nucleus/libs/ADMIN.php

   1 <?php\r
   2 /*\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2009 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18 \r
  19  */\r
  20 \r
  21 if ( !function_exists('requestVar') ) exit;\r
  22 require_once dirname(__FILE__) . '/showlist.php';\r
  23 \r
  24 /**\r
  25  * Builds the admin area and executes admin actions\r
  26  */\r
  27 class ADMIN\r
  28 {\r
  29         private $xml_version_info = '1.0';\r
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';\r
  33         \r
  34     /**\r
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)\r
  36      */\r
  37     var $action;\r
  38 \r
  39     /**\r
  40      * Class constructor\r
  41      */\r
  42     function ADMIN() {\r
  43 \r
  44     }\r
  45 \r
  46     /**\r
  47      * Executes an action\r
  48      *\r
  49      * @param string $action action to be performed\r
  50      */\r
  51     function action($action) {\r
  52         global $CONF, $manager;\r
  53 \r
  54         // list of action aliases\r
  55         $alias = array(\r
  56             'login' => 'overview',\r
  57             '' => 'overview'\r
  58         );\r
  59 \r
  60         if (isset($alias[$action]))\r
  61             $action = $alias[$action];\r
  62 \r
  63         $methodName = 'action_' . $action;\r
  64 \r
  65         $this->action = strtolower($action);\r
  66 \r
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action\r
  68         // is an action that requires user interaction before something is actually done)\r
  69         // all safe actions are in this array:\r
  70         $aActionsNotToCheck = array(\r
  71             'showlogin',\r
  72             'login',\r
  73             'overview',\r
  74             'itemlist',\r
  75             'blogcommentlist',\r
  76             'bookmarklet',\r
  77             'blogsettings',\r
  78             'banlist',\r
  79             'deleteblog',\r
  80             'editmembersettings',\r
  81             'browseownitems',\r
  82             'browseowncomments',\r
  83             'createitem',\r
  84             'itemedit',\r
  85             'itemmove',\r
  86             'categoryedit',\r
  87             'categorydelete',\r
  88             'manage',\r
  89             'actionlog',\r
  90             'settingsedit',\r
  91             'backupoverview',\r
  92             'pluginlist',\r
  93             'createnewlog',\r
  94             'usermanagement',\r
  95             'skinoverview',\r
  96             'templateoverview',\r
  97             'skinieoverview',\r
  98             'itemcommentlist',\r
  99             'commentedit',\r
 100             'commentdelete',\r
 101             'banlistnewfromitem',\r
 102             'banlistdelete',\r
 103             'itemdelete',\r
 104             'manageteam',\r
 105             'teamdelete',\r
 106             'banlistnew',\r
 107             'memberedit',\r
 108             'memberdelete',\r
 109             'pluginhelp',\r
 110             'pluginoptions',\r
 111             'plugindelete',\r
 112             'skinedittype',\r
 113             'skinremovetype',\r
 114             'skindelete',\r
 115             'skinedit',\r
 116             'templateedit',\r
 117             'templatedelete',\r
 118             'activate',\r
 119             'systemoverview'\r
 120         );\r
 121 /*\r
 122         // the rest of the actions needs to be checked\r
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');\r
 124 */\r
 125         if (!in_array($this->action, $aActionsNotToCheck))\r
 126         {\r
 127             if (!$manager->checkTicket())\r
 128                 $this->error(_ERROR_BADTICKET);\r
 129         }\r
 130 \r
 131         if (method_exists($this, $methodName))\r
 132             call_user_func(array(&$this, $methodName));\r
 133         else\r
 134             $this->error(_BADACTION . ENTITY::hsc(" ($action)"));\r
 135 \r
 136     }\r
 137 \r
 138     /**\r
 139      * @todo document this\r
 140      */\r
 141     function action_showlogin() {\r
 142         global $error;\r
 143         $this->action_login($error);\r
 144     }\r
 145 \r
 146     /**\r
 147      * @todo document this\r
 148      */\r
 149     function action_login($msg = '', $passvars = 1) {\r
 150         global $member;\r
 151 \r
 152         // skip to overview when allowed\r
 153         if ($member->isLoggedIn() && $member->canLogin()) {\r
 154             $this->action_overview();\r
 155             exit;\r
 156         }\r
 157 \r
 158         $this->pagehead();\r
 159 \r
 160         echo '<h2>', _LOGIN ,'</h2>';\r
 161         if ($msg) echo _MESSAGE , ': ', ENTITY::hsc($msg);\r
 162         ?>\r
 163 \r
 164         <form action="index.php" method="post"><p>\r
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />\r
 166         <br />\r
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />\r
 168         <br />\r
 169         <input name="action" value="login" type="hidden" />\r
 170         <br />\r
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />\r
 172         <br />\r
 173         <small>\r
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>\r
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>\r
 176         </small>\r
 177         <?php           // pass through vars\r
 178 \r
 179             $oldaction = postVar('oldaction');\r
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {\r
 181                 passRequestVars();\r
 182             }\r
 183 \r
 184 \r
 185         ?>\r
 186         </p></form>\r
 187         <?php       $this->pagefoot();\r
 188     }\r
 189 \r
 190 \r
 191     /**\r
 192      * provides a screen with the overview of the actions available\r
 193      * @todo document parameter\r
 194      */\r
 195     function action_overview($msg = '') {\r
 196         global $member;\r
 197 \r
 198         $this->pagehead();\r
 199 \r
 200         if ($msg)\r
 201             echo _MESSAGE , ': ', $msg;\r
 202 \r
 203         /* ---- add items ---- */\r
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';\r
 205 \r
 206         $showAll = requestVar('showall');\r
 207 \r
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {\r
 209             // Super-Admins have access to all blogs! (no add item support though)\r
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'\r
 211                    . ' FROM ' . sql_table('blog')\r
 212                    . ' ORDER BY bname';\r
 213         } else {\r
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'\r
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
 217                    . ' ORDER BY bname';\r
 218         }\r
 219         $template['content'] = 'bloglist';\r
 220         $template['superadmin'] = $member->isAdmin();\r
 221         $amount = showlist($query,'table',$template);\r
 222 \r
 223         if (($showAll != 'yes') && ($member->isAdmin())) {\r
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));\r
 225             if ($total > $amount)\r
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';\r
 227         }\r
 228 \r
 229         if ($amount == 0)\r
 230             echo _OVERVIEW_NOBLOGS;\r
 231 \r
 232         if ($amount != 0) {\r
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';\r
 234             $query =  'SELECT ititle, inumber, bshortname'\r
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')\r
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';\r
 237             $template['content'] = 'draftlist';\r
 238             $amountdrafts = showlist($query, 'table', $template);\r
 239             if ($amountdrafts == 0)\r
 240                 echo _OVERVIEW_NODRAFTS;\r
 241         }\r
 242                                 \r
 243                 if ($amount != 0) {\r
 244                         $yrBlogs = $member->getAdminBlogs();\r
 245                         if ($showAll != 'yes') {\r
 246                                 $admBlogs = array();\r
 247                                 foreach ($yrBlogs as $value) {\r
 248                                         if ($member->isBlogAdmin(intval($value))) {\r
 249                                                 $admBlogs[] = intval($value);\r
 250                                         }\r
 251                                 }\r
 252                                 $yrBlogs = $admBlogs;\r
 253                         }\r
 254                         \r
 255                         if (count($yrBlogs) > 0) {\r
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';\r
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'\r
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')\r
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'\r
 260                                            . ' ORDER BY iblog ASC';\r
 261                                 $template['content'] = 'otherdraftlist';\r
 262                                 $amountdrafts = showlist($query, 'table', $template);\r
 263                                 if ($amountdrafts == 0)\r
 264                                         echo _OVERVIEW_NODRAFTS;\r
 265                         }\r
 266         }\r
 267 \r
 268         /* ---- user settings ---- */\r
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';\r
 270         echo '<ul>';\r
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';\r
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';\r
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';\r
 274         echo '</ul>';\r
 275 \r
 276         /* ---- general settings ---- */\r
 277         if ($member->isAdmin()) {\r
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';\r
 279             echo '<ul>';\r
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';\r
 281             echo '</ul>';\r
 282         }\r
 283 \r
 284 \r
 285         $this->pagefoot();\r
 286     }\r
 287 \r
 288     /**\r
 289      * Returns a link to a weblog\r
 290      * @param object BLOG\r
 291      */\r
 292     function bloglink(&$blog) {\r
 293         return '<a href="'.ENTITY::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. ENTITY::hsc( $blog->getName() ) .'</a>';\r
 294     }\r
 295 \r
 296     /**\r
 297      * @todo document this\r
 298      */\r
 299     function action_manage($msg = '') {\r
 300         global $member;\r
 301 \r
 302         $member->isAdmin() or $this->disallow();\r
 303 \r
 304         $this->pagehead();\r
 305 \r
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 307 \r
 308         if ($msg)\r
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';\r
 310 \r
 311 \r
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';\r
 313 \r
 314         echo '<ul>';\r
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';\r
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';\r
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';\r
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';\r
 319         echo '</ul>';\r
 320 \r
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';\r
 322         echo '<ul>';\r
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';\r
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';\r
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';\r
 326         echo '</ul>';\r
 327 \r
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';\r
 329         echo '<ul>';\r
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';\r
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';\r
 332         echo '</ul>';\r
 333 \r
 334         $this->pagefoot();\r
 335     }\r
 336 \r
 337     /**\r
 338      * @todo document this\r
 339      */\r
 340     function action_itemlist($blogid = '') {\r
 341         global $member, $manager, $CONF;\r
 342 \r
 343         if ($blogid == '')\r
 344             $blogid = intRequestVar('blogid');\r
 345 \r
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
 347 \r
 348         $this->pagehead();\r
 349         $blog =& $manager->getBlog($blogid);\r
 350 \r
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';\r
 353 \r
 354         // start index\r
 355         if (postVar('start'))\r
 356             $start = intPostVar('start');\r
 357         else\r
 358             $start = 0;\r
 359 \r
 360         if ($start == 0)\r
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';\r
 362 \r
 363         // amount of items to show\r
 364         if (postVar('amount'))\r
 365             $amount = intPostVar('amount');\r
 366         else {\r
 367             $amount = intval($CONF['DefaultListSize']);\r
 368             if ($amount < 1)\r
 369                 $amount = 10;\r
 370         }\r
 371 \r
 372         $search = postVar('search');    // search through items\r
 373 \r
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'\r
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')\r
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;\r
 377 \r
 378         if ($search)\r
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';\r
 380 \r
 381         // non-blog-admins can only edit/delete their own items\r
 382         if (!$member->blogAdminRights($blogid))\r
 383             $query .= ' and iauthor=' . $member->getID();\r
 384 \r
 385 \r
 386         $query .= ' ORDER BY itime DESC'\r
 387                 . " LIMIT $start,$amount";\r
 388 \r
 389         $template['content'] = 'itemlist';\r
 390         $template['now'] = $blog->getCorrectTime(time());\r
 391 \r
 392         $manager->loadClass("ENCAPSULATE");\r
 393         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
 394         $navList->showBatchList('item',$query,'table',$template);\r
 395 \r
 396 \r
 397         $this->pagefoot();\r
 398     }\r
 399 \r
 400     /**\r
 401      * @todo document this\r
 402      */\r
 403     function action_batchitem() {\r
 404         global $member, $manager;\r
 405 \r
 406         // check if logged in\r
 407         $member->isLoggedIn() or $this->disallow();\r
 408 \r
 409         // more precise check will be done for each performed operation\r
 410 \r
 411         // get array of itemids from request\r
 412         $selected = requestIntArray('batch');\r
 413         $action = requestVar('batchaction');\r
 414 \r
 415         // Show error when no items were selected\r
 416         if (!is_array($selected) || sizeof($selected) == 0)\r
 417             $this->error(_BATCH_NOSELECTION);\r
 418 \r
 419         // On move: when no destination blog/category chosen, show choice now\r
 420         $destCatid = intRequestVar('destcatid');\r
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))\r
 422             $this->batchMoveSelectDestination('item',$selected);\r
 423 \r
 424         // On delete: check if confirmation has been given\r
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 426             $this->batchAskDeleteConfirmation('item',$selected);\r
 427 \r
 428         $this->pagehead();\r
 429 \r
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';\r
 432         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';\r
 433         echo '<ul>';\r
 434 \r
 435 \r
 436         // walk over all itemids and perform action\r
 437         foreach ($selected as $itemid) {\r
 438             $itemid = intval($itemid);\r
 439             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';\r
 440 \r
 441             // perform action, display errors if needed\r
 442             switch($action) {\r
 443                 case 'delete':\r
 444                     $error = $this->deleteOneItem($itemid);\r
 445                     break;\r
 446                 case 'move':\r
 447                     $error = $this->moveOneItem($itemid, $destCatid);\r
 448                     break;\r
 449                 default:\r
 450                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);\r
 451             }\r
 452 \r
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 454             echo '</li>';\r
 455         }\r
 456 \r
 457         echo '</ul>';\r
 458         echo '<b>',_BATCH_DONE,'</b>';\r
 459 \r
 460         $this->pagefoot();\r
 461 \r
 462 \r
 463     }\r
 464 \r
 465     /**\r
 466      * @todo document this\r
 467      */\r
 468     function action_batchcomment() {\r
 469         global $member;\r
 470 \r
 471         // check if logged in\r
 472         $member->isLoggedIn() or $this->disallow();\r
 473 \r
 474         // more precise check will be done for each performed operation\r
 475 \r
 476         // get array of itemids from request\r
 477         $selected = requestIntArray('batch');\r
 478         $action = requestVar('batchaction');\r
 479 \r
 480         // Show error when no items were selected\r
 481         if (!is_array($selected) || sizeof($selected) == 0)\r
 482             $this->error(_BATCH_NOSELECTION);\r
 483 \r
 484         // On delete: check if confirmation has been given\r
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 486             $this->batchAskDeleteConfirmation('comment',$selected);\r
 487 \r
 488         $this->pagehead();\r
 489 \r
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';\r
 492         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';\r
 493         echo '<ul>';\r
 494 \r
 495         // walk over all itemids and perform action\r
 496         foreach ($selected as $commentid) {\r
 497             $commentid = intval($commentid);\r
 498             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';\r
 499 \r
 500             // perform action, display errors if needed\r
 501             switch($action) {\r
 502                 case 'delete':\r
 503                     $error = $this->deleteOneComment($commentid);\r
 504                     break;\r
 505                 default:\r
 506                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);\r
 507             }\r
 508 \r
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 510             echo '</li>';\r
 511         }\r
 512 \r
 513         echo '</ul>';\r
 514         echo '<b>',_BATCH_DONE,'</b>';\r
 515 \r
 516         $this->pagefoot();\r
 517 \r
 518 \r
 519     }\r
 520 \r
 521     /**\r
 522      * @todo document this\r
 523      */\r
 524     function action_batchmember() {\r
 525         global $member;\r
 526 \r
 527         // check if logged in and admin\r
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();\r
 529 \r
 530         // get array of itemids from request\r
 531         $selected = requestIntArray('batch');\r
 532         $action = requestVar('batchaction');\r
 533 \r
 534         // Show error when no members selected\r
 535         if (!is_array($selected) || sizeof($selected) == 0)\r
 536             $this->error(_BATCH_NOSELECTION);\r
 537 \r
 538         // On delete: check if confirmation has been given\r
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 540             $this->batchAskDeleteConfirmation('member',$selected);\r
 541 \r
 542         $this->pagehead();\r
 543 \r
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';\r
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';\r
 546         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';\r
 547         echo '<ul>';\r
 548 \r
 549         // walk over all itemids and perform action\r
 550         foreach ($selected as $memberid) {\r
 551             $memberid = intval($memberid);\r
 552             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';\r
 553 \r
 554             // perform action, display errors if needed\r
 555             switch($action) {\r
 556                 case 'delete':\r
 557                     $error = $this->deleteOneMember($memberid);\r
 558                     break;\r
 559                 case 'setadmin':\r
 560                     // always succeeds\r
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);\r
 562                     $error = '';\r
 563                     break;\r
 564                 case 'unsetadmin':\r
 565                     // there should always remain at least one super-admin\r
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');\r
 567                     if (sql_num_rows($r) < 2)\r
 568                         $error = _ERROR_ATLEASTONEADMIN;\r
 569                     else\r
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);\r
 571                     break;\r
 572                 default:\r
 573                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);\r
 574             }\r
 575 \r
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 577             echo '</li>';\r
 578         }\r
 579 \r
 580         echo '</ul>';\r
 581         echo '<b>',_BATCH_DONE,'</b>';\r
 582 \r
 583         $this->pagefoot();\r
 584 \r
 585 \r
 586     }\r
 587 \r
 588     /**\r
 589      * @todo document this\r
 590      */\r
 591     function action_batchteam() {\r
 592         global $member;\r
 593 \r
 594         $blogid = intRequestVar('blogid');\r
 595 \r
 596         // check if logged in and admin\r
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();\r
 598 \r
 599         // get array of itemids from request\r
 600         $selected = requestIntArray('batch');\r
 601         $action = requestVar('batchaction');\r
 602 \r
 603         // Show error when no members selected\r
 604         if (!is_array($selected) || sizeof($selected) == 0)\r
 605             $this->error(_BATCH_NOSELECTION);\r
 606 \r
 607         // On delete: check if confirmation has been given\r
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 609             $this->batchAskDeleteConfirmation('team',$selected);\r
 610 \r
 611         $this->pagehead();\r
 612 \r
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';\r
 614 \r
 615         echo '<h2>',_BATCH_TEAM,'</h2>';\r
 616         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';\r
 617         echo '<ul>';\r
 618 \r
 619         // walk over all itemids and perform action\r
 620         foreach ($selected as $memberid) {\r
 621             $memberid = intval($memberid);\r
 622             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';\r
 623 \r
 624             // perform action, display errors if needed\r
 625             switch($action) {\r
 626                 case 'delete':\r
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);\r
 628                     break;\r
 629                 case 'setadmin':\r
 630                     // always succeeds\r
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
 632                     $error = '';\r
 633                     break;\r
 634                 case 'unsetadmin':\r
 635                     // there should always remain at least one admin\r
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);\r
 637                     if (sql_num_rows($r) < 2)\r
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;\r
 639                     else\r
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);\r
 641                     break;\r
 642                 default:\r
 643                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);\r
 644             }\r
 645 \r
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';\r
 647             echo '</li>';\r
 648         }\r
 649 \r
 650         echo '</ul>';\r
 651         echo '<b>',_BATCH_DONE,'</b>';\r
 652 \r
 653         $this->pagefoot();\r
 654 \r
 655 \r
 656     }\r
 657 \r
 658     /**\r
 659      * @todo document this\r
 660      */\r
 661     function action_batchcategory() {\r
 662         global $member, $manager;\r
 663 \r
 664         // check if logged in\r
 665         $member->isLoggedIn() or $this->disallow();\r
 666 \r
 667         // more precise check will be done for each performed operation\r
 668 \r
 669         // get array of itemids from request\r
 670         $selected = requestIntArray('batch');\r
 671         $action = requestVar('batchaction');\r
 672 \r
 673         // Show error when no items were selected\r
 674         if (!is_array($selected) || sizeof($selected) == 0)\r
 675             $this->error(_BATCH_NOSELECTION);\r
 676 \r
 677         // On move: when no destination blog chosen, show choice now\r
 678         $destBlogId = intRequestVar('destblogid');\r
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))\r
 680             $this->batchMoveCategorySelectDestination('category',$selected);\r
 681 \r
 682         // On delete: check if confirmation has been given\r
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))\r
 684             $this->batchAskDeleteConfirmation('category',$selected);\r
 685 \r
 686         $this->pagehead();\r
 687 \r
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';\r
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';\r
 690         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';\r
 691         echo '<ul>';\r
 692 \r
 693         // walk over all itemids and perform action\r
 694         foreach ($selected as $catid) {\r
 695             $catid = intval($catid);\r
 696             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';\r
 697 \r
 698             // perform action, display errors if needed\r
 699             switch($action) {\r
 700                 case 'delete':\r
 701                     $error = $this->deleteOneCategory($catid);\r
 702                     break;\r
 703                 case 'move':\r
 704                     $error = $this->moveOneCategory($catid, $destBlogId);\r
 705                     break;\r
 706                 default:\r
 707                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);\r
 708             }\r
 709 \r
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';\r
 711             echo '</li>';\r
 712         }\r
 713 \r
 714         echo '</ul>';\r
 715         echo '<b>',_BATCH_DONE,'</b>';\r
 716 \r
 717         $this->pagefoot();\r
 718 \r
 719     }\r
 720 \r
 721     /**\r
 722      * @todo document this\r
 723      */\r
 724     function batchMoveSelectDestination($type, $ids) {\r
 725         global $manager;\r
 726         $this->pagehead();\r
 727         ?>\r
 728         <h2><?php echo _MOVE_TITLE?></h2>\r
 729         <form method="post" action="index.php"><div>\r
 730 \r
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 732             <input type="hidden" name="batchaction" value="move" />\r
 733             <?php\r
 734                 $manager->addTicketHidden();\r
 735 \r
 736                 // insert selected item numbers\r
 737                 $idx = 0;\r
 738                 foreach ($ids as $id)\r
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 740 \r
 741                 // show blog/category selection list\r
 742                 $this->selectBlogCategory('destcatid');\r
 743 \r
 744             ?>\r
 745 \r
 746 \r
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />\r
 748 \r
 749         </div></form>\r
 750         <?php       $this->pagefoot();\r
 751         exit;\r
 752     }\r
 753 \r
 754     /**\r
 755      * @todo document this\r
 756      */\r
 757     function batchMoveCategorySelectDestination($type, $ids) {\r
 758         global $manager;\r
 759         $this->pagehead();\r
 760         ?>\r
 761         <h2><?php echo _MOVECAT_TITLE?></h2>\r
 762         <form method="post" action="index.php"><div>\r
 763 \r
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 765             <input type="hidden" name="batchaction" value="move" />\r
 766             <?php\r
 767                 $manager->addTicketHidden();\r
 768 \r
 769                 // insert selected item numbers\r
 770                 $idx = 0;\r
 771                 foreach ($ids as $id)\r
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 773 \r
 774                 // show blog/category selection list\r
 775                 $this->selectBlog('destblogid');\r
 776 \r
 777             ?>\r
 778 \r
 779 \r
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />\r
 781 \r
 782         </div></form>\r
 783         <?php       $this->pagefoot();\r
 784         exit;\r
 785     }\r
 786 \r
 787     /**\r
 788      * @todo document this\r
 789      */\r
 790     function batchAskDeleteConfirmation($type, $ids) {\r
 791         global $manager;\r
 792 \r
 793         $this->pagehead();\r
 794         ?>\r
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>\r
 796         <form method="post" action="index.php"><div>\r
 797 \r
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />\r
 799             <?php $manager->addTicketHidden() ?>\r
 800             <input type="hidden" name="batchaction" value="delete" />\r
 801             <input type="hidden" name="confirmation" value="yes" />\r
 802             <?php               // insert selected item numbers\r
 803                 $idx = 0;\r
 804                 foreach ($ids as $id)\r
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';\r
 806 \r
 807                 // add hidden vars for team & comment\r
 808                 if ($type == 'team')\r
 809                 {\r
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';\r
 811                 }\r
 812                 if ($type == 'comment')\r
 813                 {\r
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';\r
 815                 }\r
 816 \r
 817             ?>\r
 818 \r
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />\r
 820 \r
 821         </div></form>\r
 822         <?php       $this->pagefoot();\r
 823         exit;\r
 824     }\r
 825 \r
 826 \r
 827     /**\r
 828      * Inserts a HTML select element with choices for all categories to which the current\r
 829      * member has access\r
 830      * @see function selectBlog\r
 831      */\r
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
 833         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 834     }\r
 835 \r
 836     /**\r
 837      * Inserts a HTML select element with choices for all blogs to which the user has access\r
 838      *      mode = 'blog' => shows blognames and values are blogids\r
 839      *      mode = 'category' => show category names and values are catids\r
 840      *\r
 841      * @param $iForcedBlogInclude\r
 842      *      ID of a blog that always needs to be included, without checking if the\r
 843      *      member is on the blog team (-1 = none)\r
 844      * @todo document parameters\r
 845      */\r
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {\r
 847         global $member, $CONF;\r
 848 \r
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 850         $aBlogIds = array();\r
 851         if ($iForcedBlogInclude != -1)\r
 852             $aBlogIds[] = intval($iForcedBlogInclude);\r
 853 \r
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))\r
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';\r
 856         else\r
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();\r
 858         $rblogids = sql_query($queryBlogs);\r
 859         while ($o = sql_fetch_object($rblogids))\r
 860             if ($o->bnumber != $iForcedBlogInclude)\r
 861                 $aBlogIds[] = intval($o->bnumber);\r
 862 \r
 863         if (count($aBlogIds) == 0)\r
 864             return;\r
 865 \r
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';\r
 867 \r
 868         // 1. select blogs (we'll create optiongroups)\r
 869         // (only select those blogs that have the user on the team)\r
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';\r
 871         $blogs = sql_query($queryBlogs);\r
 872         if ($mode == 'category') {\r
 873             if (sql_num_rows($blogs) > 1)\r
 874                 $multipleBlogs = 1;\r
 875 \r
 876             while ($oBlog = sql_fetch_object($blogs)) {\r
 877                 if ($multipleBlogs)\r
 878                     echo '<optgroup label="',ENTITY::hsc($oBlog->bname),'">';\r
 879 \r
 880                 // show selection to create new category when allowed/wanted\r
 881                 if ($showNewCat) {\r
 882                     // check if allowed to do so\r
 883                     if ($member->blogAdminRights($oBlog->bnumber))\r
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';\r
 885                 }\r
 886 \r
 887                 // 2. for each category in that blog\r
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');\r
 889                 while ($oCat = sql_fetch_object($categories)) {\r
 890                     if ($oCat->catid == $selected)\r
 891                         $selectText = ' selected="selected" ';\r
 892                     else\r
 893                         $selectText = '';\r
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',ENTITY::hsc($oCat->cname),'</option>';\r
 895                 }\r
 896 \r
 897                 if ($multipleBlogs)\r
 898                     echo '</optgroup>';\r
 899             }\r
 900         } else {\r
 901             // blog mode\r
 902             while ($oBlog = sql_fetch_object($blogs)) {\r
 903                 echo '<option value="',$oBlog->bnumber,'"';\r
 904                 if ($oBlog->bnumber == $selected)\r
 905                     echo ' selected="selected"';\r
 906                 echo'>',ENTITY::hsc($oBlog->bname),'</option>';\r
 907             }\r
 908         }\r
 909         echo '</select>';\r
 910 \r
 911     }\r
 912 \r
 913     /**\r
 914      * @todo document this\r
 915      */\r
 916     function action_browseownitems() {\r
 917         global $member, $manager, $CONF;\r
 918 \r
 919         $this->pagehead();\r
 920 \r
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';\r
 923 \r
 924         // start index\r
 925         if (postVar('start'))\r
 926             $start = intPostVar('start');\r
 927         else\r
 928             $start = 0;\r
 929 \r
 930         // amount of items to show\r
 931         if (postVar('amount'))\r
 932             $amount = intPostVar('amount');\r
 933         else {\r
 934             $amount = intval($CONF['DefaultListSize']);\r
 935             if ($amount < 1)\r
 936                 $amount = 10;\r
 937         }\r
 938 \r
 939         $search = postVar('search');    // search through items\r
 940 \r
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'\r
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')\r
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';\r
 944 \r
 945         if ($search)\r
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';\r
 947 \r
 948         $query .= ' ORDER BY itime DESC'\r
 949                 . " LIMIT $start,$amount";\r
 950 \r
 951         $template['content'] = 'itemlist';\r
 952         $template['now'] = time();\r
 953 \r
 954         $manager->loadClass("ENCAPSULATE");\r
 955         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);\r
 956         $navList->showBatchList('item',$query,'table',$template);\r
 957 \r
 958         $this->pagefoot();\r
 959 \r
 960     }\r
 961 \r
 962     /**\r
 963      * Show all the comments for a given item\r
 964      * @param int $itemid\r
 965      */\r
 966     function action_itemcommentlist($itemid = '') {\r
 967         global $member, $manager, $CONF;\r
 968 \r
 969         if ($itemid == '')\r
 970             $itemid = intRequestVar('itemid');\r
 971 \r
 972         // only allow if user is allowed to alter item\r
 973         $member->canAlterItem($itemid) or $this->disallow();\r
 974 \r
 975         $blogid = getBlogIdFromItemId($itemid);\r
 976 \r
 977         $this->pagehead();\r
 978 \r
 979         // start index\r
 980         if (postVar('start'))\r
 981             $start = intPostVar('start');\r
 982         else\r
 983             $start = 0;\r
 984 \r
 985         // amount of items to show\r
 986         if (postVar('amount'))\r
 987             $amount = intPostVar('amount');\r
 988         else {\r
 989             $amount = intval($CONF['DefaultListSize']);\r
 990             if ($amount < 1)\r
 991                 $amount = 10;\r
 992         }\r
 993 \r
 994         $search = postVar('search');\r
 995 \r
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';\r
 997         echo '<h2>',_COMMENTS,'</h2>';\r
 998 \r
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;\r
1000 \r
1001         if ($search)\r
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
1003 \r
1004         $query .= ' ORDER BY ctime ASC'\r
1005                 . " LIMIT $start,$amount";\r
1006 \r
1007         $template['content'] = 'commentlist';\r
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));\r
1009 \r
1010         $manager->loadClass("ENCAPSULATE");\r
1011         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);\r
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);\r
1013 \r
1014         $this->pagefoot();\r
1015     }\r
1016 \r
1017     /**\r
1018      * Browse own comments\r
1019      */\r
1020     function action_browseowncomments() {\r
1021         global $member, $manager, $CONF;\r
1022 \r
1023         // start index\r
1024         if (postVar('start'))\r
1025             $start = intPostVar('start');\r
1026         else\r
1027             $start = 0;\r
1028 \r
1029         // amount of items to show\r
1030         if (postVar('amount'))\r
1031             $amount = intPostVar('amount');\r
1032         else {\r
1033             $amount = intval($CONF['DefaultListSize']);\r
1034             if ($amount < 1)\r
1035                 $amount = 10;\r
1036         }\r
1037 \r
1038         $search = postVar('search');\r
1039 \r
1040 \r
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();\r
1042 \r
1043         if ($search)\r
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
1045 \r
1046         $query .= ' ORDER BY ctime DESC'\r
1047                 . " LIMIT $start,$amount";\r
1048 \r
1049         $this->pagehead();\r
1050 \r
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';\r
1053 \r
1054         $template['content'] = 'commentlist';\r
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself\r
1056 \r
1057         $manager->loadClass("ENCAPSULATE");\r
1058         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);\r
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);\r
1060 \r
1061         $this->pagefoot();\r
1062     }\r
1063 \r
1064     /**\r
1065      * Browse all comments for a weblog\r
1066      * @param int $blogid\r
1067      */\r
1068     function action_blogcommentlist($blogid = '')\r
1069     {\r
1070         global $member, $manager, $CONF;\r
1071 \r
1072         if ($blogid == '')\r
1073             $blogid = intRequestVar('blogid');\r
1074         else\r
1075             $blogid = intval($blogid);\r
1076 \r
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
1078 \r
1079         // start index\r
1080         if (postVar('start'))\r
1081             $start = intPostVar('start');\r
1082         else\r
1083             $start = 0;\r
1084 \r
1085         // amount of items to show\r
1086         if (postVar('amount'))\r
1087             $amount = intPostVar('amount');\r
1088         else {\r
1089             $amount = intval($CONF['DefaultListSize']);\r
1090             if ($amount < 1)\r
1091                 $amount = 10;\r
1092         }\r
1093 \r
1094         $search = postVar('search');        // search through comments\r
1095 \r
1096 \r
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);\r
1098 \r
1099         if ($search != '')\r
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';\r
1101 \r
1102 \r
1103         $query .= ' ORDER BY ctime DESC'\r
1104                 . " LIMIT $start,$amount";\r
1105 \r
1106 \r
1107         $blog =& $manager->getBlog($blogid);\r
1108 \r
1109         $this->pagehead();\r
1110 \r
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';\r
1113 \r
1114         $template['content'] = 'commentlist';\r
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);\r
1116 \r
1117         $manager->loadClass("ENCAPSULATE");\r
1118         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);\r
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);\r
1120 \r
1121         $this->pagefoot();\r
1122     }\r
1123 \r
1124     /**\r
1125      * Provide a page to item a new item to the given blog\r
1126      */\r
1127     function action_createitem() {\r
1128         global $member, $manager;\r
1129 \r
1130         $blogid = intRequestVar('blogid');\r
1131 \r
1132         // check if allowed\r
1133         $member->teamRights($blogid) or $this->disallow();\r
1134 \r
1135         $memberid = $member->getID();\r
1136 \r
1137         $blog =& $manager->getBlog($blogid);\r
1138 \r
1139         $this->pagehead();\r
1140 \r
1141         // generate the add-item form\r
1142         $formfactory = new PAGEFACTORY($blogid);\r
1143         $formfactory->createAddForm('admin');\r
1144 \r
1145         $this->pagefoot();\r
1146     }\r
1147 \r
1148     /**\r
1149      * @todo document this\r
1150      */\r
1151     function action_itemedit()\r
1152         {\r
1153                 global $member, $manager;\r
1154 \r
1155                 $itemid = intRequestVar('itemid');\r
1156 \r
1157                 // only allow if user is allowed to alter item\r
1158                 $member->canAlterItem($itemid) or $this->disallow();\r
1159 \r
1160                 $item =& $manager->getItem($itemid, 1, 1);\r
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
1162 \r
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));\r
1164 \r
1165                 if ($blog->convertBreaks())\r
1166                 {\r
1167                         $item['body'] = removeBreaks($item['body']);\r
1168                         $item['more'] = removeBreaks($item['more']);\r
1169                 }\r
1170 \r
1171                 // form to edit blog items\r
1172                 $this->pagehead();\r
1173                 $formfactory = new PAGEFACTORY($blog->getID());\r
1174                 $formfactory->createEditForm('admin', $item);\r
1175                 $this->pagefoot();\r
1176     }\r
1177 \r
1178     /**\r
1179      * @todo document this\r
1180      */\r
1181     function action_itemupdate() {\r
1182         global $member, $manager, $CONF;\r
1183 \r
1184         $itemid = intRequestVar('itemid');\r
1185         $catid = postVar('catid');\r
1186 \r
1187         // only allow if user is allowed to alter item\r
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1189 \r
1190         $actiontype = postVar('actiontype');\r
1191 \r
1192         // delete actions are handled by itemdelete (which has confirmation)\r
1193         if ($actiontype == 'delete') {\r
1194             $this->action_itemdelete();\r
1195             return;\r
1196         }\r
1197 \r
1198         $body   = postVar('body');\r
1199         $title  = postVar('title');\r
1200         $more   = postVar('more');\r
1201         $closed = intPostVar('closed');\r
1202         $draftid = intPostVar('draftid');\r
1203 \r
1204         // default action = add now\r
1205         if (!$actiontype)\r
1206             $actiontype='addnow';\r
1207 \r
1208         // create new category if needed\r
1209         if (strstr($catid,'newcat')) {\r
1210             // get blogid\r
1211             list($blogid) = sscanf($catid,"newcat-%d");\r
1212 \r
1213             // create\r
1214             $blog =& $manager->getBlog($blogid);\r
1215             $catid = $blog->createNewCategory();\r
1216 \r
1217             // show error when sth goes wrong\r
1218             if (!$catid)\r
1219                 $this->doError(_ERROR_CATCREATEFAIL);\r
1220         }\r
1221 \r
1222         /*\r
1223             set some variables based on actiontype\r
1224 \r
1225             actiontypes:\r
1226                 draft items -> addnow, addfuture, adddraft, delete\r
1227                 non-draft items -> edit, changedate, delete\r
1228 \r
1229             variables set:\r
1230                 $timestamp: set to a nonzero value for future dates or date changes\r
1231                 $wasdraft: set to 1 when the item used to be a draft item\r
1232                 $publish: set to 1 when the edited item is not a draft\r
1233         */\r
1234         $blogid =  getBlogIDFromItemID($itemid);\r
1235         $blog   =& $manager->getBlog($blogid);\r
1236 \r
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {\r
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
1242         } else {\r
1243             $timestamp =0;\r
1244         }\r
1245 \r
1246         // edit the item for real\r
1247         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
1248 \r
1249         $this->updateFuturePosted($blogid);\r
1250 \r
1251         if ($draftid > 0) {\r
1252             // delete permission is checked inside ITEM::delete()\r
1253             ITEM::delete($draftid);\r
1254         }\r
1255 \r
1256         // show category edit window when we created a new category\r
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')\r
1258         if ($catid != intPostVar('catid')) {\r
1259             $this->action_categoryedit(\r
1260                 $catid,\r
1261                 $blog->getID(),\r
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
1263             );\r
1264         } else {\r
1265             // TODO: set start item correctly for itemlist\r
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));\r
1267         }\r
1268     }\r
1269         \r
1270         /**\r
1271          * ADMIN::action_itemdelete()\r
1272          * Delete item\r
1273          * \r
1274          * @param       Void\r
1275          * @return      Void\r
1276          */\r
1277         function action_itemdelete()\r
1278         {\r
1279                 global $member, $manager;\r
1280                 \r
1281                 $itemid = intRequestVar('itemid');\r
1282                 \r
1283                 // only allow if user is allowed to alter item\r
1284                 $member->canAlterItem($itemid) or $this->disallow();\r
1285                 \r
1286                 if ( !$manager->existsItem($itemid,1,1) )\r
1287                 {\r
1288                         $this->error(_ERROR_NOSUCHITEM);\r
1289                 }\r
1290                 \r
1291                 $item =& $manager->getItem($itemid,1,1);\r
1292                 $title = ENTITY::hsc(strip_tags($item['title']));\r
1293                 $body = strip_tags($item['body']);\r
1294                 $body = ENTITY::hsc(ENTITY::shorten($body,300,'...'));\r
1295                 \r
1296                 $this->pagehead();\r
1297                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";\r
1298                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";\r
1299                 echo "<div class=\"note\">\n";\r
1300                 echo "<b>{$title}</b>\n";\r
1301                 echo "<br />\n";\r
1302                 echo "{$body}\n";\r
1303                 echo "</div>\n";\r
1304                 echo "<form method=\"post\" action=\"index.php\">\n";\r
1305                 echo "<div>\n";\r
1306                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";\r
1307                 echo $manager->addTicketHidden() . "\n";\r
1308                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";\r
1309                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";\r
1310                 echo "</div>\n";\r
1311                 echo "</form>\n";\r
1312                 $this->pagefoot();\r
1313                 return;\r
1314         }\r
1315         \r
1316     /**\r
1317      * @todo document this\r
1318      */\r
1319     function action_itemdeleteconfirm() {\r
1320         global $member;\r
1321 \r
1322         $itemid = intRequestVar('itemid');\r
1323 \r
1324         // only allow if user is allowed to alter item\r
1325         $member->canAlterItem($itemid) or $this->disallow();\r
1326 \r
1327         // get blogid first\r
1328         $blogid = getBlogIdFromItemId($itemid);\r
1329 \r
1330         // delete item (note: some checks will be performed twice)\r
1331         $this->deleteOneItem($itemid);\r
1332 \r
1333         $this->action_itemlist($blogid);\r
1334     }\r
1335 \r
1336     /**\r
1337      * Deletes one item and returns error if something goes wrong\r
1338      * @param int $itemid\r
1339      */\r
1340     function deleteOneItem($itemid) {\r
1341         global $member, $manager;\r
1342 \r
1343         // only allow if user is allowed to alter item (also checks if itemid exists)\r
1344         if (!$member->canAlterItem($itemid))\r
1345             return _ERROR_DISALLOWED;\r
1346 \r
1347         // need to get blogid before the item is deleted\r
1348         $blogid = getBlogIDFromItemId($itemid);\r
1349 \r
1350         $manager->loadClass('ITEM');\r
1351         ITEM::delete($itemid);\r
1352 \r
1353         // update blog's futureposted\r
1354         $this->updateFuturePosted($blogid);\r
1355     }\r
1356 \r
1357         /**\r
1358          * ADMIN::updateFuturePosted()\r
1359          * Update a blog's future posted flag\r
1360          * \r
1361          * @param integer $blogid\r
1362          * @return      void\r
1363          * \r
1364          */\r
1365         function updateFuturePosted($blogid)\r
1366         {\r
1367                 global $manager;\r
1368                 \r
1369                 $blog =& $manager->getBlog($blogid);\r
1370                 $currenttime = $blog->getCorrectTime(time());\r
1371                 \r
1372                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1373                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1374                 $result = sql_query($query);\r
1375                 \r
1376                 if ( sql_num_rows($result) > 0 )\r
1377                 {\r
1378                         $blog->setFuturePost();\r
1379                 }\r
1380                 else\r
1381                 {\r
1382                         $blog->clearFuturePost();\r
1383                 }\r
1384                 return;\r
1385         }\r
1386 \r
1387     /**\r
1388      * @todo document this\r
1389      */\r
1390     function action_itemmove() {\r
1391         global $member, $manager;\r
1392 \r
1393         $itemid = intRequestVar('itemid');\r
1394 \r
1395         // only allow if user is allowed to alter item\r
1396         $member->canAlterItem($itemid) or $this->disallow();\r
1397 \r
1398         $item =& $manager->getItem($itemid,1,1);\r
1399 \r
1400         $this->pagehead();\r
1401         ?>\r
1402             <h2><?php echo _MOVE_TITLE?></h2>\r
1403             <form method="post" action="index.php"><div>\r
1404                 <input type="hidden" name="action" value="itemmoveto" />\r
1405                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />\r
1406 \r
1407                 <?php\r
1408 \r
1409                     $manager->addTicketHidden();\r
1410                     $this->selectBlogCategory('catid',$item['catid'],10,1);\r
1411                 ?>\r
1412 \r
1413                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />\r
1414             </div></form>\r
1415         <?php\r
1416         $this->pagefoot();\r
1417     }\r
1418 \r
1419     /**\r
1420      * @todo document this\r
1421      */\r
1422     function action_itemmoveto() {\r
1423         global $member, $manager;\r
1424 \r
1425         $itemid = intRequestVar('itemid');\r
1426         $catid = requestVar('catid');\r
1427 \r
1428         // create new category if needed\r
1429         if (strstr($catid,'newcat')) {\r
1430             // get blogid\r
1431             list($blogid) = sscanf($catid,'newcat-%d');\r
1432 \r
1433             // create\r
1434             $blog =& $manager->getBlog($blogid);\r
1435             $catid = $blog->createNewCategory();\r
1436 \r
1437             // show error when sth goes wrong\r
1438             if (!$catid)\r
1439                 $this->doError(_ERROR_CATCREATEFAIL);\r
1440         }\r
1441 \r
1442         // only allow if user is allowed to alter item\r
1443         $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1444 \r
1445         $old_blogid = getBlogIDFromItemId($itemid);\r
1446 \r
1447         ITEM::move($itemid, $catid);\r
1448 \r
1449         // set the futurePosted flag on the blog\r
1450         $this->updateFuturePosted(getBlogIDFromItemId($itemid));\r
1451 \r
1452         // reset the futurePosted in case the item is moved from one blog to another\r
1453         $this->updateFuturePosted($old_blogid);\r
1454 \r
1455         if ($catid != intRequestVar('catid'))\r
1456             $this->action_categoryedit($catid, $blog->getID());\r
1457         else\r
1458             $this->action_itemlist(getBlogIDFromCatID($catid));\r
1459     }\r
1460 \r
1461     /**\r
1462      * Moves one item to a given category (category existance should be checked by caller)\r
1463      * errors are returned\r
1464      * @param int $itemid\r
1465      * @param int $destCatid category ID to which the item will be moved\r
1466      */\r
1467     function moveOneItem($itemid, $destCatid) {\r
1468         global $member;\r
1469 \r
1470         // only allow if user is allowed to move item\r
1471         if (!$member->canUpdateItem($itemid, $destCatid))\r
1472             return _ERROR_DISALLOWED;\r
1473 \r
1474         ITEM::move($itemid, $destCatid);\r
1475     }\r
1476 \r
1477     /**\r
1478      * Adds a item to the chosen blog\r
1479      */\r
1480     function action_additem() {\r
1481         global $manager, $CONF;\r
1482 \r
1483         $manager->loadClass('ITEM');\r
1484 \r
1485         $result = ITEM::createFromRequest();\r
1486 \r
1487         if ($result['status'] == 'error')\r
1488             $this->error($result['message']);\r
1489 \r
1490         $blogid = getBlogIDFromItemID($result['itemid']);\r
1491         $blog =& $manager->getBlog($blogid);\r
1492         $btimestamp = $blog->getCorrectTime();\r
1493         $item       = $manager->getItem(intval($result['itemid']), 1, 1);\r
1494 \r
1495         if ($result['status'] == 'newcategory') {\r
1496             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1497             $this->action_categoryedit($result['catid'], $blogid, $distURI);\r
1498         } else {\r
1499             $methodName = 'action_itemList';\r
1500             call_user_func(array(&$this, $methodName), $blogid);\r
1501         }\r
1502     }\r
1503 \r
1504         /**\r
1505          * Allows to edit previously made comments\r
1506          **/\r
1507         function action_commentedit() {\r
1508 \r
1509                 global $member, $manager;\r
1510 \r
1511                 $commentid = intRequestVar('commentid');\r
1512 \r
1513                 $member->canAlterComment($commentid) or $this->disallow();\r
1514 \r
1515                 $comment = COMMENT::getComment($commentid);\r
1516 \r
1517                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );\r
1518 \r
1519                 // change <br /> to \n\r
1520                 $comment['body'] = str_replace('<br />', '', $comment['body']);\r
1521 \r
1522                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0\r
1523                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */\r
1524 \r
1525         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);\r
1526 \r
1527         $this->pagehead();\r
1528 \r
1529         ?>\r
1530         <h2><?php echo _EDITC_TITLE?></h2>\r
1531 \r
1532         <form action="index.php" method="post"><div>\r
1533 \r
1534         <input type="hidden" name="action" value="commentupdate" />\r
1535         <?php $manager->addTicketHidden(); ?>\r
1536         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />\r
1537         <table><tr>\r
1538             <th colspan="2"><?php echo _EDITC_TITLE?></th>\r
1539         </tr><tr>\r
1540             <td><?php echo _EDITC_WHO?></td>\r
1541             <td>\r
1542             <?php               if ($comment['member'])\r
1543                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";\r
1544                 else\r
1545                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";\r
1546             ?>\r
1547             </td>\r
1548         </tr><tr>\r
1549             <td><?php echo _EDITC_WHEN?></td>\r
1550             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>\r
1551         </tr><tr>\r
1552             <td><?php echo _EDITC_HOST?></td>\r
1553             <td><?php echo  $comment['host']; ?></td>\r
1554         </tr>\r
1555         <tr>\r
1556             <td><?php echo _EDITC_URL; ?></td>\r
1557             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>\r
1558         </tr>\r
1559         <tr>\r
1560             <td><?php echo _EDITC_EMAIL; ?></td>\r
1561             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>\r
1562         </tr>\r
1563         <tr>\r
1564             <td><?php echo _EDITC_TEXT?></td>\r
1565             <td>\r
1566                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)\r
1567                     echo $comment['body'];\r
1568                 ?></textarea>\r
1569             </td>\r
1570         </tr><tr>\r
1571             <td><?php echo _EDITC_EDIT?></td>\r
1572             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>\r
1573         </tr></table>\r
1574 \r
1575         </div></form>\r
1576         <?php\r
1577         $this->pagefoot();\r
1578     }\r
1579 \r
1580     /**\r
1581      * @todo document this\r
1582      */\r
1583     function action_commentupdate() {\r
1584         global $member, $manager;\r
1585 \r
1586         $commentid = intRequestVar('commentid');\r
1587 \r
1588         $member->canAlterComment($commentid) or $this->disallow();\r
1589 \r
1590         $url = postVar('url');\r
1591         $email = postVar('email');\r
1592         $body = postVar('body');\r
1593 \r
1594                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1595                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE\r
1596                 # important note that '\' must be matched with '\\\\' in preg* expressions\r
1597 \r
1598                 // intercept words that are too long\r
1599                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1600                 {\r
1601                         $this->error(_ERROR_COMMENT_LONGWORD);\r
1602                 }\r
1603 \r
1604                 // check length\r
1605                 if (i18n::strlen($body) < 3)\r
1606                 {\r
1607                         $this->error(_ERROR_COMMENT_NOCOMMENT);\r
1608                 }\r
1609 \r
1610                 if (i18n::strlen($body) > 5000)\r
1611                 {\r
1612                         $this->error(_ERROR_COMMENT_TOOLONG);\r
1613                 }\r
1614 \r
1615         // prepare body\r
1616         $body = COMMENT::prepareBody($body);\r
1617 \r
1618         // call plugins\r
1619         $manager->notify('PreUpdateComment',array('body' => &$body));\r
1620 \r
1621         $query = 'UPDATE ' . sql_table('comment')\r
1622                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"\r
1623                . " WHERE cnumber = " . $commentid;\r
1624         sql_query($query);\r
1625 \r
1626         // get itemid\r
1627         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);\r
1628         $o = sql_fetch_object($res);\r
1629         $itemid = $o->citem;\r
1630 \r
1631         if ($member->canAlterItem($itemid))\r
1632             $this->action_itemcommentlist($itemid);\r
1633         else\r
1634             $this->action_browseowncomments();\r
1635 \r
1636     }\r
1637         \r
1638         /**\r
1639          * ADMIN::action_commentdelete()\r
1640          * Update comment\r
1641          * \r
1642          * @param       Void\r
1643          * @return      Void\r
1644          */\r
1645         function action_commentdelete()\r
1646         {\r
1647                 global $member, $manager;\r
1648                 \r
1649                 $commentid = intRequestVar('commentid');\r
1650                 $member->canAlterComment($commentid) or $this->disallow();\r
1651                 $comment = COMMENT::getComment($commentid);\r
1652                 \r
1653                 $body = strip_tags($comment['body']);\r
1654                 $body = ENTITY::hsc(ENTITY::shorten($body, 300, '...'));\r
1655                 \r
1656                 if ( $comment['member'] )\r
1657                 {\r
1658                         $author = $comment['member'];\r
1659                 }\r
1660                 else\r
1661                 {\r
1662                         $author = $comment['user'];\r
1663                 }\r
1664                 \r
1665                 $this->pagehead();\r
1666                 \r
1667                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";\r
1668                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";\r
1669                 echo "<div class=\"note\">\n";\r
1670                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";\r
1671                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";\r
1672                 echo "</div>\n";\r
1673                 echo "<form method=\"post\" action=\"index.php\">\n";\r
1674                 echo "<div>\n";\r
1675                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";\r
1676                 echo $manager->addTicketHidden() . "\n";\r
1677                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";\r
1678                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";\r
1679                 echo "</div>\n";\r
1680                 echo "</form>\n";\r
1681                 $this->pagefoot();\r
1682                 return;\r
1683         }\r
1684         \r
1685     /**\r
1686      * @todo document this\r
1687      */\r
1688     function action_commentdeleteconfirm() {\r
1689         global $member;\r
1690 \r
1691         $commentid = intRequestVar('commentid');\r
1692 \r
1693         // get item id first\r
1694         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);\r
1695         $o = sql_fetch_object($res);\r
1696         $itemid = $o->citem;\r
1697 \r
1698         $error = $this->deleteOneComment($commentid);\r
1699         if ($error)\r
1700             $this->doError($error);\r
1701 \r
1702         if ($member->canAlterItem($itemid))\r
1703             $this->action_itemcommentlist($itemid);\r
1704         else\r
1705             $this->action_browseowncomments();\r
1706     }\r
1707 \r
1708     /**\r
1709      * @todo document this\r
1710      */\r
1711     function deleteOneComment($commentid) {\r
1712         global $member, $manager;\r
1713 \r
1714         $commentid = intval($commentid);\r
1715 \r
1716         if (!$member->canAlterComment($commentid))\r
1717             return _ERROR_DISALLOWED;\r
1718 \r
1719         $manager->notify('PreDeleteComment', array('commentid' => $commentid));\r
1720 \r
1721         // delete the comments associated with the item\r
1722         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;\r
1723         sql_query($query);\r
1724 \r
1725         $manager->notify('PostDeleteComment', array('commentid' => $commentid));\r
1726 \r
1727         return '';\r
1728     }\r
1729 \r
1730     /**\r
1731      * Usermanagement main\r
1732      */\r
1733     function action_usermanagement() {\r
1734         global $member, $manager;\r
1735 \r
1736         // check if allowed\r
1737         $member->isAdmin() or $this->disallow();\r
1738 \r
1739         $this->pagehead();\r
1740 \r
1741         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
1742 \r
1743         echo '<h2>' . _MEMBERS_TITLE .'</h2>';\r
1744 \r
1745         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';\r
1746 \r
1747         // show list of members with actions\r
1748         $query =  'SELECT *'\r
1749                . ' FROM '.sql_table('member');\r
1750         $template['content'] = 'memberlist';\r
1751         $template['tabindex'] = 10;\r
1752 \r
1753         $manager->loadClass("ENCAPSULATE");\r
1754         $batch = new BATCH('member');\r
1755         $batch->showlist($query,'table',$template);\r
1756 \r
1757         echo '<h3>' . _MEMBERS_NEW .'</h3>';\r
1758         ?>\r
1759             <form method="post" action="index.php" name="memberedit"><div>\r
1760 \r
1761             <input type="hidden" name="action" value="memberadd" />\r
1762             <?php $manager->addTicketHidden() ?>\r
1763 \r
1764             <table>\r
1765             <tr>\r
1766                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>\r
1767             </tr><tr>\r
1768                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1769                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1770                 </td>\r
1771                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>\r
1772             </tr><tr>\r
1773                 <td><?php echo _MEMBERS_REALNAME?></td>\r
1774                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>\r
1775             </tr><tr>\r
1776                 <td><?php echo _MEMBERS_PWD?></td>\r
1777                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>\r
1778             </tr><tr>\r
1779                 <td><?php echo _MEMBERS_REPPWD?></td>\r
1780                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>\r
1781             </tr><tr>\r
1782                 <td><?php echo _MEMBERS_EMAIL?></td>\r
1783                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>\r
1784             </tr><tr>\r
1785                 <td><?php echo _MEMBERS_URL?></td>\r
1786                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>\r
1787             </tr><tr>\r
1788                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1789                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>\r
1790             </tr><tr>\r
1791                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1792                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>\r
1793             </tr><tr>\r
1794                 <td><?php echo _MEMBERS_NOTES?></td>\r
1795                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>\r
1796             </tr><tr>\r
1797                 <td><?php echo _MEMBERS_NEW?></td>\r
1798                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>\r
1799             </tr></table>\r
1800 \r
1801             </div></form>\r
1802         <?php\r
1803         $this->pagefoot();\r
1804     }\r
1805 \r
1806     /**\r
1807      * Edit member settings\r
1808      */\r
1809     function action_memberedit() {\r
1810         $this->action_editmembersettings(intRequestVar('memberid'));\r
1811     }\r
1812 \r
1813         /**\r
1814          * @todo document this\r
1815          */\r
1816         function action_editmembersettings($memberid = '') {\r
1817                 global $member, $manager, $CONF;\r
1818                 \r
1819                 if ($memberid == '')\r
1820                 {\r
1821                         $memberid = $member->getID();\r
1822                 }\r
1823                 \r
1824                 // check if allowed\r
1825                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1826                 \r
1827                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1828                 $this->pagehead($extrahead);\r
1829                 \r
1830                 // show message to go back to member overview (only for admins)\r
1831                 if ($member->isAdmin())\r
1832                 {\r
1833                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';\r
1834                 }\r
1835                 else\r
1836                 {\r
1837                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';\r
1838                 }\r
1839                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';\r
1840                 \r
1841                 $mem = MEMBER::createFromID($memberid);\r
1842                 ?>\r
1843                 <form method="post" action="index.php" name="memberedit"><div>\r
1844                 \r
1845                 <input type="hidden" name="action" value="changemembersettings" />\r
1846                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
1847                 <?php $manager->addTicketHidden() ?>\r
1848                 \r
1849                 <table><tr>\r
1850                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>\r
1851                 </tr><tr>\r
1852                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>\r
1853                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>\r
1854                         </td>\r
1855                         <td>\r
1856                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1857                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  ENTITY::hsc($mem->getDisplayName()); ?>" />\r
1858                         <?php } else {\r
1859                                 echo ENTITY::hsc($member->getDisplayName());\r
1860                            }\r
1861                         ?>\r
1862                         </td>\r
1863                 </tr><tr>\r
1864                         <td><?php echo _MEMBERS_REALNAME?></td>\r
1865                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  ENTITY::hsc($mem->getRealName()); ?>" /></td>\r
1866                 </tr><tr>\r
1867                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>\r
1868                         <td><?php echo _MEMBERS_PWD?></td>\r
1869                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>\r
1870                 </tr><tr>\r
1871                         <td><?php echo _MEMBERS_REPPWD?></td>\r
1872                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>\r
1873                 <?php } ?>\r
1874                 </tr><tr>\r
1875                         <td><?php echo _MEMBERS_EMAIL?>\r
1876                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>\r
1877                         </td>\r
1878                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($mem->getEmail()); ?>" /></td>\r
1879                 </tr><tr>\r
1880                         <td><?php echo _MEMBERS_URL?></td>\r
1881                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getURL()); ?>" /></td>\r
1882                 <?php // only allow to change this by super-admins\r
1883                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)\r
1884                    if ($member->isAdmin()) {\r
1885                 ?>\r
1886                         </tr><tr>\r
1887                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>\r
1888                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>\r
1889                         </tr><tr>\r
1890                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>\r
1891                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>\r
1892                 <?php } ?>\r
1893                 </tr><tr>\r
1894                         <td><?php echo _MEMBERS_NOTES?></td>\r
1895                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getNotes()); ?>" /></td>\r
1896                 </tr><tr>\r
1897                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>\r
1898                         </td>\r
1899                         <td>\r
1900                         \r
1901                                 <select name="locale" tabindex="85">\r
1902                                 <?php\r
1903                                 $locales = i18n::get_available_locale_list();\r
1904                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )\r
1905                                 {\r
1906                                         echo "<option value=\"\" selected=\"selected\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";\r
1907                                 }\r
1908                                 else\r
1909                                 {\r
1910                                         echo "<option value=\"\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";\r
1911                                 }\r
1912                                 \r
1913                                 foreach( $locales as $locale )\r
1914                                 {\r
1915                                         if( $locale == $mem->getLocale() )\r
1916                                         {\r
1917                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";\r
1918                                         }\r
1919                                         else\r
1920                                         {\r
1921                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";\r
1922                                         }\r
1923                                 }\r
1924                                 ?>\r
1925                                 </select>\r
1926                                 \r
1927                         </td>\r
1928                 </tr>\r
1929                 <tr>\r
1930                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>\r
1931                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>\r
1932                 </tr>\r
1933                 <?php\r
1934                         // plugin options\r
1935                         $this->_insertPluginOptions('member',$memberid);\r
1936                 ?>\r
1937                 <tr>\r
1938                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>\r
1939                 </tr><tr>\r
1940                         <td><?php echo _MEMBERS_EDIT?></td>\r
1941                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>\r
1942                 </tr></table>\r
1943                 \r
1944                 </div></form>\r
1945                 \r
1946                 <?php\r
1947                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';\r
1948                         \r
1949                         $manager->notify(\r
1950                                 'MemberSettingsFormExtras',\r
1951                                 array(\r
1952                                         'member' => &$mem\r
1953                                 )\r
1954                         );\r
1955                 $this->pagefoot();\r
1956         }\r
1957         \r
1958     /**\r
1959      * @todo document this\r
1960      */\r
1961     function action_changemembersettings() {\r
1962         global $member, $CONF, $manager;\r
1963 \r
1964         $memberid = intRequestVar('memberid');\r
1965 \r
1966         // check if allowed\r
1967         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1968 \r
1969         $name           = trim(strip_tags(postVar('name')));\r
1970         $realname       = trim(strip_tags(postVar('realname')));\r
1971         $password       = postVar('password');\r
1972         $repeatpassword = postVar('repeatpassword');\r
1973         $email          = strip_tags(postVar('email'));\r
1974         $url            = strip_tags(postVar('url'));\r
1975 \r
1976                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1977                 # original eregi: !eregi("^https?://", $url)\r
1978 \r
1979                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1980                 if (!preg_match('#^https?://#', $url) )\r
1981                 {\r
1982                         $url = 'http://' . $url;\r
1983                 }\r
1984 \r
1985         $admin          = postVar('admin');\r
1986         $canlogin       = postVar('canlogin');\r
1987         $notes          = strip_tags(postVar('notes'));\r
1988         $locale        = postVar('locale');\r
1989 \r
1990         $mem = MEMBER::createFromID($memberid);\r
1991 \r
1992         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
1993 \r
1994             if (!isValidDisplayName($name))\r
1995                 $this->error(_ERROR_BADNAME);\r
1996 \r
1997             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))\r
1998                 $this->error(_ERROR_NICKNAMEINUSE);\r
1999 \r
2000             if ($password != $repeatpassword)\r
2001                 $this->error(_ERROR_PASSWORDMISMATCH);\r
2002 \r
2003             if ($password && (i18n::strlen($password) < 6))\r
2004                 $this->error(_ERROR_PASSWORDTOOSHORT);\r
2005                 \r
2006             if ($password) {\r
2007                                 $pwdvalid = true;\r
2008                                 $pwderror = '';\r
2009                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));\r
2010                                 if (!$pwdvalid) {\r
2011                                         $this->error($pwderror);\r
2012                                 }\r
2013                         }\r
2014                 }\r
2015                 \r
2016                 if ( !NOTIFICATION::address_validation($email) )\r
2017                 {\r
2018                         $this->error(_ERROR_BADMAILADDRESS);\r
2019                 }\r
2020                 if ( !$realname )\r
2021                 {\r
2022                         $this->error(_ERROR_REALNAMEMISSING);\r
2023                 }\r
2024         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
2025             $this->error(_ERROR_NOSUCHTRANSLATION);\r
2026 \r
2027         // check if there will remain at least one site member with both the logon and admin rights\r
2028         // (check occurs when taking away one of these rights from such a member)\r
2029         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
2030              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
2031            )\r
2032         {\r
2033             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
2034             if (sql_num_rows($r) < 2)\r
2035                 $this->error(_ERROR_ATLEASTONEADMIN);\r
2036         }\r
2037 \r
2038         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
2039             $mem->setDisplayName($name);\r
2040             if ($password)\r
2041                 $mem->setPassword($password);\r
2042         }\r
2043 \r
2044         $oldEmail = $mem->getEmail();\r
2045 \r
2046         $mem->setRealName($realname);\r
2047         $mem->setEmail($email);\r
2048         $mem->setURL($url);\r
2049         $mem->setNotes($notes);\r
2050         $mem->setLocale($locale);\r
2051 \r
2052 \r
2053         // only allow super-admins to make changes to the admin status\r
2054         if ($member->isAdmin()) {\r
2055             $mem->setAdmin($admin);\r
2056             $mem->setCanLogin($canlogin);\r
2057         }\r
2058 \r
2059         $autosave = postVar ('autosave');\r
2060         $mem->setAutosave($autosave);\r
2061 \r
2062         $mem->write();\r
2063 \r
2064         // store plugin options\r
2065         $aOptions = requestArray('plugoption');\r
2066         NucleusPlugin::apply_plugin_options($aOptions);\r
2067         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));\r
2068 \r
2069         // if email changed, generate new password\r
2070         if ($oldEmail != $mem->getEmail())\r
2071         {\r
2072             $mem->sendActivationLink('addresschange', $oldEmail);\r
2073             // logout member\r
2074             $mem->newCookieKey();\r
2075 \r
2076             // only log out if the member being edited is the current member.\r
2077             if ($member->getID() == $memberid)\r
2078                 $member->logout();\r
2079             $this->action_login(_MSG_ACTIVATION_SENT, 0);\r
2080             return;\r
2081         }\r
2082 \r
2083 \r
2084         if (  ( $mem->getID() == $member->getID() )\r
2085            && ( $mem->getDisplayName() != $member->getDisplayName() )\r
2086            ) {\r
2087             $mem->newCookieKey();\r
2088             $member->logout();\r
2089             $this->action_login(_MSG_LOGINAGAIN, 0);\r
2090         } else {\r
2091             $this->action_overview(_MSG_SETTINGSCHANGED);\r
2092         }\r
2093     }\r
2094 \r
2095     /**\r
2096      * @todo document this\r
2097      */\r
2098     function action_memberadd() {\r
2099         global $member, $manager;\r
2100 \r
2101         // check if allowed\r
2102         $member->isAdmin() or $this->disallow();\r
2103 \r
2104         if (postVar('password') != postVar('repeatpassword'))\r
2105             $this->error(_ERROR_PASSWORDMISMATCH);\r
2106         if (i18n::strlen(postVar('password')) < 6)\r
2107             $this->error(_ERROR_PASSWORDTOOSHORT);\r
2108 \r
2109         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));\r
2110         if ($res != 1)\r
2111             $this->error($res);\r
2112 \r
2113         // fire PostRegister event\r
2114         $newmem = new MEMBER();\r
2115         $newmem->readFromName(postVar('name'));\r
2116         $manager->notify('PostRegister',array('member' => &$newmem));\r
2117 \r
2118         $this->action_usermanagement();\r
2119     }\r
2120 \r
2121     /**\r
2122      * Account activation\r
2123      *\r
2124      * @author dekarma\r
2125      */\r
2126     function action_activate() {\r
2127 \r
2128         $key = getVar('key');\r
2129         $this->_showActivationPage($key);\r
2130     }\r
2131 \r
2132     /**\r
2133      * @todo document this\r
2134      */\r
2135     function _showActivationPage($key, $message = '')\r
2136     {\r
2137         global $manager;\r
2138 \r
2139         // clean up old activation keys\r
2140         MEMBER::cleanupActivationTable();\r
2141 \r
2142         // get activation info\r
2143         $info = MEMBER::getActivationInfo($key);\r
2144 \r
2145         if (!$info)\r
2146             $this->error(_ERROR_ACTIVATE);\r
2147 \r
2148         $mem = MEMBER::createFromId($info->vmember);\r
2149 \r
2150         if (!$mem)\r
2151             $this->error(_ERROR_ACTIVATE);\r
2152 \r
2153         $text = '';\r
2154         $title = '';\r
2155         $bNeedsPasswordChange = true;\r
2156 \r
2157         switch ($info->vtype)\r
2158         {\r
2159             case 'forgot':\r
2160                 $title = _ACTIVATE_FORGOT_TITLE;\r
2161                 $text = _ACTIVATE_FORGOT_TEXT;\r
2162                 break;\r
2163             case 'register':\r
2164                 $title = _ACTIVATE_REGISTER_TITLE;\r
2165                 $text = _ACTIVATE_REGISTER_TEXT;\r
2166                 break;\r
2167             case 'addresschange':\r
2168                 $title = _ACTIVATE_CHANGE_TITLE;\r
2169                 $text = _ACTIVATE_CHANGE_TEXT;\r
2170                 $bNeedsPasswordChange = false;\r
2171                 MEMBER::activate($key);\r
2172                 break;\r
2173         }\r
2174 \r
2175         $aVars = array(\r
2176             'memberName' => ENTITY::hsc($mem->getDisplayName())\r
2177         );\r
2178         $title = TEMPLATE::fill($title, $aVars);\r
2179         $text = TEMPLATE::fill($text, $aVars);\r
2180 \r
2181         $this->pagehead();\r
2182 \r
2183             echo '<h2>' , $title, '</h2>';\r
2184             echo '<p>' , $text, '</p>';\r
2185 \r
2186             if ($message != '')\r
2187             {\r
2188                 echo '<p class="error">',$message,'</p>';\r
2189             }\r
2190 \r
2191             if ($bNeedsPasswordChange)\r
2192             {\r
2193                 ?>\r
2194                     <div><form action="index.php" method="post">\r
2195 \r
2196                         <input type="hidden" name="action" value="activatesetpwd" />\r
2197                         <?php $manager->addTicketHidden() ?>\r
2198                         <input type="hidden" name="key" value="<?php echo ENTITY::hsc($key) ?>" />\r
2199 \r
2200                         <table><tr>\r
2201                             <td><?php echo _MEMBERS_PWD?></td>\r
2202                             <td><input type="password" maxlength="40" size="16" name="password" /></td>\r
2203                         </tr><tr>\r
2204                             <td><?php echo _MEMBERS_REPPWD?></td>\r
2205                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>\r
2206                         <?php\r
2207 \r
2208                             global $manager;\r
2209                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));\r
2210 \r
2211                         ?>\r
2212                         </tr><tr>\r
2213                             <td><?php echo _MEMBERS_SETPWD ?></td>\r
2214                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>\r
2215                         </tr></table>\r
2216 \r
2217 \r
2218                     </form></div>\r
2219 \r
2220                 <?php\r
2221 \r
2222             }\r
2223 \r
2224         $this->pagefoot();\r
2225 \r
2226     }\r
2227 \r
2228     /**\r
2229      * Account activation - set password part\r
2230      *\r
2231      * @author dekarma\r
2232      */\r
2233     function action_activatesetpwd() {\r
2234 \r
2235         $key = postVar('key');\r
2236 \r
2237         // clean up old activation keys\r
2238         MEMBER::cleanupActivationTable();\r
2239 \r
2240         // get activation info\r
2241         $info = MEMBER::getActivationInfo($key);\r
2242 \r
2243         if (!$info || ($info->type == 'addresschange'))\r
2244             return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2245 \r
2246         $mem = MEMBER::createFromId($info->vmember);\r
2247 \r
2248         if (!$mem)\r
2249             return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
2250 \r
2251         $password       = postVar('password');\r
2252         $repeatpassword = postVar('repeatpassword');\r
2253 \r
2254         if ($password != $repeatpassword)\r
2255             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
2256 \r
2257         if ($password && (i18n::strlen($password) < 6))\r
2258             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
2259             \r
2260         if ($password) {\r
2261                         $pwdvalid = true;\r
2262                         $pwderror = '';\r
2263                         global $manager;\r
2264                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));\r
2265                         if (!$pwdvalid) {\r
2266                                 return $this->_showActivationPage($key,$pwderror);\r
2267                         }\r
2268                 }\r
2269 \r
2270         $error = '';\r
2271         \r
2272         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));\r
2273         if ($error != '')\r
2274             return $this->_showActivationPage($key, $error);\r
2275 \r
2276 \r
2277         // set password\r
2278         $mem->setPassword($password);\r
2279         $mem->write();\r
2280 \r
2281         // do the activation\r
2282         MEMBER::activate($key);\r
2283 \r
2284         $this->pagehead();\r
2285             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';\r
2286             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';\r
2287         $this->pagefoot();\r
2288     }\r
2289 \r
2290     /**\r
2291      * Manage team\r
2292      */\r
2293     function action_manageteam() {\r
2294         global $member, $manager;\r
2295 \r
2296         $blogid = intRequestVar('blogid');\r
2297 \r
2298         // check if allowed\r
2299         $member->blogAdminRights($blogid) or $this->disallow();\r
2300 \r
2301         $this->pagehead();\r
2302 \r
2303         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";\r
2304 \r
2305         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';\r
2306 \r
2307         echo '<h3>' . _TEAM_CURRENT . '</h3>';\r
2308 \r
2309 \r
2310 \r
2311         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'\r
2312                . ' FROM '.sql_table('member').', '.sql_table('team')\r
2313                . ' WHERE tmember=mnumber and tblog=' . $blogid;\r
2314 \r
2315         $template['content'] = 'teamlist';\r
2316         $template['tabindex'] = 10;\r
2317 \r
2318         $manager->loadClass("ENCAPSULATE");\r
2319         $batch = new BATCH('team');\r
2320         $batch->showlist($query, 'table', $template);\r
2321 \r
2322         ?>\r
2323             <h3><?php echo _TEAM_ADDNEW?></h3>\r
2324 \r
2325             <form method='post' action='index.php'><div>\r
2326 \r
2327             <input type='hidden' name='action' value='teamaddmember' />\r
2328             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />\r
2329             <?php $manager->addTicketHidden() ?>\r
2330 \r
2331             <table><tr>\r
2332                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>\r
2333                 <td><?php                   // TODO: try to make it so only non-team-members are listed\r
2334                     $query =  'SELECT mname as text, mnumber as value'\r
2335                            . ' FROM '.sql_table('member');\r
2336 \r
2337                     $template['name'] = 'memberid';\r
2338                     $template['tabindex'] = 10000;\r
2339                     showlist($query,'select',$template);\r
2340                 ?></td>\r
2341             </tr><tr>\r
2342                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>\r
2343                 <td><?php $this->input_yesno('admin',0,10020); ?></td>\r
2344             </tr><tr>\r
2345                 <td><?php echo _TEAM_ADD?></td>\r
2346                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>\r
2347             </tr></table>\r
2348 \r
2349             </div></form>\r
2350         <?php\r
2351         $this->pagefoot();\r
2352     }\r
2353 \r
2354     /**\r
2355      * Add member to team\r
2356      */\r
2357     function action_teamaddmember() {\r
2358         global $member, $manager;\r
2359 \r
2360         $memberid = intPostVar('memberid');\r
2361         $blogid = intPostVar('blogid');\r
2362         $admin = intPostVar('admin');\r
2363 \r
2364         // check if allowed\r
2365         $member->blogAdminRights($blogid) or $this->disallow();\r
2366 \r
2367         $blog =& $manager->getBlog($blogid);\r
2368         if (!$blog->addTeamMember($memberid, $admin))\r
2369             $this->error(_ERROR_ALREADYONTEAM);\r
2370 \r
2371         $this->action_manageteam();\r
2372 \r
2373     }\r
2374 \r
2375     /**\r
2376      * @todo document this\r
2377      */\r
2378     function action_teamdelete() {\r
2379         global $member, $manager;\r
2380 \r
2381         $memberid = intRequestVar('memberid');\r
2382         $blogid = intRequestVar('blogid');\r
2383 \r
2384         // check if allowed\r
2385         $member->blogAdminRights($blogid) or $this->disallow();\r
2386 \r
2387         $teammem = MEMBER::createFromID($memberid);\r
2388         $blog =& $manager->getBlog($blogid);\r
2389 \r
2390         $this->pagehead();\r
2391         ?>\r
2392             <h2><?php echo _DELETE_CONFIRM?></h2>\r
2393 \r
2394             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  ENTITY::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  ENTITY::hsc(strip_tags($blog->getName())) ?></b>\r
2395             </p>\r
2396 \r
2397 \r
2398             <form method="post" action="index.php"><div>\r
2399             <input type="hidden" name="action" value="teamdeleteconfirm" />\r
2400             <?php $manager->addTicketHidden() ?>\r
2401             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
2402             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2403             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
2404             </div></form>\r
2405         <?php\r
2406         $this->pagefoot();\r
2407     }\r
2408 \r
2409     /**\r
2410      * @todo document this\r
2411      */\r
2412     function action_teamdeleteconfirm() {\r
2413         global $member;\r
2414 \r
2415         $memberid = intRequestVar('memberid');\r
2416         $blogid = intRequestVar('blogid');\r
2417 \r
2418         $error = $this->deleteOneTeamMember($blogid, $memberid);\r
2419         if ($error)\r
2420             $this->error($error);\r
2421 \r
2422 \r
2423         $this->action_manageteam();\r
2424     }\r
2425 \r
2426     /**\r
2427      * @todo document this\r
2428      */\r
2429     function deleteOneTeamMember($blogid, $memberid) {\r
2430         global $member, $manager;\r
2431 \r
2432         $blogid = intval($blogid);\r
2433         $memberid = intval($memberid);\r
2434 \r
2435         // check if allowed\r
2436         if (!$member->blogAdminRights($blogid))\r
2437             return _ERROR_DISALLOWED;\r
2438 \r
2439         // check if: - there remains at least one blog admin\r
2440         //           - (there remains at least one team member)\r
2441         $tmem = MEMBER::createFromID($memberid);\r
2442 \r
2443         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));\r
2444 \r
2445         if ($tmem->isBlogAdmin($blogid)) {\r
2446             // check if there are more blog members left and at least one admin\r
2447             // (check for at least two admins before deletion)\r
2448             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';\r
2449             $r = sql_query($query);\r
2450             if (sql_num_rows($r) < 2)\r
2451                 return _ERROR_ATLEASTONEBLOGADMIN;\r
2452         }\r
2453 \r
2454         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";\r
2455         sql_query($query);\r
2456 \r
2457         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));\r
2458 \r
2459         return '';\r
2460     }\r
2461 \r
2462     /**\r
2463      * @todo document this\r
2464      */\r
2465     function action_teamchangeadmin() {\r
2466         global $member;\r
2467 \r
2468         $blogid = intRequestVar('blogid');\r
2469         $memberid = intRequestVar('memberid');\r
2470 \r
2471         // check if allowed\r
2472         $member->blogAdminRights($blogid) or $this->disallow();\r
2473 \r
2474         $mem = MEMBER::createFromID($memberid);\r
2475 \r
2476         // don't allow when there is only one admin at this moment\r
2477         if ($mem->isBlogAdmin($blogid)) {\r
2478             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");\r
2479             if (sql_num_rows($r) == 1)\r
2480                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);\r
2481         }\r
2482 \r
2483         if ($mem->isBlogAdmin($blogid))\r
2484             $newval = 0;\r
2485         else\r
2486             $newval = 1;\r
2487 \r
2488         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";\r
2489         sql_query($query);\r
2490 \r
2491         // only show manageteam if member did not change its own admin privileges\r
2492         if ($member->isBlogAdmin($blogid))\r
2493             $this->action_manageteam();\r
2494         else\r
2495             $this->action_overview(_MSG_ADMINCHANGED);\r
2496     }\r
2497 \r
2498     /**\r
2499      * @todo document this\r
2500      */\r
2501     function action_blogsettings() {\r
2502         global $member, $manager;\r
2503 \r
2504         $blogid = intRequestVar('blogid');\r
2505 \r
2506         // check if allowed\r
2507         $member->blogAdminRights($blogid) or $this->disallow();\r
2508 \r
2509         $blog =& $manager->getBlog($blogid);\r
2510 \r
2511         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2512         $this->pagehead($extrahead);\r
2513 \r
2514         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
2515         ?>\r
2516         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>\r
2517 \r
2518         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>\r
2519 \r
2520         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>\r
2521         <?php\r
2522             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));\r
2523             $aMemberNames = array();\r
2524             while ($o = sql_fetch_object($res))\r
2525                 array_push($aMemberNames, ENTITY::hsc($o->mname) . ' (' . ENTITY::hsc($o->mrealname). ')');\r
2526             echo implode(',', $aMemberNames);\r
2527         ?>\r
2528         </p>\r
2529 \r
2530 \r
2531 \r
2532         <p>\r
2533         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>\r
2534         </p>\r
2535 \r
2536         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>\r
2537 \r
2538         <form method="post" action="index.php"><div>\r
2539 \r
2540         <input type="hidden" name="action" value="blogsettingsupdate" />\r
2541         <?php $manager->addTicketHidden() ?>\r
2542         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
2543         <table><tr>\r
2544             <td><?php echo _EBLOG_NAME?></td>\r
2545             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getName()) ?>" /></td>\r
2546         </tr><tr>\r
2547             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>\r
2548                 <?php echo _EBLOG_SHORTNAME_EXTRA?>\r
2549             </td>\r
2550             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  ENTITY::hsc($blog->getShortName()) ?>" /></td>\r
2551         </tr><tr>\r
2552             <td><?php echo _EBLOG_DESC?></td>\r
2553             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  ENTITY::hsc($blog->getDescription()) ?>" /></td>\r
2554         </tr><tr>\r
2555             <td><?php echo _EBLOG_URL?></td>\r
2556             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($blog->getURL()) ?>" /></td>\r
2557         </tr><tr>\r
2558             <td><?php echo _EBLOG_DEFSKIN?>\r
2559                 <?php help('blogdefaultskin'); ?>\r
2560             </td>\r
2561             <td>\r
2562                 <?php\r
2563                     $query =  'SELECT sdname as text, sdnumber as value'\r
2564                            . ' FROM '.sql_table('skin_desc');\r
2565                     $template['name'] = 'defskin';\r
2566                     $template['selected'] = $blog->getDefaultSkin();\r
2567                     $template['tabindex'] = 50;\r
2568                     showlist($query,'select',$template);\r
2569                 ?>\r
2570 \r
2571             </td>\r
2572         </tr><tr>\r
2573             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>\r
2574             </td>\r
2575             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>\r
2576         </tr><tr>\r
2577             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>\r
2578             </td>\r
2579             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>\r
2580         </tr><tr>\r
2581             <td><?php echo _EBLOG_DISABLECOMMENTS?>\r
2582             </td>\r
2583             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>\r
2584         </tr><tr>\r
2585             <td><?php echo _EBLOG_ANONYMOUS?>\r
2586             </td>\r
2587             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>\r
2588         </tr><tr>\r
2589     <td><?php echo _EBLOG_REQUIREDEMAIL?>\r
2590          </td>\r
2591          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>\r
2592       </tr><tr>\r
2593             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>\r
2594             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  ENTITY::hsc($blog->getNotifyAddress()); ?>" /></td>\r
2595         </tr><tr>\r
2596             <td><?php echo _EBLOG_NOTIFY_ON?></td>\r
2597             <td>\r
2598                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"\r
2599                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>\r
2600                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>\r
2601                 <br />\r
2602                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"\r
2603                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>\r
2604                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>\r
2605                 <br />\r
2606                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"\r
2607                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>\r
2608                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>\r
2609             </td>\r
2610         </tr><tr>\r
2611             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>\r
2612             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  ENTITY::hsc($blog->getMaxComments()); ?>" /></td>\r
2613         </tr><tr>\r
2614             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>\r
2615             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getUpdateFile()) ?>" /></td>\r
2616         </tr><tr>\r
2617             <td><?php echo _EBLOG_DEFCAT?></td>\r
2618             <td>\r
2619                 <?php\r
2620                     $query =  'SELECT cname as text, catid as value'\r
2621                            . ' FROM '.sql_table('category')\r
2622                            . ' WHERE cblog=' . $blog->getID();\r
2623                     $template['name'] = 'defcat';\r
2624                     $template['selected'] = $blog->getDefaultCategory();\r
2625                     $template['tabindex'] = 110;\r
2626                     showlist($query,'select',$template);\r
2627                 ?>\r
2628             </td>\r
2629         </tr><tr>\r
2630             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>\r
2631                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', time()); ?></b>\r
2632                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', $blog->getCorrectTime()); ?></b>\r
2633                 </td>\r
2634             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  ENTITY::hsc($blog->getTimeOffset()); ?>" /></td>\r
2635         </tr><tr>\r
2636             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>\r
2637             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>\r
2638         </tr>\r
2639         <?php\r
2640             // plugin options\r
2641             $this->_insertPluginOptions('blog',$blogid);\r
2642         ?>\r
2643         <tr>\r
2644             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>\r
2645         </tr><tr>\r
2646             <td><?php echo _EBLOG_CHANGE?></td>\r
2647             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>\r
2648         </tr></table>\r
2649 \r
2650         </div></form>\r
2651 \r
2652         <h3><?php echo _EBLOG_CAT_TITLE?></h3>\r
2653 \r
2654 \r
2655         <?php\r
2656         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';\r
2657         $template['content'] = 'categorylist';\r
2658         $template['tabindex'] = 200;\r
2659 \r
2660         $manager->loadClass("ENCAPSULATE");\r
2661         $batch = new BATCH('category');\r
2662         $batch->showlist($query,'table',$template);\r
2663 \r
2664         ?>\r
2665 \r
2666 \r
2667         <form action="index.php" method="post"><div>\r
2668         <input name="action" value="categorynew" type="hidden" />\r
2669         <?php $manager->addTicketHidden() ?>\r
2670         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />\r
2671 \r
2672         <table><tr>\r
2673             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>\r
2674         </tr><tr>\r
2675             <td><?php echo _EBLOG_CAT_NAME?></td>\r
2676             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>\r
2677         </tr><tr>\r
2678             <td><?php echo _EBLOG_CAT_DESC?></td>\r
2679             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>\r
2680         </tr><tr>\r
2681             <td><?php echo _EBLOG_CAT_CREATE?></td>\r
2682             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>\r
2683         </tr></table>\r
2684 \r
2685         </div></form>\r
2686 \r
2687         <?php\r
2688 \r
2689             echo '<h3>',_PLUGINS_EXTRA,'</h3>';\r
2690 \r
2691             $manager->notify(\r
2692                 'BlogSettingsFormExtras',\r
2693                 array(\r
2694                     'blog' => &$blog\r
2695                 )\r
2696             );\r
2697 \r
2698         $this->pagefoot();\r
2699     }\r
2700 \r
2701     /**\r
2702      * @todo document this\r
2703      */\r
2704     function action_categorynew() {\r
2705         global $member, $manager;\r
2706 \r
2707         $blogid = intRequestVar('blogid');\r
2708 \r
2709         $member->blogAdminRights($blogid) or $this->disallow();\r
2710 \r
2711         $cname = postVar('cname');\r
2712         $cdesc = postVar('cdesc');\r
2713 \r
2714         if (!isValidCategoryName($cname))\r
2715             $this->error(_ERROR_BADCATEGORYNAME);\r
2716 \r
2717         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);\r
2718         $res = sql_query($query);\r
2719         if (sql_num_rows($res) > 0)\r
2720             $this->error(_ERROR_DUPCATEGORYNAME);\r
2721 \r
2722         $blog       =& $manager->getBlog($blogid);\r
2723         $newCatID   =  $blog->createNewCategory($cname, $cdesc);\r
2724 \r
2725         $this->action_blogsettings();\r
2726     }\r
2727 \r
2728     /**\r
2729      * @todo document this\r
2730      */\r
2731     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {\r
2732         global $member, $manager;\r
2733 \r
2734         if ($blogid == '')\r
2735             $blogid = intGetVar('blogid');\r
2736         else\r
2737             $blogid = intval($blogid);\r
2738         if ($catid == '')\r
2739             $catid = intGetVar('catid');\r
2740         else\r
2741             $catid = intval($catid);\r
2742 \r
2743         $member->blogAdminRights($blogid) or $this->disallow();\r
2744 \r
2745         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");\r
2746         $obj = sql_fetch_object($res);\r
2747 \r
2748         $cname = $obj->cname;\r
2749         $cdesc = $obj->cdesc;\r
2750 \r
2751         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2752         $this->pagehead($extrahead);\r
2753 \r
2754         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";\r
2755 \r
2756         ?>\r
2757         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo ENTITY::hsc($cname)?>'</h2>\r
2758         <form method='post' action='index.php'><div>\r
2759         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />\r
2760         <input name="catid" type="hidden" value="<?php echo $catid?>" />\r
2761         <input name="desturl" type="hidden" value="<?php echo ENTITY::hsc($desturl) ?>" />\r
2762         <input name="action" type="hidden" value="categoryupdate" />\r
2763         <?php $manager->addTicketHidden(); ?>\r
2764 \r
2765         <table><tr>\r
2766             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>\r
2767         </tr><tr>\r
2768             <td><?php echo _EBLOG_CAT_NAME?></td>\r
2769             <td><input type="text" name="cname" value="<?php echo ENTITY::hsc($cname)?>" size="40" maxlength="40" /></td>\r
2770         </tr><tr>\r
2771             <td><?php echo _EBLOG_CAT_DESC?></td>\r
2772             <td><input type="text" name="cdesc" value="<?php echo ENTITY::hsc($cdesc)?>" size="40" maxlength="200" /></td>\r
2773         </tr>\r
2774         <?php\r
2775             // insert plugin options\r
2776             $this->_insertPluginOptions('category',$catid);\r
2777         ?>\r
2778         <tr>\r
2779             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>\r
2780         </tr><tr>\r
2781             <td><?php echo _EBLOG_CAT_UPDATE?></td>\r
2782             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>\r
2783         </tr></table>\r
2784 \r
2785         </div></form>\r
2786         <?php\r
2787         $this->pagefoot();\r
2788     }\r
2789 \r
2790     /**\r
2791      * @todo document this\r
2792      */\r
2793     function action_categoryupdate() {\r
2794         global $member, $manager;\r
2795 \r
2796         $blogid = intPostVar('blogid');\r
2797         $catid = intPostVar('catid');\r
2798         $cname = postVar('cname');\r
2799         $cdesc = postVar('cdesc');\r
2800         $desturl = postVar('desturl');\r
2801 \r
2802         $member->blogAdminRights($blogid) or $this->disallow();\r
2803 \r
2804         if (!isValidCategoryName($cname))\r
2805             $this->error(_ERROR_BADCATEGORYNAME);\r
2806 \r
2807         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";\r
2808         $res = sql_query($query);\r
2809         if (sql_num_rows($res) > 0)\r
2810             $this->error(_ERROR_DUPCATEGORYNAME);\r
2811 \r
2812         $query =  'UPDATE '.sql_table('category').' SET'\r
2813                . " cname='" . sql_real_escape_string($cname) . "',"\r
2814                . " cdesc='" . sql_real_escape_string($cdesc) . "'"\r
2815                . " WHERE catid=" . $catid;\r
2816 \r
2817         sql_query($query);\r
2818 \r
2819         // store plugin options\r
2820         $aOptions = requestArray('plugoption');\r
2821         NucleusPlugin::apply_plugin_options($aOptions);\r
2822         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));\r
2823 \r
2824 \r
2825         if ($desturl) {\r
2826             redirect($desturl);\r
2827             exit;\r
2828         } else {\r
2829             $this->action_blogsettings();\r
2830         }\r
2831     }\r
2832 \r
2833     /**\r
2834      * @todo document this\r
2835      */\r
2836     function action_categorydelete() {\r
2837         global $member, $manager;\r
2838 \r
2839         $blogid = intRequestVar('blogid');\r
2840         $catid = intRequestVar('catid');\r
2841 \r
2842         $member->blogAdminRights($blogid) or $this->disallow();\r
2843 \r
2844         $blog =& $manager->getBlog($blogid);\r
2845 \r
2846         // check if the category is valid\r
2847         if (!$blog->isValidCategory($catid))\r
2848             $this->error(_ERROR_NOSUCHCATEGORY);\r
2849 \r
2850         // don't allow deletion of default category\r
2851         if ($blog->getDefaultCategory() == $catid)\r
2852             $this->error(_ERROR_DELETEDEFCATEGORY);\r
2853 \r
2854         // check if catid is the only category left for blogid\r
2855         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;\r
2856         $res = sql_query($query);\r
2857         if (sql_num_rows($res) == 1)\r
2858             $this->error(_ERROR_DELETELASTCATEGORY);\r
2859 \r
2860 \r
2861         $this->pagehead();\r
2862         ?>\r
2863             <h2><?php echo _DELETE_CONFIRM?></h2>\r
2864 \r
2865             <div>\r
2866             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  ENTITY::hsc($blog->getCategoryName($catid))?></b>\r
2867             </div>\r
2868 \r
2869             <form method="post" action="index.php"><div>\r
2870             <input type="hidden" name="action" value="categorydeleteconfirm" />\r
2871             <?php $manager->addTicketHidden() ?>\r
2872             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
2873             <input type="hidden" name="catid" value="<?php echo $catid?>" />\r
2874             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
2875             </div></form>\r
2876         <?php\r
2877         $this->pagefoot();\r
2878     }\r
2879 \r
2880     /**\r
2881      * @todo document this\r
2882      */\r
2883     function action_categorydeleteconfirm() {\r
2884         global $member, $manager;\r
2885 \r
2886         $blogid = intRequestVar('blogid');\r
2887         $catid = intRequestVar('catid');\r
2888 \r
2889         $member->blogAdminRights($blogid) or $this->disallow();\r
2890 \r
2891         $error = $this->deleteOneCategory($catid);\r
2892         if ($error)\r
2893             $this->error($error);\r
2894 \r
2895         $this->action_blogsettings();\r
2896     }\r
2897         \r
2898         /**\r
2899          * ADMIN::deleteOneCategory()\r
2900          * Delete a category by its id\r
2901          * \r
2902          * @param       String  $catid  category id for deleting\r
2903          * @return      Void\r
2904          */\r
2905         function deleteOneCategory($catid)\r
2906         {\r
2907                 global $manager, $member;\r
2908                 \r
2909                 $catid = intval($catid);\r
2910                 $blogid = getBlogIDFromCatID($catid);\r
2911                 \r
2912                 if ( !$member->blogAdminRights($blogid) )\r
2913                 {\r
2914                         return ERROR_DISALLOWED;\r
2915                 }\r
2916                 \r
2917                 // get blog\r
2918                 $blog =& $manager->getBlog($blogid);\r
2919                 \r
2920                 // check if the category is valid\r
2921                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2922                 {\r
2923                         return _ERROR_NOSUCHCATEGORY;\r
2924                 }\r
2925                 \r
2926                 $destcatid = $blog->getDefaultCategory();\r
2927                 \r
2928                 // don't allow deletion of default category\r
2929                 if ( $blog->getDefaultCategory() == $catid )\r
2930                 {\r
2931                         return _ERROR_DELETEDEFCATEGORY;\r
2932                 }\r
2933                 \r
2934                 // check if catid is the only category left for blogid\r
2935                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;\r
2936                 $res = sql_query($query);\r
2937                 if ( sql_num_rows($res) == 1 )\r
2938                 {\r
2939                         return _ERROR_DELETELASTCATEGORY;\r
2940                 }\r
2941                 \r
2942                 $manager->notify('PreDeleteCategory', array('catid' => $catid));\r
2943                 \r
2944                 // change category for all items to the default category\r
2945                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";\r
2946                 sql_query($query);\r
2947                 \r
2948                 // delete all associated plugin options\r
2949                 NucleusPlugin::delete_option_values('category', $catid);\r
2950                 \r
2951                 // delete category\r
2952                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;\r
2953                 sql_query($query);\r
2954                 \r
2955                 $manager->notify('PostDeleteCategory', array('catid' => $catid));\r
2956                 return;\r
2957         }\r
2958         \r
2959         /**\r
2960          * ADMIN::action_blogsettingsupdate\r
2961          * Updating blog settings\r
2962          * \r
2963          * @param       Void\r
2964          * @return      Void\r
2965          */\r
2966         function action_blogsettingsupdate()\r
2967         {\r
2968                 global $member, $manager;\r
2969                 \r
2970                 $blogid = intRequestVar('blogid');\r
2971                 \r
2972                 $member->blogAdminRights($blogid) or $this->disallow();\r
2973                 \r
2974                 $blog =& $manager->getBlog($blogid);\r
2975                 \r
2976                 $notify_address = trim(postVar('notify'));\r
2977                 $shortname              = trim(postVar('shortname'));\r
2978                 $updatefile     = trim(postVar('update'));\r
2979                 \r
2980                 $notifyComment  = intPostVar('notifyComment');\r
2981                 $notifyVote             = intPostVar('notifyVote');\r
2982                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2983                 \r
2984                 if ( $notifyComment == 0 )\r
2985                 {\r
2986                         $notifyComment = 1;\r
2987                 }\r
2988                 if ( $notifyVote == 0 )\r
2989                 {\r
2990                         $notifyVote = 1;\r
2991                 }\r
2992                 if ( $notifyNewItem == 0 )\r
2993                 {\r
2994                         $notifyNewItem = 1;\r
2995                 }\r
2996                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2997                 \r
2998                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2999                 {\r
3000                         $this->error(_ERROR_BADNOTIFY);\r
3001                 }\r
3002                 \r
3003                 if ( !isValidShortName($shortname) )\r
3004                 {\r
3005                         $this->error(_ERROR_BADSHORTBLOGNAME);\r
3006                 }\r
3007                 \r
3008                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
3009                 {\r
3010                         $this->error(_ERROR_DUPSHORTBLOGNAME);\r
3011                 }\r
3012                 // check if update file is writable\r
3013                 if ( $updatefile && !is_writeable($updatefile) )\r
3014                 {\r
3015                         $this->error(_ERROR_UPDATEFILE);\r
3016                 }\r
3017                 \r
3018                 $blog->setName(trim(postVar('name')));\r
3019                 $blog->setShortName($shortname);\r
3020                 $blog->setNotifyAddress($notify_address);\r
3021                 $blog->setNotifyType($notifyType);\r
3022                 $blog->setMaxComments(postVar('maxcomments'));\r
3023                 $blog->setCommentsEnabled(postVar('comments'));\r
3024                 $blog->setTimeOffset(postVar('timeoffset'));\r
3025                 $blog->setUpdateFile($updatefile);\r
3026                 $blog->setURL(trim(postVar('url')));\r
3027                 $blog->setDefaultSkin(intPostVar('defskin'));\r
3028                 $blog->setDescription(trim(postVar('desc')));\r
3029                 $blog->setPublic(postVar('public'));\r
3030                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
3031                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
3032                 $blog->setDefaultCategory(intPostVar('defcat'));\r
3033                 $blog->setSearchable(intPostVar('searchable'));\r
3034                 $blog->setEmailRequired(intPostVar('reqemail'));\r
3035                 $blog->writeSettings();\r
3036                 \r
3037                 // store plugin options\r
3038                 $aOptions = requestArray('plugoption');\r
3039                 NucleusPlugin::apply_plugin_options($aOptions);\r
3040                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));\r
3041                 \r
3042                 $this->action_overview(_MSG_SETTINGSCHANGED);\r
3043                 return;\r
3044         }\r
3045 \r
3046     /**\r
3047      * @todo document this\r
3048      */\r
3049     function action_deleteblog() {\r
3050         global $member, $CONF, $manager;\r
3051 \r
3052         $blogid = intRequestVar('blogid');\r
3053 \r
3054         $member->blogAdminRights($blogid) or $this->disallow();\r
3055 \r
3056         // check if blog is default blog\r
3057         if ($CONF['DefaultBlog'] == $blogid)\r
3058             $this->error(_ERROR_DELDEFBLOG);\r
3059 \r
3060         $blog =& $manager->getBlog($blogid);\r
3061 \r
3062         $this->pagehead();\r
3063         ?>\r
3064             <h2><?php echo _DELETE_CONFIRM?></h2>\r
3065 \r
3066             <p><?php echo _WARNINGTXT_BLOGDEL?>\r
3067             </p>\r
3068 \r
3069             <div>\r
3070             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  ENTITY::hsc($blog->getName())?></b>\r
3071             </div>\r
3072 \r
3073             <form method="post" action="index.php"><div>\r
3074             <input type="hidden" name="action" value="deleteblogconfirm" />\r
3075             <?php $manager->addTicketHidden() ?>\r
3076             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />\r
3077             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
3078             </div></form>\r
3079         <?php\r
3080         $this->pagefoot();\r
3081     }\r
3082         \r
3083         /**\r
3084          * ADMIN::action_deleteblogconfirm()\r
3085          * Delete Blog\r
3086          * \r
3087          * @param       Void\r
3088          * @return      Void\r
3089          */\r
3090         function action_deleteblogconfirm()\r
3091         {\r
3092                 global $member, $CONF, $manager;\r
3093                 \r
3094                 $blogid = intRequestVar('blogid');\r
3095                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));\r
3096                 $member->blogAdminRights($blogid) or $this->disallow();\r
3097                 \r
3098                 // check if blog is default blog\r
3099                 if ( $CONF['DefaultBlog'] == $blogid )\r
3100                 {\r
3101                         $this->error(_ERROR_DELDEFBLOG);\r
3102                 }\r
3103                 \r
3104                 // delete all comments\r
3105                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;\r
3106                 sql_query($query);\r
3107                 \r
3108                 // delete all items\r
3109                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;\r
3110                 sql_query($query);\r
3111                 \r
3112                 // delete all team members\r
3113                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;\r
3114                 sql_query($query);\r
3115                 \r
3116                 // delete all bans\r
3117                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;\r
3118                 sql_query($query);\r
3119                 \r
3120                 // delete all categories\r
3121                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;\r
3122                 sql_query($query);\r
3123                 \r
3124                 // delete all associated plugin options\r
3125                 NucleusPlugin::delete_option_values('blog', $blogid);\r
3126                 \r
3127                 // delete the blog itself\r
3128                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;\r
3129                 sql_query($query);\r
3130                 \r
3131                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));\r
3132                 \r
3133                 $this->action_overview(_DELETED_BLOG);\r
3134                 return;\r
3135         }\r
3136         \r
3137     /**\r
3138      * @todo document this\r
3139      */\r
3140     function action_memberdelete() {\r
3141         global $member, $manager;\r
3142 \r
3143         $memberid = intRequestVar('memberid');\r
3144 \r
3145         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
3146 \r
3147         $mem = MEMBER::createFromID($memberid);\r
3148 \r
3149         $this->pagehead();\r
3150         ?>\r
3151             <h2><?php echo _DELETE_CONFIRM?></h2>\r
3152 \r
3153             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo ENTITY::hsc($mem->getDisplayName()) ?></b>\r
3154             </p>\r
3155 \r
3156             <p>\r
3157             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>\r
3158             </p>\r
3159 \r
3160             <form method="post" action="index.php"><div>\r
3161             <input type="hidden" name="action" value="memberdeleteconfirm" />\r
3162             <?php $manager->addTicketHidden() ?>\r
3163             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />\r
3164             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
3165             </div></form>\r
3166         <?php\r
3167         $this->pagefoot();\r
3168     }\r
3169 \r
3170     /**\r
3171      * @todo document this\r
3172      */\r
3173     function action_memberdeleteconfirm() {\r
3174         global $member;\r
3175 \r
3176         $memberid = intRequestVar('memberid');\r
3177 \r
3178         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
3179 \r
3180         $error = $this->deleteOneMember($memberid);\r
3181         if ($error)\r
3182             $this->error($error);\r
3183 \r
3184         if ($member->isAdmin())\r
3185             $this->action_usermanagement();\r
3186         else\r
3187             $this->action_overview(_DELETED_MEMBER);\r
3188     }\r
3189         \r
3190         /**\r
3191          * ADMIN::deleteOneMember()\r
3192          * Delete a member by id\r
3193          * \r
3194          * @static\r
3195          * @params      Integer $memberid       member id\r
3196          * @return      String  null string or error messages\r
3197          */\r
3198         function deleteOneMember($memberid)\r
3199         {\r
3200                 global $manager;\r
3201                 \r
3202                 $memberid = intval($memberid);\r
3203                 $mem = MEMBER::createFromID($memberid);\r
3204                 \r
3205                 if ( !$mem->canBeDeleted() )\r
3206                 {\r
3207                         return _ERROR_DELETEMEMBER;\r
3208                 }\r
3209                 \r
3210                 $manager->notify('PreDeleteMember', array('member' => &$mem));\r
3211                 \r
3212                 /* unlink comments from memberid */\r
3213                 if ( $memberid )\r
3214                 {\r
3215                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";\r
3216                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
3217                         sql_query($query);\r
3218                 }\r
3219                 \r
3220                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;\r
3221                 sql_query($query);\r
3222                 \r
3223                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;\r
3224                 sql_query($query);\r
3225                 \r
3226                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;\r
3227                 sql_query($query);\r
3228                 \r
3229                 // delete all associated plugin options\r
3230                 NucleusPlugin::delete_option_values('member', $memberid);\r
3231                 \r
3232                 $manager->notify('PostDeleteMember', array('member' => &$mem));\r
3233                 \r
3234                 return '';\r
3235         }\r
3236         \r
3237     /**\r
3238      * @todo document this\r
3239      */\r
3240     function action_createnewlog() {\r
3241         global $member, $CONF, $manager;\r
3242 \r
3243         // Only Super-Admins can do this\r
3244         $member->isAdmin() or $this->disallow();\r
3245 \r
3246         $this->pagehead();\r
3247 \r
3248         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3249         ?>\r
3250         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>\r
3251 \r
3252         <h3><?php echo _ADMIN_NOTABILIA ?></h3>\r
3253 \r
3254         <p><?php echo _ADMIN_PLEASE_READ ?></p>\r
3255 \r
3256         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>\r
3257 \r
3258         <ol>\r
3259             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>\r
3260             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>\r
3261         </ol>\r
3262 \r
3263         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>\r
3264 \r
3265         <p>\r
3266         <?php echo _EBLOG_CREATE_TEXT?>\r
3267         </p>\r
3268 \r
3269         <form method="post" action="index.php"><div>\r
3270 \r
3271         <input type="hidden" name="action" value="addnewlog" />\r
3272         <?php $manager->addTicketHidden() ?>\r
3273 \r
3274 \r
3275         <table><tr>\r
3276             <td><?php echo _EBLOG_NAME?></td>\r
3277             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>\r
3278         </tr><tr>\r
3279             <td><?php echo _EBLOG_SHORTNAME?>\r
3280                 <?php help('shortblogname'); ?>\r
3281             </td>\r
3282             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>\r
3283         </tr><tr>\r
3284             <td><?php echo _EBLOG_DESC?></td>\r
3285             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>\r
3286         </tr><tr>\r
3287             <td><?php echo _EBLOG_DEFSKIN?>\r
3288                 <?php help('blogdefaultskin'); ?>\r
3289             </td>\r
3290             <td>\r
3291                 <?php\r
3292                     $query =  'SELECT sdname as text, sdnumber as value'\r
3293                            . ' FROM '.sql_table('skin_desc');\r
3294                     $template['name'] = 'defskin';\r
3295                     $template['tabindex'] = 50;\r
3296                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin\r
3297                     showlist($query,'select',$template);\r
3298                 ?>\r
3299             </td>\r
3300         </tr><tr>\r
3301             <td><?php echo _EBLOG_OFFSET?>\r
3302                 <?php help('blogtimeoffset'); ?>\r
3303                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::formatted_datetime('%H:%M',time()); ?></b>\r
3304             </td>\r
3305             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>\r
3306         </tr><tr>\r
3307             <td><?php echo _EBLOG_ADMIN?>\r
3308                 <?php help('teamadmin'); ?>\r
3309             </td>\r
3310             <td><?php echo _EBLOG_ADMIN_MSG?></td>\r
3311         </tr><tr>\r
3312             <td><?php echo _EBLOG_CREATE?></td>\r
3313             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3314         </tr></table>\r
3315 \r
3316         </div></form>\r
3317         <?php\r
3318         $this->pagefoot();\r
3319     }\r
3320 \r
3321     /**\r
3322      * @todo document this\r
3323      */\r
3324     function action_addnewlog() {\r
3325         global $member, $manager, $CONF;\r
3326 \r
3327         // Only Super-Admins can do this\r
3328         $member->isAdmin() or $this->disallow();\r
3329 \r
3330         $bname          = trim(postVar('name'));\r
3331         $bshortname     = trim(postVar('shortname'));\r
3332         $btimeoffset    = postVar('timeoffset');\r
3333         $bdesc          = trim(postVar('desc'));\r
3334         $bdefskin       = postVar('defskin');\r
3335 \r
3336         if (!isValidShortName($bshortname))\r
3337             $this->error(_ERROR_BADSHORTBLOGNAME);\r
3338 \r
3339         if ($manager->existsBlog($bshortname))\r
3340             $this->error(_ERROR_DUPSHORTBLOGNAME);\r
3341 \r
3342         $manager->notify(\r
3343             'PreAddBlog',\r
3344             array(\r
3345                 'name' => &$bname,\r
3346                 'shortname' => &$bshortname,\r
3347                 'timeoffset' => &$btimeoffset,\r
3348                 'description' => &$bdesc,\r
3349                 'defaultskin' => &$bdefskin\r
3350             )\r
3351         );\r
3352 \r
3353 \r
3354         // add slashes for sql queries\r
3355         $bname =        sql_real_escape_string($bname);\r
3356         $bshortname =   sql_real_escape_string($bshortname);\r
3357         $btimeoffset =  sql_real_escape_string($btimeoffset);\r
3358         $bdesc =        sql_real_escape_string($bdesc);\r
3359         $bdefskin =     sql_real_escape_string($bdefskin);\r
3360 \r
3361         // create blog\r
3362         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";\r
3363         sql_query($query);\r
3364         $blogid = sql_insert_id();\r
3365         $blog   =& $manager->getBlog($blogid);\r
3366 \r
3367         // create new category\r
3368         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');\r
3369         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');\r
3370         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
3371         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));\r
3372 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));\r
3373 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");\r
3374         $catid = sql_insert_id();\r
3375 \r
3376         // set as default category\r
3377         $blog->setDefaultCategory($catid);\r
3378         $blog->writeSettings();\r
3379 \r
3380         // create team member\r
3381         $memberid = $member->getID();\r
3382         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";\r
3383         sql_query($query);\r
3384 \r
3385         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
3386         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');\r
3387 \r
3388         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);\r
3389         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);\r
3390 \r
3391 \r
3392 \r
3393         $manager->notify(\r
3394             'PostAddBlog',\r
3395             array(\r
3396                 'blog' => &$blog\r
3397             )\r
3398         );\r
3399 \r
3400         $manager->notify(\r
3401             'PostAddCategory',\r
3402             array(\r
3403                 'blog' => &$blog,\r
3404                 'name' => _EBLOGDEFAULTCATEGORY_NAME,\r
3405                 'description' => _EBLOGDEFAULTCATEGORY_DESC,\r
3406                 'catid' => $catid\r
3407             )\r
3408         );\r
3409 \r
3410         $this->pagehead();\r
3411         ?>\r
3412         <h2><?php echo _BLOGCREATED_TITLE ?></h2>\r
3413 \r
3414         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, ENTITY::hsc($bname)) ?></p>\r
3415 \r
3416         <ol>\r
3417             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, ENTITY::hsc($bshortname)) ?></a></li>\r
3418             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>\r
3419         </ol>\r
3420 \r
3421         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, ENTITY::hsc($bshortname)) ?></a></h3>\r
3422 \r
3423         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, ENTITY::hsc($bshortname)) ?></p>\r
3424 <pre><code>&lt;?php\r
3425 \r
3426 $CONF['Self'] = '<b><?php echo ENTITY::hsc($bshortname)?>.php</b>';\r
3427 \r
3428 include('<i>./config.php</i>');\r
3429 \r
3430 selectBlog('<b><?php echo ENTITY::hsc($bshortname)?></b>');\r
3431 selector();\r
3432 \r
3433 ?&gt;</code></pre>\r
3434 \r
3435         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>\r
3436 \r
3437         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>\r
3438 \r
3439         <form action="index.php" method="post"><div>\r
3440             <input type="hidden" name="action" value="addnewlog2" />\r
3441             <?php $manager->addTicketHidden() ?>\r
3442             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />\r
3443             <table><tr>\r
3444                 <td><?php echo _EBLOG_URL?></td>\r
3445                 <td><input name="url" maxlength="100" size="40" value="<?php echo ENTITY::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>\r
3446             </tr><tr>\r
3447                 <td><?php echo _EBLOG_CREATE?></td>\r
3448                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3449             </tr></table>\r
3450         </div></form>\r
3451 \r
3452         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>\r
3453 \r
3454         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>\r
3455 \r
3456         <form action="index.php" method="post"><div>\r
3457             <input type="hidden" name="action" value="addnewlog2" />\r
3458             <?php $manager->addTicketHidden() ?>\r
3459             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />\r
3460             <table><tr>\r
3461                 <td><?php echo _EBLOG_URL?></td>\r
3462                 <td><input name="url" maxlength="100" size="40" /></td>\r
3463             </tr><tr>\r
3464                 <td><?php echo _EBLOG_CREATE?></td>\r
3465                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3466             </tr></table>\r
3467         </div></form>\r
3468 \r
3469         <?php       $this->pagefoot();\r
3470 \r
3471     }\r
3472 \r
3473     /**\r
3474      * @todo document this\r
3475      */\r
3476     function action_addnewlog2() {\r
3477         global $member, $manager;\r
3478 \r
3479         $member->blogAdminRights($blogid) or $this->disallow();\r
3480 \r
3481         $burl   = requestVar('url');\r
3482         $blogid = intRequestVar('blogid');\r
3483 \r
3484         $blog =& $manager->getBlog($blogid);\r
3485         $blog->setURL(trim($burl));\r
3486         $blog->writeSettings();\r
3487 \r
3488         $this->action_overview(_MSG_NEWBLOG);\r
3489     }\r
3490 \r
3491     /**\r
3492      * @todo document this\r
3493      */\r
3494     function action_skinieoverview() {\r
3495         global $member, $DIR_LIBS, $manager;\r
3496 \r
3497         $member->isAdmin() or $this->disallow();\r
3498 \r
3499         // load skinie class\r
3500         include_once($DIR_LIBS . 'skinie.php');\r
3501 \r
3502         $this->pagehead();\r
3503 \r
3504         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3505 \r
3506     ?>\r
3507         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>\r
3508 \r
3509                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>\r
3510                 <?php                   global $DIR_SKINS;\r
3511 \r
3512                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);\r
3513 \r
3514                     if (sizeof($candidates) > 0) {\r
3515                         ?>\r
3516                             <form method="post" action="index.php"><div>\r
3517                                 <input type="hidden" name="action" value="skinieimport" />\r
3518                                 <?php $manager->addTicketHidden() ?>\r
3519                                 <input type="hidden" name="mode" value="file" />\r
3520                                 <select name="skinfile" id="skinie_import_local">\r
3521                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {\r
3522                                         $html = ENTITY::hsc($skinfile);\r
3523                                         echo '<option value="',$html,'">',$skinname,'</option>';\r
3524                                     }\r
3525                                 ?>\r
3526                                 </select>\r
3527                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />\r
3528                             </div></form>\r
3529                         <?php                   } else {\r
3530                         echo _SKINIE_NOCANDIDATES;\r
3531                     }\r
3532                 ?>\r
3533                 </p>\r
3534 \r
3535                 <p><em><?php echo _OR?></em></p>\r
3536 \r
3537                 <form method="post" action="index.php"><p>\r
3538                     <?php $manager->addTicketHidden() ?>\r
3539                     <input type="hidden" name="action" value="skinieimport" />\r
3540                     <input type="hidden" name="mode" value="url" />\r
3541                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>\r
3542                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />\r
3543                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />\r
3544                 </p></form>\r
3545 \r
3546 \r
3547         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>\r
3548         <form method="post" action="index.php"><div>\r
3549             <input type="hidden" name="action" value="skinieexport" />\r
3550             <?php $manager->addTicketHidden() ?>\r
3551 \r
3552             <p><?php echo _SKINIE_EXPORT_INTRO?></p>\r
3553 \r
3554             <table><tr>\r
3555                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>\r
3556             </tr><tr>\r
3557     <?php       // show list of skins\r
3558         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));\r
3559         while ($skinObj = sql_fetch_object($res)) {\r
3560             $id = 'skinexp' . $skinObj->sdnumber;\r
3561             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';\r
3562             echo '<label for="',$id,'">',ENTITY::hsc($skinObj->sdname),'</label></td>';\r
3563             echo '<td>',ENTITY::hsc($skinObj->sddesc),'</td>';\r
3564             echo '</tr><tr>';\r
3565         }\r
3566 \r
3567         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';\r
3568 \r
3569         // show list of templates\r
3570         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));\r
3571         while ($templateObj = sql_fetch_object($res)) {\r
3572             $id = 'templateexp' . $templateObj->tdnumber;\r
3573             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';\r
3574             echo '<label for="',$id,'">',ENTITY::hsc($templateObj->tdname),'</label></td>';\r
3575             echo '<td>',ENTITY::hsc($templateObj->tddesc),'</td>';\r
3576             echo '</tr><tr>';\r
3577         }\r
3578 \r
3579     ?>\r
3580                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>\r
3581             </tr><tr>\r
3582                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>\r
3583             </tr><tr>\r
3584                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>\r
3585             </tr><tr>\r
3586                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>\r
3587             </tr></table>\r
3588         </div></form>\r
3589 \r
3590     <?php\r
3591         $this->pagefoot();\r
3592 \r
3593     }\r
3594 \r
3595     /**\r
3596      * @todo document this\r
3597      */\r
3598     function action_skinieimport() {\r
3599         global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
3600 \r
3601         $member->isAdmin() or $this->disallow();\r
3602 \r
3603         // load skinie class\r
3604         include_once($DIR_LIBS . 'skinie.php');\r
3605 \r
3606         $skinFileRaw= postVar('skinfile');\r
3607         $mode       = postVar('mode');\r
3608 \r
3609         $importer = new SKINIMPORT();\r
3610 \r
3611         // get full filename\r
3612         if ($mode == 'file')\r
3613         {\r
3614             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
3615 \r
3616             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
3617             if (!file_exists($skinFile))\r
3618                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
3619         } else {\r
3620             $skinFile = $skinFileRaw;\r
3621         }\r
3622 \r
3623         // read only metadata\r
3624         $error = $importer->readFile($skinFile, 1);\r
3625 \r
3626         // clashes\r
3627         $skinNameClashes = $importer->checkSkinNameClashes();\r
3628         $templateNameClashes = $importer->checkTemplateNameClashes();\r
3629         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
3630 \r
3631         if ($error) $this->error($error);\r
3632 \r
3633         $this->pagehead();\r
3634 \r
3635         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';\r
3636         ?>\r
3637         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>\r
3638 \r
3639         <ul>\r
3640             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>\r
3641             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>\r
3642             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>\r
3643             <?php\r
3644                 if ($hasNameClashes)\r
3645                 {\r
3646             ?>\r
3647             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>\r
3648             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>\r
3649             <?php\r
3650                 } // if (hasNameClashes)\r
3651             ?>\r
3652         </ul>\r
3653 \r
3654         <form method="post" action="index.php"><div>\r
3655             <input type="hidden" name="action" value="skiniedoimport" />\r
3656             <?php $manager->addTicketHidden() ?>\r
3657             <input type="hidden" name="skinfile" value="<?php echo ENTITY::hsc(postVar('skinfile'))?>" />\r
3658             <input type="hidden" name="mode" value="<?php echo ENTITY::hsc($mode)?>" />\r
3659             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />\r
3660             <?php\r
3661                 if ($hasNameClashes)\r
3662                 {\r
3663             ?>\r
3664             <br />\r
3665             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>\r
3666             <?php\r
3667                 } // if (hasNameClashes)\r
3668             ?>\r
3669         </div></form>\r
3670 \r
3671 \r
3672         <?php\r
3673         $this->pagefoot();\r
3674     }\r
3675 \r
3676     /**\r
3677      * @todo document this\r
3678      */\r
3679     function action_skiniedoimport() {\r
3680         global $member, $DIR_LIBS, $DIR_SKINS;\r
3681 \r
3682         $member->isAdmin() or $this->disallow();\r
3683 \r
3684         // load skinie class\r
3685         include_once($DIR_LIBS . 'skinie.php');\r
3686 \r
3687         $skinFileRaw= postVar('skinfile');\r
3688         $mode       = postVar('mode');\r
3689 \r
3690         $allowOverwrite = intPostVar('overwrite');\r
3691 \r
3692         // get full filename\r
3693         if ($mode == 'file')\r
3694         {\r
3695             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
3696 \r
3697             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
3698             if (!file_exists($skinFile))\r
3699                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
3700 \r
3701         } else {\r
3702             $skinFile = $skinFileRaw;\r
3703         }\r
3704 \r
3705         $importer = new SKINIMPORT();\r
3706 \r
3707         $error = $importer->readFile($skinFile);\r
3708 \r
3709         if ($error)\r
3710             $this->error($error);\r
3711 \r
3712         $error = $importer->writeToDatabase($allowOverwrite);\r
3713 \r
3714         if ($error)\r
3715             $this->error($error);\r
3716 \r
3717         $this->pagehead();\r
3718 \r
3719         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3720     ?>\r
3721         <h2><?php echo _SKINIE_DONE?></h2>\r
3722 \r
3723         <ul>\r
3724             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>\r
3725             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>\r
3726             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>\r
3727         </ul>\r
3728 \r
3729     <?php       $this->pagefoot();\r
3730 \r
3731     }\r
3732 \r
3733     /**\r
3734      * @todo document this\r
3735      */\r
3736     function action_skinieexport() {\r
3737         global $member, $DIR_LIBS;\r
3738 \r
3739         $member->isAdmin() or $this->disallow();\r
3740 \r
3741         // load skinie class\r
3742         include_once($DIR_LIBS . 'skinie.php');\r
3743 \r
3744         $aSkins = requestIntArray('skin');\r
3745         $aTemplates = requestIntArray('template');\r
3746 \r
3747         if (!is_array($aTemplates)) $aTemplates = array();\r
3748         if (!is_array($aSkins)) $aSkins = array();\r
3749 \r
3750         $skinList = array_keys($aSkins);\r
3751         $templateList = array_keys($aTemplates);\r
3752 \r
3753         $info = postVar('info');\r
3754 \r
3755         $exporter = new SKINEXPORT();\r
3756         foreach ($skinList as $skinId) {\r
3757             $exporter->addSkin($skinId);\r
3758         }\r
3759         foreach ($templateList as $templateId) {\r
3760             $exporter->addTemplate($templateId);\r
3761         }\r
3762         $exporter->setInfo($info);\r
3763 \r
3764         $exporter->export();\r
3765     }\r
3766 \r
3767     /**\r
3768      * @todo document this\r
3769      */\r
3770     function action_templateoverview() {\r
3771         global $member, $manager;\r
3772 \r
3773         $member->isAdmin() or $this->disallow();\r
3774 \r
3775         $this->pagehead();\r
3776 \r
3777         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
3778 \r
3779         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';\r
3780         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';\r
3781 \r
3782         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';\r
3783         $template['content'] = 'templatelist';\r
3784         $template['tabindex'] = 10;\r
3785         showlist($query,'table',$template);\r
3786 \r
3787         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';\r
3788 \r
3789         ?>\r
3790         <form method="post" action="index.php"><div>\r
3791 \r
3792         <input name="action" value="templatenew" type="hidden" />\r
3793         <?php $manager->addTicketHidden() ?>\r
3794         <table><tr>\r
3795             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>\r
3796             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>\r
3797         </tr><tr>\r
3798             <td><?php echo _TEMPLATE_DESC?></td>\r
3799             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>\r
3800         </tr><tr>\r
3801             <td><?php echo _TEMPLATE_CREATE?></td>\r
3802             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
3803         </tr></table>\r
3804 \r
3805         </div></form>\r
3806 \r
3807         <?php\r
3808         $this->pagefoot();\r
3809     }\r
3810 \r
3811     /**\r
3812      * @todo document this\r
3813      */\r
3814     function action_templateedit($msg = '') {\r
3815         global $member, $manager;\r
3816 \r
3817         $templateid = intRequestVar('templateid');\r
3818 \r
3819         $member->isAdmin() or $this->disallow();\r
3820 \r
3821         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';\r
3822         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';\r
3823 \r
3824         $this->pagehead($extrahead);\r
3825 \r
3826         $templatename = TEMPLATE::getNameFromId($templateid);\r
3827         $templatedescription = TEMPLATE::getDesc($templateid);\r
3828         $template =& $manager->getTemplate($templatename);\r
3829 \r
3830         ?>\r
3831         <p>\r
3832         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>\r
3833         </p>\r
3834 \r
3835         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  ENTITY::hsc($templatename); ?>'</h2>\r
3836 \r
3837         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";\r
3838         ?>\r
3839 \r
3840         <p><?php echo _TEMPLATE_EDIT_MSG?></p>\r
3841 \r
3842         <form method="post" action="index.php">\r
3843         <div>\r
3844 \r
3845         <input type="hidden" name="action" value="templateupdate" />\r
3846         <?php $manager->addTicketHidden() ?>\r
3847         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />\r
3848 \r
3849         <table><tr>\r
3850             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>\r
3851         </tr><tr>\r
3852             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>\r
3853             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  ENTITY::hsc($templatename) ?>" /></td>\r
3854         </tr><tr>\r
3855             <td><?php echo _TEMPLATE_DESC?></td>\r
3856             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  ENTITY::hsc($templatedescription) ?>" /></td>\r
3857         </tr><tr>\r
3858             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>\r
3859         </tr><tr>\r
3860             <td><?php echo _TEMPLATE_UPDATE?></td>\r
3861             <td>\r
3862                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
3863                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />\r
3864             </td>\r
3865         </tr><tr>\r
3866             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>\r
3867 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);\r
3868     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);\r
3869     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);\r
3870     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);\r
3871     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);\r
3872     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);\r
3873 ?>\r
3874         </tr><tr>\r
3875             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>\r
3876 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);\r
3877     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);\r
3878     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);\r
3879     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);\r
3880     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);\r
3881     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);\r
3882     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);\r
3883 ?>\r
3884         </tr><tr>\r
3885             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>\r
3886 <?php\r
3887     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);\r
3888 ?>\r
3889         </tr><tr>\r
3890             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>\r
3891 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);\r
3892 ?>\r
3893         </tr><tr>\r
3894             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>\r
3895 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);\r
3896     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);\r
3897     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);\r
3898 ?>\r
3899         </tr><tr>\r
3900             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>\r
3901 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);\r
3902     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);\r
3903     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);\r
3904 ?>\r
3905         </tr><tr>\r
3906             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>\r
3907 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);\r
3908     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);\r
3909     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);\r
3910 ?>\r
3911         </tr><tr>\r
3912             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>\r
3913 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);\r
3914     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);\r
3915     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);\r
3916     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);\r
3917     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);\r
3918 ?>\r
3919         </tr><tr>\r
3920             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>\r
3921 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);\r
3922     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);\r
3923     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);\r
3924 ?>\r
3925         </tr><tr>\r
3926             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>\r
3927 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);\r
3928     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);\r
3929 ?>\r
3930         </tr><tr>\r
3931             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>\r
3932 <?php\r
3933         $tab = 600;\r
3934         $pluginfields = array();\r
3935         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));\r
3936 \r
3937         foreach ($pluginfields as $pfkey=>$pfvalue) {\r
3938             echo "</tr><tr>\n";\r
3939             echo '<th colspan="2">' . ENTITY::hen($pfkey) . "</th>\n";\r
3940             foreach ($pfvalue as $pffield=>$pfdesc) {\r
3941                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);\r
3942             }\r
3943         }\r
3944 ?>\r
3945         </tr><tr>\r
3946             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>\r
3947         </tr><tr>\r
3948             <td><?php echo _TEMPLATE_UPDATE?></td>\r
3949             <td>\r
3950                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
3951                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />\r
3952             </td>\r
3953         </tr></table>\r
3954 \r
3955         </div>\r
3956         </form>\r
3957         <?php\r
3958         $this->pagefoot();\r
3959     }\r
3960 \r
3961     /**\r
3962      * @todo document this\r
3963      */\r
3964     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3965         static $count = 1;\r
3966         if (!isset($template[$name])) $template[$name] = '';\r
3967     ?>\r
3968         </tr><tr>\r
3969             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3970             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  ENTITY::hsc($template[$name]); ?></textarea></td>\r
3971     <?php       $count++;\r
3972     }\r
3973 \r
3974     /**\r
3975      * @todo document this\r
3976      */\r
3977     function action_templateupdate() {\r
3978         global $member,$manager;\r
3979 \r
3980         $templateid = intRequestVar('templateid');\r
3981 \r
3982         $member->isAdmin() or $this->disallow();\r
3983 \r
3984         $name = postVar('tname');\r
3985         $desc = postVar('tdesc');\r
3986 \r
3987         if (!isValidTemplateName($name))\r
3988             $this->error(_ERROR_BADTEMPLATENAME);\r
3989 \r
3990         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))\r
3991             $this->error(_ERROR_DUPTEMPLATENAME);\r
3992 \r
3993 \r
3994         $name = sql_real_escape_string($name);\r
3995         $desc = sql_real_escape_string($desc);\r
3996 \r
3997         // 1. Remove all template parts\r
3998         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;\r
3999         sql_query($query);\r
4000 \r
4001         // 2. Update description\r
4002         $query =  'UPDATE '.sql_table('template_desc').' SET'\r
4003                . " tdname='" . $name . "',"\r
4004                . " tddesc='" . $desc . "'"\r
4005                . " WHERE tdnumber=" . $templateid;\r
4006         sql_query($query);\r
4007 \r
4008         // 3. Add non-empty template parts\r
4009         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));\r
4010         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));\r
4011         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));\r
4012         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));\r
4013         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));\r
4014         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));\r
4015         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));\r
4016         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));\r
4017         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));\r
4018         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));\r
4019         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));\r
4020         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));\r
4021         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));\r
4022         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));\r
4023         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));\r
4024         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));\r
4025         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
4026         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));\r
4027         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));\r
4028         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));\r
4029         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));\r
4030         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));\r
4031         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));\r
4032         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));\r
4033         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));\r
4034         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));\r
4035         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));\r
4036         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));\r
4037         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));\r
4038         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));\r
4039         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
4040         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));\r
4041         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));\r
4042         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));\r
4043 \r
4044         $pluginfields = array();\r
4045         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));\r
4046         foreach ($pluginfields as $pfkey=>$pfvalue) {\r
4047             foreach ($pfvalue as $pffield=>$pfdesc) {\r
4048                 $this->addToTemplate($templateid, $pffield, postVar($pffield));\r
4049             }\r
4050         }\r
4051 \r
4052         // jump back to template edit\r
4053         $this->action_templateedit(_TEMPLATE_UPDATED);\r
4054 \r
4055     }\r
4056 \r
4057         /**\r
4058          * ADMIN::addToTemplate()\r
4059          * \r
4060          * @param       Integer $id     ID for template\r
4061          * @param       String  $partname       parts name\r
4062          * @param       String  $content        template contents\r
4063          * @return      Integer record index\r
4064          * \r
4065          */\r
4066         function addToTemplate($id, $partname, $content)\r
4067         {\r
4068                 // don't add empty parts:\r
4069                 if ( !trim($content) )\r
4070                 {\r
4071                         return -1;\r
4072                 }\r
4073                 \r
4074                 $partname = sql_real_escape_string($partname);\r
4075                 $content = sql_real_escape_string($content);\r
4076                 \r
4077                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";\r
4078                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
4079                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4080                 return sql_insert_id();\r
4081         }\r
4082         \r
4083     /**\r
4084      * @todo document this\r
4085      */\r
4086     function action_templatedelete() {\r
4087         global $member, $manager;\r
4088 \r
4089         $member->isAdmin() or $this->disallow();\r
4090 \r
4091         $templateid = intRequestVar('templateid');\r
4092         // TODO: check if template can be deleted\r
4093 \r
4094         $this->pagehead();\r
4095 \r
4096         $name = TEMPLATE::getNameFromId($templateid);\r
4097         $desc = TEMPLATE::getDesc($templateid);\r
4098 \r
4099         ?>\r
4100             <h2><?php echo _DELETE_CONFIRM?></h2>\r
4101 \r
4102             <p>\r
4103             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo ENTITY::hsc($name)?></b> (<?php echo  ENTITY::hsc($desc) ?>)\r
4104             </p>\r
4105 \r
4106             <form method="post" action="index.php"><div>\r
4107                 <input type="hidden" name="action" value="templatedeleteconfirm" />\r
4108                 <?php $manager->addTicketHidden() ?>\r
4109                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />\r
4110                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4111             </div></form>\r
4112         <?php\r
4113         $this->pagefoot();\r
4114     }\r
4115 \r
4116     /**\r
4117      * @todo document this\r
4118      */\r
4119     function action_templatedeleteconfirm() {\r
4120         global $member, $manager;\r
4121 \r
4122         $templateid = intRequestVar('templateid');\r
4123 \r
4124         $member->isAdmin() or $this->disallow();\r
4125 \r
4126         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));\r
4127 \r
4128         // 1. delete description\r
4129         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);\r
4130 \r
4131         // 2. delete parts\r
4132         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);\r
4133 \r
4134         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));\r
4135 \r
4136         $this->action_templateoverview();\r
4137     }\r
4138 \r
4139     /**\r
4140      * @todo document this\r
4141      */\r
4142     function action_templatenew() {\r
4143         global $member;\r
4144 \r
4145         $member->isAdmin() or $this->disallow();\r
4146 \r
4147         $name = postVar('name');\r
4148         $desc = postVar('desc');\r
4149 \r
4150         if (!isValidTemplateName($name))\r
4151             $this->error(_ERROR_BADTEMPLATENAME);\r
4152 \r
4153         if (TEMPLATE::exists($name))\r
4154             $this->error(_ERROR_DUPTEMPLATENAME);\r
4155 \r
4156         $newTemplateId = TEMPLATE::createNew($name, $desc);\r
4157 \r
4158         $this->action_templateoverview();\r
4159     }\r
4160 \r
4161     /**\r
4162      * @todo document this\r
4163      */\r
4164     function action_templateclone() {\r
4165         global $member;\r
4166 \r
4167         $templateid = intRequestVar('templateid');\r
4168 \r
4169         $member->isAdmin() or $this->disallow();\r
4170 \r
4171         // 1. read old template\r
4172         $name = TEMPLATE::getNameFromId($templateid);\r
4173         $desc = TEMPLATE::getDesc($templateid);\r
4174 \r
4175         // 2. create desc thing\r
4176         $name = "cloned" . $name;\r
4177 \r
4178         // if a template with that name already exists:\r
4179         if (TEMPLATE::exists($name)) {\r
4180             $i = 1;\r
4181             while (TEMPLATE::exists($name . $i))\r
4182                 $i++;\r
4183             $name .= $i;\r
4184         }\r
4185 \r
4186         $newid = TEMPLATE::createNew($name, $desc);\r
4187 \r
4188         // 3. create clone\r
4189         // go through parts of old template and add them to the new one\r
4190         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);\r
4191         while ($o = sql_fetch_object($res)) {\r
4192             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);\r
4193         }\r
4194 \r
4195         $this->action_templateoverview();\r
4196     }\r
4197 \r
4198     /**\r
4199      * @todo document this\r
4200      */\r
4201     function action_skinoverview() {\r
4202         global $member, $manager;\r
4203 \r
4204         $member->isAdmin() or $this->disallow();\r
4205 \r
4206         $this->pagehead();\r
4207 \r
4208         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
4209 \r
4210         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';\r
4211 \r
4212         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';\r
4213 \r
4214         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';\r
4215         $template['content'] = 'skinlist';\r
4216         $template['tabindex'] = 10;\r
4217         showlist($query,'table',$template);\r
4218 \r
4219         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';\r
4220 \r
4221         ?>\r
4222         <form method="post" action="index.php">\r
4223         <div>\r
4224 \r
4225         <input name="action" value="skinnew" type="hidden" />\r
4226         <?php $manager->addTicketHidden() ?>\r
4227         <table><tr>\r
4228             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>\r
4229             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>\r
4230         </tr><tr>\r
4231             <td><?php echo _SKIN_DESC?></td>\r
4232             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>\r
4233         </tr><tr>\r
4234             <td><?php echo _SKIN_CREATE?></td>\r
4235             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>\r
4236         </tr></table>\r
4237 \r
4238         </div>\r
4239         </form>\r
4240 \r
4241         <?php\r
4242         $this->pagefoot();\r
4243     }\r
4244 \r
4245     /**\r
4246      * @todo document this\r
4247      */\r
4248     function action_skinnew() {\r
4249         global $member;\r
4250 \r
4251         $member->isAdmin() or $this->disallow();\r
4252 \r
4253         $name = trim(postVar('name'));\r
4254         $desc = trim(postVar('desc'));\r
4255 \r
4256         if (!isValidSkinName($name))\r
4257             $this->error(_ERROR_BADSKINNAME);\r
4258 \r
4259         if (SKIN::exists($name))\r
4260             $this->error(_ERROR_DUPSKINNAME);\r
4261 \r
4262         $newId = SKIN::createNew($name, $desc);\r
4263 \r
4264         $this->action_skinoverview();\r
4265     }\r
4266 \r
4267     /**\r
4268      * @todo document this\r
4269      */\r
4270     function action_skinedit() {\r
4271         global $member, $manager;\r
4272 \r
4273         $skinid = intRequestVar('skinid');\r
4274 \r
4275         $member->isAdmin() or $this->disallow();\r
4276 \r
4277         $skin = new SKIN($skinid);\r
4278 \r
4279         $this->pagehead();\r
4280         ?>\r
4281         <p>\r
4282             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>\r
4283         </p>\r
4284         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>\r
4285 \r
4286         <h3><?php echo _SKIN_PARTS_TITLE?></h3>\r
4287         <?php echo _SKIN_PARTS_MSG?>\r
4288         <ul>\r
4289             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>\r
4290             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>\r
4291             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>\r
4292             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>\r
4293             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>\r
4294             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>\r
4295             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>\r
4296             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>\r
4297         </ul>\r
4298 \r
4299         <?php\r
4300 \r
4301         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;\r
4302         $res = sql_query($query);\r
4303 \r
4304         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';\r
4305         echo '<form method="get" action="index.php">' . "\r\n";\r
4306         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";\r
4307         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";\r
4308         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";\r
4309         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";\r
4310         echo '</form>' . "\r\n";\r
4311 \r
4312         if ($res && sql_num_rows($res) > 0) {\r
4313             echo '<ul>';\r
4314             $tabstart = 75;\r
4315 \r
4316             while ($row = sql_fetch_assoc($res)) {\r
4317                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">' . ENTITY::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';\r
4318             }\r
4319 \r
4320             echo '</ul>';\r
4321         }\r
4322 \r
4323         ?>\r
4324 \r
4325         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>\r
4326         <form method="post" action="index.php">\r
4327         <div>\r
4328 \r
4329         <input type="hidden" name="action" value="skineditgeneral" />\r
4330         <?php $manager->addTicketHidden() ?>\r
4331         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4332         <table><tr>\r
4333             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>\r
4334             <td><input name="name" tabindex="90" value="<?php echo  ENTITY::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>\r
4335         </tr><tr>\r
4336             <td><?php echo _SKIN_DESC?></td>\r
4337             <td><input name="desc" tabindex="100" value="<?php echo  ENTITY::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>\r
4338         </tr><tr>\r
4339             <td><?php echo _SKIN_TYPE?></td>\r
4340             <td><input name="type" tabindex="110" value="<?php echo  ENTITY::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>\r
4341         </tr><tr>\r
4342             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>\r
4343             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>\r
4344         </tr><tr>\r
4345             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>\r
4346             <td><input name="inc_prefix" tabindex="130" value="<?php echo  ENTITY::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>\r
4347         </tr><tr>\r
4348             <td><?php echo _SKIN_CHANGE?></td>\r
4349             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>\r
4350         </tr></table>\r
4351 \r
4352         </div>\r
4353         </form>\r
4354 \r
4355 \r
4356         <?php       $this->pagefoot();\r
4357     }\r
4358 \r
4359     /**\r
4360      * @todo document this\r
4361      */\r
4362     function action_skineditgeneral() {\r
4363         global $member;\r
4364 \r
4365         $skinid = intRequestVar('skinid');\r
4366 \r
4367         $member->isAdmin() or $this->disallow();\r
4368 \r
4369         $name = postVar('name');\r
4370         $desc = postVar('desc');\r
4371         $type = postVar('type');\r
4372         $inc_mode = postVar('inc_mode');\r
4373         $inc_prefix = postVar('inc_prefix');\r
4374 \r
4375         $skin = new SKIN($skinid);\r
4376 \r
4377         // 1. Some checks\r
4378         if (!isValidSkinName($name))\r
4379             $this->error(_ERROR_BADSKINNAME);\r
4380 \r
4381         if (($skin->getName() != $name) && SKIN::exists($name))\r
4382             $this->error(_ERROR_DUPSKINNAME);\r
4383 \r
4384         if (!$type) $type = 'text/html';\r
4385         if (!$inc_mode) $inc_mode = 'normal';\r
4386 \r
4387         // 2. Update description\r
4388         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4389 \r
4390         $this->action_skinedit();\r
4391 \r
4392     }\r
4393 \r
4394     /**\r
4395      * @todo document this\r
4396      */\r
4397     function action_skinedittype($msg = '') {\r
4398         global $member, $manager;\r
4399 \r
4400         $skinid = intRequestVar('skinid');\r
4401         $type = requestVar('type');\r
4402 \r
4403         $member->isAdmin() or $this->disallow();\r
4404 \r
4405         $type = trim($type);\r
4406         $type = strtolower($type);\r
4407 \r
4408         if (!isValidShortName($type)) {\r
4409             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4410         }\r
4411 \r
4412         $skin = new SKIN($skinid);\r
4413 \r
4414         $friendlyNames = SKIN::getFriendlyNames();\r
4415 \r
4416         $this->pagehead();\r
4417         ?>\r
4418         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>\r
4419 \r
4420         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo ENTITY::hsc($skin->getName()) ?>': <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>\r
4421 \r
4422         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";\r
4423         ?>\r
4424 \r
4425 \r
4426         <form method="post" action="index.php">\r
4427         <div>\r
4428 \r
4429         <input type="hidden" name="action" value="skinupdate" />\r
4430         <?php $manager->addTicketHidden() ?>\r
4431         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4432         <input type="hidden" name="type" value="<?php echo  $type ?>" />\r
4433 \r
4434         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
4435         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />\r
4436         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)\r
4437         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4438             help('skinpart' . $type);\r
4439         } else {\r
4440             help('skinpartspecial');\r
4441         }?>\r
4442         <br />\r
4443 \r
4444         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  ENTITY::hsc($skin->getContent($type)) ?></textarea>\r
4445 \r
4446         <br />\r
4447         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />\r
4448         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />\r
4449         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)\r
4450 \r
4451         <br /><br />\r
4452         <?php echo _SKIN_ALLOWEDVARS?>\r
4453         <?php           $actions = SKIN::getAllowedActionsForType($type);\r
4454 \r
4455             sort($actions);\r
4456 \r
4457             while ($current = array_shift($actions)) {\r
4458                 // skip deprecated vars\r
4459                 if ($current == 'ifcat') continue;\r
4460                 if ($current == 'imagetext') continue;\r
4461                 if ($current == 'vars') continue;\r
4462 \r
4463                 echo helplink('skinvar-' . $current) . "$current</a>";\r
4464                 if (count($actions) != 0) echo ", ";\r
4465             }\r
4466         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;\r
4467         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');\r
4468         showlist($query,'table',array('content'=>'shortblognames'));\r
4469         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;\r
4470         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');\r
4471         showlist($query,'table',array('content'=>'shortnames'));\r
4472         echo '</div></form>';\r
4473         $this->pagefoot();\r
4474     }\r
4475 \r
4476     /**\r
4477      * @todo document this\r
4478      */\r
4479     function action_skinupdate() {\r
4480         global $member;\r
4481 \r
4482         $skinid = intRequestVar('skinid');\r
4483         $content = trim(postVar('content'));\r
4484         $type = postVar('type');\r
4485 \r
4486         $member->isAdmin() or $this->disallow();\r
4487 \r
4488         $skin = new SKIN($skinid);\r
4489         $skin->update($type, $content);\r
4490 \r
4491         $this->action_skinedittype(_SKIN_UPDATED);\r
4492     }\r
4493 \r
4494     /**\r
4495      * @todo document this\r
4496      */\r
4497     function action_skindelete() {\r
4498         global $member, $manager, $CONF;\r
4499 \r
4500         $skinid = intRequestVar('skinid');\r
4501 \r
4502         $member->isAdmin() or $this->disallow();\r
4503 \r
4504         // don't allow default skin to be deleted\r
4505         if ($skinid == $CONF['BaseSkin'])\r
4506             $this->error(_ERROR_DEFAULTSKIN);\r
4507 \r
4508         // don't allow deletion of default skins for blogs\r
4509         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;\r
4510         $r = sql_query($query);\r
4511         if ($o = sql_fetch_object($r))\r
4512             $this->error(_ERROR_SKINDEFDELETE . ENTITY::hsc($o->bname));\r
4513 \r
4514         $this->pagehead();\r
4515 \r
4516         $skin = new SKIN($skinid);\r
4517         $name = $skin->getName();\r
4518         $desc = $skin->getDescription();\r
4519 \r
4520         ?>\r
4521             <h2><?php echo _DELETE_CONFIRM?></h2>\r
4522 \r
4523             <p>\r
4524                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo ENTITY::hsc($name) ?></b> (<?php echo  ENTITY::hsc($desc)?>)\r
4525             </p>\r
4526 \r
4527             <form method="post" action="index.php"><div>\r
4528                 <input type="hidden" name="action" value="skindeleteconfirm" />\r
4529                 <?php $manager->addTicketHidden() ?>\r
4530                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />\r
4531                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4532             </div></form>\r
4533         <?php\r
4534         $this->pagefoot();\r
4535     }\r
4536 \r
4537     /**\r
4538      * @todo document this\r
4539      */\r
4540     function action_skindeleteconfirm() {\r
4541         global $member, $CONF, $manager;\r
4542 \r
4543         $skinid = intRequestVar('skinid');\r
4544 \r
4545         $member->isAdmin() or $this->disallow();\r
4546 \r
4547         // don't allow default skin to be deleted\r
4548         if ($skinid == $CONF['BaseSkin'])\r
4549             $this->error(_ERROR_DEFAULTSKIN);\r
4550 \r
4551         // don't allow deletion of default skins for blogs\r
4552         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;\r
4553         $r = sql_query($query);\r
4554         if ($o = sql_fetch_object($r))\r
4555             $this->error(_ERROR_SKINDEFDELETE .$o->bname);\r
4556 \r
4557         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));\r
4558 \r
4559         // 1. delete description\r
4560         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);\r
4561 \r
4562         // 2. delete parts\r
4563         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);\r
4564 \r
4565         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));\r
4566 \r
4567         $this->action_skinoverview();\r
4568     }\r
4569 \r
4570     /**\r
4571      * @todo document this\r
4572      */\r
4573     function action_skinremovetype() {\r
4574         global $member, $manager, $CONF;\r
4575 \r
4576         $skinid = intRequestVar('skinid');\r
4577         $skintype = requestVar('type');\r
4578 \r
4579         if (!isValidShortName($skintype)) {\r
4580             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4581         }\r
4582 \r
4583         $member->isAdmin() or $this->disallow();\r
4584 \r
4585         // don't allow default skinparts to be deleted\r
4586         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4587             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4588         }\r
4589 \r
4590         $this->pagehead();\r
4591 \r
4592         $skin = new SKIN($skinid);\r
4593         $name = $skin->getName();\r
4594         $desc = $skin->getDescription();\r
4595 \r
4596         ?>\r
4597             <h2><?php echo _DELETE_CONFIRM?></h2>\r
4598 \r
4599             <p>\r
4600                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo ENTITY::hsc($skintype); ?> (<?php echo ENTITY::hsc($name); ?>)</b> (<?php echo  ENTITY::hsc($desc)?>)\r
4601             </p>\r
4602 \r
4603             <form method="post" action="index.php"><div>\r
4604                 <input type="hidden" name="action" value="skinremovetypeconfirm" />\r
4605                 <?php $manager->addTicketHidden() ?>\r
4606                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />\r
4607                 <input type="hidden" name="type" value="<?php echo ENTITY::hsc($skintype); ?>" />\r
4608                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
4609             </div></form>\r
4610         <?php\r
4611         $this->pagefoot();\r
4612     }\r
4613 \r
4614     /**\r
4615      * @todo document this\r
4616      */\r
4617     function action_skinremovetypeconfirm() {\r
4618         global $member, $CONF, $manager;\r
4619 \r
4620         $skinid = intRequestVar('skinid');\r
4621         $skintype = requestVar('type');\r
4622 \r
4623         if (!isValidShortName($skintype)) {\r
4624             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4625         }\r
4626 \r
4627         $member->isAdmin() or $this->disallow();\r
4628 \r
4629         // don't allow default skinparts to be deleted\r
4630         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {\r
4631             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4632         }\r
4633 \r
4634         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));\r
4635 \r
4636         // delete part\r
4637         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');\r
4638 \r
4639         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));\r
4640 \r
4641         $this->action_skinedit();\r
4642     }\r
4643 \r
4644     /**\r
4645      * @todo document this\r
4646      */\r
4647     function action_skinclone() {\r
4648         global $member;\r
4649 \r
4650         $skinid = intRequestVar('skinid');\r
4651 \r
4652         $member->isAdmin() or $this->disallow();\r
4653 \r
4654         // 1. read skin to clone\r
4655         $skin = new SKIN($skinid);\r
4656 \r
4657         $name = "clone_" . $skin->getName();\r
4658 \r
4659         // if a skin with that name already exists:\r
4660         if (SKIN::exists($name)) {\r
4661             $i = 1;\r
4662             while (SKIN::exists($name . $i))\r
4663                 $i++;\r
4664             $name .= $i;\r
4665         }\r
4666 \r
4667         // 2. create skin desc\r
4668         $newid = SKIN::createNew(\r
4669             $name,\r
4670             $skin->getDescription(),\r
4671             $skin->getContentType(),\r
4672             $skin->getIncludeMode(),\r
4673             $skin->getIncludePrefix()\r
4674         );\r
4675 \r
4676 \r
4677         // 3. clone\r
4678         /*\r
4679         $this->skinclonetype($skin, $newid, 'index');\r
4680         $this->skinclonetype($skin, $newid, 'item');\r
4681         $this->skinclonetype($skin, $newid, 'archivelist');\r
4682         $this->skinclonetype($skin, $newid, 'archive');\r
4683         $this->skinclonetype($skin, $newid, 'search');\r
4684         $this->skinclonetype($skin, $newid, 'error');\r
4685         $this->skinclonetype($skin, $newid, 'member');\r
4686         $this->skinclonetype($skin, $newid, 'imagepopup');\r
4687         */\r
4688 \r
4689         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;\r
4690         $res = sql_query($query);\r
4691         while ($row = sql_fetch_assoc($res)) {\r
4692             $this->skinclonetype($skin, $newid, $row['stype']);\r
4693         }\r
4694 \r
4695         $this->action_skinoverview();\r
4696 \r
4697     }\r
4698 \r
4699         /**\r
4700          * ADMIN::skinclonetype()\r
4701          * \r
4702          * @param       String  $skin   Skin object\r
4703          * @param       Integer $newid  ID for this clone\r
4704          * @param       String  $type   type of skin\r
4705          * @return      Void\r
4706          */\r
4707         function skinclonetype($skin, $newid, $type)\r
4708         {\r
4709                 $newid = intval($newid);\r
4710                 $content = $skin->getContent($type);\r
4711                 \r
4712                 if ( $content )\r
4713                 {\r
4714                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4715                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4716                         sql_query($query);\r
4717                 }\r
4718                 return;\r
4719         }\r
4720         \r
4721         /**\r
4722          * ADMIN::action_settingsedit()\r
4723          * \r
4724          * @param       Void\r
4725          * @return      Void\r
4726          */\r
4727         function action_settingsedit() {\r
4728                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4729 \r
4730                 $member->isAdmin() or $this->disallow();\r
4731 \r
4732                 $this->pagehead();\r
4733 \r
4734                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
4735                 ?>\r
4736 \r
4737                 <h2><?php echo _SETTINGS_TITLE?></h2>\r
4738 \r
4739                 <form action="index.php" method="post">\r
4740                 <div>\r
4741 \r
4742                 <input type="hidden" name="action" value="settingsupdate" />\r
4743                 <?php $manager->addTicketHidden() ?>\r
4744 \r
4745                 <table><tr>\r
4746                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>\r
4747                 </tr><tr>\r
4748                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>\r
4749                         <td>\r
4750                                 <?php\r
4751                                         $query =  'SELECT bname as text, bnumber as value'\r
4752                                                    . ' FROM '.sql_table('blog');\r
4753                                         $template['name'] = 'DefaultBlog';\r
4754                                         $template['selected'] = $CONF['DefaultBlog'];\r
4755                                         $template['tabindex'] = 10;\r
4756                                         showlist($query,'select',$template);\r
4757                                 ?>\r
4758                         </td>\r
4759                 </tr><tr>\r
4760                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>\r
4761                         <td>\r
4762                                 <?php\r
4763                                         $query =  'SELECT sdname as text, sdnumber as value'\r
4764                                                    . ' FROM '.sql_table('skin_desc');\r
4765                                         $template['name'] = 'BaseSkin';\r
4766                                         $template['selected'] = $CONF['BaseSkin'];\r
4767                                         $template['tabindex'] = 1;\r
4768                                         showlist($query,'select',$template);\r
4769                                 ?>\r
4770                         </td>\r
4771                 </tr><tr>\r
4772                         <td><?php echo _SETTINGS_ADMINMAIL?></td>\r
4773                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminEmail']) ?>" /></td>\r
4774                 </tr><tr>\r
4775                         <td><?php echo _SETTINGS_SITENAME?></td>\r
4776                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  ENTITY::hsc($CONF['SiteName']) ?>" /></td>\r
4777                 </tr><tr>\r
4778                         <td><?php echo _SETTINGS_SITEURL?></td>\r
4779                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  ENTITY::hsc($CONF['IndexURL']) ?>" /></td>\r
4780                 </tr><tr>\r
4781                         <td><?php echo _SETTINGS_ADMINURL?></td>\r
4782                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminURL']) ?>" /></td>\r
4783                 </tr><tr>\r
4784                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>\r
4785                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  ENTITY::hsc($CONF['PluginURL']) ?>" /></td>\r
4786                 </tr><tr>\r
4787                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>\r
4788                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  ENTITY::hsc($CONF['SkinsURL']) ?>" /></td>\r
4789                 </tr><tr>\r
4790                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>\r
4791                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  ENTITY::hsc($CONF['ActionURL']) ?>" /></td>\r
4792                 </tr><tr>\r
4793                         <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>\r
4794                         </td>\r
4795                         <td>\r
4796                                 <select name="Locale" tabindex="10050">\r
4797                         <?php\r
4798                                 $locales = i18n::get_available_locale_list();\r
4799                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )\r
4800                                 {\r
4801                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";\r
4802                                 }\r
4803                                 else\r
4804                                 {\r
4805                                         echo "<option value=\"\">en_Latn_US</option>\n";\r
4806                                 }\r
4807                                 \r
4808                                 foreach ( $locales as $locale )\r
4809                                 {\r
4810                                         if ( $locale == 'en_Latn_US' )\r
4811                                         {\r
4812                                                 continue;\r
4813                                         }\r
4814                                         if ( $locale == i18n::get_current_locale() )\r
4815                                         {\r
4816                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";\r
4817                                         }\r
4818                                         else\r
4819                                         {\r
4820                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";\r
4821                                         }\r
4822                                 }\r
4823                         ?>\r
4824                         </select>\r
4825 \r
4826                         </td>\r
4827                 </tr><tr>\r
4828                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>\r
4829                         </td>\r
4830                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>\r
4831                                         <br />\r
4832                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  ENTITY::hsc($CONF['DisableSiteURL'])?>" />\r
4833                         </td>\r
4834                 </tr><tr>\r
4835                         <td><?php echo _SETTINGS_DIRS?></td>\r
4836                         <td><?php echo  ENTITY::hsc($DIR_NUCLEUS) ?>\r
4837                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>\r
4838                 </tr><tr>\r
4839                         <td><?php echo _SETTINGS_DBLOGIN?></td>\r
4840                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>\r
4841                 </tr><tr>\r
4842                         <td>\r
4843                         <?php\r
4844                                 echo _SETTINGS_JSTOOLBAR\r
4845                                 /* =_SETTINGS_DISABLEJS\r
4846 \r
4847                                         I temporary changed the meaning of DisableJsTools, until I can find a good\r
4848                                         way to select the javascript version to use\r
4849 \r
4850                                         now, its:\r
4851                                                 0 : IE\r
4852                                                 1 : all javascript disabled\r
4853                                                 2 : 'simpler' javascript (for mozilla/opera/mac)\r
4854                                 */\r
4855                            ?>\r
4856                         </td>\r
4857                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>\r
4858                                 <select name="DisableJsTools" tabindex="10075">\r
4859                         <?php                              $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';\r
4860                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";\r
4861                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';\r
4862                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";\r
4863                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';\r
4864                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";\r
4865                         ?>\r
4866                                 </select>\r
4867                         </td>\r
4868                 </tr><tr>\r
4869                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>\r
4870                                            <td><?php\r
4871 \r
4872                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,\r
4873                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);\r
4874 \r
4875                                            echo ' ', _SETTINGS_URLMODE_HELP;\r
4876 \r
4877                                                          ?>\r
4878 \r
4879                                            </td>\r
4880                 </tr><tr>\r
4881                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>\r
4882                                            <td><?php\r
4883 \r
4884                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);\r
4885 \r
4886                                                          ?>\r
4887 \r
4888                                            </td>\r
4889                 </tr><tr>\r
4890                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>\r
4891                         <td>\r
4892                         <?php\r
4893                                 if (!array_key_exists('DefaultListSize',$CONF)) {\r
4894                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");\r
4895                                         $CONF['DefaultListSize'] = 10;\r
4896                                 }\r
4897                         ?>\r
4898                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  ENTITY::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />\r
4899                         </td>\r
4900                 </tr><tr>\r
4901                         <td><?php echo _SETTINGS_ADMINCSS?> \r
4902                         </td>\r
4903                         <td>\r
4904 \r
4905                                 <select name="AdminCSS" tabindex="10080">\r
4906                                 <?php                      // show a dropdown list of all available admin css files\r
4907                                 global $DIR_NUCLEUS;\r
4908                                 \r
4909                                 $dirhandle = opendir($DIR_NUCLEUS."styles/");\r
4910 \r
4911                                 while ($filename = readdir($dirhandle) )\r
4912                                 {\r
4913 \r
4914                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
4915                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)\r
4916 \r
4917                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )\r
4918                                         {\r
4919 \r
4920                                                 $name = $matches[1];\r
4921                                                 echo "<option value=\"$name\"";\r
4922 \r
4923                                                 if ($name == $CONF['AdminCSS'])\r
4924                                                 {\r
4925                                                         echo " selected=\"selected\"";\r
4926                                                 }\r
4927 \r
4928                                                 echo ">$name</option>";\r
4929 \r
4930                                         }\r
4931 \r
4932                                 }\r
4933 \r
4934                                 closedir($dirhandle);\r
4935 \r
4936                                 ?>\r
4937                                 </select>\r
4938 \r
4939                         </td>\r
4940                 </tr><tr>\r
4941                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>\r
4942                 </tr><tr>\r
4943                         <td><?php echo _SETTINGS_MEDIADIR?></td>\r
4944                         <td><?php echo  ENTITY::hsc($DIR_MEDIA) ?>\r
4945                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>\r
4946                                 <?php                              if (!is_dir($DIR_MEDIA))\r
4947                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";\r
4948                                         if (!is_readable($DIR_MEDIA))\r
4949                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";\r
4950                                         if (!is_writeable($DIR_MEDIA))\r
4951                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";\r
4952                                 ?>\r
4953                         </td>\r
4954                 </tr><tr>\r
4955                         <td><?php echo _SETTINGS_MEDIAURL?></td>\r
4956                         <td>\r
4957                                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  ENTITY::hsc($CONF['MediaURL']) ?>" />\r
4958                         </td>\r
4959                 </tr><tr>\r
4960                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>\r
4961                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>\r
4962                 </tr><tr>\r
4963                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>\r
4964                         <td>\r
4965                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  ENTITY::hsc($CONF['AllowedTypes']) ?>" />\r
4966                         </td>\r
4967                 </tr><tr>\r
4968                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>\r
4969                         <td>\r
4970                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  ENTITY::hsc($CONF['MaxUploadSize']) ?>" />\r
4971                         </td>\r
4972                 </tr><tr>\r
4973                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>\r
4974                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>\r
4975 \r
4976                 </tr><tr>\r
4977                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>\r
4978                 </tr><tr>\r
4979                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>\r
4980                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>\r
4981                 </tr><tr>\r
4982                         <td><?php echo _SETTINGS_ALLOWCREATE?>\r
4983                                 <?php help('allowaccountcreation'); ?>\r
4984                         </td>\r
4985                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>\r
4986                         </td>\r
4987                 </tr><tr>\r
4988                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>\r
4989                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>\r
4990                         </td>\r
4991                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>\r
4992                         </td>\r
4993                 </tr><tr>\r
4994                         <td><?php echo _SETTINGS_MEMBERMSGS?>\r
4995                                 <?php help('messageservice'); ?>\r
4996                         </td>\r
4997                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>\r
4998                         </td>\r
4999                 </tr><tr>\r
5000                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>\r
5001                                 <?php help('messageservice'); ?>\r
5002                         </td>\r
5003                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>\r
5004                         </td>\r
5005                 </tr><tr>\r
5006                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>\r
5007                                 <?php help('protectmemnames'); ?>\r
5008                         </td>\r
5009                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>\r
5010                         </td>\r
5011 \r
5012 \r
5013 \r
5014                 </tr><tr>\r
5015                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>\r
5016                 </tr><tr>\r
5017                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>\r
5018                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePrefix'])?>" /></td>\r
5019                 </tr><tr>\r
5020                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>\r
5021                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  ENTITY::hsc($CONF['CookieDomain'])?>" /></td>\r
5022                 </tr><tr>\r
5023                         <td><?php echo _SETTINGS_COOKIEPATH?></td>\r
5024                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePath'])?>" /></td>\r
5025                 </tr><tr>\r
5026                         <td><?php echo _SETTINGS_COOKIESECURE?></td>\r
5027                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>\r
5028                 </tr><tr>\r
5029                         <td><?php echo _SETTINGS_COOKIELIFE?></td>\r
5030                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,\r
5031                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>\r
5032                         </td>\r
5033                 </tr><tr>\r
5034                         <td><?php echo _SETTINGS_LASTVISIT?></td>\r
5035                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>\r
5036 \r
5037 \r
5038 \r
5039                 </tr><tr>\r
5040                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>\r
5041                 </tr><tr>\r
5042                         <td><?php echo _SETTINGS_UPDATE?></td>\r
5043                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>\r
5044                 </tr></table>\r
5045 \r
5046                 </div>\r
5047                 </form>\r
5048 \r
5049                 <?php\r
5050                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';\r
5051 \r
5052                         $manager->notify(\r
5053                                 'GeneralSettingsFormExtras',\r
5054                                 array()\r
5055                         );\r
5056 \r
5057                 $this->pagefoot();\r
5058         }\r
5059         \r
5060         /**\r
5061          * ADMIN::action_settingsupdate()\r
5062          * Update $CONFIG and redirect\r
5063          * \r
5064          * @param       void\r
5065          * @return      void\r
5066          */\r
5067         function action_settingsupdate() {\r
5068                 global $member, $CONF;\r
5069                 \r
5070                 $member->isAdmin() or $this->disallow();\r
5071                 \r
5072                 // check if email address for admin is valid\r
5073                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
5074                 {\r
5075                         $this->error(_ERROR_BADMAILADDRESS);\r
5076                 }\r
5077                 \r
5078                 // save settings\r
5079                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));\r
5080                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));\r
5081                 $this->updateConfig('IndexURL',          postVar('IndexURL'));\r
5082                 $this->updateConfig('AdminURL',          postVar('AdminURL'));\r
5083                 $this->updateConfig('PluginURL',                postVar('PluginURL'));\r
5084                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));\r
5085                 $this->updateConfig('ActionURL',                postVar('ActionURL'));\r
5086                 $this->updateConfig('Locale',              postVar('Locale'));\r
5087                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));\r
5088                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));\r
5089                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));\r
5090                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));\r
5091                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));\r
5092                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));\r
5093                 $this->updateConfig('SiteName',          postVar('SiteName'));\r
5094                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));\r
5095                 $this->updateConfig('DisableSite',        postVar('DisableSite'));\r
5096                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));\r
5097                 $this->updateConfig('LastVisit',                postVar('LastVisit'));\r
5098                 $this->updateConfig('MediaURL',          postVar('MediaURL'));\r
5099                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));\r
5100                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));\r
5101                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));\r
5102                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));\r
5103                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));\r
5104                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));\r
5105                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));\r
5106                 $this->updateConfig('CookiePath',          postVar('CookiePath'));\r
5107                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));\r
5108                 $this->updateConfig('URLMode',            postVar('URLMode'));\r
5109                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));\r
5110                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));\r
5111                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));\r
5112                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));\r
5113                 \r
5114                 // load new config and redirect (this way, the new locale will be used is necessary)\r
5115                 // note that when changing cookie settings, this redirect might cause the user\r
5116                 // to have to log in again.\r
5117                 getConfig();\r
5118                 redirect($CONF['AdminURL'] . '?action=manage');\r
5119                 exit;\r
5120         }\r
5121 \r
5122         /**\r
5123          * ADMIN::action_systemoverview()\r
5124          * Output system overview\r
5125          * \r
5126          * @param       void\r
5127          * @return      void\r
5128          */\r
5129         function action_systemoverview()\r
5130         {\r
5131                 global $member, $nucleus, $CONF;\r
5132                 \r
5133                 $this->pagehead();\r
5134                 \r
5135                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";\r
5136                 \r
5137                 if ( $member->isLoggedIn() && $member->isAdmin() )\r
5138                 {\r
5139                         // Information about the used PHP and MySQL installation\r
5140                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";\r
5141                         \r
5142                         // Version of PHP MySQL\r
5143                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";\r
5144                         echo "<thead>\n";\r
5145                         echo "<tr>\n";\r
5146                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";\r
5147                         echo "</tr>\n";\r
5148                         echo "</thead>\n";\r
5149                         echo "<tbody>\n";\r
5150                         echo "<tr>\n";\r
5151                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";\r
5152                         echo '<td>' . phpversion() . "</td>\n";\r
5153                         echo "</tr>\n";\r
5154                         echo "<tr>\n";\r
5155                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";\r
5156                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";\r
5157                         echo "</tr>\n";\r
5158                         echo "</tbody>\n";\r
5159                         echo "</table>\n\n";\r
5160                         \r
5161                         // Important PHP settings\r
5162                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";\r
5163                         echo "<thead>\n";\r
5164                         echo "<tr>\n";\r
5165                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";\r
5166                         echo "</tr>\n";\r
5167                         echo "</thead>\n";\r
5168                         echo "<tbody>\n";\r
5169                         echo "<tr>\n";\r
5170                         echo '<td>magic_quotes_gpc' . "</td>\n";\r
5171                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';\r
5172                         echo '<td>' . $mqg . "</td>\n";\r
5173                         echo "</tr>\n";\r
5174                         echo "<tr>\n";\r
5175                         echo '<td>magic_quotes_runtime' . "</td>\n";\r
5176                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';\r
5177                         echo '<td>' . $mqr . "</td>\n";\r
5178                         echo "</tr>\n";\r
5179                         echo "<tr>\n";\r
5180                         echo '<td>register_globals' . "</td>\n";\r
5181                         $rg = ini_get('register_globals') ? 'On' : 'Off';\r
5182                         echo '<td>' . $rg . "</td>\n";\r
5183                         echo "</tr>\n";\r
5184                         echo "</tbody>\n";\r
5185                         echo "</table>\n\n";\r
5186                         \r
5187                         // Information about GD library\r
5188                         $gdinfo = gd_info();\r
5189                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";\r
5190                         echo "<thead>\n";\r
5191                         echo "<tr>\n";\r
5192                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";\r
5193                         echo "</tr>\n";\r
5194                         echo "</thead>\n";\r
5195                         echo "<tbody>\n";\r
5196                         foreach ( $gdinfo as $key=>$value )\r
5197                         {\r
5198                                 if ( is_bool($value) )\r
5199                                 {\r
5200                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5201                                 }\r
5202                                 else\r
5203                                 {\r
5204                                         $value = ENTITY::hsc($value);\r
5205                                 }\r
5206                                 echo "<tr>\n";\r
5207                                 echo '<td>' . $key . "</td>\n";\r
5208                                 echo '<td>' . $value . "</td>\n";\r
5209                                 echo "</tr>\n";\r
5210                         }\r
5211                         echo "</tbody>\n";\r
5212                         echo "</table>\n\n";\r
5213 \r
5214                         // Check if special modules are loaded\r
5215                         ob_start();\r
5216                         phpinfo(INFO_MODULES);\r
5217                         $im = ob_get_contents();\r
5218                         ob_clean();\r
5219                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";\r
5220                         echo "<thead>\n";\r
5221                         echo "<tr>";\r
5222                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";\r
5223                         echo "</tr>\n";\r
5224                         echo "<tbody>\n";\r
5225                         echo "<tr>\n";\r
5226                         echo '<td>mod_rewrite' . "</td>\n";\r
5227                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?\r
5228                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :\r
5229                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5230                         echo '<td>' . $modrewrite . "</td>\n";\r
5231                         echo "</tr>\n";\r
5232                         echo "</tbody>\n";\r
5233                         echo "</table>\n\n";\r
5234 \r
5235                         // Information about the used Nucleus CMS\r
5236                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";\r
5237                         global $nucleus;\r
5238                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';\r
5239                         $np = getNucleusPatchLevel();\r
5240                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";\r
5241                         echo "<thead>\n";\r
5242                         echo "<tr>\n";\r
5243                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";\r
5244                         echo "</tr>\n";\r
5245                         echo "</thead>\n";\r
5246                         echo "<tbody>\n";\r
5247                         echo "<tr>\n";\r
5248                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";\r
5249                         echo '<td>' . $nv . "</td>\n";\r
5250                         echo "</tr>\n";\r
5251                         echo "<tr>\n";\r
5252                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";\r
5253                         echo '<td>' . $np . "</td>\n";\r
5254                         echo "</tr>\n";\r
5255                         echo "</tbody>\n";\r
5256                         echo "</table>\n\n";\r
5257 \r
5258                         // Important settings of the installation\r
5259                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";\r
5260                         echo "<thead>\n";\r
5261                         echo "<tr>\n";\r
5262                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";\r
5263                         echo "</tr>\n";\r
5264                         echo "</thead>\n";\r
5265                         echo "<tbody>\n";\r
5266                         echo "<tr>\n";\r
5267                         echo '<td>' . '$CONF[' . "'Self']</td>\n";\r
5268                         echo '<td>' . $CONF['Self'] . "</td>\n";\r
5269                         echo "</tr>\n";\r
5270                         echo "<tr>\n";\r
5271                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";\r
5272                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";\r
5273                         echo "</tr>\n";\r
5274                         echo "<tr>\n";\r
5275                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";\r
5276                         $ohs = $CONF['alertOnHeadersSent'] ?\r
5277                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :\r
5278                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;\r
5279                         echo '<td>' . $ohs . "</td>\n";\r
5280                         echo "</tr>\n";\r
5281                         echo "<tr>\n";\r
5282                         echo "<td>i18n::get_current_charset()</td>\n";\r
5283                         echo '<td>' . i18n::get_current_charset() . "</td>\n";\r
5284                         echo "</tr>\n";\r
5285                         echo "</tbody>\n";\r
5286                         echo "</table>\n\n";\r
5287 \r
5288                         // Link to the online version test at the Nucleus CMS website\r
5289                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";\r
5290                         if ( $nucleus['codename'] != '')\r
5291                         {\r
5292                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';\r
5293                         }\r
5294                         else\r
5295                         {\r
5296                                 $codenamestring = '';\r
5297                         }\r
5298                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;\r
5299                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
5300                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';\r
5301                         echo 'Nucleus CMS ' . $nv . $codenamestring;\r
5302                         echo '</a>';\r
5303                 }\r
5304                 else\r
5305                 {\r
5306                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;\r
5307                 }\r
5308                 $this->pagefoot();\r
5309         }\r
5310 \r
5311         /**\r
5312          * ADMIN::updateConfig()\r
5313          * \r
5314          * @param       string  $name   \r
5315          * @param       string  $val    \r
5316          * @return      integer return the ID in which the latest query posted\r
5317          */\r
5318         function updateConfig($name, $val)\r
5319         {\r
5320                 $name = sql_real_escape_string($name);\r
5321                 $val = trim(sql_real_escape_string($val));\r
5322                 \r
5323                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
5324                 $query = sprintf($query, sql_table('config'), $val, $name);\r
5325                 sql_query($query) or die("Query error: " . sql_error());\r
5326                 return sql_insert_id();\r
5327         }\r
5328         \r
5329         /**\r
5330          * Error message\r
5331          * @param string $msg message that will be shown\r
5332          */\r
5333         function error($msg)\r
5334         {\r
5335                 $this->pagehead();\r
5336                 \r
5337                 echo "<h2>Error!</h2>\n";\r
5338                 echo $msg;\r
5339                 echo "<br />\n";\r
5340                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";\r
5341                 $this->pagefoot();\r
5342                 exit;\r
5343         }\r
5344         \r
5345         /**\r
5346          * ADMIN::disallow()\r
5347          * add error log and show error page \r
5348          * \r
5349          * @param       void\r
5350          * @return      void\r
5351          */\r
5352         function disallow()\r
5353         {\r
5354                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
5355                 $this->error(_ERROR_DISALLOWED);\r
5356         }\r
5357         \r
5358         /**\r
5359          * ADMIN::pagehead()\r
5360          * Output admin page head\r
5361          * \r
5362          * @param       void\r
5363          * @return      void\r
5364          */\r
5365         function pagehead($extrahead = '')\r
5366         {\r
5367                 global $member, $nucleus, $CONF, $manager;\r
5368                 \r
5369                 $manager->notify(\r
5370                         'AdminPrePageHead',\r
5371                         array(\r
5372                                 'extrahead' => &$extrahead,\r
5373                                 'action' => $this->action));\r
5374                 \r
5375                 $baseUrl = ENTITY::hsc($CONF['AdminURL']);\r
5376                 if ( !array_key_exists('AdminCSS',$CONF) )\r
5377                 {\r
5378                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");\r
5379                         $CONF['AdminCSS'] = 'original';\r
5380                 }\r
5381                 \r
5382                 /* HTTP 1.1 application for no caching */\r
5383                 header("Cache-Control: no-cache, must-revalidate");\r
5384                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
5385                 \r
5386                 $root_element = 'html';\r
5387                 $charset = i18n::get_current_charset();\r
5388                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
5389                 \r
5390                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
5391                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";\r
5392                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
5393                 echo "<head>\n";\r
5394                 echo '<title>' . ENTITY::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
5395                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
5396                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";\r
5397                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
5398                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
5399                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
5400                 echo "{$extrahead}\n";\r
5401                 echo "</head>\n\n";\r
5402                 echo "<body>\n";\r
5403                 echo "<div id=\"adminwrapper\">\n";\r
5404                 echo "<div class=\"header\">\n";\r
5405                 echo '<h1>' . ENTITY::hsc($CONF['SiteName']) . "</h1>\n";\r
5406                 echo "</div>\n";\r
5407                 echo "<div id=\"container\">\n";\r
5408                 echo "<div id=\"content\">\n";\r
5409                 echo "<div class=\"loginname\">\n";\r
5410                 if ( $member->isLoggedIn() )\r
5411                 {\r
5412                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
5413                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
5414                 }\r
5415                 else\r
5416                 {\r
5417                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
5418                 }\r
5419                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
5420                 echo '(';\r
5421                 \r
5422                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
5423                 {\r
5424                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
5425                 }\r
5426                 else\r
5427                 {\r
5428                         $codenamestring = '';\r
5429                 }\r
5430                 \r
5431                 if ( $member->isLoggedIn() && $member->isAdmin() )\r
5432                 {\r
5433                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
5434                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
5435                         \r
5436                         $newestVersion = getLatestVersion();\r
5437                         $newestCompare = str_replace('/','.',$newestVersion);\r
5438                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);\r
5439                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
5440                         {\r
5441                                 echo "<br />\n";\r
5442                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
5443                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
5444                                 echo "</a>";\r
5445                         }\r
5446                 }\r
5447                 else\r
5448                 {\r
5449                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;\r
5450                 }\r
5451                 echo ')';\r
5452                 echo '</div>';\r
5453                 return;\r
5454         }\r
5455         \r
5456         /**\r
5457          * ADMIN::pagefoot()\r
5458          * Output admin page foot include quickmenu\r
5459          * \r
5460          * @param       void\r
5461          * @return      void\r
5462          */\r
5463         function pagefoot()\r
5464         {\r
5465                 global $action, $member, $manager;\r
5466                 \r
5467                 $manager->notify(\r
5468                         'AdminPrePageFoot',\r
5469                         array('action' => $this->action)\r
5470                 );\r
5471                 \r
5472                 if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
5473                 {\r
5474                         echo '<h2>' . _LOGOUT . "</h2>\n";\r
5475                         echo "<ul>\n";\r
5476                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
5477                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
5478                         echo "</ul>\n";\r
5479                 }\r
5480                 \r
5481                 echo "<div class=\"foot\">\n";\r
5482                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
5483                 echo '-';\r
5484                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
5485                 echo "</div>\n";\r
5486                 \r
5487                 echo "<!-- content -->\n";\r
5488                 echo "<div id=\"quickmenu\">\n";\r
5489                 \r
5490                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
5491                 {\r
5492                         echo "<ul>\n";\r
5493                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
5494                         echo "</ul>\n";\r
5495                         \r
5496                         echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
5497                         echo "<form method=\"get\" action=\"index.php\">\n";\r
5498                         echo "<p>\n";\r
5499                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
5500                         \r
5501                         $showAll = requestVar('showall');\r
5502                         \r
5503                         if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
5504                         {\r
5505                                 // Super-Admins have access to all blogs! (no add item support though)\r
5506                                 $query =  'SELECT bnumber as value, bname as text'\r
5507                                                 . ' FROM ' . sql_table('blog')\r
5508                                                 . ' ORDER BY bname';\r
5509                         }\r
5510                         else\r
5511                         {\r
5512                                 $query =  'SELECT bnumber as value, bname as text'\r
5513                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
5514                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
5515                                                 . ' ORDER BY bname';\r
5516                         }\r
5517                         $template['name'] = 'blogid';\r
5518                         $template['tabindex'] = 15000;\r
5519                         $template['extra'] = _QMENU_ADD_SELECT;\r
5520                         $template['selected'] = -1;\r
5521                         $template['shorten'] = 10;\r
5522                         $template['shortenel'] = '';\r
5523                         $template['javascript'] = 'onchange="return form.submit()"';\r
5524                         showlist($query,'select',$template);\r
5525                         \r
5526                         echo "</p>\n";\r
5527                         echo "</form>\n";\r
5528                         \r
5529                         echo "<h2>{$member->getDisplayName()}</h2>\n";\r
5530                         echo "<ul>\n";\r
5531                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
5532                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
5533                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
5534                         echo "</ul>\n";\r
5535                         \r
5536                         // ---- general settings ----\r
5537                         if ( $member->isAdmin() )\r
5538                         {\r
5539                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
5540                                 echo "<ul>\n";\r
5541                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
5542                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
5543                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
5544                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
5545                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
5546                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
5547                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
5548                                 echo "</ul>\n";\r
5549                                 \r
5550                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
5551                                 echo "<ul>\n";\r
5552                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
5553                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
5554                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
5555                                 echo "</ul>\n";\r
5556                         }\r
5557                         \r
5558                         $aPluginExtras = array();\r
5559                         $manager->notify(\r
5560                                 'QuickMenu',\r
5561                                 array(\r
5562                                         'options' => &$aPluginExtras));\r
5563                         \r
5564                         if ( count($aPluginExtras) > 0 )\r
5565                         {\r
5566                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
5567                                 echo "<ul>\n";\r
5568                                 foreach ( $aPluginExtras as $aInfo )\r
5569                                 {\r
5570                                         echo '<li><a href="' . ENTITY::hsc($aInfo['url']) . '" title="' . ENTITY::hsc($aInfo['tooltip']) . '">' . ENTITY::hsc($aInfo['title']) . "</a></li>\n";\r
5571                                 }\r
5572                                 echo "</ul>\n";\r
5573                         }\r
5574                 }\r
5575                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
5576                 {\r
5577                 \r
5578                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
5579                 }\r
5580                 else\r
5581                 {\r
5582                         // introduction text on login screen\r
5583                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
5584                 }\r
5585                 \r
5586                 echo "<!-- quickmenu -->\n";\r
5587                 echo "</div>\n";\r
5588                 \r
5589                 echo "<!-- content -->\n";\r
5590                 echo "</div>\n";\r
5591                 \r
5592                 echo "<!-- container -->\n";\r
5593                 echo "</div>\n";\r
5594                 \r
5595                 echo "<!-- adminwrapper -->\n";\r
5596                 echo "</div>\n";\r
5597                 \r
5598                 echo "</body>\n";\r
5599                 echo "</html>\n";\r
5600                 return;\r
5601         }\r
5602         \r
5603     /**\r
5604      * @todo document this\r
5605      */\r
5606     function action_regfile() {\r
5607         global $member, $CONF;\r
5608 \r
5609         $blogid = intRequestVar('blogid');\r
5610 \r
5611         $member->teamRights($blogid) or $this->disallow();\r
5612 \r
5613         // header-code stolen from phpMyAdmin\r
5614         // REGEDIT and bookmarklet code stolen from GreyMatter\r
5615 \r
5616         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));\r
5617 \r
5618 \r
5619         header('Content-Type: application/octetstream');\r
5620         header('Content-Disposition: filename="nucleus.reg"');\r
5621         header('Pragma: no-cache');\r
5622         header('Expires: 0');\r
5623 \r
5624         echo "REGEDIT4\n";\r
5625         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";\r
5626         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";\r
5627         echo '"contexts"=hex:31';\r
5628     }\r
5629 \r
5630     /**\r
5631      * @todo document this\r
5632      */\r
5633     function action_bookmarklet() {\r
5634         global $member, $manager;\r
5635 \r
5636         $blogid = intRequestVar('blogid');\r
5637 \r
5638         $member->teamRights($blogid) or $this->disallow();\r
5639 \r
5640         $blog =& $manager->getBlog($blogid);\r
5641         $bm = getBookmarklet($blogid);\r
5642 \r
5643         $this->pagehead();\r
5644 \r
5645         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
5646 \r
5647         ?>\r
5648 \r
5649         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>\r
5650 \r
5651         <p>\r
5652         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>\r
5653         </p>\r
5654 \r
5655         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>\r
5656         <p>\r
5657             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>\r
5658             <br />\r
5659             <br />\r
5660             <?php echo '<a href="' . ENTITY::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, ENTITY::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>\r
5661         </p>\r
5662 \r
5663         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>\r
5664         <p>\r
5665             <?php\r
5666                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);\r
5667                 $url = $manager->addTicketToUrl($url);\r
5668             ?>\r
5669             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . ENTITY::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>\r
5670         </p>\r
5671 \r
5672         <p>\r
5673             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>\r
5674         </p>\r
5675 \r
5676         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>\r
5677         <p>\r
5678             <?php echo _BOOKMARKLET_DELETEBAR ?>\r
5679         </p>\r
5680 \r
5681         <p>\r
5682             <?php echo _BOOKMARKLET_DELETERIGHTT ?>\r
5683         </p>\r
5684 \r
5685         <ol>\r
5686             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>\r
5687             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>\r
5688             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>\r
5689             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>\r
5690             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>\r
5691         </ol>\r
5692 \r
5693         <?php\r
5694         $this->pagefoot();\r
5695 \r
5696     }\r
5697 \r
5698     /**\r
5699      * @todo document this\r
5700      */\r
5701     function action_actionlog() {\r
5702         global $member, $manager;\r
5703 \r
5704         $member->isAdmin() or $this->disallow();\r
5705 \r
5706         $this->pagehead();\r
5707 \r
5708         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
5709 \r
5710         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');\r
5711 \r
5712         ?>\r
5713             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>\r
5714             <p><a href="<?php echo ENTITY::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>\r
5715         <?php\r
5716         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';\r
5717 \r
5718         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';\r
5719         $template['content'] = 'actionlist';\r
5720         $amount = showlist($query,'table',$template);\r
5721 \r
5722         $this->pagefoot();\r
5723 \r
5724     }\r
5725 \r
5726     /**\r
5727      * @todo document this\r
5728      */\r
5729     function action_banlist() {\r
5730         global $member, $manager;\r
5731 \r
5732         $blogid = intRequestVar('blogid');\r
5733 \r
5734         $member->blogAdminRights($blogid) or $this->disallow();\r
5735 \r
5736         $blog =& $manager->getBlog($blogid);\r
5737 \r
5738         $this->pagehead();\r
5739 \r
5740         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';\r
5741 \r
5742         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";\r
5743 \r
5744         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';\r
5745         $template['content'] = 'banlist';\r
5746         $amount = showlist($query,'table',$template);\r
5747 \r
5748         if ($amount == 0)\r
5749             echo _BAN_NONE;\r
5750 \r
5751         echo '<h2>'._BAN_NEW_TITLE.'</h2>';\r
5752         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";\r
5753 \r
5754 \r
5755         $this->pagefoot();\r
5756 \r
5757     }\r
5758 \r
5759     /**\r
5760      * @todo document this\r
5761      */\r
5762     function action_banlistdelete() {\r
5763         global $member, $manager;\r
5764 \r
5765         $blogid = intRequestVar('blogid');\r
5766         $iprange = requestVar('iprange');\r
5767 \r
5768         $member->blogAdminRights($blogid) or $this->disallow();\r
5769 \r
5770         $blog =& $manager->getBlog($blogid);\r
5771         $banBlogName =  ENTITY::hsc($blog->getName());\r
5772 \r
5773         $this->pagehead();\r
5774         ?>\r
5775             <h2><?php echo _BAN_REMOVE_TITLE?></h2>\r
5776 \r
5777             <form method="post" action="index.php">\r
5778 \r
5779             <h3><?php echo _BAN_IPRANGE?></h3>\r
5780 \r
5781             <p>\r
5782                 <?php echo _CONFIRMTXT_BAN?> <?php echo ENTITY::hsc($iprange) ?>\r
5783                 <input name="iprange" type="hidden" value="<?php echo ENTITY::hsc($iprange)?>" />\r
5784             </p>\r
5785 \r
5786             <h3><?php echo _BAN_BLOGS?></h3>\r
5787 \r
5788             <div>\r
5789                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
5790                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />\r
5791                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>\r
5792                 <br />\r
5793                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>\r
5794             </div>\r
5795 \r
5796             <h3><?php echo _BAN_DELETE_TITLE?></h3>\r
5797 \r
5798             <div>\r
5799                 <?php $manager->addTicketHidden() ?>\r
5800                 <input type="hidden" name="action" value="banlistdeleteconfirm" />\r
5801                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
5802             </div>\r
5803 \r
5804             </form>\r
5805         <?php\r
5806         $this->pagefoot();\r
5807     }\r
5808 \r
5809     /**\r
5810      * @todo document this\r
5811      */\r
5812     function action_banlistdeleteconfirm() {\r
5813         global $member, $manager;\r
5814 \r
5815         $blogid = intPostVar('blogid');\r
5816         $allblogs = postVar('allblogs');\r
5817         $iprange = postVar('iprange');\r
5818 \r
5819         $member->blogAdminRights($blogid) or $this->disallow();\r
5820 \r
5821         $deleted = array();\r
5822 \r
5823         if (!$allblogs) {\r
5824             if (BAN::removeBan($blogid, $iprange))\r
5825                 array_push($deleted, $blogid);\r
5826         } else {\r
5827             // get blogs fot which member has admin rights\r
5828             $adminblogs = $member->getAdminBlogs();\r
5829             foreach ($adminblogs as $blogje) {\r
5830                 if (BAN::removeBan($blogje, $iprange))\r
5831                     array_push($deleted, $blogje);\r
5832             }\r
5833         }\r
5834 \r
5835         if (sizeof($deleted) == 0)\r
5836             $this->error(_ERROR_DELETEBAN);\r
5837 \r
5838         $this->pagehead();\r
5839 \r
5840         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';\r
5841         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';\r
5842         echo "<p>"._BAN_REMOVED_TEXT."</p>";\r
5843 \r
5844         echo "<ul>";\r
5845         foreach ($deleted as $delblog) {\r
5846             $b =& $manager->getBlog($delblog);\r
5847             echo "<li>" . ENTITY::hsc($b->getName()). "</li>";\r
5848         }\r
5849         echo "</ul>";\r
5850 \r
5851         $this->pagefoot();\r
5852 \r
5853     }\r
5854 \r
5855     /**\r
5856      * @todo document this\r
5857      */\r
5858     function action_banlistnewfromitem() {\r
5859         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5860     }\r
5861 \r
5862     /**\r
5863      * @todo document this\r
5864      */\r
5865     function action_banlistnew($blogid = '') {\r
5866         global $member, $manager;\r
5867 \r
5868         if ($blogid == '')\r
5869             $blogid = intRequestVar('blogid');\r
5870 \r
5871         $ip = requestVar('ip');\r
5872 \r
5873         $member->blogAdminRights($blogid) or $this->disallow();\r
5874 \r
5875         $blog =& $manager->getBlog($blogid);\r
5876 \r
5877         $this->pagehead();\r
5878         ?>\r
5879         <h2><?php echo _BAN_ADD_TITLE?></h2>\r
5880 \r
5881 \r
5882         <form method="post" action="index.php">\r
5883 \r
5884         <h3><?php echo _BAN_IPRANGE?></h3>\r
5885 \r
5886         <p><?php echo _BAN_IPRANGE_TEXT?></p>\r
5887 \r
5888         <div class="note">\r
5889             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>\r
5890             <?php echo _BAN_EXAMPLE_TEXT ?>\r
5891         </div>\r
5892 \r
5893         <div>\r
5894         <?php\r
5895         if ($ip) {\r
5896             $iprangeVal = ENTITY::hsc($ip);\r
5897         ?>\r
5898             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />\r
5899             <label for="ip_fixed"><?php echo $iprangeVal ?></label>\r
5900             <br />\r
5901             <input name="iprange" type="radio" value="custom" id="ip_custom" />\r
5902             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>\r
5903             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />\r
5904         <?php\r
5905         } else {\r
5906             echo "<input name='iprange' value='custom' type='hidden' />";\r
5907             echo "<input name='customiprange' value='' maxlength='15' size='15' />";\r
5908         }\r
5909         ?>\r
5910         </div>\r
5911 \r
5912         <h3><?php echo _BAN_BLOGS?></h3>\r
5913 \r
5914         <p><?php echo _BAN_BLOGS_TEXT?></p>\r
5915 \r
5916         <div>\r
5917             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />\r
5918             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo ENTITY::hsc($blog->getName())?>'</label>\r
5919             <br />\r
5920             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>\r
5921         </div>\r
5922 \r
5923         <h3><?php echo _BAN_REASON_TITLE?></h3>\r
5924 \r
5925         <p><?php echo _BAN_REASON_TEXT?></p>\r
5926 \r
5927         <div><textarea name="reason" cols="40" rows="5"></textarea></div>\r
5928 \r
5929         <h3><?php echo _BAN_ADD_TITLE?></h3>\r
5930 \r
5931         <div>\r
5932             <input name="action" type="hidden" value="banlistadd" />\r
5933             <?php $manager->addTicketHidden() ?>\r
5934             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />\r
5935         </div>\r
5936 \r
5937         </form>\r
5938 \r
5939         <?php       $this->pagefoot();\r
5940     }\r
5941 \r
5942     /**\r
5943      * @todo document this\r
5944      */\r
5945     function action_banlistadd() {\r
5946         global $member;\r
5947 \r
5948         $blogid =       intPostVar('blogid');\r
5949         $allblogs =     postVar('allblogs');\r
5950         $iprange =      postVar('iprange');\r
5951         if ($iprange == "custom")\r
5952             $iprange = postVar('customiprange');\r
5953         $reason =       postVar('reason');\r
5954 \r
5955         $member->blogAdminRights($blogid) or $this->disallow();\r
5956 \r
5957         // TODO: check IP range validity\r
5958 \r
5959         if (!$allblogs) {\r
5960             if (!BAN::addBan($blogid, $iprange, $reason))\r
5961                 $this->error(_ERROR_ADDBAN);\r
5962         } else {\r
5963             // get blogs fot which member has admin rights\r
5964             $adminblogs = $member->getAdminBlogs();\r
5965             $failed = 0;\r
5966             foreach ($adminblogs as $blogje) {\r
5967                 if (!BAN::addBan($blogje, $iprange, $reason))\r
5968                     $failed = 1;\r
5969             }\r
5970             if ($failed)\r
5971                 $this->error(_ERROR_ADDBAN);\r
5972         }\r
5973 \r
5974         $this->action_banlist();\r
5975 \r
5976     }\r
5977 \r
5978     /**\r
5979      * @todo document this\r
5980      */\r
5981     function action_clearactionlog() {\r
5982         global $member;\r
5983 \r
5984         $member->isAdmin() or $this->disallow();\r
5985 \r
5986         ACTIONLOG::clear();\r
5987 \r
5988         $this->action_manage(_MSG_ACTIONLOGCLEARED);\r
5989     }\r
5990 \r
5991     /**\r
5992      * @todo document this\r
5993      */\r
5994     function action_backupoverview() {\r
5995         global $member, $manager;\r
5996 \r
5997         $member->isAdmin() or $this->disallow();\r
5998 \r
5999         $this->pagehead();\r
6000 \r
6001         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
6002         ?>\r
6003         <h2><?php echo _BACKUPS_TITLE?></h2>\r
6004 \r
6005         <h3><?php echo _BACKUP_TITLE?></h3>\r
6006 \r
6007         <p><?php echo _BACKUP_INTRO?></p>\r
6008 \r
6009         <form method="post" action="index.php"><p>\r
6010         <input type="hidden" name="action" value="backupcreate" />\r
6011         <?php $manager->addTicketHidden() ?>\r
6012 \r
6013         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>\r
6014         <br />\r
6015         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>\r
6016         <br /><br />\r
6017         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />\r
6018 \r
6019         </p></form>\r
6020 \r
6021         <div class="note"><?php echo _BACKUP_NOTE?></div>\r
6022 \r
6023 \r
6024         <h3><?php echo _RESTORE_TITLE?></h3>\r
6025 \r
6026         <div class="note"><?php echo _RESTORE_NOTE?></div>\r
6027 \r
6028         <p><?php echo _RESTORE_INTRO?></p>\r
6029 \r
6030         <form method="post" action="index.php" enctype="multipart/form-data"><p>\r
6031             <input type="hidden" name="action" value="backuprestore" />\r
6032             <?php $manager->addTicketHidden() ?>\r
6033             <input name="backup_file" type="file" tabindex="30" />\r
6034             <br /><br />\r
6035             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />\r
6036             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>\r
6037             <br /><?php echo _RESTORE_WARNING?>\r
6038         </p></form>\r
6039 \r
6040         <?php       $this->pagefoot();\r
6041     }\r
6042 \r
6043         /**\r
6044          * ADMIN::action_backupcreate()\r
6045          * create file for backup\r
6046          * \r
6047          * @param               void\r
6048          * @return      void\r
6049          * \r
6050          */\r
6051         function action_backupcreate()\r
6052         {\r
6053                 global $member, $DIR_LIBS;\r
6054                 \r
6055                 $member->isAdmin() or $this->disallow();\r
6056                 \r
6057                 // use compression ?\r
6058                 $useGzip = (integer) postVar('gzip');\r
6059                 \r
6060                 include($DIR_LIBS . 'backup.php');\r
6061                 \r
6062                 // try to extend time limit\r
6063                 // (creating/restoring dumps might take a while)\r
6064                 @set_time_limit(1200);\r
6065                 \r
6066                 Backup::do_backup($useGzip);\r
6067                 exit;\r
6068         }\r
6069         \r
6070         /**\r
6071          * ADMIN::action_backuprestore()\r
6072          * restoring from uploaded file\r
6073          * \r
6074          * @param               void\r
6075          * @return      void\r
6076          */\r
6077         function action_backuprestore()\r
6078         {\r
6079                 global $member, $DIR_LIBS;\r
6080                 \r
6081                 $member->isAdmin() or $this->disallow();\r
6082                 \r
6083                 if ( intPostVar('letsgo') != 1 )\r
6084                 {\r
6085                         $this->error(_ERROR_BACKUP_NOTSURE);\r
6086                 }\r
6087                 \r
6088                 include($DIR_LIBS . 'backup.php');\r
6089                 \r
6090                 // try to extend time limit\r
6091                 // (creating/restoring dumps might take a while)\r
6092                 @set_time_limit(1200);\r
6093                 \r
6094                 $message = Backup::do_restore();\r
6095                 if ( $message != '' )\r
6096                 {\r
6097                         $this->error($message);\r
6098                 }\r
6099                 $this->pagehead();\r
6100                 echo '<h2>' . _RESTORE_COMPLETE . "</h2>\n";\r
6101                 $this->pagefoot();\r
6102                 return;\r
6103         }\r
6104 \r
6105         /**\r
6106      * @todo document this\r
6107      */\r
6108     function action_pluginlist() {\r
6109         global $member, $manager;\r
6110 \r
6111         // check if allowed\r
6112         $member->isAdmin() or $this->disallow();\r
6113 \r
6114         $this->pagehead();\r
6115 \r
6116         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';\r
6117 \r
6118         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';\r
6119 \r
6120         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';\r
6121 \r
6122 \r
6123         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';\r
6124 \r
6125         $template['content'] = 'pluginlist';\r
6126         $template['tabindex'] = 10;\r
6127         showlist($query, 'table', $template);\r
6128 \r
6129 ?>\r
6130                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>\r
6131 \r
6132                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>\r
6133 \r
6134                         <form method="post" action="index.php"><div>\r
6135                                 <input type="hidden" name="action" value="pluginupdate" />\r
6136                                 <?php $manager->addTicketHidden() ?>\r
6137                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />\r
6138                         </div></form>\r
6139 \r
6140                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>\r
6141 \r
6142 <?php\r
6143                 // find a list of possibly non-installed plugins\r
6144                 $candidates = array();\r
6145 \r
6146                 global $DIR_PLUGINS;\r
6147 \r
6148                 $dirhandle = opendir($DIR_PLUGINS);\r
6149 \r
6150                 while ($filename = readdir($dirhandle) )\r
6151                 {\r
6152 \r
6153                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
6154                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)\r
6155 \r
6156                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )\r
6157                         {\r
6158 \r
6159                                 $name = $matches[1];\r
6160                                 // only show in list when not yet installed\r
6161                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE pfile = "NP_' . sql_real_escape_string($name) . '"');\r
6162 \r
6163                                 if (sql_num_rows($res) == 0)\r
6164                                 {\r
6165                                         array_push($candidates, $name);\r
6166                                 }\r
6167 \r
6168                         }\r
6169 \r
6170                 }\r
6171 \r
6172                 closedir($dirhandle);\r
6173 \r
6174                 if (sizeof($candidates) > 0)\r
6175                 {\r
6176 ?>\r
6177                         <p><?php echo _PLUGS_ADD_TEXT?></p>\r
6178 \r
6179                         <form method='post' action='index.php'><div>\r
6180                                 <input type='hidden' name='action' value='pluginadd' />\r
6181                                 <?php $manager->addTicketHidden() ?>\r
6182                                 <select name="filename" tabindex="30">\r
6183 <?php\r
6184                         foreach($candidates as $name)\r
6185                         {\r
6186                                 echo '<option value="NP_',$name,'">',ENTITY::hsc($name),'</option>';\r
6187                         }\r
6188 ?>\r
6189                                 </select>\r
6190                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />\r
6191                         </div></form>\r
6192 \r
6193 <?php\r
6194                 }\r
6195                 else\r
6196                 {\r
6197                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';\r
6198                 }\r
6199 \r
6200                 $this->pagefoot();\r
6201 \r
6202         }\r
6203 \r
6204     /**\r
6205      * @todo document this\r
6206      */\r
6207     function action_pluginhelp() {\r
6208         global $member, $manager, $DIR_PLUGINS, $CONF;\r
6209 \r
6210         // check if allowed\r
6211         $member->isAdmin() or $this->disallow();\r
6212 \r
6213         $plugid = intGetVar('plugid');\r
6214 \r
6215         if (!$manager->pidInstalled($plugid))\r
6216             $this->error(_ERROR_NOSUCHPLUGIN);\r
6217 \r
6218         $plugName = getPluginNameFromPid($plugid);\r
6219 \r
6220         $this->pagehead();\r
6221 \r
6222         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';\r
6223 \r
6224         echo '<h2>',_PLUGS_HELP_TITLE,': ',ENTITY::hsc($plugName),'</h2>';\r
6225 \r
6226         $plug =& $manager->getPlugin($plugName);\r
6227         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';\r
6228 \r
6229         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {\r
6230             @readfile($helpFile);\r
6231         } else {\r
6232             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';\r
6233             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';\r
6234         }\r
6235 \r
6236 \r
6237         $this->pagefoot();\r
6238     }\r
6239 \r
6240         /**\r
6241          * ADMIN::action_pluginadd()\r
6242          * \r
6243          * @param       Void\r
6244          * @return      Void\r
6245          * \r
6246          */\r
6247         function action_pluginadd()\r
6248         {\r
6249                 global $member, $manager, $DIR_PLUGINS;\r
6250                 \r
6251                 // check if allowed\r
6252                 $member->isAdmin() or $this->disallow();\r
6253                 \r
6254                 $name = postVar('filename');\r
6255                 \r
6256                 if ( $manager->pluginInstalled($name) )\r
6257                 {\r
6258                         $this->error(_ERROR_DUPPLUGIN);\r
6259                 }\r
6260                 \r
6261                 if ( !checkPlugin($name) )\r
6262                 {\r
6263                         $this->error(_ERROR_PLUGFILEERROR . ' (' . ENTITY::hsc($name) . ')');\r
6264                 }\r
6265                 \r
6266                 // get number of currently installed plugins\r
6267                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));\r
6268                 $numCurrent = sql_num_rows($res);\r
6269                 \r
6270                 // plugin will be added as last one in the list\r
6271                 $newOrder = $numCurrent + 1;\r
6272                 \r
6273                 $manager->notify(\r
6274                         'PreAddPlugin',\r
6275                         array(\r
6276                                 'file' => &$name\r
6277                         )\r
6278                 );\r
6279                 \r
6280                 // do this before calling getPlugin (in case the plugin id is used there)\r
6281                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';\r
6282                 sql_query($query);\r
6283                 $iPid = sql_insert_id();\r
6284                 \r
6285                 $manager->clearCachedInfo('installedPlugins');\r
6286                 \r
6287                 // Load the plugin for condition checking and instalation\r
6288                 $plugin =& $manager->getPlugin($name);\r
6289                 \r
6290                 // check if it got loaded (could have failed)\r
6291                 if ( !$plugin )\r
6292                 {\r
6293                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));\r
6294                         $manager->clearCachedInfo('installedPlugins');\r
6295                         $this->error(_ERROR_PLUGIN_LOAD);\r
6296                 }\r
6297                 \r
6298                 // check if plugin needs a newer Nucleus version\r
6299                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
6300                 {\r
6301                         // uninstall plugin again...\r
6302                         $this->deleteOnePlugin($plugin->getID());\r
6303                         \r
6304                         // ...and show error\r
6305                         $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc($plugin->getMinNucleusVersion()));\r
6306                 }\r
6307                 \r
6308                 // check if plugin needs a newer Nucleus version\r
6309                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
6310                 {\r
6311                         // uninstall plugin again...\r
6312                         $this->deleteOnePlugin($plugin->getID());\r
6313                         \r
6314                         // ...and show error\r
6315                         $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
6316                 }\r
6317                 \r
6318                 $pluginList = $plugin->getPluginDep();\r
6319                 foreach ( $pluginList as $pluginName )\r
6320                 {\r
6321                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
6322                         if (sql_num_rows($res) == 0)\r
6323                         {\r
6324                                 // uninstall plugin again...\r
6325                                 $this->deleteOnePlugin($plugin->getID());\r
6326                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, ENTITY::hsc($pluginName)));\r
6327                         }\r
6328                 }\r
6329                 \r
6330                 // call the install method of the plugin\r
6331                 $plugin->install();\r
6332                 \r
6333                 $manager->notify(\r
6334                         'PostAddPlugin',\r
6335                         array(\r
6336                                 'plugin' => &$plugin\r
6337                         )\r
6338                 );\r
6339                 \r
6340                 // update all events\r
6341                 $this->action_pluginupdate();\r
6342                 return;\r
6343         }\r
6344         \r
6345         /**\r
6346          * ADMIN:action_pluginupdate():\r
6347          * \r
6348          * @param       Void\r
6349          * @return      Void\r
6350          * \r
6351          */\r
6352         function action_pluginupdate()\r
6353         {\r
6354                 global $member, $manager, $CONF;\r
6355                 \r
6356                 // check if allowed\r
6357                 $member->isAdmin() or $this->disallow();\r
6358                 \r
6359                 // delete everything from plugin_events\r
6360                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
6361                 \r
6362                 // loop over all installed plugins\r
6363                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
6364                 while ( $o = sql_fetch_object($res) )\r
6365                 {\r
6366                         $pid = $o->pid;\r
6367                         $plug =& $manager->getPlugin($o->pfile);\r
6368                         if ( $plug )\r
6369                         {\r
6370                                 $eventList = $plug->getEventList();\r
6371                                 foreach ( $eventList as $eventName )\r
6372                                 {\r
6373                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
6374                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
6375                                         sql_query($query);\r
6376                                 }\r
6377                         }\r
6378                 }\r
6379                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6380                 return;\r
6381         }\r
6382         \r
6383     /**\r
6384      * @todo document this\r
6385      */\r
6386     function action_plugindelete() {\r
6387         global $member, $manager;\r
6388 \r
6389         // check if allowed\r
6390         $member->isAdmin() or $this->disallow();\r
6391 \r
6392         $pid = intGetVar('plugid');\r
6393 \r
6394         if (!$manager->pidInstalled($pid))\r
6395             $this->error(_ERROR_NOSUCHPLUGIN);\r
6396 \r
6397         $this->pagehead();\r
6398         ?>\r
6399             <h2><?php echo _DELETE_CONFIRM?></h2>\r
6400 \r
6401             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>\r
6402 \r
6403             <form method="post" action="index.php"><div>\r
6404             <?php $manager->addTicketHidden() ?>\r
6405             <input type="hidden" name="action" value="plugindeleteconfirm" />\r
6406             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />\r
6407             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />\r
6408             </div></form>\r
6409         <?php\r
6410         $this->pagefoot();\r
6411     }\r
6412 \r
6413     /**\r
6414      * @todo document this\r
6415      */\r
6416     function action_plugindeleteconfirm() {\r
6417         global $member, $manager, $CONF;\r
6418 \r
6419         // check if allowed\r
6420         $member->isAdmin() or $this->disallow();\r
6421 \r
6422         $pid = intPostVar('plugid');\r
6423 \r
6424         $error = $this->deleteOnePlugin($pid, 1);\r
6425         if ($error) {\r
6426             $this->error($error);\r
6427         }\r
6428 \r
6429         redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6430 //              $this->action_pluginlist();\r
6431     }\r
6432 \r
6433     /**\r
6434      * @todo document this\r
6435      */\r
6436     function deleteOnePlugin($pid, $callUninstall = 0) {\r
6437         global $manager;\r
6438 \r
6439         $pid = intval($pid);\r
6440 \r
6441         if (!$manager->pidInstalled($pid))\r
6442             return _ERROR_NOSUCHPLUGIN;\r
6443 \r
6444         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);\r
6445 \r
6446 /*              // call the unInstall method of the plugin\r
6447         if ($callUninstall) {\r
6448             $plugin =& $manager->getPlugin($name);\r
6449             if ($plugin) $plugin->unInstall();\r
6450         }*/\r
6451 \r
6452         // check dependency before delete\r
6453         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));\r
6454         while($o = sql_fetch_object($res)) {\r
6455             $plug =& $manager->getPlugin($o->pfile);\r
6456             if ($plug)\r
6457             {\r
6458                 $depList = $plug->getPluginDep();\r
6459                 foreach ($depList as $depName)\r
6460                 {\r
6461                     if ($name == $depName)\r
6462                     {\r
6463                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
6464                     }\r
6465                 }\r
6466             }\r
6467         }\r
6468 \r
6469         $manager->notify('PreDeletePlugin', array('plugid' => $pid));\r
6470 \r
6471         // call the unInstall method of the plugin\r
6472         if ($callUninstall) {\r
6473             $plugin =& $manager->getPlugin($name);\r
6474             if ($plugin) $plugin->unInstall();\r
6475         }\r
6476 \r
6477         // delete all subscriptions\r
6478         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);\r
6479 \r
6480         // delete all options\r
6481         // get OIDs from plugin_option_desc\r
6482         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
6483         $aOIDs = array();\r
6484         while ($o = sql_fetch_object($res)) {\r
6485             array_push($aOIDs, $o->oid);\r
6486         }\r
6487 \r
6488         // delete from plugin_option and plugin_option_desc\r
6489         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);\r
6490         if (count($aOIDs) > 0)\r
6491             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');\r
6492 \r
6493         // update order numbers\r
6494         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);\r
6495         $o = sql_fetch_object($res);\r
6496         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);\r
6497 \r
6498         // delete row\r
6499         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);\r
6500 \r
6501         $manager->clearCachedInfo('installedPlugins');\r
6502         $manager->notify('PostDeletePlugin', array('plugid' => $pid));\r
6503 \r
6504         return '';\r
6505     }\r
6506 \r
6507     /**\r
6508      * @todo document this\r
6509      */\r
6510     function action_pluginup() {\r
6511         global $member, $manager, $CONF;\r
6512 \r
6513         // check if allowed\r
6514         $member->isAdmin() or $this->disallow();\r
6515 \r
6516         $plugid = intGetVar('plugid');\r
6517 \r
6518         if (!$manager->pidInstalled($plugid))\r
6519             $this->error(_ERROR_NOSUCHPLUGIN);\r
6520 \r
6521         // 1. get old order number\r
6522         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);\r
6523         $o = sql_fetch_object($res);\r
6524         $oldOrder = $o->porder;\r
6525 \r
6526         // 2. calculate new order number\r
6527         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
6528 \r
6529         // 3. update plug numbers\r
6530         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);\r
6531         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);\r
6532 \r
6533         //$this->action_pluginlist();\r
6534         // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
6535         redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6536     }\r
6537 \r
6538     /**\r
6539      * @todo document this\r
6540      */\r
6541     function action_plugindown() {\r
6542         global $member, $manager, $CONF;\r
6543 \r
6544         // check if allowed\r
6545         $member->isAdmin() or $this->disallow();\r
6546 \r
6547         $plugid = intGetVar('plugid');\r
6548         if (!$manager->pidInstalled($plugid))\r
6549             $this->error(_ERROR_NOSUCHPLUGIN);\r
6550 \r
6551         // 1. get old order number\r
6552         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);\r
6553         $o = sql_fetch_object($res);\r
6554         $oldOrder = $o->porder;\r
6555 \r
6556         $res = sql_query('SELECT * FROM '.sql_table('plugin'));\r
6557         $maxOrder = sql_num_rows($res);\r
6558 \r
6559         // 2. calculate new order number\r
6560         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
6561 \r
6562         // 3. update plug numbers\r
6563         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);\r
6564         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);\r
6565 \r
6566         //$this->action_pluginlist();\r
6567         // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
6568         redirect($CONF['AdminURL'] . '?action=pluginlist');\r
6569     }\r
6570         \r
6571         /**\r
6572          * ADMIN::action_pluginoptions()\r
6573          * \r
6574          * Output Plugin option page\r
6575          * \r
6576          * @access      public\r
6577          * @param       string $message message when fallbacked\r
6578          * @return      void\r
6579          * \r
6580          */\r
6581         public function action_pluginoptions($message = '')\r
6582         {\r
6583                 global $member, $manager;\r
6584                 \r
6585                 // check if allowed\r
6586                 $member->isAdmin() or $this->disallow();\r
6587                 \r
6588                 $pid = (integer) requestVar('plugid');\r
6589                 if ( !$manager->pidInstalled($pid) )\r
6590                 {\r
6591                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6592                 }\r
6593                 \r
6594                 $pname = getPluginNameFromPid($pid);\r
6595                 \r
6596                 /* just for including translation */\r
6597                 $manager->getPlugin($pname);\r
6598                 \r
6599                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
6600                 $this->pagehead($extrahead);\r
6601                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";\r
6602                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($pname)) . "</h2>\n";\r
6603                 \r
6604                 if ( isset($message) )\r
6605                 {\r
6606                         echo $message;\r
6607                 }\r
6608                 \r
6609                 echo "<form action=\"index.php\" method=\"post\">\n";\r
6610                 echo "<div>\n";\r
6611                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";\r
6612                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";\r
6613                 $manager->addTicketHidden();\r
6614                 \r
6615                 $aOptions = array();\r
6616                 $aOIDs = array();\r
6617                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";\r
6618                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);\r
6619                 $result = sql_query($query);\r
6620                 while ( $object = sql_fetch_object($result) )\r
6621                 {\r
6622                         array_push($aOIDs, $object->oid);\r
6623                         $aOptions[$object->oid] = array(\r
6624                                                 'oid' => $object->oid,\r
6625                                                 'value' => $object->odef,\r
6626                                                 'name' => $object->oname,\r
6627                                                 'description' => $object->odesc,\r
6628                                                 'type' => $object->otype,\r
6629                                                 'typeinfo' => $object->oextra,\r
6630                                                 'contextid' => 0\r
6631                         );\r
6632                 }\r
6633                 // fill out actual values\r
6634                 if ( count($aOIDs) > 0 )\r
6635                 {\r
6636                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";\r
6637                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));\r
6638                         $result = sql_query($query);\r
6639                         while ( $object = sql_fetch_object($result) )\r
6640                         {\r
6641                                 $aOptions[$object->oid]['value'] = $object->ovalue;\r
6642                         }\r
6643                 }\r
6644                 \r
6645                 // call plugins\r
6646                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);\r
6647                 $manager->notify('PrePluginOptionsEdit',$data);\r
6648                 \r
6649                 $template['content'] = 'plugoptionlist';\r
6650                 $amount = showlist($aOptions,'table',$template);\r
6651                 if ( $amount == 0 )\r
6652                 {\r
6653                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';\r
6654                 }\r
6655                 echo "</div>\n";\r
6656                 echo "</form>\n";\r
6657                 $this->pagefoot();\r
6658                 \r
6659                 return;\r
6660         }\r
6661         \r
6662         /**\r
6663          * ADMIN::action_pluginoptionsupdate()\r
6664          * \r
6665          * Update plugin options and fallback to plugin option page\r
6666          * \r
6667          * @access      public\r
6668          * @param       void\r
6669          * @return      void\r
6670          */\r
6671         public function action_pluginoptionsupdate()\r
6672         {\r
6673                 global $member, $manager;\r
6674                 \r
6675                 // check if allowed\r
6676                 $member->isAdmin() or $this->disallow();\r
6677                 \r
6678                 $pid = (integer) requestVar('plugid');\r
6679                 if ( !$manager->pidInstalled($pid) )\r
6680                 {\r
6681                         $this->error(_ERROR_NOSUCHPLUGIN);\r
6682                 }\r
6683                 \r
6684                 $aOptions = requestArray('plugoption');\r
6685                 NucleusPlugin::apply_plugin_options($aOptions);\r
6686                 \r
6687                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));\r
6688                 \r
6689                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
6690                 return;\r
6691         }\r
6692         \r
6693         /**\r
6694          * ADMIN::_insertPluginOptions()\r
6695          * \r
6696          * Output plugin option field\r
6697          * \r
6698          * @access      public\r
6699          * @param string        $context        plugin option context\r
6700          * @param integer       $contextid      plugin option context id\r
6701          * @return      void\r
6702          */\r
6703         public function _insertPluginOptions($context, $contextid = 0)\r
6704         {\r
6705                 // get all current values for this contextid\r
6706                 // (note: this might contain doubles for overlapping contextids)\r
6707                 $aIdToValue = array();\r
6708                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));\r
6709                 while ( $object = sql_fetch_object($res) )\r
6710                 {\r
6711                         $aIdToValue[$object->oid] = $object->ovalue;\r
6712                 }\r
6713                 \r
6714                 // get list of oids per pid\r
6715                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')\r
6716                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';\r
6717                 $res = sql_query($query);\r
6718                 $aOptions = array();\r
6719                 while ( $object = sql_fetch_object($res) )\r
6720                 {\r
6721                         if (in_array($object->oid, array_keys($aIdToValue)))\r
6722                         {\r
6723                                 $value = $aIdToValue[$object->oid];\r
6724                         }\r
6725                         else\r
6726                         {\r
6727                                 $value = $object->odef;\r
6728                         }\r
6729                         \r
6730                         array_push($aOptions, array(\r
6731                                 'pid' => $object->pid,\r
6732                                 'pfile' => $object->pfile,\r
6733                                 'oid' => $object->oid,\r
6734                                 'value' => $value,\r
6735                                 'name' => $object->oname,\r
6736                                 'description' => $object->odesc,\r
6737                                 'type' => $object->otype,\r
6738                                 'typeinfo' => $object->oextra,\r
6739                                 'contextid' => $contextid,\r
6740                                 'extra' => ''));\r
6741                 }\r
6742                 \r
6743                 global $manager;\r
6744                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));\r
6745                 \r
6746                 $iPrevPid = -1;\r
6747                 foreach ($aOptions as $aOption)\r
6748                 {\r
6749                         // new plugin?\r
6750                         if ( $iPrevPid != $aOption['pid'] )\r
6751                         {\r
6752                                 $iPrevPid = $aOption['pid'];\r
6753                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )\r
6754                                 {\r
6755                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');\r
6756                                 }\r
6757                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($aOption['pfile'])).'</th></tr>';\r
6758                         }\r
6759                         \r
6760                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);\r
6761                         if ( @$meta['access'] != 'hidden' )\r
6762                         {\r
6763                                 echo '<tr>';\r
6764                                 listplug_plugOptionRow($aOption);\r
6765                                 echo '</tr>';\r
6766                         }\r
6767                 }\r
6768                 return;\r
6769         }\r
6770         \r
6771         /**\r
6772          * ADMIN::input_yesno()\r
6773          * Output input elements with radio attribute for yes/no options\r
6774          * \r
6775          * @param       string  $name   name attribute\r
6776          * @param       string  $value_current  current value attribute\r
6777          * @param       integer $tabindex       tab index\r
6778          * @param       string  $value_yes      value attribute for yes option\r
6779          * @param       string  $value_no       value attribute for no option\r
6780          * @param       string  $text_yes       child text element for yes option\r
6781          * @param       string  $text_no        child text element for no option\r
6782          * @param       boolean $isAdmin        have admin right or not\r
6783          * @return      void\r
6784          */\r
6785         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)\r
6786         {\r
6787                 $id = preg_replace('#\[|\]#', '-', $name);\r
6788                 $id_yes = $id . $value_yes;\r
6789                 $id_no  = $id . $value_no;\r
6790                 \r
6791                 /* yes option */\r
6792                 echo '<input type="radio" id="' . ENTITY::hsc($id_yes) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_yes) . '"';\r
6793                 if ( $name=="admin" )\r
6794                 {\r
6795                         echo ' onclick="selectCanLogin(true);"';\r
6796                 }\r
6797                 if ( $value_current == $value_yes )\r
6798                 {\r
6799                         echo " tabindex='$tabindex' checked='checked'";\r
6800                 }\r
6801                 echo " />\n";\r
6802                 echo '<label for="' . ENTITY::hsc($id_yes) . '">' . ENTITY::hsc($text_yes) . "</label>\n";\r
6803                 \r
6804                 /* no option */\r
6805                 echo '<input type="radio" id="' . ENTITY::hsc($id_no) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_no) . '"';\r
6806                 if ( $name=="admin" )\r
6807                 {\r
6808                         echo ' onclick="selectCanLogin(false);"';\r
6809                 }\r
6810                 if ( $value_current != $value_yes )\r
6811                 {\r
6812                         echo " tabindex='$tabindex' checked='checked'";\r
6813                 }\r
6814                 if ($isAdmin && $name=="canlogin")\r
6815                 {\r
6816                         echo ' disabled="disabled"';\r
6817                 }\r
6818                 echo " />\n";\r
6819                 echo '<label for="' . ENTITY::hsc($id_no) . '">' . ENTITY::hsc($text_no) . "</label>\n";\r
6820                 \r
6821                 return;\r
6822         }\r
6823 }\r