nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class Admin
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . Entity::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', Entity::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.Entity::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. Entity::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NavList('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',Entity::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',Entity::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',Entity::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NavList('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NavList('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NavList('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NavList('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124     /**
1125      * Provide a page to item a new item to the given blog
1126      */
1127     function action_createitem() {
1128         global $member, $manager;
1129
1130         $blogid = intRequestVar('blogid');
1131
1132         // check if allowed
1133         $member->teamRights($blogid) or $this->disallow();
1134
1135         $memberid = $member->getID();
1136
1137         $blog =& $manager->getBlog($blogid);
1138
1139         $this->pagehead();
1140
1141         // generate the add-item form
1142         $formfactory = new PageFactory($blogid);
1143         $formfactory->createAddForm('admin');
1144
1145         $this->pagefoot();
1146     }
1147
1148     /**
1149      * @todo document this
1150      */
1151     function action_itemedit()
1152         {
1153                 global $member, $manager;
1154
1155                 $itemid = intRequestVar('itemid');
1156
1157                 // only allow if user is allowed to alter item
1158                 $member->canAlterItem($itemid) or $this->disallow();
1159
1160                 $item =& $manager->getItem($itemid, 1, 1);
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1162
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1164
1165                 if ($blog->convertBreaks())
1166                 {
1167                         $item['body'] = removeBreaks($item['body']);
1168                         $item['more'] = removeBreaks($item['more']);
1169                 }
1170
1171                 // form to edit blog items
1172                 $this->pagehead();
1173                 $formfactory = new PageFactory($blog->getID());
1174                 $formfactory->createEditForm('admin', $item);
1175                 $this->pagefoot();
1176     }
1177
1178     /**
1179      * @todo document this
1180      */
1181     function action_itemupdate() {
1182         global $member, $manager, $CONF;
1183
1184         $itemid = intRequestVar('itemid');
1185         $catid = postVar('catid');
1186
1187         // only allow if user is allowed to alter item
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1189
1190         $actiontype = postVar('actiontype');
1191
1192         // delete actions are handled by itemdelete (which has confirmation)
1193         if ($actiontype == 'delete') {
1194             $this->action_itemdelete();
1195             return;
1196         }
1197
1198         $body   = postVar('body');
1199         $title  = postVar('title');
1200         $more   = postVar('more');
1201         $closed = intPostVar('closed');
1202         $draftid = intPostVar('draftid');
1203
1204         // default action = add now
1205         if (!$actiontype)
1206             $actiontype='addnow';
1207
1208         // create new category if needed
1209         if (strstr($catid,'newcat')) {
1210             // get blogid
1211             list($blogid) = sscanf($catid,"newcat-%d");
1212
1213             // create
1214             $blog =& $manager->getBlog($blogid);
1215             $catid = $blog->createNewCategory();
1216
1217             // show error when sth goes wrong
1218             if (!$catid)
1219                 $this->doError(_ERROR_CATCREATEFAIL);
1220         }
1221
1222         /*
1223             set some variables based on actiontype
1224
1225             actiontypes:
1226                 draft items -> addnow, addfuture, adddraft, delete
1227                 non-draft items -> edit, changedate, delete
1228
1229             variables set:
1230                 $timestamp: set to a nonzero value for future dates or date changes
1231                 $wasdraft: set to 1 when the item used to be a draft item
1232                 $publish: set to 1 when the edited item is not a draft
1233         */
1234         $blogid =  getBlogIDFromItemID($itemid);
1235         $blog   =& $manager->getBlog($blogid);
1236
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1242         } else {
1243             $timestamp =0;
1244         }
1245
1246         // edit the item for real
1247         Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1248
1249         $this->updateFuturePosted($blogid);
1250
1251         if ($draftid > 0) {
1252             // delete permission is checked inside Item::delete()
1253             Item::delete($draftid);
1254         }
1255
1256         // show category edit window when we created a new category
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1258         if ($catid != intPostVar('catid')) {
1259             $this->action_categoryedit(
1260                 $catid,
1261                 $blog->getID(),
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1263             );
1264         } else {
1265             // TODO: set start item correctly for itemlist
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));
1267         }
1268     }
1269
1270         /**
1271          * Admin::action_itemdelete()
1272          * Delete item
1273          *
1274          * @param       Void
1275          * @return      Void
1276          */
1277         function action_itemdelete()
1278         {
1279                 global $member, $manager;
1280
1281                 $itemid = intRequestVar('itemid');
1282
1283                 // only allow if user is allowed to alter item
1284                 $member->canAlterItem($itemid) or $this->disallow();
1285
1286                 if ( !$manager->existsItem($itemid,1,1) )
1287                 {
1288                         $this->error(_ERROR_NOSUCHITEM);
1289                 }
1290
1291                 $item =& $manager->getItem($itemid,1,1);
1292                 $title = Entity::hsc(strip_tags($item['title']));
1293                 $body = strip_tags($item['body']);
1294                 $body = Entity::hsc(Entity::shorten($body,300,'...'));
1295
1296                 $this->pagehead();
1297                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1298                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";
1299                 echo "<div class=\"note\">\n";
1300                 echo "<b>{$title}</b>\n";
1301                 echo "<br />\n";
1302                 echo "{$body}\n";
1303                 echo "</div>\n";
1304                 echo "<form method=\"post\" action=\"index.php\">\n";
1305                 echo "<div>\n";
1306                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";
1307                 echo $manager->addTicketHidden() . "\n";
1308                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";
1309                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";
1310                 echo "</div>\n";
1311                 echo "</form>\n";
1312                 $this->pagefoot();
1313                 return;
1314         }
1315
1316     /**
1317      * @todo document this
1318      */
1319     function action_itemdeleteconfirm() {
1320         global $member;
1321
1322         $itemid = intRequestVar('itemid');
1323
1324         // only allow if user is allowed to alter item
1325         $member->canAlterItem($itemid) or $this->disallow();
1326
1327         // get blogid first
1328         $blogid = getBlogIdFromItemId($itemid);
1329
1330         // delete item (note: some checks will be performed twice)
1331         $this->deleteOneItem($itemid);
1332
1333         $this->action_itemlist($blogid);
1334     }
1335
1336     /**
1337      * Deletes one item and returns error if something goes wrong
1338      * @param int $itemid
1339      */
1340     function deleteOneItem($itemid) {
1341         global $member, $manager;
1342
1343         // only allow if user is allowed to alter item (also checks if itemid exists)
1344         if (!$member->canAlterItem($itemid))
1345             return _ERROR_DISALLOWED;
1346
1347         // need to get blogid before the item is deleted
1348         $blogid = getBlogIDFromItemId($itemid);
1349
1350         $manager->loadClass('ITEM');
1351         Item::delete($itemid);
1352
1353         // update blog's futureposted
1354         $this->updateFuturePosted($blogid);
1355     }
1356
1357         /**
1358          * Admin::updateFuturePosted()
1359          * Update a blog's future posted flag
1360          *
1361          * @param integer $blogid
1362          * @return      void
1363          *
1364          */
1365         function updateFuturePosted($blogid)
1366         {
1367                 global $manager;
1368
1369                 $blog =& $manager->getBlog($blogid);
1370                 $currenttime = $blog->getCorrectTime(time());
1371
1372                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1373                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1374                 $result = sql_query($query);
1375
1376                 if ( sql_num_rows($result) > 0 )
1377                 {
1378                                 $blog->setFuturePost();
1379                 }
1380                 else
1381                 {
1382                                 $blog->clearFuturePost();
1383                 }
1384                 return;
1385         }
1386
1387     /**
1388      * @todo document this
1389      */
1390     function action_itemmove() {
1391         global $member, $manager;
1392
1393         $itemid = intRequestVar('itemid');
1394
1395         // only allow if user is allowed to alter item
1396         $member->canAlterItem($itemid) or $this->disallow();
1397
1398         $item =& $manager->getItem($itemid,1,1);
1399
1400         $this->pagehead();
1401         ?>
1402             <h2><?php echo _MOVE_TITLE?></h2>
1403             <form method="post" action="index.php"><div>
1404                 <input type="hidden" name="action" value="itemmoveto" />
1405                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1406
1407                 <?php
1408
1409                     $manager->addTicketHidden();
1410                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1411                 ?>
1412
1413                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1414             </div></form>
1415         <?php
1416         $this->pagefoot();
1417     }
1418
1419     /**
1420      * @todo document this
1421      */
1422     function action_itemmoveto() {
1423         global $member, $manager;
1424
1425         $itemid = intRequestVar('itemid');
1426         $catid = requestVar('catid');
1427
1428         // create new category if needed
1429         if (strstr($catid,'newcat')) {
1430             // get blogid
1431             list($blogid) = sscanf($catid,'newcat-%d');
1432
1433             // create
1434             $blog =& $manager->getBlog($blogid);
1435             $catid = $blog->createNewCategory();
1436
1437             // show error when sth goes wrong
1438             if (!$catid)
1439                 $this->doError(_ERROR_CATCREATEFAIL);
1440         }
1441
1442         // only allow if user is allowed to alter item
1443         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1444
1445         $old_blogid = getBlogIDFromItemId($itemid);
1446
1447         Item::move($itemid, $catid);
1448
1449         // set the futurePosted flag on the blog
1450         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1451
1452         // reset the futurePosted in case the item is moved from one blog to another
1453         $this->updateFuturePosted($old_blogid);
1454
1455         if ($catid != intRequestVar('catid'))
1456             $this->action_categoryedit($catid, $blog->getID());
1457         else
1458             $this->action_itemlist(getBlogIDFromCatID($catid));
1459     }
1460
1461     /**
1462      * Moves one item to a given category (category existance should be checked by caller)
1463      * errors are returned
1464      * @param int $itemid
1465      * @param int $destCatid category ID to which the item will be moved
1466      */
1467     function moveOneItem($itemid, $destCatid) {
1468         global $member;
1469
1470         // only allow if user is allowed to move item
1471         if (!$member->canUpdateItem($itemid, $destCatid))
1472             return _ERROR_DISALLOWED;
1473
1474         Item::move($itemid, $destCatid);
1475     }
1476
1477     /**
1478      * Adds a item to the chosen blog
1479      */
1480     function action_additem() {
1481         global $manager, $CONF;
1482
1483         $manager->loadClass('ITEM');
1484
1485         $result = Item::createFromRequest();
1486
1487         if ($result['status'] == 'error')
1488             $this->error($result['message']);
1489
1490         $blogid = getBlogIDFromItemID($result['itemid']);
1491         $blog =& $manager->getBlog($blogid);
1492         $btimestamp = $blog->getCorrectTime();
1493         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1494
1495         if ($result['status'] == 'newcategory') {
1496             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1497             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1498         } else {
1499             $methodName = 'action_itemList';
1500             call_user_func(array(&$this, $methodName), $blogid);
1501         }
1502     }
1503
1504         /**
1505          * Allows to edit previously made comments
1506          **/
1507         function action_commentedit() {
1508
1509                 global $member, $manager;
1510
1511                 $commentid = intRequestVar('commentid');
1512
1513                 $member->canAlterComment($commentid) or $this->disallow();
1514
1515                 $comment = Comment::getComment($commentid);
1516
1517                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1518
1519                 // change <br /> to \n
1520                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1521
1522                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1523                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1524
1525         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1526
1527         $this->pagehead();
1528
1529         ?>
1530         <h2><?php echo _EDITC_TITLE?></h2>
1531
1532         <form action="index.php" method="post"><div>
1533
1534         <input type="hidden" name="action" value="commentupdate" />
1535         <?php $manager->addTicketHidden(); ?>
1536         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1537         <table><tr>
1538             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1539         </tr><tr>
1540             <td><?php echo _EDITC_WHO?></td>
1541             <td>
1542             <?php               if ($comment['member'])
1543                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1544                 else
1545                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1546             ?>
1547             </td>
1548         </tr><tr>
1549             <td><?php echo _EDITC_WHEN?></td>
1550             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1551         </tr><tr>
1552             <td><?php echo _EDITC_HOST?></td>
1553             <td><?php echo  $comment['host']; ?></td>
1554         </tr>
1555         <tr>
1556             <td><?php echo _EDITC_URL; ?></td>
1557             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1558         </tr>
1559         <tr>
1560             <td><?php echo _EDITC_EMAIL; ?></td>
1561             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1562         </tr>
1563         <tr>
1564             <td><?php echo _EDITC_TEXT?></td>
1565             <td>
1566                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1567                     echo $comment['body'];
1568                 ?></textarea>
1569             </td>
1570         </tr><tr>
1571             <td><?php echo _EDITC_EDIT?></td>
1572             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1573         </tr></table>
1574
1575         </div></form>
1576         <?php
1577         $this->pagefoot();
1578     }
1579
1580     /**
1581      * @todo document this
1582      */
1583     function action_commentupdate() {
1584         global $member, $manager;
1585
1586         $commentid = intRequestVar('commentid');
1587
1588         $member->canAlterComment($commentid) or $this->disallow();
1589
1590         $url = postVar('url');
1591         $email = postVar('email');
1592         $body = postVar('body');
1593
1594                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1595                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1596                 # important note that '\' must be matched with '\\\\' in preg* expressions
1597
1598                 // intercept words that are too long
1599                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1600                 {
1601                         $this->error(_ERROR_COMMENT_LONGWORD);
1602                 }
1603
1604                 // check length
1605                 if (i18n::strlen($body) < 3)
1606                 {
1607                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1608                 }
1609
1610                 if (i18n::strlen($body) > 5000)
1611                 {
1612                         $this->error(_ERROR_COMMENT_TOOLONG);
1613                 }
1614
1615         // prepare body
1616         $body = Comment::prepareBody($body);
1617
1618         // call plugins
1619         $manager->notify('PreUpdateComment',array('body' => &$body));
1620
1621         $query = 'UPDATE ' . sql_table('comment')
1622                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1623                . " WHERE cnumber = " . $commentid;
1624         sql_query($query);
1625
1626         // get itemid
1627         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1628         $o = sql_fetch_object($res);
1629         $itemid = $o->citem;
1630
1631         if ($member->canAlterItem($itemid))
1632             $this->action_itemcommentlist($itemid);
1633         else
1634             $this->action_browseowncomments();
1635
1636     }
1637
1638         /**
1639          * Admin::action_commentdelete()
1640          * Update comment
1641          *
1642          * @param       Void
1643          * @return      Void
1644          */
1645         function action_commentdelete()
1646         {
1647                 global $member, $manager;
1648
1649                 $commentid = intRequestVar('commentid');
1650                 $member->canAlterComment($commentid) or $this->disallow();
1651                 $comment = Comment::getComment($commentid);
1652
1653                 $body = strip_tags($comment['body']);
1654                 $body = Entity::hsc(Entity::shorten($body, 300, '...'));
1655
1656                 if ( $comment['member'] )
1657                 {
1658                         $author = $comment['member'];
1659                 }
1660                 else
1661                 {
1662                         $author = $comment['user'];
1663                 }
1664
1665                 $this->pagehead();
1666
1667                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1668                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";
1669                 echo "<div class=\"note\">\n";
1670                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";
1671                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";
1672                 echo "</div>\n";
1673                 echo "<form method=\"post\" action=\"index.php\">\n";
1674                 echo "<div>\n";
1675                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";
1676                 echo $manager->addTicketHidden() . "\n";
1677                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";
1678                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";
1679                 echo "</div>\n";
1680                 echo "</form>\n";
1681                 $this->pagefoot();
1682                 return;
1683         }
1684
1685     /**
1686      * @todo document this
1687      */
1688     function action_commentdeleteconfirm() {
1689         global $member;
1690
1691         $commentid = intRequestVar('commentid');
1692
1693         // get item id first
1694         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1695         $o = sql_fetch_object($res);
1696         $itemid = $o->citem;
1697
1698         $error = $this->deleteOneComment($commentid);
1699         if ($error)
1700             $this->doError($error);
1701
1702         if ($member->canAlterItem($itemid))
1703             $this->action_itemcommentlist($itemid);
1704         else
1705             $this->action_browseowncomments();
1706     }
1707
1708     /**
1709      * @todo document this
1710      */
1711     function deleteOneComment($commentid) {
1712         global $member, $manager;
1713
1714         $commentid = intval($commentid);
1715
1716         if (!$member->canAlterComment($commentid))
1717             return _ERROR_DISALLOWED;
1718
1719         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1720
1721         // delete the comments associated with the item
1722         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1723         sql_query($query);
1724
1725         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1726
1727         return '';
1728     }
1729
1730     /**
1731      * Usermanagement main
1732      */
1733     function action_usermanagement() {
1734         global $member, $manager;
1735
1736         // check if allowed
1737         $member->isAdmin() or $this->disallow();
1738
1739         $this->pagehead();
1740
1741         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1742
1743         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1744
1745         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1746
1747         // show list of members with actions
1748         $query =  'SELECT *'
1749                . ' FROM '.sql_table('member');
1750         $template['content'] = 'memberlist';
1751         $template['tabindex'] = 10;
1752
1753         $manager->loadClass("ENCAPSULATE");
1754         $batch = new Barch('member');
1755         $batch->showlist($query,'table',$template);
1756
1757         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1758         ?>
1759             <form method="post" action="index.php" name="memberedit"><div>
1760
1761             <input type="hidden" name="action" value="memberadd" />
1762             <?php $manager->addTicketHidden() ?>
1763
1764             <table>
1765             <tr>
1766                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1767             </tr><tr>
1768                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1769                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1770                 </td>
1771                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1772             </tr><tr>
1773                 <td><?php echo _MEMBERS_REALNAME?></td>
1774                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1775             </tr><tr>
1776                 <td><?php echo _MEMBERS_PWD?></td>
1777                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1778             </tr><tr>
1779                 <td><?php echo _MEMBERS_REPPWD?></td>
1780                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1781             </tr><tr>
1782                 <td><?php echo _MEMBERS_EMAIL?></td>
1783                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1784             </tr><tr>
1785                 <td><?php echo _MEMBERS_URL?></td>
1786                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1787             </tr><tr>
1788                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1789                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1790             </tr><tr>
1791                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1792                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1793             </tr><tr>
1794                 <td><?php echo _MEMBERS_NOTES?></td>
1795                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1796             </tr><tr>
1797                 <td><?php echo _MEMBERS_NEW?></td>
1798                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1799             </tr></table>
1800
1801             </div></form>
1802         <?php
1803         $this->pagefoot();
1804     }
1805
1806     /**
1807      * Edit member settings
1808      */
1809     function action_memberedit() {
1810         $this->action_editmembersettings(intRequestVar('memberid'));
1811     }
1812
1813         /**
1814          * @todo document this
1815          */
1816         function action_editmembersettings($memberid = '') {
1817                 global $member, $manager, $CONF;
1818
1819                 if ($memberid == '')
1820                 {
1821                         $memberid = $member->getID();
1822                 }
1823
1824                 // check if allowed
1825                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1826
1827                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1828                 $this->pagehead($extrahead);
1829
1830                 // show message to go back to member overview (only for admins)
1831                 if ($member->isAdmin())
1832                 {
1833                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1834                 }
1835                 else
1836                 {
1837                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1838                 }
1839                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1840
1841                 $mem = Member::createFromID($memberid);
1842                 ?>
1843                 <form method="post" action="index.php" name="memberedit"><div>
1844
1845                 <input type="hidden" name="action" value="changemembersettings" />
1846                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1847                 <?php $manager->addTicketHidden() ?>
1848
1849                 <table><tr>
1850                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1851                 </tr><tr>
1852                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1853                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1854                         </td>
1855                         <td>
1856                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1857                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  Entity::hsc($mem->getDisplayName()); ?>" />
1858                         <?php } else {
1859                                 echo Entity::hsc($member->getDisplayName());
1860                            }
1861                         ?>
1862                         </td>
1863                 </tr><tr>
1864                         <td><?php echo _MEMBERS_REALNAME?></td>
1865                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  Entity::hsc($mem->getRealName()); ?>" /></td>
1866                 </tr><tr>
1867                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1868                         <td><?php echo _MEMBERS_PWD?></td>
1869                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1870                 </tr><tr>
1871                         <td><?php echo _MEMBERS_REPPWD?></td>
1872                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1873                 <?php } ?>
1874                 </tr><tr>
1875                         <td><?php echo _MEMBERS_EMAIL?>
1876                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1877                         </td>
1878                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  Entity::hsc($mem->getEmail()); ?>" /></td>
1879                 </tr><tr>
1880                         <td><?php echo _MEMBERS_URL?></td>
1881                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getURL()); ?>" /></td>
1882                 <?php // only allow to change this by super-admins
1883                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1884                    if ($member->isAdmin()) {
1885                 ?>
1886                         </tr><tr>
1887                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1888                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1889                         </tr><tr>
1890                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1891                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1892                 <?php } ?>
1893                 </tr><tr>
1894                         <td><?php echo _MEMBERS_NOTES?></td>
1895                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getNotes()); ?>" /></td>
1896                 </tr><tr>
1897                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>
1898                         </td>
1899                         <td>
1900
1901                                 <select name="locale" tabindex="85">
1902                                 <?php
1903                                 $locales = i18n::get_available_locale_list();
1904                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1905                                 {
1906                                         echo "<option value=\"\" selected=\"selected\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1907                                 }
1908                                 else
1909                                 {
1910                                         echo "<option value=\"\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1911                                 }
1912
1913                                 foreach( $locales as $locale )
1914                                 {
1915                                         if( $locale == $mem->getLocale() )
1916                                         {
1917                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1918                                         }
1919                                         else
1920                                         {
1921                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1922                                         }
1923                                 }
1924                                 ?>
1925                                 </select>
1926
1927                         </td>
1928                 </tr>
1929                 <tr>
1930                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1931                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1932                 </tr>
1933                 <?php
1934                         // plugin options
1935                         $this->_insertPluginOptions('member',$memberid);
1936                 ?>
1937                 <tr>
1938                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1939                 </tr><tr>
1940                         <td><?php echo _MEMBERS_EDIT?></td>
1941                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1942                 </tr></table>
1943
1944                 </div></form>
1945
1946                 <?php
1947                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1948
1949                         $manager->notify(
1950                                 'MemberSettingsFormExtras',
1951                                 array(
1952                                         'member' => &$mem
1953                                 )
1954                         );
1955                 $this->pagefoot();
1956         }
1957
1958     /**
1959      * @todo document this
1960      */
1961     function action_changemembersettings() {
1962         global $member, $CONF, $manager;
1963
1964         $memberid = intRequestVar('memberid');
1965
1966         // check if allowed
1967         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1968
1969         $name           = trim(strip_tags(postVar('name')));
1970         $realname       = trim(strip_tags(postVar('realname')));
1971         $password       = postVar('password');
1972         $repeatpassword = postVar('repeatpassword');
1973         $email          = strip_tags(postVar('email'));
1974         $url            = strip_tags(postVar('url'));
1975
1976                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1977                 # original eregi: !eregi("^https?://", $url)
1978
1979                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1980                 if (!preg_match('#^https?://#', $url) )
1981                 {
1982                         $url = 'http://' . $url;
1983                 }
1984
1985         $admin          = postVar('admin');
1986         $canlogin       = postVar('canlogin');
1987         $notes          = strip_tags(postVar('notes'));
1988         $locale        = postVar('locale');
1989
1990         $mem = Member::createFromID($memberid);
1991
1992         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1993
1994             if (!isValidDisplayName($name))
1995                 $this->error(_ERROR_BADNAME);
1996
1997             if (($name != $mem->getDisplayName()) && Member::exists($name))
1998                 $this->error(_ERROR_NICKNAMEINUSE);
1999
2000             if ($password != $repeatpassword)
2001                 $this->error(_ERROR_PASSWORDMISMATCH);
2002
2003             if ($password && (i18n::strlen($password) < 6))
2004                 $this->error(_ERROR_PASSWORDTOOSHORT);
2005
2006             if ($password) {
2007                                 $pwdvalid = true;
2008                                 $pwderror = '';
2009                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2010                                 if (!$pwdvalid) {
2011                                         $this->error($pwderror);
2012                                 }
2013                         }
2014                 }
2015
2016                 if ( !NOTIFICATION::address_validation($email) )
2017                 {
2018                         $this->error(_ERROR_BADMAILADDRESS);
2019                 }
2020                 if ( !$realname )
2021                 {
2022                         $this->error(_ERROR_REALNAMEMISSING);
2023                 }
2024         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2025             $this->error(_ERROR_NOSUCHTRANSLATION);
2026
2027         // check if there will remain at least one site member with both the logon and admin rights
2028         // (check occurs when taking away one of these rights from such a member)
2029         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2030              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2031            )
2032         {
2033             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2034             if (sql_num_rows($r) < 2)
2035                 $this->error(_ERROR_ATLEASTONEADMIN);
2036         }
2037
2038         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2039             $mem->setDisplayName($name);
2040             if ($password)
2041                 $mem->setPassword($password);
2042         }
2043
2044         $oldEmail = $mem->getEmail();
2045
2046         $mem->setRealName($realname);
2047         $mem->setEmail($email);
2048         $mem->setURL($url);
2049         $mem->setNotes($notes);
2050         $mem->setLocale($locale);
2051
2052
2053         // only allow super-admins to make changes to the admin status
2054         if ($member->isAdmin()) {
2055             $mem->setAdmin($admin);
2056             $mem->setCanLogin($canlogin);
2057         }
2058
2059         $autosave = postVar ('autosave');
2060         $mem->setAutosave($autosave);
2061
2062         $mem->write();
2063
2064         // store plugin options
2065         $aOptions = requestArray('plugoption');
2066         NucleusPlugin::apply_plugin_options($aOptions);
2067         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2068
2069         // if email changed, generate new password
2070         if ($oldEmail != $mem->getEmail())
2071         {
2072             $mem->sendActivationLink('addresschange', $oldEmail);
2073             // logout member
2074             $mem->newCookieKey();
2075
2076             // only log out if the member being edited is the current member.
2077             if ($member->getID() == $memberid)
2078                 $member->logout();
2079             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2080             return;
2081         }
2082
2083
2084         if (  ( $mem->getID() == $member->getID() )
2085            && ( $mem->getDisplayName() != $member->getDisplayName() )
2086            ) {
2087             $mem->newCookieKey();
2088             $member->logout();
2089             $this->action_login(_MSG_LOGINAGAIN, 0);
2090         } else {
2091             $this->action_overview(_MSG_SETTINGSCHANGED);
2092         }
2093     }
2094
2095         /**
2096          * Admin::action_memberadd()
2097          *
2098          * @param       void
2099          * @return      void
2100          *
2101         */
2102         function action_memberadd()
2103         {
2104                 global $member, $manager;
2105
2106                 // check if allowed
2107                 $member->isAdmin() or $this->disallow();
2108
2109                 if ( postVar('password') != postVar('repeatpassword') )
2110                 {
2111                         $this->error(_ERROR_PASSWORDMISMATCH);
2112                 }
2113
2114                 if ( i18n::strlen(postVar('password')) < 6 )
2115                 {
2116                         $this->error(_ERROR_PASSWORDTOOSHORT);
2117                 }
2118
2119                 $res = Member::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2120                 if ( $res != 1 )
2121                 {
2122                         $this->error($res);
2123                 }
2124
2125                 // fire PostRegister event
2126                 $newmem = new Member();
2127                 $newmem->readFromName(postVar('name'));
2128                 $manager->notify('PostRegister',array('member' => &$newmem));
2129
2130                 $this->action_usermanagement();
2131                 return;
2132         }
2133
2134     /**
2135      * Account activation
2136      *
2137      * @author dekarma
2138      */
2139     function action_activate() {
2140
2141         $key = getVar('key');
2142         $this->_showActivationPage($key);
2143     }
2144
2145     /**
2146      * @todo document this
2147      */
2148     function _showActivationPage($key, $message = '')
2149     {
2150         global $manager;
2151
2152         // clean up old activation keys
2153         Member::cleanupActivationTable();
2154
2155         // get activation info
2156         $info = Member::getActivationInfo($key);
2157
2158         if (!$info)
2159             $this->error(_ERROR_ACTIVATE);
2160
2161         $mem = Member::createFromId($info->vmember);
2162
2163         if (!$mem)
2164             $this->error(_ERROR_ACTIVATE);
2165
2166         $text = '';
2167         $title = '';
2168         $bNeedsPasswordChange = true;
2169
2170         switch ($info->vtype)
2171         {
2172             case 'forgot':
2173                 $title = _ACTIVATE_FORGOT_TITLE;
2174                 $text = _ACTIVATE_FORGOT_TEXT;
2175                 break;
2176             case 'register':
2177                 $title = _ACTIVATE_REGISTER_TITLE;
2178                 $text = _ACTIVATE_REGISTER_TEXT;
2179                 break;
2180             case 'addresschange':
2181                 $title = _ACTIVATE_CHANGE_TITLE;
2182                 $text = _ACTIVATE_CHANGE_TEXT;
2183                 $bNeedsPasswordChange = false;
2184                 Member::activate($key);
2185                 break;
2186         }
2187
2188         $aVars = array(
2189             'memberName' => Entity::hsc($mem->getDisplayName())
2190         );
2191         $title = Template::fill($title, $aVars);
2192         $text = Template::fill($text, $aVars);
2193
2194         $this->pagehead();
2195
2196             echo '<h2>' , $title, '</h2>';
2197             echo '<p>' , $text, '</p>';
2198
2199             if ($message != '')
2200             {
2201                 echo '<p class="error">',$message,'</p>';
2202             }
2203
2204             if ($bNeedsPasswordChange)
2205             {
2206                 ?>
2207                     <div><form action="index.php" method="post">
2208
2209                         <input type="hidden" name="action" value="activatesetpwd" />
2210                         <?php $manager->addTicketHidden() ?>
2211                         <input type="hidden" name="key" value="<?php echo Entity::hsc($key) ?>" />
2212
2213                         <table><tr>
2214                             <td><?php echo _MEMBERS_PWD?></td>
2215                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2216                         </tr><tr>
2217                             <td><?php echo _MEMBERS_REPPWD?></td>
2218                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2219                         <?php
2220
2221                             global $manager;
2222                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2223
2224                         ?>
2225                         </tr><tr>
2226                             <td><?php echo _MEMBERS_SETPWD ?></td>
2227                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2228                         </tr></table>
2229
2230
2231                     </form></div>
2232
2233                 <?php
2234
2235             }
2236
2237         $this->pagefoot();
2238
2239     }
2240
2241     /**
2242      * Account activation - set password part
2243      *
2244      * @author dekarma
2245      */
2246     function action_activatesetpwd() {
2247
2248         $key = postVar('key');
2249
2250         // clean up old activation keys
2251         Member::cleanupActivationTable();
2252
2253         // get activation info
2254         $info = Member::getActivationInfo($key);
2255
2256         if (!$info || ($info->type == 'addresschange'))
2257             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2258
2259         $mem = Member::createFromId($info->vmember);
2260
2261         if (!$mem)
2262             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2263
2264         $password       = postVar('password');
2265         $repeatpassword = postVar('repeatpassword');
2266
2267         if ($password != $repeatpassword)
2268             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2269
2270         if ($password && (i18n::strlen($password) < 6))
2271             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2272
2273         if ($password) {
2274                         $pwdvalid = true;
2275                         $pwderror = '';
2276                         global $manager;
2277                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2278                         if (!$pwdvalid) {
2279                                 return $this->_showActivationPage($key,$pwderror);
2280                         }
2281                 }
2282
2283         $error = '';
2284
2285         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2286         if ($error != '')
2287             return $this->_showActivationPage($key, $error);
2288
2289
2290         // set password
2291         $mem->setPassword($password);
2292         $mem->write();
2293
2294         // do the activation
2295         Member::activate($key);
2296
2297         $this->pagehead();
2298             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2299             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2300         $this->pagefoot();
2301     }
2302
2303     /**
2304      * Manage team
2305      */
2306     function action_manageteam() {
2307         global $member, $manager;
2308
2309         $blogid = intRequestVar('blogid');
2310
2311         // check if allowed
2312         $member->blogAdminRights($blogid) or $this->disallow();
2313
2314         $this->pagehead();
2315
2316         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2317
2318         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2319
2320         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2321
2322
2323
2324         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2325                . ' FROM '.sql_table('member').', '.sql_table('team')
2326                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2327
2328         $template['content'] = 'teamlist';
2329         $template['tabindex'] = 10;
2330
2331         $manager->loadClass("ENCAPSULATE");
2332         $batch = new Barch('team');
2333         $batch->showlist($query, 'table', $template);
2334
2335         ?>
2336             <h3><?php echo _TEAM_ADDNEW?></h3>
2337
2338             <form method='post' action='index.php'><div>
2339
2340             <input type='hidden' name='action' value='teamaddmember' />
2341             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2342             <?php $manager->addTicketHidden() ?>
2343
2344             <table><tr>
2345                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2346                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2347                     $query =  'SELECT mname as text, mnumber as value'
2348                            . ' FROM '.sql_table('member');
2349
2350                     $template['name'] = 'memberid';
2351                     $template['tabindex'] = 10000;
2352                     showlist($query,'select',$template);
2353                 ?></td>
2354             </tr><tr>
2355                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2356                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2357             </tr><tr>
2358                 <td><?php echo _TEAM_ADD?></td>
2359                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2360             </tr></table>
2361
2362             </div></form>
2363         <?php
2364         $this->pagefoot();
2365     }
2366
2367     /**
2368      * Add member to team
2369      */
2370     function action_teamaddmember() {
2371         global $member, $manager;
2372
2373         $memberid = intPostVar('memberid');
2374         $blogid = intPostVar('blogid');
2375         $admin = intPostVar('admin');
2376
2377         // check if allowed
2378         $member->blogAdminRights($blogid) or $this->disallow();
2379
2380         $blog =& $manager->getBlog($blogid);
2381         if (!$blog->addTeamMember($memberid, $admin))
2382             $this->error(_ERROR_ALREADYONTEAM);
2383
2384         $this->action_manageteam();
2385
2386     }
2387
2388     /**
2389      * @todo document this
2390      */
2391     function action_teamdelete() {
2392         global $member, $manager;
2393
2394         $memberid = intRequestVar('memberid');
2395         $blogid = intRequestVar('blogid');
2396
2397         // check if allowed
2398         $member->blogAdminRights($blogid) or $this->disallow();
2399
2400         $teammem = Member::createFromID($memberid);
2401         $blog =& $manager->getBlog($blogid);
2402
2403         $this->pagehead();
2404         ?>
2405             <h2><?php echo _DELETE_CONFIRM?></h2>
2406
2407             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  Entity::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  Entity::hsc(strip_tags($blog->getName())) ?></b>
2408             </p>
2409
2410
2411             <form method="post" action="index.php"><div>
2412             <input type="hidden" name="action" value="teamdeleteconfirm" />
2413             <?php $manager->addTicketHidden() ?>
2414             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2415             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2416             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2417             </div></form>
2418         <?php
2419         $this->pagefoot();
2420     }
2421
2422     /**
2423      * @todo document this
2424      */
2425     function action_teamdeleteconfirm() {
2426         global $member;
2427
2428         $memberid = intRequestVar('memberid');
2429         $blogid = intRequestVar('blogid');
2430
2431         $error = $this->deleteOneTeamMember($blogid, $memberid);
2432         if ($error)
2433             $this->error($error);
2434
2435
2436         $this->action_manageteam();
2437     }
2438
2439     /**
2440      * @todo document this
2441      */
2442     function deleteOneTeamMember($blogid, $memberid) {
2443         global $member, $manager;
2444
2445         $blogid = intval($blogid);
2446         $memberid = intval($memberid);
2447
2448         // check if allowed
2449         if (!$member->blogAdminRights($blogid))
2450             return _ERROR_DISALLOWED;
2451
2452         // check if: - there remains at least one blog admin
2453         //           - (there remains at least one team member)
2454         $tmem = Member::createFromID($memberid);
2455
2456         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2457
2458         if ($tmem->isBlogAdmin($blogid)) {
2459             // check if there are more blog members left and at least one admin
2460             // (check for at least two admins before deletion)
2461             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2462             $r = sql_query($query);
2463             if (sql_num_rows($r) < 2)
2464                 return _ERROR_ATLEASTONEBLOGADMIN;
2465         }
2466
2467         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2468         sql_query($query);
2469
2470         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2471
2472         return '';
2473     }
2474
2475     /**
2476      * @todo document this
2477      */
2478     function action_teamchangeadmin() {
2479         global $member;
2480
2481         $blogid = intRequestVar('blogid');
2482         $memberid = intRequestVar('memberid');
2483
2484         // check if allowed
2485         $member->blogAdminRights($blogid) or $this->disallow();
2486
2487         $mem = Member::createFromID($memberid);
2488
2489         // don't allow when there is only one admin at this moment
2490         if ($mem->isBlogAdmin($blogid)) {
2491             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2492             if (sql_num_rows($r) == 1)
2493                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2494         }
2495
2496         if ($mem->isBlogAdmin($blogid))
2497             $newval = 0;
2498         else
2499             $newval = 1;
2500
2501         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2502         sql_query($query);
2503
2504         // only show manageteam if member did not change its own admin privileges
2505         if ($member->isBlogAdmin($blogid))
2506             $this->action_manageteam();
2507         else
2508             $this->action_overview(_MSG_ADMINCHANGED);
2509     }
2510
2511     /**
2512      * @todo document this
2513      */
2514     function action_blogsettings() {
2515         global $member, $manager;
2516
2517         $blogid = intRequestVar('blogid');
2518
2519         // check if allowed
2520         $member->blogAdminRights($blogid) or $this->disallow();
2521
2522         $blog =& $manager->getBlog($blogid);
2523
2524         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2525         $this->pagehead($extrahead);
2526
2527         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2528         ?>
2529         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2530
2531         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2532
2533         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2534         <?php
2535             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2536             $aMemberNames = array();
2537             while ($o = sql_fetch_object($res))
2538                 array_push($aMemberNames, Entity::hsc($o->mname) . ' (' . Entity::hsc($o->mrealname). ')');
2539             echo implode(',', $aMemberNames);
2540         ?>
2541         </p>
2542
2543
2544
2545         <p>
2546         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2547         </p>
2548
2549         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2550
2551         <form method="post" action="index.php"><div>
2552
2553         <input type="hidden" name="action" value="blogsettingsupdate" />
2554         <?php $manager->addTicketHidden() ?>
2555         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2556         <table><tr>
2557             <td><?php echo _EBLOG_NAME?></td>
2558             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getName()) ?>" /></td>
2559         </tr><tr>
2560             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2561                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2562             </td>
2563             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  Entity::hsc($blog->getShortName()) ?>" /></td>
2564         </tr><tr>
2565             <td><?php echo _EBLOG_DESC?></td>
2566             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  Entity::hsc($blog->getDescription()) ?>" /></td>
2567         </tr><tr>
2568             <td><?php echo _EBLOG_URL?></td>
2569             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  Entity::hsc($blog->getURL()) ?>" /></td>
2570         </tr><tr>
2571             <td><?php echo _EBLOG_DEFSKIN?>
2572                 <?php help('blogdefaultskin'); ?>
2573             </td>
2574             <td>
2575                 <?php
2576                     $query =  'SELECT sdname as text, sdnumber as value'
2577                            . ' FROM '.sql_table('skin_desc');
2578                     $template['name'] = 'defskin';
2579                     $template['selected'] = $blog->getDefaultSkin();
2580                     $template['tabindex'] = 50;
2581                     showlist($query,'select',$template);
2582                 ?>
2583
2584             </td>
2585         </tr><tr>
2586             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2587             </td>
2588             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2589         </tr><tr>
2590             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2591             </td>
2592             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2593         </tr><tr>
2594             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2595             </td>
2596             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2597         </tr><tr>
2598             <td><?php echo _EBLOG_ANONYMOUS?>
2599             </td>
2600             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2601         </tr><tr>
2602     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2603          </td>
2604          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2605       </tr><tr>
2606             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2607             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  Entity::hsc($blog->getNotifyAddress()); ?>" /></td>
2608         </tr><tr>
2609             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2610             <td>
2611                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2612                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2613                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2614                 <br />
2615                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2616                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2617                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2618                 <br />
2619                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2620                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2621                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2622             </td>
2623         </tr><tr>
2624             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2625             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  Entity::hsc($blog->getMaxComments()); ?>" /></td>
2626         </tr><tr>
2627             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2628             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getUpdateFile()) ?>" /></td>
2629         </tr><tr>
2630             <td><?php echo _EBLOG_DEFCAT?></td>
2631             <td>
2632                 <?php
2633                     $query =  'SELECT cname as text, catid as value'
2634                            . ' FROM '.sql_table('category')
2635                            . ' WHERE cblog=' . $blog->getID();
2636                     $template['name'] = 'defcat';
2637                     $template['selected'] = $blog->getDefaultCategory();
2638                     $template['tabindex'] = 110;
2639                     showlist($query,'select',$template);
2640                 ?>
2641             </td>
2642         </tr><tr>
2643             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2644                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', time()); ?></b>
2645                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', $blog->getCorrectTime()); ?></b>
2646                 </td>
2647             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  Entity::hsc($blog->getTimeOffset()); ?>" /></td>
2648         </tr><tr>
2649             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2650             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2651         </tr>
2652         <?php
2653             // plugin options
2654             $this->_insertPluginOptions('blog',$blogid);
2655         ?>
2656         <tr>
2657             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2658         </tr><tr>
2659             <td><?php echo _EBLOG_CHANGE?></td>
2660             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2661         </tr></table>
2662
2663         </div></form>
2664
2665         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2666
2667
2668         <?php
2669         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2670         $template['content'] = 'categorylist';
2671         $template['tabindex'] = 200;
2672
2673         $manager->loadClass("ENCAPSULATE");
2674         $batch = new Barch('category');
2675         $batch->showlist($query,'table',$template);
2676
2677         ?>
2678
2679
2680         <form action="index.php" method="post"><div>
2681         <input name="action" value="categorynew" type="hidden" />
2682         <?php $manager->addTicketHidden() ?>
2683         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2684
2685         <table><tr>
2686             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2687         </tr><tr>
2688             <td><?php echo _EBLOG_CAT_NAME?></td>
2689             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2690         </tr><tr>
2691             <td><?php echo _EBLOG_CAT_DESC?></td>
2692             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2693         </tr><tr>
2694             <td><?php echo _EBLOG_CAT_CREATE?></td>
2695             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2696         </tr></table>
2697
2698         </div></form>
2699
2700         <?php
2701
2702             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2703
2704             $manager->notify(
2705                 'BlogSettingsFormExtras',
2706                 array(
2707                     'blog' => &$blog
2708                 )
2709             );
2710
2711         $this->pagefoot();
2712     }
2713
2714     /**
2715      * @todo document this
2716      */
2717     function action_categorynew() {
2718         global $member, $manager;
2719
2720         $blogid = intRequestVar('blogid');
2721
2722         $member->blogAdminRights($blogid) or $this->disallow();
2723
2724         $cname = postVar('cname');
2725         $cdesc = postVar('cdesc');
2726
2727         if (!isValidCategoryName($cname))
2728             $this->error(_ERROR_BADCATEGORYNAME);
2729
2730         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2731         $res = sql_query($query);
2732         if (sql_num_rows($res) > 0)
2733             $this->error(_ERROR_DUPCATEGORYNAME);
2734
2735         $blog       =& $manager->getBlog($blogid);
2736         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2737
2738         $this->action_blogsettings();
2739     }
2740
2741     /**
2742      * @todo document this
2743      */
2744     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2745         global $member, $manager;
2746
2747         if ($blogid == '')
2748             $blogid = intGetVar('blogid');
2749         else
2750             $blogid = intval($blogid);
2751         if ($catid == '')
2752             $catid = intGetVar('catid');
2753         else
2754             $catid = intval($catid);
2755
2756         $member->blogAdminRights($blogid) or $this->disallow();
2757
2758         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2759         $obj = sql_fetch_object($res);
2760
2761         $cname = $obj->cname;
2762         $cdesc = $obj->cdesc;
2763
2764         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2765         $this->pagehead($extrahead);
2766
2767         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2768
2769         ?>
2770         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo Entity::hsc($cname)?>'</h2>
2771         <form method='post' action='index.php'><div>
2772         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2773         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2774         <input name="desturl" type="hidden" value="<?php echo Entity::hsc($desturl) ?>" />
2775         <input name="action" type="hidden" value="categoryupdate" />
2776         <?php $manager->addTicketHidden(); ?>
2777
2778         <table><tr>
2779             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2780         </tr><tr>
2781             <td><?php echo _EBLOG_CAT_NAME?></td>
2782             <td><input type="text" name="cname" value="<?php echo Entity::hsc($cname)?>" size="40" maxlength="40" /></td>
2783         </tr><tr>
2784             <td><?php echo _EBLOG_CAT_DESC?></td>
2785             <td><input type="text" name="cdesc" value="<?php echo Entity::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2786         </tr>
2787         <?php
2788             // insert plugin options
2789             $this->_insertPluginOptions('category',$catid);
2790         ?>
2791         <tr>
2792             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2793         </tr><tr>
2794             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2795             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2796         </tr></table>
2797
2798         </div></form>
2799         <?php
2800         $this->pagefoot();
2801     }
2802
2803     /**
2804      * @todo document this
2805      */
2806     function action_categoryupdate() {
2807         global $member, $manager;
2808
2809         $blogid = intPostVar('blogid');
2810         $catid = intPostVar('catid');
2811         $cname = postVar('cname');
2812         $cdesc = postVar('cdesc');
2813         $desturl = postVar('desturl');
2814
2815         $member->blogAdminRights($blogid) or $this->disallow();
2816
2817         if (!isValidCategoryName($cname))
2818             $this->error(_ERROR_BADCATEGORYNAME);
2819
2820         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2821         $res = sql_query($query);
2822         if (sql_num_rows($res) > 0)
2823             $this->error(_ERROR_DUPCATEGORYNAME);
2824
2825         $query =  'UPDATE '.sql_table('category').' SET'
2826                . " cname='" . sql_real_escape_string($cname) . "',"
2827                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2828                . " WHERE catid=" . $catid;
2829
2830         sql_query($query);
2831
2832         // store plugin options
2833         $aOptions = requestArray('plugoption');
2834         NucleusPlugin::apply_plugin_options($aOptions);
2835         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2836
2837
2838         if ($desturl) {
2839             redirect($desturl);
2840             exit;
2841         } else {
2842             $this->action_blogsettings();
2843         }
2844     }
2845
2846     /**
2847      * @todo document this
2848      */
2849     function action_categorydelete() {
2850         global $member, $manager;
2851
2852         $blogid = intRequestVar('blogid');
2853         $catid = intRequestVar('catid');
2854
2855         $member->blogAdminRights($blogid) or $this->disallow();
2856
2857         $blog =& $manager->getBlog($blogid);
2858
2859         // check if the category is valid
2860         if (!$blog->isValidCategory($catid))
2861             $this->error(_ERROR_NOSUCHCATEGORY);
2862
2863         // don't allow deletion of default category
2864         if ($blog->getDefaultCategory() == $catid)
2865             $this->error(_ERROR_DELETEDEFCATEGORY);
2866
2867         // check if catid is the only category left for blogid
2868         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2869         $res = sql_query($query);
2870         if (sql_num_rows($res) == 1)
2871             $this->error(_ERROR_DELETELASTCATEGORY);
2872
2873
2874         $this->pagehead();
2875         ?>
2876             <h2><?php echo _DELETE_CONFIRM?></h2>
2877
2878             <div>
2879             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  Entity::hsc($blog->getCategoryName($catid))?></b>
2880             </div>
2881
2882             <form method="post" action="index.php"><div>
2883             <input type="hidden" name="action" value="categorydeleteconfirm" />
2884             <?php $manager->addTicketHidden() ?>
2885             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2886             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2887             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2888             </div></form>
2889         <?php
2890         $this->pagefoot();
2891     }
2892
2893     /**
2894      * @todo document this
2895      */
2896     function action_categorydeleteconfirm() {
2897         global $member, $manager;
2898
2899         $blogid = intRequestVar('blogid');
2900         $catid = intRequestVar('catid');
2901
2902         $member->blogAdminRights($blogid) or $this->disallow();
2903
2904         $error = $this->deleteOneCategory($catid);
2905         if ($error)
2906             $this->error($error);
2907
2908         $this->action_blogsettings();
2909     }
2910
2911         /**
2912          * Admin::deleteOneCategory()
2913          * Delete a category by its id
2914          *
2915          * @param       String  $catid  category id for deleting
2916          * @return      Void
2917          */
2918         function deleteOneCategory($catid)
2919         {
2920                 global $manager, $member;
2921
2922                 $catid = intval($catid);
2923                 $blogid = getBlogIDFromCatID($catid);
2924
2925                 if ( !$member->blogAdminRights($blogid) )
2926                 {
2927                         return ERROR_DISALLOWED;
2928                 }
2929
2930                 // get blog
2931                 $blog =& $manager->getBlog($blogid);
2932
2933                 // check if the category is valid
2934                 if ( !$blog || !$blog->isValidCategory($catid) )
2935                 {
2936                         return _ERROR_NOSUCHCATEGORY;
2937                 }
2938
2939                 $destcatid = $blog->getDefaultCategory();
2940
2941                 // don't allow deletion of default category
2942                 if ( $blog->getDefaultCategory() == $catid )
2943                 {
2944                         return _ERROR_DELETEDEFCATEGORY;
2945                 }
2946
2947                 // check if catid is the only category left for blogid
2948                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2949                 $res = sql_query($query);
2950                 if ( sql_num_rows($res) == 1 )
2951                 {
2952                         return _ERROR_DELETELASTCATEGORY;
2953                 }
2954
2955                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2956
2957                 // change category for all items to the default category
2958                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2959                 sql_query($query);
2960
2961                 // delete all associated plugin options
2962                 NucleusPlugin::delete_option_values('category', $catid);
2963
2964                 // delete category
2965                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2966                 sql_query($query);
2967
2968                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2969                 return;
2970         }
2971
2972         /**
2973          * Admin::action_blogsettingsupdate
2974          * Updating blog settings
2975          *
2976          * @param       Void
2977          * @return      Void
2978          */
2979         function action_blogsettingsupdate()
2980         {
2981                 global $member, $manager;
2982
2983                 $blogid = intRequestVar('blogid');
2984
2985                 $member->blogAdminRights($blogid) or $this->disallow();
2986
2987                 $blog =& $manager->getBlog($blogid);
2988
2989                 $notify_address = trim(postVar('notify'));
2990                 $shortname              = trim(postVar('shortname'));
2991                 $updatefile     = trim(postVar('update'));
2992
2993                 $notifyComment  = intPostVar('notifyComment');
2994                 $notifyVote             = intPostVar('notifyVote');
2995                 $notifyNewItem  = intPostVar('notifyNewItem');
2996
2997                 if ( $notifyComment == 0 )
2998                 {
2999                         $notifyComment = 1;
3000                 }
3001                 if ( $notifyVote == 0 )
3002                 {
3003                         $notifyVote = 1;
3004                 }
3005                 if ( $notifyNewItem == 0 )
3006                 {
3007                         $notifyNewItem = 1;
3008                 }
3009                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3010
3011                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
3012                 {
3013                         $this->error(_ERROR_BADNOTIFY);
3014                 }
3015
3016                 if ( !isValidShortName($shortname) )
3017                 {
3018                         $this->error(_ERROR_BADSHORTBLOGNAME);
3019                 }
3020
3021                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
3022                 {
3023                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3024                 }
3025                 // check if update file is writable
3026                 if ( $updatefile && !is_writeable($updatefile) )
3027                 {
3028                         $this->error(_ERROR_UPDATEFILE);
3029                 }
3030
3031                 $blog->setName(trim(postVar('name')));
3032                 $blog->setShortName($shortname);
3033                 $blog->setNotifyAddress($notify_address);
3034                 $blog->setNotifyType($notifyType);
3035                 $blog->setMaxComments(postVar('maxcomments'));
3036                 $blog->setCommentsEnabled(postVar('comments'));
3037                 $blog->setTimeOffset(postVar('timeoffset'));
3038                 $blog->setUpdateFile($updatefile);
3039                 $blog->setURL(trim(postVar('url')));
3040                 $blog->setDefaultSkin(intPostVar('defskin'));
3041                 $blog->setDescription(trim(postVar('desc')));
3042                 $blog->setPublic(postVar('public'));
3043                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3044                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3045                 $blog->setDefaultCategory(intPostVar('defcat'));
3046                 $blog->setSearchable(intPostVar('searchable'));
3047                 $blog->setEmailRequired(intPostVar('reqemail'));
3048                 $blog->writeSettings();
3049
3050                 // store plugin options
3051                 $aOptions = requestArray('plugoption');
3052                 NucleusPlugin::apply_plugin_options($aOptions);
3053                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3054
3055                 $this->action_overview(_MSG_SETTINGSCHANGED);
3056                 return;
3057         }
3058
3059     /**
3060      * @todo document this
3061      */
3062     function action_deleteblog() {
3063         global $member, $CONF, $manager;
3064
3065         $blogid = intRequestVar('blogid');
3066
3067         $member->blogAdminRights($blogid) or $this->disallow();
3068
3069         // check if blog is default blog
3070         if ($CONF['DefaultBlog'] == $blogid)
3071             $this->error(_ERROR_DELDEFBLOG);
3072
3073         $blog =& $manager->getBlog($blogid);
3074
3075         $this->pagehead();
3076         ?>
3077             <h2><?php echo _DELETE_CONFIRM?></h2>
3078
3079             <p><?php echo _WARNINGTXT_BLOGDEL?>
3080             </p>
3081
3082             <div>
3083             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  Entity::hsc($blog->getName())?></b>
3084             </div>
3085
3086             <form method="post" action="index.php"><div>
3087             <input type="hidden" name="action" value="deleteblogconfirm" />
3088             <?php $manager->addTicketHidden() ?>
3089             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3090             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3091             </div></form>
3092         <?php
3093         $this->pagefoot();
3094     }
3095
3096         /**
3097          * Admin::action_deleteblogconfirm()
3098          * Delete Blog
3099          *
3100          * @param       Void
3101          * @return      Void
3102          */
3103         function action_deleteblogconfirm()
3104         {
3105                 global $member, $CONF, $manager;
3106
3107                 $blogid = intRequestVar('blogid');
3108                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3109                 $member->blogAdminRights($blogid) or $this->disallow();
3110
3111                 // check if blog is default blog
3112                 if ( $CONF['DefaultBlog'] == $blogid )
3113                 {
3114                         $this->error(_ERROR_DELDEFBLOG);
3115                 }
3116
3117                 // delete all comments
3118                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3119                 sql_query($query);
3120
3121                 // delete all items
3122                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3123                 sql_query($query);
3124
3125                 // delete all team members
3126                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3127                 sql_query($query);
3128
3129                 // delete all bans
3130                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3131                 sql_query($query);
3132
3133                 // delete all categories
3134                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3135                 sql_query($query);
3136
3137                 // delete all associated plugin options
3138                 NucleusPlugin::delete_option_values('blog', $blogid);
3139
3140                 // delete the blog itself
3141                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3142                 sql_query($query);
3143
3144                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3145
3146                 $this->action_overview(_DELETED_BLOG);
3147                 return;
3148         }
3149
3150     /**
3151      * @todo document this
3152      */
3153     function action_memberdelete() {
3154         global $member, $manager;
3155
3156         $memberid = intRequestVar('memberid');
3157
3158         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3159
3160         $mem = Member::createFromID($memberid);
3161
3162         $this->pagehead();
3163         ?>
3164             <h2><?php echo _DELETE_CONFIRM?></h2>
3165
3166             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo Entity::hsc($mem->getDisplayName()) ?></b>
3167             </p>
3168
3169             <p>
3170             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3171             </p>
3172
3173             <form method="post" action="index.php"><div>
3174             <input type="hidden" name="action" value="memberdeleteconfirm" />
3175             <?php $manager->addTicketHidden() ?>
3176             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3177             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3178             </div></form>
3179         <?php
3180         $this->pagefoot();
3181     }
3182
3183     /**
3184      * @todo document this
3185      */
3186     function action_memberdeleteconfirm() {
3187         global $member;
3188
3189         $memberid = intRequestVar('memberid');
3190
3191         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3192
3193         $error = $this->deleteOneMember($memberid);
3194         if ($error)
3195             $this->error($error);
3196
3197         if ($member->isAdmin())
3198             $this->action_usermanagement();
3199         else
3200             $this->action_overview(_DELETED_MEMBER);
3201     }
3202
3203         /**
3204          * Admin::deleteOneMember()
3205          * Delete a member by id
3206          *
3207          * @static
3208          * @params      Integer $memberid       member id
3209          * @return      String  null string or error messages
3210          */
3211         function deleteOneMember($memberid)
3212         {
3213                 global $manager;
3214
3215                 $memberid = intval($memberid);
3216                 $mem = Member::createFromID($memberid);
3217
3218                 if ( !$mem->canBeDeleted() )
3219                 {
3220                         return _ERROR_DELETEMEMBER;
3221                 }
3222
3223                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3224
3225                 /* unlink comments from memberid */
3226                 if ( $memberid )
3227                 {
3228                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3229                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3230                         sql_query($query);
3231                 }
3232
3233                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3234                 sql_query($query);
3235
3236                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3237                 sql_query($query);
3238
3239                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3240                 sql_query($query);
3241
3242                 // delete all associated plugin options
3243                 NucleusPlugin::delete_option_values('member', $memberid);
3244
3245                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3246
3247                 return '';
3248         }
3249
3250     /**
3251      * @todo document this
3252      */
3253     function action_createnewlog() {
3254         global $member, $CONF, $manager;
3255
3256         // Only Super-Admins can do this
3257         $member->isAdmin() or $this->disallow();
3258
3259         $this->pagehead();
3260
3261         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3262         ?>
3263         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3264
3265         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3266
3267         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3268
3269         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3270
3271         <ol>
3272             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3273             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3274         </ol>
3275
3276         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3277
3278         <p>
3279         <?php echo _EBLOG_CREATE_TEXT?>
3280         </p>
3281
3282         <form method="post" action="index.php"><div>
3283
3284         <input type="hidden" name="action" value="addnewlog" />
3285         <?php $manager->addTicketHidden() ?>
3286
3287
3288         <table><tr>
3289             <td><?php echo _EBLOG_NAME?></td>
3290             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3291         </tr><tr>
3292             <td><?php echo _EBLOG_SHORTNAME?>
3293                 <?php help('shortblogname'); ?>
3294             </td>
3295             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3296         </tr><tr>
3297             <td><?php echo _EBLOG_DESC?></td>
3298             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3299         </tr><tr>
3300             <td><?php echo _EBLOG_DEFSKIN?>
3301                 <?php help('blogdefaultskin'); ?>
3302             </td>
3303             <td>
3304                 <?php
3305                     $query =  'SELECT sdname as text, sdnumber as value'
3306                            . ' FROM '.sql_table('skin_desc');
3307                     $template['name'] = 'defskin';
3308                     $template['tabindex'] = 50;
3309                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3310                     showlist($query,'select',$template);
3311                 ?>
3312             </td>
3313         </tr><tr>
3314             <td><?php echo _EBLOG_OFFSET?>
3315                 <?php help('blogtimeoffset'); ?>
3316                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::formatted_datetime('%H:%M',time()); ?></b>
3317             </td>
3318             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3319         </tr><tr>
3320             <td><?php echo _EBLOG_ADMIN?>
3321                 <?php help('teamadmin'); ?>
3322             </td>
3323             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3324         </tr><tr>
3325             <td><?php echo _EBLOG_CREATE?></td>
3326             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3327         </tr></table>
3328
3329         </div></form>
3330         <?php
3331         $this->pagefoot();
3332     }
3333
3334     /**
3335      * @todo document this
3336      */
3337     function action_addnewlog() {
3338         global $member, $manager, $CONF;
3339
3340         // Only Super-Admins can do this
3341         $member->isAdmin() or $this->disallow();
3342
3343         $bname          = trim(postVar('name'));
3344         $bshortname     = trim(postVar('shortname'));
3345         $btimeoffset    = postVar('timeoffset');
3346         $bdesc          = trim(postVar('desc'));
3347         $bdefskin       = postVar('defskin');
3348
3349         if (!isValidShortName($bshortname))
3350             $this->error(_ERROR_BADSHORTBLOGNAME);
3351
3352         if ($manager->existsBlog($bshortname))
3353             $this->error(_ERROR_DUPSHORTBLOGNAME);
3354
3355         $manager->notify(
3356             'PreAddBlog',
3357             array(
3358                 'name' => &$bname,
3359                 'shortname' => &$bshortname,
3360                 'timeoffset' => &$btimeoffset,
3361                 'description' => &$bdesc,
3362                 'defaultskin' => &$bdefskin
3363             )
3364         );
3365
3366
3367         // add slashes for sql queries
3368         $bname =        sql_real_escape_string($bname);
3369         $bshortname =   sql_real_escape_string($bshortname);
3370         $btimeoffset =  sql_real_escape_string($btimeoffset);
3371         $bdesc =        sql_real_escape_string($bdesc);
3372         $bdefskin =     sql_real_escape_string($bdefskin);
3373
3374         // create blog
3375         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3376         sql_query($query);
3377         $blogid = sql_insert_id();
3378         $blog   =& $manager->getBlog($blogid);
3379
3380         // create new category
3381         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3382         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3383         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3384         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3385 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3386 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3387         $catid = sql_insert_id();
3388
3389         // set as default category
3390         $blog->setDefaultCategory($catid);
3391         $blog->writeSettings();
3392
3393         // create team member
3394         $memberid = $member->getID();
3395         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3396         sql_query($query);
3397
3398         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3399         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3400
3401         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3402         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3403
3404
3405
3406         $manager->notify(
3407             'PostAddBlog',
3408             array(
3409                 'blog' => &$blog
3410             )
3411         );
3412
3413         $manager->notify(
3414             'PostAddCategory',
3415             array(
3416                 'blog' => &$blog,
3417                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3418                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3419                 'catid' => $catid
3420             )
3421         );
3422
3423         $this->pagehead();
3424         ?>
3425         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3426
3427         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, Entity::hsc($bname)) ?></p>
3428
3429         <ol>
3430             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, Entity::hsc($bshortname)) ?></a></li>
3431             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3432         </ol>
3433
3434         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, Entity::hsc($bshortname)) ?></a></h3>
3435
3436         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, Entity::hsc($bshortname)) ?></p>
3437 <pre><code>&lt;?php
3438
3439 $CONF['Self'] = '<b><?php echo Entity::hsc($bshortname)?>.php</b>';
3440
3441 include('<i>./config.php</i>');
3442
3443 selectBlog('<b><?php echo Entity::hsc($bshortname)?></b>');
3444 selector();
3445
3446 ?&gt;</code></pre>
3447
3448         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3449
3450         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3451
3452         <form action="index.php" method="post"><div>
3453             <input type="hidden" name="action" value="addnewlog2" />
3454             <?php $manager->addTicketHidden() ?>
3455             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3456             <table><tr>
3457                 <td><?php echo _EBLOG_URL?></td>
3458                 <td><input name="url" maxlength="100" size="40" value="<?php echo Entity::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3459             </tr><tr>
3460                 <td><?php echo _EBLOG_CREATE?></td>
3461                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3462             </tr></table>
3463         </div></form>
3464
3465         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3466
3467         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3468
3469         <form action="index.php" method="post"><div>
3470             <input type="hidden" name="action" value="addnewlog2" />
3471             <?php $manager->addTicketHidden() ?>
3472             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3473             <table><tr>
3474                 <td><?php echo _EBLOG_URL?></td>
3475                 <td><input name="url" maxlength="100" size="40" /></td>
3476             </tr><tr>
3477                 <td><?php echo _EBLOG_CREATE?></td>
3478                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3479             </tr></table>
3480         </div></form>
3481
3482         <?php       $this->pagefoot();
3483
3484     }
3485
3486     /**
3487      * @todo document this
3488      */
3489     function action_addnewlog2() {
3490         global $member, $manager;
3491
3492         $member->blogAdminRights($blogid) or $this->disallow();
3493
3494         $burl   = requestVar('url');
3495         $blogid = intRequestVar('blogid');
3496
3497         $blog =& $manager->getBlog($blogid);
3498         $blog->setURL(trim($burl));
3499         $blog->writeSettings();
3500
3501         $this->action_overview(_MSG_NEWBLOG);
3502     }
3503
3504     /**
3505      * @todo document this
3506      */
3507     function action_skinieoverview() {
3508         global $member, $DIR_LIBS, $manager;
3509
3510         $member->isAdmin() or $this->disallow();
3511
3512         // load skinie class
3513         include_once($DIR_LIBS . 'skinie.php');
3514
3515         $this->pagehead();
3516
3517         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3518
3519     ?>
3520         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3521
3522                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3523                 <?php                   global $DIR_SKINS;
3524
3525                     $candidates = SkinImport::searchForCandidates($DIR_SKINS);
3526
3527                     if (sizeof($candidates) > 0) {
3528                         ?>
3529                             <form method="post" action="index.php"><div>
3530                                 <input type="hidden" name="action" value="skinieimport" />
3531                                 <?php $manager->addTicketHidden() ?>
3532                                 <input type="hidden" name="mode" value="file" />
3533                                 <select name="skinfile" id="skinie_import_local">
3534                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3535                                         $html = Entity::hsc($skinfile);
3536                                         echo '<option value="',$html,'">',$skinname,'</option>';
3537                                     }
3538                                 ?>
3539                                 </select>
3540                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3541                             </div></form>
3542                         <?php                   } else {
3543                         echo _SKINIE_NOCANDIDATES;
3544                     }
3545                 ?>
3546                 </p>
3547
3548                 <p><em><?php echo _OR?></em></p>
3549
3550                 <form method="post" action="index.php"><p>
3551                     <?php $manager->addTicketHidden() ?>
3552                     <input type="hidden" name="action" value="skinieimport" />
3553                     <input type="hidden" name="mode" value="url" />
3554                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3555                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3556                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3557                 </p></form>
3558
3559
3560         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3561         <form method="post" action="index.php"><div>
3562             <input type="hidden" name="action" value="skinieexport" />
3563             <?php $manager->addTicketHidden() ?>
3564
3565             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3566
3567             <table><tr>
3568                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3569             </tr><tr>
3570     <?php       // show list of skins
3571         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3572         while ($skinObj = sql_fetch_object($res)) {
3573             $id = 'skinexp' . $skinObj->sdnumber;
3574             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3575             echo '<label for="',$id,'">',Entity::hsc($skinObj->sdname),'</label></td>';
3576             echo '<td>',Entity::hsc($skinObj->sddesc),'</td>';
3577             echo '</tr><tr>';
3578         }
3579
3580         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3581
3582         // show list of templates
3583         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3584         while ($templateObj = sql_fetch_object($res)) {
3585             $id = 'templateexp' . $templateObj->tdnumber;
3586             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3587             echo '<label for="',$id,'">',Entity::hsc($templateObj->tdname),'</label></td>';
3588             echo '<td>',Entity::hsc($templateObj->tddesc),'</td>';
3589             echo '</tr><tr>';
3590         }
3591
3592     ?>
3593                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3594             </tr><tr>
3595                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3596             </tr><tr>
3597                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3598             </tr><tr>
3599                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3600             </tr></table>
3601         </div></form>
3602
3603     <?php
3604         $this->pagefoot();
3605
3606     }
3607
3608     /**
3609      * @todo document this
3610      */
3611     function action_skinieimport() {
3612         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3613
3614         $member->isAdmin() or $this->disallow();
3615
3616         // load skinie class
3617         include_once($DIR_LIBS . 'skinie.php');
3618
3619         $skinFileRaw= postVar('skinfile');
3620         $mode       = postVar('mode');
3621
3622         $importer = new SkinImport();
3623
3624         // get full filename
3625         if ($mode == 'file')
3626         {
3627             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3628
3629             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3630             if (!file_exists($skinFile))
3631                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3632         } else {
3633             $skinFile = $skinFileRaw;
3634         }
3635
3636         // read only metadata
3637         $error = $importer->readFile($skinFile, 1);
3638
3639         // clashes
3640         $skinNameClashes = $importer->checkSkinNameClashes();
3641         $templateNameClashes = $importer->checkTemplateNameClashes();
3642         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3643
3644         if ($error) $this->error($error);
3645
3646         $this->pagehead();
3647
3648         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3649         ?>
3650         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3651
3652         <ul>
3653             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3654             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3655             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3656             <?php
3657                 if ($hasNameClashes)
3658                 {
3659             ?>
3660             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3661             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3662             <?php
3663                 } // if (hasNameClashes)
3664             ?>
3665         </ul>
3666
3667         <form method="post" action="index.php"><div>
3668             <input type="hidden" name="action" value="skiniedoimport" />
3669             <?php $manager->addTicketHidden() ?>
3670             <input type="hidden" name="skinfile" value="<?php echo Entity::hsc(postVar('skinfile'))?>" />
3671             <input type="hidden" name="mode" value="<?php echo Entity::hsc($mode)?>" />
3672             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3673             <?php
3674                 if ($hasNameClashes)
3675                 {
3676             ?>
3677             <br />
3678             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3679             <?php
3680                 } // if (hasNameClashes)
3681             ?>
3682         </div></form>
3683
3684
3685         <?php
3686         $this->pagefoot();
3687     }
3688
3689     /**
3690      * @todo document this
3691      */
3692     function action_skiniedoimport() {
3693         global $member, $DIR_LIBS, $DIR_SKINS;
3694
3695         $member->isAdmin() or $this->disallow();
3696
3697         // load skinie class
3698         include_once($DIR_LIBS . 'skinie.php');
3699
3700         $skinFileRaw= postVar('skinfile');
3701         $mode       = postVar('mode');
3702
3703         $allowOverwrite = intPostVar('overwrite');
3704
3705         // get full filename
3706         if ($mode == 'file')
3707         {
3708             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3709
3710             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3711             if (!file_exists($skinFile))
3712                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3713
3714         } else {
3715             $skinFile = $skinFileRaw;
3716         }
3717
3718         $importer = new SkinImport();
3719
3720         $error = $importer->readFile($skinFile);
3721
3722         if ($error)
3723             $this->error($error);
3724
3725         $error = $importer->writeToDatabase($allowOverwrite);
3726
3727         if ($error)
3728             $this->error($error);
3729
3730         $this->pagehead();
3731
3732         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3733     ?>
3734         <h2><?php echo _SKINIE_DONE?></h2>
3735
3736         <ul>
3737             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3738             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3739             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3740         </ul>
3741
3742     <?php       $this->pagefoot();
3743
3744     }
3745
3746     /**
3747      * @todo document this
3748      */
3749     function action_skinieexport() {
3750         global $member, $DIR_LIBS;
3751
3752         $member->isAdmin() or $this->disallow();
3753
3754         // load skinie class
3755         include_once($DIR_LIBS . 'skinie.php');
3756
3757         $aSkins = requestIntArray('skin');
3758         $aTemplates = requestIntArray('template');
3759
3760         if (!is_array($aTemplates)) $aTemplates = array();
3761         if (!is_array($aSkins)) $aSkins = array();
3762
3763         $skinList = array_keys($aSkins);
3764         $templateList = array_keys($aTemplates);
3765
3766         $info = postVar('info');
3767
3768         $exporter = new SkinExport();
3769         foreach ($skinList as $skinId) {
3770             $exporter->addSkin($skinId);
3771         }
3772         foreach ($templateList as $templateId) {
3773             $exporter->addTemplate($templateId);
3774         }
3775         $exporter->setInfo($info);
3776
3777         $exporter->export();
3778     }
3779
3780     /**
3781      * @todo document this
3782      */
3783     function action_templateoverview() {
3784         global $member, $manager;
3785
3786         $member->isAdmin() or $this->disallow();
3787
3788         $this->pagehead();
3789
3790         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3791
3792         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3793         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3794
3795         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3796         $template['content'] = 'templatelist';
3797         $template['tabindex'] = 10;
3798         showlist($query,'table',$template);
3799
3800         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3801
3802         ?>
3803         <form method="post" action="index.php"><div>
3804
3805         <input name="action" value="templatenew" type="hidden" />
3806         <?php $manager->addTicketHidden() ?>
3807         <table><tr>
3808             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3809             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3810         </tr><tr>
3811             <td><?php echo _TEMPLATE_DESC?></td>
3812             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3813         </tr><tr>
3814             <td><?php echo _TEMPLATE_CREATE?></td>
3815             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3816         </tr></table>
3817
3818         </div></form>
3819
3820         <?php
3821         $this->pagefoot();
3822     }
3823
3824     /**
3825      * @todo document this
3826      */
3827     function action_templateedit($msg = '') {
3828         global $member, $manager;
3829
3830         $templateid = intRequestVar('templateid');
3831
3832         $member->isAdmin() or $this->disallow();
3833
3834         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3835         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3836
3837         $this->pagehead($extrahead);
3838
3839         $templatename = Template::getNameFromId($templateid);
3840         $templatedescription = Template::getDesc($templateid);
3841         $template =& $manager->getTemplate($templatename);
3842
3843         ?>
3844         <p>
3845         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3846         </p>
3847
3848         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  Entity::hsc($templatename); ?>'</h2>
3849
3850         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3851         ?>
3852
3853         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3854
3855         <form method="post" action="index.php">
3856         <div>
3857
3858         <input type="hidden" name="action" value="templateupdate" />
3859         <?php $manager->addTicketHidden() ?>
3860         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3861
3862         <table><tr>
3863             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3864         </tr><tr>
3865             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3866             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  Entity::hsc($templatename) ?>" /></td>
3867         </tr><tr>
3868             <td><?php echo _TEMPLATE_DESC?></td>
3869             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  Entity::hsc($templatedescription) ?>" /></td>
3870         </tr><tr>
3871             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3872         </tr><tr>
3873             <td><?php echo _TEMPLATE_UPDATE?></td>
3874             <td>
3875                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3876                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3877             </td>
3878         </tr><tr>
3879             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3880 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3881     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3882     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3883     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3884     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3885     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3886 ?>
3887         </tr><tr>
3888             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3889 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3890     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3891     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3892     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3893     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3894     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3895     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3896 ?>
3897         </tr><tr>
3898             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3899 <?php
3900     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3901 ?>
3902         </tr><tr>
3903             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3904 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3905 ?>
3906         </tr><tr>
3907             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3908 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3909     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3910     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3911 ?>
3912         </tr><tr>
3913             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3914 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3915     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3916     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3917 ?>
3918         </tr><tr>
3919             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3920 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3921     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3922     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3923 ?>
3924         </tr><tr>
3925             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3926 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3927     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3928     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3929     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3930     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3931 ?>
3932         </tr><tr>
3933             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3934 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3935     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3936     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3937 ?>
3938         </tr><tr>
3939             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3940 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3941     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3942 ?>
3943         </tr><tr>
3944             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3945 <?php
3946         $tab = 600;
3947         $pluginfields = array();
3948         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3949
3950         foreach ($pluginfields as $pfkey=>$pfvalue) {
3951             echo "</tr><tr>\n";
3952             echo '<th colspan="2">' . Entity::hen($pfkey) . "</th>\n";
3953             foreach ($pfvalue as $pffield=>$pfdesc) {
3954                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3955             }
3956         }
3957 ?>
3958         </tr><tr>
3959             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3960         </tr><tr>
3961             <td><?php echo _TEMPLATE_UPDATE?></td>
3962             <td>
3963                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3964                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3965             </td>
3966         </tr></table>
3967
3968         </div>
3969         </form>
3970         <?php
3971         $this->pagefoot();
3972     }
3973
3974     /**
3975      * @todo document this
3976      */
3977     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3978         static $count = 1;
3979         if (!isset($template[$name])) $template[$name] = '';
3980     ?>
3981         </tr><tr>
3982             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3983             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>
3984     <?php       $count++;
3985     }
3986
3987     /**
3988      * @todo document this
3989      */
3990     function action_templateupdate() {
3991         global $member,$manager;
3992
3993         $templateid = intRequestVar('templateid');
3994
3995         $member->isAdmin() or $this->disallow();
3996
3997         $name = postVar('tname');
3998         $desc = postVar('tdesc');
3999
4000         if (!isValidTemplateName($name))
4001             $this->error(_ERROR_BADTEMPLATENAME);
4002
4003         if ((Template::getNameFromId($templateid) != $name) && Template::exists($name))
4004             $this->error(_ERROR_DUPTEMPLATENAME);
4005
4006
4007         $name = sql_real_escape_string($name);
4008         $desc = sql_real_escape_string($desc);
4009
4010         // 1. Remove all template parts
4011         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4012         sql_query($query);
4013
4014         // 2. Update description
4015         $query =  'UPDATE '.sql_table('template_desc').' SET'
4016                . " tdname='" . $name . "',"
4017                . " tddesc='" . $desc . "'"
4018                . " WHERE tdnumber=" . $templateid;
4019         sql_query($query);
4020
4021         // 3. Add non-empty template parts
4022         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4023         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4024         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4025         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4026         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4027         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4028         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4029         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4030         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4031         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4032         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4033         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4034         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4035         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4036         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4037         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4038         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4039         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4040         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4041         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4042         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4043         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4044         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4045         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4046         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4047         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4048         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4049         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4050         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4051         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4052         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4053         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4054         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4055         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4056
4057         $pluginfields = array();
4058         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4059         foreach ($pluginfields as $pfkey=>$pfvalue) {
4060             foreach ($pfvalue as $pffield=>$pfdesc) {
4061                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4062             }
4063         }
4064
4065         // jump back to template edit
4066         $this->action_templateedit(_TEMPLATE_UPDATED);
4067
4068     }
4069
4070         /**
4071          * Admin::addToTemplate()
4072          *
4073          * @param       Integer $id     ID for template
4074          * @param       String  $partname       parts name
4075          * @param       String  $content        template contents
4076          * @return      Integer record index
4077          *
4078          */
4079         function addToTemplate($id, $partname, $content)
4080         {
4081                 // don't add empty parts:
4082                 if ( !trim($content) )
4083                 {
4084                         return -1;
4085                 }
4086
4087                 $partname = sql_real_escape_string($partname);
4088                 $content = sql_real_escape_string($content);
4089
4090                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";
4091                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);
4092                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4093                 return sql_insert_id();
4094         }
4095
4096     /**
4097      * @todo document this
4098      */
4099     function action_templatedelete() {
4100         global $member, $manager;
4101
4102         $member->isAdmin() or $this->disallow();
4103
4104         $templateid = intRequestVar('templateid');
4105         // TODO: check if template can be deleted
4106
4107         $this->pagehead();
4108
4109         $name = Template::getNameFromId($templateid);
4110         $desc = Template::getDesc($templateid);
4111
4112         ?>
4113             <h2><?php echo _DELETE_CONFIRM?></h2>
4114
4115             <p>
4116             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo Entity::hsc($name)?></b> (<?php echo  Entity::hsc($desc) ?>)
4117             </p>
4118
4119             <form method="post" action="index.php"><div>
4120                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4121                 <?php $manager->addTicketHidden() ?>
4122                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4123                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4124             </div></form>
4125         <?php
4126         $this->pagefoot();
4127     }
4128
4129     /**
4130      * @todo document this
4131      */
4132     function action_templatedeleteconfirm() {
4133         global $member, $manager;
4134
4135         $templateid = intRequestVar('templateid');
4136
4137         $member->isAdmin() or $this->disallow();
4138
4139         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4140
4141         // 1. delete description
4142         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4143
4144         // 2. delete parts
4145         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4146
4147         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4148
4149         $this->action_templateoverview();
4150     }
4151
4152     /**
4153      * @todo document this
4154      */
4155     function action_templatenew() {
4156         global $member;
4157
4158         $member->isAdmin() or $this->disallow();
4159
4160         $name = postVar('name');
4161         $desc = postVar('desc');
4162
4163         if (!isValidTemplateName($name))
4164             $this->error(_ERROR_BADTEMPLATENAME);
4165
4166         if (Template::exists($name))
4167             $this->error(_ERROR_DUPTEMPLATENAME);
4168
4169         $newTemplateId = Template::createNew($name, $desc);
4170
4171         $this->action_templateoverview();
4172     }
4173
4174     /**
4175      * @todo document this
4176      */
4177     function action_templateclone() {
4178         global $member;
4179
4180         $templateid = intRequestVar('templateid');
4181
4182         $member->isAdmin() or $this->disallow();
4183
4184         // 1. read old template
4185         $name = Template::getNameFromId($templateid);
4186         $desc = Template::getDesc($templateid);
4187
4188         // 2. create desc thing
4189         $name = "cloned" . $name;
4190
4191         // if a template with that name already exists:
4192         if (Template::exists($name)) {
4193             $i = 1;
4194             while (Template::exists($name . $i))
4195                 $i++;
4196             $name .= $i;
4197         }
4198
4199         $newid = Template::createNew($name, $desc);
4200
4201         // 3. create clone
4202         // go through parts of old template and add them to the new one
4203         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4204         while ($o = sql_fetch_object($res)) {
4205             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4206         }
4207
4208         $this->action_templateoverview();
4209     }
4210
4211     /**
4212      * @todo document this
4213      */
4214     function action_skinoverview() {
4215         global $member, $manager;
4216
4217         $member->isAdmin() or $this->disallow();
4218
4219         $this->pagehead();
4220
4221         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4222
4223         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4224
4225         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4226
4227         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4228         $template['content'] = 'skinlist';
4229         $template['tabindex'] = 10;
4230         showlist($query,'table',$template);
4231
4232         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4233
4234         ?>
4235         <form method="post" action="index.php">
4236         <div>
4237
4238         <input name="action" value="skinnew" type="hidden" />
4239         <?php $manager->addTicketHidden() ?>
4240         <table><tr>
4241             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4242             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4243         </tr><tr>
4244             <td><?php echo _SKIN_DESC?></td>
4245             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4246         </tr><tr>
4247             <td><?php echo _SKIN_CREATE?></td>
4248             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4249         </tr></table>
4250
4251         </div>
4252         </form>
4253
4254         <?php
4255         $this->pagefoot();
4256     }
4257
4258     /**
4259      * @todo document this
4260      */
4261     function action_skinnew() {
4262         global $member;
4263
4264         $member->isAdmin() or $this->disallow();
4265
4266         $name = trim(postVar('name'));
4267         $desc = trim(postVar('desc'));
4268
4269         if (!isValidSkinName($name))
4270             $this->error(_ERROR_BADSKINNAME);
4271
4272         if (SKIN::exists($name))
4273             $this->error(_ERROR_DUPSKINNAME);
4274
4275         $newId = SKIN::createNew($name, $desc);
4276
4277         $this->action_skinoverview();
4278     }
4279
4280     /**
4281      * @todo document this
4282      */
4283     function action_skinedit() {
4284         global $member, $manager;
4285
4286         $skinid = intRequestVar('skinid');
4287
4288         $member->isAdmin() or $this->disallow();
4289
4290         $skin = new SKIN($skinid);
4291
4292         $this->pagehead();
4293         ?>
4294         <p>
4295             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4296         </p>
4297         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4298
4299         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4300         <?php echo _SKIN_PARTS_MSG?>
4301         <ul>
4302             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4303             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4304             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4305             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4306             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4307             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4308             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4309             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4310         </ul>
4311
4312         <?php
4313
4314         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4315         $res = sql_query($query);
4316
4317         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4318         echo '<form method="get" action="index.php">' . "\r\n";
4319         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4320         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4321         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4322         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4323         echo '</form>' . "\r\n";
4324
4325         if ($res && sql_num_rows($res) > 0) {
4326             echo '<ul>';
4327             $tabstart = 75;
4328
4329             while ($row = sql_fetch_assoc($res)) {
4330                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . Entity::hsc(strtolower($row['stype'])) . '">' . Entity::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . Entity::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4331             }
4332
4333             echo '</ul>';
4334         }
4335
4336         ?>
4337
4338         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4339         <form method="post" action="index.php">
4340         <div>
4341
4342         <input type="hidden" name="action" value="skineditgeneral" />
4343         <?php $manager->addTicketHidden() ?>
4344         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4345         <table><tr>
4346             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4347             <td><input name="name" tabindex="90" value="<?php echo  Entity::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4348         </tr><tr>
4349             <td><?php echo _SKIN_DESC?></td>
4350             <td><input name="desc" tabindex="100" value="<?php echo  Entity::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4351         </tr><tr>
4352             <td><?php echo _SKIN_TYPE?></td>
4353             <td><input name="type" tabindex="110" value="<?php echo  Entity::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4354         </tr><tr>
4355             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4356             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4357         </tr><tr>
4358             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4359             <td><input name="inc_prefix" tabindex="130" value="<?php echo  Entity::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4360         </tr><tr>
4361             <td><?php echo _SKIN_CHANGE?></td>
4362             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4363         </tr></table>
4364
4365         </div>
4366         </form>
4367
4368
4369         <?php       $this->pagefoot();
4370     }
4371
4372     /**
4373      * @todo document this
4374      */
4375     function action_skineditgeneral() {
4376         global $member;
4377
4378         $skinid = intRequestVar('skinid');
4379
4380         $member->isAdmin() or $this->disallow();
4381
4382         $name = postVar('name');
4383         $desc = postVar('desc');
4384         $type = postVar('type');
4385         $inc_mode = postVar('inc_mode');
4386         $inc_prefix = postVar('inc_prefix');
4387
4388         $skin = new SKIN($skinid);
4389
4390         // 1. Some checks
4391         if (!isValidSkinName($name))
4392             $this->error(_ERROR_BADSKINNAME);
4393
4394         if (($skin->getName() != $name) && SKIN::exists($name))
4395             $this->error(_ERROR_DUPSKINNAME);
4396
4397         if (!$type) $type = 'text/html';
4398         if (!$inc_mode) $inc_mode = 'normal';
4399
4400         // 2. Update description
4401         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4402
4403         $this->action_skinedit();
4404
4405     }
4406
4407     /**
4408      * @todo document this
4409      */
4410     function action_skinedittype($msg = '') {
4411         global $member, $manager;
4412
4413         $skinid = intRequestVar('skinid');
4414         $type = requestVar('type');
4415
4416         $member->isAdmin() or $this->disallow();
4417
4418         $type = trim($type);
4419         $type = strtolower($type);
4420
4421         if (!isValidShortName($type)) {
4422             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4423         }
4424
4425         $skin = new SKIN($skinid);
4426
4427         $friendlyNames = SKIN::getFriendlyNames();
4428
4429         $this->pagehead();
4430         ?>
4431         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4432
4433         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo Entity::hsc($skin->getName()) ?>': <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4434
4435         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4436         ?>
4437
4438
4439         <form method="post" action="index.php">
4440         <div>
4441
4442         <input type="hidden" name="action" value="skinupdate" />
4443         <?php $manager->addTicketHidden() ?>
4444         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4445         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4446
4447         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4448         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4449         (skin type: <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4450         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4451             help('skinpart' . $type);
4452         } else {
4453             help('skinpartspecial');
4454         }?>
4455         <br />
4456
4457         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  Entity::hsc($skin->getContent($type)) ?></textarea>
4458
4459         <br />
4460         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4461         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4462         (skin type: <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4463
4464         <br /><br />
4465         <?php echo _SKIN_ALLOWEDVARS?>
4466         <?php           $actions = SKIN::getAllowedActionsForType($type);
4467
4468             sort($actions);
4469
4470             while ($current = array_shift($actions)) {
4471                 // skip deprecated vars
4472                 if ($current == 'ifcat') continue;
4473                 if ($current == 'imagetext') continue;
4474                 if ($current == 'vars') continue;
4475
4476                 echo helplink('skinvar-' . $current) . "$current</a>";
4477                 if (count($actions) != 0) echo ", ";
4478             }
4479         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4480         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4481         showlist($query,'table',array('content'=>'shortblognames'));
4482         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4483         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4484         showlist($query,'table',array('content'=>'shortnames'));
4485         echo '</div></form>';
4486         $this->pagefoot();
4487     }
4488
4489     /**
4490      * @todo document this
4491      */
4492     function action_skinupdate() {
4493         global $member;
4494
4495         $skinid = intRequestVar('skinid');
4496         $content = trim(postVar('content'));
4497         $type = postVar('type');
4498
4499         $member->isAdmin() or $this->disallow();
4500
4501         $skin = new SKIN($skinid);
4502         $skin->update($type, $content);
4503
4504         $this->action_skinedittype(_SKIN_UPDATED);
4505     }
4506
4507     /**
4508      * @todo document this
4509      */
4510     function action_skindelete() {
4511         global $member, $manager, $CONF;
4512
4513         $skinid = intRequestVar('skinid');
4514
4515         $member->isAdmin() or $this->disallow();
4516
4517         // don't allow default skin to be deleted
4518         if ($skinid == $CONF['BaseSkin'])
4519             $this->error(_ERROR_DEFAULTSKIN);
4520
4521         // don't allow deletion of default skins for blogs
4522         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4523         $r = sql_query($query);
4524         if ($o = sql_fetch_object($r))
4525             $this->error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));
4526
4527         $this->pagehead();
4528
4529         $skin = new SKIN($skinid);
4530         $name = $skin->getName();
4531         $desc = $skin->getDescription();
4532
4533         ?>
4534             <h2><?php echo _DELETE_CONFIRM?></h2>
4535
4536             <p>
4537                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo Entity::hsc($name) ?></b> (<?php echo  Entity::hsc($desc)?>)
4538             </p>
4539
4540             <form method="post" action="index.php"><div>
4541                 <input type="hidden" name="action" value="skindeleteconfirm" />
4542                 <?php $manager->addTicketHidden() ?>
4543                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4544                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4545             </div></form>
4546         <?php
4547         $this->pagefoot();
4548     }
4549
4550     /**
4551      * @todo document this
4552      */
4553     function action_skindeleteconfirm() {
4554         global $member, $CONF, $manager;
4555
4556         $skinid = intRequestVar('skinid');
4557
4558         $member->isAdmin() or $this->disallow();
4559
4560         // don't allow default skin to be deleted
4561         if ($skinid == $CONF['BaseSkin'])
4562             $this->error(_ERROR_DEFAULTSKIN);
4563
4564         // don't allow deletion of default skins for blogs
4565         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4566         $r = sql_query($query);
4567         if ($o = sql_fetch_object($r))
4568             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4569
4570         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4571
4572         // 1. delete description
4573         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4574
4575         // 2. delete parts
4576         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4577
4578         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4579
4580         $this->action_skinoverview();
4581     }
4582
4583     /**
4584      * @todo document this
4585      */
4586     function action_skinremovetype() {
4587         global $member, $manager, $CONF;
4588
4589         $skinid = intRequestVar('skinid');
4590         $skintype = requestVar('type');
4591
4592         if (!isValidShortName($skintype)) {
4593             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4594         }
4595
4596         $member->isAdmin() or $this->disallow();
4597
4598         // don't allow default skinparts to be deleted
4599         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4600             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4601         }
4602
4603         $this->pagehead();
4604
4605         $skin = new SKIN($skinid);
4606         $name = $skin->getName();
4607         $desc = $skin->getDescription();
4608
4609         ?>
4610             <h2><?php echo _DELETE_CONFIRM?></h2>
4611
4612             <p>
4613                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo Entity::hsc($skintype); ?> (<?php echo Entity::hsc($name); ?>)</b> (<?php echo  Entity::hsc($desc)?>)
4614             </p>
4615
4616             <form method="post" action="index.php"><div>
4617                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4618                 <?php $manager->addTicketHidden() ?>
4619                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4620                 <input type="hidden" name="type" value="<?php echo Entity::hsc($skintype); ?>" />
4621                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4622             </div></form>
4623         <?php
4624         $this->pagefoot();
4625     }
4626
4627     /**
4628      * @todo document this
4629      */
4630     function action_skinremovetypeconfirm() {
4631         global $member, $CONF, $manager;
4632
4633         $skinid = intRequestVar('skinid');
4634         $skintype = requestVar('type');
4635
4636         if (!isValidShortName($skintype)) {
4637             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4638         }
4639
4640         $member->isAdmin() or $this->disallow();
4641
4642         // don't allow default skinparts to be deleted
4643         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4644             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4645         }
4646
4647         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4648
4649         // delete part
4650         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4651
4652         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4653
4654         $this->action_skinedit();
4655     }
4656
4657     /**
4658      * @todo document this
4659      */
4660     function action_skinclone() {
4661         global $member;
4662
4663         $skinid = intRequestVar('skinid');
4664
4665         $member->isAdmin() or $this->disallow();
4666
4667         // 1. read skin to clone
4668         $skin = new SKIN($skinid);
4669
4670         $name = "clone_" . $skin->getName();
4671
4672         // if a skin with that name already exists:
4673         if (SKIN::exists($name)) {
4674             $i = 1;
4675             while (SKIN::exists($name . $i))
4676                 $i++;
4677             $name .= $i;
4678         }
4679
4680         // 2. create skin desc
4681         $newid = SKIN::createNew(
4682             $name,
4683             $skin->getDescription(),
4684             $skin->getContentType(),
4685             $skin->getIncludeMode(),
4686             $skin->getIncludePrefix()
4687         );
4688
4689
4690         // 3. clone
4691         /*
4692         $this->skinclonetype($skin, $newid, 'index');
4693         $this->skinclonetype($skin, $newid, 'item');
4694         $this->skinclonetype($skin, $newid, 'archivelist');
4695         $this->skinclonetype($skin, $newid, 'archive');
4696         $this->skinclonetype($skin, $newid, 'search');
4697         $this->skinclonetype($skin, $newid, 'error');
4698         $this->skinclonetype($skin, $newid, 'member');
4699         $this->skinclonetype($skin, $newid, 'imagepopup');
4700         */
4701
4702         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4703         $res = sql_query($query);
4704         while ($row = sql_fetch_assoc($res)) {
4705             $this->skinclonetype($skin, $newid, $row['stype']);
4706         }
4707
4708         $this->action_skinoverview();
4709
4710     }
4711
4712         /**
4713          * Admin::skinclonetype()
4714          *
4715          * @param       String  $skin   Skin object
4716          * @param       Integer $newid  ID for this clone
4717          * @param       String  $type   type of skin
4718          * @return      Void
4719          */
4720         function skinclonetype($skin, $newid, $type)
4721         {
4722                 $newid = intval($newid);
4723                 $content = $skin->getContent($type);
4724
4725                 if ( $content )
4726                 {
4727                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";
4728                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);
4729                         sql_query($query);
4730                 }
4731                 return;
4732         }
4733
4734         /**
4735          * Admin::action_settingsedit()
4736          *
4737          * @param       Void
4738          * @return      Void
4739          */
4740         function action_settingsedit() {
4741                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4742
4743                 $member->isAdmin() or $this->disallow();
4744
4745                 $this->pagehead();
4746
4747                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4748                 ?>
4749
4750                 <h2><?php echo _SETTINGS_TITLE?></h2>
4751
4752                 <form action="index.php" method="post">
4753                 <div>
4754
4755                 <input type="hidden" name="action" value="settingsupdate" />
4756                 <?php $manager->addTicketHidden() ?>
4757
4758                 <table><tr>
4759                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4760                 </tr><tr>
4761                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4762                         <td>
4763                                 <?php
4764                                         $query =  'SELECT bname as text, bnumber as value'
4765                                                    . ' FROM '.sql_table('blog');
4766                                         $template['name'] = 'DefaultBlog';
4767                                         $template['selected'] = $CONF['DefaultBlog'];
4768                                         $template['tabindex'] = 10;
4769                                         showlist($query,'select',$template);
4770                                 ?>
4771                         </td>
4772                 </tr><tr>
4773                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4774                         <td>
4775                                 <?php
4776                                         $query =  'SELECT sdname as text, sdnumber as value'
4777                                                    . ' FROM '.sql_table('skin_desc');
4778                                         $template['name'] = 'BaseSkin';
4779                                         $template['selected'] = $CONF['BaseSkin'];
4780                                         $template['tabindex'] = 1;
4781                                         showlist($query,'select',$template);
4782                                 ?>
4783                         </td>
4784                 </tr><tr>
4785                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4786                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  Entity::hsc($CONF['AdminEmail']) ?>" /></td>
4787                 </tr><tr>
4788                         <td><?php echo _SETTINGS_SITENAME?></td>
4789                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  Entity::hsc($CONF['SiteName']) ?>" /></td>
4790                 </tr><tr>
4791                         <td><?php echo _SETTINGS_SITEURL?></td>
4792                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  Entity::hsc($CONF['IndexURL']) ?>" /></td>
4793                 </tr><tr>
4794                         <td><?php echo _SETTINGS_ADMINURL?></td>
4795                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  Entity::hsc($CONF['AdminURL']) ?>" /></td>
4796                 </tr><tr>
4797                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4798                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  Entity::hsc($CONF['PluginURL']) ?>" /></td>
4799                 </tr><tr>
4800                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4801                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  Entity::hsc($CONF['SkinsURL']) ?>" /></td>
4802                 </tr><tr>
4803                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4804                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  Entity::hsc($CONF['ActionURL']) ?>" /></td>
4805                 </tr><tr>
4806                         <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>
4807                         </td>
4808                         <td>
4809                                 <select name="Locale" tabindex="10050">
4810                         <?php
4811                                 $locales = i18n::get_available_locale_list();
4812                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4813                                 {
4814                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4815                                 }
4816                                 else
4817                                 {
4818                                         echo "<option value=\"\">en_Latn_US</option>\n";
4819                                 }
4820
4821                                 foreach ( $locales as $locale )
4822                                 {
4823                                         if ( $locale == 'en_Latn_US' )
4824                                         {
4825                                                 continue;
4826                                         }
4827                                         if ( $locale == i18n::get_current_locale() )
4828                                         {
4829                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4830                                         }
4831                                         else
4832                                         {
4833                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4834                                         }
4835                                 }
4836                         ?>
4837                         </select>
4838
4839                         </td>
4840                 </tr><tr>
4841                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4842                         </td>
4843                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4844                                         <br />
4845                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  Entity::hsc($CONF['DisableSiteURL'])?>" />
4846                         </td>
4847                 </tr><tr>
4848                         <td><?php echo _SETTINGS_DIRS?></td>
4849                         <td><?php echo  Entity::hsc($DIR_NUCLEUS) ?>
4850                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4851                 </tr><tr>
4852                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4853                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4854                 </tr><tr>
4855                         <td>
4856                         <?php
4857                                 echo _SETTINGS_JSTOOLBAR
4858                                 /* =_SETTINGS_DISABLEJS
4859
4860                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4861                                         way to select the javascript version to use
4862
4863                                         now, its:
4864                                                 0 : IE
4865                                                 1 : all javascript disabled
4866                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4867                                 */
4868                            ?>
4869                         </td>
4870                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4871                                 <select name="DisableJsTools" tabindex="10075">
4872                         <?php                              $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4873                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4874                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4875                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4876                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4877                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4878                         ?>
4879                                 </select>
4880                         </td>
4881                 </tr><tr>
4882                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4883                                            <td><?php
4884
4885                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4886                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4887
4888                                            echo ' ', _SETTINGS_URLMODE_HELP;
4889
4890                                                          ?>
4891
4892                                            </td>
4893                 </tr><tr>
4894                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4895                                            <td><?php
4896
4897                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4898
4899                                                          ?>
4900
4901                                            </td>
4902                 </tr><tr>
4903                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4904                         <td>
4905                         <?php
4906                                 if (!array_key_exists('DefaultListSize',$CONF)) {
4907                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4908                                         $CONF['DefaultListSize'] = 10;
4909                                 }
4910                         ?>
4911                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  Entity::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4912                         </td>
4913                 </tr><tr>
4914                         <td><?php echo _SETTINGS_ADMINCSS?>
4915                         </td>
4916                         <td>
4917
4918                                 <select name="AdminCSS" tabindex="10080">
4919                                 <?php                      // show a dropdown list of all available admin css files
4920                                 global $DIR_NUCLEUS;
4921
4922                                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4923
4924                                 while ($filename = readdir($dirhandle) )
4925                                 {
4926
4927                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4928                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4929
4930                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4931                                         {
4932
4933                                                 $name = $matches[1];
4934                                                 echo "<option value=\"$name\"";
4935
4936                                                 if ($name == $CONF['AdminCSS'])
4937                                                 {
4938                                                         echo " selected=\"selected\"";
4939                                                 }
4940
4941                                                 echo ">$name</option>";
4942
4943                                         }
4944
4945                                 }
4946
4947                                 closedir($dirhandle);
4948
4949                                 ?>
4950                                 </select>
4951
4952                         </td>
4953                 </tr><tr>
4954                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4955                 </tr><tr>
4956                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4957                         <td><?php echo  Entity::hsc($DIR_MEDIA) ?>
4958                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4959                                 <?php                              if (!is_dir($DIR_MEDIA))
4960                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4961                                         if (!is_readable($DIR_MEDIA))
4962                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4963                                         if (!is_writeable($DIR_MEDIA))
4964                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4965                                 ?>
4966                         </td>
4967                 </tr><tr>
4968                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4969                         <td>
4970                                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  Entity::hsc($CONF['MediaURL']) ?>" />
4971                         </td>
4972                 </tr><tr>
4973                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4974                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4975                 </tr><tr>
4976                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4977                         <td>
4978                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  Entity::hsc($CONF['AllowedTypes']) ?>" />
4979                         </td>
4980                 </tr><tr>
4981                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4982                         <td>
4983                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  Entity::hsc($CONF['MaxUploadSize']) ?>" />
4984                         </td>
4985                 </tr><tr>
4986                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4987                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4988
4989                 </tr><tr>
4990                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4991                 </tr><tr>
4992                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4993                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4994                 </tr><tr>
4995                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4996                                 <?php help('allowaccountcreation'); ?>
4997                         </td>
4998                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4999                         </td>
5000                 </tr><tr>
5001                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
5002                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
5003                         </td>
5004                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
5005                         </td>
5006                 </tr><tr>
5007                         <td><?php echo _SETTINGS_MEMBERMSGS?>
5008                                 <?php help('messageservice'); ?>
5009                         </td>
5010                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
5011                         </td>
5012                 </tr><tr>
5013                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
5014                                 <?php help('messageservice'); ?>
5015                         </td>
5016                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5017                         </td>
5018                 </tr><tr>
5019                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5020                                 <?php help('protectmemnames'); ?>
5021                         </td>
5022                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5023                         </td>
5024
5025
5026
5027                 </tr><tr>
5028                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5029                 </tr><tr>
5030                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5031                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  Entity::hsc($CONF['CookiePrefix'])?>" /></td>
5032                 </tr><tr>
5033                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5034                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  Entity::hsc($CONF['CookieDomain'])?>" /></td>
5035                 </tr><tr>
5036                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
5037                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  Entity::hsc($CONF['CookiePath'])?>" /></td>
5038                 </tr><tr>
5039                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
5040                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5041                 </tr><tr>
5042                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
5043                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5044                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5045                         </td>
5046                 </tr><tr>
5047                         <td><?php echo _SETTINGS_LASTVISIT?></td>
5048                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5049
5050
5051
5052                 </tr><tr>
5053                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5054                 </tr><tr>
5055                         <td><?php echo _SETTINGS_UPDATE?></td>
5056                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5057                 </tr></table>
5058
5059                 </div>
5060                 </form>
5061
5062                 <?php
5063                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5064
5065                         $manager->notify(
5066                                 'GeneralSettingsFormExtras',
5067                                 array()
5068                         );
5069
5070                 $this->pagefoot();
5071         }
5072
5073         /**
5074          * Admin::action_settingsupdate()
5075          * Update $CONFIG and redirect
5076          *
5077          * @param       void
5078          * @return      void
5079          */
5080         function action_settingsupdate() {
5081                 global $member, $CONF;
5082
5083                 $member->isAdmin() or $this->disallow();
5084
5085                 // check if email address for admin is valid
5086                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5087                 {
5088                         $this->error(_ERROR_BADMAILADDRESS);
5089                 }
5090
5091                 // save settings
5092                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5093                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5094                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5095                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5096                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5097                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5098                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5099                 $this->updateConfig('Locale',              postVar('Locale'));
5100                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5101                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5102                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5103                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5104                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5105                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5106                 $this->updateConfig('SiteName',          postVar('SiteName'));
5107                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5108                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5109                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5110                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5111                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5112                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5113                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5114                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5115                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5116                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5117                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5118                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5119                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5120                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5121                 $this->updateConfig('URLMode',            postVar('URLMode'));
5122                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5123                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5124                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5125                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5126
5127                 // load new config and redirect (this way, the new locale will be used is necessary)
5128                 // note that when changing cookie settings, this redirect might cause the user
5129                 // to have to log in again.
5130                 getConfig();
5131                 redirect($CONF['AdminURL'] . '?action=manage');
5132                 exit;
5133         }
5134
5135         /**
5136          * Admin::action_systemoverview()
5137          * Output system overview
5138          *
5139          * @param       void
5140          * @return      void
5141          */
5142         function action_systemoverview()
5143         {
5144                 global $member, $nucleus, $CONF;
5145
5146                 $this->pagehead();
5147
5148                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5149
5150                 if ( $member->isLoggedIn() && $member->isAdmin() )
5151                 {
5152                         // Information about the used PHP and MySQL installation
5153                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5154
5155                         // Version of PHP MySQL
5156                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5157                         echo "<thead>\n";
5158                         echo "<tr>\n";
5159                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5160                         echo "</tr>\n";
5161                         echo "</thead>\n";
5162                         echo "<tbody>\n";
5163                         echo "<tr>\n";
5164                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5165                         echo '<td>' . phpversion() . "</td>\n";
5166                         echo "</tr>\n";
5167                         echo "<tr>\n";
5168                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5169                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5170                         echo "</tr>\n";
5171                         echo "</tbody>\n";
5172                         echo "</table>\n\n";
5173
5174                         // Important PHP settings
5175                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5176                         echo "<thead>\n";
5177                         echo "<tr>\n";
5178                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5179                         echo "</tr>\n";
5180                         echo "</thead>\n";
5181                         echo "<tbody>\n";
5182                         echo "<tr>\n";
5183                         echo '<td>magic_quotes_gpc' . "</td>\n";
5184                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5185                         echo '<td>' . $mqg . "</td>\n";
5186                         echo "</tr>\n";
5187                         echo "<tr>\n";
5188                         echo '<td>magic_quotes_runtime' . "</td>\n";
5189                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5190                         echo '<td>' . $mqr . "</td>\n";
5191                         echo "</tr>\n";
5192                         echo "<tr>\n";
5193                         echo '<td>register_globals' . "</td>\n";
5194                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5195                         echo '<td>' . $rg . "</td>\n";
5196                         echo "</tr>\n";
5197                         echo "</tbody>\n";
5198                         echo "</table>\n\n";
5199
5200                         // Information about GD library
5201                         $gdinfo = gd_info();
5202                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5203                         echo "<thead>\n";
5204                         echo "<tr>\n";
5205                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5206                         echo "</tr>\n";
5207                         echo "</thead>\n";
5208                         echo "<tbody>\n";
5209                         foreach ( $gdinfo as $key=>$value )
5210                         {
5211                                 if ( is_bool($value) )
5212                                 {
5213                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5214                                 }
5215                                 else
5216                                 {
5217                                         $value = Entity::hsc($value);
5218                                 }
5219                                 echo "<tr>\n";
5220                                 echo '<td>' . $key . "</td>\n";
5221                                 echo '<td>' . $value . "</td>\n";
5222                                 echo "</tr>\n";
5223                         }
5224                         echo "</tbody>\n";
5225                         echo "</table>\n\n";
5226
5227                         // Check if special modules are loaded
5228                         ob_start();
5229                         phpinfo(INFO_MODULES);
5230                         $im = ob_get_contents();
5231                         ob_clean();
5232                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5233                         echo "<thead>\n";
5234                         echo "<tr>";
5235                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5236                         echo "</tr>\n";
5237                         echo "<tbody>\n";
5238                         echo "<tr>\n";
5239                         echo '<td>mod_rewrite' . "</td>\n";
5240                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5241                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5242                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5243                         echo '<td>' . $modrewrite . "</td>\n";
5244                         echo "</tr>\n";
5245                         echo "</tbody>\n";
5246                         echo "</table>\n\n";
5247
5248                         // Information about the used Nucleus CMS
5249                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5250                         global $nucleus;
5251                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5252                         $np = getNucleusPatchLevel();
5253                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5254                         echo "<thead>\n";
5255                         echo "<tr>\n";
5256                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5257                         echo "</tr>\n";
5258                         echo "</thead>\n";
5259                         echo "<tbody>\n";
5260                         echo "<tr>\n";
5261                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5262                         echo '<td>' . $nv . "</td>\n";
5263                         echo "</tr>\n";
5264                         echo "<tr>\n";
5265                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5266                         echo '<td>' . $np . "</td>\n";
5267                         echo "</tr>\n";
5268                         echo "</tbody>\n";
5269                         echo "</table>\n\n";
5270
5271                         // Important settings of the installation
5272                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5273                         echo "<thead>\n";
5274                         echo "<tr>\n";
5275                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5276                         echo "</tr>\n";
5277                         echo "</thead>\n";
5278                         echo "<tbody>\n";
5279                         echo "<tr>\n";
5280                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5281                         echo '<td>' . $CONF['Self'] . "</td>\n";
5282                         echo "</tr>\n";
5283                         echo "<tr>\n";
5284                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5285                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5286                         echo "</tr>\n";
5287                         echo "<tr>\n";
5288                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5289                         $ohs = $CONF['alertOnHeadersSent'] ?
5290                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5291                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5292                         echo '<td>' . $ohs . "</td>\n";
5293                         echo "</tr>\n";
5294                         echo "<tr>\n";
5295                         echo "<td>i18n::get_current_charset()</td>\n";
5296                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5297                         echo "</tr>\n";
5298                         echo "</tbody>\n";
5299                         echo "</table>\n\n";
5300
5301                         // Link to the online version test at the Nucleus CMS website
5302                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5303                         if ( $nucleus['codename'] != '')
5304                         {
5305                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5306                         }
5307                         else
5308                         {
5309                                 $codenamestring = '';
5310                         }
5311                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5312                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5313                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5314                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5315                         echo '</a>';
5316                 }
5317                 else
5318                 {
5319                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5320                 }
5321                 $this->pagefoot();
5322         }
5323
5324         /**
5325          * Admin::updateConfig()
5326          *
5327          * @param       string  $name
5328          * @param       string  $val
5329          * @return      integer return the ID in which the latest query posted
5330          */
5331         function updateConfig($name, $val)
5332         {
5333                 $name = sql_real_escape_string($name);
5334                 $val = trim(sql_real_escape_string($val));
5335
5336                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5337                 $query = sprintf($query, sql_table('config'), $val, $name);
5338                 sql_query($query) or die("Query error: " . sql_error());
5339                 return sql_insert_id();
5340         }
5341
5342         /**
5343          * Error message
5344          * @param string $msg message that will be shown
5345          */
5346         function error($msg)
5347         {
5348                 $this->pagehead();
5349
5350                 echo "<h2>Error!</h2>\n";
5351                 echo $msg;
5352                 echo "<br />\n";
5353                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5354                 $this->pagefoot();
5355                 exit;
5356         }
5357
5358         /**
5359          * Admin::disallow()
5360          * add error log and show error page
5361          *
5362          * @param       void
5363          * @return      void
5364          */
5365         function disallow()
5366         {
5367                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5368                 $this->error(_ERROR_DISALLOWED);
5369         }
5370
5371         /**
5372          * Admin::pagehead()
5373          * Output admin page head
5374          *
5375          * @param       void
5376          * @return      void
5377          */
5378         function pagehead($extrahead = '')
5379         {
5380                 global $member, $nucleus, $CONF, $manager;
5381
5382                 $manager->notify(
5383                         'AdminPrePageHead',
5384                         array(
5385                                 'extrahead' => &$extrahead,
5386                                 'action' => $this->action));
5387
5388                 $baseUrl = Entity::hsc($CONF['AdminURL']);
5389                 if ( !array_key_exists('AdminCSS',$CONF) )
5390                 {
5391                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5392                         $CONF['AdminCSS'] = 'original';
5393                 }
5394
5395                 /* HTTP 1.1 application for no caching */
5396                 header("Cache-Control: no-cache, must-revalidate");
5397                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5398
5399                 $root_element = 'html';
5400                 $charset = i18n::get_current_charset();
5401                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5402
5403                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5404                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5405                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5406                 echo "<head>\n";
5407                 echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";
5408                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5409                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5410                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5411                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5412                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5413                 echo "{$extrahead}\n";
5414                 echo "</head>\n\n";
5415                 echo "<body>\n";
5416                 echo "<div id=\"adminwrapper\">\n";
5417                 echo "<div class=\"header\">\n";
5418                 echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";
5419                 echo "</div>\n";
5420                 echo "<div id=\"container\">\n";
5421                 echo "<div id=\"content\">\n";
5422                 echo "<div class=\"loginname\">\n";
5423                 if ( $member->isLoggedIn() )
5424                 {
5425                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5426                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5427                 }
5428                 else
5429                 {
5430                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5431                 }
5432                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5433                 echo '(';
5434
5435                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5436                 {
5437                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5438                 }
5439                 else
5440                 {
5441                         $codenamestring = '';
5442                 }
5443
5444                 if ( $member->isLoggedIn() && $member->isAdmin() )
5445                 {
5446                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5447                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5448
5449                         $newestVersion = getLatestVersion();
5450                         $newestCompare = str_replace('/','.',$newestVersion);
5451                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5452                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5453                         {
5454                                 echo "<br />\n";
5455                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5456                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5457                                 echo "</a>";
5458                         }
5459                 }
5460                 else
5461                 {
5462                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5463                 }
5464                 echo ')';
5465                 echo '</div>';
5466                 return;
5467         }
5468
5469         /**
5470          * Admin::pagefoot()
5471          * Output admin page foot include quickmenu
5472          *
5473          * @param       void
5474          * @return      void
5475          */
5476         function pagefoot()
5477         {
5478                 global $action, $member, $manager;
5479
5480                 $manager->notify(
5481                         'AdminPrePageFoot',
5482                         array('action' => $this->action)
5483                 );
5484
5485                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5486                 {
5487                         echo '<h2>' . _LOGOUT . "</h2>\n";
5488                         echo "<ul>\n";
5489                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5490                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5491                         echo "</ul>\n";
5492                 }
5493
5494                 echo "<div class=\"foot\">\n";
5495                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5496                 echo '-';
5497                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5498                 echo "</div>\n";
5499
5500                 echo "<!-- content -->\n";
5501                 echo "<div id=\"quickmenu\">\n";
5502
5503                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5504                 {
5505                         echo "<ul>\n";
5506                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5507                         echo "</ul>\n";
5508
5509                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5510                         echo "<form method=\"get\" action=\"index.php\">\n";
5511                         echo "<p>\n";
5512                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5513
5514                         $showAll = requestVar('showall');
5515
5516                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5517                         {
5518                                 // Super-Admins have access to all blogs! (no add item support though)
5519                                 $query =  'SELECT bnumber as value, bname as text'
5520                                                 . ' FROM ' . sql_table('blog')
5521                                                 . ' ORDER BY bname';
5522                         }
5523                         else
5524                         {
5525                                 $query =  'SELECT bnumber as value, bname as text'
5526                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5527                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5528                                                 . ' ORDER BY bname';
5529                         }
5530                         $template['name'] = 'blogid';
5531                         $template['tabindex'] = 15000;
5532                         $template['extra'] = _QMENU_ADD_SELECT;
5533                         $template['selected'] = -1;
5534                         $template['shorten'] = 10;
5535                         $template['shortenel'] = '';
5536                         $template['javascript'] = 'onchange="return form.submit()"';
5537                         showlist($query,'select',$template);
5538
5539                         echo "</p>\n";
5540                         echo "</form>\n";
5541
5542                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5543                         echo "<ul>\n";
5544                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5545                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5546                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5547                         echo "</ul>\n";
5548
5549                         // ---- general settings ----
5550                         if ( $member->isAdmin() )
5551                         {
5552                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5553                                 echo "<ul>\n";
5554                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5555                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5556                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5557                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5558                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5559                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5560                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5561                                 echo "</ul>\n";
5562
5563                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5564                                 echo "<ul>\n";
5565                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5566                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5567                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5568                                 echo "</ul>\n";
5569                         }
5570
5571                         $aPluginExtras = array();
5572                         $manager->notify(
5573                                 'QuickMenu',
5574                                 array(
5575                                         'options' => &$aPluginExtras));
5576
5577                         if ( count($aPluginExtras) > 0 )
5578                         {
5579                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5580                                 echo "<ul>\n";
5581                                 foreach ( $aPluginExtras as $aInfo )
5582                                 {
5583                                         echo '<li><a href="' . Entity::hsc($aInfo['url']) . '" title="' . Entity::hsc($aInfo['tooltip']) . '">' . Entity::hsc($aInfo['title']) . "</a></li>\n";
5584                                 }
5585                                 echo "</ul>\n";
5586                         }
5587                 }
5588                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5589                 {
5590
5591                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5592                 }
5593                 else
5594                 {
5595                         // introduction text on login screen
5596                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5597                 }
5598
5599                 echo "<!-- quickmenu -->\n";
5600                 echo "</div>\n";
5601
5602                 echo "<!-- content -->\n";
5603                 echo "</div>\n";
5604
5605                 echo "<!-- container -->\n";
5606                 echo "</div>\n";
5607
5608                 echo "<!-- adminwrapper -->\n";
5609                 echo "</div>\n";
5610
5611                 echo "</body>\n";
5612                 echo "</html>\n";
5613                 return;
5614         }
5615
5616     /**
5617      * @todo document this
5618      */
5619     function action_regfile() {
5620         global $member, $CONF;
5621
5622         $blogid = intRequestVar('blogid');
5623
5624         $member->teamRights($blogid) or $this->disallow();
5625
5626         // header-code stolen from phpMyAdmin
5627         // REGEDIT and bookmarklet code stolen from GreyMatter
5628
5629         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5630
5631
5632         header('Content-Type: application/octetstream');
5633         header('Content-Disposition: filename="nucleus.reg"');
5634         header('Pragma: no-cache');
5635         header('Expires: 0');
5636
5637         echo "REGEDIT4\n";
5638         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5639         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5640         echo '"contexts"=hex:31';
5641     }
5642
5643     /**
5644      * @todo document this
5645      */
5646     function action_bookmarklet() {
5647         global $member, $manager;
5648
5649         $blogid = intRequestVar('blogid');
5650
5651         $member->teamRights($blogid) or $this->disallow();
5652
5653         $blog =& $manager->getBlog($blogid);
5654         $bm = getBookmarklet($blogid);
5655
5656         $this->pagehead();
5657
5658         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5659
5660         ?>
5661
5662         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5663
5664         <p>
5665         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5666         </p>
5667
5668         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5669         <p>
5670             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5671             <br />
5672             <br />
5673             <?php echo '<a href="' . Entity::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, Entity::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5674         </p>
5675
5676         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5677         <p>
5678             <?php
5679                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5680                 $url = $manager->addTicketToUrl($url);
5681             ?>
5682             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . Entity::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5683         </p>
5684
5685         <p>
5686             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5687         </p>
5688
5689         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5690         <p>
5691             <?php echo _BOOKMARKLET_DELETEBAR ?>
5692         </p>
5693
5694         <p>
5695             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5696         </p>
5697
5698         <ol>
5699             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5700             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5701             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5702             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5703             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5704         </ol>
5705
5706         <?php
5707         $this->pagefoot();
5708
5709     }
5710
5711     /**
5712      * @todo document this
5713      */
5714     function action_actionlog() {
5715         global $member, $manager;
5716
5717         $member->isAdmin() or $this->disallow();
5718
5719         $this->pagehead();
5720
5721         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5722
5723         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5724
5725         ?>
5726             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5727             <p><a href="<?php echo Entity::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5728         <?php
5729         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5730
5731         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5732         $template['content'] = 'actionlist';
5733         $amount = showlist($query,'table',$template);
5734
5735         $this->pagefoot();
5736
5737     }
5738
5739     /**
5740      * @todo document this
5741      */
5742     function action_banlist() {
5743         global $member, $manager;
5744
5745         $blogid = intRequestVar('blogid');
5746
5747         $member->blogAdminRights($blogid) or $this->disallow();
5748
5749         $blog =& $manager->getBlog($blogid);
5750
5751         $this->pagehead();
5752
5753         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5754
5755         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5756
5757         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5758         $template['content'] = 'banlist';
5759         $amount = showlist($query,'table',$template);
5760
5761         if ($amount == 0)
5762             echo _BAN_NONE;
5763
5764         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5765         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5766
5767
5768         $this->pagefoot();
5769
5770     }
5771
5772     /**
5773      * @todo document this
5774      */
5775     function action_banlistdelete() {
5776         global $member, $manager;
5777
5778         $blogid = intRequestVar('blogid');
5779         $iprange = requestVar('iprange');
5780
5781         $member->blogAdminRights($blogid) or $this->disallow();
5782
5783         $blog =& $manager->getBlog($blogid);
5784         $banBlogName =  Entity::hsc($blog->getName());
5785
5786         $this->pagehead();
5787         ?>
5788             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5789
5790             <form method="post" action="index.php">
5791
5792             <h3><?php echo _BAN_IPRANGE?></h3>
5793
5794             <p>
5795                 <?php echo _CONFIRMTXT_BAN?> <?php echo Entity::hsc($iprange) ?>
5796                 <input name="iprange" type="hidden" value="<?php echo Entity::hsc($iprange)?>" />
5797             </p>
5798
5799             <h3><?php echo _BAN_BLOGS?></h3>
5800
5801             <div>
5802                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5803                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5804                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5805                 <br />
5806                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5807             </div>
5808
5809             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5810
5811             <div>
5812                 <?php $manager->addTicketHidden() ?>
5813                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5814                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5815             </div>
5816
5817             </form>
5818         <?php
5819         $this->pagefoot();
5820     }
5821
5822     /**
5823      * @todo document this
5824      */
5825     function action_banlistdeleteconfirm() {
5826         global $member, $manager;
5827
5828         $blogid = intPostVar('blogid');
5829         $allblogs = postVar('allblogs');
5830         $iprange = postVar('iprange');
5831
5832         $member->blogAdminRights($blogid) or $this->disallow();
5833
5834         $deleted = array();
5835
5836         if (!$allblogs) {
5837             if (Ban::removeBan($blogid, $iprange))
5838                 array_push($deleted, $blogid);
5839         } else {
5840             // get blogs fot which member has admin rights
5841             $adminblogs = $member->getAdminBlogs();
5842             foreach ($adminblogs as $blogje) {
5843                 if (Ban::removeBan($blogje, $iprange))
5844                     array_push($deleted, $blogje);
5845             }
5846         }
5847
5848         if (sizeof($deleted) == 0)
5849             $this->error(_ERROR_DELETEBAN);
5850
5851         $this->pagehead();
5852
5853         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5854         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5855         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5856
5857         echo "<ul>";
5858         foreach ($deleted as $delblog) {
5859             $b =& $manager->getBlog($delblog);
5860             echo "<li>" . Entity::hsc($b->getName()). "</li>";
5861         }
5862         echo "</ul>";
5863
5864         $this->pagefoot();
5865
5866     }
5867
5868     /**
5869      * @todo document this
5870      */
5871     function action_banlistnewfromitem() {
5872         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5873     }
5874
5875     /**
5876      * @todo document this
5877      */
5878     function action_banlistnew($blogid = '') {
5879         global $member, $manager;
5880
5881         if ($blogid == '')
5882             $blogid = intRequestVar('blogid');
5883
5884         $ip = requestVar('ip');
5885
5886         $member->blogAdminRights($blogid) or $this->disallow();
5887
5888         $blog =& $manager->getBlog($blogid);
5889
5890         $this->pagehead();
5891         ?>
5892         <h2><?php echo _BAN_ADD_TITLE?></h2>
5893
5894
5895         <form method="post" action="index.php">
5896
5897         <h3><?php echo _BAN_IPRANGE?></h3>
5898
5899         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5900
5901         <div class="note">
5902             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5903             <?php echo _BAN_EXAMPLE_TEXT ?>
5904         </div>
5905
5906         <div>
5907         <?php
5908         if ($ip) {
5909             $iprangeVal = Entity::hsc($ip);
5910         ?>
5911             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5912             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5913             <br />
5914             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5915             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5916             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5917         <?php
5918         } else {
5919             echo "<input name='iprange' value='custom' type='hidden' />";
5920             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5921         }
5922         ?>
5923         </div>
5924
5925         <h3><?php echo _BAN_BLOGS?></h3>
5926
5927         <p><?php echo _BAN_BLOGS_TEXT?></p>
5928
5929         <div>
5930             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5931             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo Entity::hsc($blog->getName())?>'</label>
5932             <br />
5933             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5934         </div>
5935
5936         <h3><?php echo _BAN_REASON_TITLE?></h3>
5937
5938         <p><?php echo _BAN_REASON_TEXT?></p>
5939
5940         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5941
5942         <h3><?php echo _BAN_ADD_TITLE?></h3>
5943
5944         <div>
5945             <input name="action" type="hidden" value="banlistadd" />
5946             <?php $manager->addTicketHidden() ?>
5947             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5948         </div>
5949
5950         </form>
5951
5952         <?php       $this->pagefoot();
5953     }
5954
5955     /**
5956      * @todo document this
5957      */
5958     function action_banlistadd() {
5959         global $member;
5960
5961         $blogid =       intPostVar('blogid');
5962         $allblogs =     postVar('allblogs');
5963         $iprange =      postVar('iprange');
5964         if ($iprange == "custom")
5965             $iprange = postVar('customiprange');
5966         $reason =       postVar('reason');
5967
5968         $member->blogAdminRights($blogid) or $this->disallow();
5969
5970         // TODO: check IP range validity
5971
5972         if (!$allblogs) {
5973             if (!Ban::addBan($blogid, $iprange, $reason))
5974                 $this->error(_ERROR_ADDBAN);
5975         } else {
5976             // get blogs fot which member has admin rights
5977             $adminblogs = $member->getAdminBlogs();
5978             $failed = 0;
5979             foreach ($adminblogs as $blogje) {
5980                 if (!Ban::addBan($blogje, $iprange, $reason))
5981                     $failed = 1;
5982             }
5983             if ($failed)
5984                 $this->error(_ERROR_ADDBAN);
5985         }
5986
5987         $this->action_banlist();
5988
5989     }
5990
5991     /**
5992      * @todo document this
5993      */
5994     function action_clearactionlog() {
5995         global $member;
5996
5997         $member->isAdmin() or $this->disallow();
5998
5999         ActionLog::clear();
6000
6001         $this->action_manage(_MSG_ACTIONLOGCLEARED);
6002     }
6003
6004     /**
6005      * @todo document this
6006      */
6007     function action_backupoverview() {
6008         global $member, $manager;
6009
6010         $member->isAdmin() or $this->disallow();
6011
6012         $this->pagehead();
6013
6014         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6015         ?>
6016         <h2><?php echo _BACKUPS_TITLE?></h2>
6017
6018         <h3><?php echo _BACKUP_TITLE?></h3>
6019
6020         <p><?php echo _BACKUP_INTRO?></p>
6021
6022         <form method="post" action="index.php"><p>
6023         <input type="hidden" name="action" value="backupcreate" />
6024         <?php $manager->addTicketHidden() ?>
6025
6026         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
6027         <br />
6028         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
6029         <br /><br />
6030         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
6031
6032         </p></form>
6033
6034         <div class="note"><?php echo _BACKUP_NOTE?></div>
6035
6036
6037         <h3><?php echo _RESTORE_TITLE?></h3>
6038
6039         <div class="note"><?php echo _RESTORE_NOTE?></div>
6040
6041         <p><?php echo _RESTORE_INTRO?></p>
6042
6043         <form method="post" action="index.php" enctype="multipart/form-data"><p>
6044             <input type="hidden" name="action" value="backuprestore" />
6045             <?php $manager->addTicketHidden() ?>
6046             <input name="backup_file" type="file" tabindex="30" />
6047             <br /><br />
6048             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6049             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6050             <br /><?php echo _RESTORE_WARNING?>
6051         </p></form>
6052
6053         <?php       $this->pagefoot();
6054     }
6055
6056         /**
6057          * Admin::action_backupcreate()
6058          * create file for backup
6059          *
6060          * @param               void
6061          * @return      void
6062          *
6063          */
6064         function action_backupcreate()
6065         {
6066                 global $member, $DIR_LIBS;
6067
6068                 $member->isAdmin() or $this->disallow();
6069
6070                 // use compression ?
6071                 $useGzip = (integer) postVar('gzip');
6072
6073                 include($DIR_LIBS . 'backup.php');
6074
6075                 // try to extend time limit
6076                 // (creating/restoring dumps might take a while)
6077                 @set_time_limit(1200);
6078
6079                 Backup::do_backup($useGzip);
6080                 exit;
6081         }
6082
6083         /**
6084          * Admin::action_backuprestore()
6085          * restoring from uploaded file
6086          *
6087          * @param               void
6088          * @return      void
6089          */
6090         function action_backuprestore()
6091         {
6092                 global $member, $DIR_LIBS;
6093
6094                 $member->isAdmin() or $this->disallow();
6095
6096                 if ( intPostVar('letsgo') != 1 )
6097                 {
6098                         $this->error(_ERROR_BACKUP_NOTSURE);
6099                 }
6100
6101                 include($DIR_LIBS . 'backup.php');
6102
6103                 // try to extend time limit
6104                 // (creating/restoring dumps might take a while)
6105                 @set_time_limit(1200);
6106
6107                 $message = Backup::do_restore();
6108                 if ( $message != '' )
6109                 {
6110                         $this->error($message);
6111                 }
6112                 $this->pagehead();
6113                 echo '<h2>' . _RESTORE_COMPLETE . "</h2>\n";
6114                 $this->pagefoot();
6115                 return;
6116         }
6117
6118         /**
6119          * Admin::action_pluginlist()
6120          * output the list of installed plugins
6121          *
6122          * @param       void
6123          * @return      void
6124          *
6125          */
6126         function action_pluginlist()
6127         {
6128                 global $DIR_PLUGINS, $member, $manager;
6129
6130                 // check if allowed
6131                 $member->isAdmin() or $this->disallow();
6132
6133                 $this->pagehead();
6134
6135                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6136
6137                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6138
6139                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6140
6141                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6142
6143                 $template['content'] = 'pluginlist';
6144                 $template['tabindex'] = 10;
6145                 showlist($query, 'table', $template);
6146
6147                 echo '<h3>' . _PLUGS_TITLE_UPDATE . "</h3>\n";
6148                 echo '<p>' . _PLUGS_TEXT_UPDATE . "</p>\n";
6149                 echo '<form method="post" action="index.php">' . "\n";
6150                 echo "<div>\n";
6151                 echo '<input type="hidden" name="action" value="pluginupdate" />' . "\n";
6152                 $manager->addTicketHidden();
6153                 echo '<input type="submit" value="' . _PLUGS_BTN_UPDATE . '" tabindex="20" />' . "\n";
6154                 echo "</div>\n";
6155                 echo "</form>\n";
6156
6157                 echo '<h3>' . _PLUGS_TITLE_NEW . "</h3>\n";
6158
6159                 // find a list of possibly non-installed plugins
6160                 $candidates = array();
6161                 $dirhandle = opendir($DIR_PLUGINS);
6162
6163                 while ( $filename = readdir($dirhandle) )
6164                 {
6165                         if ( preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6166                         {
6167                                 $name = $matches[1];
6168
6169                                 // only show in list when not yet installed
6170                                 $query = 'SELECT * FROM %s WHERE pfile = "NP_%s"';
6171                                 $query = sprintf($query, sql_table('plugin'), sql_real_escape_string($name));
6172                                 $res = sql_query($query);
6173
6174                                 if ( sql_num_rows($res) == 0 )
6175                                 {
6176                                         array_push($candidates, $name);
6177                                 }
6178                         }
6179                 }
6180
6181                 closedir($dirhandle);
6182
6183                 if ( sizeof($candidates) > 0 )
6184                 {
6185                         echo '<p>' . _PLUGS_ADD_TEXT . "</p>\n";
6186
6187                         echo '<form method="post" action="index.php">' . "\n";
6188                         echo "<div>\n";
6189                         echo '<input type="hidden" name="action" value="pluginadd" />' . "\n";
6190                         $manager->addTicketHidden();
6191                         echo '<select name="filename" tabindex="30">' . "\n";
6192
6193                         foreach ( $candidates as $name )
6194                         {
6195                                 echo '<option value="NP_',$name,'">',Entity::hsc($name),'</option>';
6196                         }
6197
6198                         echo "</select>\n";
6199                         echo '<input type="submit" tabindex="40" value="' . _PLUGS_BTN_INSTALL ."\" />\n";
6200                         echo "</div>\n";
6201                         echo "</form>\n";
6202                 }
6203                 else
6204                 {
6205                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6206                 }
6207
6208                 $this->pagefoot();
6209                 return;
6210         }
6211
6212     /**
6213      * @todo document this
6214      */
6215     function action_pluginhelp() {
6216         global $member, $manager, $DIR_PLUGINS, $CONF;
6217
6218         // check if allowed
6219         $member->isAdmin() or $this->disallow();
6220
6221         $plugid = intGetVar('plugid');
6222
6223         if (!$manager->pidInstalled($plugid))
6224             $this->error(_ERROR_NOSUCHPLUGIN);
6225
6226         $plugName = getPluginNameFromPid($plugid);
6227
6228         $this->pagehead();
6229
6230         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6231
6232         echo '<h2>',_PLUGS_HELP_TITLE,': ',Entity::hsc($plugName),'</h2>';
6233
6234         $plug =& $manager->getPlugin($plugName);
6235         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6236
6237         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6238             @readfile($helpFile);
6239         } else {
6240             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6241             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6242         }
6243
6244
6245         $this->pagefoot();
6246     }
6247
6248         /**
6249          * Admin::action_pluginadd()
6250          *
6251          * @param       Void
6252          * @return      Void
6253          *
6254          */
6255         function action_pluginadd()
6256         {
6257                 global $member, $manager, $DIR_PLUGINS;
6258
6259                 // check if allowed
6260                 $member->isAdmin() or $this->disallow();
6261
6262                 $name = postVar('filename');
6263
6264                 if ( $manager->pluginInstalled($name) )
6265                 {
6266                         $this->error(_ERROR_DUPPLUGIN);
6267                 }
6268
6269                 if ( !checkPlugin($name) )
6270                 {
6271                         $this->error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
6272                 }
6273
6274                 // get number of currently installed plugins
6275                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6276                 $numCurrent = sql_num_rows($res);
6277
6278                 // plugin will be added as last one in the list
6279                 $newOrder = $numCurrent + 1;
6280
6281                 $manager->notify(
6282                         'PreAddPlugin',
6283                         array(
6284                                 'file' => &$name
6285                         )
6286                 );
6287
6288                 // do this before calling getPlugin (in case the plugin id is used there)
6289                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6290                 sql_query($query);
6291                 $iPid = sql_insert_id();
6292
6293                 $manager->clearCachedInfo('installedPlugins');
6294
6295                 // Load the plugin for condition checking and instalation
6296                 $plugin =& $manager->getPlugin($name);
6297
6298                 // check if it got loaded (could have failed)
6299                 if ( !$plugin )
6300                 {
6301                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6302                         $manager->clearCachedInfo('installedPlugins');
6303                         $this->error(_ERROR_PLUGIN_LOAD);
6304                 }
6305
6306                 // check if plugin needs a newer Nucleus version
6307                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
6308                 {
6309                         // uninstall plugin again...
6310                         $this->deleteOnePlugin($plugin->getID());
6311
6312                         // ...and show error
6313                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
6314                 }
6315
6316                 // check if plugin needs a newer Nucleus version
6317                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
6318                 {
6319                         // uninstall plugin again...
6320                         $this->deleteOnePlugin($plugin->getID());
6321
6322                         // ...and show error
6323                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6324                 }
6325
6326                 $pluginList = $plugin->getPluginDep();
6327                 foreach ( $pluginList as $pluginName )
6328                 {
6329                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6330                         if (sql_num_rows($res) == 0)
6331                         {
6332                                 // uninstall plugin again...
6333                                 $this->deleteOnePlugin($plugin->getID());
6334                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
6335                         }
6336                 }
6337
6338                 // call the install method of the plugin
6339                 $plugin->install();
6340
6341                 $manager->notify(
6342                         'PostAddPlugin',
6343                         array(
6344                                 'plugin' => &$plugin
6345                         )
6346                 );
6347
6348                 // update all events
6349                 $this->action_pluginupdate();
6350                 return;
6351         }
6352
6353         /**
6354          * ADMIN:action_pluginupdate():
6355          *
6356          * @param       Void
6357          * @return      Void
6358          *
6359          */
6360         function action_pluginupdate()
6361         {
6362                 global $member, $manager, $CONF;
6363
6364                 // check if allowed
6365                 $member->isAdmin() or $this->disallow();
6366
6367                 // delete everything from plugin_events
6368                 sql_query('DELETE FROM '.sql_table('plugin_event'));
6369
6370                 // loop over all installed plugins
6371                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6372                 while ( $o = sql_fetch_object($res) )
6373                 {
6374                         $pid = $o->pid;
6375                         $plug =& $manager->getPlugin($o->pfile);
6376                         if ( $plug )
6377                         {
6378                                 $eventList = $plug->getEventList();
6379                                 foreach ( $eventList as $eventName )
6380                                 {
6381                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";
6382                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));
6383                                         sql_query($query);
6384                                 }
6385                         }
6386                 }
6387                 redirect($CONF['AdminURL'] . '?action=pluginlist');
6388                 return;
6389         }
6390
6391     /**
6392      * @todo document this
6393      */
6394     function action_plugindelete() {
6395         global $member, $manager;
6396
6397         // check if allowed
6398         $member->isAdmin() or $this->disallow();
6399
6400         $pid = intGetVar('plugid');
6401
6402         if (!$manager->pidInstalled($pid))
6403             $this->error(_ERROR_NOSUCHPLUGIN);
6404
6405         $this->pagehead();
6406         ?>
6407             <h2><?php echo _DELETE_CONFIRM?></h2>
6408
6409             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6410
6411             <form method="post" action="index.php"><div>
6412             <?php $manager->addTicketHidden() ?>
6413             <input type="hidden" name="action" value="plugindeleteconfirm" />
6414             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6415             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6416             </div></form>
6417         <?php
6418         $this->pagefoot();
6419     }
6420
6421     /**
6422      * @todo document this
6423      */
6424     function action_plugindeleteconfirm() {
6425         global $member, $manager, $CONF;
6426
6427         // check if allowed
6428         $member->isAdmin() or $this->disallow();
6429
6430         $pid = intPostVar('plugid');
6431
6432         $error = $this->deleteOnePlugin($pid, 1);
6433         if ($error) {
6434             $this->error($error);
6435         }
6436
6437         redirect($CONF['AdminURL'] . '?action=pluginlist');
6438 //              $this->action_pluginlist();
6439     }
6440
6441     /**
6442      * @todo document this
6443      */
6444     function deleteOnePlugin($pid, $callUninstall = 0) {
6445         global $manager;
6446
6447         $pid = intval($pid);
6448
6449         if (!$manager->pidInstalled($pid))
6450             return _ERROR_NOSUCHPLUGIN;
6451
6452         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6453
6454 /*              // call the unInstall method of the plugin
6455         if ($callUninstall) {
6456             $plugin =& $manager->getPlugin($name);
6457             if ($plugin) $plugin->unInstall();
6458         }*/
6459
6460         // check dependency before delete
6461         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6462         while($o = sql_fetch_object($res)) {
6463             $plug =& $manager->getPlugin($o->pfile);
6464             if ($plug)
6465             {
6466                 $depList = $plug->getPluginDep();
6467                 foreach ($depList as $depName)
6468                 {
6469                     if ($name == $depName)
6470                     {
6471                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6472                     }
6473                 }
6474             }
6475         }
6476
6477         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6478
6479         // call the unInstall method of the plugin
6480         if ($callUninstall) {
6481             $plugin =& $manager->getPlugin($name);
6482             if ($plugin) $plugin->unInstall();
6483         }
6484
6485         // delete all subscriptions
6486         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6487
6488         // delete all options
6489         // get OIDs from plugin_option_desc
6490         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6491         $aOIDs = array();
6492         while ($o = sql_fetch_object($res)) {
6493             array_push($aOIDs, $o->oid);
6494         }
6495
6496         // delete from plugin_option and plugin_option_desc
6497         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6498         if (count($aOIDs) > 0)
6499             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6500
6501         // update order numbers
6502         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6503         $o = sql_fetch_object($res);
6504         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6505
6506         // delete row
6507         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6508
6509         $manager->clearCachedInfo('installedPlugins');
6510         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6511
6512         return '';
6513     }
6514
6515     /**
6516      * @todo document this
6517      */
6518     function action_pluginup() {
6519         global $member, $manager, $CONF;
6520
6521         // check if allowed
6522         $member->isAdmin() or $this->disallow();
6523
6524         $plugid = intGetVar('plugid');
6525
6526         if (!$manager->pidInstalled($plugid))
6527             $this->error(_ERROR_NOSUCHPLUGIN);
6528
6529         // 1. get old order number
6530         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6531         $o = sql_fetch_object($res);
6532         $oldOrder = $o->porder;
6533
6534         // 2. calculate new order number
6535         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6536
6537         // 3. update plug numbers
6538         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6539         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6540
6541         //$this->action_pluginlist();
6542         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6543         redirect($CONF['AdminURL'] . '?action=pluginlist');
6544     }
6545
6546     /**
6547      * @todo document this
6548      */
6549     function action_plugindown() {
6550         global $member, $manager, $CONF;
6551
6552         // check if allowed
6553         $member->isAdmin() or $this->disallow();
6554
6555         $plugid = intGetVar('plugid');
6556         if (!$manager->pidInstalled($plugid))
6557             $this->error(_ERROR_NOSUCHPLUGIN);
6558
6559         // 1. get old order number
6560         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6561         $o = sql_fetch_object($res);
6562         $oldOrder = $o->porder;
6563
6564         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6565         $maxOrder = sql_num_rows($res);
6566
6567         // 2. calculate new order number
6568         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6569
6570         // 3. update plug numbers
6571         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6572         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6573
6574         //$this->action_pluginlist();
6575         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6576         redirect($CONF['AdminURL'] . '?action=pluginlist');
6577     }
6578
6579         /**
6580          * Admin::action_pluginoptions()
6581          *
6582          * Output Plugin option page
6583          *
6584          * @access      public
6585          * @param       string $message message when fallbacked
6586          * @return      void
6587          *
6588          */
6589         public function action_pluginoptions($message = '')
6590         {
6591                 global $member, $manager;
6592
6593                 // check if allowed
6594                 $member->isAdmin() or $this->disallow();
6595
6596                 $pid = (integer) requestVar('plugid');
6597                 if ( !$manager->pidInstalled($pid) )
6598                 {
6599                         $this->error(_ERROR_NOSUCHPLUGIN);
6600                 }
6601
6602                 $pname = getPluginNameFromPid($pid);
6603
6604                 /* just for including translation */
6605                 $manager->getPlugin($pname);
6606
6607                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6608                 $this->pagehead($extrahead);
6609                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6610                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($pname)) . "</h2>\n";
6611
6612                 if ( isset($message) )
6613                 {
6614                         echo $message;
6615                 }
6616
6617                 echo "<form action=\"index.php\" method=\"post\">\n";
6618                 echo "<div>\n";
6619                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6620                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6621                 $manager->addTicketHidden();
6622
6623                 $aOptions = array();
6624                 $aOIDs = array();
6625                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6626                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6627                 $result = sql_query($query);
6628                 while ( $object = sql_fetch_object($result) )
6629                 {
6630                         array_push($aOIDs, $object->oid);
6631                         $aOptions[$object->oid] = array(
6632                                                 'oid' => $object->oid,
6633                                                 'value' => $object->odef,
6634                                                 'name' => $object->oname,
6635                                                 'description' => $object->odesc,
6636                                                 'type' => $object->otype,
6637                                                 'typeinfo' => $object->oextra,
6638                                                 'contextid' => 0
6639                         );
6640                 }
6641                 // fill out actual values
6642                 if ( count($aOIDs) > 0 )
6643                 {
6644                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6645                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6646                         $result = sql_query($query);
6647                         while ( $object = sql_fetch_object($result) )
6648                         {
6649                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6650                         }
6651                 }
6652
6653                 // call plugins
6654                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6655                 $manager->notify('PrePluginOptionsEdit',$data);
6656
6657                 $template['content'] = 'plugoptionlist';
6658                 $amount = showlist($aOptions,'table',$template);
6659                 if ( $amount == 0 )
6660                 {
6661                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6662                 }
6663                 echo "</div>\n";
6664                 echo "</form>\n";
6665                 $this->pagefoot();
6666
6667                 return;
6668         }
6669
6670         /**
6671          * Admin::action_pluginoptionsupdate()
6672          *
6673          * Update plugin options and fallback to plugin option page
6674          *
6675          * @access      public
6676          * @param       void
6677          * @return      void
6678          */
6679         public function action_pluginoptionsupdate()
6680         {
6681                 global $member, $manager;
6682
6683                 // check if allowed
6684                 $member->isAdmin() or $this->disallow();
6685
6686                 $pid = (integer) requestVar('plugid');
6687                 if ( !$manager->pidInstalled($pid) )
6688                 {
6689                         $this->error(_ERROR_NOSUCHPLUGIN);
6690                 }
6691
6692                 $aOptions = requestArray('plugoption');
6693                 NucleusPlugin::apply_plugin_options($aOptions);
6694
6695                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6696
6697                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6698                 return;
6699         }
6700
6701         /**
6702          * Admin::_insertPluginOptions()
6703          *
6704          * Output plugin option field
6705          *
6706          * @access      public
6707          * @param string        $context        plugin option context
6708          * @param integer       $contextid      plugin option context id
6709          * @return      void
6710          */
6711         public function _insertPluginOptions($context, $contextid = 0)
6712         {
6713                 // get all current values for this contextid
6714                 // (note: this might contain doubles for overlapping contextids)
6715                 $aIdToValue = array();
6716                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6717                 while ( $object = sql_fetch_object($res) )
6718                 {
6719                         $aIdToValue[$object->oid] = $object->ovalue;
6720                 }
6721
6722                 // get list of oids per pid
6723                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6724                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6725                 $res = sql_query($query);
6726                 $aOptions = array();
6727                 while ( $object = sql_fetch_object($res) )
6728                 {
6729                         if (in_array($object->oid, array_keys($aIdToValue)))
6730                         {
6731                                 $value = $aIdToValue[$object->oid];
6732                         }
6733                         else
6734                         {
6735                                 $value = $object->odef;
6736                         }
6737
6738                         array_push($aOptions, array(
6739                                 'pid' => $object->pid,
6740                                 'pfile' => $object->pfile,
6741                                 'oid' => $object->oid,
6742                                 'value' => $value,
6743                                 'name' => $object->oname,
6744                                 'description' => $object->odesc,
6745                                 'type' => $object->otype,
6746                                 'typeinfo' => $object->oextra,
6747                                 'contextid' => $contextid,
6748                                 'extra' => ''));
6749                 }
6750
6751                 global $manager;
6752                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6753
6754                 $iPrevPid = -1;
6755                 foreach ($aOptions as $aOption)
6756                 {
6757                         // new plugin?
6758                         if ( $iPrevPid != $aOption['pid'] )
6759                         {
6760                                 $iPrevPid = $aOption['pid'];
6761                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6762                                 {
6763                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6764                                 }
6765                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($aOption['pfile'])).'</th></tr>';
6766                         }
6767
6768                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6769                         if ( @$meta['access'] != 'hidden' )
6770                         {
6771                                 echo '<tr>';
6772                                 listplug_plugOptionRow($aOption);
6773                                 echo '</tr>';
6774                         }
6775                 }
6776                 return;
6777         }
6778
6779         /**
6780          * Admin::input_yesno()
6781          * Output input elements with radio attribute for yes/no options
6782          *
6783          * @param       string  $name   name attribute
6784          * @param       string  $value_current  current value attribute
6785          * @param       integer $tabindex       tab index
6786          * @param       string  $value_yes      value attribute for yes option
6787          * @param       string  $value_no       value attribute for no option
6788          * @param       string  $text_yes       child text element for yes option
6789          * @param       string  $text_no        child text element for no option
6790          * @param       boolean $isAdmin        have admin right or not
6791          * @return      void
6792          */
6793         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6794         {
6795                 $id = preg_replace('#\[|\]#', '-', $name);
6796                 $id_yes = $id . $value_yes;
6797                 $id_no  = $id . $value_no;
6798
6799                 /* yes option */
6800                 echo '<input type="radio" id="' . Entity::hsc($id_yes) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_yes) . '"';
6801                 if ( $name=="admin" )
6802                 {
6803                         echo ' onclick="selectCanLogin(true);"';
6804                 }
6805                 if ( $value_current == $value_yes )
6806                 {
6807                         echo " tabindex='$tabindex' checked='checked'";
6808                 }
6809                 echo " />\n";
6810                 echo '<label for="' . Entity::hsc($id_yes) . '">' . Entity::hsc($text_yes) . "</label>\n";
6811
6812                 /* no option */
6813                 echo '<input type="radio" id="' . Entity::hsc($id_no) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_no) . '"';
6814                 if ( $name=="admin" )
6815                 {
6816                         echo ' onclick="selectCanLogin(false);"';
6817                 }
6818                 if ( $value_current != $value_yes )
6819                 {
6820                         echo " tabindex='$tabindex' checked='checked'";
6821                 }
6822                 if ($isAdmin && $name=="canlogin")
6823                 {
6824                         echo ' disabled="disabled"';
6825                 }
6826                 echo " />\n";
6827                 echo '<label for="' . Entity::hsc($id_no) . '">' . Entity::hsc($text_no) . "</label>\n";
6828
6829                 return;
6830         }
6831 }