         \r
1751         /**\r
1752          * Admin::action_activatesetpwd()\r
1753          * Account activation - set password part\r
1754          * \r
1755          * @param       void\r
1756          * @return      void\r
1757          */\r
1758         static private function action_activatesetpwd()\r
1759         {\r
1760                 global $manager;\r
1761                 $key = postVar('key');\r
1762                 \r
1763                 // clean up old activation keys\r
1764                 Member::cleanupActivationTable();\r
1765                 \r
1766                 // get activation info\r
1767                 $info = Member::getActivationInfo($key);\r
1768                 \r
1769                 if ( !$info || ($info->type == 'addresschange') )\r
1770                 {\r
1771                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1772                 }\r
1773                 \r
1774                 $mem = Member::createFromId($info->vmember);\r
1775                 \r
1776                 if ( !$mem )\r
1777                 {\r
1778                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1779                 }\r
1780                 \r
1781                 $password               = postVar('password');\r
1782                 $repeatpassword = postVar('repeatpassword');\r
1783                 \r
1784                 if ( $password != $repeatpassword )\r
1785                 {\r
1786                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1787                 }\r
1788                 \r
1789                 if ( $password && (i18n::strlen($password) < 6) )\r
1790                 {\r
1791                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1792                 }\r
1793                         \r
1794                 if ( $password )\r
1795                 {\r
1796                         $pwdvalid = true;\r
1797                         $pwderror = '';\r
1798                         \r
1799                         $data = array(\r
1800                                 'password'              => $password,\r
1801                                 'errormessage'  => &$pwderror,\r
1802                                 'valid'                 => &$pwdvalid\r
1803                         );\r
1804                         $manager->notify('PrePasswordSet', $data);\r
1805                         if ( !$pwdvalid )\r
1806                         {\r
1807                                 return self::showActivationPage($key,$pwderror);\r
1808                         }\r
1809                 }\r
1810                 \r
1811                 $error = '';\r
1812                 \r
1813                 $data = array(\r
1814                         'type'   => 'activation',\r
1815                         'member' => $mem,\r
1816                         'error'  => &$error\r
1817                 );\r
1818                 $manager->notify('ValidateForm', $data);\r
1819                 if ( $error != '' )\r
1820                 {\r
1821                         return self::showActivationPage($key, $error);\r
1822                 }\r
1823                 \r
1824                 // set password\r
1825                 $mem->setPassword($password);\r
1826                 $mem->write();\r
1827                 \r
1828                 // do the activation\r
1829                 Member::activate($key);\r
1830                 \r
1831                 self::pagehead();\r
1832                 self::$skin->parse('activatesetpwd');\r
1833                 self::pagefoot();\r
1834                 return;\r
1835         }\r
1836         \r
1837         /**\r
1838          * Admin::action_manageteam()\r
1839          * Manage team\r
1840          * \r
1841          * @param       void\r
1842          * @return      void\r
1843          */\r
1844         static private function action_manageteam()\r
1845         {\r
1846                 global $member, $manager;\r
1847                 \r
1848                 $blogid = intRequestVar('blogid');\r
1849                 \r
1850                 // check if allowed\r
1851                 $member->blogAdminRights($blogid) or self::disallow();\r
1852                 \r
1853                 self::pagehead();\r
1854                 self::$skin->parse('manageteam');\r
1855                 self::pagefoot();\r
1856                 return;\r
1857         }\r
1858         \r
1859         /**\r
1860          * Admin::action_teamaddmember()\r
1861          * Add member to team\r
1862          * \r
1863          * @param       void\r
1864          * @return      void\r
1865          */\r
1866         static private function action_teamaddmember()\r
1867         {\r
1868                 global $member, $manager;\r
1869                 \r
1870                 $memberid       = intPostVar('memberid');\r
1871                 $blogid         = intPostVar('blogid');\r
1872                 $admin          = intPostVar('admin');\r
1873                 \r
1874                 // check if allowed\r
1875                 $member->blogAdminRights($blogid) or self::disallow();\r
1876                 \r
1877                 $blog =& $manager->getBlog($blogid);\r
1878                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1879                 {\r
1880                         self::error(_ERROR_ALREADYONTEAM);\r
1881                 }\r
1882                 \r
1883                 self::$action_manageteam();\r
1884                 return;\r
1885         }\r
1886         \r
1887         /**\r
1888          * Admin::action_teamdelete()\r
1889          * \r
1890          * @param       void\r
1891          * @return      void\r
1892          */\r
1893         static private function action_teamdelete()\r
1894         {\r
1895                 global $member, $manager;\r
1896                 \r
1897                 $memberid       = intRequestVar('memberid');\r
1898                 $blogid         = intRequestVar('blogid');\r
1899                 \r
1900                 // check if allowed\r
1901                 $member->blogAdminRights($blogid) or self::disallow();\r
1902                 \r
1903                 $teammem =  Member::createFromID($memberid);\r
1904                 $blog =& $manager->getBlog($blogid);\r
1905                 \r
1906                 self::pagehead();\r
1907                 self::$skin->parse('teamdelete');\r
1908                 self::pagefoot();\r
1909                 return;\r
1910         }\r
1911         \r
1912         /**\r
1913          * Admin::action_teamdeleteconfirm()\r
1914          * \r
1915          * @param       void\r
1916          * @return      void\r
1917          */\r
1918         static private function action_teamdeleteconfirm()\r
1919         {\r
1920                 global $member;\r
1921                 \r
1922                 $memberid = intRequestVar('memberid');\r
1923                 $blogid = intRequestVar('blogid');\r
1924                 \r
1925                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1926                 if ( $error )\r
1927                 {\r
1928                         self::error($error);\r
1929                 }\r
1930                 self::$action_manageteam();\r
1931                 return;\r
1932         }\r
1933         \r
1934         /**\r
1935          * Admin::deleteOneTeamMember()\r
1936          * \r
1937          * @param       void\r
1938          * @return      void\r
1939          */\r
1940         static private function deleteOneTeamMember($blogid, $memberid)\r
1941         {\r
1942                 global $member, $manager;\r
1943                 \r
1944                 $blogid   = intval($blogid);\r
1945                 $memberid = intval($memberid);\r
1946                 \r
1947                 // check if allowed\r
1948                 if ( !$member->blogAdminRights($blogid) )\r
1949                 {\r
1950                         return _ERROR_DISALLOWED;\r
1951                 }\r
1952                 \r
1953                 // check if: - there remains at least one blog admin\r
1954                 //           - (there remains at least one team member)\r
1955                 $tmem = Member::createFromID($memberid);\r
1956                 \r
1957                 \r
1958                 $data = array(\r
1959                         'member' => &$tmem,\r
1960                         'blogid' => $blogid\r
1961                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1962                 \r
1963                 if ( $tmem->isBlogAdmin($blogid) )\r
1964                 {\r
1965                         /* TODO: why we did double check? */\r
1966                         // check if there are more blog members left and at least one admin\r
1967                         // (check for at least two admins before deletion)\r
1968                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1969                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1970                         $r     = sql_query($query);\r
1971                         if ( sql_num_rows($r) < 2 )\r
1972                         {\r
1973                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1974                         }\r
1975                 }\r
1976                 \r
1977                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1978                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1979                 sql_query($query);\r
1980                 \r
1981                 $data = array(\r
1982                         'member' => &$tmem,\r
1983                         'blogid' => $blogid\r
1984                 );\r
1985                 $manager->notify('PostDeleteTeamMember', $data);\r
1986                 \r
1987                 return '';\r
1988         }\r
1989         \r
1990         /**\r
1991          * Admin::action_teamchangeadmin()\r
1992          * \r
1993          * @param       void\r
1994          * @return      void\r
1995          */\r
1996         static private function action_teamchangeadmin()\r
1997         {\r
1998                 global $member;\r
1999                 \r
2000                 $blogid         = intRequestVar('blogid');\r
2001                 $memberid       = intRequestVar('memberid');\r
2002                 \r
2003                 // check if allowed\r
2004                 $member->blogAdminRights($blogid) or self::disallow();\r
2005                 \r
2006                 $mem = Member::createFromID($memberid);\r
2007                 \r
2008                 // don't allow when there is only one admin at this moment\r
2009                 if ( $mem->isBlogAdmin($blogid) )\r
2010                 {\r
2011                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2012                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2013                         $r = sql_query($query);\r
2014                         if ( sql_num_rows($r) == 1 )\r
2015                         {\r
2016                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2017                         }\r
2018                 }\r
2019                 \r
2020                 if ( $mem->isBlogAdmin($blogid) )\r
2021                 {\r
2022                         $newval = 0;\r
2023                 }\r
2024                 else\r
2025                 {\r
2026                         $newval = 1;\r
2027                 }\r
2028                 \r
2029                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2030                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2031                 sql_query($query);\r
2032                 \r
2033                 // only show manageteam if member did not change its own admin privileges\r
2034                 if ( $member->isBlogAdmin($blogid) )\r
2035                 {\r
2036                         self::$action_manageteam();\r
2037                 }\r
2038                 else\r
2039                 {\r
2040                         self::$action_overview(_MSG_ADMINCHANGED);\r
2041                 }\r
2042                 return;\r
2043         }\r
2044         \r
2045         /**\r
2046          * Admin::action_blogsettings()\r
2047          * \r
2048          * @param       void\r
2049          * @return      void\r
2050          */\r
2051         static private function action_blogsettings()\r
2052         {\r
2053                 global $member, $manager;\r
2054                 \r
2055                 $blogid = intRequestVar('blogid');\r
2056                 \r
2057                 // check if allowed\r
2058                 $member->blogAdminRights($blogid) or self::disallow();\r
2059                 \r
2060                 $blog =& $manager->getBlog($blogid);\r
2061                 \r
2062                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2063                 self::pagehead($extrahead);\r
2064                 self::$skin->parse('blogsettings');\r
2065                 self::pagefoot();\r
2066                 return;\r
2067         }\r
2068         \r
2069         /**\r
2070          * Admin::action_categorynew()\r
2071          * \r
2072          * @param       void\r
2073          * @return      void\r
2074          */\r
2075         static private function action_categorynew()\r
2076         {\r
2077                 global $member, $manager;\r
2078                 \r
2079                 $blogid = intRequestVar('blogid');\r
2080                 \r
2081                 $member->blogAdminRights($blogid) or self::disallow();\r
2082                 \r
2083                 $cname = postVar('cname');\r
2084                 $cdesc = postVar('cdesc');\r
2085                 \r
2086                 if ( !isValidCategoryName($cname) )\r
2087                 {\r
2088                         self::error(_ERROR_BADCATEGORYNAME);\r
2089                 }\r
2090                 \r
2091                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2092                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2093                 $res = sql_query($query);\r
2094                 if ( sql_num_rows($res) > 0 )\r
2095                 {\r
2096                         self::error(_ERROR_DUPCATEGORYNAME);\r
2097                 }\r
2098                 \r
2099                 $blog           =& $manager->getBlog($blogid);\r
2100                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2101                 \r
2102                 self::$action_blogsettings();\r
2103                 return;\r
2104         }\r
2105         \r
2106         /**\r
2107          * Admin::action_categoryedit()\r
2108          * \r
2109          * @param       void\r
2110          * @return      void\r
2111          */\r
2112         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2113         {\r
2114                 global $member, $manager;\r
2115                 \r
2116                 if ( $blogid == '' )\r
2117                 {\r
2118                         $blogid = intGetVar('blogid');\r
2119                 }\r
2120                 else\r
2121                 {\r
2122                         $blogid = intval($blogid);\r
2123                 }\r
2124                 if ( $catid == '' )\r
2125                 {\r
2126                         $catid = intGetVar('catid');\r
2127                 }\r
2128                 else\r
2129                 {\r
2130                         $catid = intval($catid);\r
2131                 }\r
2132                 \r
2133                 /* TODO: we should consider to use the other way insterad of this */\r
2134                 $_REQUEST['blogid']             = $blogid;\r
2135                 $_REQUEST['catid']              = $catid;\r
2136                 $_REQUEST['desturl']    = $desturl;\r
2137                 $member->blogAdminRights($blogid) or self::disallow();\r
2138                 \r
2139                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2140                 self::pagehead($extrahead);\r
2141                 self::$skin->parse('categoryedit');\r
2142                 self::pagefoot();\r
2143                 return;\r
2144         }\r
2145         \r
2146         /**\r
2147          * Admin::action_categoryupdate()\r
2148          * \r
2149          * @param       void\r
2150          * @return      void\r
2151          */\r
2152         static private function action_categoryupdate()\r
2153         {\r
2154                 global $member, $manager;\r
2155                 \r
2156                 $blogid         = intPostVar('blogid');\r
2157                 $catid          = intPostVar('catid');\r
2158                 $cname          = postVar('cname');\r
2159                 $cdesc          = postVar('cdesc');\r
2160                 $desturl        = postVar('desturl');\r
2161                 \r
2162                 $member->blogAdminRights($blogid) or self::disallow();\r
2163                 \r
2164                 if ( !isValidCategoryName($cname) )\r
2165                 {\r
2166                         self::error(_ERROR_BADCATEGORYNAME);\r
2167                 }\r
2168                 \r
2169                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2170                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2171                 $res    = sql_query($query);\r
2172                 if ( sql_num_rows($res) > 0 )\r
2173                 {\r
2174                         self::error(_ERROR_DUPCATEGORYNAME);\r
2175                 }\r
2176                 \r
2177                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2178                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2179                 sql_query($query);\r
2180                 \r
2181                 // store plugin options\r
2182                 $aOptions = requestArray('plugoption');\r
2183                 NucleusPlugin::apply_plugin_options($aOptions);\r
2184                 $data = array(\r
2185                         'context'       => 'category',\r
2186                         'catid'         => $catid\r
2187                 );\r
2188                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2189                 \r
2190                 if ( $desturl )\r
2191                 {\r
2192                         redirect($desturl);\r
2193                         exit;\r
2194                 }\r
2195                 else\r
2196                 {\r
2197                         self::$action_blogsettings();\r
2198                 }\r
2199                 return;\r
2200         }\r
2201         \r
2202         /**\r
2203          * Admin::action_categorydelete()\r
2204          * \r
2205          * @param       void\r
2206          * @return      void\r
2207          */\r
2208         static private function action_categorydelete()\r
2209         {\r
2210                 global $member, $manager;\r
2211                 \r
2212                 $blogid = intRequestVar('blogid');\r
2213                 $catid  = intRequestVar('catid');\r
2214                 \r
2215                 $member->blogAdminRights($blogid) or self::disallow();\r
2216                 \r
2217                 $blog =& $manager->getBlog($blogid);\r
2218                 \r
2219                 // check if the category is valid\r
2220                 if ( !$blog->isValidCategory($catid) )\r
2221                 {\r
2222                         self::error(_ERROR_NOSUCHCATEGORY);\r
2223                 }\r
2224                 \r
2225                 // don't allow deletion of default category\r
2226                 if ( $blog->getDefaultCategory() == $catid )\r
2227                 {\r
2228                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2229                 }\r
2230                 \r
2231                 // check if catid is the only category left for blogid\r
2232                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2233                 $query = sprintf($query, sql_table('category'), $blogid);\r
2234                 $res = sql_query($query);\r
2235                 if ( sql_num_rows($res) == 1 )\r
2236                 {\r
2237                         self::error(_ERROR_DELETELASTCATEGORY);\r
2238                 }\r
2239                 \r
2240                 self::pagehead();\r
2241                 self::$skin->parse('categorydelete');\r
2242                 self::pagefoot();\r
2243                 return;\r
2244         }\r
2245         \r
2246         /**\r
2247          * Admin::action_categorydeleteconfirm()\r
2248          * \r
2249          * @param       void\r
2250          * @return      void\r
2251          */\r
2252         static private function action_categorydeleteconfirm()\r
2253         {\r
2254                 global $member, $manager;\r
2255                 \r
2256                 $blogid = intRequestVar('blogid');\r
2257                 $catid  = intRequestVar('catid');\r
2258                 \r
2259                 $member->blogAdminRights($blogid) or self::disallow();\r
2260                 \r
2261                 $error = self::deleteOneCategory($catid);\r
2262                 if ( $error )\r
2263                 {\r
2264                         self::error($error);\r
2265                 }\r
2266                 \r
2267                 self::$action_blogsettings();\r
2268                 return;\r
2269         }\r
2270         \r
2271         /**\r
2272          * Admin::deleteOneCategory()\r
2273          * Delete a category by its id\r
2274          * \r
2275          * @param       String  $catid  category id for deleting\r
2276          * @return      Void\r
2277          */\r
2278         static private function deleteOneCategory($catid)\r
2279         {\r
2280                 global $manager, $member;\r
2281                 \r
2282                 $catid  = intval($catid);\r
2283                 $blogid = getBlogIDFromCatID($catid);\r
2284                 \r
2285                 if ( !$member->blogAdminRights($blogid) )\r
2286                 {\r
2287                         return ERROR_DISALLOWED;\r
2288                 }\r
2289                 \r
2290                 // get blog\r
2291                 $blog =& $manager->getBlog($blogid);\r
2292                 \r
2293                 // check if the category is valid\r
2294                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2295                 {\r
2296                         return _ERROR_NOSUCHCATEGORY;\r
2297                 }\r
2298                 \r
2299                 $destcatid = $blog->getDefaultCategory();\r
2300                 \r
2301                 // don't allow deletion of default category\r
2302                 if ( $blog->getDefaultCategory() == $catid )\r
2303                 {\r
2304                         return _ERROR_DELETEDEFCATEGORY;\r
2305                 }\r
2306                 \r
2307                 // check if catid is the only category left for blogid\r
2308                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2309                 $query = sprintf(sql_table('category'), (integer) $blogid);\r
2310                 \r
2311                 $res = sql_query($query);\r
2312                 if ( sql_num_rows($res) == 1 )\r
2313                 {\r
2314                         return _ERROR_DELETELASTCATEGORY;\r
2315                 }\r
2316                 \r
2317                 $data = array('catid' => $catid);\r
2318                 $manager->notify('PreDeleteCategory', $data);\r
2319                 \r
2320                 // change category for all items to the default category\r
2321                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2322                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2323                 sql_query($query);\r
2324                 \r
2325                 // delete all associated plugin options\r
2326                 NucleusPlugin::delete_option_values('category', $catid);\r
2327                 \r
2328                 // delete category\r
2329                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2330                 $query = sprintf($query, (integer) $catid);\r
2331                 sql_query($query);\r
2332                 \r
2333                 $data = array('catid' => $catid);\r
2334                 $manager->notify('PostDeleteCategory', $data);\r
2335                 return;\r
2336         }\r
2337         \r
2338         /**\r
2339          * Admin::action_blogsettingsupdate\r
2340          * Updating blog settings\r
2341          * \r
2342          * @param       Void\r
2343          * @return      Void\r
2344          */\r
2345         static private function action_blogsettingsupdate()\r
2346         {\r
2347                 global $member, $manager;\r
2348                 \r
2349                 $blogid = intRequestVar('blogid');\r
2350                 \r
2351                 $member->blogAdminRights($blogid) or self::disallow();\r
2352                 \r
2353                 $blog =& $manager->getBlog($blogid);\r
2354                 \r
2355                 $notify_address = trim(postVar('notify'));\r
2356                 $shortname              = trim(postVar('shortname'));\r
2357                 $updatefile             = trim(postVar('update'));\r
2358                 \r
2359                 $notifyComment  = intPostVar('notifyComment');\r
2360                 $notifyVote             = intPostVar('notifyVote');\r
2361                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2362                 \r
2363                 if ( $notifyComment == 0 )\r
2364                 {\r
2365                         $notifyComment = 1;\r
2366                 }\r
2367                 if ( $notifyVote == 0 )\r
2368                 {\r
2369                         $notifyVote = 1;\r
2370                 }\r
2371                 if ( $notifyNewItem == 0 )\r
2372                 {\r
2373                         $notifyNewItem = 1;\r
2374                 }\r
2375                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2376                 \r
2377                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2378                 {\r
2379                         self::error(_ERROR_BADNOTIFY);\r
2380                 }\r
2381                 \r
2382                 if ( !isValidShortName($shortname) )\r
2383                 {\r
2384                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2385                 }\r
2386                 \r
2387                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2388                 {\r
2389                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2390                 }\r
2391                 // check if update file is writable\r
2392                 if ( $updatefile && !is_writeable($updatefile) )\r
2393                 {\r
2394                         self::error(_ERROR_UPDATEFILE);\r
2395                 }\r
2396                 \r
2397                 $blog->setName(trim(postVar('name')));\r
2398                 $blog->setShortName($shortname);\r
2399                 $blog->setNotifyAddress($notify_address);\r
2400                 $blog->setNotifyType($notifyType);\r
2401                 $blog->setMaxComments(postVar('maxcomments'));\r
2402                 $blog->setCommentsEnabled(postVar('comments'));\r
2403                 $blog->setTimeOffset(postVar('timeoffset'));\r
2404                 $blog->setUpdateFile($updatefile);\r
2405                 $blog->setURL(trim(postVar('url')));\r
2406                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2407                 $blog->setDescription(trim(postVar('desc')));\r
2408                 $blog->setPublic(postVar('public'));\r
2409                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2410                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2411                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2412                 $blog->setSearchable(intPostVar('searchable'));\r
2413                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2414                 $blog->writeSettings();\r
2415                 \r
2416                 // store plugin options\r
2417                 $aOptions = requestArray('plugoption');\r
2418                 NucleusPlugin::apply_plugin_options($aOptions);\r
2419                 \r
2420                 $data = array(\r
2421                         'context' => 'blog',\r
2422                         'blogid'  => $blogid,\r
2423                         'blog'    => &$blog\r
2424                 );\r
2425                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2426                 \r
2427                 self::$action_overview(_MSG_SETTINGSCHANGED);\r
2428                 return;\r
2429         }\r
2430         \r
2431         /**\r
2432          * Admin::action_deleteblog()\r
2433          * \r
2434          * @param       void\r
2435          * @return      void\r
2436          */\r
2437         static private function action_deleteblog()\r
2438         {\r
2439                 global $member, $CONF, $manager;\r
2440                 \r
2441                 $blogid = intRequestVar('blogid');\r
2442                 \r
2443                 $member->blogAdminRights($blogid) or self::disallow();\r
2444                 \r
2445                 // check if blog is default blog\r
2446                 if ( $CONF['DefaultBlog'] == $blogid )\r
2447                 {\r
2448                         self::error(_ERROR_DELDEFBLOG);\r
2449                 }\r
2450                 \r
2451                 $blog =& $manager->getBlog($blogid);\r
2452                 \r
2453                 self::pagehead();\r
2454                 self::$skin->parse('deleteblog');\r
2455                 self::pagefoot();\r
2456                 return;\r
2457         }\r
2458         \r
2459         /**\r
2460          * Admin::action_deleteblogconfirm()\r
2461          * Delete Blog\r
2462          * \r
2463          * @param       Void\r
2464          * @return      Void\r
2465          */\r
2466         static private function action_deleteblogconfirm()\r
2467         {\r
2468                 global $member, $CONF, $manager;\r
2469                 \r
2470                 $blogid = intRequestVar('blogid');\r
2471                 \r
2472                 $data = array('blogid' => $blogid);\r
2473                 $manager->notify('PreDeleteBlog', $data);\r
2474                 \r
2475                 $member->blogAdminRights($blogid) or self::disallow();\r
2476                 \r
2477                 // check if blog is default blog\r
2478                 if ( $CONF['DefaultBlog'] == $blogid )\r
2479                 {\r
2480                         self::error(_ERROR_DELDEFBLOG);\r
2481                 }\r
2482                 \r
2483                 // delete all comments\r
2484                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2485                 sql_query($query);\r
2486                 \r
2487                 // delete all items\r
2488                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2489                 sql_query($query);\r
2490                 \r
2491                 // delete all team members\r
2492                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2493                 sql_query($query);\r
2494                 \r
2495                 // delete all bans\r
2496                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2497                 sql_query($query);\r
2498                 \r
2499                 // delete all categories\r
2500                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2501                 sql_query($query);\r
2502                 \r
2503                 // delete all associated plugin options\r
2504                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2505                 \r
2506                 // delete the blog itself\r
2507                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2508                 sql_query($query);\r
2509                 \r
2510                 $data = array('blogid' => $blogid);\r
2511                 $manager->notify('PostDeleteBlog', $data);\r
2512                 \r
2513                 self::$action_overview(_DELETED_BLOG);\r
2514                 return;\r
2515         }\r
2516         \r
2517         /**\r
2518          * Admin::action_memberdelete()\r
2519          * \r
2520          * @param       void\r
2521          * @return      void\r
2522          */\r
2523         static private function action_memberdelete()\r
2524         {\r
2525                 global $member, $manager;\r
2526                 \r
2527                 $memberid = intRequestVar('memberid');\r
2528                 \r
2529                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2530                 \r
2531                 $mem = Member::createFromID($memberid);\r
2532                 \r
2533                 self::pagehead();\r
2534                 self::$skin->parse('memberdelete');\r
2535                 self::pagefoot();\r
2536                 return;\r
2537         }\r
2538         \r
2539         /**\r
2540          * Admin::action_memberdeleteconfirm()\r
2541          * \r
2542          * @param       void\r
2543          * @return      void\r
2544          */\r
2545         static private function action_memberdeleteconfirm()\r
2546         {\r
2547                 global $member;\r
2548                 \r
2549                 $memberid = intRequestVar('memberid');\r
2550                 \r
2551                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2552                 \r
2553                 $error = self::deleteOneMember($memberid);\r
2554                 if ( $error )\r
2555                 {\r
2556                         self::error($error);\r
2557                 }\r
2558                 \r
2559                 if ( $member->isAdmin() )\r
2560                 {\r
2561                         self::$action_usermanagement();\r
2562                 }\r
2563                 else\r
2564                 {\r
2565                         self::$action_overview(_DELETED_MEMBER);\r
2566                 }\r
2567                 return;\r
2568         }\r
2569         \r
2570         /**\r
2571          * Admin::deleteOneMember()\r
2572          * Delete a member by id\r
2573          * \r
2574          * @static\r
2575          * @params      Integer $memberid       member id\r
2576          * @return      String  null string or error messages\r
2577          */\r
2578         static private function deleteOneMember($memberid)\r
2579         {\r
2580                 global $manager;\r
2581                 \r
2582                 $memberid = intval($memberid);\r
2583                 $mem = Member::createFromID($memberid);\r
2584                 \r
2585                 if ( !$mem->canBeDeleted() )\r
2586                 {\r
2587                         return _ERROR_DELETEMEMBER;\r
2588                 }\r
2589                 \r
2590                 $data = array('member' => &$mem);\r
2591                 $manager->notify('PreDeleteMember', $data);\r
2592                 \r
2593                 /* unlink comments from memberid */\r
2594                 if ( $memberid )\r
2595                 {\r
2596                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2597                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2598                         sql_query($query);\r
2599                 }\r
2600                 \r
2601                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2602                 sql_query($query);\r
2603                 \r
2604                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2605                 sql_query($query);\r
2606                 \r
2607                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2608                 sql_query($query);\r
2609                 \r
2610                 // delete all associated plugin options\r
2611                 NucleusPlugin::delete_option_values('member', $memberid);\r
2612                 \r
2613                 $data = array('member' => &$mem);\r
2614                 $manager->notify('PostDeleteMember', $data);\r
2615                 \r
2616                 return '';\r
2617         }\r
2618         \r
2619         /**\r
2620          * Admin::action_createnewlog()\r
2621          * \r
2622          * @param       void\r
2623          * @return      void\r
2624          */\r
2625         static private function action_createnewlog()\r
2626         {\r
2627                 global $member, $CONF, $manager;\r
2628                 \r
2629                 // Only Super-Admins can do this\r
2630                 $member->isAdmin() or self::disallow();\r
2631                 \r
2632                 self::pagehead();\r
2633                 self::$skin->parse('createnewlog');\r
2634                 self::pagefoot();\r
2635                 return;\r
2636         }\r
2637         \r
2638         /**\r
2639          * Admin::action_addnewlog()\r
2640          * \r
2641          * @param       void\r
2642          * @return      void\r
2643          */\r
2644         static private function action_addnewlog()\r
2645         {\r
2646                 global $member, $manager, $CONF;\r
2647                 \r
2648                 // Only Super-Admins can do this\r
2649                 $member->isAdmin() or self::disallow();\r
2650                 \r
2651                 $bname                  = trim(postVar('name'));\r
2652                 $bshortname             = trim(postVar('shortname'));\r
2653                 $btimeoffset    = postVar('timeoffset');\r
2654                 $bdesc                  = trim(postVar('desc'));\r
2655                 $bdefskin               = postVar('defskin');\r
2656                 \r
2657                 if ( !isValidShortName($bshortname) )\r
2658                 {\r
2659                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2660                 }\r
2661                 \r
2662                 if ( $manager->existsBlog($bshortname) )\r
2663                 {\r
2664                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2665                 }\r
2666                 \r
2667                 $data = array(\r
2668                         'name'        => &$bname,\r
2669                         'shortname'   => &$bshortname,\r
2670                         'timeoffset'  => &$btimeoffset,\r
2671                         'description' => &$bdesc,\r
2672                         'defaultskin' => &$bdefskin\r
2673                 );\r
2674                 $manager->notify('PreAddBlog', $data);\r
2675                 \r
2676                 // add slashes for sql queries\r
2677                 $bname                  = sql_real_escape_string($bname);\r
2678                 $bshortname             = sql_real_escape_string($bshortname);\r
2679                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2680                 $bdesc                  = sql_real_escape_string($bdesc);\r
2681                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2682                 \r
2683                 // create blog\r
2684                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2685                 $query = sprintf(sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2686                 sql_query($query);\r
2687                 \r
2688                 $blogid =  sql_insert_id();\r
2689                 $blog   =& $manager->getBlog($blogid);\r
2690                 \r
2691                 // create new category\r
2692                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2693                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2694                 \r
2695                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2696                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2697                 $catid = sql_insert_id();\r
2698                 \r
2699                 // set as default category\r
2700                 $blog->setDefaultCategory($catid);\r
2701                 $blog->writeSettings();\r
2702                 \r
2703                 // create team member\r
2704                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2705                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2706                 sql_query($query);\r
2707                 \r
2708                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2709                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2710                 \r
2711                 $blog->additem(\r
2712                         $blog->getDefaultCategory(),\r
2713                         $itemdeftitle,$itemdefbody,\r
2714                         '',\r
2715                         $blogid,\r
2716                         $member->getID(),\r
2717                         $blog->getCorrectTime(),\r
2718                         0,\r
2719                         0,\r
2720                         0\r
2721                 );\r
2722                 \r
2723                 $data = array('blog' => &$blog);\r
2724                 $manager->notify('PostAddBlog', $data);\r
2725                 \r
2726                 $data = array(\r
2727                         'blog'                  => &$blog,\r
2728                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2729                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2730                         'catid'                 => $catid\r
2731                 );\r
2732                 $manager->notify('PostAddCategory', $data);\r
2733                 \r
2734                 /* TODO: we should consider to use the other way insterad of this */\r
2735                 $_REQUEST['blogid'] = $blogid;\r
2736                 $_REQUEST['catid']  = $catid;\r
2737                 self::pagehead();\r
2738                 self::$skin->parse('addnewlog');\r
2739                 self::pagefoot();\r
2740                 return;\r
2741         }\r
2742         \r
2743         /**\r
2744          * Admin::action_addnewlog2()\r
2745          * \r
2746          * @param       void\r
2747          * @return      void\r
2748          */\r
2749         static private function action_addnewlog2()\r
2750         {\r
2751                 global $member, $manager;\r
2752                 $blogid = intRequestVar('blogid');\r
2753                 \r
2754                 $member->blogAdminRights($blogid) or self::disallow();\r
2755                 \r
2756                 $burl = requestVar('url');\r
2757                 \r
2758                 $blog =& $manager->getBlog($blogid);\r
2759                 $blog->setURL(trim($burl));\r
2760                 $blog->writeSettings();\r
2761                 \r
2762                 self::$action_overview(_MSG_NEWBLOG);\r
2763                 return;\r
2764         }\r
2765         \r
2766         /**\r
2767          * Admin::action_skinieoverview()\r
2768          * \r
2769          * @param       void\r
2770          * @return      void\r
2771          */\r
2772         static private function action_skinieoverview()\r
2773         {\r
2774                 global $member, $DIR_LIBS, $manager;\r
2775                 \r
2776                 $member->isAdmin() or self::disallow();\r
2777                 \r
2778                 include_once($DIR_LIBS . 'skinie.php');\r
2779                 \r
2780                 self::pagehead();\r
2781                 self::$skin->parse('skinieoverview');\r
2782                 self::pagefoot();\r
2783                 return;\r
2784         }\r
2785         \r
2786         /**\r
2787          * Admin::action_skinieimport()\r
2788          * \r
2789          * @param       void\r
2790          * @return      void\r
2791          */\r
2792         static private function action_skinieimport()\r
2793         {\r
2794                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2795                 \r
2796                 $member->isAdmin() or self::disallow();\r
2797                 \r
2798                 // load skinie class\r
2799                 include_once($DIR_LIBS . 'skinie.php');\r
2800                 \r
2801                 $skinFileRaw    = postVar('skinfile');\r
2802                 $mode                   = postVar('mode');\r
2803                 \r
2804                 $importer = new SkinImport();\r
2805                 \r
2806                 // get full filename\r
2807                 if ($mode == 'file')\r
2808                 {\r
2809                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2810                         \r
2811                         /* TODO: remove this\r
2812                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2813                         if ( !file_exists($skinFile) )\r
2814                         {\r
2815                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2816                         }\r
2817                          */\r
2818                 }\r
2819                 else\r
2820                 {\r
2821                         $skinFile = $skinFileRaw;\r
2822                 }\r
2823                 \r
2824                 // read only metadata\r
2825                 $error = $importer->readFile($skinFile, 1);\r
2826                 \r
2827                 /* TODO: we should consider to use the other way insterad of this */\r
2828                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2829                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2830                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2831                 \r
2832                 // clashes\r
2833                 $skinNameClashe                 = $importer->checkSkinNameClashes();\r
2834                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2835                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2836                 \r
2837                 /* TODO: we should consider to use the other way insterad of this */\r
2838                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2839                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2840                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2841                 \r
2842                 if ( $error )\r
2843                 {\r
2844                         self::error($error);\r
2845                 }\r
2846                 \r
2847                 self::pagehead();\r
2848                 self::$skin->parse('skinieimport');\r
2849                 self::pagefoot();\r
2850                 return;\r
2851         }\r
2852         \r
2853         /**\r
2854          * Admin::action_skiniedoimport()\r
2855          * \r
2856          * @param       void\r
2857          * @return      void\r
2858          */\r
2859         static private function action_skiniedoimport()\r
2860         {\r
2861                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2862                 \r
2863                 $member->isAdmin() or self::disallow();\r
2864                 \r
2865                 // load skinie class\r
2866                 include_once($DIR_LIBS . 'skinie.php');\r
2867                 \r
2868                 $skinFileRaw    = postVar('skinfile');\r
2869                 $mode                   = postVar('mode');\r
2870                 \r
2871                 $allowOverwrite = intPostVar('overwrite');\r
2872                 \r
2873                 // get full filename\r
2874                 if ( $mode == 'file' )\r
2875                 {\r
2876                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2877                         \r
2878                         /* TODO: remove this\r
2879                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2880                         if ( !file_exists($skinFile) )\r
2881                         {\r
2882                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2883                         }\r
2884                         */\r
2885                 }\r
2886                 else\r
2887                 {\r
2888                         $skinFile = $skinFileRaw;\r
2889                 }\r
2890                 \r
2891                 $importer = new SkinImport();\r
2892                 \r
2893                 $error = $importer->readFile($skinFile);\r
2894                 \r
2895                 if ( $error )\r
2896                 {\r
2897                         self::error($error);\r
2898                 }\r
2899                 \r
2900                 $error = $importer->writeToDatabase($allowOverwrite);\r
2901                 \r
2902                 if ( $error )\r
2903                 {\r
2904                         self::error($error);\r
2905                 }\r
2906                 \r
2907                 /* TODO: we should consider to use the other way insterad of this */\r
2908                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2909                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2910                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2911                 \r
2912                 self::pagehead();\r
2913                 self::$skin->parse('skiniedoimport');\r
2914                 self::pagefoot();\r
2915                 return;\r
2916         }\r
2917 \r
2918         /**\r
2919          * Admin::action_skinieexport()\r
2920          * \r
2921          * @param       void\r
2922          * @return      void\r
2923          */\r
2924         static private function action_skinieexport()\r
2925         {\r
2926                 global $member, $DIR_LIBS;\r
2927                 \r
2928                 $member->isAdmin() or self::disallow();\r
2929                 \r
2930                 // load skinie class\r
2931                 include_once($DIR_LIBS . 'skinie.php');\r
2932                 \r
2933                 $aSkins         = requestIntArray('skin');\r
2934                 $aTemplates     = requestIntArray('template');\r
2935                 \r
2936                 if ( !is_array($aTemplates) )\r
2937                 {\r
2938                         $aTemplates = array();\r
2939                 }\r
2940                 if ( !is_array($aSkins) )\r
2941                 {\r
2942                         $aSkins = array();\r
2943                 }\r
2944                 \r
2945                 $skinList               = array_keys($aSkins);\r
2946                 $templateList   = array_keys($aTemplates);\r
2947                 \r
2948                 $info = postVar('info');\r
2949                 \r
2950                 $exporter = new SkinExport();\r
2951                 foreach ( $skinList as $skinId )\r
2952                 {\r
2953                         $exporter->addSkin($skinId);\r
2954                 }\r
2955                 foreach ($templateList as $templateId)\r
2956                 {\r
2957                         $exporter->addTemplate($templateId);\r
2958                 }\r
2959                 $exporter->setInfo($info);\r
2960                 \r
2961                 $exporter->export();\r
2962                 return;\r
2963         }\r
2964         \r
2965         /**\r
2966          * Admin::action_templateoverview()\r
2967          * \r
2968          * @param       void\r
2969          * @return      void\r
2970          */\r
2971         static private function action_templateoverview()\r
2972         {\r
2973                 global $member, $manager;\r
2974                 \r
2975                 $member->isAdmin() or self::disallow();\r
2976                 \r
2977                 self::pagehead();\r
2978                 self::$skin->parse('templateoverview');\r
2979                 self::pagefoot();\r
2980                 return;\r
2981         }\r
2982         \r
2983         /**\r
2984          * Admin::action_templateedit()\r
2985          * \r
2986          * @param       string  $msg    message for pageheader\r
2987          * @return      void\r
2988          */\r
2989         static private function action_templateedit($msg = '')\r
2990         {\r
2991                 global $member, $manager;\r
2992                 if ( $msg )\r
2993                 {\r
2994                         self::$headMess = $msg;\r
2995                 }\r
2996                 \r
2997                 $templateid = intRequestVar('templateid');\r
2998                 \r
2999                 $member->isAdmin() or self::disallow();\r
3000                 \r
3001                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3002                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3003                 \r
3004                 self::pagehead($extrahead);\r
3005                 self::$skin->parse('templateedit');\r
3006                 self::pagefoot();\r
3007                 return;\r
3008         }\r
3009         \r
3010         /**\r
3011          * TODO: remove this\r
3012          *\r
3013         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3014                 static $count = 1;\r
3015                 if (!isset($template[$name])) $template[$name] = '';\r
3016         ?>\r
3017                 </tr><tr>\r
3018                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3019                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3020         <?php       $count++;\r
3021         }\r
3022         */\r
3023         \r
3024         /**\r
3025          * Admin::action_templateupdate()\r
3026          * \r
3027          * @param       void\r
3028          * @return      void\r
3029          */\r
3030         static private function action_templateupdate()\r
3031         {\r
3032                 global $member,$manager;\r
3033                 \r
3034                 $templateid = intRequestVar('templateid');\r
3035                 \r
3036                 $member->isAdmin() or self::disallow();\r
3037                 \r
3038                 $name = postVar('tname');\r
3039                 $desc = postVar('tdesc');\r
3040                 \r
3041                 if ( !isValidTemplateName($name) )\r
3042                 {\r
3043                         self::error(_ERROR_BADTEMPLATENAME);\r
3044                 }\r
3045                 \r
3046                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3047                 {\r
3048                         self::error(_ERROR_DUPTEMPLATENAME);\r
3049                 }\r
3050                 \r
3051                 $name = sql_real_escape_string($name);\r
3052                 $desc = sql_real_escape_string($desc);\r
3053                 \r
3054                 // 1. Remove all template parts\r
3055                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3056                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3057                 sql_query($query);\r
3058                 \r
3059                 // 2. Update description\r
3060                 $query = "UPDATE %s SET tdname='%s',tddesc='%s' WHERE tdnumber=%d;";\r
3061                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3062                 sql_query($query);\r
3063                 \r
3064                 // 3. Add non-empty template parts\r
3065                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3066                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3067                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3068                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3069                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3070                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3071                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3072                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3073                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3074                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3075                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3076                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3077                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3078                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3079                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3080                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3081                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3082                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3083                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3084                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3085                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3086                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3087                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3088                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3089                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3090                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3091                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3092                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3093                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3094                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3095                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3096                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3097                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3098                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3099                 \r
3100                 $data = array('fields' => array());\r
3101                 $manager->notify('TemplateExtraFields', $data);\r
3102                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3103                 {\r
3104                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3105                         {\r
3106                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3107                         }\r
3108                 }\r
3109                 \r
3110                 // jump back to template edit\r
3111                 self::$action_templateedit(_TEMPLATE_UPDATED);\r
3112                 return;\r
3113         }\r
3114         \r
3115         /**\r
3116          * Admin::addToTemplate()\r
3117          * \r
3118          * @param       Integer $id     ID for template\r
3119          * @param       String  $partname       parts name\r
3120          * @param       String  $content        template contents\r
3121          * @return      Integer record index\r
3122          * \r
3123          */\r
3124         static private function addToTemplate($id, $partname, $content)\r
3125         {\r
3126                 // don't add empty parts:\r
3127                 if ( !trim($content) )\r
3128                 {\r
3129                         return -1;\r
3130                 }\r
3131                 \r
3132                 $partname = sql_real_escape_string($partname);\r
3133                 $content  = sql_real_escape_string($content);\r
3134                 \r
3135                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3136                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3137                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3138                 return sql_insert_id();\r
3139         }\r
3140         \r
3141         /**\r
3142          * Admin::action_templatedelete()\r
3143          * \r
3144          * @param       void\r
3145          * @return      void\r
3146          */\r
3147         static private function action_templatedelete()\r
3148         {\r
3149                 global $member, $manager;\r
3150                 \r
3151                 $member->isAdmin() or self::disallow();\r
3152                 \r
3153                 $templateid = intRequestVar('templateid');\r
3154                 // TODO: check if template can be deleted\r
3155                 \r
3156                 self::pagehead();\r
3157                 self::$skin->parse('templatedelete');\r
3158                 self::pagefoot();\r
3159                 return;\r
3160         }\r
3161         \r
3162         /**\r
3163          * Admin::action_templatedeleteconfirm()\r
3164          * \r
3165          * @param       void\r
3166          * @return      void\r
3167          */\r
3168         static private function action_templatedeleteconfirm()\r
3169         {\r
3170                 global $member, $manager;\r
3171                 \r
3172                 $templateid = intRequestVar('templateid');\r
3173                 \r
3174                 $member->isAdmin() or self::disallow();\r
3175                 \r
3176                 $data = array('templateid' => $templateid);\r
3177                 $manager->notify('PreDeleteTemplate', $data);\r
3178                 \r
3179                 // 1. delete description\r
3180                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3181                 \r
3182                 // 2. delete parts\r
3183                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3184                 \r
3185                 \r
3186                 $data = array('templateid' => $templateid);\r
3187                 $manager->notify('PostDeleteTemplate', $data);\r
3188                 \r
3189                 self::$action_templateoverview();\r
3190                 return;\r
3191         }\r
3192         \r
3193         /**\r
3194          * Admin::action_templatenew()\r
3195          * \r
3196          * @param       void\r
3197          * @return      void\r
3198          */\r
3199         static private function action_templatenew()\r
3200         {\r
3201                 global $member;\r
3202                 \r
3203                 $member->isAdmin() or self::disallow();\r
3204                 \r
3205                 $name = postVar('name');\r
3206                 $desc = postVar('desc');\r
3207                 \r
3208                 if ( !isValidTemplateName($name) )\r
3209                 {\r
3210                         self::error(_ERROR_BADTEMPLATENAME);\r
3211                 }\r
3212                 \r
3213                 if ( Template::exists($name) )\r
3214                 {\r
3215                         self::error(_ERROR_DUPTEMPLATENAME);\r
3216                 }\r
3217                 \r
3218                 $newTemplateId = Template::createNew($name, $desc);\r
3219                 \r
3220                 self::$action_templateoverview();\r
3221                 return;\r
3222         }\r
3223         \r
3224         /**\r
3225          * Admin::action_templateclone()\r
3226          * \r
3227          * @param       void\r
3228          * @return      void\r
3229          */\r
3230         static private function action_templateclone()\r
3231         {\r
3232                 global $member;\r
3233                 \r
3234                 $templateid = intRequestVar('templateid');\r
3235                 \r
3236                 $member->isAdmin() or self::disallow();\r
3237                 \r
3238                 // 1. read old template\r
3239                 $name = Template::getNameFromId($templateid);\r
3240                 $desc = Template::getDesc($templateid);\r
3241                 \r
3242                 // 2. create desc thing\r
3243                 $name = "cloned" . $name;\r
3244                 \r
3245                 // if a template with that name already exists:\r
3246                 if ( Template::exists($name) )\r
3247                 {\r
3248                         $i = 1;\r
3249                         while (Template::exists($name . $i))\r
3250                         {\r
3251                                 $i++;\r
3252                         }\r
3253                         $name .= $i;\r
3254                 }\r
3255                 \r
3256                 $newid = Template::createNew($name, $desc);\r
3257                 \r
3258                 // 3. create clone\r
3259                 // go through parts of old template and add them to the new one\r
3260                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3261                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3262                 \r
3263                 $res = sql_query($query);\r
3264                 while ( $o = sql_fetch_object($res) )\r
3265                 {\r
3266                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3267                 }\r
3268                 \r
3269                 self::$action_templateoverview();\r
3270                 return;\r
3271         }\r
3272         \r
3273         /**\r
3274          * Admin::action_admintemplateoverview()\r
3275          * \r
3276          * @param       void\r
3277          * @return      void\r
3278          */\r
3279         static private function action_admintemplateoverview()\r
3280         {\r
3281                 global $member, $manager;\r
3282                 $member->isAdmin() or self::disallow();\r
3283                 self::pagehead();\r
3284                 self::$skin->parse('admintemplateoverview');\r
3285                 self::pagefoot();\r
3286                 return;\r
3287         }\r
3288         \r
3289         /**\r
3290          * Admin::action_admintemplateedit()\r
3291          * \r
3292          * @param       string  $msg    message for pageheader\r
3293          * @return      void\r
3294          */\r
3295         static private function action_admintemplateedit($msg = '')\r
3296         {\r
3297                 global $member, $manager;\r
3298                 if ( $msg )\r
3299                 {\r
3300                         self::$headMess = $msg;\r
3301                 }\r
3302                 $member->isAdmin() or self::disallow();\r
3303                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3304                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3305                 self::pagehead($extrahead);\r
3306                 self::$skin->parse('admintemplateedit');\r
3307                 self::pagefoot();\r
3308                 return;\r
3309         }\r
3310         \r
3311         /**\r
3312          * Admin::action_admintemplateupdate()\r
3313          * \r
3314          * @param       void\r
3315          * @return      void\r
3316          */\r
3317         static private function action_admintemplateupdate()\r
3318         {\r
3319                 global $member, $manager;\r
3320                 $templateid = intRequestVar('templateid');\r
3321                 $member->isAdmin() or self::disallow();\r
3322                 $name = postVar('tname');\r
3323                 $desc = postVar('tdesc');\r
3324                 \r
3325                 if ( !isValidTemplateName($name) )\r
3326                 {\r
3327                         self::error(_ERROR_BADTEMPLATENAME);\r
3328                 }\r
3329                 \r
3330                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3331                 {\r
3332                         self::error(_ERROR_DUPTEMPLATENAME);\r
3333                 }\r
3334                 $name = sql_real_escape_string($name);\r
3335                 $desc = sql_real_escape_string($desc);\r
3336                 \r
3337                 // 1. Remove all template parts\r
3338                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3339                 $query = sprintf($query, (integer) $templateid);\r
3340                 sql_query($query);\r
3341                 \r
3342                 // 2. Update description\r
3343                 $query = 'UPDATE %s SET tdname=%s tddesc=%s WHERE tdnumber=%d;';\r
3344                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3345                 sql_query($query);\r
3346                 \r
3347                 // 3. Add non-empty template parts\r
3348                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3349                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3350                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3351                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3352                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3353                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3354                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3355                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3356                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3357                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3358                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3359                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3360                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3361                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3362                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3363                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3364                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3365                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3366                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3367                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3368                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3369                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3370                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3371                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3372                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3376                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3377                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3378                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3379                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3380                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3381                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3382                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3383                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3384                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3385                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3386                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3387                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3388                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3389                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3390                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3391                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3392                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3393                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3394                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3395                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3396                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3397                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3450                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3451                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3452                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3453                 \r
3454                 $data = array('fields' => array());\r
3455                 $manager->notify('TemplateExtraFields', $data);\r
3456                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3457                 {\r
3458                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3459                         {\r
3460                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3461                         }\r
3462                 }\r
3463                 \r
3464                 // jump back to template edit\r
3465                 self::$action_admintemplateedit(_TEMPLATE_UPDATED);\r
3466                 return;\r
3467         }\r
3468         \r
3469         /**\r
3470          * Admin::addToAdminTemplate()\r
3471          * \r
3472          * @param       integer $id                     ID for template\r
3473          * @param       string  $partname       name of part for template\r
3474          * @param       void    $contents       content for part of template\r
3475          * @return      integer ID for newly inserted Template\r
3476          */\r
3477         static private function addToAdminTemplate($id, $partname, $content)\r
3478         {\r
3479                 // don't add empty parts:\r
3480                 if ( !trim($content) )\r
3481                 {\r
3482                         return -1;\r
3483                 }\r
3484                 \r
3485                 $query = "INSERT INTO (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3486                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($contents));\r
3487                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3488                 return sql_insert_id();\r
3489         }\r
3490         \r
3491         /**\r
3492          * Admin::action_admintemplatedelete()\r
3493          * \r
3494          * @param       void\r
3495          * @return      void\r
3496          */\r
3497         static private function action_admintemplatedelete()\r
3498         {\r
3499                 global $member, $manager;\r
3500                 $member->isAdmin() or self::disallow();\r
3501                 \r
3502                 // TODO: check if template can be deleted\r
3503                 self::pagehead();\r
3504                 self::$skin->parse('admintemplatedelete');\r
3505                 self::pagefoot();\r
3506                 return;\r
3507         }\r
3508         \r
3509         /**\r
3510          * Admin::action_admintemplatedeleteconfirm()\r
3511          * \r
3512          * @param       void\r
3513          * @return      void\r
3514          */\r
3515         static private function action_admintemplatedeleteconfirm()\r
3516         {\r
3517                 global $member, $manager;\r
3518                 \r
3519                 $templateid = intRequestVar('templateid');\r
3520                 $member->isAdmin() or self::disallow();\r
3521                 \r
3522                 $data = array('templateid' => $templateid);\r
3523                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3524                 \r
3525                 // 1. delete description\r
3526                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3527                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3528                 sql_query($query);\r
3529                 \r
3530                 // 2. delete parts\r
3531                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3532                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3533                 sql_query();\r
3534                 \r
3535                 $data = array('templateid' => $templateid);\r
3536                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3537                 \r
3538                 self::$action_admintemplateoverview();\r
3539                 return;\r
3540         }\r
3541         \r
3542         /**\r
3543          * Admin::action_admintemplatenew()\r
3544          * \r
3545          * @param       void\r
3546          * @return      void\r
3547          */\r
3548         static private function action_admintemplatenew()\r
3549         {\r
3550                 global $member;\r
3551                 $member->isAdmin() or self::disallow();\r
3552                 $name = postVar('name');\r
3553                 $desc = postVar('desc');\r
3554                 \r
3555                 if ( !isValidTemplateName($name) )\r
3556                 {\r
3557                         self::error(_ERROR_BADTEMPLATENAME);\r
3558                 }\r
3559                 if ( Template::exists($name) )\r
3560                 {\r
3561                         self::error(_ERROR_DUPTEMPLATENAME);\r
3562                 }\r
3563                 \r
3564                 $newTemplateId = Template::createNew($name, $desc);\r
3565                 self::$action_admintemplateoverview();\r
3566                 return;\r
3567         }\r
3568         \r
3569         /**\r
3570          * Admin::action_admintemplateclone()\r
3571          * \r
3572          * @param       void\r
3573          * @return      void\r
3574          */\r
3575         static private function action_admintemplateclone()\r
3576         {\r
3577                 global $member;\r
3578                 $templateid = intRequestVar('templateid');\r
3579                 $member->isAdmin() or self::disallow();\r
3580                 \r
3581                 // 1. read old template\r
3582                 $name = Template::getNameFromId($templateid);\r
3583                 $desc = Template::getDesc($templateid);\r
3584                 \r
3585                 // 2. create desc thing\r
3586                 $name = "cloned" . $name;\r
3587                 \r
3588                 // if a template with that name already exists:\r
3589                 if ( Template::exists($name) )\r
3590                 {\r
3591                         $i = 1;\r
3592                         while ( Template::exists($name . $i) )\r
3593                         {\r
3594                                 $i++;\r
3595                         }\r
3596                         $name .= $i;\r
3597                 }\r
3598                 \r
3599                 $newid = Template::admincreateNew($name, $desc);\r
3600                 \r
3601                 // 3. create clone\r
3602                 // go through parts of old template and add them to the new one\r
3603                 $query = "SELECT tpartname, tcontent FROM %sWHERE tdesc=%d;";\r
3604                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3605                 \r
3606                 $res = sql_query($query);\r
3607                 while ( $o = sql_fetch_object($res) )\r
3608                 {\r
3609                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3610                 }\r
3611                 \r
3612                 self::$action_admintemplateoverview();\r
3613                 return;\r
3614         }\r
3615 \r
3616         /**\r
3617          * Admin::action_skinoverview()\r
3618          * \r
3619          * @param       void\r
3620          * @return      void\r
3621          */\r
3622         static private function action_skinoverview()\r
3623         {\r
3624                 global $member, $manager;\r
3625                 \r
3626                 $member->isAdmin() or self::disallow();\r
3627                 \r
3628                 self::pagehead();\r
3629                 self::$skin->parse('skinoverview');\r
3630                 self::pagefoot();\r
3631                 return;\r
3632         }\r
3633         \r
3634         /**\r
3635          * Admin::action_skinnew()\r
3636          * \r
3637          * @param       void\r
3638          * @return      void\r
3639          */\r
3640         static private function action_skinnew()\r
3641         {\r
3642                 global $member;\r
3643                 \r
3644                 $member->isAdmin() or self::disallow();\r
3645                 \r
3646                 $name = trim(postVar('name'));\r
3647                 $desc = trim(postVar('desc'));\r
3648                 \r
3649                 if ( !isValidSkinName($name) )\r
3650                 {\r
3651                         self::error(_ERROR_BADSKINNAME);\r
3652                 }\r
3653                 \r
3654                 if ( SKIN::exists($name) )\r
3655                 {\r
3656                         self::error(_ERROR_DUPSKINNAME);\r
3657                 }\r
3658                 \r
3659                 $newId = SKIN::createNew($name, $desc);\r
3660                 \r
3661                 self::$action_skinoverview();\r
3662                 return;\r
3663         }\r
3664         \r
3665         /**\r
3666          * Admin::action_skinedit()\r
3667          * \r
3668          * @param       void\r
3669          * @return      void\r
3670          */\r
3671         static private function action_skinedit()\r
3672         {\r
3673                 global $member, $manager;\r
3674                 \r
3675                 $member->isAdmin() or self::disallow();\r
3676                 \r
3677                 self::pagehead();\r
3678                 self::$skin->parse('skinedit');\r
3679                 self::pagefoot();\r
3680                 return;\r
3681         }\r
3682         \r
3683         /**\r
3684          * Admin::action_skineditgeneral()\r
3685          * \r
3686          * @param       void\r
3687          * @return      void\r
3688          */\r
3689         static private function action_skineditgeneral()\r
3690         {\r
3691                 global $member;\r
3692                 \r
3693                 $skinid = intRequestVar('skinid');\r
3694                 \r
3695                 $member->isAdmin() or self::disallow();\r
3696                 \r
3697                 $name           = postVar('name');\r
3698                 $desc           = postVar('desc');\r
3699                 $type           = postVar('type');\r
3700                 $inc_mode       = postVar('inc_mode');\r
3701                 $inc_prefix     = postVar('inc_prefix');\r
3702                 \r
3703                 $skin = new Skin($skinid);\r
3704                 \r
3705                 // 1. Some checks\r
3706                 if ( !isValidSkinName($name) )\r
3707                 {\r
3708                         self::error(_ERROR_BADSKINNAME);\r
3709                 }\r
3710                 \r
3711                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3712                 {\r
3713                         self::error(_ERROR_DUPSKINNAME);\r
3714                 }\r
3715                 \r
3716                 if ( !$type )\r
3717                 {\r
3718                         $type = 'text/html';\r
3719                 }\r
3720                 if ( !$inc_mode )\r
3721                 {\r
3722                         $inc_mode = 'normal';\r
3723                 }\r
3724                 \r
3725                 // 2. Update description\r
3726                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3727                 \r
3728                 self::$action_skinedit();\r
3729                 return;\r
3730         }\r
3731         \r
3732         static private function action_skinedittype($msg = '')\r
3733         {\r
3734                 global $member, $manager;\r
3735                 \r
3736                 $member->isAdmin() or self::disallow();\r
3737                 \r
3738                 if ( $msg )\r
3739                 {\r
3740                         self::$headMess = $msg;\r
3741                 }\r
3742                 \r
3743                 $skinid = intRequestVar('skinid');\r
3744                 $type   = requestVar('type');\r
3745                 $type   = trim($type);\r
3746                 $type   = strtolower($type);\r
3747                 \r
3748                 if ( !isValidShortName($type) )\r
3749                 {\r
3750                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3751                 }\r
3752                 \r
3753                 self::pagehead();\r
3754                 self::$skin->parse('skinedittype');\r
3755                 self::pagefoot();\r
3756                 return;\r
3757         }\r
3758         \r
3759         /**\r
3760          * Admin::action_skinupdate()\r
3761          * \r
3762          * @param       void\r
3763          * @return      void\r
3764          */\r
3765         static private function action_skinupdate()\r
3766         {\r
3767                 global $member;\r
3768                 \r
3769                 $skinid = intRequestVar('skinid');\r
3770                 $content = trim(postVar('content'));\r
3771                 $type = postVar('type');\r
3772                 \r
3773                 $member->isAdmin() or self::disallow();\r
3774                 \r
3775                 $skin = new SKIN($skinid);\r
3776                 $skin->update($type, $content);\r
3777                 \r
3778                 self::$action_skinedittype(_SKIN_UPDATED);\r
3779                 return;\r
3780         }\r
3781         \r
3782         /**\r
3783          * Admin::action_skindelete()\r
3784          * \r
3785          * @param       void\r
3786          * @return      void\r
3787          */\r
3788         static private function action_skindelete()\r
3789         {\r
3790                 global $member, $manager, $CONF;\r
3791                 \r
3792                 $skinid = intRequestVar('skinid');\r
3793                 \r
3794                 $member->isAdmin() or self::disallow();\r
3795                 \r
3796                 // don't allow default skin to be deleted\r
3797                 if ( $skinid == $CONF['BaseSkin'] )\r
3798                 {\r
3799                         self::error(_ERROR_DEFAULTSKIN);\r
3800                 }\r
3801                 \r
3802                 // don't allow deletion of default skins for blogs\r
3803                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3804                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3805                 \r
3806                 $r = sql_query($query);\r
3807                 if ( $o = sql_fetch_object($r) )\r
3808                 {\r
3809                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3810                 }\r
3811                 \r
3812                 self::pagehead();\r
3813                 self::$skin->parse('skindelete');\r
3814                 self::pagefoot();\r
3815                 return;\r
3816         }\r
3817         \r
3818         /**\r
3819          * Admin::action_skindeleteconfirm()\r
3820          * \r
3821          * @param       void\r
3822          * @return      void\r
3823          */\r
3824         static private function action_skindeleteconfirm()\r
3825         {\r
3826                 global $member, $CONF, $manager;\r
3827                 \r
3828                 $skinid = intRequestVar('skinid');\r
3829                 \r
3830                 $member->isAdmin() or self::disallow();\r
3831                 \r
3832                 // don't allow default skin to be deleted\r
3833                 if ( $skinid == $CONF['BaseSkin'] )\r
3834                 {\r
3835                         self::error(_ERROR_DEFAULTSKIN);\r
3836                 }\r
3837                 \r
3838                 // don't allow deletion of default skins for blogs\r
3839                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3840                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3841                 \r
3842                 $r = sql_query($query);\r
3843                 if ( $o = sql_fetch_object($r) )\r
3844                 {\r
3845                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3846                 }\r
3847                 \r
3848                 $data = array('skinid' => $skinid);\r
3849                 $manager->notify('PreDeleteSkin', $data);\r
3850                 \r
3851                 // 1. delete description\r
3852                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3853                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3854                 sql_query($query);\r
3855                 \r
3856                 // 2. delete parts\r
3857                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3858                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3859                 sql_query($query);\r
3860                 \r
3861                 $data = array('skinid' => $skinid);\r
3862                 $manager->notify('PostDeleteSkin', $data);\r
3863                 \r
3864                 self::$action_skinoverview();\r
3865                 return;\r
3866         }\r
3867         \r
3868         /**\r
3869          * Admin::action_skinremovetype()\r
3870          * \r
3871          * @param       void\r
3872          * @return      void\r
3873          */\r
3874         static private function action_skinremovetype()\r
3875         {\r
3876                 global $member, $manager, $CONF;\r
3877                 \r
3878                 $member->isAdmin() or self::disallow();\r
3879                 \r
3880                 $skinid = intRequestVar('skinid');\r
3881                 $skintype = requestVar('type');\r
3882                 \r
3883                 if ( !isValidShortName($skintype) )\r
3884                 {\r
3885                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3886                 }\r
3887                 \r
3888                 // don't allow default skinparts to be deleted\r
3889                 /* TODO: this array should be retrieved from Action class */\r
3890                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3891                 {\r
3892                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3893                 }\r
3894                 \r
3895                 self::pagehead();\r
3896                 self::$skin->parse('skinremovetype');\r
3897                 self::pagefoot();\r
3898                 return;\r
3899         }\r
3900         \r
3901         /**\r
3902          * Admin::action_skinremovetypeconfirm()\r
3903          * \r
3904          * @param       void\r
3905          * @return      void\r
3906          */\r
3907         static private function action_skinremovetypeconfirm()\r
3908         {\r
3909                 global $member, $CONF, $manager;\r
3910                 \r
3911                 $member->isAdmin() or self::disallow();\r
3912                 \r
3913                 $skinid = intRequestVar('skinid');\r
3914                 $skintype = requestVar('type');\r
3915                 \r
3916                 if ( !isValidShortName($skintype) )\r
3917                 {\r
3918                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3919                 }\r
3920                 \r
3921                 // don't allow default skinparts to be deleted\r
3922                 /* TODO: this array should be retrieved from Action class */\r
3923                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3924                 {\r
3925                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3926                 }\r
3927                 \r
3928                 $data = array(\r
3929                         'skinid'   => $skinid,\r
3930                         'skintype' => $skintype\r
3931                 );\r
3932                 $manager->notify('PreDeleteSkinPart', $data);\r
3933                 \r
3934                 // delete part\r
3935                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3936                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3937                 sql_query($query);\r
3938                 \r
3939                 $data = array(\r
3940                         'skinid'   => $skinid,\r
3941                         'skintype' => $skintype\r
3942                 );\r
3943                 $manager->notify('PostDeleteSkinPart', $data);\r
3944                 \r
3945                 self::$action_skinedit();\r
3946                 return;\r
3947         }\r
3948 \r
3949         /**\r
3950          * Admin::action_skinclone()\r
3951          * \r
3952          * @param       void\r
3953          * @return      void\r
3954          */\r
3955         static private function action_skinclone()\r
3956         {\r
3957                 global $member;\r
3958                 \r
3959                 $member->isAdmin() or self::disallow();\r
3960                 \r
3961                 $skinid = intRequestVar('skinid');\r
3962                 \r
3963                 // 1. read skin to clone\r
3964                 $skin = new Skin($skinid);\r
3965                 \r
3966                 $name = "clone_{$skin->getName()}";\r
3967                 \r
3968                 // if a skin with that name already exists:\r
3969                 if ( Skin::exists($name) )\r
3970                 {\r
3971                         $i = 1;\r
3972                         while (Skin::exists($name . $i))\r
3973                                 $i++;\r
3974                         $name .= $i;\r
3975                 }\r
3976                 \r
3977                 // 2. create skin desc\r
3978                 $newid = Skin::createNew(\r
3979                         $name,\r
3980                         $skin->getDescription(),\r
3981                         $skin->getContentType(),\r
3982                         $skin->getIncludeMode(),\r
3983                         $skin->getIncludePrefix()\r
3984                 );\r
3985                 \r
3986                 // 3. clone\r
3987                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
3988                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3989                 \r
3990                 $res = sql_query($query);\r
3991                 while ( $row = sql_fetch_assoc($res) )\r
3992                 {\r
3993                         self::$skinclonetype($skin, $newid, $row['stype']);\r
3994                 }\r
3995                 \r
3996                 self::$action_skinoverview();\r
3997                 return;\r
3998         }\r
3999         \r
4000         /**\r
4001          * Admin::skinclonetype()\r
4002          * \r
4003          * @param       String  $skin   Skin object\r
4004          * @param       Integer $newid  ID for this clone\r
4005          * @param       String  $type   type of skin\r
4006          * @return      Void\r
4007          */\r
4008         static private function skinclonetype($skin, $newid, $type)\r
4009         {\r
4010                 $newid = intval($newid);\r
4011                 $content = $skin->getContent($type);\r
4012                 \r
4013                 if ( $content )\r
4014                 {\r
4015                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4016                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4017                         sql_query($query);\r
4018                 }\r
4019                 return;\r
4020         }\r
4021         \r
4022         /**\r
4023          * Admin::action_adminskinoverview()\r
4024          * \r
4025          * @param       void\r
4026          * @return      void\r
4027          */\r
4028         static private function action_adminskinoverview()\r
4029         {\r
4030                 global $member, $manager;\r
4031                 \r
4032                 $member->isAdmin() or self::disallow();\r
4033                 \r
4034                 self::pagehead();\r
4035                 self::$skin->parse('adminskinoverview');\r
4036                 self::pagefoot();\r
4037                 return;\r
4038         }\r
4039         \r
4040         /**\r
4041          * Admin::action_adminskinnew()\r
4042          * \r
4043          * @param       void\r
4044          * @return      void\r
4045          */\r
4046         static private function action_adminskinnew()\r
4047         {\r
4048                 global $member;\r
4049                 $member->isAdmin() or self::disallow();\r
4050                 $name = trim(postVar('name'));\r
4051                 $desc = trim(postVar('desc'));\r
4052                 \r
4053                 if ( !isValidSkinName($name) )\r
4054                 {\r
4055                         self::error(_ERROR_BADSKINNAME);\r
4056                 }\r
4057                 if ( Skin::exists($name) )\r
4058                 {\r
4059                         self::error(_ERROR_DUPSKINNAME);\r
4060                 }\r
4061                 /* TODO: $newId is not reused... */\r
4062                 $newId = Skin::createNew($name, $desc);\r
4063                 self::$action_adminskinoverview();\r
4064                 return;\r
4065         }\r
4066         \r
4067         /**\r
4068          * Admin::action_adminskinedit()\r
4069          * \r
4070          * @param       void\r
4071          * @return      void\r
4072          */\r
4073         static private function action_adminskinedit()\r
4074         {\r
4075                 global $member, $manager;\r
4076                 \r
4077                 $member->isAdmin() or self::disallow();\r
4078                 self::pagehead();\r
4079                 self::$skin->parse('adminskinedit');\r
4080                 self::pagefoot();\r
4081                 return;\r
4082         }\r
4083         \r
4084         /**\r
4085          * Admin::action_adminskineditgeneral()\r
4086          * \r
4087          * @param       void\r
4088          * @return      void\r
4089          */\r
4090         static private function action_adminskineditgeneral()\r
4091         {\r
4092                 global $member;\r
4093                 \r
4094                 $skinid = intRequestVar('skinid');\r
4095                 \r
4096                 $member->isAdmin() or self::disallow();\r
4097                 \r
4098                 $name           = postVar('name');\r
4099                 $desc           = postVar('desc');\r
4100                 $type           = postVar('type');\r
4101                 $inc_mode       = postVar('inc_mode');\r
4102                 $inc_prefix     = postVar('inc_prefix');\r
4103                 \r
4104                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4105                 \r
4106                 // 1. Some checks\r
4107                 if ( !isValidSkinName($name) )\r
4108                 {\r
4109                         self::error(_ERROR_BADSKINNAME);\r
4110                 }\r
4111                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4112                 {\r
4113                         self::error(_ERROR_DUPSKINNAME);\r
4114                 }\r
4115                 if ( !$type )\r
4116                 {\r
4117                         $type = 'text/html';\r
4118                 }\r
4119                 if ( !$inc_mode )\r
4120                 {\r
4121                         $inc_mode = 'normal';\r
4122                 }\r
4123                 // 2. Update description\r
4124                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4125                 self::$action_adminskinedit();\r
4126                 return;\r
4127         }\r
4128         \r
4129         /**\r
4130          * Admin::action_adminskinedittype()\r
4131          * \r
4132          * @param       string  $msg    message for pageheader\r
4133          * @return      void\r
4134          */\r
4135         static private function action_adminskinedittype($msg = '')\r
4136         {\r
4137                 global $member, $manager;\r
4138                 \r
4139                 $member->isAdmin() or self::disallow();\r
4140                 \r
4141                 if ( $msg )\r
4142                 {\r
4143                         self::$headMess = $msg;\r
4144                 }\r
4145                 $type = requestVar('type');\r
4146                 $type = trim($type);\r
4147                 $type = strtolower($type);\r
4148                 \r
4149                 if ( !isValidShortName($type) )\r
4150                 {\r
4151                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4152                 }\r
4153                 \r
4154                 self::pagehead();\r
4155                 self::$skin->parse('adminskinedittype');\r
4156                 self::pagefoot();\r
4157                 return;\r
4158         }\r
4159         \r
4160         /**\r
4161          * Admin::action_adminskinupdate()\r
4162          * \r
4163          * @param       void\r
4164          * @return      void\r
4165          */\r
4166         static private function action_adminskinupdate()\r
4167         {\r
4168                 global $member;\r
4169                 $skinid         = intRequestVar('skinid');\r
4170                 $content        = trim(postVar('content'));\r
4171                 $type           = postVar('type');\r
4172                 \r
4173                 $member->isAdmin() or self::disallow();\r
4174                 \r
4175                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4176                 $skin->update($type, $content);\r
4177                 self::$action_adminskinedittype(_SKIN_UPDATED);\r
4178                 return;\r
4179         }\r
4180         \r
4181         /**\r
4182          * Admin::action_adminskindelete()\r
4183          * \r
4184          * @param       void\r
4185          * @return      void\r
4186          */\r
4187         static private function action_adminskindelete()\r
4188         {\r
4189                 global $member, $manager, $CONF;\r
4190                 $member->isAdmin() or self::disallow();\r
4191                 \r
4192                 /* TODO: needless variable $skinid... */\r
4193                 $skinid = intRequestVar('skinid');\r
4194                 self::pagehead();\r
4195                 self::$skin->parse('adminskindelete');\r
4196                 self::pagefoot();\r
4197                 return;\r
4198         }\r
4199 \r
4200         /**\r
4201          * Admin::action_adminskindeleteconfirm()\r
4202          * \r
4203          * @param       void\r
4204          * @return      void\r
4205          */\r
4206         static private function action_adminskindeleteconfirm()\r
4207         {\r
4208                 global $member, $CONF, $manager;\r
4209                 $member->isAdmin() or self::disallow();\r
4210                 $skinid = intRequestVar('skinid');\r
4211                 // don't allow default skin to be deleted\r
4212                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4213                 {\r
4214                         self::error(_ERROR_DEFAULTSKIN);\r
4215                 }\r
4216                 \r
4217                 // don't allow deletion of default skins for members\r
4218                 $memberDefaults =  $member->getAdminSkin();\r
4219                 foreach ( $memberDefaults as $memID => $adminskin )\r
4220                 {\r
4221                         if ( $skinid == $adminskin )\r
4222                         {\r
4223                                 $mem = MEMBER::createFromID($memID);\r
4224                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4225                         }\r
4226                 }\r
4227                 \r
4228                 $data = array('skinid' => (integer) $skinid);\r
4229                 $manager->notify('PreDeleteAdminSkin', $data);\r
4230                 \r
4231                 // 1. delete description\r
4232                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
4233                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
4234                 sql_query($query);\r
4235                 \r
4236                 // 2. delete parts\r
4237                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
4238                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
4239                 \r
4240                 sql_query($query);\r
4241                 \r
4242                 $data = array('skinid' => intval($skinid));\r
4243                 $manager->notify('PostDeleteAdminSkin', $data);\r
4244                 self::$action_adminskinoverview();\r
4245                 return;\r
4246         }\r
4247         \r
4248         /**\r
4249          * Admin::action_adminskinremovetype()\r
4250          * \r
4251          * @param       void\r
4252          * @return      void\r
4253          */\r
4254         static private function action_adminskinremovetype()\r
4255         {\r
4256                 global $member, $manager, $CONF;\r
4257 \r
4258                 $member->isAdmin() or self::disallow();\r
4259                 \r
4260                 $skinid         = intRequestVar('skinid');\r
4261                 $skintype       = requestVar('type');\r
4262                 \r
4263                 if ( !isValidShortName($skintype) )\r
4264                 {\r
4265                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4266                 }\r
4267                 \r
4268                 self::pagehead();\r
4269                 self::$skin->parse('adminskinremovetype');\r
4270                 self::pagefoot();\r
4271                 return;\r
4272         }\r
4273         \r
4274         /**\r
4275          * Admin::action_adminskinremovetypeconfirm()\r
4276          * \r
4277          * @param       void\r
4278          * @return      void\r
4279          */\r
4280         static private function action_adminskinremovetypeconfirm()\r
4281         {\r
4282                 global $member, $CONF, $manager;\r
4283                 \r
4284                 $member->isAdmin() or self::disallow();\r
4285                 \r
4286                 $skinid         = intRequestVar('skinid');\r
4287                 $skintype       = requestVar('type');\r
4288                 \r
4289                 if ( !isValidShortName($skintype) )\r
4290                 {\r
4291                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4292                 }\r
4293                 \r
4294                 $data =array(\r
4295                         'skinid'        => $skinid,\r
4296                         'skintype'      => $skintype\r
4297                 );\r
4298                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4299                 \r
4300                 // delete part\r
4301                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4302                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4303                 sql_query($query);\r
4304                 \r
4305                 $data = array(\r
4306                         'skinid'        => $skinid,\r
4307                         'skintype'      => $skintype\r
4308                 );\r
4309                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4310                 \r
4311                 self::$action_adminskinedit();\r
4312                 return;\r
4313         }\r
4314 \r
4315         /**\r
4316          * Admin::action_adminskinclone()\r
4317          * \r
4318          * @param       void\r
4319          * @return      void\r
4320          */\r
4321         static private function action_adminskinclone()\r
4322         {\r
4323                 global $member;\r
4324                 \r
4325                 $member->isAdmin() or self::disallow();\r
4326                 \r
4327                 $skinid = intRequestVar('skinid');\r
4328                 \r
4329                 // 1. read skin to clone\r
4330                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4331                 $name = "clone_{$skin->getName()}";\r
4332                 \r
4333                 // if a skin with that name already exists:\r
4334                 if ( Skin::exists($name) )\r
4335                 {\r
4336                         $i = 1;\r
4337                         while ( Skin::exists($name . $i) )\r
4338                         {\r
4339                                 $i++;\r
4340                         }\r
4341                         $name .= $i;\r
4342                 }\r
4343                 \r
4344                 // 2. create skin desc\r
4345                 $newid = Skin::createNew(\r
4346                         $name,\r
4347                         $skin->getDescription(),\r
4348                         $skin->getContentType(),\r
4349                         $skin->getIncludeMode(),\r
4350                         $skin->getIncludePrefix()\r
4351                 );\r
4352                 \r
4353                 $query = "SELECT stype %s FROM WHERE sdesc=%d;";\r
4354                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4355                 \r
4356                 $res = sql_query($query);\r
4357                 while ( $row = sql_fetch_assoc($res) )\r
4358                 {\r
4359                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4360                 }\r
4361                 self::$action_adminskinoverview();\r
4362                 return;\r
4363         }\r
4364         \r
4365         /**\r
4366          * Admin::adminskinclonetype()\r
4367          * \r
4368          * @param       string  $skin   an instance of Skin class\r
4369          * @param       integer $newid  ID for new skin\r
4370          * @param       string  $type   skin type\r
4371          * @return      void\r
4372          */\r
4373         static private function adminskinclonetype($skin, $newid, $type)\r
4374         {\r
4375                 $content = $skin->getContent($type);\r
4376                 \r
4377                 if ( $content )\r
4378                 {\r
4379                         $content        = sql_real_escape_string($content);\r
4380                         $type           = sql_real_escape_string($type);\r
4381                         \r
4382                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4383                         $query = sprintf(sql_table('skin'), (integer) $newid, $content, $type);\r
4384                         sql_query($query);\r
4385                 }\r
4386                 return;\r
4387         }\r
4388         \r
4389         /**\r
4390          * Admin::action_adminskinieoverview()\r
4391          * \r
4392          * @param       void\r
4393          * @return      void\r
4394          */\r
4395         static private function action_adminskinieoverview()\r
4396         {\r
4397                 global $member, $DIR_LIBS, $manager;\r
4398                 \r
4399                 $member->isAdmin() or self::disallow();\r
4400                 \r
4401                 // load skinie class\r
4402                 include_once($DIR_LIBS . 'skinie.php');\r
4403                 \r
4404                 self::pagehead();\r
4405                 self::$skin->parse('adminskinieoverview');\r
4406                 self::pagefoot();\r
4407                 return;\r
4408         }\r
4409 \r
4410         /**\r
4411          * Admin::action_adminskinieimport()\r
4412          * \r
4413          * @param       void\r
4414          * @return      void\r
4415          */\r
4416         static private function action_adminskinieimport()\r
4417         {\r
4418                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4419                 \r
4420                 $member->isAdmin() or self::disallow();\r
4421                 \r
4422                 // load skinie class\r
4423                 include_once($DIR_LIBS . 'skinie.php');\r
4424                 \r
4425                 $skinFileRaw    = postVar('skinfile');\r
4426                 $mode                   = postVar('mode');\r
4427                 \r
4428                 $importer = new SKINIMPORT();\r
4429                 \r
4430                 // get full filename\r
4431                 if ( $mode == 'file' )\r
4432                 {\r
4433                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4434                         \r
4435                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4436                         if ( !file_exists($skinFile) )\r
4437                         {\r
4438                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4439                         }\r
4440                 }\r
4441                 else\r
4442                 {\r
4443                         $skinFile = $skinFileRaw;\r
4444                 }\r
4445                 \r
4446                 // read only metadata\r
4447                 $error = $importer->readFile($skinFile, 1);\r
4448                 if ( $error )\r
4449                 {\r
4450                         self::error($error);\r
4451                 }\r
4452                 \r
4453                 /* TODO: we should consider to use the other way instead of this */\r
4454                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4455                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4456                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4457                 \r
4458                 // clashes\r
4459                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4460                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4461                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4462                 /* TODO: we should consider to use the other way instead of this */\r
4463                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4464                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4465                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4466                 \r
4467                 self::pagehead();\r
4468                 self::$skin->parse('adminskinieimport');\r
4469                 self::pagefoot();\r
4470                 return;\r
4471         }\r
4472         \r
4473         /**\r
4474          * Admin::action_adminskiniedoimport()\r
4475          * \r
4476          * @param       void\r
4477          * @return      void\r
4478          */\r
4479         static private function action_adminskiniedoimport()\r
4480         {\r
4481                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4482                 \r
4483                 $member->isAdmin() or self::disallow();\r
4484                 \r
4485                 // load skinie class\r
4486                 include_once($DIR_LIBS . 'skinie.php');\r
4487                 \r
4488                 $skinFileRaw    = postVar('skinfile');\r
4489                 $mode                   = postVar('mode');\r
4490                 $allowOverwrite = intPostVar('overwrite');\r
4491                 \r
4492                 // get full filename\r
4493                 if ( $mode == 'file' )\r
4494                 {\r
4495                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4496                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4497                         if ( !file_exists($skinFile) )\r
4498                         {\r
4499                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4500                         }\r
4501                 }\r
4502                 else\r
4503                 {\r
4504                         $skinFile = $skinFileRaw;\r
4505                 }\r
4506                 \r
4507                 $importer = new SKINIMPORT();\r
4508                 \r
4509                 $error = $importer->readFile($skinFile);\r
4510                 if ( $error )\r
4511                 {\r
4512                         self::error($error);\r
4513                 }\r
4514                 \r
4515                 $error = $importer->writeToDatabase($allowOverwrite);\r
4516                 if ( $error )\r
4517                 {\r
4518                         self::error($error);\r
4519                 }\r
4520                 \r
4521                 /* TODO: we should consider to use the other way instead of this */\r
4522                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4523                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4524                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4525                 \r
4526                 self::pagehead();\r
4527                 self::$skin->parse('adminskiniedoimport');\r
4528                 self::pagefoot();\r
4529                 return;\r
4530         }\r
4531 \r
4532         /**\r
4533          * Admin::action_adminskinieexport()\r
4534          * \r
4535          * @param       void\r
4536          * @return      void\r
4537          */\r
4538         static private function action_adminskinieexport()\r
4539         {\r
4540                 global $member, $DIR_PLUGINS;\r
4541                 \r
4542                 $member->isAdmin() or self::disallow();\r
4543                 \r
4544                 // load skinie class\r
4545                 $aSkins = requestIntArray('skin');\r
4546                 if (!is_array($aSkins)) {\r
4547                         $aSkins = array();\r
4548                 }\r
4549                 $skinList = array_keys($aSkins);\r
4550                 \r
4551                 $aTemplates = requestIntArray('template');\r
4552                 if (!is_array($aTemplates))\r
4553                 {\r
4554                         $aTemplates = array();\r
4555                 }\r
4556                 $templateList = array_keys($aTemplates);\r
4557                 \r
4558                 $info = postVar('info');\r
4559                 \r
4560                 $exporter = new SkinEXPORT();\r
4561                 foreach ( $skinList as $skinId )\r
4562                 {\r
4563                         $exporter->addSkin($skinId);\r
4564                 }\r
4565                 foreach ( $templateList as $templateId )\r
4566                 {\r
4567                         $exporter->addTemplate($templateId);\r
4568                 }\r
4569                 $exporter->setInfo($info);\r
4570                 $exporter->export();\r
4571                 return;\r
4572         }\r
4573         \r
4574         /**\r
4575          * Admin::action_settingsedit()\r
4576          * \r
4577          * @param       Void\r
4578          * @return      Void\r
4579          */\r
4580         static private function action_settingsedit()\r
4581         {\r
4582                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4583                 \r
4584                 $member->isAdmin() or self::disallow();\r
4585                 \r
4586                 self::pagehead();\r
4587                 self::$skin->parse('settingsedit');\r
4588                 self::pagefoot();\r
4589                 return;\r
4590         }\r
4591         \r
4592         /**\r
4593          * Admin::action_settingsupdate()\r
4594          * Update $CONFIG and redirect\r
4595          * \r
4596          * @param       void\r
4597          * @return      void\r
4598          */\r
4599         static private function action_settingsupdate()\r
4600         {\r
4601                 global $member, $CONF;\r
4602                 \r
4603                 $member->isAdmin() or self::disallow();\r
4604                 \r
4605                 // check if email address for admin is valid\r
4606                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4607                 {\r
4608                         self::error(_ERROR_BADMAILADDRESS);\r
4609                 }\r
4610                 \r
4611                 // save settings\r
4612                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4613                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4614                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4615                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4616                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4617                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4618                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4619                 self::updateConfig('Locale',                    postVar('Locale'));\r
4620                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4621                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4622                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4623                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4624                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4625                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4626                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4627                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4628                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4629                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4630                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4631                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4632                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4633                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4634                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4635                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4636                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4637                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4638                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4639                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4640                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4641                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4642                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4643                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4644                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4645                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4646                 \r
4647                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4648                 // note that when changing cookie settings, this redirect might cause the user\r
4649                 // to have to log in again.\r
4650                 getConfig();\r
4651                 redirect($CONF['AdminURL'] . '?action=manage');\r
4652                 return;\r
4653         }\r
4654         \r
4655         /**\r
4656          * Admin::action_systemoverview()\r
4657          * Output system overview\r
4658          * \r
4659          * @param       void\r
4660          * @return      void\r
4661          */\r
4662         static private function action_systemoverview()\r
4663         {\r
4664                 self::pagehead();\r
4665                 self::$skin->parse('systemoverview');\r
4666                 self::pagefoot();\r
4667                 return;\r
4668         }\r
4669         \r
4670         /**\r
4671          * Admin::updateConfig()\r
4672          * \r
4673          * @param       string  $name   \r
4674          * @param       string  $val    \r
4675          * @return      integer return the ID in which the latest query posted\r
4676          */\r
4677         static private function updateConfig($name, $val)\r
4678         {\r
4679                 $name = sql_real_escape_string($name);\r
4680                 $val = trim(sql_real_escape_string($val));\r
4681                 \r
4682                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4683                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4684                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4685                 return sql_insert_id();\r
4686         }\r
4687         \r
4688         /**\r
4689          * Admin::error()\r
4690          * Error message\r
4691          * \r
4692          * @param       string  $msg    message that will be shown\r
4693          * @return      void\r
4694          */\r
4695         static private function error($msg)\r
4696         {\r
4697                 self::pagehead();\r
4698                 self::parse('adminerrorpage');\r
4699                 self::pagefoot();\r
4700                 return;\r
4701         }\r
4702         \r
4703         /**\r
4704          * Admin::disallow()\r
4705          * add error log and show error page \r
4706          * \r
4707          * @param       void\r
4708          * @return      void\r
4709          */\r
4710         static private function disallow()\r
4711         {\r
4712                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4713                 self::error(_ERROR_DISALLOWED);\r
4714                 return;\r
4715         }\r
4716         \r
4717         /**\r
4718          * Admin::pagehead()\r
4719          * Output admin page head\r
4720          * \r
4721          * @param       void\r
4722          * @return      void\r
4723          */\r
4724         static private function pagehead($extrahead = '')\r
4725         {\r
4726                 global $member, $nucleus, $CONF, $manager;\r
4727                 \r
4728                 if ( self::existsSkinContents('pagehead') )\r
4729                 {\r
4730                         if ( isset($extrahead) && !empty($extrahead) )\r
4731                         {\r
4732                         self::$extrahead = $extrahead;\r
4733                         }\r
4734                         self::parse('pagehead');\r
4735                 }\r
4736                 else\r
4737                 {\r
4738                         $data = array(\r
4739                                 'extrahead'     => &$extrahead,\r
4740                                 'action'        => self::$action\r
4741                         );\r
4742                         \r
4743                         $manager->notify('AdminPrePageHead', $data);\r
4744                         \r
4745                         $baseUrl = Entity::hsc($CONF['AdminURL']);\r
4746                         \r
4747                         /*\r
4748                          * TODO: obsoleted\r
4749                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4750                         {\r
4751                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4752                                 $CONF['AdminCSS'] = 'original';\r
4753                         }\r
4754                         */\r
4755                         \r
4756                         /* HTTP 1.1 application for no caching */\r
4757                         header("Cache-Control: no-cache, must-revalidate");\r
4758                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4759                         \r
4760                         $root_element = 'html';\r
4761                         $charset = i18n::get_current_charset();\r
4762                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4763                         $xml_version_info = self::$xml_version_info;\r
4764                         $formal_public_identifier = self::$formal_public_identifier;\r
4765                         $system_identifier = self::$system_identifier;\r
4766                         $xhtml_namespace = self::$xhtml_namespace;\r
4767                         \r
4768                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4769                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4770                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4771                         echo "<head>\n";\r
4772                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4773                         /*\r
4774                          * TODO: obsoleted\r
4775                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4776                         */\r
4777                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";\r
4778                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4779                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4780                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4781                         echo "{$extrahead}\n";\r
4782                         echo "</head>\n\n";\r
4783                         echo "<body>\n";\r
4784                         echo "<div id=\"adminwrapper\">\n";\r
4785                         echo "<div class=\"header\">\n";\r
4786                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4787                         echo "</div>\n";\r
4788                         echo "<div id=\"container\">\n";\r
4789                         echo "<div id=\"content\">\n";\r
4790                         echo "<div class=\"loginname\">\n";\r
4791                         if ( $member->isLoggedIn() )\r
4792                         {\r
4793                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4794                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4795                         }\r
4796                         else\r
4797                         {\r
4798                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4799                         }\r
4800                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4801                         echo '(';\r
4802                         \r
4803                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4804                         {\r
4805                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4806                         }\r
4807                         else\r
4808                         {\r
4809                                 $codenamestring = '';\r
4810                         }\r
4811                         \r
4812                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4813                         {\r
4814                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4815                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4816                                 \r
4817                                 $newestVersion = getLatestVersion();\r
4818                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4819                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4820                                 \r
4821                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4822                                 {\r
4823                                         echo "<br />\n";\r
4824                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4825                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4826                                         echo "</a>";\r
4827                                 }\r
4828                         }\r
4829                         else\r
4830                         {\r
4831                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4832                         }\r
4833                         echo ')';\r
4834                         echo '</div>';\r
4835                 }\r
4836                 return;\r
4837         }\r
4838         \r
4839         /**\r
4840          * Admin::pagefoot()\r
4841          * Output admin page foot include quickmenu\r
4842          * \r
4843          * @param       void\r
4844          * @return      void\r
4845          */\r
4846         static private function pagefoot()\r
4847         {\r
4848                 global $action, $member, $manager;\r
4849                 \r
4850                 if ( self::existsSkinContents('pagefoot') )\r
4851                 {\r
4852                         self::parse('pagefoot');\r
4853                         exit;\r
4854                 }\r
4855                 else\r
4856                 {\r
4857                         $data = array(\r
4858                                 'action' => self::$action\r
4859                         );\r
4860                         \r
4861                         $manager->notify('AdminPrePageFoot', $data);\r
4862                         \r
4863                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4864                         {\r
4865                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4866                                 echo "<ul>\n";\r
4867                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4868                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4869                                 echo "</ul>\n";\r
4870                         }\r
4871                         \r
4872                         echo "<div class=\"foot\">\n";\r
4873                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4874                         echo '-';\r
4875                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4876                         echo "</div>\n";\r
4877                         \r
4878                         echo "<div id=\"quickmenu\">\n";\r
4879                         \r
4880                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4881                         {\r
4882                                 echo "<ul>\n";\r
4883                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4884                                 echo "</ul>\n";\r
4885                                 \r
4886                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4887                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4888                                 echo "<p>\n";\r
4889                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4890                                 \r
4891                                 $showAll = requestVar('showall');\r
4892                                 \r
4893                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4894                                 {\r
4895                                         // Super-Admins have access to all blogs! (no add item support though)\r
4896                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4897                                         $query = sprintf($query, sql_table('blog'));\r
4898                                 }\r
4899                                 else\r
4900                                 {\r
4901                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4902                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4903                                 }\r
4904                                 $template['name']               = 'blogid';\r
4905                                 $template['tabindex']   = 15000;\r
4906                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4907                                 $template['selected']   = -1;\r
4908                                 $template['shorten']    = 10;\r
4909                                 $template['shortenel']  = '';\r
4910                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4911                                 showlist($query, 'select', $template);\r
4912                                 \r
4913                                 echo "</p>\n";\r
4914                                 echo "</form>\n";\r
4915                                 \r
4916                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4917                                 echo "<ul>\n";\r
4918                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4919                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4920                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4921                                 echo "</ul>\n";\r
4922                                 \r
4923                                 if ( $member->isAdmin() )\r
4924                                 {\r
4925                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4926                                         echo "<ul>\n";\r
4927                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4928                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4929                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4930                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4931                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4932                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4933                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4934                                         echo "</ul>\n";\r
4935                                         \r
4936                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4937                                         echo "<ul>\n";\r
4938                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4939                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4940                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4941                                         echo "</ul>\n";\r
4942                                 }\r
4943                                 \r
4944                                 $data = array('options' => array());\r
4945                                 \r
4946                                 $manager->notify('QuickMenu', $data);\r
4947                                 \r
4948                                 if ( count($data['options']) > 0 )\r
4949                                 {\r
4950                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4951                                         echo "<ul>\n";\r
4952                                         foreach ( $data['options'] as $option )\r
4953                                         {\r
4954                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
4955                                         }\r
4956                                         echo "</ul>\n";\r
4957                                 }\r
4958                         }\r
4959                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
4960                         {\r
4961                         \r
4962                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
4963                         }\r
4964                         else\r
4965                         {\r
4966                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
4967                         }\r
4968                         \r
4969                         echo "<!-- quickmenu -->\n";\r
4970                         echo "</div>\n";\r
4971                         \r
4972                         echo "<!-- content -->\n";\r
4973                         echo "</div>\n";\r
4974                         \r
4975                         echo "<!-- container -->\n";\r
4976                         echo "</div>\n";\r
4977                         \r
4978                         echo "<!-- adminwrapper -->\n";\r
4979                         echo "</div>\n";\r
4980                         \r
4981                         echo "</body>\n";\r
4982                         echo "</html>\n";\r
4983                 }\r
4984                 return;\r
4985         }\r
4986         \r
4987         /**\r
4988          * Admin::action_regfile()\r
4989          * \r
4990          * @param       void\r
4991          * @return      void\r
4992          */\r
4993         static private function action_regfile()\r
4994         {\r
4995                 global $member, $CONF;\r
4996                 \r
4997                 $blogid = intRequestVar('blogid');\r
4998                 \r
4999                 $member->teamRights($blogid) or self::disallow();\r
5000                 \r
5001                 // header-code stolen from phpMyAdmin\r
5002                 // REGEDIT and bookmarklet code stolen from GreyMatter\r
5003                 \r
5004                 $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));\r
5005                 \r
5006                 header('Content-Type: application/octetstream');\r
5007                 header('Content-Disposition: filename="nucleus.reg"');\r
5008                 header('Pragma: no-cache');\r
5009                 header('Expires: 0');\r
5010                 \r
5011                 echo "REGEDIT4\n";\r
5012                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";\r
5013                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";\r
5014                 echo '"contexts"=hex:31';\r
5015                 return;\r
5016         }\r
5017         \r
5018         /**\r
5019          * Admin::action_bookmarklet()\r
5020          * \r
5021          * @param       void\r
5022          * @return      void\r
5023          */\r
5024         static private function action_bookmarklet()\r
5025         {\r
5026                 global $member, $manager;\r
5027                 \r
5028                 $member->teamRights($blogid) or self::disallow();\r
5029                 \r
5030                 $blogid = intRequestVar('blogid');\r
5031                 \r
5032                 self::pagehead();\r
5033                 self::$skin->parse('bookmarklet');\r
5034                 self::pagefoot();\r
5035                 return;\r
5036         }\r
5037         \r
5038         /**\r
5039          * Admin::action_actionlog()\r
5040          * \r
5041          * @param       void\r
5042          * @return      void\r
5043          */\r
5044         static private function action_actionlog()\r
5045         {\r
5046                 global $member, $manager;\r
5047                 \r
5048                 $member->isAdmin() or self::disallow();\r
5049                 \r
5050                 self::pagehead();\r
5051                 self::$skin->parse('actionlog');\r
5052                 self::pagefoot();\r
5053                 return;\r
5054         }\r
5055         \r
5056         /**\r
5057          * Admin::action_banlist()\r
5058          * \r
5059          * @param       void\r
5060          * @return      void\r
5061          */\r
5062         static private function action_banlist()\r
5063         {\r
5064                 global $member, $manager;\r
5065                 \r
5066                 $member->blogAdminRights($blogid) or self::disallow();\r
5067                 \r
5068                 $blogid = intRequestVar('blogid');\r
5069                 \r
5070                 self::pagehead();\r
5071                 self::$skin->parse('banlist');\r
5072                 self::pagefoot();\r
5073                 return;\r
5074         }\r
5075         \r
5076         /**\r
5077          * Admin::action_banlistdelete()\r
5078          * \r
5079          * @param       void\r
5080          * @return      void\r
5081          */\r
5082         static private function action_banlistdelete()\r
5083         {\r
5084                 global $member, $manager;\r
5085                 \r
5086                 $blogid = intRequestVar('blogid');\r
5087                 $member->blogAdminRights($blogid) or self::disallow();\r
5088                 \r
5089                 self::pagehead();\r
5090                 self::$skin->parse('banlistdelete');\r
5091                 self::pagefoot();\r
5092                 return;\r
5093         }\r
5094         \r
5095         /**\r
5096          * Admin::action_banlistdeleteconfirm()\r
5097          * \r
5098          * @param       void\r
5099          * @return      void\r
5100          */\r
5101         static private function action_banlistdeleteconfirm()\r
5102         {\r
5103                 global $member, $manager;\r
5104                 \r
5105                 $member->blogAdminRights($blogid) or self::disallow();\r
5106                 \r
5107                 $blogid         = intPostVar('blogid');\r
5108                 $allblogs       = postVar('allblogs');\r
5109                 $iprange        = postVar('iprange');\r
5110                 \r
5111                 $deleted = array();\r
5112                 \r
5113                 if ( !$allblogs )\r
5114                 {\r
5115                         if ( Ban::removeBan($blogid, $iprange) )\r
5116                         {\r
5117                                 array_push($deleted, $blogid);\r
5118                         }\r
5119                 }\r
5120                 else\r
5121                 {\r
5122                         // get blogs fot which member has admin rights\r
5123                         $adminblogs = $member->getAdminBlogs();\r
5124                         foreach ($adminblogs as $blogje)\r
5125                         {\r
5126                                 if ( Ban::removeBan($blogje, $iprange) )\r
5127                                 {\r
5128                                         array_push($deleted, $blogje);\r
5129                                 }\r
5130                         }\r
5131                 }\r
5132                 \r
5133                 if ( sizeof($deleted) == 0 )\r
5134                 {\r
5135                         self::error(_ERROR_DELETEBAN);\r
5136                 }\r
5137                 \r
5138                 self::pagehead();\r
5139                 self::$skin->parse('banlistdeleteconfirm');\r
5140                 self::pagefoot();\r
5141                 return;\r
5142         }\r
5143         \r
5144         /**\r
5145          * Admin::action_banlistnewfromitem()\r
5146          * \r
5147          * @param       void\r
5148          * @return      void\r
5149          */\r
5150         static private function action_banlistnewfromitem()\r
5151         {\r
5152                 self::$action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5153                 return;\r
5154         }\r
5155         \r
5156         /**\r
5157          * Admin::action_banlistnew()\r
5158          * \r
5159          * @param       integer $blogid ID for weblog\r
5160          * @return      void\r
5161          */\r
5162         static private function action_banlistnew($blogid = '')\r
5163         {\r
5164                 global $member, $manager;\r
5165                 \r
5166                 if ( $blogid == '' )\r
5167                 {\r
5168                         $blogid = intRequestVar('blogid');\r
5169                 }\r
5170                 \r
5171                 $ip = requestVar('ip');\r
5172                 \r
5173                 $member->blogAdminRights($blogid) or self::disallow();\r
5174                 \r
5175                 /* TODO: we should consider to use the other way instead of this */\r
5176                 $_REQUEST['blogid'] = $blogid;          \r
5177                 \r
5178                 self::pagehead();\r
5179                 self::$skin->parse('banlistnew');\r
5180                 self::pagefoot();\r
5181                 \r
5182                 return;\r
5183         }\r
5184 \r
5185         /**\r
5186          * Admin::action_banlistadd()\r
5187          * \r
5188          * @param       void\r
5189          * @return      void\r
5190          */\r
5191         static private function action_banlistadd()\r
5192         {\r
5193                 global $member;\r
5194                 \r
5195                 $blogid         = intPostVar('blogid');\r
5196                 $allblogs       = postVar('allblogs');\r
5197                 $iprange        = postVar('iprange');\r
5198                 \r
5199                 if ( $iprange == "custom" )\r
5200                 {\r
5201                         $iprange = postVar('customiprange');\r
5202                 }\r
5203                 $reason   = postVar('reason');\r
5204                 \r
5205                 $member->blogAdminRights($blogid) or self::disallow();\r
5206                 \r
5207                 // TODO: check IP range validity\r
5208                 \r
5209                 if ( !$allblogs )\r
5210                 {\r
5211                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5212                         {\r
5213                                 self::error(_ERROR_ADDBAN);\r
5214                         }\r
5215                 }\r
5216                 else\r
5217                 {\r
5218                         // get blogs fot which member has admin rights\r
5219                         $adminblogs = $member->getAdminBlogs();\r
5220                         $failed = 0;\r
5221                         foreach ($adminblogs as $blogje)\r
5222                         {\r
5223                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5224                                 {\r
5225                                         $failed = 1;\r
5226                                 }\r
5227                         }\r
5228                         if ( $failed )\r
5229                         {\r
5230                                 self::error(_ERROR_ADDBAN);\r
5231                         }\r
5232                 }\r
5233                 self::$action_banlist();\r
5234                 return;\r
5235         }\r
5236         \r
5237         /**\r
5238          * Admin::action_clearactionlog()\r
5239          * \r
5240          * @param       void\r
5241          * @return      void\r
5242          */\r
5243         static private function action_clearactionlog()\r
5244         {\r
5245                 global $member;\r
5246                 \r
5247                 $member->isAdmin() or self::disallow();\r
5248                 \r
5249                 ActionLog::clear();\r
5250                 \r
5251                 self::$action_manage(_MSG_ACTIONLOGCLEARED);\r
5252                 return;\r
5253         }\r
5254         \r
5255         /**\r
5256          * Admin::action_backupoverview()\r
5257          * \r
5258          * @param       void\r
5259          * @return      void\r
5260          */\r
5261         static private function action_backupoverview()\r
5262         {\r
5263                 global $member, $manager;\r
5264                 \r
5265                 $member->isAdmin() or self::disallow();\r
5266                 \r
5267                 self::pagehead();\r
5268                 self::$skin->parse('backupoverview');\r
5269                 self::pagefoot();\r
5270                 return;\r
5271         }\r
5272 \r
5273         /**\r
5274          * Admin::action_backupcreate()\r
5275          * create file for backup\r
5276          * \r
5277          * @param               void\r
5278          * @return      void\r
5279          * \r
5280          */\r
5281         static private function action_backupcreate()\r
5282         {\r
5283                 global $member, $DIR_LIBS;\r
5284                 \r
5285                 $member->isAdmin() or self::disallow();\r
5286                 \r
5287                 // use compression ?\r
5288                 $useGzip = (integer) postVar('gzip');\r
5289                 \r
5290                 include($DIR_LIBS . 'backup.php');\r
5291                 \r
5292                 // try to extend time limit\r
5293                 // (creating/restoring dumps might take a while)\r
5294                 @set_time_limit(1200);\r
5295                 \r
5296                 Backup::do_backup($useGzip);\r
5297                 exit;\r
5298         }\r
5299         \r
5300         /**\r
5301          * Admin::action_backuprestore()\r
5302          * restoring from uploaded file\r
5303          * \r
5304          * @param               void\r
5305          * @return      void\r
5306          */\r
5307         static private function action_backuprestore()\r
5308         {\r
5309                 global $member, $DIR_LIBS;\r
5310                 \r
5311                 $member->isAdmin() or self::disallow();\r
5312                 \r
5313                 if ( intPostVar('letsgo') != 1 )\r
5314                 {\r
5315                         self::error(_ERROR_BACKUP_NOTSURE);\r
5316                 }\r
5317                 \r
5318                 include($DIR_LIBS . 'backup.php');\r
5319                 \r
5320                 // try to extend time limit\r
5321                 // (creating/restoring dumps might take a while)\r
5322                 @set_time_limit(1200);\r
5323                 \r
5324                 $message = Backup::do_restore();\r
5325                 if ( $message != '' )\r
5326                 {\r
5327                         self::error($message);\r
5328                 }\r
5329                 self::pagehead();\r
5330                 self::$skin->parse('backuprestore');\r
5331                 self::pagefoot();\r
5332                 return;\r
5333         }\r
5334         \r
5335         /**\r
5336          * Admin::action_pluginlist()\r
5337          * output the list of installed plugins\r
5338          * \r
5339          * @param       void\r
5340          * @return      void\r
5341          * \r
5342          */\r
5343         static private function action_pluginlist()\r
5344         {\r
5345                 global $DIR_PLUGINS, $member, $manager;\r
5346                 \r
5347                 // check if allowed\r
5348                 $member->isAdmin() or self::disallow();\r
5349                 \r
5350                 self::pagehead();\r
5351                 self::$skin->parse('pluginlist');\r
5352                 self::pagefoot();\r
5353                 return;\r
5354         }\r
5355         \r
5356         /**\r
5357          * Admin::action_pluginhelp()\r
5358          * \r
5359          * @param       void\r
5360          * @return      void\r
5361          */\r
5362         static private function action_pluginhelp()\r
5363         {\r
5364                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5365                 \r
5366                 // check if allowed\r
5367                 $member->isAdmin() or self::disallow();\r
5368                 \r
5369                 $plugid = intGetVar('plugid');\r
5370                 \r
5371                 if ( !$manager->pidInstalled($plugid) )\r
5372                 {\r
5373                         self::error(_ERROR_NOSUCHPLUGIN);\r
5374                 }\r
5375                 \r
5376                 self::pagehead();\r
5377                 self::$skin->parse('pluginhelp');\r
5378                 self::pagefoot();\r
5379                 return;\r
5380         }\r
5381         \r
5382         /**\r
5383          * Admin::action_pluginadd()\r
5384          * \r
5385          * @param       Void\r
5386          * @return      Void\r
5387          * \r
5388          */\r
5389         static private function action_pluginadd()\r
5390         {\r
5391                 global $member, $manager, $DIR_PLUGINS;\r
5392                 \r
5393                 // check if allowed\r
5394                 $member->isAdmin() or self::disallow();\r
5395                 \r
5396                 $name = postVar('filename');\r
5397                 \r
5398                 if ( $manager->pluginInstalled($name) )\r
5399                 {\r
5400                         self::error(_ERROR_DUPPLUGIN);\r
5401                 }\r
5402                 \r
5403                 if ( !checkPlugin($name) )\r
5404                 {\r
5405                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5406                 }\r
5407                 \r
5408                 // get number of currently installed plugins\r
5409                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5410                 $numCurrent = sql_num_rows($res);\r
5411                 \r
5412                 // plugin will be added as last one in the list\r
5413                 $newOrder = $numCurrent + 1;\r
5414                 \r
5415                 $data = array('file' => &$name);\r
5416                 $manager->notify('PreAddPlugin', $data);\r
5417                 \r
5418                 // do this before calling getPlugin (in case the plugin id is used there)\r
5419                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5420                 $query = sprintf(sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5421                 sql_query($query);\r
5422                 $iPid = sql_insert_id();\r
5423                 \r
5424                 $manager->clearCachedInfo('installedPlugins');\r
5425                 \r
5426                 // Load the plugin for condition checking and instalation\r
5427                 $plugin =& $manager->getPlugin($name);\r
5428                 \r
5429                 // check if it got loaded (could have failed)\r
5430                 if ( !$plugin )\r
5431                 {\r
5432                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5433                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5434                         \r
5435                         sql_query($query);\r
5436                         \r
5437                         $manager->clearCachedInfo('installedPlugins');\r
5438                         self::error(_ERROR_PLUGIN_LOAD);\r
5439                 }\r
5440                 \r
5441                 // check if plugin needs a newer Nucleus version\r
5442                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5443                 {\r
5444                         // uninstall plugin again...\r
5445                         self::deleteOnePlugin($plugin->getID());\r
5446                         \r
5447                         // ...and show error\r
5448                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5449                 }\r
5450                 \r
5451                 // check if plugin needs a newer Nucleus version\r
5452                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5453                 {\r
5454                         // uninstall plugin again...\r
5455                         self::deleteOnePlugin($plugin->getID());\r
5456                         \r
5457                         // ...and show error\r
5458                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5459                 }\r
5460                 \r
5461                 $pluginList = $plugin->getPluginDep();\r
5462                 foreach ( $pluginList as $pluginName )\r
5463                 {\r
5464                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5465                         if (sql_num_rows($res) == 0)\r
5466                         {\r
5467                                 // uninstall plugin again...\r
5468                                 self::deleteOnePlugin($plugin->getID());\r
5469                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5470                         }\r
5471                 }\r
5472                 \r
5473                 // call the install method of the plugin\r
5474                 $plugin->install();\r
5475                 \r
5476                 $data = array('plugin' => &$plugin);\r
5477                 $manager->notify('PostAddPlugin', $data);\r
5478                 \r
5479                 // update all events\r
5480                 self::$action_pluginupdate();\r
5481                 return;\r
5482         }\r
5483         \r
5484         /**\r
5485          * ADMIN:action_pluginupdate():\r
5486          * \r
5487          * @param       Void\r
5488          * @return      Void\r
5489          * \r
5490          */\r
5491         static private function action_pluginupdate()\r
5492         {\r
5493                 global $member, $manager, $CONF;\r
5494                 \r
5495                 // check if allowed\r
5496                 $member->isAdmin() or self::disallow();\r
5497                 \r
5498                 // delete everything from plugin_events\r
5499                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5500                 \r
5501                 // loop over all installed plugins\r
5502                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5503                 while ( $o = sql_fetch_object($res) )\r
5504                 {\r
5505                         $pid  =  $o->pid;\r
5506                         $plug =& $manager->getPlugin($o->pfile);\r
5507                         if ( $plug )\r
5508                         {\r
5509                                 $eventList = $plug->getEventList();\r
5510                                 foreach ( $eventList as $eventName )\r
5511                                 {\r
5512                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5513                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5514                                         sql_query($query);\r
5515                                 }\r
5516                         }\r
5517                 }\r
5518                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5519                 return;\r
5520         }\r
5521         \r
5522         /**\r
5523          * Admin::action_plugindelete()\r
5524          * \r
5525          * @param       void\r
5526          * @return      void\r
5527          */\r
5528         static private function action_plugindelete()\r
5529         {\r
5530                 global $member, $manager;\r
5531                 \r
5532                 // check if allowed\r
5533                 $member->isAdmin() or self::disallow();\r
5534                 \r
5535                 $pid = intGetVar('plugid');\r
5536                 \r
5537                 if ( !$manager->pidInstalled($pid) )\r
5538                 {\r
5539                         self::error(_ERROR_NOSUCHPLUGIN);\r
5540                 }\r
5541                 \r
5542                 self::pagehead();\r
5543                 self::$skin->parse('plugindelete');\r
5544                 self::pagefoot();\r
5545                 return;\r
5546         }\r
5547 \r
5548         /**\r
5549          * Admin::action_plugindeleteconfirm()\r
5550          * \r
5551          * @param       void\r
5552          * @return      void\r
5553          */\r
5554         static private function action_plugindeleteconfirm()\r
5555         {\r
5556                 global $member, $manager, $CONF;\r
5557                 \r
5558                 // check if allowed\r
5559                 $member->isAdmin() or self::disallow();\r
5560                 \r
5561                 $pid = intPostVar('plugid');\r
5562                 \r
5563                 $error = self::deleteOnePlugin($pid, 1);\r
5564                 if ( $error )\r
5565                 {\r
5566                         self::error($error);\r
5567                 }\r
5568                 \r
5569                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5570                 return;\r
5571         }\r
5572         \r
5573         /**\r
5574          * Admin::\r
5575          * \r
5576          * @param       void\r
5577          * @return      void\r
5578          */\r
5579         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5580         {\r
5581                 global $manager;\r
5582                 \r
5583                 $pid = intval($pid);\r
5584                 \r
5585                 if ( !$manager->pidInstalled($pid) )\r
5586                 {\r
5587                         return _ERROR_NOSUCHPLUGIN;\r
5588                 }\r
5589                 \r
5590                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5591                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5592                 $name = quickQuery($query);\r
5593                 \r
5594                 // check dependency before delete\r
5595                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5596                 while ($o = sql_fetch_object($res))\r
5597                 {\r
5598                         $plug =& $manager->getPlugin($o->pfile);\r
5599                         if ( $plug )\r
5600                         {\r
5601                                 $depList = $plug->getPluginDep();\r
5602                                 foreach ( $depList as $depName )\r
5603                                 {\r
5604                                         if ( $name == $depName )\r
5605                                         {\r
5606                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5607                                         }\r
5608                                 }\r
5609                         }\r
5610                 }\r
5611                 \r
5612                 $data = array('plugid' => $pid);\r
5613                 $manager->notify('PreDeletePlugin', $data);\r
5614                 \r
5615                 // call the unInstall method of the plugin\r
5616                 if ( $callUninstall )\r
5617                 {\r
5618                         $plugin =& $manager->getPlugin($name);\r
5619                         if ( $plugin )\r
5620                         {\r
5621                                 $plugin->unInstall();\r
5622                         }\r
5623                 }\r
5624                 \r
5625                 // delete all subscriptions\r
5626                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5627                 \r
5628                 // delete all options\r
5629                 // get OIDs from plugin_option_desc\r
5630                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5631                 $aOIDs = array();\r
5632                 while ($o = sql_fetch_object($res))\r
5633                 {\r
5634                         array_push($aOIDs, $o->oid);\r
5635                 }\r
5636                 \r
5637                 // delete from plugin_option and plugin_option_desc\r
5638                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5639                 if (count($aOIDs) > 0)\r
5640                 {\r
5641                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5642                 }\r
5643                 \r
5644                 // update order numbers\r
5645                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5646                 $o = sql_fetch_object($res);\r
5647                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5648                 \r
5649                 // delete row\r
5650                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5651                 \r
5652                 $manager->clearCachedInfo('installedPlugins');\r
5653                 $data = array('plugid' => $pid);\r
5654                 $manager->notify('PostDeletePlugin', $data);\r
5655                 \r
5656                 return '';\r
5657         }\r
5658         \r
5659         /**\r
5660          * Admin::action_pluginup()\r
5661          * \r
5662          * @param       void\r
5663          * @return      void\r
5664          */\r
5665         static private function action_pluginup()\r
5666         {\r
5667                 global $member, $manager, $CONF;\r
5668                 \r
5669                 // check if allowed\r
5670                 $member->isAdmin() or self::disallow();\r
5671                 \r
5672                 $plugid = intGetVar('plugid');\r
5673                 \r
5674                 if ( !$manager->pidInstalled($plugid) )\r
5675                 {\r
5676                         self::error(_ERROR_NOSUCHPLUGIN);\r
5677                 }\r
5678                 \r
5679                 // 1. get old order number\r
5680                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5681                 $o = sql_fetch_object($res);\r
5682                 $oldOrder = $o->porder;\r
5683                 \r
5684                 // 2. calculate new order number\r
5685                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5686                 \r
5687                 // 3. update plug numbers\r
5688                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5689                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5690                 \r
5691                 //self::$action_pluginlist();\r
5692                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5693                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5694                 return;\r
5695         }\r
5696         \r
5697         /**\r
5698          * Admin::action_plugindown()\r
5699          * \r
5700          * @param       void\r
5701          * @return      void\r
5702          */\r
5703         static private function action_plugindown()\r
5704         {\r
5705                 global $member, $manager, $CONF;\r
5706                 \r
5707                 // check if allowed\r
5708                 $member->isAdmin() or self::disallow();\r
5709                 \r
5710                 $plugid = intGetVar('plugid');\r
5711                 if ( !$manager->pidInstalled($plugid) )\r
5712                 {\r
5713                         self::error(_ERROR_NOSUCHPLUGIN);\r
5714                 }\r
5715                 \r
5716                 // 1. get old order number\r
5717                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5718                 $o = sql_fetch_object($res);\r
5719                 $oldOrder = $o->porder;\r
5720                 \r
5721                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5722                 $maxOrder = sql_num_rows($res);\r
5723                 \r
5724                 // 2. calculate new order number\r
5725                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5726                 \r
5727                 // 3. update plug numbers\r
5728                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5729                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5730                 \r
5731                 //self::$action_pluginlist();\r
5732                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5733                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5734                 return;\r
5735         }\r
5736         \r
5737         /**\r
5738          * Admin::action_pluginoptions()\r
5739          * \r
5740          * Output Plugin option page\r
5741          * \r
5742          * @access      public\r
5743          * @param       string $message message when fallbacked\r
5744          * @return      void\r
5745          * \r
5746          */\r
5747         static private function action_pluginoptions($message = '')\r
5748         {\r
5749                 global $member, $manager;\r
5750                 \r
5751                 // check if allowed\r
5752                 $member->isAdmin() or self::disallow();\r
5753                 \r
5754                 $pid = intRequestVar('plugid');\r
5755                 if ( !$manager->pidInstalled($pid) )\r
5756                 {\r
5757                         self::error(_ERROR_NOSUCHPLUGIN);\r
5758                 }\r
5759                 \r
5760                 if ( isset($message) )\r
5761                 {\r
5762                         self::$headMess = $message;\r
5763                 }\r
5764                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5765                 self::pagehead($extrahead);\r
5766                 self::$skin->parse('pluginoptions');\r
5767                 self::pagefoot();\r
5768                 return;\r
5769         }\r
5770         \r
5771         /**\r
5772          * Admin::action_pluginoptionsupdate()\r
5773          * \r
5774          * Update plugin options and fallback to plugin option page\r
5775          * \r
5776          * @access      public\r
5777          * @param       void\r
5778          * @return      void\r
5779          */\r
5780         static private function action_pluginoptionsupdate()\r
5781         {\r
5782                 global $member, $manager;\r
5783                 \r
5784                 // check if allowed\r
5785                 $member->isAdmin() or self::disallow();\r
5786                 \r
5787                 $pid = intRequestVar('plugid');\r
5788                 \r
5789                 if ( !$manager->pidInstalled($pid) )\r
5790                 {\r
5791                         self::error(_ERROR_NOSUCHPLUGIN);\r
5792                 }\r
5793                 \r
5794                 $aOptions = requestArray('plugoption');\r
5795                 NucleusPlugin::apply_plugin_options($aOptions);\r
5796                 \r
5797                 $data = array(\r
5798                         'context'       => 'global',\r
5799                         'plugid'        => $pid\r
5800                 );\r
5801                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5802                 \r
5803                 self::$action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5804                 return;\r
5805         }\r
5806         \r
5807         /**\r
5808          * Admin::insertPluginOptions()\r
5809          * \r
5810          * Output plugin option field\r
5811          * \r
5812          * @access      public\r
5813          * @param string        $context        plugin option context\r
5814          * @param integer       $contextid      plugin option context id\r
5815          * @return      void\r
5816          */\r
5817         static public function insertPluginOptions($context, $contextid = 0)\r
5818         {\r
5819                 global $manager;\r
5820                 \r
5821                 // get all current values for this contextid\r
5822                 // (note: this might contain doubles for overlapping contextids)\r
5823                 $aIdToValue = array();\r
5824                 \r
5825                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5826                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5827                 \r
5828                 $res = sql_query($query);\r
5829                 while ( $object = sql_fetch_object($res) )\r
5830                 {\r
5831                         $aIdToValue[$object->oid] = $object->ovalue;\r
5832                 }\r
5833                 \r
5834                 // get list of oids per pid\r
5835                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5836                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5837                 $res    = sql_query($query);\r
5838                 \r
5839                 $aOptions = array();\r
5840                 while ( $object = sql_fetch_object($res) )\r
5841                 {\r
5842                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5843                         {\r
5844                                 $value = $object->odef;\r
5845                         }\r
5846                         else\r
5847                         {\r
5848                                 $value = $aIdToValue[$object->oid];\r
5849                         }\r
5850                         \r
5851                         array_push(\r
5852                                 $aOptions,\r
5853                                 array(\r
5854                                         'pid'                   => $object->pid,\r
5855                                         'pfile'                 => $object->pfile,\r
5856                                         'oid'                   => $object->oid,\r
5857                                         'value'                 => $value,\r
5858                                         'name'                  => $object->oname,\r
5859                                         'description'   => $object->odesc,\r
5860                                         'type'                  => $object->otype,\r
5861                                         'typeinfo'              => $object->oextra,\r
5862                                         'contextid'             => $contextid,\r
5863                                         'extra'                 => ''\r
5864                                 )\r
5865                         );\r
5866                 }\r
5867                 \r
5868                 $data = array(\r
5869                         'context'       =>  $context,\r
5870                         'contextid'     =>  $contextid,\r
5871                         'options'       =>& $aOptions\r
5872                 );\r
5873                 $manager->notify('PrePluginOptionsEdit', $data);\r
5874                 \r
5875                 self::$aOptions = $aOptions;\r
5876                 self::$skin->parse('insertpluginoptions');\r
5877                 return;\r
5878         }\r
5879         \r
5880         /**\r
5881          * Admin::action_parseSpecialskin()\r
5882          * \r
5883          * @param       void\r
5884          * @return      void\r
5885          */\r
5886         static private function action_parseSpecialskin()\r
5887         {\r
5888                 self::pagehead();\r
5889                 self::$skin->parse(self::$action);\r
5890                 self::pagefoot();\r
5891                 return;\r
5892         }\r
5893         \r
5894         /*\r
5895          * TODO: use Skin class instead of this\r
5896         static private function parse($type)\r
5897         {\r
5898                 global $manager, $CONF;\r
5899                 \r
5900                 if ( $type == 'pagehead' )\r
5901                 {\r
5902                         $data = array(\r
5903                                 'skin' => &self::$skin,\r
5904                                 'type' => $type\r
5905                         );\r
5906                         \r
5907                         $manager->notify('InitAdminSkinParse', $data);\r
5908                         sendContentType(self::$skin->getContentType(), 'skin', i18n::get_current_charset());\r
5909                 }\r
5910                 \r
5911                 $contents = self::$skin->getContent($type);\r
5912                 \r
5913                 if ( !$contents )\r
5914                 {\r
5915                         echo _ERROR_SKIN;\r
5916                         return;\r
5917                 }\r
5918                 \r
5919                 $actions = self::$skin->getAllowedActionsForType($type);\r
5920                 \r
5921                 if ( $type == 'pagehead' )\r
5922                 {\r
5923                         $data = array(\r
5924                                 'skin'          => &self::$skin,\r
5925                                 'type'          => $type,\r
5926                                 'contents'      => &$contents\r
5927                         );\r
5928                         \r
5929                         $manager->notify('PreAdminSkinParse', $data);\r
5930                 }\r
5931                 \r
5932                 PARSER::setProperty('IncludeMode', self::$skin->getIncludeMode());\r
5933                 PARSER::setProperty('IncludePrefix', self::$skin->getIncludePrefix());\r
5934                 \r
5935                 if ( $type == 'createitem' || $type == 'itemedit' )\r
5936                 {\r
5937                         // TODO: where is this class???\r
5938                         $handler = new Factory(intRequestVar('blogid'), $type, self::$skin, $this);\r
5939                         $actions = array_merge($actions, $handler->actions);\r
5940                 }\r
5941                 else\r
5942                 {\r
5943                         // TODO: why???\r
5944                         $actions = array_merge($actions, self::$skin->getAllowedActionsForType($type));\r
5945                 }\r
5946                 \r
5947                 $parser = new Parser($actions, $handler);\r
5948                 $handler->setParser($parser);\r
5949                 $handler->setSkin(self::$skin);\r
5950                 $parser->parse($contents);\r
5951                 \r
5952                 if ( $type == 'pagefoot' )\r
5953                 {\r
5954                         $data = array(\r
5955                                 'skin'  => &self::$skin,\r
5956                                 'type'  => $type,\r
5957                         );\r
5958                         \r
5959                         $manager->notify('PostAdminSkinParse', $data);\r
5960                 }\r
5961                 return;\r
5962         }\r
5963         */\r
5964         \r
5965         /**\r
5966          * Admin::getAdminskinIDFromName()\r
5967          * \r
5968          * @param       string  $skinname       name of skin\r
5969          * @return      integer ID for skin\r
5970          */\r
5971         static private function getAdminskinIDFromName($skinname)\r
5972         {\r
5973                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5974                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5975                 $admnSknID      = quickQuery($query);\r
5976                 return (integer) $adminSkinID;\r
5977         }\r
5978         \r
5979         /**\r
5980          * Admin::getAdminskinNameFromID()\r
5981          * \r
5982          * @param       integer $skinid ID for skin\r
5983          * @return      integer ID for skin\r
5984          */\r
5985         static private function getAdminskinNameFromID($skinid)\r
5986         {\r
5987                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5988                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5989                 $admnSknID      = quickQuery($query);\r
5990                 return (integer) $adminSkinID;\r
5991         }\r
5992         \r
5993         /**\r
5994          * Admin::action_importAdmin()\r
5995          * \r
5996          * @param       void\r
5997          * @return      void\r
5998          */\r
5999         static private function action_importAdmin()\r
6000         {\r
6001                 global $DIR_ADMINSKINS, $action;\r
6002                 if ( $action == 'adminskinieimport' )\r
6003                 {\r
6004                         self::doAdminskinimport();\r
6005                 }\r
6006                 $skn = array();\r
6007                 if ( $action == 'showlogin' )\r
6008                 {\r
6009                         $skinName = 'showlogin';\r
6010                         $actnName = 'showlogin';\r
6011                 }\r
6012                 else\r
6013                 {\r
6014                         $skinName = 'defaultimporter';\r
6015                         $actnName = 'importAdmin';\r
6016                 }\r
6017                 \r
6018                 /* TODO: why??? */\r
6019                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6020                 $skn['id']                              = 0;\r
6021                 $skn['description']             = $skinName;\r
6022                 $skn['contentType']             = 'importAdmin';\r
6023                 $skn['includeMode']             = 'normal';\r
6024                 $skn['includePrefix']   = '';\r
6025                 $skn['name']                    = 'defaultinporter';\r
6026                 \r
6027                 self::$skin                             = (object) $skn;\r
6028                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6029                 $actions = Skin::getAllowedActionsForType($actnName);\r
6030                 \r
6031                 $parser = new PARSER($actions, $handler);\r
6032                 $handler->setParser($parser);\r
6033                 $handler->setSkin(self::$skin);\r
6034                 $parser->parse($contents);\r
6035                 return;\r
6036         }\r
6037         \r
6038         /**\r
6039          * Admin::doAdminskinimport()\r
6040          * \r
6041          * @param       void\r
6042          * @return      void\r
6043          */\r
6044         static private function doAdminskinimport()\r
6045         {\r
6046                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6047                 \r
6048                 $member->isAdmin() or self::disallow();\r
6049                 \r
6050                 include_once($DIR_LIBS . 'Skinie.php');\r
6051                 $skinFileRaw    = postVar('skinfile');\r
6052                 $mode                   = postVar('mode');\r
6053                 $allowOverwrite = intPostVar('overwrite');\r
6054                 \r
6055                 if ( $mode == 'file' )\r
6056                 {\r
6057                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6058                 }\r
6059                 else\r
6060                 {\r
6061                         $skinFile = $skinFileRaw;\r
6062                 }\r
6063                 \r
6064                 $importer       = new SKINIMPORT();\r
6065                 $error          = $importer->readFile($skinFile);\r
6066                 if ( $error )\r
6067                 {\r
6068                         self::error($error);\r
6069                 }\r
6070                 $error = $importer->writeToDatabase($allowOverwrite);\r
6071                 if ( $error )\r
6072                 {\r
6073                         self::error($error);\r
6074                 }\r
6075                 \r
6076                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6077                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6078                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6079                 \r
6080                 header('Location: ' . $CONF['AdminURL']);\r
6081                 exit;\r
6082         }\r
6083 }\r