nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2012 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class Admin
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . Entity::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', Entity::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.Entity::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. Entity::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NavList('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',Entity::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',Entity::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',Entity::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NavList('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NavList('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NavList('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NavList('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124         /**
1125          * Admin::action_createitem()
1126          * Provide a page to item a new item to the given blog
1127          *
1128          * @param       void
1129          * @return      void
1130          */
1131         public function action_createitem()
1132         {
1133                 global $member, $manager;
1134
1135                 $blogid = intRequestVar('blogid');
1136
1137                 // check if allowed
1138                 $member->teamRights($blogid) or $this->disallow();
1139
1140                 $memberid = $member->getID();
1141
1142                 $blog =& $manager->getBlog($blogid);
1143
1144                 $this->pagehead();
1145
1146                 // generate the add-item form
1147                 $formfactory = new PageFactory($blogid);
1148                 $formfactory->createAddForm('admin');
1149
1150                 $this->pagefoot();
1151                 return;
1152         }
1153
1154         /**
1155          * Admin::action_itemedit()
1156          *
1157          * @param       void
1158          * @return      void
1159          */
1160         public function action_itemedit()
1161         {
1162                 global $member, $manager;
1163
1164                 $itemid = intRequestVar('itemid');
1165
1166                 // only allow if user is allowed to alter item
1167                 $member->canAlterItem($itemid) or $this->disallow();
1168
1169                 $item =& $manager->getItem($itemid, 1, 1);
1170                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1171
1172                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1173
1174                 if ( $blog->convertBreaks() )
1175                 {
1176                         $item['body'] = removeBreaks($item['body']);
1177                         $item['more'] = removeBreaks($item['more']);
1178                 }
1179
1180                 // form to edit blog items
1181                 $this->pagehead();
1182                 $formfactory = new PageFactory($blog->getID());
1183                 $formfactory->createEditForm('admin', $item);
1184                 $this->pagefoot();
1185                 return;
1186         }
1187
1188     /**
1189      * @todo document this
1190      */
1191     function action_itemupdate() {
1192         global $member, $manager, $CONF;
1193
1194         $itemid = intRequestVar('itemid');
1195         $catid = postVar('catid');
1196
1197         // only allow if user is allowed to alter item
1198         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1199
1200         $actiontype = postVar('actiontype');
1201
1202         // delete actions are handled by itemdelete (which has confirmation)
1203         if ($actiontype == 'delete') {
1204             $this->action_itemdelete();
1205             return;
1206         }
1207
1208         $body   = postVar('body');
1209         $title  = postVar('title');
1210         $more   = postVar('more');
1211         $closed = intPostVar('closed');
1212         $draftid = intPostVar('draftid');
1213
1214         // default action = add now
1215         if (!$actiontype)
1216             $actiontype='addnow';
1217
1218         // create new category if needed
1219         if (strstr($catid,'newcat')) {
1220             // get blogid
1221             list($blogid) = sscanf($catid,"newcat-%d");
1222
1223             // create
1224             $blog =& $manager->getBlog($blogid);
1225             $catid = $blog->createNewCategory();
1226
1227             // show error when sth goes wrong
1228             if (!$catid)
1229                 $this->doError(_ERROR_CATCREATEFAIL);
1230         }
1231
1232         /*
1233             set some variables based on actiontype
1234
1235             actiontypes:
1236                 draft items -> addnow, addfuture, adddraft, delete
1237                 non-draft items -> edit, changedate, delete
1238
1239             variables set:
1240                 $timestamp: set to a nonzero value for future dates or date changes
1241                 $wasdraft: set to 1 when the item used to be a draft item
1242                 $publish: set to 1 when the edited item is not a draft
1243         */
1244         $blogid =  getBlogIDFromItemID($itemid);
1245         $blog   =& $manager->getBlog($blogid);
1246
1247         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1248         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1249         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1250         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1251             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1252         } else {
1253             $timestamp =0;
1254         }
1255
1256         // edit the item for real
1257         Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1258
1259         $this->updateFuturePosted($blogid);
1260
1261         if ($draftid > 0) {
1262             // delete permission is checked inside Item::delete()
1263             Item::delete($draftid);
1264         }
1265
1266         // show category edit window when we created a new category
1267         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1268         if ($catid != intPostVar('catid')) {
1269             $this->action_categoryedit(
1270                 $catid,
1271                 $blog->getID(),
1272                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1273             );
1274         } else {
1275             // TODO: set start item correctly for itemlist
1276             $this->action_itemlist(getBlogIDFromItemID($itemid));
1277         }
1278     }
1279
1280         /**
1281          * Admin::action_itemdelete()
1282          * Delete item
1283          *
1284          * @param       Void
1285          * @return      Void
1286          */
1287         function action_itemdelete()
1288         {
1289                 global $member, $manager;
1290
1291                 $itemid = intRequestVar('itemid');
1292
1293                 // only allow if user is allowed to alter item
1294                 $member->canAlterItem($itemid) or $this->disallow();
1295
1296                 if ( !$manager->existsItem($itemid,1,1) )
1297                 {
1298                         $this->error(_ERROR_NOSUCHITEM);
1299                 }
1300
1301                 $item =& $manager->getItem($itemid,1,1);
1302                 $title = Entity::hsc(strip_tags($item['title']));
1303                 $body = strip_tags($item['body']);
1304                 $body = Entity::hsc(Entity::shorten($body,300,'...'));
1305
1306                 $this->pagehead();
1307                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1308                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";
1309                 echo "<div class=\"note\">\n";
1310                 echo "<b>{$title}</b>\n";
1311                 echo "<br />\n";
1312                 echo "{$body}\n";
1313                 echo "</div>\n";
1314                 echo "<form method=\"post\" action=\"index.php\">\n";
1315                 echo "<div>\n";
1316                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";
1317                 echo $manager->addTicketHidden() . "\n";
1318                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";
1319                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";
1320                 echo "</div>\n";
1321                 echo "</form>\n";
1322                 $this->pagefoot();
1323                 return;
1324         }
1325
1326     /**
1327      * @todo document this
1328      */
1329     function action_itemdeleteconfirm() {
1330         global $member;
1331
1332         $itemid = intRequestVar('itemid');
1333
1334         // only allow if user is allowed to alter item
1335         $member->canAlterItem($itemid) or $this->disallow();
1336
1337         // get blogid first
1338         $blogid = getBlogIdFromItemId($itemid);
1339
1340         // delete item (note: some checks will be performed twice)
1341         $this->deleteOneItem($itemid);
1342
1343         $this->action_itemlist($blogid);
1344     }
1345
1346     /**
1347      * Deletes one item and returns error if something goes wrong
1348      * @param int $itemid
1349      */
1350     function deleteOneItem($itemid) {
1351         global $member, $manager;
1352
1353         // only allow if user is allowed to alter item (also checks if itemid exists)
1354         if (!$member->canAlterItem($itemid))
1355             return _ERROR_DISALLOWED;
1356
1357         // need to get blogid before the item is deleted
1358         $blogid = getBlogIDFromItemId($itemid);
1359
1360         $manager->loadClass('ITEM');
1361         Item::delete($itemid);
1362
1363         // update blog's futureposted
1364         $this->updateFuturePosted($blogid);
1365     }
1366
1367         /**
1368          * Admin::updateFuturePosted()
1369          * Update a blog's future posted flag
1370          *
1371          * @param integer $blogid
1372          * @return      void
1373          *
1374          */
1375         function updateFuturePosted($blogid)
1376         {
1377                 global $manager;
1378
1379                 $blog =& $manager->getBlog($blogid);
1380                 $currenttime = $blog->getCorrectTime(time());
1381
1382                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1383                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1384                 $result = sql_query($query);
1385
1386                 if ( sql_num_rows($result) > 0 )
1387                 {
1388                                 $blog->setFuturePost();
1389                 }
1390                 else
1391                 {
1392                                 $blog->clearFuturePost();
1393                 }
1394                 return;
1395         }
1396
1397     /**
1398      * @todo document this
1399      */
1400     function action_itemmove() {
1401         global $member, $manager;
1402
1403         $itemid = intRequestVar('itemid');
1404
1405         // only allow if user is allowed to alter item
1406         $member->canAlterItem($itemid) or $this->disallow();
1407
1408         $item =& $manager->getItem($itemid,1,1);
1409
1410         $this->pagehead();
1411         ?>
1412             <h2><?php echo _MOVE_TITLE?></h2>
1413             <form method="post" action="index.php"><div>
1414                 <input type="hidden" name="action" value="itemmoveto" />
1415                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1416
1417                 <?php
1418
1419                     $manager->addTicketHidden();
1420                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1421                 ?>
1422
1423                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1424             </div></form>
1425         <?php
1426         $this->pagefoot();
1427     }
1428
1429     /**
1430      * @todo document this
1431      */
1432     function action_itemmoveto() {
1433         global $member, $manager;
1434
1435         $itemid = intRequestVar('itemid');
1436         $catid = requestVar('catid');
1437
1438         // create new category if needed
1439         if (strstr($catid,'newcat')) {
1440             // get blogid
1441             list($blogid) = sscanf($catid,'newcat-%d');
1442
1443             // create
1444             $blog =& $manager->getBlog($blogid);
1445             $catid = $blog->createNewCategory();
1446
1447             // show error when sth goes wrong
1448             if (!$catid)
1449                 $this->doError(_ERROR_CATCREATEFAIL);
1450         }
1451
1452         // only allow if user is allowed to alter item
1453         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1454
1455         $old_blogid = getBlogIDFromItemId($itemid);
1456
1457         Item::move($itemid, $catid);
1458
1459         // set the futurePosted flag on the blog
1460         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1461
1462         // reset the futurePosted in case the item is moved from one blog to another
1463         $this->updateFuturePosted($old_blogid);
1464
1465         if ($catid != intRequestVar('catid'))
1466             $this->action_categoryedit($catid, $blog->getID());
1467         else
1468             $this->action_itemlist(getBlogIDFromCatID($catid));
1469     }
1470
1471     /**
1472      * Moves one item to a given category (category existance should be checked by caller)
1473      * errors are returned
1474      * @param int $itemid
1475      * @param int $destCatid category ID to which the item will be moved
1476      */
1477     function moveOneItem($itemid, $destCatid) {
1478         global $member;
1479
1480         // only allow if user is allowed to move item
1481         if (!$member->canUpdateItem($itemid, $destCatid))
1482             return _ERROR_DISALLOWED;
1483
1484         Item::move($itemid, $destCatid);
1485     }
1486
1487     /**
1488      * Adds a item to the chosen blog
1489      */
1490     function action_additem() {
1491         global $manager, $CONF;
1492
1493         $manager->loadClass('ITEM');
1494
1495         $result = Item::createFromRequest();
1496
1497         if ($result['status'] == 'error')
1498             $this->error($result['message']);
1499
1500         $blogid = getBlogIDFromItemID($result['itemid']);
1501         $blog =& $manager->getBlog($blogid);
1502         $btimestamp = $blog->getCorrectTime();
1503         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1504
1505         if ($result['status'] == 'newcategory') {
1506             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1507             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1508         } else {
1509             $methodName = 'action_itemList';
1510             call_user_func(array(&$this, $methodName), $blogid);
1511         }
1512     }
1513
1514         /**
1515          * Allows to edit previously made comments
1516          **/
1517         function action_commentedit() {
1518
1519                 global $member, $manager;
1520
1521                 $commentid = intRequestVar('commentid');
1522
1523                 $member->canAlterComment($commentid) or $this->disallow();
1524
1525                 $comment = Comment::getComment($commentid);
1526
1527                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1528
1529                 // change <br /> to \n
1530                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1531
1532                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1533                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1534
1535         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1536
1537         $this->pagehead();
1538
1539         ?>
1540         <h2><?php echo _EDITC_TITLE?></h2>
1541
1542         <form action="index.php" method="post"><div>
1543
1544         <input type="hidden" name="action" value="commentupdate" />
1545         <?php $manager->addTicketHidden(); ?>
1546         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1547         <table><tr>
1548             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1549         </tr><tr>
1550             <td><?php echo _EDITC_WHO?></td>
1551             <td>
1552             <?php               if ($comment['member'])
1553                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1554                 else
1555                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1556             ?>
1557             </td>
1558         </tr><tr>
1559             <td><?php echo _EDITC_WHEN?></td>
1560             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1561         </tr><tr>
1562             <td><?php echo _EDITC_HOST?></td>
1563             <td><?php echo  $comment['host']; ?></td>
1564         </tr>
1565         <tr>
1566             <td><?php echo _EDITC_URL; ?></td>
1567             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1568         </tr>
1569         <tr>
1570             <td><?php echo _EDITC_EMAIL; ?></td>
1571             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1572         </tr>
1573         <tr>
1574             <td><?php echo _EDITC_TEXT?></td>
1575             <td>
1576                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1577                     echo $comment['body'];
1578                 ?></textarea>
1579             </td>
1580         </tr><tr>
1581             <td><?php echo _EDITC_EDIT?></td>
1582             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1583         </tr></table>
1584
1585         </div></form>
1586         <?php
1587         $this->pagefoot();
1588     }
1589
1590     /**
1591      * @todo document this
1592      */
1593     function action_commentupdate() {
1594         global $member, $manager;
1595
1596         $commentid = intRequestVar('commentid');
1597
1598         $member->canAlterComment($commentid) or $this->disallow();
1599
1600         $url = postVar('url');
1601         $email = postVar('email');
1602         $body = postVar('body');
1603
1604                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1605                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1606                 # important note that '\' must be matched with '\\\\' in preg* expressions
1607
1608                 // intercept words that are too long
1609                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1610                 {
1611                         $this->error(_ERROR_COMMENT_LONGWORD);
1612                 }
1613
1614                 // check length
1615                 if (i18n::strlen($body) < 3)
1616                 {
1617                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1618                 }
1619
1620                 if (i18n::strlen($body) > 5000)
1621                 {
1622                         $this->error(_ERROR_COMMENT_TOOLONG);
1623                 }
1624
1625         // prepare body
1626         $body = Comment::prepareBody($body);
1627
1628         // call plugins
1629         $manager->notify('PreUpdateComment',array('body' => &$body));
1630
1631         $query = 'UPDATE ' . sql_table('comment')
1632                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1633                . " WHERE cnumber = " . $commentid;
1634         sql_query($query);
1635
1636         // get itemid
1637         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1638         $o = sql_fetch_object($res);
1639         $itemid = $o->citem;
1640
1641         if ($member->canAlterItem($itemid))
1642             $this->action_itemcommentlist($itemid);
1643         else
1644             $this->action_browseowncomments();
1645
1646     }
1647
1648         /**
1649          * Admin::action_commentdelete()
1650          * Update comment
1651          *
1652          * @param       Void
1653          * @return      Void
1654          */
1655         function action_commentdelete()
1656         {
1657                 global $member, $manager;
1658
1659                 $commentid = intRequestVar('commentid');
1660                 $member->canAlterComment($commentid) or $this->disallow();
1661                 $comment = Comment::getComment($commentid);
1662
1663                 $body = strip_tags($comment['body']);
1664                 $body = Entity::hsc(Entity::shorten($body, 300, '...'));
1665
1666                 if ( $comment['member'] )
1667                 {
1668                         $author = $comment['member'];
1669                 }
1670                 else
1671                 {
1672                         $author = $comment['user'];
1673                 }
1674
1675                 $this->pagehead();
1676
1677                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1678                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";
1679                 echo "<div class=\"note\">\n";
1680                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";
1681                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";
1682                 echo "</div>\n";
1683                 echo "<form method=\"post\" action=\"index.php\">\n";
1684                 echo "<div>\n";
1685                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";
1686                 echo $manager->addTicketHidden() . "\n";
1687                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";
1688                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";
1689                 echo "</div>\n";
1690                 echo "</form>\n";
1691                 $this->pagefoot();
1692                 return;
1693         }
1694
1695     /**
1696      * @todo document this
1697      */
1698     function action_commentdeleteconfirm() {
1699         global $member;
1700
1701         $commentid = intRequestVar('commentid');
1702
1703         // get item id first
1704         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1705         $o = sql_fetch_object($res);
1706         $itemid = $o->citem;
1707
1708         $error = $this->deleteOneComment($commentid);
1709         if ($error)
1710             $this->doError($error);
1711
1712         if ($member->canAlterItem($itemid))
1713             $this->action_itemcommentlist($itemid);
1714         else
1715             $this->action_browseowncomments();
1716     }
1717
1718     /**
1719      * @todo document this
1720      */
1721     function deleteOneComment($commentid) {
1722         global $member, $manager;
1723
1724         $commentid = intval($commentid);
1725
1726         if (!$member->canAlterComment($commentid))
1727             return _ERROR_DISALLOWED;
1728
1729         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1730
1731         // delete the comments associated with the item
1732         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1733         sql_query($query);
1734
1735         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1736
1737         return '';
1738     }
1739
1740     /**
1741      * Usermanagement main
1742      */
1743     function action_usermanagement() {
1744         global $member, $manager;
1745
1746         // check if allowed
1747         $member->isAdmin() or $this->disallow();
1748
1749         $this->pagehead();
1750
1751         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1752
1753         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1754
1755         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1756
1757         // show list of members with actions
1758         $query =  'SELECT *'
1759                . ' FROM '.sql_table('member');
1760         $template['content'] = 'memberlist';
1761         $template['tabindex'] = 10;
1762
1763         $manager->loadClass("ENCAPSULATE");
1764         $batch = new Batch('member');
1765         $batch->showlist($query,'table',$template);
1766
1767         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1768         ?>
1769             <form method="post" action="index.php" name="memberedit"><div>
1770
1771             <input type="hidden" name="action" value="memberadd" />
1772             <?php $manager->addTicketHidden() ?>
1773
1774             <table>
1775             <tr>
1776                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1777             </tr><tr>
1778                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1779                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1780                 </td>
1781                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1782             </tr><tr>
1783                 <td><?php echo _MEMBERS_REALNAME?></td>
1784                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1785             </tr><tr>
1786                 <td><?php echo _MEMBERS_PWD?></td>
1787                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1788             </tr><tr>
1789                 <td><?php echo _MEMBERS_REPPWD?></td>
1790                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1791             </tr><tr>
1792                 <td><?php echo _MEMBERS_EMAIL?></td>
1793                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1794             </tr><tr>
1795                 <td><?php echo _MEMBERS_URL?></td>
1796                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1797             </tr><tr>
1798                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1799                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1800             </tr><tr>
1801                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1802                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1803             </tr><tr>
1804                 <td><?php echo _MEMBERS_NOTES?></td>
1805                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1806             </tr><tr>
1807                 <td><?php echo _MEMBERS_NEW?></td>
1808                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1809             </tr></table>
1810
1811             </div></form>
1812         <?php
1813         $this->pagefoot();
1814     }
1815
1816     /**
1817      * Edit member settings
1818      */
1819     function action_memberedit() {
1820         $this->action_editmembersettings(intRequestVar('memberid'));
1821     }
1822
1823         /**
1824          * @todo document this
1825          */
1826         function action_editmembersettings($memberid = '') {
1827                 global $member, $manager, $CONF;
1828
1829                 if ($memberid == '')
1830                 {
1831                         $memberid = $member->getID();
1832                 }
1833
1834                 // check if allowed
1835                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1836
1837                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1838                 $this->pagehead($extrahead);
1839
1840                 // show message to go back to member overview (only for admins)
1841                 if ($member->isAdmin())
1842                 {
1843                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1844                 }
1845                 else
1846                 {
1847                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1848                 }
1849                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1850
1851                 $mem = Member::createFromID($memberid);
1852                 ?>
1853                 <form method="post" action="index.php" name="memberedit"><div>
1854
1855                 <input type="hidden" name="action" value="changemembersettings" />
1856                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1857                 <?php $manager->addTicketHidden() ?>
1858
1859                 <table><tr>
1860                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1861                 </tr><tr>
1862                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1863                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1864                         </td>
1865                         <td>
1866                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1867                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  Entity::hsc($mem->getDisplayName()); ?>" />
1868                         <?php } else {
1869                                 echo Entity::hsc($member->getDisplayName());
1870                            }
1871                         ?>
1872                         </td>
1873                 </tr><tr>
1874                         <td><?php echo _MEMBERS_REALNAME?></td>
1875                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  Entity::hsc($mem->getRealName()); ?>" /></td>
1876                 </tr><tr>
1877                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1878                         <td><?php echo _MEMBERS_PWD?></td>
1879                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1880                 </tr><tr>
1881                         <td><?php echo _MEMBERS_REPPWD?></td>
1882                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1883                 <?php } ?>
1884                 </tr><tr>
1885                         <td><?php echo _MEMBERS_EMAIL?>
1886                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1887                         </td>
1888                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  Entity::hsc($mem->getEmail()); ?>" /></td>
1889                 </tr><tr>
1890                         <td><?php echo _MEMBERS_URL?></td>
1891                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getURL()); ?>" /></td>
1892                 <?php // only allow to change this by super-admins
1893                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1894                    if ($member->isAdmin()) {
1895                 ?>
1896                         </tr><tr>
1897                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1898                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1899                         </tr><tr>
1900                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1901                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1902                 <?php } ?>
1903                 </tr><tr>
1904                         <td><?php echo _MEMBERS_NOTES?></td>
1905                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getNotes()); ?>" /></td>
1906                 </tr><tr>
1907                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>
1908                         </td>
1909                         <td>
1910
1911                                 <select name="locale" tabindex="85">
1912                                 <?php
1913                                 $locales = i18n::get_available_locale_list();
1914                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1915                                 {
1916                                         echo "<option value=\"\" selected=\"selected\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1917                                 }
1918                                 else
1919                                 {
1920                                         echo "<option value=\"\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1921                                 }
1922
1923                                 foreach( $locales as $locale )
1924                                 {
1925                                         if( $locale == $mem->getLocale() )
1926                                         {
1927                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1928                                         }
1929                                         else
1930                                         {
1931                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1932                                         }
1933                                 }
1934                                 ?>
1935                                 </select>
1936
1937                         </td>
1938                 </tr>
1939                 <tr>
1940                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1941                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1942                 </tr>
1943                 <?php
1944                         // plugin options
1945                         $this->_insertPluginOptions('member',$memberid);
1946                 ?>
1947                 <tr>
1948                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1949                 </tr><tr>
1950                         <td><?php echo _MEMBERS_EDIT?></td>
1951                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1952                 </tr></table>
1953
1954                 </div></form>
1955
1956                 <?php
1957                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1958
1959                         $manager->notify(
1960                                 'MemberSettingsFormExtras',
1961                                 array(
1962                                         'member' => &$mem
1963                                 )
1964                         );
1965                 $this->pagefoot();
1966         }
1967
1968     /**
1969      * @todo document this
1970      */
1971     function action_changemembersettings() {
1972         global $member, $CONF, $manager;
1973
1974         $memberid = intRequestVar('memberid');
1975
1976         // check if allowed
1977         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1978
1979         $name           = trim(strip_tags(postVar('name')));
1980         $realname       = trim(strip_tags(postVar('realname')));
1981         $password       = postVar('password');
1982         $repeatpassword = postVar('repeatpassword');
1983         $email          = strip_tags(postVar('email'));
1984         $url            = strip_tags(postVar('url'));
1985
1986                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1987                 # original eregi: !eregi("^https?://", $url)
1988
1989                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1990                 if (!preg_match('#^https?://#', $url) )
1991                 {
1992                         $url = 'http://' . $url;
1993                 }
1994
1995         $admin          = postVar('admin');
1996         $canlogin       = postVar('canlogin');
1997         $notes          = strip_tags(postVar('notes'));
1998         $locale        = postVar('locale');
1999
2000         $mem = Member::createFromID($memberid);
2001
2002         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2003
2004             if (!isValidDisplayName($name))
2005                 $this->error(_ERROR_BADNAME);
2006
2007             if (($name != $mem->getDisplayName()) && Member::exists($name))
2008                 $this->error(_ERROR_NICKNAMEINUSE);
2009
2010             if ($password != $repeatpassword)
2011                 $this->error(_ERROR_PASSWORDMISMATCH);
2012
2013             if ($password && (i18n::strlen($password) < 6))
2014                 $this->error(_ERROR_PASSWORDTOOSHORT);
2015
2016             if ($password) {
2017                                 $pwdvalid = true;
2018                                 $pwderror = '';
2019                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2020                                 if (!$pwdvalid) {
2021                                         $this->error($pwderror);
2022                                 }
2023                         }
2024                 }
2025
2026                 if ( !NOTIFICATION::address_validation($email) )
2027                 {
2028                         $this->error(_ERROR_BADMAILADDRESS);
2029                 }
2030                 if ( !$realname )
2031                 {
2032                         $this->error(_ERROR_REALNAMEMISSING);
2033                 }
2034         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2035             $this->error(_ERROR_NOSUCHTRANSLATION);
2036
2037         // check if there will remain at least one site member with both the logon and admin rights
2038         // (check occurs when taking away one of these rights from such a member)
2039         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2040              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2041            )
2042         {
2043             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2044             if (sql_num_rows($r) < 2)
2045                 $this->error(_ERROR_ATLEASTONEADMIN);
2046         }
2047
2048         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2049             $mem->setDisplayName($name);
2050             if ($password)
2051                 $mem->setPassword($password);
2052         }
2053
2054         $oldEmail = $mem->getEmail();
2055
2056         $mem->setRealName($realname);
2057         $mem->setEmail($email);
2058         $mem->setURL($url);
2059         $mem->setNotes($notes);
2060         $mem->setLocale($locale);
2061
2062
2063         // only allow super-admins to make changes to the admin status
2064         if ($member->isAdmin()) {
2065             $mem->setAdmin($admin);
2066             $mem->setCanLogin($canlogin);
2067         }
2068
2069         $autosave = postVar ('autosave');
2070         $mem->setAutosave($autosave);
2071
2072         $mem->write();
2073
2074         // store plugin options
2075         $aOptions = requestArray('plugoption');
2076         NucleusPlugin::apply_plugin_options($aOptions);
2077         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2078
2079         // if email changed, generate new password
2080         if ($oldEmail != $mem->getEmail())
2081         {
2082             $mem->sendActivationLink('addresschange', $oldEmail);
2083             // logout member
2084             $mem->newCookieKey();
2085
2086             // only log out if the member being edited is the current member.
2087             if ($member->getID() == $memberid)
2088                 $member->logout();
2089             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2090             return;
2091         }
2092
2093
2094         if (  ( $mem->getID() == $member->getID() )
2095            && ( $mem->getDisplayName() != $member->getDisplayName() )
2096            ) {
2097             $mem->newCookieKey();
2098             $member->logout();
2099             $this->action_login(_MSG_LOGINAGAIN, 0);
2100         } else {
2101             $this->action_overview(_MSG_SETTINGSCHANGED);
2102         }
2103     }
2104
2105         /**
2106          * Admin::action_memberadd()
2107          *
2108          * @param       void
2109          * @return      void
2110          *
2111         */
2112         function action_memberadd()
2113         {
2114                 global $member, $manager;
2115
2116                 // check if allowed
2117                 $member->isAdmin() or $this->disallow();
2118
2119                 if ( postVar('password') != postVar('repeatpassword') )
2120                 {
2121                         $this->error(_ERROR_PASSWORDMISMATCH);
2122                 }
2123
2124                 if ( i18n::strlen(postVar('password')) < 6 )
2125                 {
2126                         $this->error(_ERROR_PASSWORDTOOSHORT);
2127                 }
2128
2129                 $res = Member::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2130                 if ( $res != 1 )
2131                 {
2132                         $this->error($res);
2133                 }
2134
2135                 // fire PostRegister event
2136                 $newmem = new Member();
2137                 $newmem->readFromName(postVar('name'));
2138                 $manager->notify('PostRegister',array('member' => &$newmem));
2139
2140                 $this->action_usermanagement();
2141                 return;
2142         }
2143
2144     /**
2145      * Account activation
2146      *
2147      * @author dekarma
2148      */
2149     function action_activate() {
2150
2151         $key = getVar('key');
2152         $this->_showActivationPage($key);
2153     }
2154
2155     /**
2156      * @todo document this
2157      */
2158     function _showActivationPage($key, $message = '')
2159     {
2160         global $manager;
2161
2162         // clean up old activation keys
2163         Member::cleanupActivationTable();
2164
2165         // get activation info
2166         $info = Member::getActivationInfo($key);
2167
2168         if (!$info)
2169             $this->error(_ERROR_ACTIVATE);
2170
2171         $mem = Member::createFromId($info->vmember);
2172
2173         if (!$mem)
2174             $this->error(_ERROR_ACTIVATE);
2175
2176         $text = '';
2177         $title = '';
2178         $bNeedsPasswordChange = true;
2179
2180         switch ($info->vtype)
2181         {
2182             case 'forgot':
2183                 $title = _ACTIVATE_FORGOT_TITLE;
2184                 $text = _ACTIVATE_FORGOT_TEXT;
2185                 break;
2186             case 'register':
2187                 $title = _ACTIVATE_REGISTER_TITLE;
2188                 $text = _ACTIVATE_REGISTER_TEXT;
2189                 break;
2190             case 'addresschange':
2191                 $title = _ACTIVATE_CHANGE_TITLE;
2192                 $text = _ACTIVATE_CHANGE_TEXT;
2193                 $bNeedsPasswordChange = false;
2194                 Member::activate($key);
2195                 break;
2196         }
2197
2198         $aVars = array(
2199             'memberName' => Entity::hsc($mem->getDisplayName())
2200         );
2201         $title = Template::fill($title, $aVars);
2202         $text = Template::fill($text, $aVars);
2203
2204         $this->pagehead();
2205
2206             echo '<h2>' , $title, '</h2>';
2207             echo '<p>' , $text, '</p>';
2208
2209             if ($message != '')
2210             {
2211                 echo '<p class="error">',$message,'</p>';
2212             }
2213
2214             if ($bNeedsPasswordChange)
2215             {
2216                 ?>
2217                     <div><form action="index.php" method="post">
2218
2219                         <input type="hidden" name="action" value="activatesetpwd" />
2220                         <?php $manager->addTicketHidden() ?>
2221                         <input type="hidden" name="key" value="<?php echo Entity::hsc($key) ?>" />
2222
2223                         <table><tr>
2224                             <td><?php echo _MEMBERS_PWD?></td>
2225                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2226                         </tr><tr>
2227                             <td><?php echo _MEMBERS_REPPWD?></td>
2228                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2229                         <?php
2230
2231                             global $manager;
2232                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2233
2234                         ?>
2235                         </tr><tr>
2236                             <td><?php echo _MEMBERS_SETPWD ?></td>
2237                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2238                         </tr></table>
2239
2240
2241                     </form></div>
2242
2243                 <?php
2244
2245             }
2246
2247         $this->pagefoot();
2248
2249     }
2250
2251     /**
2252      * Account activation - set password part
2253      *
2254      * @author dekarma
2255      */
2256     function action_activatesetpwd() {
2257
2258         $key = postVar('key');
2259
2260         // clean up old activation keys
2261         Member::cleanupActivationTable();
2262
2263         // get activation info
2264         $info = Member::getActivationInfo($key);
2265
2266         if (!$info || ($info->type == 'addresschange'))
2267             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2268
2269         $mem = Member::createFromId($info->vmember);
2270
2271         if (!$mem)
2272             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2273
2274         $password       = postVar('password');
2275         $repeatpassword = postVar('repeatpassword');
2276
2277         if ($password != $repeatpassword)
2278             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2279
2280         if ($password && (i18n::strlen($password) < 6))
2281             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2282
2283         if ($password) {
2284                         $pwdvalid = true;
2285                         $pwderror = '';
2286                         global $manager;
2287                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2288                         if (!$pwdvalid) {
2289                                 return $this->_showActivationPage($key,$pwderror);
2290                         }
2291                 }
2292
2293         $error = '';
2294
2295         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2296         if ($error != '')
2297             return $this->_showActivationPage($key, $error);
2298
2299
2300         // set password
2301         $mem->setPassword($password);
2302         $mem->write();
2303
2304         // do the activation
2305         Member::activate($key);
2306
2307         $this->pagehead();
2308             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2309             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2310         $this->pagefoot();
2311     }
2312
2313     /**
2314      * Manage team
2315      */
2316     function action_manageteam() {
2317         global $member, $manager;
2318
2319         $blogid = intRequestVar('blogid');
2320
2321         // check if allowed
2322         $member->blogAdminRights($blogid) or $this->disallow();
2323
2324         $this->pagehead();
2325
2326         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2327
2328         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2329
2330         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2331
2332
2333
2334         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2335                . ' FROM '.sql_table('member').', '.sql_table('team')
2336                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2337
2338         $template['content'] = 'teamlist';
2339         $template['tabindex'] = 10;
2340
2341         $manager->loadClass("ENCAPSULATE");
2342         $batch = new Batch('team');
2343         $batch->showlist($query, 'table', $template);
2344
2345         ?>
2346             <h3><?php echo _TEAM_ADDNEW?></h3>
2347
2348             <form method='post' action='index.php'><div>
2349
2350             <input type='hidden' name='action' value='teamaddmember' />
2351             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2352             <?php $manager->addTicketHidden() ?>
2353
2354             <table><tr>
2355                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2356                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2357                     $query =  'SELECT mname as text, mnumber as value'
2358                            . ' FROM '.sql_table('member');
2359
2360                     $template['name'] = 'memberid';
2361                     $template['tabindex'] = 10000;
2362                     showlist($query,'select',$template);
2363                 ?></td>
2364             </tr><tr>
2365                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2366                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2367             </tr><tr>
2368                 <td><?php echo _TEAM_ADD?></td>
2369                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2370             </tr></table>
2371
2372             </div></form>
2373         <?php
2374         $this->pagefoot();
2375     }
2376
2377     /**
2378      * Add member to team
2379      */
2380     function action_teamaddmember() {
2381         global $member, $manager;
2382
2383         $memberid = intPostVar('memberid');
2384         $blogid = intPostVar('blogid');
2385         $admin = intPostVar('admin');
2386
2387         // check if allowed
2388         $member->blogAdminRights($blogid) or $this->disallow();
2389
2390         $blog =& $manager->getBlog($blogid);
2391         if (!$blog->addTeamMember($memberid, $admin))
2392             $this->error(_ERROR_ALREADYONTEAM);
2393
2394         $this->action_manageteam();
2395
2396     }
2397
2398     /**
2399      * @todo document this
2400      */
2401     function action_teamdelete() {
2402         global $member, $manager;
2403
2404         $memberid = intRequestVar('memberid');
2405         $blogid = intRequestVar('blogid');
2406
2407         // check if allowed
2408         $member->blogAdminRights($blogid) or $this->disallow();
2409
2410         $teammem = Member::createFromID($memberid);
2411         $blog =& $manager->getBlog($blogid);
2412
2413         $this->pagehead();
2414         ?>
2415             <h2><?php echo _DELETE_CONFIRM?></h2>
2416
2417             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  Entity::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  Entity::hsc(strip_tags($blog->getName())) ?></b>
2418             </p>
2419
2420
2421             <form method="post" action="index.php"><div>
2422             <input type="hidden" name="action" value="teamdeleteconfirm" />
2423             <?php $manager->addTicketHidden() ?>
2424             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2425             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2426             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2427             </div></form>
2428         <?php
2429         $this->pagefoot();
2430     }
2431
2432     /**
2433      * @todo document this
2434      */
2435     function action_teamdeleteconfirm() {
2436         global $member;
2437
2438         $memberid = intRequestVar('memberid');
2439         $blogid = intRequestVar('blogid');
2440
2441         $error = $this->deleteOneTeamMember($blogid, $memberid);
2442         if ($error)
2443             $this->error($error);
2444
2445
2446         $this->action_manageteam();
2447     }
2448
2449     /**
2450      * @todo document this
2451      */
2452     function deleteOneTeamMember($blogid, $memberid) {
2453         global $member, $manager;
2454
2455         $blogid = intval($blogid);
2456         $memberid = intval($memberid);
2457
2458         // check if allowed
2459         if (!$member->blogAdminRights($blogid))
2460             return _ERROR_DISALLOWED;
2461
2462         // check if: - there remains at least one blog admin
2463         //           - (there remains at least one team member)
2464         $tmem = Member::createFromID($memberid);
2465
2466         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2467
2468         if ($tmem->isBlogAdmin($blogid)) {
2469             // check if there are more blog members left and at least one admin
2470             // (check for at least two admins before deletion)
2471             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2472             $r = sql_query($query);
2473             if (sql_num_rows($r) < 2)
2474                 return _ERROR_ATLEASTONEBLOGADMIN;
2475         }
2476
2477         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2478         sql_query($query);
2479
2480         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2481
2482         return '';
2483     }
2484
2485     /**
2486      * @todo document this
2487      */
2488     function action_teamchangeadmin() {
2489         global $member;
2490
2491         $blogid = intRequestVar('blogid');
2492         $memberid = intRequestVar('memberid');
2493
2494         // check if allowed
2495         $member->blogAdminRights($blogid) or $this->disallow();
2496
2497         $mem = Member::createFromID($memberid);
2498
2499         // don't allow when there is only one admin at this moment
2500         if ($mem->isBlogAdmin($blogid)) {
2501             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2502             if (sql_num_rows($r) == 1)
2503                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2504         }
2505
2506         if ($mem->isBlogAdmin($blogid))
2507             $newval = 0;
2508         else
2509             $newval = 1;
2510
2511         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2512         sql_query($query);
2513
2514         // only show manageteam if member did not change its own admin privileges
2515         if ($member->isBlogAdmin($blogid))
2516             $this->action_manageteam();
2517         else
2518             $this->action_overview(_MSG_ADMINCHANGED);
2519     }
2520
2521     /**
2522      * @todo document this
2523      */
2524     function action_blogsettings() {
2525         global $member, $manager;
2526
2527         $blogid = intRequestVar('blogid');
2528
2529         // check if allowed
2530         $member->blogAdminRights($blogid) or $this->disallow();
2531
2532         $blog =& $manager->getBlog($blogid);
2533
2534         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2535         $this->pagehead($extrahead);
2536
2537         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2538         ?>
2539         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2540
2541         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2542
2543         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2544         <?php
2545             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2546             $aMemberNames = array();
2547             while ($o = sql_fetch_object($res))
2548                 array_push($aMemberNames, Entity::hsc($o->mname) . ' (' . Entity::hsc($o->mrealname). ')');
2549             echo implode(',', $aMemberNames);
2550         ?>
2551         </p>
2552
2553
2554
2555         <p>
2556         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2557         </p>
2558
2559         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2560
2561         <form method="post" action="index.php"><div>
2562
2563         <input type="hidden" name="action" value="blogsettingsupdate" />
2564         <?php $manager->addTicketHidden() ?>
2565         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2566         <table><tr>
2567             <td><?php echo _EBLOG_NAME?></td>
2568             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getName()) ?>" /></td>
2569         </tr><tr>
2570             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2571                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2572             </td>
2573             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  Entity::hsc($blog->getShortName()) ?>" /></td>
2574         </tr><tr>
2575             <td><?php echo _EBLOG_DESC?></td>
2576             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  Entity::hsc($blog->getDescription()) ?>" /></td>
2577         </tr><tr>
2578             <td><?php echo _EBLOG_URL?></td>
2579             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  Entity::hsc($blog->getURL()) ?>" /></td>
2580         </tr><tr>
2581             <td><?php echo _EBLOG_DEFSKIN?>
2582                 <?php help('blogdefaultskin'); ?>
2583             </td>
2584             <td>
2585                 <?php
2586                     $query =  'SELECT sdname as text, sdnumber as value'
2587                            . ' FROM '.sql_table('skin_desc');
2588                     $template['name'] = 'defskin';
2589                     $template['selected'] = $blog->getDefaultSkin();
2590                     $template['tabindex'] = 50;
2591                     showlist($query,'select',$template);
2592                 ?>
2593
2594             </td>
2595         </tr><tr>
2596             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2597             </td>
2598             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2599         </tr><tr>
2600             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2601             </td>
2602             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2603         </tr><tr>
2604             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2605             </td>
2606             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2607         </tr><tr>
2608             <td><?php echo _EBLOG_ANONYMOUS?>
2609             </td>
2610             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2611         </tr><tr>
2612     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2613          </td>
2614          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2615       </tr><tr>
2616             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2617             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  Entity::hsc($blog->getNotifyAddress()); ?>" /></td>
2618         </tr><tr>
2619             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2620             <td>
2621                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2622                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2623                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2624                 <br />
2625                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2626                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2627                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2628                 <br />
2629                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2630                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2631                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2632             </td>
2633         </tr><tr>
2634             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2635             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  Entity::hsc($blog->getMaxComments()); ?>" /></td>
2636         </tr><tr>
2637             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2638             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getUpdateFile()) ?>" /></td>
2639         </tr><tr>
2640             <td><?php echo _EBLOG_DEFCAT?></td>
2641             <td>
2642                 <?php
2643                     $query =  'SELECT cname as text, catid as value'
2644                            . ' FROM '.sql_table('category')
2645                            . ' WHERE cblog=' . $blog->getID();
2646                     $template['name'] = 'defcat';
2647                     $template['selected'] = $blog->getDefaultCategory();
2648                     $template['tabindex'] = 110;
2649                     showlist($query,'select',$template);
2650                 ?>
2651             </td>
2652         </tr><tr>
2653             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2654                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', time()); ?></b>
2655                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', $blog->getCorrectTime()); ?></b>
2656                 </td>
2657             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  Entity::hsc($blog->getTimeOffset()); ?>" /></td>
2658         </tr><tr>
2659             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2660             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2661         </tr>
2662         <?php
2663             // plugin options
2664             $this->_insertPluginOptions('blog',$blogid);
2665         ?>
2666         <tr>
2667             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2668         </tr><tr>
2669             <td><?php echo _EBLOG_CHANGE?></td>
2670             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2671         </tr></table>
2672
2673         </div></form>
2674
2675         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2676
2677
2678         <?php
2679         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2680         $template['content'] = 'categorylist';
2681         $template['tabindex'] = 200;
2682
2683         $manager->loadClass("ENCAPSULATE");
2684         $batch = new Batch('category');
2685         $batch->showlist($query,'table',$template);
2686
2687         ?>
2688
2689
2690         <form action="index.php" method="post"><div>
2691         <input name="action" value="categorynew" type="hidden" />
2692         <?php $manager->addTicketHidden() ?>
2693         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2694
2695         <table><tr>
2696             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2697         </tr><tr>
2698             <td><?php echo _EBLOG_CAT_NAME?></td>
2699             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2700         </tr><tr>
2701             <td><?php echo _EBLOG_CAT_DESC?></td>
2702             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2703         </tr><tr>
2704             <td><?php echo _EBLOG_CAT_CREATE?></td>
2705             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2706         </tr></table>
2707
2708         </div></form>
2709
2710         <?php
2711
2712             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2713
2714             $manager->notify(
2715                 'BlogSettingsFormExtras',
2716                 array(
2717                     'blog' => &$blog
2718                 )
2719             );
2720
2721         $this->pagefoot();
2722     }
2723
2724     /**
2725      * @todo document this
2726      */
2727     function action_categorynew() {
2728         global $member, $manager;
2729
2730         $blogid = intRequestVar('blogid');
2731
2732         $member->blogAdminRights($blogid) or $this->disallow();
2733
2734         $cname = postVar('cname');
2735         $cdesc = postVar('cdesc');
2736
2737         if (!isValidCategoryName($cname))
2738             $this->error(_ERROR_BADCATEGORYNAME);
2739
2740         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2741         $res = sql_query($query);
2742         if (sql_num_rows($res) > 0)
2743             $this->error(_ERROR_DUPCATEGORYNAME);
2744
2745         $blog       =& $manager->getBlog($blogid);
2746         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2747
2748         $this->action_blogsettings();
2749     }
2750
2751     /**
2752      * @todo document this
2753      */
2754     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2755         global $member, $manager;
2756
2757         if ($blogid == '')
2758             $blogid = intGetVar('blogid');
2759         else
2760             $blogid = intval($blogid);
2761         if ($catid == '')
2762             $catid = intGetVar('catid');
2763         else
2764             $catid = intval($catid);
2765
2766         $member->blogAdminRights($blogid) or $this->disallow();
2767
2768         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2769         $obj = sql_fetch_object($res);
2770
2771         $cname = $obj->cname;
2772         $cdesc = $obj->cdesc;
2773
2774         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2775         $this->pagehead($extrahead);
2776
2777         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2778
2779         ?>
2780         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo Entity::hsc($cname)?>'</h2>
2781         <form method='post' action='index.php'><div>
2782         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2783         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2784         <input name="desturl" type="hidden" value="<?php echo Entity::hsc($desturl) ?>" />
2785         <input name="action" type="hidden" value="categoryupdate" />
2786         <?php $manager->addTicketHidden(); ?>
2787
2788         <table><tr>
2789             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2790         </tr><tr>
2791             <td><?php echo _EBLOG_CAT_NAME?></td>
2792             <td><input type="text" name="cname" value="<?php echo Entity::hsc($cname)?>" size="40" maxlength="40" /></td>
2793         </tr><tr>
2794             <td><?php echo _EBLOG_CAT_DESC?></td>
2795             <td><input type="text" name="cdesc" value="<?php echo Entity::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2796         </tr>
2797         <?php
2798             // insert plugin options
2799             $this->_insertPluginOptions('category',$catid);
2800         ?>
2801         <tr>
2802             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2803         </tr><tr>
2804             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2805             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2806         </tr></table>
2807
2808         </div></form>
2809         <?php
2810         $this->pagefoot();
2811     }
2812
2813     /**
2814      * @todo document this
2815      */
2816     function action_categoryupdate() {
2817         global $member, $manager;
2818
2819         $blogid = intPostVar('blogid');
2820         $catid = intPostVar('catid');
2821         $cname = postVar('cname');
2822         $cdesc = postVar('cdesc');
2823         $desturl = postVar('desturl');
2824
2825         $member->blogAdminRights($blogid) or $this->disallow();
2826
2827         if (!isValidCategoryName($cname))
2828             $this->error(_ERROR_BADCATEGORYNAME);
2829
2830         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2831         $res = sql_query($query);
2832         if (sql_num_rows($res) > 0)
2833             $this->error(_ERROR_DUPCATEGORYNAME);
2834
2835         $query =  'UPDATE '.sql_table('category').' SET'
2836                . " cname='" . sql_real_escape_string($cname) . "',"
2837                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2838                . " WHERE catid=" . $catid;
2839
2840         sql_query($query);
2841
2842         // store plugin options
2843         $aOptions = requestArray('plugoption');
2844         NucleusPlugin::apply_plugin_options($aOptions);
2845         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2846
2847
2848         if ($desturl) {
2849             redirect($desturl);
2850             exit;
2851         } else {
2852             $this->action_blogsettings();
2853         }
2854     }
2855
2856     /**
2857      * @todo document this
2858      */
2859     function action_categorydelete() {
2860         global $member, $manager;
2861
2862         $blogid = intRequestVar('blogid');
2863         $catid = intRequestVar('catid');
2864
2865         $member->blogAdminRights($blogid) or $this->disallow();
2866
2867         $blog =& $manager->getBlog($blogid);
2868
2869         // check if the category is valid
2870         if (!$blog->isValidCategory($catid))
2871             $this->error(_ERROR_NOSUCHCATEGORY);
2872
2873         // don't allow deletion of default category
2874         if ($blog->getDefaultCategory() == $catid)
2875             $this->error(_ERROR_DELETEDEFCATEGORY);
2876
2877         // check if catid is the only category left for blogid
2878         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2879         $res = sql_query($query);
2880         if (sql_num_rows($res) == 1)
2881             $this->error(_ERROR_DELETELASTCATEGORY);
2882
2883
2884         $this->pagehead();
2885         ?>
2886             <h2><?php echo _DELETE_CONFIRM?></h2>
2887
2888             <div>
2889             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  Entity::hsc($blog->getCategoryName($catid))?></b>
2890             </div>
2891
2892             <form method="post" action="index.php"><div>
2893             <input type="hidden" name="action" value="categorydeleteconfirm" />
2894             <?php $manager->addTicketHidden() ?>
2895             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2896             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2897             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2898             </div></form>
2899         <?php
2900         $this->pagefoot();
2901     }
2902
2903     /**
2904      * @todo document this
2905      */
2906     function action_categorydeleteconfirm() {
2907         global $member, $manager;
2908
2909         $blogid = intRequestVar('blogid');
2910         $catid = intRequestVar('catid');
2911
2912         $member->blogAdminRights($blogid) or $this->disallow();
2913
2914         $error = $this->deleteOneCategory($catid);
2915         if ($error)
2916             $this->error($error);
2917
2918         $this->action_blogsettings();
2919     }
2920
2921         /**
2922          * Admin::deleteOneCategory()
2923          * Delete a category by its id
2924          *
2925          * @param       String  $catid  category id for deleting
2926          * @return      Void
2927          */
2928         function deleteOneCategory($catid)
2929         {
2930                 global $manager, $member;
2931
2932                 $catid = intval($catid);
2933                 $blogid = getBlogIDFromCatID($catid);
2934
2935                 if ( !$member->blogAdminRights($blogid) )
2936                 {
2937                         return ERROR_DISALLOWED;
2938                 }
2939
2940                 // get blog
2941                 $blog =& $manager->getBlog($blogid);
2942
2943                 // check if the category is valid
2944                 if ( !$blog || !$blog->isValidCategory($catid) )
2945                 {
2946                         return _ERROR_NOSUCHCATEGORY;
2947                 }
2948
2949                 $destcatid = $blog->getDefaultCategory();
2950
2951                 // don't allow deletion of default category
2952                 if ( $blog->getDefaultCategory() == $catid )
2953                 {
2954                         return _ERROR_DELETEDEFCATEGORY;
2955                 }
2956
2957                 // check if catid is the only category left for blogid
2958                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2959                 $res = sql_query($query);
2960                 if ( sql_num_rows($res) == 1 )
2961                 {
2962                         return _ERROR_DELETELASTCATEGORY;
2963                 }
2964
2965                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2966
2967                 // change category for all items to the default category
2968                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2969                 sql_query($query);
2970
2971                 // delete all associated plugin options
2972                 NucleusPlugin::delete_option_values('category', $catid);
2973
2974                 // delete category
2975                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2976                 sql_query($query);
2977
2978                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2979                 return;
2980         }
2981
2982         /**
2983          * Admin::action_blogsettingsupdate
2984          * Updating blog settings
2985          *
2986          * @param       Void
2987          * @return      Void
2988          */
2989         function action_blogsettingsupdate()
2990         {
2991                 global $member, $manager;
2992
2993                 $blogid = intRequestVar('blogid');
2994
2995                 $member->blogAdminRights($blogid) or $this->disallow();
2996
2997                 $blog =& $manager->getBlog($blogid);
2998
2999                 $notify_address = trim(postVar('notify'));
3000                 $shortname              = trim(postVar('shortname'));
3001                 $updatefile     = trim(postVar('update'));
3002
3003                 $notifyComment  = intPostVar('notifyComment');
3004                 $notifyVote             = intPostVar('notifyVote');
3005                 $notifyNewItem  = intPostVar('notifyNewItem');
3006
3007                 if ( $notifyComment == 0 )
3008                 {
3009                         $notifyComment = 1;
3010                 }
3011                 if ( $notifyVote == 0 )
3012                 {
3013                         $notifyVote = 1;
3014                 }
3015                 if ( $notifyNewItem == 0 )
3016                 {
3017                         $notifyNewItem = 1;
3018                 }
3019                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3020
3021                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
3022                 {
3023                         $this->error(_ERROR_BADNOTIFY);
3024                 }
3025
3026                 if ( !isValidShortName($shortname) )
3027                 {
3028                         $this->error(_ERROR_BADSHORTBLOGNAME);
3029                 }
3030
3031                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
3032                 {
3033                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3034                 }
3035                 // check if update file is writable
3036                 if ( $updatefile && !is_writeable($updatefile) )
3037                 {
3038                         $this->error(_ERROR_UPDATEFILE);
3039                 }
3040
3041                 $blog->setName(trim(postVar('name')));
3042                 $blog->setShortName($shortname);
3043                 $blog->setNotifyAddress($notify_address);
3044                 $blog->setNotifyType($notifyType);
3045                 $blog->setMaxComments(postVar('maxcomments'));
3046                 $blog->setCommentsEnabled(postVar('comments'));
3047                 $blog->setTimeOffset(postVar('timeoffset'));
3048                 $blog->setUpdateFile($updatefile);
3049                 $blog->setURL(trim(postVar('url')));
3050                 $blog->setDefaultSkin(intPostVar('defskin'));
3051                 $blog->setDescription(trim(postVar('desc')));
3052                 $blog->setPublic(postVar('public'));
3053                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3054                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3055                 $blog->setDefaultCategory(intPostVar('defcat'));
3056                 $blog->setSearchable(intPostVar('searchable'));
3057                 $blog->setEmailRequired(intPostVar('reqemail'));
3058                 $blog->writeSettings();
3059
3060                 // store plugin options
3061                 $aOptions = requestArray('plugoption');
3062                 NucleusPlugin::apply_plugin_options($aOptions);
3063                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3064
3065                 $this->action_overview(_MSG_SETTINGSCHANGED);
3066                 return;
3067         }
3068
3069     /**
3070      * @todo document this
3071      */
3072     function action_deleteblog() {
3073         global $member, $CONF, $manager;
3074
3075         $blogid = intRequestVar('blogid');
3076
3077         $member->blogAdminRights($blogid) or $this->disallow();
3078
3079         // check if blog is default blog
3080         if ($CONF['DefaultBlog'] == $blogid)
3081             $this->error(_ERROR_DELDEFBLOG);
3082
3083         $blog =& $manager->getBlog($blogid);
3084
3085         $this->pagehead();
3086         ?>
3087             <h2><?php echo _DELETE_CONFIRM?></h2>
3088
3089             <p><?php echo _WARNINGTXT_BLOGDEL?>
3090             </p>
3091
3092             <div>
3093             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  Entity::hsc($blog->getName())?></b>
3094             </div>
3095
3096             <form method="post" action="index.php"><div>
3097             <input type="hidden" name="action" value="deleteblogconfirm" />
3098             <?php $manager->addTicketHidden() ?>
3099             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3100             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3101             </div></form>
3102         <?php
3103         $this->pagefoot();
3104     }
3105
3106         /**
3107          * Admin::action_deleteblogconfirm()
3108          * Delete Blog
3109          *
3110          * @param       Void
3111          * @return      Void
3112          */
3113         function action_deleteblogconfirm()
3114         {
3115                 global $member, $CONF, $manager;
3116
3117                 $blogid = intRequestVar('blogid');
3118                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3119                 $member->blogAdminRights($blogid) or $this->disallow();
3120
3121                 // check if blog is default blog
3122                 if ( $CONF['DefaultBlog'] == $blogid )
3123                 {
3124                         $this->error(_ERROR_DELDEFBLOG);
3125                 }
3126
3127                 // delete all comments
3128                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3129                 sql_query($query);
3130
3131                 // delete all items
3132                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3133                 sql_query($query);
3134
3135                 // delete all team members
3136                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3137                 sql_query($query);
3138
3139                 // delete all bans
3140                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3141                 sql_query($query);
3142
3143                 // delete all categories
3144                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3145                 sql_query($query);
3146
3147                 // delete all associated plugin options
3148                 NucleusPlugin::delete_option_values('blog', $blogid);
3149
3150                 // delete the blog itself
3151                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3152                 sql_query($query);
3153
3154                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3155
3156                 $this->action_overview(_DELETED_BLOG);
3157                 return;
3158         }
3159
3160     /**
3161      * @todo document this
3162      */
3163     function action_memberdelete() {
3164         global $member, $manager;
3165
3166         $memberid = intRequestVar('memberid');
3167
3168         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3169
3170         $mem = Member::createFromID($memberid);
3171
3172         $this->pagehead();
3173         ?>
3174             <h2><?php echo _DELETE_CONFIRM?></h2>
3175
3176             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo Entity::hsc($mem->getDisplayName()) ?></b>
3177             </p>
3178
3179             <p>
3180             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3181             </p>
3182
3183             <form method="post" action="index.php"><div>
3184             <input type="hidden" name="action" value="memberdeleteconfirm" />
3185             <?php $manager->addTicketHidden() ?>
3186             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3187             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3188             </div></form>
3189         <?php
3190         $this->pagefoot();
3191     }
3192
3193     /**
3194      * @todo document this
3195      */
3196     function action_memberdeleteconfirm() {
3197         global $member;
3198
3199         $memberid = intRequestVar('memberid');
3200
3201         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3202
3203         $error = $this->deleteOneMember($memberid);
3204         if ($error)
3205             $this->error($error);
3206
3207         if ($member->isAdmin())
3208             $this->action_usermanagement();
3209         else
3210             $this->action_overview(_DELETED_MEMBER);
3211     }
3212
3213         /**
3214          * Admin::deleteOneMember()
3215          * Delete a member by id
3216          *
3217          * @static
3218          * @params      Integer $memberid       member id
3219          * @return      String  null string or error messages
3220          */
3221         function deleteOneMember($memberid)
3222         {
3223                 global $manager;
3224
3225                 $memberid = intval($memberid);
3226                 $mem = Member::createFromID($memberid);
3227
3228                 if ( !$mem->canBeDeleted() )
3229                 {
3230                         return _ERROR_DELETEMEMBER;
3231                 }
3232
3233                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3234
3235                 /* unlink comments from memberid */
3236                 if ( $memberid )
3237                 {
3238                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3239                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3240                         sql_query($query);
3241                 }
3242
3243                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3244                 sql_query($query);
3245
3246                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3247                 sql_query($query);
3248
3249                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3250                 sql_query($query);
3251
3252                 // delete all associated plugin options
3253                 NucleusPlugin::delete_option_values('member', $memberid);
3254
3255                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3256
3257                 return '';
3258         }
3259
3260     /**
3261      * @todo document this
3262      */
3263     function action_createnewlog() {
3264         global $member, $CONF, $manager;
3265
3266         // Only Super-Admins can do this
3267         $member->isAdmin() or $this->disallow();
3268
3269         $this->pagehead();
3270
3271         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3272         ?>
3273         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3274
3275         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3276
3277         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3278
3279         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3280
3281         <ol>
3282             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3283             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3284         </ol>
3285
3286         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3287
3288         <p>
3289         <?php echo _EBLOG_CREATE_TEXT?>
3290         </p>
3291
3292         <form method="post" action="index.php"><div>
3293
3294         <input type="hidden" name="action" value="addnewlog" />
3295         <?php $manager->addTicketHidden() ?>
3296
3297
3298         <table><tr>
3299             <td><?php echo _EBLOG_NAME?></td>
3300             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3301         </tr><tr>
3302             <td><?php echo _EBLOG_SHORTNAME?>
3303                 <?php help('shortblogname'); ?>
3304             </td>
3305             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3306         </tr><tr>
3307             <td><?php echo _EBLOG_DESC?></td>
3308             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3309         </tr><tr>
3310             <td><?php echo _EBLOG_DEFSKIN?>
3311                 <?php help('blogdefaultskin'); ?>
3312             </td>
3313             <td>
3314                 <?php
3315                     $query =  'SELECT sdname as text, sdnumber as value'
3316                            . ' FROM '.sql_table('skin_desc');
3317                     $template['name'] = 'defskin';
3318                     $template['tabindex'] = 50;
3319                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3320                     showlist($query,'select',$template);
3321                 ?>
3322             </td>
3323         </tr><tr>
3324             <td><?php echo _EBLOG_OFFSET?>
3325                 <?php help('blogtimeoffset'); ?>
3326                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::formatted_datetime('%H:%M',time()); ?></b>
3327             </td>
3328             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3329         </tr><tr>
3330             <td><?php echo _EBLOG_ADMIN?>
3331                 <?php help('teamadmin'); ?>
3332             </td>
3333             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3334         </tr><tr>
3335             <td><?php echo _EBLOG_CREATE?></td>
3336             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3337         </tr></table>
3338
3339         </div></form>
3340         <?php
3341         $this->pagefoot();
3342     }
3343
3344     /**
3345      * @todo document this
3346      */
3347     function action_addnewlog() {
3348         global $member, $manager, $CONF;
3349
3350         // Only Super-Admins can do this
3351         $member->isAdmin() or $this->disallow();
3352
3353         $bname          = trim(postVar('name'));
3354         $bshortname     = trim(postVar('shortname'));
3355         $btimeoffset    = postVar('timeoffset');
3356         $bdesc          = trim(postVar('desc'));
3357         $bdefskin       = postVar('defskin');
3358
3359         if (!isValidShortName($bshortname))
3360             $this->error(_ERROR_BADSHORTBLOGNAME);
3361
3362         if ($manager->existsBlog($bshortname))
3363             $this->error(_ERROR_DUPSHORTBLOGNAME);
3364
3365         $manager->notify(
3366             'PreAddBlog',
3367             array(
3368                 'name' => &$bname,
3369                 'shortname' => &$bshortname,
3370                 'timeoffset' => &$btimeoffset,
3371                 'description' => &$bdesc,
3372                 'defaultskin' => &$bdefskin
3373             )
3374         );
3375
3376
3377         // add slashes for sql queries
3378         $bname =        sql_real_escape_string($bname);
3379         $bshortname =   sql_real_escape_string($bshortname);
3380         $btimeoffset =  sql_real_escape_string($btimeoffset);
3381         $bdesc =        sql_real_escape_string($bdesc);
3382         $bdefskin =     sql_real_escape_string($bdefskin);
3383
3384         // create blog
3385         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3386         sql_query($query);
3387         $blogid = sql_insert_id();
3388         $blog   =& $manager->getBlog($blogid);
3389
3390         // create new category
3391         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3392         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3393         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3394         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3395 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3396 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3397         $catid = sql_insert_id();
3398
3399         // set as default category
3400         $blog->setDefaultCategory($catid);
3401         $blog->writeSettings();
3402
3403         // create team member
3404         $memberid = $member->getID();
3405         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3406         sql_query($query);
3407
3408         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3409         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3410
3411         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3412         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3413
3414
3415
3416         $manager->notify(
3417             'PostAddBlog',
3418             array(
3419                 'blog' => &$blog
3420             )
3421         );
3422
3423         $manager->notify(
3424             'PostAddCategory',
3425             array(
3426                 'blog' => &$blog,
3427                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3428                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3429                 'catid' => $catid
3430             )
3431         );
3432
3433         $this->pagehead();
3434         ?>
3435         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3436
3437         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, Entity::hsc($bname)) ?></p>
3438
3439         <ol>
3440             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, Entity::hsc($bshortname)) ?></a></li>
3441             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3442         </ol>
3443
3444         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, Entity::hsc($bshortname)) ?></a></h3>
3445
3446         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, Entity::hsc($bshortname)) ?></p>
3447 <pre><code>&lt;?php
3448
3449 $CONF['Self'] = '<b><?php echo Entity::hsc($bshortname)?>.php</b>';
3450
3451 include('<i>./config.php</i>');
3452
3453 selectBlog('<b><?php echo Entity::hsc($bshortname)?></b>');
3454 selector();
3455
3456 ?&gt;</code></pre>
3457
3458         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3459
3460         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3461
3462         <form action="index.php" method="post"><div>
3463             <input type="hidden" name="action" value="addnewlog2" />
3464             <?php $manager->addTicketHidden() ?>
3465             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3466             <table><tr>
3467                 <td><?php echo _EBLOG_URL?></td>
3468                 <td><input name="url" maxlength="100" size="40" value="<?php echo Entity::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3469             </tr><tr>
3470                 <td><?php echo _EBLOG_CREATE?></td>
3471                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3472             </tr></table>
3473         </div></form>
3474
3475         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3476
3477         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3478
3479         <form action="index.php" method="post"><div>
3480             <input type="hidden" name="action" value="addnewlog2" />
3481             <?php $manager->addTicketHidden() ?>
3482             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3483             <table><tr>
3484                 <td><?php echo _EBLOG_URL?></td>
3485                 <td><input name="url" maxlength="100" size="40" /></td>
3486             </tr><tr>
3487                 <td><?php echo _EBLOG_CREATE?></td>
3488                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3489             </tr></table>
3490         </div></form>
3491
3492         <?php       $this->pagefoot();
3493
3494     }
3495
3496     /**
3497      * @todo document this
3498      */
3499     function action_addnewlog2() {
3500         global $member, $manager;
3501
3502         $member->blogAdminRights($blogid) or $this->disallow();
3503
3504         $burl   = requestVar('url');
3505         $blogid = intRequestVar('blogid');
3506
3507         $blog =& $manager->getBlog($blogid);
3508         $blog->setURL(trim($burl));
3509         $blog->writeSettings();
3510
3511         $this->action_overview(_MSG_NEWBLOG);
3512     }
3513
3514     /**
3515      * @todo document this
3516      */
3517     function action_skinieoverview() {
3518         global $member, $DIR_LIBS, $manager;
3519
3520         $member->isAdmin() or $this->disallow();
3521
3522         // load skinie class
3523         include_once($DIR_LIBS . 'skinie.php');
3524
3525         $this->pagehead();
3526
3527         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3528
3529     ?>
3530         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3531
3532                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3533                 <?php                   global $DIR_SKINS;
3534
3535                     $candidates = SkinImport::searchForCandidates($DIR_SKINS);
3536
3537                     if (sizeof($candidates) > 0) {
3538                         ?>
3539                             <form method="post" action="index.php"><div>
3540                                 <input type="hidden" name="action" value="skinieimport" />
3541                                 <?php $manager->addTicketHidden() ?>
3542                                 <input type="hidden" name="mode" value="file" />
3543                                 <select name="skinfile" id="skinie_import_local">
3544                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3545                                         $html = Entity::hsc($skinfile);
3546                                         echo '<option value="',$html,'">',$skinname,'</option>';
3547                                     }
3548                                 ?>
3549                                 </select>
3550                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3551                             </div></form>
3552                         <?php                   } else {
3553                         echo _SKINIE_NOCANDIDATES;
3554                     }
3555                 ?>
3556                 </p>
3557
3558                 <p><em><?php echo _OR?></em></p>
3559
3560                 <form method="post" action="index.php"><p>
3561                     <?php $manager->addTicketHidden() ?>
3562                     <input type="hidden" name="action" value="skinieimport" />
3563                     <input type="hidden" name="mode" value="url" />
3564                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3565                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3566                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3567                 </p></form>
3568
3569
3570         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3571         <form method="post" action="index.php"><div>
3572             <input type="hidden" name="action" value="skinieexport" />
3573             <?php $manager->addTicketHidden() ?>
3574
3575             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3576
3577             <table><tr>
3578                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3579             </tr><tr>
3580     <?php       // show list of skins
3581         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3582         while ($skinObj = sql_fetch_object($res)) {
3583             $id = 'skinexp' . $skinObj->sdnumber;
3584             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3585             echo '<label for="',$id,'">',Entity::hsc($skinObj->sdname),'</label></td>';
3586             echo '<td>',Entity::hsc($skinObj->sddesc),'</td>';
3587             echo '</tr><tr>';
3588         }
3589
3590         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3591
3592         // show list of templates
3593         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3594         while ($templateObj = sql_fetch_object($res)) {
3595             $id = 'templateexp' . $templateObj->tdnumber;
3596             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3597             echo '<label for="',$id,'">',Entity::hsc($templateObj->tdname),'</label></td>';
3598             echo '<td>',Entity::hsc($templateObj->tddesc),'</td>';
3599             echo '</tr><tr>';
3600         }
3601
3602     ?>
3603                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3604             </tr><tr>
3605                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3606             </tr><tr>
3607                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3608             </tr><tr>
3609                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3610             </tr></table>
3611         </div></form>
3612
3613     <?php
3614         $this->pagefoot();
3615
3616     }
3617
3618     /**
3619      * @todo document this
3620      */
3621     function action_skinieimport() {
3622         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3623
3624         $member->isAdmin() or $this->disallow();
3625
3626         // load skinie class
3627         include_once($DIR_LIBS . 'skinie.php');
3628
3629         $skinFileRaw= postVar('skinfile');
3630         $mode       = postVar('mode');
3631
3632         $importer = new SkinImport();
3633
3634         // get full filename
3635         if ($mode == 'file')
3636         {
3637             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3638
3639             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3640             if (!file_exists($skinFile))
3641                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3642         } else {
3643             $skinFile = $skinFileRaw;
3644         }
3645
3646         // read only metadata
3647         $error = $importer->readFile($skinFile, 1);
3648
3649         // clashes
3650         $skinNameClashes = $importer->checkSkinNameClashes();
3651         $templateNameClashes = $importer->checkTemplateNameClashes();
3652         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3653
3654         if ($error) $this->error($error);
3655
3656         $this->pagehead();
3657
3658         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3659         ?>
3660         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3661
3662         <ul>
3663             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3664             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3665             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3666             <?php
3667                 if ($hasNameClashes)
3668                 {
3669             ?>
3670             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3671             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3672             <?php
3673                 } // if (hasNameClashes)
3674             ?>
3675         </ul>
3676
3677         <form method="post" action="index.php"><div>
3678             <input type="hidden" name="action" value="skiniedoimport" />
3679             <?php $manager->addTicketHidden() ?>
3680             <input type="hidden" name="skinfile" value="<?php echo Entity::hsc(postVar('skinfile'))?>" />
3681             <input type="hidden" name="mode" value="<?php echo Entity::hsc($mode)?>" />
3682             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3683             <?php
3684                 if ($hasNameClashes)
3685                 {
3686             ?>
3687             <br />
3688             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3689             <?php
3690                 } // if (hasNameClashes)
3691             ?>
3692         </div></form>
3693
3694
3695         <?php
3696         $this->pagefoot();
3697     }
3698
3699     /**
3700      * @todo document this
3701      */
3702     function action_skiniedoimport() {
3703         global $member, $DIR_LIBS, $DIR_SKINS;
3704
3705         $member->isAdmin() or $this->disallow();
3706
3707         // load skinie class
3708         include_once($DIR_LIBS . 'skinie.php');
3709
3710         $skinFileRaw= postVar('skinfile');
3711         $mode       = postVar('mode');
3712
3713         $allowOverwrite = intPostVar('overwrite');
3714
3715         // get full filename
3716         if ($mode == 'file')
3717         {
3718             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3719
3720             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3721             if (!file_exists($skinFile))
3722                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3723
3724         } else {
3725             $skinFile = $skinFileRaw;
3726         }
3727
3728         $importer = new SkinImport();
3729
3730         $error = $importer->readFile($skinFile);
3731
3732         if ($error)
3733             $this->error($error);
3734
3735         $error = $importer->writeToDatabase($allowOverwrite);
3736
3737         if ($error)
3738             $this->error($error);
3739
3740         $this->pagehead();
3741
3742         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3743     ?>
3744         <h2><?php echo _SKINIE_DONE?></h2>
3745
3746         <ul>
3747             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3748             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3749             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3750         </ul>
3751
3752     <?php       $this->pagefoot();
3753
3754     }
3755
3756     /**
3757      * @todo document this
3758      */
3759     function action_skinieexport() {
3760         global $member, $DIR_LIBS;
3761
3762         $member->isAdmin() or $this->disallow();
3763
3764         // load skinie class
3765         include_once($DIR_LIBS . 'skinie.php');
3766
3767         $aSkins = requestIntArray('skin');
3768         $aTemplates = requestIntArray('template');
3769
3770         if (!is_array($aTemplates)) $aTemplates = array();
3771         if (!is_array($aSkins)) $aSkins = array();
3772
3773         $skinList = array_keys($aSkins);
3774         $templateList = array_keys($aTemplates);
3775
3776         $info = postVar('info');
3777
3778         $exporter = new SkinExport();
3779         foreach ($skinList as $skinId) {
3780             $exporter->addSkin($skinId);
3781         }
3782         foreach ($templateList as $templateId) {
3783             $exporter->addTemplate($templateId);
3784         }
3785         $exporter->setInfo($info);
3786
3787         $exporter->export();
3788     }
3789
3790     /**
3791      * @todo document this
3792      */
3793     function action_templateoverview() {
3794         global $member, $manager;
3795
3796         $member->isAdmin() or $this->disallow();
3797
3798         $this->pagehead();
3799
3800         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3801
3802         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3803         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3804
3805         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3806         $template['content'] = 'templatelist';
3807         $template['tabindex'] = 10;
3808         showlist($query,'table',$template);
3809
3810         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3811
3812         ?>
3813         <form method="post" action="index.php"><div>
3814
3815         <input name="action" value="templatenew" type="hidden" />
3816         <?php $manager->addTicketHidden() ?>
3817         <table><tr>
3818             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3819             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3820         </tr><tr>
3821             <td><?php echo _TEMPLATE_DESC?></td>
3822             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3823         </tr><tr>
3824             <td><?php echo _TEMPLATE_CREATE?></td>
3825             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3826         </tr></table>
3827
3828         </div></form>
3829
3830         <?php
3831         $this->pagefoot();
3832     }
3833
3834     /**
3835      * @todo document this
3836      */
3837     function action_templateedit($msg = '') {
3838         global $member, $manager;
3839
3840         $templateid = intRequestVar('templateid');
3841
3842         $member->isAdmin() or $this->disallow();
3843
3844         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3845         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3846
3847         $this->pagehead($extrahead);
3848
3849         $templatename = Template::getNameFromId($templateid);
3850         $templatedescription = Template::getDesc($templateid);
3851         $template =& $manager->getTemplate($templatename);
3852
3853         ?>
3854         <p>
3855         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3856         </p>
3857
3858         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  Entity::hsc($templatename); ?>'</h2>
3859
3860         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3861         ?>
3862
3863         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3864
3865         <form method="post" action="index.php">
3866         <div>
3867
3868         <input type="hidden" name="action" value="templateupdate" />
3869         <?php $manager->addTicketHidden() ?>
3870         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3871
3872         <table><tr>
3873             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3874         </tr><tr>
3875             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3876             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  Entity::hsc($templatename) ?>" /></td>
3877         </tr><tr>
3878             <td><?php echo _TEMPLATE_DESC?></td>
3879             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  Entity::hsc($templatedescription) ?>" /></td>
3880         </tr><tr>
3881             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3882         </tr><tr>
3883             <td><?php echo _TEMPLATE_UPDATE?></td>
3884             <td>
3885                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3886                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3887             </td>
3888         </tr><tr>
3889             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3890 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3891     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3892     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3893     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3894     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3895     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3896 ?>
3897         </tr><tr>
3898             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3899 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3900     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3901     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3902     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3903     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3904     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3905     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3906 ?>
3907         </tr><tr>
3908             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3909 <?php
3910     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3911 ?>
3912         </tr><tr>
3913             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3914 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3915 ?>
3916         </tr><tr>
3917             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3918 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3919     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3920     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3921 ?>
3922         </tr><tr>
3923             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3924 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3925     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3926     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3927 ?>
3928         </tr><tr>
3929             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3930 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3931     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3932     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3933 ?>
3934         </tr><tr>
3935             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3936 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3937     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3938     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3939     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3940     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3941 ?>
3942         </tr><tr>
3943             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3944 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3945     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3946     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3947 ?>
3948         </tr><tr>
3949             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3950 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3951     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3952 ?>
3953         </tr><tr>
3954             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3955 <?php
3956         $tab = 600;
3957         $pluginfields = array();
3958         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3959
3960         foreach ($pluginfields as $pfkey=>$pfvalue) {
3961             echo "</tr><tr>\n";
3962             echo '<th colspan="2">' . Entity::hen($pfkey) . "</th>\n";
3963             foreach ($pfvalue as $pffield=>$pfdesc) {
3964                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3965             }
3966         }
3967 ?>
3968         </tr><tr>
3969             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3970         </tr><tr>
3971             <td><?php echo _TEMPLATE_UPDATE?></td>
3972             <td>
3973                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3974                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3975             </td>
3976         </tr></table>
3977
3978         </div>
3979         </form>
3980         <?php
3981         $this->pagefoot();
3982     }
3983
3984     /**
3985      * @todo document this
3986      */
3987     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3988         static $count = 1;
3989         if (!isset($template[$name])) $template[$name] = '';
3990     ?>
3991         </tr><tr>
3992             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3993             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>
3994     <?php       $count++;
3995     }
3996
3997     /**
3998      * @todo document this
3999      */
4000     function action_templateupdate() {
4001         global $member,$manager;
4002
4003         $templateid = intRequestVar('templateid');
4004
4005         $member->isAdmin() or $this->disallow();
4006
4007         $name = postVar('tname');
4008         $desc = postVar('tdesc');
4009
4010         if (!isValidTemplateName($name))
4011             $this->error(_ERROR_BADTEMPLATENAME);
4012
4013         if ((Template::getNameFromId($templateid) != $name) && Template::exists($name))
4014             $this->error(_ERROR_DUPTEMPLATENAME);
4015
4016
4017         $name = sql_real_escape_string($name);
4018         $desc = sql_real_escape_string($desc);
4019
4020         // 1. Remove all template parts
4021         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4022         sql_query($query);
4023
4024         // 2. Update description
4025         $query =  'UPDATE '.sql_table('template_desc').' SET'
4026                . " tdname='" . $name . "',"
4027                . " tddesc='" . $desc . "'"
4028                . " WHERE tdnumber=" . $templateid;
4029         sql_query($query);
4030
4031         // 3. Add non-empty template parts
4032         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4033         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4034         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4035         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4036         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4037         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4038         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4039         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4040         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4041         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4042         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4043         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4044         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4045         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4046         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4047         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4048         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4049         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4050         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4051         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4052         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4053         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4054         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4055         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4056         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4057         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4058         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4059         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4060         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4061         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4062         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4063         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4064         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4065         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4066
4067         $pluginfields = array();
4068         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4069         foreach ($pluginfields as $pfkey=>$pfvalue) {
4070             foreach ($pfvalue as $pffield=>$pfdesc) {
4071                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4072             }
4073         }
4074
4075         // jump back to template edit
4076         $this->action_templateedit(_TEMPLATE_UPDATED);
4077
4078     }
4079
4080         /**
4081          * Admin::addToTemplate()
4082          *
4083          * @param       Integer $id     ID for template
4084          * @param       String  $partname       parts name
4085          * @param       String  $content        template contents
4086          * @return      Integer record index
4087          *
4088          */
4089         function addToTemplate($id, $partname, $content)
4090         {
4091                 // don't add empty parts:
4092                 if ( !trim($content) )
4093                 {
4094                         return -1;
4095                 }
4096
4097                 $partname = sql_real_escape_string($partname);
4098                 $content = sql_real_escape_string($content);
4099
4100                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";
4101                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);
4102                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4103                 return sql_insert_id();
4104         }
4105
4106     /**
4107      * @todo document this
4108      */
4109     function action_templatedelete() {
4110         global $member, $manager;
4111
4112         $member->isAdmin() or $this->disallow();
4113
4114         $templateid = intRequestVar('templateid');
4115         // TODO: check if template can be deleted
4116
4117         $this->pagehead();
4118
4119         $name = Template::getNameFromId($templateid);
4120         $desc = Template::getDesc($templateid);
4121
4122         ?>
4123             <h2><?php echo _DELETE_CONFIRM?></h2>
4124
4125             <p>
4126             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo Entity::hsc($name)?></b> (<?php echo  Entity::hsc($desc) ?>)
4127             </p>
4128
4129             <form method="post" action="index.php"><div>
4130                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4131                 <?php $manager->addTicketHidden() ?>
4132                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4133                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4134             </div></form>
4135         <?php
4136         $this->pagefoot();
4137     }
4138
4139     /**
4140      * @todo document this
4141      */
4142     function action_templatedeleteconfirm() {
4143         global $member, $manager;
4144
4145         $templateid = intRequestVar('templateid');
4146
4147         $member->isAdmin() or $this->disallow();
4148
4149         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4150
4151         // 1. delete description
4152         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4153
4154         // 2. delete parts
4155         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4156
4157         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4158
4159         $this->action_templateoverview();
4160     }
4161
4162     /**
4163      * @todo document this
4164      */
4165     function action_templatenew() {
4166         global $member;
4167
4168         $member->isAdmin() or $this->disallow();
4169
4170         $name = postVar('name');
4171         $desc = postVar('desc');
4172
4173         if (!isValidTemplateName($name))
4174             $this->error(_ERROR_BADTEMPLATENAME);
4175
4176         if (Template::exists($name))
4177             $this->error(_ERROR_DUPTEMPLATENAME);
4178
4179         $newTemplateId = Template::createNew($name, $desc);
4180
4181         $this->action_templateoverview();
4182     }
4183
4184     /**
4185      * @todo document this
4186      */
4187     function action_templateclone() {
4188         global $member;
4189
4190         $templateid = intRequestVar('templateid');
4191
4192         $member->isAdmin() or $this->disallow();
4193
4194         // 1. read old template
4195         $name = Template::getNameFromId($templateid);
4196         $desc = Template::getDesc($templateid);
4197
4198         // 2. create desc thing
4199         $name = "cloned" . $name;
4200
4201         // if a template with that name already exists:
4202         if (Template::exists($name)) {
4203             $i = 1;
4204             while (Template::exists($name . $i))
4205                 $i++;
4206             $name .= $i;
4207         }
4208
4209         $newid = Template::createNew($name, $desc);
4210
4211         // 3. create clone
4212         // go through parts of old template and add them to the new one
4213         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4214         while ($o = sql_fetch_object($res)) {
4215             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4216         }
4217
4218         $this->action_templateoverview();
4219     }
4220
4221     /**
4222      * @todo document this
4223      */
4224     function action_skinoverview() {
4225         global $member, $manager;
4226
4227         $member->isAdmin() or $this->disallow();
4228
4229         $this->pagehead();
4230
4231         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4232
4233         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4234
4235         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4236
4237         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4238         $template['content'] = 'skinlist';
4239         $template['tabindex'] = 10;
4240         showlist($query,'table',$template);
4241
4242         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4243
4244         ?>
4245         <form method="post" action="index.php">
4246         <div>
4247
4248         <input name="action" value="skinnew" type="hidden" />
4249         <?php $manager->addTicketHidden() ?>
4250         <table><tr>
4251             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4252             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4253         </tr><tr>
4254             <td><?php echo _SKIN_DESC?></td>
4255             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4256         </tr><tr>
4257             <td><?php echo _SKIN_CREATE?></td>
4258             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4259         </tr></table>
4260
4261         </div>
4262         </form>
4263
4264         <?php
4265         $this->pagefoot();
4266     }
4267
4268     /**
4269      * @todo document this
4270      */
4271     function action_skinnew() {
4272         global $member;
4273
4274         $member->isAdmin() or $this->disallow();
4275
4276         $name = trim(postVar('name'));
4277         $desc = trim(postVar('desc'));
4278
4279         if (!isValidSkinName($name))
4280             $this->error(_ERROR_BADSKINNAME);
4281
4282         if (SKIN::exists($name))
4283             $this->error(_ERROR_DUPSKINNAME);
4284
4285         $newId = SKIN::createNew($name, $desc);
4286
4287         $this->action_skinoverview();
4288     }
4289
4290     /**
4291      * @todo document this
4292      */
4293     function action_skinedit() {
4294         global $member, $manager;
4295
4296         $skinid = intRequestVar('skinid');
4297
4298         $member->isAdmin() or $this->disallow();
4299
4300         $skin = new SKIN($skinid);
4301
4302         $this->pagehead();
4303         ?>
4304         <p>
4305             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4306         </p>
4307         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4308
4309         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4310         <?php echo _SKIN_PARTS_MSG?>
4311         <ul>
4312             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4313             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4314             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4315             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4316             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4317             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4318             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4319             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4320         </ul>
4321
4322         <?php
4323
4324         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4325         $res = sql_query($query);
4326
4327         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4328         echo '<form method="get" action="index.php">' . "\r\n";
4329         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4330         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4331         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4332         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4333         echo '</form>' . "\r\n";
4334
4335         if ($res && sql_num_rows($res) > 0) {
4336             echo '<ul>';
4337             $tabstart = 75;
4338
4339             while ($row = sql_fetch_assoc($res)) {
4340                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . Entity::hsc(strtolower($row['stype'])) . '">' . Entity::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . Entity::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4341             }
4342
4343             echo '</ul>';
4344         }
4345
4346         ?>
4347
4348         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4349         <form method="post" action="index.php">
4350         <div>
4351
4352         <input type="hidden" name="action" value="skineditgeneral" />
4353         <?php $manager->addTicketHidden() ?>
4354         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4355         <table><tr>
4356             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4357             <td><input name="name" tabindex="90" value="<?php echo  Entity::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4358         </tr><tr>
4359             <td><?php echo _SKIN_DESC?></td>
4360             <td><input name="desc" tabindex="100" value="<?php echo  Entity::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4361         </tr><tr>
4362             <td><?php echo _SKIN_TYPE?></td>
4363             <td><input name="type" tabindex="110" value="<?php echo  Entity::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4364         </tr><tr>
4365             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4366             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4367         </tr><tr>
4368             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4369             <td><input name="inc_prefix" tabindex="130" value="<?php echo  Entity::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4370         </tr><tr>
4371             <td><?php echo _SKIN_CHANGE?></td>
4372             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4373         </tr></table>
4374
4375         </div>
4376         </form>
4377
4378
4379         <?php       $this->pagefoot();
4380     }
4381
4382     /**
4383      * @todo document this
4384      */
4385     function action_skineditgeneral() {
4386         global $member;
4387
4388         $skinid = intRequestVar('skinid');
4389
4390         $member->isAdmin() or $this->disallow();
4391
4392         $name = postVar('name');
4393         $desc = postVar('desc');
4394         $type = postVar('type');
4395         $inc_mode = postVar('inc_mode');
4396         $inc_prefix = postVar('inc_prefix');
4397
4398         $skin = new SKIN($skinid);
4399
4400         // 1. Some checks
4401         if (!isValidSkinName($name))
4402             $this->error(_ERROR_BADSKINNAME);
4403
4404         if (($skin->getName() != $name) && SKIN::exists($name))
4405             $this->error(_ERROR_DUPSKINNAME);
4406
4407         if (!$type) $type = 'text/html';
4408         if (!$inc_mode) $inc_mode = 'normal';
4409
4410         // 2. Update description
4411         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4412
4413         $this->action_skinedit();
4414
4415     }
4416
4417     /**
4418      * @todo document this
4419      */
4420     function action_skinedittype($msg = '') {
4421         global $member, $manager;
4422
4423         $skinid = intRequestVar('skinid');
4424         $type = requestVar('type');
4425
4426         $member->isAdmin() or $this->disallow();
4427
4428         $type = trim($type);
4429         $type = strtolower($type);
4430
4431         if (!isValidShortName($type)) {
4432             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4433         }
4434
4435         $skin = new SKIN($skinid);
4436
4437         $friendlyNames = SKIN::getFriendlyNames();
4438
4439         $this->pagehead();
4440         ?>
4441         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4442
4443         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo Entity::hsc($skin->getName()) ?>': <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4444
4445         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4446         ?>
4447
4448
4449         <form method="post" action="index.php">
4450         <div>
4451
4452         <input type="hidden" name="action" value="skinupdate" />
4453         <?php $manager->addTicketHidden() ?>
4454         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4455         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4456
4457         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4458         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4459         (skin type: <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4460         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4461             help('skinpart' . $type);
4462         } else {
4463             help('skinpartspecial');
4464         }?>
4465         <br />
4466
4467         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  Entity::hsc($skin->getContent($type)) ?></textarea>
4468
4469         <br />
4470         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4471         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4472         (skin type: <?php echo Entity::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4473
4474         <br /><br />
4475         <?php echo _SKIN_ALLOWEDVARS?>
4476         <?php           $actions = SKIN::getAllowedActionsForType($type);
4477
4478             sort($actions);
4479
4480             while ($current = array_shift($actions)) {
4481                 // skip deprecated vars
4482                 if ($current == 'ifcat') continue;
4483                 if ($current == 'imagetext') continue;
4484                 if ($current == 'vars') continue;
4485
4486                 echo helplink('skinvar-' . $current) . "$current</a>";
4487                 if (count($actions) != 0) echo ", ";
4488             }
4489         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4490         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4491         showlist($query,'table',array('content'=>'shortblognames'));
4492         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4493         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4494         showlist($query,'table',array('content'=>'shortnames'));
4495         echo '</div></form>';
4496         $this->pagefoot();
4497     }
4498
4499     /**
4500      * @todo document this
4501      */
4502     function action_skinupdate() {
4503         global $member;
4504
4505         $skinid = intRequestVar('skinid');
4506         $content = trim(postVar('content'));
4507         $type = postVar('type');
4508
4509         $member->isAdmin() or $this->disallow();
4510
4511         $skin = new SKIN($skinid);
4512         $skin->update($type, $content);
4513
4514         $this->action_skinedittype(_SKIN_UPDATED);
4515     }
4516
4517     /**
4518      * @todo document this
4519      */
4520     function action_skindelete() {
4521         global $member, $manager, $CONF;
4522
4523         $skinid = intRequestVar('skinid');
4524
4525         $member->isAdmin() or $this->disallow();
4526
4527         // don't allow default skin to be deleted
4528         if ($skinid == $CONF['BaseSkin'])
4529             $this->error(_ERROR_DEFAULTSKIN);
4530
4531         // don't allow deletion of default skins for blogs
4532         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4533         $r = sql_query($query);
4534         if ($o = sql_fetch_object($r))
4535             $this->error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));
4536
4537         $this->pagehead();
4538
4539         $skin = new SKIN($skinid);
4540         $name = $skin->getName();
4541         $desc = $skin->getDescription();
4542
4543         ?>
4544             <h2><?php echo _DELETE_CONFIRM?></h2>
4545
4546             <p>
4547                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo Entity::hsc($name) ?></b> (<?php echo  Entity::hsc($desc)?>)
4548             </p>
4549
4550             <form method="post" action="index.php"><div>
4551                 <input type="hidden" name="action" value="skindeleteconfirm" />
4552                 <?php $manager->addTicketHidden() ?>
4553                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4554                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4555             </div></form>
4556         <?php
4557         $this->pagefoot();
4558     }
4559
4560     /**
4561      * @todo document this
4562      */
4563     function action_skindeleteconfirm() {
4564         global $member, $CONF, $manager;
4565
4566         $skinid = intRequestVar('skinid');
4567
4568         $member->isAdmin() or $this->disallow();
4569
4570         // don't allow default skin to be deleted
4571         if ($skinid == $CONF['BaseSkin'])
4572             $this->error(_ERROR_DEFAULTSKIN);
4573
4574         // don't allow deletion of default skins for blogs
4575         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4576         $r = sql_query($query);
4577         if ($o = sql_fetch_object($r))
4578             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4579
4580         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4581
4582         // 1. delete description
4583         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4584
4585         // 2. delete parts
4586         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4587
4588         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4589
4590         $this->action_skinoverview();
4591     }
4592
4593     /**
4594      * @todo document this
4595      */
4596     function action_skinremovetype() {
4597         global $member, $manager, $CONF;
4598
4599         $skinid = intRequestVar('skinid');
4600         $skintype = requestVar('type');
4601
4602         if (!isValidShortName($skintype)) {
4603             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4604         }
4605
4606         $member->isAdmin() or $this->disallow();
4607
4608         // don't allow default skinparts to be deleted
4609         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4610             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4611         }
4612
4613         $this->pagehead();
4614
4615         $skin = new SKIN($skinid);
4616         $name = $skin->getName();
4617         $desc = $skin->getDescription();
4618
4619         ?>
4620             <h2><?php echo _DELETE_CONFIRM?></h2>
4621
4622             <p>
4623                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo Entity::hsc($skintype); ?> (<?php echo Entity::hsc($name); ?>)</b> (<?php echo  Entity::hsc($desc)?>)
4624             </p>
4625
4626             <form method="post" action="index.php"><div>
4627                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4628                 <?php $manager->addTicketHidden() ?>
4629                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4630                 <input type="hidden" name="type" value="<?php echo Entity::hsc($skintype); ?>" />
4631                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4632             </div></form>
4633         <?php
4634         $this->pagefoot();
4635     }
4636
4637     /**
4638      * @todo document this
4639      */
4640     function action_skinremovetypeconfirm() {
4641         global $member, $CONF, $manager;
4642
4643         $skinid = intRequestVar('skinid');
4644         $skintype = requestVar('type');
4645
4646         if (!isValidShortName($skintype)) {
4647             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4648         }
4649
4650         $member->isAdmin() or $this->disallow();
4651
4652         // don't allow default skinparts to be deleted
4653         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4654             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4655         }
4656
4657         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4658
4659         // delete part
4660         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4661
4662         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4663
4664         $this->action_skinedit();
4665     }
4666
4667     /**
4668      * @todo document this
4669      */
4670     function action_skinclone() {
4671         global $member;
4672
4673         $skinid = intRequestVar('skinid');
4674
4675         $member->isAdmin() or $this->disallow();
4676
4677         // 1. read skin to clone
4678         $skin = new SKIN($skinid);
4679
4680         $name = "clone_" . $skin->getName();
4681
4682         // if a skin with that name already exists:
4683         if (SKIN::exists($name)) {
4684             $i = 1;
4685             while (SKIN::exists($name . $i))
4686                 $i++;
4687             $name .= $i;
4688         }
4689
4690         // 2. create skin desc
4691         $newid = SKIN::createNew(
4692             $name,
4693             $skin->getDescription(),
4694             $skin->getContentType(),
4695             $skin->getIncludeMode(),
4696             $skin->getIncludePrefix()
4697         );
4698
4699
4700         // 3. clone
4701         /*
4702         $this->skinclonetype($skin, $newid, 'index');
4703         $this->skinclonetype($skin, $newid, 'item');
4704         $this->skinclonetype($skin, $newid, 'archivelist');
4705         $this->skinclonetype($skin, $newid, 'archive');
4706         $this->skinclonetype($skin, $newid, 'search');
4707         $this->skinclonetype($skin, $newid, 'error');
4708         $this->skinclonetype($skin, $newid, 'member');
4709         $this->skinclonetype($skin, $newid, 'imagepopup');
4710         */
4711
4712         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4713         $res = sql_query($query);
4714         while ($row = sql_fetch_assoc($res)) {
4715             $this->skinclonetype($skin, $newid, $row['stype']);
4716         }
4717
4718         $this->action_skinoverview();
4719
4720     }
4721
4722         /**
4723          * Admin::skinclonetype()
4724          *
4725          * @param       String  $skin   Skin object
4726          * @param       Integer $newid  ID for this clone
4727          * @param       String  $type   type of skin
4728          * @return      Void
4729          */
4730         function skinclonetype($skin, $newid, $type)
4731         {
4732                 $newid = intval($newid);
4733                 $content = $skin->getContent($type);
4734
4735                 if ( $content )
4736                 {
4737                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";
4738                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);
4739                         sql_query($query);
4740                 }
4741                 return;
4742         }
4743
4744         /**
4745          * Admin::action_settingsedit()
4746          *
4747          * @param       Void
4748          * @return      Void
4749          */
4750         function action_settingsedit() {
4751                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4752
4753                 $member->isAdmin() or $this->disallow();
4754
4755                 $this->pagehead();
4756
4757                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4758                 ?>
4759
4760                 <h2><?php echo _SETTINGS_TITLE?></h2>
4761
4762                 <form action="index.php" method="post">
4763                 <div>
4764
4765                 <input type="hidden" name="action" value="settingsupdate" />
4766                 <?php $manager->addTicketHidden() ?>
4767
4768                 <table><tr>
4769                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4770                 </tr><tr>
4771                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4772                         <td>
4773                                 <?php
4774                                         $query =  'SELECT bname as text, bnumber as value'
4775                                                    . ' FROM '.sql_table('blog');
4776                                         $template['name'] = 'DefaultBlog';
4777                                         $template['selected'] = $CONF['DefaultBlog'];
4778                                         $template['tabindex'] = 10;
4779                                         showlist($query,'select',$template);
4780                                 ?>
4781                         </td>
4782                 </tr><tr>
4783                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4784                         <td>
4785                                 <?php
4786                                         $query =  'SELECT sdname as text, sdnumber as value'
4787                                                    . ' FROM '.sql_table('skin_desc');
4788                                         $template['name'] = 'BaseSkin';
4789                                         $template['selected'] = $CONF['BaseSkin'];
4790                                         $template['tabindex'] = 1;
4791                                         showlist($query,'select',$template);
4792                                 ?>
4793                         </td>
4794                 </tr><tr>
4795                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4796                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  Entity::hsc($CONF['AdminEmail']) ?>" /></td>
4797                 </tr><tr>
4798                         <td><?php echo _SETTINGS_SITENAME?></td>
4799                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  Entity::hsc($CONF['SiteName']) ?>" /></td>
4800                 </tr><tr>
4801                         <td><?php echo _SETTINGS_SITEURL?></td>
4802                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  Entity::hsc($CONF['IndexURL']) ?>" /></td>
4803                 </tr><tr>
4804                         <td><?php echo _SETTINGS_ADMINURL?></td>
4805                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  Entity::hsc($CONF['AdminURL']) ?>" /></td>
4806                 </tr><tr>
4807                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4808                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  Entity::hsc($CONF['PluginURL']) ?>" /></td>
4809                 </tr><tr>
4810                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4811                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  Entity::hsc($CONF['SkinsURL']) ?>" /></td>
4812                 </tr><tr>
4813                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4814                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  Entity::hsc($CONF['ActionURL']) ?>" /></td>
4815                 </tr><tr>
4816                         <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>
4817                         </td>
4818                         <td>
4819                                 <select name="Locale" tabindex="10050">
4820                         <?php
4821                                 $locales = i18n::get_available_locale_list();
4822                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4823                                 {
4824                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4825                                 }
4826                                 else
4827                                 {
4828                                         echo "<option value=\"\">en_Latn_US</option>\n";
4829                                 }
4830
4831                                 foreach ( $locales as $locale )
4832                                 {
4833                                         if ( $locale == 'en_Latn_US' )
4834                                         {
4835                                                 continue;
4836                                         }
4837                                         if ( $locale == i18n::get_current_locale() )
4838                                         {
4839                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4840                                         }
4841                                         else
4842                                         {
4843                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4844                                         }
4845                                 }
4846                         ?>
4847                         </select>
4848
4849                         </td>
4850                 </tr><tr>
4851                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4852                         </td>
4853                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4854                                         <br />
4855                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  Entity::hsc($CONF['DisableSiteURL'])?>" />
4856                         </td>
4857                 </tr><tr>
4858                         <td><?php echo _SETTINGS_DIRS?></td>
4859                         <td><?php echo  Entity::hsc($DIR_NUCLEUS) ?>
4860                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4861                 </tr><tr>
4862                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4863                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4864                 </tr><tr>
4865                         <td>
4866                         <?php
4867                                 echo _SETTINGS_JSTOOLBAR
4868                                 /* =_SETTINGS_DISABLEJS
4869
4870                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4871                                         way to select the javascript version to use
4872
4873                                         now, its:
4874                                                 0 : IE
4875                                                 1 : all javascript disabled
4876                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4877                                 */
4878                            ?>
4879                         </td>
4880                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4881                                 <select name="DisableJsTools" tabindex="10075">
4882                         <?php                              $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4883                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4884                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4885                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4886                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4887                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4888                         ?>
4889                                 </select>
4890                         </td>
4891                 </tr><tr>
4892                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4893                                            <td><?php
4894
4895                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4896                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4897
4898                                            echo ' ', _SETTINGS_URLMODE_HELP;
4899
4900                                                          ?>
4901
4902                                            </td>
4903                 </tr><tr>
4904                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4905                                            <td><?php
4906
4907                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4908
4909                                                          ?>
4910
4911                                            </td>
4912                 </tr><tr>
4913                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4914                         <td>
4915                         <?php
4916                                 if (!array_key_exists('DefaultListSize',$CONF)) {
4917                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4918                                         $CONF['DefaultListSize'] = 10;
4919                                 }
4920                         ?>
4921                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  Entity::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4922                         </td>
4923                 </tr><tr>
4924                         <td><?php echo _SETTINGS_ADMINCSS?>
4925                         </td>
4926                         <td>
4927
4928                                 <select name="AdminCSS" tabindex="10080">
4929                                 <?php                      // show a dropdown list of all available admin css files
4930                                 global $DIR_NUCLEUS;
4931
4932                                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4933
4934                                 while ($filename = readdir($dirhandle) )
4935                                 {
4936
4937                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4938                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4939
4940                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4941                                         {
4942
4943                                                 $name = $matches[1];
4944                                                 echo "<option value=\"$name\"";
4945
4946                                                 if ($name == $CONF['AdminCSS'])
4947                                                 {
4948                                                         echo " selected=\"selected\"";
4949                                                 }
4950
4951                                                 echo ">$name</option>";
4952
4953                                         }
4954
4955                                 }
4956
4957                                 closedir($dirhandle);
4958
4959                                 ?>
4960                                 </select>
4961
4962                         </td>
4963                 </tr><tr>
4964                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4965                 </tr><tr>
4966                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4967                         <td><?php echo  Entity::hsc($DIR_MEDIA) ?>
4968                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4969                                 <?php                              if (!is_dir($DIR_MEDIA))
4970                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4971                                         if (!is_readable($DIR_MEDIA))
4972                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4973                                         if (!is_writeable($DIR_MEDIA))
4974                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4975                                 ?>
4976                         </td>
4977                 </tr><tr>
4978                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4979                         <td>
4980                                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  Entity::hsc($CONF['MediaURL']) ?>" />
4981                         </td>
4982                 </tr><tr>
4983                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4984                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4985                 </tr><tr>
4986                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4987                         <td>
4988                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  Entity::hsc($CONF['AllowedTypes']) ?>" />
4989                         </td>
4990                 </tr><tr>
4991                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4992                         <td>
4993                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  Entity::hsc($CONF['MaxUploadSize']) ?>" />
4994                         </td>
4995                 </tr><tr>
4996                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4997                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4998
4999                 </tr><tr>
5000                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
5001                 </tr><tr>
5002                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
5003                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
5004                 </tr><tr>
5005                         <td><?php echo _SETTINGS_ALLOWCREATE?>
5006                                 <?php help('allowaccountcreation'); ?>
5007                         </td>
5008                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
5009                         </td>
5010                 </tr><tr>
5011                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
5012                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
5013                         </td>
5014                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
5015                         </td>
5016                 </tr><tr>
5017                         <td><?php echo _SETTINGS_MEMBERMSGS?>
5018                                 <?php help('messageservice'); ?>
5019                         </td>
5020                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
5021                         </td>
5022                 </tr><tr>
5023                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
5024                                 <?php help('messageservice'); ?>
5025                         </td>
5026                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5027                         </td>
5028                 </tr><tr>
5029                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5030                                 <?php help('protectmemnames'); ?>
5031                         </td>
5032                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5033                         </td>
5034
5035
5036
5037                 </tr><tr>
5038                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5039                 </tr><tr>
5040                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5041                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  Entity::hsc($CONF['CookiePrefix'])?>" /></td>
5042                 </tr><tr>
5043                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5044                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  Entity::hsc($CONF['CookieDomain'])?>" /></td>
5045                 </tr><tr>
5046                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
5047                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  Entity::hsc($CONF['CookiePath'])?>" /></td>
5048                 </tr><tr>
5049                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
5050                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5051                 </tr><tr>
5052                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
5053                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5054                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5055                         </td>
5056                 </tr><tr>
5057                         <td><?php echo _SETTINGS_LASTVISIT?></td>
5058                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5059
5060
5061
5062                 </tr><tr>
5063                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5064                 </tr><tr>
5065                         <td><?php echo _SETTINGS_UPDATE?></td>
5066                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5067                 </tr></table>
5068
5069                 </div>
5070                 </form>
5071
5072                 <?php
5073                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5074
5075                         $manager->notify(
5076                                 'GeneralSettingsFormExtras',
5077                                 array()
5078                         );
5079
5080                 $this->pagefoot();
5081         }
5082
5083         /**
5084          * Admin::action_settingsupdate()
5085          * Update $CONFIG and redirect
5086          *
5087          * @param       void
5088          * @return      void
5089          */
5090         function action_settingsupdate() {
5091                 global $member, $CONF;
5092
5093                 $member->isAdmin() or $this->disallow();
5094
5095                 // check if email address for admin is valid
5096                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5097                 {
5098                         $this->error(_ERROR_BADMAILADDRESS);
5099                 }
5100
5101                 // save settings
5102                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5103                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5104                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5105                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5106                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5107                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5108                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5109                 $this->updateConfig('Locale',              postVar('Locale'));
5110                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5111                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5112                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5113                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5114                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5115                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5116                 $this->updateConfig('SiteName',          postVar('SiteName'));
5117                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5118                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5119                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5120                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5121                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5122                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5123                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5124                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5125                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5126                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5127                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5128                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5129                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5130                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5131                 $this->updateConfig('URLMode',            postVar('URLMode'));
5132                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5133                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5134                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5135                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5136
5137                 // load new config and redirect (this way, the new locale will be used is necessary)
5138                 // note that when changing cookie settings, this redirect might cause the user
5139                 // to have to log in again.
5140                 getConfig();
5141                 redirect($CONF['AdminURL'] . '?action=manage');
5142                 exit;
5143         }
5144
5145         /**
5146          * Admin::action_systemoverview()
5147          * Output system overview
5148          *
5149          * @param       void
5150          * @return      void
5151          */
5152         function action_systemoverview()
5153         {
5154                 global $member, $nucleus, $CONF;
5155
5156                 $this->pagehead();
5157
5158                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5159
5160                 if ( $member->isLoggedIn() && $member->isAdmin() )
5161                 {
5162                         // Information about the used PHP and MySQL installation
5163                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5164
5165                         // Version of PHP MySQL
5166                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5167                         echo "<thead>\n";
5168                         echo "<tr>\n";
5169                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5170                         echo "</tr>\n";
5171                         echo "</thead>\n";
5172                         echo "<tbody>\n";
5173                         echo "<tr>\n";
5174                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5175                         echo '<td>' . phpversion() . "</td>\n";
5176                         echo "</tr>\n";
5177                         echo "<tr>\n";
5178                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5179                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5180                         echo "</tr>\n";
5181                         echo "</tbody>\n";
5182                         echo "</table>\n\n";
5183
5184                         // Important PHP settings
5185                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5186                         echo "<thead>\n";
5187                         echo "<tr>\n";
5188                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5189                         echo "</tr>\n";
5190                         echo "</thead>\n";
5191                         echo "<tbody>\n";
5192                         echo "<tr>\n";
5193                         echo '<td>magic_quotes_gpc' . "</td>\n";
5194                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5195                         echo '<td>' . $mqg . "</td>\n";
5196                         echo "</tr>\n";
5197                         echo "<tr>\n";
5198                         echo '<td>magic_quotes_runtime' . "</td>\n";
5199                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5200                         echo '<td>' . $mqr . "</td>\n";
5201                         echo "</tr>\n";
5202                         echo "<tr>\n";
5203                         echo '<td>register_globals' . "</td>\n";
5204                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5205                         echo '<td>' . $rg . "</td>\n";
5206                         echo "</tr>\n";
5207                         echo "</tbody>\n";
5208                         echo "</table>\n\n";
5209
5210                         // Information about GD library
5211                         $gdinfo = gd_info();
5212                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5213                         echo "<thead>\n";
5214                         echo "<tr>\n";
5215                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5216                         echo "</tr>\n";
5217                         echo "</thead>\n";
5218                         echo "<tbody>\n";
5219                         foreach ( $gdinfo as $key=>$value )
5220                         {
5221                                 if ( is_bool($value) )
5222                                 {
5223                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5224                                 }
5225                                 else
5226                                 {
5227                                         $value = Entity::hsc($value);
5228                                 }
5229                                 echo "<tr>\n";
5230                                 echo '<td>' . $key . "</td>\n";
5231                                 echo '<td>' . $value . "</td>\n";
5232                                 echo "</tr>\n";
5233                         }
5234                         echo "</tbody>\n";
5235                         echo "</table>\n\n";
5236
5237                         // Check if special modules are loaded
5238                         ob_start();
5239                         phpinfo(INFO_MODULES);
5240                         $im = ob_get_contents();
5241                         ob_clean();
5242                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5243                         echo "<thead>\n";
5244                         echo "<tr>";
5245                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5246                         echo "</tr>\n";
5247                         echo "<tbody>\n";
5248                         echo "<tr>\n";
5249                         echo '<td>mod_rewrite' . "</td>\n";
5250                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5251                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5252                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5253                         echo '<td>' . $modrewrite . "</td>\n";
5254                         echo "</tr>\n";
5255                         echo "</tbody>\n";
5256                         echo "</table>\n\n";
5257
5258                         // Information about the used Nucleus CMS
5259                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5260                         global $nucleus;
5261                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5262                         $np = getNucleusPatchLevel();
5263                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5264                         echo "<thead>\n";
5265                         echo "<tr>\n";
5266                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5267                         echo "</tr>\n";
5268                         echo "</thead>\n";
5269                         echo "<tbody>\n";
5270                         echo "<tr>\n";
5271                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5272                         echo '<td>' . $nv . "</td>\n";
5273                         echo "</tr>\n";
5274                         echo "<tr>\n";
5275                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5276                         echo '<td>' . $np . "</td>\n";
5277                         echo "</tr>\n";
5278                         echo "</tbody>\n";
5279                         echo "</table>\n\n";
5280
5281                         // Important settings of the installation
5282                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5283                         echo "<thead>\n";
5284                         echo "<tr>\n";
5285                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5286                         echo "</tr>\n";
5287                         echo "</thead>\n";
5288                         echo "<tbody>\n";
5289                         echo "<tr>\n";
5290                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5291                         echo '<td>' . $CONF['Self'] . "</td>\n";
5292                         echo "</tr>\n";
5293                         echo "<tr>\n";
5294                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5295                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5296                         echo "</tr>\n";
5297                         echo "<tr>\n";
5298                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5299                         $ohs = $CONF['alertOnHeadersSent'] ?
5300                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5301                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5302                         echo '<td>' . $ohs . "</td>\n";
5303                         echo "</tr>\n";
5304                         echo "<tr>\n";
5305                         echo "<td>i18n::get_current_charset()</td>\n";
5306                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5307                         echo "</tr>\n";
5308                         echo "</tbody>\n";
5309                         echo "</table>\n\n";
5310
5311                         // Link to the online version test at the Nucleus CMS website
5312                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5313                         if ( $nucleus['codename'] != '')
5314                         {
5315                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5316                         }
5317                         else
5318                         {
5319                                 $codenamestring = '';
5320                         }
5321                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5322                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5323                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5324                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5325                         echo '</a>';
5326                 }
5327                 else
5328                 {
5329                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5330                 }
5331                 $this->pagefoot();
5332         }
5333
5334         /**
5335          * Admin::updateConfig()
5336          *
5337          * @param       string  $name
5338          * @param       string  $val
5339          * @return      integer return the ID in which the latest query posted
5340          */
5341         function updateConfig($name, $val)
5342         {
5343                 $name = sql_real_escape_string($name);
5344                 $val = trim(sql_real_escape_string($val));
5345
5346                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5347                 $query = sprintf($query, sql_table('config'), $val, $name);
5348                 sql_query($query) or die("Query error: " . sql_error());
5349                 return sql_insert_id();
5350         }
5351
5352         /**
5353          * Error message
5354          * @param string $msg message that will be shown
5355          */
5356         function error($msg)
5357         {
5358                 $this->pagehead();
5359
5360                 echo "<h2>Error!</h2>\n";
5361                 echo $msg;
5362                 echo "<br />\n";
5363                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5364                 $this->pagefoot();
5365                 exit;
5366         }
5367
5368         /**
5369          * Admin::disallow()
5370          * add error log and show error page
5371          *
5372          * @param       void
5373          * @return      void
5374          */
5375         function disallow()
5376         {
5377                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5378                 $this->error(_ERROR_DISALLOWED);
5379         }
5380
5381         /**
5382          * Admin::pagehead()
5383          * Output admin page head
5384          *
5385          * @param       void
5386          * @return      void
5387          */
5388         function pagehead($extrahead = '')
5389         {
5390                 global $member, $nucleus, $CONF, $manager;
5391
5392                 $manager->notify(
5393                         'AdminPrePageHead',
5394                         array(
5395                                 'extrahead' => &$extrahead,
5396                                 'action' => $this->action));
5397
5398                 $baseUrl = Entity::hsc($CONF['AdminURL']);
5399                 if ( !array_key_exists('AdminCSS',$CONF) )
5400                 {
5401                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5402                         $CONF['AdminCSS'] = 'original';
5403                 }
5404
5405                 /* HTTP 1.1 application for no caching */
5406                 header("Cache-Control: no-cache, must-revalidate");
5407                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5408
5409                 $root_element = 'html';
5410                 $charset = i18n::get_current_charset();
5411                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5412
5413                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5414                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5415                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5416                 echo "<head>\n";
5417                 echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";
5418                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5419                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5420                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5421                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5422                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5423                 echo "{$extrahead}\n";
5424                 echo "</head>\n\n";
5425                 echo "<body>\n";
5426                 echo "<div id=\"adminwrapper\">\n";
5427                 echo "<div class=\"header\">\n";
5428                 echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";
5429                 echo "</div>\n";
5430                 echo "<div id=\"container\">\n";
5431                 echo "<div id=\"content\">\n";
5432                 echo "<div class=\"loginname\">\n";
5433                 if ( $member->isLoggedIn() )
5434                 {
5435                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5436                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5437                 }
5438                 else
5439                 {
5440                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5441                 }
5442                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5443                 echo '(';
5444
5445                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5446                 {
5447                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5448                 }
5449                 else
5450                 {
5451                         $codenamestring = '';
5452                 }
5453
5454                 if ( $member->isLoggedIn() && $member->isAdmin() )
5455                 {
5456                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5457                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5458
5459                         $newestVersion = getLatestVersion();
5460                         $newestCompare = str_replace('/','.',$newestVersion);
5461                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5462                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5463                         {
5464                                 echo "<br />\n";
5465                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5466                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5467                                 echo "</a>";
5468                         }
5469                 }
5470                 else
5471                 {
5472                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5473                 }
5474                 echo ')';
5475                 echo '</div>';
5476                 return;
5477         }
5478
5479         /**
5480          * Admin::pagefoot()
5481          * Output admin page foot include quickmenu
5482          *
5483          * @param       void
5484          * @return      void
5485          */
5486         function pagefoot()
5487         {
5488                 global $action, $member, $manager;
5489
5490                 $manager->notify(
5491                         'AdminPrePageFoot',
5492                         array('action' => $this->action)
5493                 );
5494
5495                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5496                 {
5497                         echo '<h2>' . _LOGOUT . "</h2>\n";
5498                         echo "<ul>\n";
5499                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5500                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5501                         echo "</ul>\n";
5502                 }
5503
5504                 echo "<div class=\"foot\">\n";
5505                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5506                 echo '-';
5507                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5508                 echo "</div>\n";
5509
5510                 echo "<!-- content -->\n";
5511                 echo "<div id=\"quickmenu\">\n";
5512
5513                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5514                 {
5515                         echo "<ul>\n";
5516                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5517                         echo "</ul>\n";
5518
5519                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5520                         echo "<form method=\"get\" action=\"index.php\">\n";
5521                         echo "<p>\n";
5522                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5523
5524                         $showAll = requestVar('showall');
5525
5526                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5527                         {
5528                                 // Super-Admins have access to all blogs! (no add item support though)
5529                                 $query =  'SELECT bnumber as value, bname as text'
5530                                                 . ' FROM ' . sql_table('blog')
5531                                                 . ' ORDER BY bname';
5532                         }
5533                         else
5534                         {
5535                                 $query =  'SELECT bnumber as value, bname as text'
5536                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5537                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5538                                                 . ' ORDER BY bname';
5539                         }
5540                         $template['name'] = 'blogid';
5541                         $template['tabindex'] = 15000;
5542                         $template['extra'] = _QMENU_ADD_SELECT;
5543                         $template['selected'] = -1;
5544                         $template['shorten'] = 10;
5545                         $template['shortenel'] = '';
5546                         $template['javascript'] = 'onchange="return form.submit()"';
5547                         showlist($query,'select',$template);
5548
5549                         echo "</p>\n";
5550                         echo "</form>\n";
5551
5552                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5553                         echo "<ul>\n";
5554                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5555                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5556                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5557                         echo "</ul>\n";
5558
5559                         // ---- general settings ----
5560                         if ( $member->isAdmin() )
5561                         {
5562                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5563                                 echo "<ul>\n";
5564                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5565                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5566                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5567                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5568                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5569                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5570                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5571                                 echo "</ul>\n";
5572
5573                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5574                                 echo "<ul>\n";
5575                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5576                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5577                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5578                                 echo "</ul>\n";
5579                         }
5580
5581                         $aPluginExtras = array();
5582                         $manager->notify(
5583                                 'QuickMenu',
5584                                 array(
5585                                         'options' => &$aPluginExtras));
5586
5587                         if ( count($aPluginExtras) > 0 )
5588                         {
5589                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5590                                 echo "<ul>\n";
5591                                 foreach ( $aPluginExtras as $aInfo )
5592                                 {
5593                                         echo '<li><a href="' . Entity::hsc($aInfo['url']) . '" title="' . Entity::hsc($aInfo['tooltip']) . '">' . Entity::hsc($aInfo['title']) . "</a></li>\n";
5594                                 }
5595                                 echo "</ul>\n";
5596                         }
5597                 }
5598                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5599                 {
5600
5601                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5602                 }
5603                 else
5604                 {
5605                         // introduction text on login screen
5606                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5607                 }
5608
5609                 echo "<!-- quickmenu -->\n";
5610                 echo "</div>\n";
5611
5612                 echo "<!-- content -->\n";
5613                 echo "</div>\n";
5614
5615                 echo "<!-- container -->\n";
5616                 echo "</div>\n";
5617
5618                 echo "<!-- adminwrapper -->\n";
5619                 echo "</div>\n";
5620
5621                 echo "</body>\n";
5622                 echo "</html>\n";
5623                 return;
5624         }
5625
5626     /**
5627      * @todo document this
5628      */
5629     function action_regfile() {
5630         global $member, $CONF;
5631
5632         $blogid = intRequestVar('blogid');
5633
5634         $member->teamRights($blogid) or $this->disallow();
5635
5636         // header-code stolen from phpMyAdmin
5637         // REGEDIT and bookmarklet code stolen from GreyMatter
5638
5639         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5640
5641
5642         header('Content-Type: application/octetstream');
5643         header('Content-Disposition: filename="nucleus.reg"');
5644         header('Pragma: no-cache');
5645         header('Expires: 0');
5646
5647         echo "REGEDIT4\n";
5648         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5649         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5650         echo '"contexts"=hex:31';
5651     }
5652
5653     /**
5654      * @todo document this
5655      */
5656     function action_bookmarklet() {
5657         global $member, $manager;
5658
5659         $blogid = intRequestVar('blogid');
5660
5661         $member->teamRights($blogid) or $this->disallow();
5662
5663         $blog =& $manager->getBlog($blogid);
5664         $bm = getBookmarklet($blogid);
5665
5666         $this->pagehead();
5667
5668         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5669
5670         ?>
5671
5672         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5673
5674         <p>
5675         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5676         </p>
5677
5678         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5679         <p>
5680             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5681             <br />
5682             <br />
5683             <?php echo '<a href="' . Entity::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, Entity::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5684         </p>
5685
5686         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5687         <p>
5688             <?php
5689                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5690                 $url = $manager->addTicketToUrl($url);
5691             ?>
5692             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . Entity::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5693         </p>
5694
5695         <p>
5696             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5697         </p>
5698
5699         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5700         <p>
5701             <?php echo _BOOKMARKLET_DELETEBAR ?>
5702         </p>
5703
5704         <p>
5705             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5706         </p>
5707
5708         <ol>
5709             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5710             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5711             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5712             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5713             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5714         </ol>
5715
5716         <?php
5717         $this->pagefoot();
5718
5719     }
5720
5721     /**
5722      * @todo document this
5723      */
5724     function action_actionlog() {
5725         global $member, $manager;
5726
5727         $member->isAdmin() or $this->disallow();
5728
5729         $this->pagehead();
5730
5731         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5732
5733         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5734
5735         ?>
5736             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5737             <p><a href="<?php echo Entity::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5738         <?php
5739         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5740
5741         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5742         $template['content'] = 'actionlist';
5743         $amount = showlist($query,'table',$template);
5744
5745         $this->pagefoot();
5746
5747     }
5748
5749     /**
5750      * @todo document this
5751      */
5752     function action_banlist() {
5753         global $member, $manager;
5754
5755         $blogid = intRequestVar('blogid');
5756
5757         $member->blogAdminRights($blogid) or $this->disallow();
5758
5759         $blog =& $manager->getBlog($blogid);
5760
5761         $this->pagehead();
5762
5763         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5764
5765         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5766
5767         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5768         $template['content'] = 'banlist';
5769         $amount = showlist($query,'table',$template);
5770
5771         if ($amount == 0)
5772             echo _BAN_NONE;
5773
5774         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5775         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5776
5777
5778         $this->pagefoot();
5779
5780     }
5781
5782     /**
5783      * @todo document this
5784      */
5785     function action_banlistdelete() {
5786         global $member, $manager;
5787
5788         $blogid = intRequestVar('blogid');
5789         $iprange = requestVar('iprange');
5790
5791         $member->blogAdminRights($blogid) or $this->disallow();
5792
5793         $blog =& $manager->getBlog($blogid);
5794         $banBlogName =  Entity::hsc($blog->getName());
5795
5796         $this->pagehead();
5797         ?>
5798             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5799
5800             <form method="post" action="index.php">
5801
5802             <h3><?php echo _BAN_IPRANGE?></h3>
5803
5804             <p>
5805                 <?php echo _CONFIRMTXT_BAN?> <?php echo Entity::hsc($iprange) ?>
5806                 <input name="iprange" type="hidden" value="<?php echo Entity::hsc($iprange)?>" />
5807             </p>
5808
5809             <h3><?php echo _BAN_BLOGS?></h3>
5810
5811             <div>
5812                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5813                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5814                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5815                 <br />
5816                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5817             </div>
5818
5819             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5820
5821             <div>
5822                 <?php $manager->addTicketHidden() ?>
5823                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5824                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5825             </div>
5826
5827             </form>
5828         <?php
5829         $this->pagefoot();
5830     }
5831
5832     /**
5833      * @todo document this
5834      */
5835     function action_banlistdeleteconfirm() {
5836         global $member, $manager;
5837
5838         $blogid = intPostVar('blogid');
5839         $allblogs = postVar('allblogs');
5840         $iprange = postVar('iprange');
5841
5842         $member->blogAdminRights($blogid) or $this->disallow();
5843
5844         $deleted = array();
5845
5846         if (!$allblogs) {
5847             if (Ban::removeBan($blogid, $iprange))
5848                 array_push($deleted, $blogid);
5849         } else {
5850             // get blogs fot which member has admin rights
5851             $adminblogs = $member->getAdminBlogs();
5852             foreach ($adminblogs as $blogje) {
5853                 if (Ban::removeBan($blogje, $iprange))
5854                     array_push($deleted, $blogje);
5855             }
5856         }
5857
5858         if (sizeof($deleted) == 0)
5859             $this->error(_ERROR_DELETEBAN);
5860
5861         $this->pagehead();
5862
5863         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5864         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5865         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5866
5867         echo "<ul>";
5868         foreach ($deleted as $delblog) {
5869             $b =& $manager->getBlog($delblog);
5870             echo "<li>" . Entity::hsc($b->getName()). "</li>";
5871         }
5872         echo "</ul>";
5873
5874         $this->pagefoot();
5875
5876     }
5877
5878     /**
5879      * @todo document this
5880      */
5881     function action_banlistnewfromitem() {
5882         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5883     }
5884
5885     /**
5886      * @todo document this
5887      */
5888     function action_banlistnew($blogid = '') {
5889         global $member, $manager;
5890
5891         if ($blogid == '')
5892             $blogid = intRequestVar('blogid');
5893
5894         $ip = requestVar('ip');
5895
5896         $member->blogAdminRights($blogid) or $this->disallow();
5897
5898         $blog =& $manager->getBlog($blogid);
5899
5900         $this->pagehead();
5901         ?>
5902         <h2><?php echo _BAN_ADD_TITLE?></h2>
5903
5904
5905         <form method="post" action="index.php">
5906
5907         <h3><?php echo _BAN_IPRANGE?></h3>
5908
5909         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5910
5911         <div class="note">
5912             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5913             <?php echo _BAN_EXAMPLE_TEXT ?>
5914         </div>
5915
5916         <div>
5917         <?php
5918         if ($ip) {
5919             $iprangeVal = Entity::hsc($ip);
5920         ?>
5921             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5922             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5923             <br />
5924             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5925             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5926             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5927         <?php
5928         } else {
5929             echo "<input name='iprange' value='custom' type='hidden' />";
5930             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5931         }
5932         ?>
5933         </div>
5934
5935         <h3><?php echo _BAN_BLOGS?></h3>
5936
5937         <p><?php echo _BAN_BLOGS_TEXT?></p>
5938
5939         <div>
5940             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5941             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo Entity::hsc($blog->getName())?>'</label>
5942             <br />
5943             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5944         </div>
5945
5946         <h3><?php echo _BAN_REASON_TITLE?></h3>
5947
5948         <p><?php echo _BAN_REASON_TEXT?></p>
5949
5950         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5951
5952         <h3><?php echo _BAN_ADD_TITLE?></h3>
5953
5954         <div>
5955             <input name="action" type="hidden" value="banlistadd" />
5956             <?php $manager->addTicketHidden() ?>
5957             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5958         </div>
5959
5960         </form>
5961
5962         <?php       $this->pagefoot();
5963     }
5964
5965     /**
5966      * @todo document this
5967      */
5968     function action_banlistadd() {
5969         global $member;
5970
5971         $blogid =       intPostVar('blogid');
5972         $allblogs =     postVar('allblogs');
5973         $iprange =      postVar('iprange');
5974         if ($iprange == "custom")
5975             $iprange = postVar('customiprange');
5976         $reason =       postVar('reason');
5977
5978         $member->blogAdminRights($blogid) or $this->disallow();
5979
5980         // TODO: check IP range validity
5981
5982         if (!$allblogs) {
5983             if (!Ban::addBan($blogid, $iprange, $reason))
5984                 $this->error(_ERROR_ADDBAN);
5985         } else {
5986             // get blogs fot which member has admin rights
5987             $adminblogs = $member->getAdminBlogs();
5988             $failed = 0;
5989             foreach ($adminblogs as $blogje) {
5990                 if (!Ban::addBan($blogje, $iprange, $reason))
5991                     $failed = 1;
5992             }
5993             if ($failed)
5994                 $this->error(_ERROR_ADDBAN);
5995         }
5996
5997         $this->action_banlist();
5998
5999     }
6000
6001     /**
6002      * @todo document this
6003      */
6004     function action_clearactionlog() {
6005         global $member;
6006
6007         $member->isAdmin() or $this->disallow();
6008
6009         ActionLog::clear();
6010
6011         $this->action_manage(_MSG_ACTIONLOGCLEARED);
6012     }
6013
6014     /**
6015      * @todo document this
6016      */
6017     function action_backupoverview() {
6018         global $member, $manager;
6019
6020         $member->isAdmin() or $this->disallow();
6021
6022         $this->pagehead();
6023
6024         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6025         ?>
6026         <h2><?php echo _BACKUPS_TITLE?></h2>
6027
6028         <h3><?php echo _BACKUP_TITLE?></h3>
6029
6030         <p><?php echo _BACKUP_INTRO?></p>
6031
6032         <form method="post" action="index.php"><p>
6033         <input type="hidden" name="action" value="backupcreate" />
6034         <?php $manager->addTicketHidden() ?>
6035
6036         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
6037         <br />
6038         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
6039         <br /><br />
6040         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
6041
6042         </p></form>
6043
6044         <div class="note"><?php echo _BACKUP_NOTE?></div>
6045
6046
6047         <h3><?php echo _RESTORE_TITLE?></h3>
6048
6049         <div class="note"><?php echo _RESTORE_NOTE?></div>
6050
6051         <p><?php echo _RESTORE_INTRO?></p>
6052
6053         <form method="post" action="index.php" enctype="multipart/form-data"><p>
6054             <input type="hidden" name="action" value="backuprestore" />
6055             <?php $manager->addTicketHidden() ?>
6056             <input name="backup_file" type="file" tabindex="30" />
6057             <br /><br />
6058             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6059             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6060             <br /><?php echo _RESTORE_WARNING?>
6061         </p></form>
6062
6063         <?php       $this->pagefoot();
6064     }
6065
6066         /**
6067          * Admin::action_backupcreate()
6068          * create file for backup
6069          *
6070          * @param               void
6071          * @return      void
6072          *
6073          */
6074         function action_backupcreate()
6075         {
6076                 global $member, $DIR_LIBS;
6077
6078                 $member->isAdmin() or $this->disallow();
6079
6080                 // use compression ?
6081                 $useGzip = (integer) postVar('gzip');
6082
6083                 include($DIR_LIBS . 'backup.php');
6084
6085                 // try to extend time limit
6086                 // (creating/restoring dumps might take a while)
6087                 @set_time_limit(1200);
6088
6089                 Backup::do_backup($useGzip);
6090                 exit;
6091         }
6092
6093         /**
6094          * Admin::action_backuprestore()
6095          * restoring from uploaded file
6096          *
6097          * @param               void
6098          * @return      void
6099          */
6100         function action_backuprestore()
6101         {
6102                 global $member, $DIR_LIBS;
6103
6104                 $member->isAdmin() or $this->disallow();
6105
6106                 if ( intPostVar('letsgo') != 1 )
6107                 {
6108                         $this->error(_ERROR_BACKUP_NOTSURE);
6109                 }
6110
6111                 include($DIR_LIBS . 'backup.php');
6112
6113                 // try to extend time limit
6114                 // (creating/restoring dumps might take a while)
6115                 @set_time_limit(1200);
6116
6117                 $message = Backup::do_restore();
6118                 if ( $message != '' )
6119                 {
6120                         $this->error($message);
6121                 }
6122                 $this->pagehead();
6123                 echo '<h2>' . _RESTORE_COMPLETE . "</h2>\n";
6124                 $this->pagefoot();
6125                 return;
6126         }
6127
6128         /**
6129          * Admin::action_pluginlist()
6130          * output the list of installed plugins
6131          *
6132          * @param       void
6133          * @return      void
6134          *
6135          */
6136         function action_pluginlist()
6137         {
6138                 global $DIR_PLUGINS, $member, $manager;
6139
6140                 // check if allowed
6141                 $member->isAdmin() or $this->disallow();
6142
6143                 $this->pagehead();
6144
6145                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6146
6147                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6148
6149                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6150
6151                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6152
6153                 $template['content'] = 'pluginlist';
6154                 $template['tabindex'] = 10;
6155                 showlist($query, 'table', $template);
6156
6157                 echo '<h3>' . _PLUGS_TITLE_UPDATE . "</h3>\n";
6158                 echo '<p>' . _PLUGS_TEXT_UPDATE . "</p>\n";
6159                 echo '<form method="post" action="index.php">' . "\n";
6160                 echo "<div>\n";
6161                 echo '<input type="hidden" name="action" value="pluginupdate" />' . "\n";
6162                 $manager->addTicketHidden();
6163                 echo '<input type="submit" value="' . _PLUGS_BTN_UPDATE . '" tabindex="20" />' . "\n";
6164                 echo "</div>\n";
6165                 echo "</form>\n";
6166
6167                 echo '<h3>' . _PLUGS_TITLE_NEW . "</h3>\n";
6168
6169                 // find a list of possibly non-installed plugins
6170                 $candidates = array();
6171                 $dirhandle = opendir($DIR_PLUGINS);
6172
6173                 while ( $filename = readdir($dirhandle) )
6174                 {
6175                         if ( preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6176                         {
6177                                 $name = $matches[1];
6178
6179                                 // only show in list when not yet installed
6180                                 $query = 'SELECT * FROM %s WHERE pfile = "NP_%s"';
6181                                 $query = sprintf($query, sql_table('plugin'), sql_real_escape_string($name));
6182                                 $res = sql_query($query);
6183
6184                                 if ( sql_num_rows($res) == 0 )
6185                                 {
6186                                         array_push($candidates, $name);
6187                                 }
6188                         }
6189                 }
6190
6191                 closedir($dirhandle);
6192
6193                 if ( sizeof($candidates) > 0 )
6194                 {
6195                         echo '<p>' . _PLUGS_ADD_TEXT . "</p>\n";
6196
6197                         echo '<form method="post" action="index.php">' . "\n";
6198                         echo "<div>\n";
6199                         echo '<input type="hidden" name="action" value="pluginadd" />' . "\n";
6200                         $manager->addTicketHidden();
6201                         echo '<select name="filename" tabindex="30">' . "\n";
6202
6203                         foreach ( $candidates as $name )
6204                         {
6205                                 echo '<option value="NP_',$name,'">',Entity::hsc($name),'</option>';
6206                         }
6207
6208                         echo "</select>\n";
6209                         echo '<input type="submit" tabindex="40" value="' . _PLUGS_BTN_INSTALL ."\" />\n";
6210                         echo "</div>\n";
6211                         echo "</form>\n";
6212                 }
6213                 else
6214                 {
6215                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6216                 }
6217
6218                 $this->pagefoot();
6219                 return;
6220         }
6221
6222     /**
6223      * @todo document this
6224      */
6225     function action_pluginhelp() {
6226         global $member, $manager, $DIR_PLUGINS, $CONF;
6227
6228         // check if allowed
6229         $member->isAdmin() or $this->disallow();
6230
6231         $plugid = intGetVar('plugid');
6232
6233         if (!$manager->pidInstalled($plugid))
6234             $this->error(_ERROR_NOSUCHPLUGIN);
6235
6236         $plugName = getPluginNameFromPid($plugid);
6237
6238         $this->pagehead();
6239
6240         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6241
6242         echo '<h2>',_PLUGS_HELP_TITLE,': ',Entity::hsc($plugName),'</h2>';
6243
6244         $plug =& $manager->getPlugin($plugName);
6245         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6246
6247         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6248             @readfile($helpFile);
6249         } else {
6250             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6251             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6252         }
6253
6254
6255         $this->pagefoot();
6256     }
6257
6258         /**
6259          * Admin::action_pluginadd()
6260          *
6261          * @param       Void
6262          * @return      Void
6263          *
6264          */
6265         function action_pluginadd()
6266         {
6267                 global $member, $manager, $DIR_PLUGINS;
6268
6269                 // check if allowed
6270                 $member->isAdmin() or $this->disallow();
6271
6272                 $name = postVar('filename');
6273
6274                 if ( $manager->pluginInstalled($name) )
6275                 {
6276                         $this->error(_ERROR_DUPPLUGIN);
6277                 }
6278
6279                 if ( !checkPlugin($name) )
6280                 {
6281                         $this->error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
6282                 }
6283
6284                 // get number of currently installed plugins
6285                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6286                 $numCurrent = sql_num_rows($res);
6287
6288                 // plugin will be added as last one in the list
6289                 $newOrder = $numCurrent + 1;
6290
6291                 $manager->notify(
6292                         'PreAddPlugin',
6293                         array(
6294                                 'file' => &$name
6295                         )
6296                 );
6297
6298                 // do this before calling getPlugin (in case the plugin id is used there)
6299                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6300                 sql_query($query);
6301                 $iPid = sql_insert_id();
6302
6303                 $manager->clearCachedInfo('installedPlugins');
6304
6305                 // Load the plugin for condition checking and instalation
6306                 $plugin =& $manager->getPlugin($name);
6307
6308                 // check if it got loaded (could have failed)
6309                 if ( !$plugin )
6310                 {
6311                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6312                         $manager->clearCachedInfo('installedPlugins');
6313                         $this->error(_ERROR_PLUGIN_LOAD);
6314                 }
6315
6316                 // check if plugin needs a newer Nucleus version
6317                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
6318                 {
6319                         // uninstall plugin again...
6320                         $this->deleteOnePlugin($plugin->getID());
6321
6322                         // ...and show error
6323                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
6324                 }
6325
6326                 // check if plugin needs a newer Nucleus version
6327                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
6328                 {
6329                         // uninstall plugin again...
6330                         $this->deleteOnePlugin($plugin->getID());
6331
6332                         // ...and show error
6333                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6334                 }
6335
6336                 $pluginList = $plugin->getPluginDep();
6337                 foreach ( $pluginList as $pluginName )
6338                 {
6339                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6340                         if (sql_num_rows($res) == 0)
6341                         {
6342                                 // uninstall plugin again...
6343                                 $this->deleteOnePlugin($plugin->getID());
6344                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
6345                         }
6346                 }
6347
6348                 // call the install method of the plugin
6349                 $plugin->install();
6350
6351                 $manager->notify(
6352                         'PostAddPlugin',
6353                         array(
6354                                 'plugin' => &$plugin
6355                         )
6356                 );
6357
6358                 // update all events
6359                 $this->action_pluginupdate();
6360                 return;
6361         }
6362
6363         /**
6364          * ADMIN:action_pluginupdate():
6365          *
6366          * @param       Void
6367          * @return      Void
6368          *
6369          */
6370         function action_pluginupdate()
6371         {
6372                 global $member, $manager, $CONF;
6373
6374                 // check if allowed
6375                 $member->isAdmin() or $this->disallow();
6376
6377                 // delete everything from plugin_events
6378                 sql_query('DELETE FROM '.sql_table('plugin_event'));
6379
6380                 // loop over all installed plugins
6381                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6382                 while ( $o = sql_fetch_object($res) )
6383                 {
6384                         $pid = $o->pid;
6385                         $plug =& $manager->getPlugin($o->pfile);
6386                         if ( $plug )
6387                         {
6388                                 $eventList = $plug->getEventList();
6389                                 foreach ( $eventList as $eventName )
6390                                 {
6391                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";
6392                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));
6393                                         sql_query($query);
6394                                 }
6395                         }
6396                 }
6397                 redirect($CONF['AdminURL'] . '?action=pluginlist');
6398                 return;
6399         }
6400
6401     /**
6402      * @todo document this
6403      */
6404     function action_plugindelete() {
6405         global $member, $manager;
6406
6407         // check if allowed
6408         $member->isAdmin() or $this->disallow();
6409
6410         $pid = intGetVar('plugid');
6411
6412         if (!$manager->pidInstalled($pid))
6413             $this->error(_ERROR_NOSUCHPLUGIN);
6414
6415         $this->pagehead();
6416         ?>
6417             <h2><?php echo _DELETE_CONFIRM?></h2>
6418
6419             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6420
6421             <form method="post" action="index.php"><div>
6422             <?php $manager->addTicketHidden() ?>
6423             <input type="hidden" name="action" value="plugindeleteconfirm" />
6424             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6425             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6426             </div></form>
6427         <?php
6428         $this->pagefoot();
6429     }
6430
6431     /**
6432      * @todo document this
6433      */
6434     function action_plugindeleteconfirm() {
6435         global $member, $manager, $CONF;
6436
6437         // check if allowed
6438         $member->isAdmin() or $this->disallow();
6439
6440         $pid = intPostVar('plugid');
6441
6442         $error = $this->deleteOnePlugin($pid, 1);
6443         if ($error) {
6444             $this->error($error);
6445         }
6446
6447         redirect($CONF['AdminURL'] . '?action=pluginlist');
6448 //              $this->action_pluginlist();
6449     }
6450
6451     /**
6452      * @todo document this
6453      */
6454     function deleteOnePlugin($pid, $callUninstall = 0) {
6455         global $manager;
6456
6457         $pid = intval($pid);
6458
6459         if (!$manager->pidInstalled($pid))
6460             return _ERROR_NOSUCHPLUGIN;
6461
6462         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6463
6464 /*              // call the unInstall method of the plugin
6465         if ($callUninstall) {
6466             $plugin =& $manager->getPlugin($name);
6467             if ($plugin) $plugin->unInstall();
6468         }*/
6469
6470         // check dependency before delete
6471         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6472         while($o = sql_fetch_object($res)) {
6473             $plug =& $manager->getPlugin($o->pfile);
6474             if ($plug)
6475             {
6476                 $depList = $plug->getPluginDep();
6477                 foreach ($depList as $depName)
6478                 {
6479                     if ($name == $depName)
6480                     {
6481                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6482                     }
6483                 }
6484             }
6485         }
6486
6487         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6488
6489         // call the unInstall method of the plugin
6490         if ($callUninstall) {
6491             $plugin =& $manager->getPlugin($name);
6492             if ($plugin) $plugin->unInstall();
6493         }
6494
6495         // delete all subscriptions
6496         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6497
6498         // delete all options
6499         // get OIDs from plugin_option_desc
6500         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6501         $aOIDs = array();
6502         while ($o = sql_fetch_object($res)) {
6503             array_push($aOIDs, $o->oid);
6504         }
6505
6506         // delete from plugin_option and plugin_option_desc
6507         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6508         if (count($aOIDs) > 0)
6509             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6510
6511         // update order numbers
6512         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6513         $o = sql_fetch_object($res);
6514         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6515
6516         // delete row
6517         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6518
6519         $manager->clearCachedInfo('installedPlugins');
6520         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6521
6522         return '';
6523     }
6524
6525     /**
6526      * @todo document this
6527      */
6528     function action_pluginup() {
6529         global $member, $manager, $CONF;
6530
6531         // check if allowed
6532         $member->isAdmin() or $this->disallow();
6533
6534         $plugid = intGetVar('plugid');
6535
6536         if (!$manager->pidInstalled($plugid))
6537             $this->error(_ERROR_NOSUCHPLUGIN);
6538
6539         // 1. get old order number
6540         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6541         $o = sql_fetch_object($res);
6542         $oldOrder = $o->porder;
6543
6544         // 2. calculate new order number
6545         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6546
6547         // 3. update plug numbers
6548         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6549         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6550
6551         //$this->action_pluginlist();
6552         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6553         redirect($CONF['AdminURL'] . '?action=pluginlist');
6554     }
6555
6556     /**
6557      * @todo document this
6558      */
6559     function action_plugindown() {
6560         global $member, $manager, $CONF;
6561
6562         // check if allowed
6563         $member->isAdmin() or $this->disallow();
6564
6565         $plugid = intGetVar('plugid');
6566         if (!$manager->pidInstalled($plugid))
6567             $this->error(_ERROR_NOSUCHPLUGIN);
6568
6569         // 1. get old order number
6570         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6571         $o = sql_fetch_object($res);
6572         $oldOrder = $o->porder;
6573
6574         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6575         $maxOrder = sql_num_rows($res);
6576
6577         // 2. calculate new order number
6578         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6579
6580         // 3. update plug numbers
6581         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6582         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6583
6584         //$this->action_pluginlist();
6585         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6586         redirect($CONF['AdminURL'] . '?action=pluginlist');
6587     }
6588
6589         /**
6590          * Admin::action_pluginoptions()
6591          *
6592          * Output Plugin option page
6593          *
6594          * @access      public
6595          * @param       string $message message when fallbacked
6596          * @return      void
6597          *
6598          */
6599         public function action_pluginoptions($message = '')
6600         {
6601                 global $member, $manager;
6602
6603                 // check if allowed
6604                 $member->isAdmin() or $this->disallow();
6605
6606                 $pid = (integer) requestVar('plugid');
6607                 if ( !$manager->pidInstalled($pid) )
6608                 {
6609                         $this->error(_ERROR_NOSUCHPLUGIN);
6610                 }
6611
6612                 $pname = getPluginNameFromPid($pid);
6613
6614                 /* just for including translation */
6615                 $manager->getPlugin($pname);
6616
6617                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6618                 $this->pagehead($extrahead);
6619                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6620                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($pname)) . "</h2>\n";
6621
6622                 if ( isset($message) )
6623                 {
6624                         echo $message;
6625                 }
6626
6627                 echo "<form action=\"index.php\" method=\"post\">\n";
6628                 echo "<div>\n";
6629                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6630                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6631                 $manager->addTicketHidden();
6632
6633                 $aOptions = array();
6634                 $aOIDs = array();
6635                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6636                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6637                 $result = sql_query($query);
6638                 while ( $object = sql_fetch_object($result) )
6639                 {
6640                         array_push($aOIDs, $object->oid);
6641                         $aOptions[$object->oid] = array(
6642                                                 'oid' => $object->oid,
6643                                                 'value' => $object->odef,
6644                                                 'name' => $object->oname,
6645                                                 'description' => $object->odesc,
6646                                                 'type' => $object->otype,
6647                                                 'typeinfo' => $object->oextra,
6648                                                 'contextid' => 0
6649                         );
6650                 }
6651                 // fill out actual values
6652                 if ( count($aOIDs) > 0 )
6653                 {
6654                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6655                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6656                         $result = sql_query($query);
6657                         while ( $object = sql_fetch_object($result) )
6658                         {
6659                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6660                         }
6661                 }
6662
6663                 // call plugins
6664                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6665                 $manager->notify('PrePluginOptionsEdit',$data);
6666
6667                 $template['content'] = 'plugoptionlist';
6668                 $amount = showlist($aOptions,'table',$template);
6669                 if ( $amount == 0 )
6670                 {
6671                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6672                 }
6673                 echo "</div>\n";
6674                 echo "</form>\n";
6675                 $this->pagefoot();
6676
6677                 return;
6678         }
6679
6680         /**
6681          * Admin::action_pluginoptionsupdate()
6682          *
6683          * Update plugin options and fallback to plugin option page
6684          *
6685          * @access      public
6686          * @param       void
6687          * @return      void
6688          */
6689         public function action_pluginoptionsupdate()
6690         {
6691                 global $member, $manager;
6692
6693                 // check if allowed
6694                 $member->isAdmin() or $this->disallow();
6695
6696                 $pid = (integer) requestVar('plugid');
6697                 if ( !$manager->pidInstalled($pid) )
6698                 {
6699                         $this->error(_ERROR_NOSUCHPLUGIN);
6700                 }
6701
6702                 $aOptions = requestArray('plugoption');
6703                 NucleusPlugin::apply_plugin_options($aOptions);
6704
6705                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6706
6707                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6708                 return;
6709         }
6710
6711         /**
6712          * Admin::_insertPluginOptions()
6713          *
6714          * Output plugin option field
6715          *
6716          * @access      public
6717          * @param string        $context        plugin option context
6718          * @param integer       $contextid      plugin option context id
6719          * @return      void
6720          */
6721         public function _insertPluginOptions($context, $contextid = 0)
6722         {
6723                 // get all current values for this contextid
6724                 // (note: this might contain doubles for overlapping contextids)
6725                 $aIdToValue = array();
6726                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6727                 while ( $object = sql_fetch_object($res) )
6728                 {
6729                         $aIdToValue[$object->oid] = $object->ovalue;
6730                 }
6731
6732                 // get list of oids per pid
6733                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6734                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6735                 $res = sql_query($query);
6736                 $aOptions = array();
6737                 while ( $object = sql_fetch_object($res) )
6738                 {
6739                         if (in_array($object->oid, array_keys($aIdToValue)))
6740                         {
6741                                 $value = $aIdToValue[$object->oid];
6742                         }
6743                         else
6744                         {
6745                                 $value = $object->odef;
6746                         }
6747
6748                         array_push($aOptions, array(
6749                                 'pid' => $object->pid,
6750                                 'pfile' => $object->pfile,
6751                                 'oid' => $object->oid,
6752                                 'value' => $value,
6753                                 'name' => $object->oname,
6754                                 'description' => $object->odesc,
6755                                 'type' => $object->otype,
6756                                 'typeinfo' => $object->oextra,
6757                                 'contextid' => $contextid,
6758                                 'extra' => ''));
6759                 }
6760
6761                 global $manager;
6762                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6763
6764                 $iPrevPid = -1;
6765                 foreach ($aOptions as $aOption)
6766                 {
6767                         // new plugin?
6768                         if ( $iPrevPid != $aOption['pid'] )
6769                         {
6770                                 $iPrevPid = $aOption['pid'];
6771                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6772                                 {
6773                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6774                                 }
6775                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($aOption['pfile'])).'</th></tr>';
6776                         }
6777
6778                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6779                         if ( @$meta['access'] != 'hidden' )
6780                         {
6781                                 echo '<tr>';
6782                                 listplug_plugOptionRow($aOption);
6783                                 echo '</tr>';
6784                         }
6785                 }
6786                 return;
6787         }
6788
6789         /**
6790          * Admin::input_yesno()
6791          * Output input elements with radio attribute for yes/no options
6792          *
6793          * @param       string  $name   name attribute
6794          * @param       string  $value_current  current value attribute
6795          * @param       integer $tabindex       tab index
6796          * @param       string  $value_yes      value attribute for yes option
6797          * @param       string  $value_no       value attribute for no option
6798          * @param       string  $text_yes       child text element for yes option
6799          * @param       string  $text_no        child text element for no option
6800          * @param       boolean $isAdmin        have admin right or not
6801          * @return      void
6802          */
6803         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6804         {
6805                 $id = preg_replace('#\[|\]#', '-', $name);
6806                 $id_yes = $id . $value_yes;
6807                 $id_no  = $id . $value_no;
6808
6809                 /* yes option */
6810                 echo '<input type="radio" id="' . Entity::hsc($id_yes) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_yes) . '"';
6811                 if ( $name=="admin" )
6812                 {
6813                         echo ' onclick="selectCanLogin(true);"';
6814                 }
6815                 if ( $value_current == $value_yes )
6816                 {
6817                         echo " tabindex='$tabindex' checked='checked'";
6818                 }
6819                 echo " />\n";
6820                 echo '<label for="' . Entity::hsc($id_yes) . '">' . Entity::hsc($text_yes) . "</label>\n";
6821
6822                 /* no option */
6823                 echo '<input type="radio" id="' . Entity::hsc($id_no) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_no) . '"';
6824                 if ( $name=="admin" )
6825                 {
6826                         echo ' onclick="selectCanLogin(false);"';
6827                 }
6828                 if ( $value_current != $value_yes )
6829                 {
6830                         echo " tabindex='$tabindex' checked='checked'";
6831                 }
6832                 if ($isAdmin && $name=="canlogin")
6833                 {
6834                         echo ' disabled="disabled"';
6835                 }
6836                 echo " />\n";
6837                 echo '<label for="' . Entity::hsc($id_no) . '">' . Entity::hsc($text_no) . "</label>\n";
6838
6839                 return;
6840         }
6841 }