nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  *\r
  19  */\r
  20 \r
  21 if ( !function_exists('requestVar') ) exit;\r
  22 require_once dirname(__FILE__) . '/showlist.php';\r
  23 \r
  24 /**\r
  25  * Builds the admin area and executes admin actions\r
  26  */\r
  27 class Admin\r
  28 {\r
  29         private $xml_version_info                       = '1.0';\r
  30         private $formal_public_identifier       = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  31         private $system_identifier                      = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  32         private $xhtml_namespace                        = 'http://www.w3.org/1999/xhtml';\r
  33         \r
  34         static private $action;\r
  35         static private $skin;\r
  36         static private $extrahead;\r
  37         static private $passvar;\r
  38         static private $headMess;\r
  39         static private $aOptions;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95         );\r
  96         \r
  97         static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'deleteblog',\r
 107                 'editmembersettings',\r
 108                 'browseownitems',\r
 109                 'browseowncomments',\r
 110                 'createitem',\r
 111                 'itemedit',\r
 112                 'itemmove',\r
 113                 'categoryedit',\r
 114                 'categorydelete',\r
 115                 'manage',\r
 116                 'actionlog',\r
 117                 'settingsedit',\r
 118                 'backupoverview',\r
 119                 'pluginlist',\r
 120                 'createnewlog',\r
 121                 'usermanagement',\r
 122                 'skinoverview',\r
 123                 'templateoverview',\r
 124                 'skinieoverview',\r
 125                 'itemcommentlist',\r
 126                 'commentedit',\r
 127                 'commentdelete',\r
 128                 'banlistnewfromitem',\r
 129                 'banlistdelete',\r
 130                 'itemdelete',\r
 131                 'manageteam',\r
 132                 'teamdelete',\r
 133                 'banlistnew',\r
 134                 'memberedit',\r
 135                 'memberdelete',\r
 136                 'pluginhelp',\r
 137                 'pluginoptions',\r
 138                 'plugindelete',\r
 139                 'skinedittype',\r
 140                 'skinremovetype',\r
 141                 'skindelete',\r
 142                 'skinedit',\r
 143                 'templateedit',\r
 144                 'templatedelete',\r
 145                 'activate',\r
 146                 'systemoverview',\r
 147                 'activatesetpwd',\r
 148         );\r
 149         \r
 150         /**\r
 151          * Admin::__construct()\r
 152          * Class constructor\r
 153          * \r
 154          * @param       void\r
 155          * @return      void\r
 156          */\r
 157         static public function __construct()\r
 158         {\r
 159                 global $CONF, $member, $DIR_LIBS;\r
 160                 \r
 161                 /* 1. decide skinid to use */\r
 162                 $skinid = $CONF['DefaultAdminSkin'];\r
 163                 if (isset($member) && $member->isLoggedIn())\r
 164                 {\r
 165                         $memskin = $member->getAdminSkin();\r
 166                         if ( $memskin )\r
 167                         {\r
 168                                 $skinid = $memskin;\r
 169                         }\r
 170                 }\r
 171                 \r
 172                 /* 2. make an instance of skin object */\r
 173                 if ( Skin::existsID($skinid) )\r
 174                 {\r
 175                         self::$skin = new Skin($skinid);\r
 176                 }\r
 177                 else\r
 178                 {\r
 179                         /* TODO: error */\r
 180                 }\r
 181                 return;\r
 182         }\r
 183         \r
 184         /**\r
 185          * Admin::action()\r
 186          * Executes an action\r
 187          *\r
 188          * @param string $action action to be performed\r
 189          */\r
 190         static public function action($action)\r
 191         {\r
 192                 global $CONF, $manager;\r
 193                 $f = FALSE;\r
 194                 \r
 195                 // list of action aliases\r
 196                 $alias = array(\r
 197                         'login' => 'overview',\r
 198                         ''              => 'overview'\r
 199                 );\r
 200                 \r
 201                 $customAction = postvar('customaction');\r
 202                 if ( !empty($customAction) )\r
 203                 {\r
 204                         $alias = array(\r
 205                                 'login' => $customAction,\r
 206                                 ''              => $customAction\r
 207                         );\r
 208                 }\r
 209                 if ( isset($alias[$action]) )\r
 210                 {\r
 211                         $action = $alias[$action];\r
 212                 }\r
 213                 $methodName = "action_{$action}";\r
 214                 \r
 215                 self::$action = strtolower($action);\r
 216                 \r
 217                 $synonimActions = array(\r
 218                         'banlistnewfromitem',\r
 219                         'memberedit',\r
 220                         'login',\r
 221                 );\r
 222                 \r
 223                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 224                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 225                 \r
 226                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 227                 {\r
 228                         if (!$manager->checkTicket())\r
 229                         {\r
 230                                 self::error(_ERROR_BADTICKET);\r
 231                         }\r
 232                 }\r
 233                 \r
 234                 if ( !method_exists(self, $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 235                 {\r
 236                         self::$action_parseSpecialskin;\r
 237                         $f = TRUE;\r
 238                 }\r
 239                 elseif ( method_exists(self, $methodName) )\r
 240                 {\r
 241                         call_user_func(array(self, $methodName));\r
 242                         $f = TRUE;\r
 243                 }\r
 244                 \r
 245                 if ( $f )\r
 246                 {\r
 247                         exit;\r
 248                 }\r
 249                 \r
 250                 $id                     = self::getAdminSkinID();\r
 251                 self::$skin     = new Skin($id);\r
 252                 \r
 253                 if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 254                 {\r
 255                         self::error(_BADACTION . ENTITY::hsc($action));\r
 256                         $f = TRUE;\r
 257                 }\r
 258                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 259                 {\r
 260                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 261                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 262                         {\r
 263                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 264                                 $f = TRUE;\r
 265                         }\r
 266                 }\r
 267                 if ( $f )\r
 268                 {\r
 269                         exit;\r
 270                 }\r
 271                 self::error(_BADACTION . ENTITY::hsc($action));\r
 272                 return;\r
 273         }\r
 274 \r
 275         /**\r
 276          * Action::existsSkinContents()\r
 277          * Check skin contents\r
 278          *\r
 279          * @param       string  $action action type\r
 280          * @return      boolean\r
 281          */\r
 282         static private function existsSkinContents($action)\r
 283         {\r
 284                 $in_array  = in_array($action, self::$skinless_actions);\r
 285                 \r
 286                 if ( $in_array )\r
 287                 {\r
 288                         return $in_array;\r
 289                 }\r
 290                 else\r
 291                 {\r
 292                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 293                         /* TODO: skinid should be a default */\r
 294                         if ( !is_object(self::$skin) )\r
 295                         {\r
 296                                 return quickQuery(sprintf($query, 1, sql_real_escape_string($action)));\r
 297                         }\r
 298                         else\r
 299                         {\r
 300                                 return quickQuery(sprintf($query, self::$skin->id, sql_real_escape_string($action)));\r
 301                         }\r
 302                 }\r
 303                 return;\r
 304         }\r
 305         \r
 306         /**\r
 307          * Action::specialActionsAllow()\r
 308          * Check exists specialskinparts\r
 309          *\r
 310          * @param       string  $action action type\r
 311          * @return boolean\r
 312          */\r
 313         static private function specialActionsAllow($action)\r
 314         {\r
 315                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 316                 $query = sprintf($query, sql_table('adminskin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 317                 return quickQuery($query);\r
 318         }\r
 319         \r
 320         /**\r
 321          * Action::action_showlogin()\r
 322          * \r
 323          * @param       void\r
 324          * @return      void\r
 325          */\r
 326         static private function action_showlogin()\r
 327         {\r
 328                 global $error;\r
 329                 self::$action_login($error);\r
 330                 return;\r
 331         }\r
 332         \r
 333         /**\r
 334          * Action::action_login()\r
 335          * \r
 336          * @param       string  $msg            message for pageheader\r
 337          * @param       integer $passvars       ???\r
 338          */\r
 339         static private function action_login($msg = '', $passvars = 1)\r
 340         {\r
 341                 global $member;\r
 342                 \r
 343                 // skip to overview when allowed\r
 344                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 345                 {\r
 346                         self::$action_overview();\r
 347                         exit;\r
 348                 }\r
 349                 \r
 350                 /* TODO: needless variable??? */\r
 351                 self::$passvar = $passvars;\r
 352                 if ( $msg )\r
 353                 {\r
 354                         self::$headMess = $msg;\r
 355                 }\r
 356                 \r
 357                 self::pagehead();\r
 358                 self::$skin->parse('showlogin');\r
 359                 self::pagefoot();\r
 360         }\r
 361         \r
 362         /**\r
 363          * Action::action_overview()\r
 364          * provides a screen with the overview of the actions available\r
 365          * \r
 366          * @param       string  $msg    message for pageheader\r
 367          * @return      void\r
 368          */\r
 369         static private function action_overview($msg = '')\r
 370         {\r
 371                 if ( $msg )\r
 372                 {\r
 373                         self::$headMess = $msg;\r
 374                 }\r
 375                 \r
 376                 self::pagehead();\r
 377                 self::$skin->parse('overview');\r
 378                 self::pagefoot();\r
 379                 return;\r
 380         }\r
 381         \r
 382         /**\r
 383          * Admin::action_manage()\r
 384          * \r
 385          * @param       string  $msg    message for pageheader\r
 386          * @retrn       void\r
 387          */\r
 388         static private function action_manage($msg = '')\r
 389         {\r
 390                 global $member;\r
 391                 \r
 392                 if ( $msg )\r
 393                 {\r
 394                         self::$headMess = $msg;\r
 395                 }\r
 396                 $member->isAdmin() or self::disallow();\r
 397                 \r
 398                 self::pagehead();\r
 399                 self::$skin->parse('manage');\r
 400                 self::pagefoot();\r
 401                 return;\r
 402         }\r
 403         \r
 404         /**\r
 405          * Action::action_itemlist()\r
 406          * \r
 407          * @param       integer id for weblod\r
 408          * @return      void\r
 409          */\r
 410         static private function action_itemlist($blogid = '')\r
 411         {\r
 412                 global $member, $manager, $CONF;\r
 413                 \r
 414                 if ( $blogid == '' )\r
 415                 {\r
 416                         $blogid = intRequestVar('blogid');\r
 417                 }\r
 418                 \r
 419                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 420                 \r
 421                 self::pagehead();\r
 422                 self::$skin->parse('itemlist');\r
 423                 self::pagefoot();\r
 424                 return;\r
 425         }\r
 426         \r
 427         /**\r
 428          * Action::action_batchitem()\r
 429          * \r
 430          * @param       void\r
 431          * @return      void\r
 432          */\r
 433         static private function action_batchitem()\r
 434         {\r
 435                 global $member, $manager;\r
 436                 \r
 437                 $member->isLoggedIn() or self::disallow();\r
 438                 \r
 439                 $selected       = requestIntArray('batch');\r
 440                 $action         = requestVar('batchaction');\r
 441                 \r
 442                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 443                 {\r
 444                         self::error(_BATCH_NOSELECTION);\r
 445                 }\r
 446                 \r
 447                 // On move: when no destination blog/category chosen, show choice now\r
 448                 $destCatid = intRequestVar('destcatid');\r
 449                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 450                 {\r
 451                         self::batchMoveSelectDestination('item', $selected);\r
 452                 }\r
 453                 \r
 454                 // On delete: check if confirmation has been given\r
 455                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 456                 {\r
 457                         self::batchAskDeleteConfirmation('item', $selected);\r
 458                 }\r
 459                 \r
 460                 self::pagehead();\r
 461                 self::$skin->parse('batchitem');\r
 462                 self::pagefoot();\r
 463                 return;\r
 464         }\r
 465         \r
 466         /**\r
 467          * Action::action_batchcomment()\r
 468          * \r
 469          * @param       void\r
 470          * @return      void\r
 471          */\r
 472         static private function action_batchcomment()\r
 473         {\r
 474                 global $member;\r
 475                 \r
 476                 $member->isLoggedIn() or self::disallow();\r
 477                 \r
 478                 $selected       = requestIntArray('batch');\r
 479                 $action         = requestVar('batchaction');\r
 480                 \r
 481                 // Show error when no items were selected\r
 482                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 483                 {\r
 484                         self::error(_BATCH_NOSELECTION);\r
 485                 }\r
 486                 \r
 487                 // On delete: check if confirmation has been given\r
 488                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 489                 {\r
 490                         self::batchAskDeleteConfirmation('comment',$selected);\r
 491                 }\r
 492                 \r
 493                 self::pagehead();\r
 494                 self::$skin->parse('batchcomment');\r
 495                 self::pagefoot();\r
 496                 return;\r
 497         }\r
 498         \r
 499         /**\r
 500          * Admin::action_batchmember()\r
 501          * \r
 502          * @param       void\r
 503          * @return      void\r
 504          */\r
 505         static private function action_batchmember()\r
 506         {\r
 507                 global $member;\r
 508                 \r
 509                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 510                 \r
 511                 $selected       = requestIntArray('batch');\r
 512                 $action         = requestVar('batchaction');\r
 513                 \r
 514                 // Show error when no members selected\r
 515                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 516                 {\r
 517                         self::error(_BATCH_NOSELECTION);\r
 518                 }\r
 519                 \r
 520                 // On delete: check if confirmation has been given\r
 521                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 522                 {\r
 523                         self::batchAskDeleteConfirmation('member',$selected);\r
 524                 }\r
 525                 \r
 526                 self::pagehead();\r
 527                 self::$skin->parse('batchmember');\r
 528                 self::pagefoot();\r
 529                 return;\r
 530         }\r
 531         \r
 532         /**\r
 533          * Admin::action_batchteam()\r
 534          * \r
 535          * @param       void\r
 536          * @return      void\r
 537          */\r
 538         static private function action_batchteam()\r
 539         {\r
 540                 global $member;\r
 541                 \r
 542                 $blogid = intRequestVar('blogid');\r
 543                 \r
 544                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 545                 \r
 546                 $selected       = requestIntArray('batch');\r
 547                 $action         = requestVar('batchaction');\r
 548                 \r
 549                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 550                 {\r
 551                         self::error(_BATCH_NOSELECTION);\r
 552                 }\r
 553                 \r
 554                 // On delete: check if confirmation has been given\r
 555                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 556                 {\r
 557                         self::batchAskDeleteConfirmation('team',$selected);\r
 558                 }\r
 559                 \r
 560                 self::pagehead();\r
 561                 self::$skin->parse('batchteam');\r
 562                 self::pagefoot();\r
 563                 return;\r
 564         }\r
 565         \r
 566         /**\r
 567          * Admin::action_batchcategory()\r
 568          * \r
 569          * @param       void\r
 570          * @return      void\r
 571          */\r
 572         static private function action_batchcategory()\r
 573         {\r
 574                 global $member, $manager;\r
 575                 \r
 576                 $member->isLoggedIn() or self::disallow();\r
 577                 \r
 578                 $selected       = requestIntArray('batch');\r
 579                 $action         = requestVar('batchaction');\r
 580                 \r
 581                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 582                 {\r
 583                         self::error(_BATCH_NOSELECTION);\r
 584                 }\r
 585                 \r
 586                 // On move: when no destination blog chosen, show choice now\r
 587                 $destBlogId = intRequestVar('destblogid');\r
 588                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 589                 {\r
 590                         self::batchMoveCategorySelectDestination('category', $selected);\r
 591                 }\r
 592                 \r
 593                 // On delete: check if confirmation has been given\r
 594                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 595                 {\r
 596                         self::batchAskDeleteConfirmation('category', $selected);\r
 597                 }\r
 598                 \r
 599                 self::pagehead();\r
 600                 self::$skin->parse('batchcategory');\r
 601                 self::pagefoot();\r
 602                 return;\r
 603         }\r
 604         \r
 605         /**\r
 606          * Admin::batchMoveSelectDestination()\r
 607          * \r
 608          * @param       string  $type   type of batch action\r
 609          * @param       integer $ids    needless???\r
 610          * @return      void\r
 611          * \r
 612          * TODO: remove needless argument\r
 613          */\r
 614         static private function batchMoveSelectDestination($type, $ids)\r
 615         {\r
 616                 $_POST['batchmove'] = $type;\r
 617                 self::pagehead();\r
 618                 self::$skin->parse('batchmove');\r
 619                 self::pagefoot();\r
 620                 return;\r
 621         }\r
 622         \r
 623         /**\r
 624          * Admin::batchMoveCategorySelectDestination()\r
 625          * \r
 626          * @param       string  $type   type of batch action\r
 627          * @param       integer $ids    needless???\r
 628          * @return      void\r
 629          * \r
 630          * TODO: remove needless argument\r
 631          */\r
 632         static private function batchMoveCategorySelectDestination($type, $ids)\r
 633         {\r
 634                 $_POST['batchmove'] = $type;\r
 635                 global $manager;\r
 636                 self::pagehead();\r
 637                 self::$skin->parse('batchmovecat');\r
 638                 self::pagefoot();\r
 639                 return;\r
 640         }\r
 641         \r
 642         /**\r
 643          * Admin::batchAskDeleteConfirmation()\r
 644          * \r
 645          * @param       string  $type   type of batch action\r
 646          * @param       integer $ids    needless???\r
 647          * @return      void\r
 648          * \r
 649          * TODO: remove needless argument\r
 650          */\r
 651         static private function batchAskDeleteConfirmation($type, $ids)\r
 652         {\r
 653                 self::pagehead();\r
 654                 self::$skin->parse('batchdelete');\r
 655                 self::pagefoot();\r
 656                 return;\r
 657         }\r
 658         \r
 659         /**\r
 660          * Admin::selectBlogCategory()\r
 661          * Inserts a HTML select element with choices for all categories to which the current\r
 662          * member has access\r
 663          *\r
 664          * @see function selectBlog\r
 665          * @param       string  $name                           name of weblod\r
 666          * @param       integer $selected                       \r
 667          * @param       integer $tabindex                       \r
 668          * @param       integer $showNewCat                     \r
 669          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 670          * @return      void\r
 671          *\r
 672          * NOTE: callback from AdminAction\r
 673          */\r
 674         static private function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 675         {\r
 676                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 677                 return;\r
 678         }\r
 679         \r
 680         /**\r
 681          * Admin::selectBlog()\r
 682          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 683          *      mode = 'blog' => shows blognames and values are blogids\r
 684          *      mode = 'category' => show category names and values are catids\r
 685          *\r
 686          * @param       string  $name                           name of weblod\r
 687          * @param       string  $mode                           \r
 688          * @param       integer $selected                       \r
 689          * @param       integer $tabindex                       \r
 690          * @param       integer $showNewCat                     \r
 691          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 692          * @param $iForcedBlogInclude\r
 693          *      ID of a blog that always needs to be included, without checking if the\r
 694          *      member is on the blog team (-1 = none)\r
 695          * @return      void\r
 696          */\r
 697         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 698         {\r
 699                 global $member, $CONF;\r
 700                 \r
 701                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 702                 $aBlogIds = array();\r
 703                 if ( $iForcedBlogInclude != -1 )\r
 704                 {\r
 705                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 706                 }\r
 707                 \r
 708                 if ( ($member->isAdmin()) && ($CONF['ShowAllBlogs']) )\r
 709                 {\r
 710                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 711                         $query = sprintf($query, sql_table('blog'));\r
 712                 }\r
 713                 else\r
 714                 {\r
 715                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 716                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 717                 }\r
 718                 \r
 719                 $rblogids = sql_query($query);\r
 720                 while ($o = sql_fetch_object($rblogids))\r
 721                 {\r
 722                         if ( $o->bnumber != $iForcedBlogInclude )\r
 723                         {\r
 724                                 $aBlogIds[] = intval($o->bnumber);\r
 725                         }\r
 726                 }\r
 727                 \r
 728                 if ( count($aBlogIds) == 0 )\r
 729                 {\r
 730                         return;\r
 731                 }\r
 732                 \r
 733                 /* TODO: we should consider to use the other way instead of this */\r
 734                 $_REQUEST['selectData'] = array(\r
 735                         'name'                  => $name,\r
 736                         'tabindex'              => $tabindex,\r
 737                         'mode'                  => $mode,\r
 738                         'selected'              => $selected,\r
 739                         'showNewCat'    => $showNewCat,\r
 740                         'aBlogIds'              => $aBlogIds,\r
 741                 );\r
 742                 self::$skin->parse('blogselectbox');\r
 743                 return;\r
 744         }\r
 745         \r
 746         /**\r
 747          * Admin::action_browseownitems()\r
 748          * \r
 749          * @param       void\r
 750          * @return      void\r
 751          */\r
 752         static private function action_browseownitems()\r
 753         {\r
 754                 global $member, $manager, $CONF;\r
 755                 \r
 756                 self::pagehead();\r
 757                 self::$skin->parse('browseownitems');\r
 758                 self::pagefoot();\r
 759                 return;\r
 760         }\r
 761         \r
 762         /**\r
 763          * Admin::action_itemcommentlist()\r
 764          * Show all the comments for a given item\r
 765          * \r
 766          * @param       integer $itemid ID for item\r
 767          * @return      void\r
 768          */\r
 769         static private function action_itemcommentlist($itemid = '')\r
 770         {\r
 771                 global $member, $manager, $CONF;\r
 772                 \r
 773                 if ( $itemid == '' )\r
 774                 {\r
 775                         $itemid = intRequestVar('itemid');\r
 776                 }\r
 777                 \r
 778                 /* TODO: we consider to use the other way insterad of this */\r
 779                 $_REQUEST['itemid'] = $itemid;\r
 780                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 781                 \r
 782                 // only allow if user is allowed to alter item\r
 783                 $member->canAlterItem($itemid) or self::disallow();\r
 784                 \r
 785                 $blogid = getBlogIdFromItemId($itemid);\r
 786                 \r
 787                 self::pagehead();\r
 788                 self::$skin->parse('itemcommentlist');\r
 789                 self::pagefoot();\r
 790                 return;\r
 791         }\r
 792         \r
 793         /**\r
 794          * Admin::action_browseowncomments()\r
 795          * Browse own comments\r
 796          * \r
 797          * @param       void\r
 798          * @return      void\r
 799          */\r
 800         static private function action_browseowncomments()\r
 801         {\r
 802                 self::pagehead();\r
 803                 self::$skin->parse('browseowncomments');\r
 804                 self::pagefoot();\r
 805                 return;\r
 806         }\r
 807         \r
 808         /**\r
 809          * Admin::action_blogcommentlist()\r
 810          * Browse all comments for a weblog\r
 811          * \r
 812          * @param       integer $blogid ID for weblog\r
 813          * @return      void\r
 814          */\r
 815         static private function action_blogcommentlist($blogid = '')\r
 816         {\r
 817                 global $member, $manager, $CONF;\r
 818                 \r
 819                 if ( $blogid == '' )\r
 820                 {\r
 821                         $blogid = intRequestVar('blogid');\r
 822                 }\r
 823                 else\r
 824                 {\r
 825                         $blogid = intval($blogid);\r
 826                 }\r
 827                 \r
 828                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 829                 \r
 830                 /* TODO: we consider to use the other way insterad of this */\r
 831                 $_REQUEST['blogid'] = $blogid;\r
 832                 \r
 833                 self::pagehead();\r
 834                 self::$skin->parse('blogcommentlist');\r
 835                 self::pagefoot();\r
 836                 return;\r
 837         }\r
 838         \r
 839         /**\r
 840          * Admin::action_createitem()\r
 841          * Provide a page to item a new item to the given blog\r
 842          * \r
 843          * @param       void\r
 844          * @return      void\r
 845          */\r
 846         static private function action_createitem()\r
 847         {\r
 848                 global $member, $manager;\r
 849                 \r
 850                 $blogid = intRequestVar('blogid');\r
 851                 \r
 852                 // check if allowed\r
 853                 $member->teamRights($blogid) or self::disallow();\r
 854                 \r
 855                 $memberid = $member->getID();\r
 856                 \r
 857                 $blog =& $manager->getBlog($blogid);\r
 858                 \r
 859                 self::pagehead();\r
 860                 self::$skin->parse('createitem');\r
 861                 self::pagefoot();\r
 862                 return;\r
 863         }\r
 864         \r
 865         /**\r
 866          * Admin::action_itemedit()\r
 867          * \r
 868          * @param       void\r
 869          * @return      void\r
 870          */\r
 871         static private function action_itemedit()\r
 872         {\r
 873                 global $member, $manager;\r
 874                 \r
 875                 $itemid = intRequestVar('itemid');\r
 876                 \r
 877                 // only allow if user is allowed to alter item\r
 878                 $member->canAlterItem($itemid) or self::disallow();\r
 879                 \r
 880                 $item =& $manager->getItem($itemid, 1, 1);\r
 881                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
 882                 \r
 883                 self::pagehead();\r
 884                 self::$skin->parse('itemedit');\r
 885                 self::pagefoot();\r
 886                 return;\r
 887         }\r
 888         \r
 889         /**\r
 890          * Admin::action_itemupdate()\r
 891          * \r
 892          * @param       void\r
 893          * @return      void\r
 894          */\r
 895         static private function action_itemupdate()\r
 896         {\r
 897                 global $member, $manager, $CONF;\r
 898                 \r
 899                 $itemid = intRequestVar('itemid');\r
 900                 $catid  = postVar('catid');\r
 901                 \r
 902                 // only allow if user is allowed to alter item\r
 903                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 904                 \r
 905                 $actiontype = postVar('actiontype');\r
 906                 \r
 907                 // delete actions are handled by itemdelete (which has confirmation)\r
 908                 if ( $actiontype == 'delete' )\r
 909                 {\r
 910                         self::$action_itemdelete();\r
 911                         return;\r
 912                 }\r
 913                 \r
 914                 $body           = postVar('body');\r
 915                 $title          = postVar('title');\r
 916                 $more           = postVar('more');\r
 917                 $closed         = intPostVar('closed');\r
 918                 $draftid        = intPostVar('draftid');\r
 919                 \r
 920                 // default action = add now\r
 921                 if ( !$actiontype )\r
 922                 {\r
 923                         $actiontype='addnow';\r
 924                 }\r
 925                 \r
 926                 // create new category if needed\r
 927                 if ( strstr($catid,'newcat') )\r
 928                 {\r
 929                         // get blogid\r
 930                         list($blogid) = sscanf($catid,"newcat-%d");\r
 931                         \r
 932                         // create\r
 933                         $blog =& $manager->getBlog($blogid);\r
 934                         $catid = $blog->createNewCategory();\r
 935                         \r
 936                         // show error when sth goes wrong\r
 937                         if ( !$catid )\r
 938                         {\r
 939                                 self::doError(_ERROR_CATCREATEFAIL);\r
 940                         }\r
 941                 }\r
 942                 \r
 943                 /*\r
 944                         set some variables based on actiontype\r
 945 \r
 946                         actiontypes:\r
 947                                 draft items -> addnow, addfuture, adddraft, delete\r
 948                                 non-draft items -> edit, changedate, delete\r
 949 \r
 950                         variables set:\r
 951                                 $timestamp: set to a nonzero value for future dates or date changes\r
 952                                 $wasdraft: set to 1 when the item used to be a draft item\r
 953                                 $publish: set to 1 when the edited item is not a draft\r
 954          */\r
 955                 $blogid =  getBlogIDFromItemID($itemid);\r
 956                 $blog   =& $manager->getBlog($blogid);\r
 957                 \r
 958                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 959                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 960                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 961                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 962                 {\r
 963                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 964                 }\r
 965                 else\r
 966                 {\r
 967                         $timestamp =0;\r
 968                 }\r
 969                 \r
 970                 // edit the item for real\r
 971                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 972                 \r
 973                 self::updateFuturePosted($blogid);\r
 974                 \r
 975                 if ( $draftid > 0 )\r
 976                 {\r
 977                         // delete permission is checked inside Item::delete()\r
 978                         Item::delete($draftid);\r
 979                 }\r
 980                 \r
 981                 if ( $catid != intPostVar('catid') )\r
 982                 {\r
 983                         self::$action_categoryedit(\r
 984                                 $catid,\r
 985                                 $blog->getID(),\r
 986                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 987                         );\r
 988                 }\r
 989                 else\r
 990                 {\r
 991                         // TODO: set start item correctly for itemlist\r
 992                         $item = Item::getItem($itemid, 0, 0);\r
 993                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 994                         $_REQUEST['start'] = $cnt + 1;\r
 995                         self::$action_itemlist(getBlogIDFromItemID($itemid));\r
 996                 }\r
 997                 return;\r
 998         }\r
 999         \r
1000         /**\r
1001          * Admin::action_itemdelete()\r
1002          * Delete item\r
1003          * \r
1004          * @param       Void\r
1005          * @return      Void\r
1006          */\r
1007         static private function action_itemdelete()\r
1008         {\r
1009                 global $member, $manager;\r
1010                 \r
1011                 $itemid = intRequestVar('itemid');\r
1012                 \r
1013                 // only allow if user is allowed to alter item\r
1014                 $member->canAlterItem($itemid) or self::disallow();\r
1015                 \r
1016                 if ( !$manager->existsItem($itemid,1,1) )\r
1017                 {\r
1018                         self::error(_ERROR_NOSUCHITEM);\r
1019                 }\r
1020                 \r
1021                 self::pagehead();\r
1022                 self::$skin->parse('itemdelete');\r
1023                 self::pagefoot();\r
1024                 return;\r
1025         }\r
1026         \r
1027         /**\r
1028          * Admin::action_itemdeleteconfirm()\r
1029          * \r
1030          * @param       void\r
1031          * @return      void\r
1032          */\r
1033         static private function action_itemdeleteconfirm()\r
1034         {\r
1035                 global $member;\r
1036                 \r
1037                 $itemid = intRequestVar('itemid');\r
1038                 \r
1039                 // only allow if user is allowed to alter item\r
1040                 $member->canAlterItem($itemid) or self::disallow();\r
1041                 \r
1042                 // get blogid first\r
1043                 $blogid = getBlogIdFromItemId($itemid);\r
1044                 \r
1045                 // delete item (note: some checks will be performed twice)\r
1046                 self::deleteOneItem($itemid);\r
1047                 \r
1048                 self::$action_itemlist($blogid);\r
1049                 return;\r
1050         }\r
1051         \r
1052         /**\r
1053          * Admin::deleteOneItem()\r
1054          * Deletes one item and returns error if something goes wrong\r
1055          * \r
1056          * @param       integer $itemid ID for item\r
1057          * @return      void\r
1058          */\r
1059         static private function deleteOneItem($itemid)\r
1060         {\r
1061                 global $member, $manager;\r
1062                 \r
1063                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1064                 if ( !$member->canAlterItem($itemid) )\r
1065                 {\r
1066                         return _ERROR_DISALLOWED;\r
1067                 }\r
1068                 \r
1069                 // need to get blogid before the item is deleted\r
1070                 $blogid = getBlogIDFromItemId($itemid);\r
1071                 \r
1072                 $manager->loadClass('ITEM');\r
1073                 Item::delete($itemid);\r
1074                 \r
1075                 // update blog's futureposted\r
1076                 self::updateFuturePosted($blogid);\r
1077                 return;\r
1078         }\r
1079         \r
1080         /**\r
1081          * Admin::updateFuturePosted()\r
1082          * Update a blog's future posted flag\r
1083          * \r
1084          * @param integer $blogid\r
1085          * @return      void\r
1086          */\r
1087         static private function updateFuturePosted($blogid)\r
1088         {\r
1089                 global $manager;\r
1090                 \r
1091                 $blogid                 =  intval($blogid);\r
1092                 $blog                   =& $manager->getBlog($blogid);\r
1093                 $currenttime    =  $blog->getCorrectTime(time());\r
1094                 \r
1095                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1096                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1097                 $result = sql_query($query);\r
1098                 \r
1099                 if ( sql_num_rows($result) > 0 )\r
1100                 {\r
1101                                 $blog->setFuturePost();\r
1102                 }\r
1103                 else\r
1104                 {\r
1105                                 $blog->clearFuturePost();\r
1106                 }\r
1107                 return;\r
1108         }\r
1109 \r
1110         /**\r
1111          * Admin::action_itemmove()\r
1112          * \r
1113          * @param       void\r
1114          * @return      void\r
1115          */\r
1116         static private function action_itemmove()\r
1117         {\r
1118                 global $member, $manager;\r
1119                 \r
1120                 $itemid = intRequestVar('itemid');\r
1121                 \r
1122                 $member->canAlterItem($itemid) or self::disallow();\r
1123                 \r
1124                 self::pagehead();\r
1125                 self::$skin->parse('itemmove');\r
1126                 self::pagefoot();\r
1127                 return;\r
1128         }\r
1129         \r
1130         /**\r
1131          * Admin::action_itemmoveto()\r
1132          * \r
1133          * @param       void\r
1134          * @return      void\r
1135          */\r
1136         static private function action_itemmoveto()\r
1137         {\r
1138                 global $member, $manager;\r
1139                 \r
1140                 $itemid = intRequestVar('itemid');\r
1141                 $catid = requestVar('catid');\r
1142                 \r
1143                 // create new category if needed\r
1144                 if ( strstr($catid,'newcat') )\r
1145                 {\r
1146                         // get blogid\r
1147                         list($blogid) = sscanf($catid,'newcat-%d');\r
1148                         \r
1149                         // create\r
1150                         $blog =& $manager->getBlog($blogid);\r
1151                         $catid = $blog->createNewCategory();\r
1152                         \r
1153                         // show error when sth goes wrong\r
1154                         if ( !$catid )\r
1155                         {\r
1156                                 self::doError(_ERROR_CATCREATEFAIL);\r
1157                         }\r
1158                 }\r
1159                 \r
1160                 // only allow if user is allowed to alter item\r
1161                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1162                 \r
1163                 $old_blogid = getBlogIDFromItemId($itemid);\r
1164                 \r
1165                 Item::move($itemid, $catid);\r
1166                 \r
1167                 // set the futurePosted flag on the blog\r
1168                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1169                 \r
1170                 // reset the futurePosted in case the item is moved from one blog to another\r
1171                 self::updateFuturePosted($old_blogid);\r
1172                 \r
1173                 if ( $catid != intRequestVar('catid') )\r
1174                 {\r
1175                         self::$action_categoryedit($catid, $blog->getID());\r
1176                 }\r
1177                 else\r
1178                 {\r
1179                         self::$action_itemlist(getBlogIDFromCatID($catid));\r
1180                 }\r
1181                 return;\r
1182         }\r
1183         \r
1184         /**\r
1185          * Admin::moveOneItem()\r
1186          * Moves one item to a given category (category existance should be checked by caller)\r
1187          * errors are returned\r
1188          * \r
1189          * @param       integer $itemid         ID for item\r
1190          * @param       integer $destCatid      ID for category to which the item will be moved\r
1191          * @return      void\r
1192          */\r
1193         static private function moveOneItem($itemid, $destCatid)\r
1194         {\r
1195                 global $member;\r
1196                 \r
1197                 // only allow if user is allowed to move item\r
1198                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1199                 {\r
1200                         return _ERROR_DISALLOWED;\r
1201                 }\r
1202                 \r
1203                 Item::move($itemid, $destCatid);\r
1204                 return;\r
1205         }\r
1206         \r
1207         /**\r
1208          * Admin::action_additem()\r
1209          * Adds a item to the chosen blog\r
1210          * \r
1211          * @param       void\r
1212          * @return      void\r
1213          */\r
1214         static private function action_additem()\r
1215         {\r
1216                 global $manager, $CONF;\r
1217                 \r
1218                 $manager->loadClass('ITEM');\r
1219                 \r
1220                 $result = Item::createFromRequest();\r
1221                 \r
1222                 if ( $result['status'] == 'error' )\r
1223                 {\r
1224                         self::error($result['message']);\r
1225                 }\r
1226                 \r
1227                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1228                 $blog           =& $manager->getBlog($blogid);\r
1229                 $btimestamp     =  $blog->getCorrectTime();\r
1230                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1231                 \r
1232                 if ( $result['status'] == 'newcategory' )\r
1233                 {\r
1234                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1235                         self::$action_categoryedit($result['catid'], $blogid, $distURI);\r
1236                 }\r
1237                 else\r
1238                 {\r
1239                         $methodName = 'action_itemList';\r
1240                         call_user_func(array(&$this, $methodName), $blogid);\r
1241                 }\r
1242                 return;\r
1243         }\r
1244         \r
1245         /**\r
1246          * Admin::action_commentedit()\r
1247          * Allows to edit previously made comments\r
1248          * \r
1249          * @param       void\r
1250          * @return      void\r
1251          */\r
1252         static private function action_commentedit()\r
1253         {\r
1254                 global $member, $manager;\r
1255                 \r
1256                 $commentid = intRequestVar('commentid');\r
1257                 \r
1258                 $member->canAlterComment($commentid) or self::disallow();\r
1259                 \r
1260                 self::pagehead();\r
1261                 self::$skin->parse('commentedit');\r
1262                 self::pagefoot();\r
1263                 return;\r
1264         }\r
1265         \r
1266         /**\r
1267          * Admin::action_commentupdate()\r
1268          * \r
1269          * @param       void\r
1270          * @return      void\r
1271          */\r
1272         static private function action_commentupdate()\r
1273         {\r
1274                 global $member, $manager;\r
1275                 \r
1276                 $commentid = intRequestVar('commentid');\r
1277                 \r
1278                 $member->canAlterComment($commentid) or self::disallow();\r
1279                 \r
1280                 $url    = postVar('url');\r
1281                 $email  = postVar('email');\r
1282                 $body   = postVar('body');\r
1283                 \r
1284                 // intercept words that are too long\r
1285                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1286                 {\r
1287                         self::error(_ERROR_COMMENT_LONGWORD);\r
1288                 }\r
1289                 \r
1290                 // check length\r
1291                 if ( i18n::strlen($body) < 3 )\r
1292                 {\r
1293                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1294                 }\r
1295                 \r
1296                 if ( i18n::strlen($body) > 5000 )\r
1297                 {\r
1298                         self::error(_ERROR_COMMENT_TOOLONG);\r
1299                 }\r
1300                 \r
1301                 // prepare body\r
1302                 $body = Comment::prepareBody($body);\r
1303                 \r
1304                 // call plugins\r
1305                 $data = array(\r
1306                         'body' => &$body\r
1307                 );\r
1308                 $manager->notify('PreUpdateComment', $data);\r
1309                 \r
1310                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1311                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1312                 sql_query($query);\r
1313                 \r
1314                 // get itemid\r
1315                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1316                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1317                 \r
1318                 $res    = sql_query($query);\r
1319                 $o              = sql_fetch_object($res);\r
1320                 $itemid = $o->citem;\r
1321                 \r
1322                 if ( $member->canAlterItem($itemid) )\r
1323                 {\r
1324                         self::$action_itemcommentlist($itemid);\r
1325                 }\r
1326                 else\r
1327                 {\r
1328                         self::$action_browseowncomments();\r
1329                 }\r
1330                 return;\r
1331         }\r
1332         \r
1333         /**\r
1334          * Admin::action_commentdelete()\r
1335          * Update comment\r
1336          * \r
1337          * @param       void\r
1338          * @return      void\r
1339          */\r
1340         static private function action_commentdelete()\r
1341         {\r
1342                 global $member, $manager;\r
1343                 \r
1344                 $commentid = intRequestVar('commentid');\r
1345                 $member->canAlterComment($commentid) or self::disallow();\r
1346                 \r
1347                 self::pagehead();\r
1348                 self::$skin->parse('commentdelete');\r
1349                 self::pagefoot();\r
1350                 return;\r
1351         }\r
1352         \r
1353         /**\r
1354          * Admin::action_commentdeleteconfirm()\r
1355          * \r
1356          * @param       void\r
1357          * @return      void\r
1358          */\r
1359         static private function action_commentdeleteconfirm()\r
1360         {\r
1361                 global $member;\r
1362                 \r
1363                 $commentid = intRequestVar('commentid');\r
1364                 \r
1365                 // get item id first\r
1366                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1367                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1368                 \r
1369                 $res = sql_query($query);\r
1370                 $o = sql_fetch_object($res);\r
1371                 $itemid = $o->citem;\r
1372                 \r
1373                 $error = self::deleteOneComment($commentid);\r
1374                 if ( $error )\r
1375                 {\r
1376                         self::doError($error);\r
1377                 }\r
1378                 \r
1379                 if ( $member->canAlterItem($itemid) )\r
1380                 {\r
1381                         self::$action_itemcommentlist($itemid);\r
1382                 }\r
1383                 else\r
1384                 {\r
1385                         self::$action_browseowncomments();\r
1386                 }\r
1387                 return;\r
1388         }\r
1389         \r
1390         /**\r
1391          * Admin::deleteOneComment()\r
1392          * \r
1393          * @param       integer $commentid      ID for comment\r
1394          * @return      void\r
1395          */\r
1396         static private function deleteOneComment($commentid)\r
1397         {\r
1398                 global $member, $manager;\r
1399                 \r
1400                 $commentid = (integer) $commentid;\r
1401                 \r
1402                 if ( !$member->canAlterComment($commentid) )\r
1403                 {\r
1404                         return _ERROR_DISALLOWED;\r
1405                 }\r
1406                 \r
1407                 $data = array(\r
1408                         'commentid' => $commentid\r
1409                 );\r
1410                 \r
1411                 $manager->notify('PreDeleteComment', $data);\r
1412                 \r
1413                 // delete the comments associated with the item\r
1414                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1415                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1416                 sql_query($query);\r
1417                 \r
1418                 $data = array(\r
1419                         'commentid' => $commentid\r
1420                 );\r
1421                 \r
1422                 $manager->notify('PostDeleteComment', $data);\r
1423                 \r
1424                 return '';\r
1425         }\r
1426         \r
1427         /**\r
1428          * Admin::action_usermanagement()\r
1429          * Usermanagement main\r
1430          * \r
1431          * @param       void\r
1432          * @return      void\r
1433          */\r
1434         static private function action_usermanagement()\r
1435         {\r
1436                 global $member, $manager;\r
1437                 \r
1438                 // check if allowed\r
1439                 $member->isAdmin() or self::disallow();\r
1440                 \r
1441                 self::pagehead();\r
1442                 self::$skin->parse('usermanagement');\r
1443                 self::pagefoot();\r
1444                 return;\r
1445         }\r
1446         \r
1447         /**\r
1448          * Admin::\r
1449          * Edit member settings\r
1450          * \r
1451          * @param       void\r
1452          * @return      void\r
1453          */\r
1454         static private function action_memberedit()\r
1455         {\r
1456                 self::$action_editmembersettings(intRequestVar('memberid'));\r
1457                 return;\r
1458         }\r
1459         \r
1460         /**\r
1461          * Admin::action_editmembersettings()\r
1462          * \r
1463          * @param       integer $memberid       ID for member\r
1464          * @return      void\r
1465          * \r
1466          */\r
1467         static private function action_editmembersettings($memberid = '')\r
1468         {\r
1469                 global $member, $manager, $CONF;\r
1470                 \r
1471                 if ( $memberid == '' )\r
1472                 {\r
1473                         $memberid = $member->getID();\r
1474                 }\r
1475                 \r
1476                 /* TODO: we should consider to use the other way insterad of this */\r
1477                 $_REQUEST['memberid'] = $memberid;\r
1478                 \r
1479                 // check if allowed\r
1480                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1481                 \r
1482                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1483                 self::pagehead($extrahead);\r
1484                 self::$skin->parse('editmembersettings');\r
1485                 self::pagefoot();\r
1486                 return;\r
1487         }\r
1488         \r
1489         /**\r
1490          * Admin::action_changemembersettings()\r
1491          * \r
1492          * @param       void\r
1493          * @return      void\r
1494          */\r
1495         static private function action_changemembersettings()\r
1496         {\r
1497                 global $member, $CONF, $manager;\r
1498                 \r
1499                 $memberid = intRequestVar('memberid');\r
1500                 \r
1501                 // check if allowed\r
1502                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1503                 \r
1504                 $name                   = trim(strip_tags(postVar('name')));\r
1505                 $realname               = trim(strip_tags(postVar('realname')));\r
1506                 $password               = postVar('password');\r
1507                 $repeatpassword = postVar('repeatpassword');\r
1508                 $email                  = strip_tags(postVar('email'));\r
1509                 $url                    = strip_tags(postVar('url'));\r
1510                 $adminskin              = intPostVar('adminskin');\r
1511                 \r
1512                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1513                 if ( !preg_match('#^https?://#', $url) )\r
1514                 {\r
1515                         $url = 'http://' . $url;\r
1516                 }\r
1517                 \r
1518                 $admin          = postVar('admin');\r
1519                 $canlogin       = postVar('canlogin');\r
1520                 $notes          = strip_tags(postVar('notes'));\r
1521                 $locale         = postVar('locale');\r
1522                 \r
1523                 $mem = Member::createFromID($memberid);\r
1524                 \r
1525                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1526                 {\r
1527                         if ( !isValidDisplayName($name) )\r
1528                         {\r
1529                                 self::error(_ERROR_BADNAME);\r
1530                         }\r
1531                         \r
1532                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1533                         {\r
1534                                 self::error(_ERROR_NICKNAMEINUSE);\r
1535                         }\r
1536                         \r
1537                         if ( $password != $repeatpassword )\r
1538                         {\r
1539                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1540                         }\r
1541                         \r
1542                         if ( $password && (i18n::strlen($password) < 6) )\r
1543                         {\r
1544                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1545                         }\r
1546                                 \r
1547                         if ( $password )\r
1548                         {\r
1549                                 $pwdvalid = true;\r
1550                                 $pwderror = '';\r
1551                                 \r
1552                                 $data = array(\r
1553                                         'password'     => $password,\r
1554                                         'errormessage' => &$pwderror,\r
1555                                         'valid'        => &$pwdvalid\r
1556                                 );\r
1557                                 $manager->notify('PrePasswordSet', $data);\r
1558                                 \r
1559                                 if ( !$pwdvalid )\r
1560                                 {\r
1561                                         self::error($pwderror);\r
1562                                 }\r
1563                         }\r
1564                 }\r
1565                 \r
1566                 if ( !NOTIFICATION::address_validation($email) )\r
1567                 {\r
1568                         self::error(_ERROR_BADMAILADDRESS);\r
1569                 }\r
1570                 if ( !$realname )\r
1571                 {\r
1572                         self::error(_ERROR_REALNAMEMISSING);\r
1573                 }\r
1574                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1575                 {\r
1576                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1577                 }\r
1578                 \r
1579                 // check if there will remain at least one site member with both the logon and admin rights\r
1580                 // (check occurs when taking away one of these rights from such a member)\r
1581                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1582                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1583                         )\r
1584                 {\r
1585                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1586                         if ( sql_num_rows($r) < 2 )\r
1587                         {\r
1588                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1589                         }\r
1590                 }\r
1591                 \r
1592                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1593                 {\r
1594                         $mem->setDisplayName($name);\r
1595                         if ( $password )\r
1596                         {\r
1597                                 $mem->setPassword($password);\r
1598                         }\r
1599                 }\r
1600                 \r
1601                 $oldEmail = $mem->getEmail();\r
1602                 \r
1603                 $mem->setRealName($realname);\r
1604                 $mem->setEmail($email);\r
1605                 $mem->setURL($url);\r
1606                 $mem->setNotes($notes);\r
1607                 $mem->setLocale($locale);\r
1608                 \r
1609                 // only allow super-admins to make changes to the admin status\r
1610                 if ( $member->isAdmin() )\r
1611                 {\r
1612                         $mem->setAdmin($admin);\r
1613                         $mem->setCanLogin($canlogin);\r
1614                 }\r
1615                 \r
1616                 $autosave = postVar('autosave');\r
1617                 $mem->setAutosave($autosave);\r
1618                 \r
1619                 $mem->write();\r
1620                 \r
1621                 // store plugin options\r
1622                 $aOptions = requestArray('plugoption');\r
1623                 NucleusPlugin::apply_plugin_options($aOptions);\r
1624                 $data = array(\r
1625                         'context'  => 'member',\r
1626                         'memberid' => $memberid,\r
1627                         'member'   => &$mem\r
1628                 );\r
1629                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1630                 \r
1631                 // if email changed, generate new password\r
1632                 if ( $oldEmail != $mem->getEmail() )\r
1633                 {\r
1634                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1635                         // logout member\r
1636                         $mem->newCookieKey();\r
1637                         \r
1638                         // only log out if the member being edited is the current member.\r
1639                         if ( $member->getID() == $memberid )\r
1640                         {\r
1641                                 $member->logout();\r
1642                         }\r
1643                         self::$action_login(_MSG_ACTIVATION_SENT, 0);\r
1644                         return;\r
1645                 }\r
1646                 \r
1647                 if ( ($mem->getID() == $member->getID())\r
1648                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1649                 {\r
1650                         $mem->newCookieKey();\r
1651                         $member->logout();\r
1652                         self::$action_login(_MSG_LOGINAGAIN, 0);\r
1653                 }\r
1654                 else\r
1655                 {\r
1656                         self::$action_overview(_MSG_SETTINGSCHANGED);\r
1657                 }\r
1658                 return;\r
1659         }\r
1660 \r
1661         /**\r
1662          * Admin::action_memberadd()\r
1663          * \r
1664          * @param       void\r
1665          * @return      void\r
1666          * \r
1667          */\r
1668         static private function action_memberadd()\r
1669         {\r
1670                 global $member, $manager;\r
1671                 \r
1672                 // check if allowed\r
1673                 $member->isAdmin() or self::disallow();\r
1674                 \r
1675                 if ( postVar('password') != postVar('repeatpassword') )\r
1676                 {\r
1677                         self::error(_ERROR_PASSWORDMISMATCH);\r
1678                 }\r
1679                 \r
1680                 if ( i18n::strlen(postVar('password')) < 6 )\r
1681                 {\r
1682                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1683                 }\r
1684                 \r
1685                 $res = Member::create(\r
1686                         postVar('name'),\r
1687                         postVar('realname'),\r
1688                         postVar('password'),\r
1689                         postVar('email'),\r
1690                         postVar('url'),\r
1691                         postVar('admin'),\r
1692                         postVar('canlogin'),\r
1693                         postVar('notes')\r
1694                 );\r
1695                 \r
1696                 if ( $res != 1 )\r
1697                 {\r
1698                         self::error($res);\r
1699                 }\r
1700                 \r
1701                 // fire PostRegister event\r
1702                 $newmem = new Member();\r
1703                 $newmem->readFromName(postVar('name'));\r
1704                 $data = array(\r
1705                         'member' => &$newmem\r
1706                 );\r
1707                 $manager->notify('PostRegister', $data);\r
1708                 \r
1709                 self::$action_usermanagement();\r
1710                 return;\r
1711         }\r
1712         \r
1713         /**\r
1714          * Admin::action_activate()\r
1715          * Account activation\r
1716          * \r
1717          * @param       void\r
1718          * @return      void\r
1719          */\r
1720         static private function action_activate()\r
1721         {\r
1722                 $key = getVar('key');\r
1723                 self::showActivationPage($key);\r
1724                 return;\r
1725         }\r
1726         \r
1727         /**\r
1728          * Admin::showActivationPage()\r
1729          * \r
1730          * @param       void\r
1731          * @return      void\r
1732          */\r
1733         static private function showActivationPage($key, $message = '')\r
1734         {\r
1735                 global $manager;\r
1736                 \r
1737                 // clean up old activation keys\r
1738                 Member::cleanupActivationTable();\r
1739                 \r
1740                 // get activation info\r
1741                 $info = Member::getActivationInfo($key);\r
1742                 \r
1743                 if ( !$info )\r
1744                 {\r
1745                         self::error(_ERROR_ACTIVATE);\r
1746                 }\r
1747                 \r
1748                 $mem = Member::createFromId($info->vmember);\r
1749                 \r
1750                 if ( !$mem )\r
1751                 {\r
1752                         self::error(_ERROR_ACTIVATE);\r
1753                 }\r
1754                 \r
1755                 /* TODO: we should consider to use the other way insterad of this */\r
1756                 $_POST['ackey']                                 = $key;\r
1757                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1758                 \r
1759                 self::$headMess = $message;\r
1760                 self::pagehead();\r
1761                 self::$skin->parse('activate');\r
1762                 self::pagefoot();\r
1763                 return;\r
1764         }\r
1765         \r
1766         /**\r
1767          * Admin::action_activatesetpwd()\r
1768          * Account activation - set password part\r
1769          * \r
1770          * @param       void\r
1771          * @return      void\r
1772          */\r
1773         static private function action_activatesetpwd()\r
1774         {\r
1775                 global $manager;\r
1776                 $key = postVar('key');\r
1777                 \r
1778                 // clean up old activation keys\r
1779                 Member::cleanupActivationTable();\r
1780                 \r
1781                 // get activation info\r
1782                 $info = Member::getActivationInfo($key);\r
1783                 \r
1784                 if ( !$info || ($info->type == 'addresschange') )\r
1785                 {\r
1786                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1787                 }\r
1788                 \r
1789                 $mem = Member::createFromId($info->vmember);\r
1790                 \r
1791                 if ( !$mem )\r
1792                 {\r
1793                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1794                 }\r
1795                 \r
1796                 $password               = postVar('password');\r
1797                 $repeatpassword = postVar('repeatpassword');\r
1798                 \r
1799                 if ( $password != $repeatpassword )\r
1800                 {\r
1801                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1802                 }\r
1803                 \r
1804                 if ( $password && (i18n::strlen($password) < 6) )\r
1805                 {\r
1806                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1807                 }\r
1808                         \r
1809                 if ( $password )\r
1810                 {\r
1811                         $pwdvalid = true;\r
1812                         $pwderror = '';\r
1813                         \r
1814                         $data = array(\r
1815                                 'password'              => $password,\r
1816                                 'errormessage'  => &$pwderror,\r
1817                                 'valid'                 => &$pwdvalid\r
1818                         );\r
1819                         $manager->notify('PrePasswordSet', $data);\r
1820                         if ( !$pwdvalid )\r
1821                         {\r
1822                                 return self::showActivationPage($key,$pwderror);\r
1823                         }\r
1824                 }\r
1825                 \r
1826                 $error = '';\r
1827                 \r
1828                 $data = array(\r
1829                         'type'   => 'activation',\r
1830                         'member' => $mem,\r
1831                         'error'  => &$error\r
1832                 );\r
1833                 $manager->notify('ValidateForm', $data);\r
1834                 if ( $error != '' )\r
1835                 {\r
1836                         return self::showActivationPage($key, $error);\r
1837                 }\r
1838                 \r
1839                 // set password\r
1840                 $mem->setPassword($password);\r
1841                 $mem->write();\r
1842                 \r
1843                 // do the activation\r
1844                 Member::activate($key);\r
1845                 \r
1846                 self::pagehead();\r
1847                 self::$skin->parse('activatesetpwd');\r
1848                 self::pagefoot();\r
1849                 return;\r
1850         }\r
1851         \r
1852         /**\r
1853          * Admin::action_manageteam()\r
1854          * Manage team\r
1855          * \r
1856          * @param       void\r
1857          * @return      void\r
1858          */\r
1859         static private function action_manageteam()\r
1860         {\r
1861                 global $member, $manager;\r
1862                 \r
1863                 $blogid = intRequestVar('blogid');\r
1864                 \r
1865                 // check if allowed\r
1866                 $member->blogAdminRights($blogid) or self::disallow();\r
1867                 \r
1868                 self::pagehead();\r
1869                 self::$skin->parse('manageteam');\r
1870                 self::pagefoot();\r
1871                 return;\r
1872         }\r
1873         \r
1874         /**\r
1875          * Admin::action_teamaddmember()\r
1876          * Add member to team\r
1877          * \r
1878          * @param       void\r
1879          * @return      void\r
1880          */\r
1881         static private function action_teamaddmember()\r
1882         {\r
1883                 global $member, $manager;\r
1884                 \r
1885                 $memberid       = intPostVar('memberid');\r
1886                 $blogid         = intPostVar('blogid');\r
1887                 $admin          = intPostVar('admin');\r
1888                 \r
1889                 // check if allowed\r
1890                 $member->blogAdminRights($blogid) or self::disallow();\r
1891                 \r
1892                 $blog =& $manager->getBlog($blogid);\r
1893                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1894                 {\r
1895                         self::error(_ERROR_ALREADYONTEAM);\r
1896                 }\r
1897                 \r
1898                 self::$action_manageteam();\r
1899                 return;\r
1900         }\r
1901         \r
1902         /**\r
1903          * Admin::action_teamdelete()\r
1904          * \r
1905          * @param       void\r
1906          * @return      void\r
1907          */\r
1908         static private function action_teamdelete()\r
1909         {\r
1910                 global $member, $manager;\r
1911                 \r
1912                 $memberid       = intRequestVar('memberid');\r
1913                 $blogid         = intRequestVar('blogid');\r
1914                 \r
1915                 // check if allowed\r
1916                 $member->blogAdminRights($blogid) or self::disallow();\r
1917                 \r
1918                 $teammem =  Member::createFromID($memberid);\r
1919                 $blog =& $manager->getBlog($blogid);\r
1920                 \r
1921                 self::pagehead();\r
1922                 self::$skin->parse('teamdelete');\r
1923                 self::pagefoot();\r
1924                 return;\r
1925         }\r
1926         \r
1927         /**\r
1928          * Admin::action_teamdeleteconfirm()\r
1929          * \r
1930          * @param       void\r
1931          * @return      void\r
1932          */\r
1933         static private function action_teamdeleteconfirm()\r
1934         {\r
1935                 global $member;\r
1936                 \r
1937                 $memberid = intRequestVar('memberid');\r
1938                 $blogid = intRequestVar('blogid');\r
1939                 \r
1940                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1941                 if ( $error )\r
1942                 {\r
1943                         self::error($error);\r
1944                 }\r
1945                 self::$action_manageteam();\r
1946                 return;\r
1947         }\r
1948         \r
1949         /**\r
1950          * Admin::deleteOneTeamMember()\r
1951          * \r
1952          * @param       void\r
1953          * @return      void\r
1954          */\r
1955         static private function deleteOneTeamMember($blogid, $memberid)\r
1956         {\r
1957                 global $member, $manager;\r
1958                 \r
1959                 $blogid   = intval($blogid);\r
1960                 $memberid = intval($memberid);\r
1961                 \r
1962                 // check if allowed\r
1963                 if ( !$member->blogAdminRights($blogid) )\r
1964                 {\r
1965                         return _ERROR_DISALLOWED;\r
1966                 }\r
1967                 \r
1968                 // check if: - there remains at least one blog admin\r
1969                 //           - (there remains at least one team member)\r
1970                 $tmem = Member::createFromID($memberid);\r
1971                 \r
1972                 \r
1973                 $data = array(\r
1974                         'member' => &$tmem,\r
1975                         'blogid' => $blogid\r
1976                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1977                 \r
1978                 if ( $tmem->isBlogAdmin($blogid) )\r
1979                 {\r
1980                         /* TODO: why we did double check? */\r
1981                         // check if there are more blog members left and at least one admin\r
1982                         // (check for at least two admins before deletion)\r
1983                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1984                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1985                         $r     = sql_query($query);\r
1986                         if ( sql_num_rows($r) < 2 )\r
1987                         {\r
1988                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1989                         }\r
1990                 }\r
1991                 \r
1992                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1993                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1994                 sql_query($query);\r
1995                 \r
1996                 $data = array(\r
1997                         'member' => &$tmem,\r
1998                         'blogid' => $blogid\r
1999                 );\r
2000                 $manager->notify('PostDeleteTeamMember', $data);\r
2001                 \r
2002                 return '';\r
2003         }\r
2004         \r
2005         /**\r
2006          * Admin::action_teamchangeadmin()\r
2007          * \r
2008          * @param       void\r
2009          * @return      void\r
2010          */\r
2011         static private function action_teamchangeadmin()\r
2012         {\r
2013                 global $member;\r
2014                 \r
2015                 $blogid         = intRequestVar('blogid');\r
2016                 $memberid       = intRequestVar('memberid');\r
2017                 \r
2018                 // check if allowed\r
2019                 $member->blogAdminRights($blogid) or self::disallow();\r
2020                 \r
2021                 $mem = Member::createFromID($memberid);\r
2022                 \r
2023                 // don't allow when there is only one admin at this moment\r
2024                 if ( $mem->isBlogAdmin($blogid) )\r
2025                 {\r
2026                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2027                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2028                         $r = sql_query($query);\r
2029                         if ( sql_num_rows($r) == 1 )\r
2030                         {\r
2031                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2032                         }\r
2033                 }\r
2034                 \r
2035                 if ( $mem->isBlogAdmin($blogid) )\r
2036                 {\r
2037                         $newval = 0;\r
2038                 }\r
2039                 else\r
2040                 {\r
2041                         $newval = 1;\r
2042                 }\r
2043                 \r
2044                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2045                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2046                 sql_query($query);\r
2047                 \r
2048                 // only show manageteam if member did not change its own admin privileges\r
2049                 if ( $member->isBlogAdmin($blogid) )\r
2050                 {\r
2051                         self::$action_manageteam();\r
2052                 }\r
2053                 else\r
2054                 {\r
2055                         self::$action_overview(_MSG_ADMINCHANGED);\r
2056                 }\r
2057                 return;\r
2058         }\r
2059         \r
2060         /**\r
2061          * Admin::action_blogsettings()\r
2062          * \r
2063          * @param       void\r
2064          * @return      void\r
2065          */\r
2066         static private function action_blogsettings()\r
2067         {\r
2068                 global $member, $manager;\r
2069                 \r
2070                 $blogid = intRequestVar('blogid');\r
2071                 \r
2072                 // check if allowed\r
2073                 $member->blogAdminRights($blogid) or self::disallow();\r
2074                 \r
2075                 $blog =& $manager->getBlog($blogid);\r
2076                 \r
2077                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2078                 self::pagehead($extrahead);\r
2079                 self::$skin->parse('blogsettings');\r
2080                 self::pagefoot();\r
2081                 return;\r
2082         }\r
2083         \r
2084         /**\r
2085          * Admin::action_categorynew()\r
2086          * \r
2087          * @param       void\r
2088          * @return      void\r
2089          */\r
2090         static private function action_categorynew()\r
2091         {\r
2092                 global $member, $manager;\r
2093                 \r
2094                 $blogid = intRequestVar('blogid');\r
2095                 \r
2096                 $member->blogAdminRights($blogid) or self::disallow();\r
2097                 \r
2098                 $cname = postVar('cname');\r
2099                 $cdesc = postVar('cdesc');\r
2100                 \r
2101                 if ( !isValidCategoryName($cname) )\r
2102                 {\r
2103                         self::error(_ERROR_BADCATEGORYNAME);\r
2104                 }\r
2105                 \r
2106                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2107                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2108                 $res = sql_query($query);\r
2109                 if ( sql_num_rows($res) > 0 )\r
2110                 {\r
2111                         self::error(_ERROR_DUPCATEGORYNAME);\r
2112                 }\r
2113                 \r
2114                 $blog           =& $manager->getBlog($blogid);\r
2115                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2116                 \r
2117                 self::$action_blogsettings();\r
2118                 return;\r
2119         }\r
2120         \r
2121         /**\r
2122          * Admin::action_categoryedit()\r
2123          * \r
2124          * @param       void\r
2125          * @return      void\r
2126          */\r
2127         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2128         {\r
2129                 global $member, $manager;\r
2130                 \r
2131                 if ( $blogid == '' )\r
2132                 {\r
2133                         $blogid = intGetVar('blogid');\r
2134                 }\r
2135                 else\r
2136                 {\r
2137                         $blogid = intval($blogid);\r
2138                 }\r
2139                 if ( $catid == '' )\r
2140                 {\r
2141                         $catid = intGetVar('catid');\r
2142                 }\r
2143                 else\r
2144                 {\r
2145                         $catid = intval($catid);\r
2146                 }\r
2147                 \r
2148                 /* TODO: we should consider to use the other way insterad of this */\r
2149                 $_REQUEST['blogid']             = $blogid;\r
2150                 $_REQUEST['catid']              = $catid;\r
2151                 $_REQUEST['desturl']    = $desturl;\r
2152                 $member->blogAdminRights($blogid) or self::disallow();\r
2153                 \r
2154                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2155                 self::pagehead($extrahead);\r
2156                 self::$skin->parse('categoryedit');\r
2157                 self::pagefoot();\r
2158                 return;\r
2159         }\r
2160         \r
2161         /**\r
2162          * Admin::action_categoryupdate()\r
2163          * \r
2164          * @param       void\r
2165          * @return      void\r
2166          */\r
2167         static private function action_categoryupdate()\r
2168         {\r
2169                 global $member, $manager;\r
2170                 \r
2171                 $blogid         = intPostVar('blogid');\r
2172                 $catid          = intPostVar('catid');\r
2173                 $cname          = postVar('cname');\r
2174                 $cdesc          = postVar('cdesc');\r
2175                 $desturl        = postVar('desturl');\r
2176                 \r
2177                 $member->blogAdminRights($blogid) or self::disallow();\r
2178                 \r
2179                 if ( !isValidCategoryName($cname) )\r
2180                 {\r
2181                         self::error(_ERROR_BADCATEGORYNAME);\r
2182                 }\r
2183                 \r
2184                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2185                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2186                 $res    = sql_query($query);\r
2187                 if ( sql_num_rows($res) > 0 )\r
2188                 {\r
2189                         self::error(_ERROR_DUPCATEGORYNAME);\r
2190                 }\r
2191                 \r
2192                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2193                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2194                 sql_query($query);\r
2195                 \r
2196                 // store plugin options\r
2197                 $aOptions = requestArray('plugoption');\r
2198                 NucleusPlugin::apply_plugin_options($aOptions);\r
2199                 $data = array(\r
2200                         'context'       => 'category',\r
2201                         'catid'         => $catid\r
2202                 );\r
2203                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2204                 \r
2205                 if ( $desturl )\r
2206                 {\r
2207                         redirect($desturl);\r
2208                         exit;\r
2209                 }\r
2210                 else\r
2211                 {\r
2212                         self::$action_blogsettings();\r
2213                 }\r
2214                 return;\r
2215         }\r
2216         \r
2217         /**\r
2218          * Admin::action_categorydelete()\r
2219          * \r
2220          * @param       void\r
2221          * @return      void\r
2222          */\r
2223         static private function action_categorydelete()\r
2224         {\r
2225                 global $member, $manager;\r
2226                 \r
2227                 $blogid = intRequestVar('blogid');\r
2228                 $catid  = intRequestVar('catid');\r
2229                 \r
2230                 $member->blogAdminRights($blogid) or self::disallow();\r
2231                 \r
2232                 $blog =& $manager->getBlog($blogid);\r
2233                 \r
2234                 // check if the category is valid\r
2235                 if ( !$blog->isValidCategory($catid) )\r
2236                 {\r
2237                         self::error(_ERROR_NOSUCHCATEGORY);\r
2238                 }\r
2239                 \r
2240                 // don't allow deletion of default category\r
2241                 if ( $blog->getDefaultCategory() == $catid )\r
2242                 {\r
2243                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2244                 }\r
2245                 \r
2246                 // check if catid is the only category left for blogid\r
2247                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2248                 $query = sprintf($query, sql_table('category'), $blogid);\r
2249                 $res = sql_query($query);\r
2250                 if ( sql_num_rows($res) == 1 )\r
2251                 {\r
2252                         self::error(_ERROR_DELETELASTCATEGORY);\r
2253                 }\r
2254                 \r
2255                 self::pagehead();\r
2256                 self::$skin->parse('categorydelete');\r
2257                 self::pagefoot();\r
2258                 return;\r
2259         }\r
2260         \r
2261         /**\r
2262          * Admin::action_categorydeleteconfirm()\r
2263          * \r
2264          * @param       void\r
2265          * @return      void\r
2266          */\r
2267         static private function action_categorydeleteconfirm()\r
2268         {\r
2269                 global $member, $manager;\r
2270                 \r
2271                 $blogid = intRequestVar('blogid');\r
2272                 $catid  = intRequestVar('catid');\r
2273                 \r
2274                 $member->blogAdminRights($blogid) or self::disallow();\r
2275                 \r
2276                 $error = self::deleteOneCategory($catid);\r
2277                 if ( $error )\r
2278                 {\r
2279                         self::error($error);\r
2280                 }\r
2281                 \r
2282                 self::$action_blogsettings();\r
2283                 return;\r
2284         }\r
2285         \r
2286         /**\r
2287          * Admin::deleteOneCategory()\r
2288          * Delete a category by its id\r
2289          * \r
2290          * @param       String  $catid  category id for deleting\r
2291          * @return      Void\r
2292          */\r
2293         static private function deleteOneCategory($catid)\r
2294         {\r
2295                 global $manager, $member;\r
2296                 \r
2297                 $catid  = intval($catid);\r
2298                 $blogid = getBlogIDFromCatID($catid);\r
2299                 \r
2300                 if ( !$member->blogAdminRights($blogid) )\r
2301                 {\r
2302                         return ERROR_DISALLOWED;\r
2303                 }\r
2304                 \r
2305                 // get blog\r
2306                 $blog =& $manager->getBlog($blogid);\r
2307                 \r
2308                 // check if the category is valid\r
2309                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2310                 {\r
2311                         return _ERROR_NOSUCHCATEGORY;\r
2312                 }\r
2313                 \r
2314                 $destcatid = $blog->getDefaultCategory();\r
2315                 \r
2316                 // don't allow deletion of default category\r
2317                 if ( $blog->getDefaultCategory() == $catid )\r
2318                 {\r
2319                         return _ERROR_DELETEDEFCATEGORY;\r
2320                 }\r
2321                 \r
2322                 // check if catid is the only category left for blogid\r
2323                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2324                 $query = sprintf(sql_table('category'), (integer) $blogid);\r
2325                 \r
2326                 $res = sql_query($query);\r
2327                 if ( sql_num_rows($res) == 1 )\r
2328                 {\r
2329                         return _ERROR_DELETELASTCATEGORY;\r
2330                 }\r
2331                 \r
2332                 $data = array('catid' => $catid);\r
2333                 $manager->notify('PreDeleteCategory', $data);\r
2334                 \r
2335                 // change category for all items to the default category\r
2336                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2337                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2338                 sql_query($query);\r
2339                 \r
2340                 // delete all associated plugin options\r
2341                 NucleusPlugin::delete_option_values('category', $catid);\r
2342                 \r
2343                 // delete category\r
2344                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2345                 $query = sprintf($query, (integer) $catid);\r
2346                 sql_query($query);\r
2347                 \r
2348                 $data = array('catid' => $catid);\r
2349                 $manager->notify('PostDeleteCategory', $data);\r
2350                 return;\r
2351         }\r
2352         \r
2353         /**\r
2354          * Admin::action_blogsettingsupdate\r
2355          * Updating blog settings\r
2356          * \r
2357          * @param       Void\r
2358          * @return      Void\r
2359          */\r
2360         static private function action_blogsettingsupdate()\r
2361         {\r
2362                 global $member, $manager;\r
2363                 \r
2364                 $blogid = intRequestVar('blogid');\r
2365                 \r
2366                 $member->blogAdminRights($blogid) or self::disallow();\r
2367                 \r
2368                 $blog =& $manager->getBlog($blogid);\r
2369                 \r
2370                 $notify_address = trim(postVar('notify'));\r
2371                 $shortname              = trim(postVar('shortname'));\r
2372                 $updatefile             = trim(postVar('update'));\r
2373                 \r
2374                 $notifyComment  = intPostVar('notifyComment');\r
2375                 $notifyVote             = intPostVar('notifyVote');\r
2376                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2377                 \r
2378                 if ( $notifyComment == 0 )\r
2379                 {\r
2380                         $notifyComment = 1;\r
2381                 }\r
2382                 if ( $notifyVote == 0 )\r
2383                 {\r
2384                         $notifyVote = 1;\r
2385                 }\r
2386                 if ( $notifyNewItem == 0 )\r
2387                 {\r
2388                         $notifyNewItem = 1;\r
2389                 }\r
2390                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2391                 \r
2392                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2393                 {\r
2394                         self::error(_ERROR_BADNOTIFY);\r
2395                 }\r
2396                 \r
2397                 if ( !isValidShortName($shortname) )\r
2398                 {\r
2399                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2400                 }\r
2401                 \r
2402                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2403                 {\r
2404                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2405                 }\r
2406                 // check if update file is writable\r
2407                 if ( $updatefile && !is_writeable($updatefile) )\r
2408                 {\r
2409                         self::error(_ERROR_UPDATEFILE);\r
2410                 }\r
2411                 \r
2412                 $blog->setName(trim(postVar('name')));\r
2413                 $blog->setShortName($shortname);\r
2414                 $blog->setNotifyAddress($notify_address);\r
2415                 $blog->setNotifyType($notifyType);\r
2416                 $blog->setMaxComments(postVar('maxcomments'));\r
2417                 $blog->setCommentsEnabled(postVar('comments'));\r
2418                 $blog->setTimeOffset(postVar('timeoffset'));\r
2419                 $blog->setUpdateFile($updatefile);\r
2420                 $blog->setURL(trim(postVar('url')));\r
2421                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2422                 $blog->setDescription(trim(postVar('desc')));\r
2423                 $blog->setPublic(postVar('public'));\r
2424                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2425                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2426                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2427                 $blog->setSearchable(intPostVar('searchable'));\r
2428                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2429                 $blog->writeSettings();\r
2430                 \r
2431                 // store plugin options\r
2432                 $aOptions = requestArray('plugoption');\r
2433                 NucleusPlugin::apply_plugin_options($aOptions);\r
2434                 \r
2435                 $data = array(\r
2436                         'context' => 'blog',\r
2437                         'blogid'  => $blogid,\r
2438                         'blog'    => &$blog\r
2439                 );\r
2440                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2441                 \r
2442                 self::$action_overview(_MSG_SETTINGSCHANGED);\r
2443                 return;\r
2444         }\r
2445         \r
2446         /**\r
2447          * Admin::action_deleteblog()\r
2448          * \r
2449          * @param       void\r
2450          * @return      void\r
2451          */\r
2452         static private function action_deleteblog()\r
2453         {\r
2454                 global $member, $CONF, $manager;\r
2455                 \r
2456                 $blogid = intRequestVar('blogid');\r
2457                 \r
2458                 $member->blogAdminRights($blogid) or self::disallow();\r
2459                 \r
2460                 // check if blog is default blog\r
2461                 if ( $CONF['DefaultBlog'] == $blogid )\r
2462                 {\r
2463                         self::error(_ERROR_DELDEFBLOG);\r
2464                 }\r
2465                 \r
2466                 $blog =& $manager->getBlog($blogid);\r
2467                 \r
2468                 self::pagehead();\r
2469                 self::$skin->parse('deleteblog');\r
2470                 self::pagefoot();\r
2471                 return;\r
2472         }\r
2473         \r
2474         /**\r
2475          * Admin::action_deleteblogconfirm()\r
2476          * Delete Blog\r
2477          * \r
2478          * @param       Void\r
2479          * @return      Void\r
2480          */\r
2481         static private function action_deleteblogconfirm()\r
2482         {\r
2483                 global $member, $CONF, $manager;\r
2484                 \r
2485                 $blogid = intRequestVar('blogid');\r
2486                 \r
2487                 $data = array('blogid' => $blogid);\r
2488                 $manager->notify('PreDeleteBlog', $data);\r
2489                 \r
2490                 $member->blogAdminRights($blogid) or self::disallow();\r
2491                 \r
2492                 // check if blog is default blog\r
2493                 if ( $CONF['DefaultBlog'] == $blogid )\r
2494                 {\r
2495                         self::error(_ERROR_DELDEFBLOG);\r
2496                 }\r
2497                 \r
2498                 // delete all comments\r
2499                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2500                 sql_query($query);\r
2501                 \r
2502                 // delete all items\r
2503                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2504                 sql_query($query);\r
2505                 \r
2506                 // delete all team members\r
2507                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2508                 sql_query($query);\r
2509                 \r
2510                 // delete all bans\r
2511                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2512                 sql_query($query);\r
2513                 \r
2514                 // delete all categories\r
2515                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2516                 sql_query($query);\r
2517                 \r
2518                 // delete all associated plugin options\r
2519                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2520                 \r
2521                 // delete the blog itself\r
2522                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2523                 sql_query($query);\r
2524                 \r
2525                 $data = array('blogid' => $blogid);\r
2526                 $manager->notify('PostDeleteBlog', $data);\r
2527                 \r
2528                 self::$action_overview(_DELETED_BLOG);\r
2529                 return;\r
2530         }\r
2531         \r
2532         /**\r
2533          * Admin::action_memberdelete()\r
2534          * \r
2535          * @param       void\r
2536          * @return      void\r
2537          */\r
2538         static private function action_memberdelete()\r
2539         {\r
2540                 global $member, $manager;\r
2541                 \r
2542                 $memberid = intRequestVar('memberid');\r
2543                 \r
2544                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2545                 \r
2546                 $mem = Member::createFromID($memberid);\r
2547                 \r
2548                 self::pagehead();\r
2549                 self::$skin->parse('memberdelete');\r
2550                 self::pagefoot();\r
2551                 return;\r
2552         }\r
2553         \r
2554         /**\r
2555          * Admin::action_memberdeleteconfirm()\r
2556          * \r
2557          * @param       void\r
2558          * @return      void\r
2559          */\r
2560         static private function action_memberdeleteconfirm()\r
2561         {\r
2562                 global $member;\r
2563                 \r
2564                 $memberid = intRequestVar('memberid');\r
2565                 \r
2566                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2567                 \r
2568                 $error = self::deleteOneMember($memberid);\r
2569                 if ( $error )\r
2570                 {\r
2571                         self::error($error);\r
2572                 }\r
2573                 \r
2574                 if ( $member->isAdmin() )\r
2575                 {\r
2576                         self::$action_usermanagement();\r
2577                 }\r
2578                 else\r
2579                 {\r
2580                         self::$action_overview(_DELETED_MEMBER);\r
2581                 }\r
2582                 return;\r
2583         }\r
2584         \r
2585         /**\r
2586          * Admin::deleteOneMember()\r
2587          * Delete a member by id\r
2588          * \r
2589          * @static\r
2590          * @params      Integer $memberid       member id\r
2591          * @return      String  null string or error messages\r
2592          */\r
2593         static private function deleteOneMember($memberid)\r
2594         {\r
2595                 global $manager;\r
2596                 \r
2597                 $memberid = intval($memberid);\r
2598                 $mem = Member::createFromID($memberid);\r
2599                 \r
2600                 if ( !$mem->canBeDeleted() )\r
2601                 {\r
2602                         return _ERROR_DELETEMEMBER;\r
2603                 }\r
2604                 \r
2605                 $data = array('member' => &$mem);\r
2606                 $manager->notify('PreDeleteMember', $data);\r
2607                 \r
2608                 /* unlink comments from memberid */\r
2609                 if ( $memberid )\r
2610                 {\r
2611                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2612                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2613                         sql_query($query);\r
2614                 }\r
2615                 \r
2616                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2617                 sql_query($query);\r
2618                 \r
2619                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2620                 sql_query($query);\r
2621                 \r
2622                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2623                 sql_query($query);\r
2624                 \r
2625                 // delete all associated plugin options\r
2626                 NucleusPlugin::delete_option_values('member', $memberid);\r
2627                 \r
2628                 $data = array('member' => &$mem);\r
2629                 $manager->notify('PostDeleteMember', $data);\r
2630                 \r
2631                 return '';\r
2632         }\r
2633         \r
2634         /**\r
2635          * Admin::action_createnewlog()\r
2636          * \r
2637          * @param       void\r
2638          * @return      void\r
2639          */\r
2640         static private function action_createnewlog()\r
2641         {\r
2642                 global $member, $CONF, $manager;\r
2643                 \r
2644                 // Only Super-Admins can do this\r
2645                 $member->isAdmin() or self::disallow();\r
2646                 \r
2647                 self::pagehead();\r
2648                 self::$skin->parse('createnewlog');\r
2649                 self::pagefoot();\r
2650                 return;\r
2651         }\r
2652         \r
2653         /**\r
2654          * Admin::action_addnewlog()\r
2655          * \r
2656          * @param       void\r
2657          * @return      void\r
2658          */\r
2659         static private function action_addnewlog()\r
2660         {\r
2661                 global $member, $manager, $CONF;\r
2662                 \r
2663                 // Only Super-Admins can do this\r
2664                 $member->isAdmin() or self::disallow();\r
2665                 \r
2666                 $bname                  = trim(postVar('name'));\r
2667                 $bshortname             = trim(postVar('shortname'));\r
2668                 $btimeoffset    = postVar('timeoffset');\r
2669                 $bdesc                  = trim(postVar('desc'));\r
2670                 $bdefskin               = postVar('defskin');\r
2671                 \r
2672                 if ( !isValidShortName($bshortname) )\r
2673                 {\r
2674                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2675                 }\r
2676                 \r
2677                 if ( $manager->existsBlog($bshortname) )\r
2678                 {\r
2679                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2680                 }\r
2681                 \r
2682                 $data = array(\r
2683                         'name'        => &$bname,\r
2684                         'shortname'   => &$bshortname,\r
2685                         'timeoffset'  => &$btimeoffset,\r
2686                         'description' => &$bdesc,\r
2687                         'defaultskin' => &$bdefskin\r
2688                 );\r
2689                 $manager->notify('PreAddBlog', $data);\r
2690                 \r
2691                 // add slashes for sql queries\r
2692                 $bname                  = sql_real_escape_string($bname);\r
2693                 $bshortname             = sql_real_escape_string($bshortname);\r
2694                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2695                 $bdesc                  = sql_real_escape_string($bdesc);\r
2696                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2697                 \r
2698                 // create blog\r
2699                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2700                 $query = sprintf(sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2701                 sql_query($query);\r
2702                 \r
2703                 $blogid =  sql_insert_id();\r
2704                 $blog   =& $manager->getBlog($blogid);\r
2705                 \r
2706                 // create new category\r
2707                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2708                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2709                 \r
2710                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2711                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2712                 $catid = sql_insert_id();\r
2713                 \r
2714                 // set as default category\r
2715                 $blog->setDefaultCategory($catid);\r
2716                 $blog->writeSettings();\r
2717                 \r
2718                 // create team member\r
2719                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2720                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2721                 sql_query($query);\r
2722                 \r
2723                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2724                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2725                 \r
2726                 $blog->additem(\r
2727                         $blog->getDefaultCategory(),\r
2728                         $itemdeftitle,$itemdefbody,\r
2729                         '',\r
2730                         $blogid,\r
2731                         $member->getID(),\r
2732                         $blog->getCorrectTime(),\r
2733                         0,\r
2734                         0,\r
2735                         0\r
2736                 );\r
2737                 \r
2738                 $data = array('blog' => &$blog);\r
2739                 $manager->notify('PostAddBlog', $data);\r
2740                 \r
2741                 $data = array(\r
2742                         'blog'                  => &$blog,\r
2743                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2744                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2745                         'catid'                 => $catid\r
2746                 );\r
2747                 $manager->notify('PostAddCategory', $data);\r
2748                 \r
2749                 /* TODO: we should consider to use the other way insterad of this */\r
2750                 $_REQUEST['blogid'] = $blogid;\r
2751                 $_REQUEST['catid']  = $catid;\r
2752                 self::pagehead();\r
2753                 self::$skin->parse('addnewlog');\r
2754                 self::pagefoot();\r
2755                 return;\r
2756         }\r
2757         \r
2758         /**\r
2759          * Admin::action_addnewlog2()\r
2760          * \r
2761          * @param       void\r
2762          * @return      void\r
2763          */\r
2764         static private function action_addnewlog2()\r
2765         {\r
2766                 global $member, $manager;\r
2767                 $blogid = intRequestVar('blogid');\r
2768                 \r
2769                 $member->blogAdminRights($blogid) or self::disallow();\r
2770                 \r
2771                 $burl = requestVar('url');\r
2772                 \r
2773                 $blog =& $manager->getBlog($blogid);\r
2774                 $blog->setURL(trim($burl));\r
2775                 $blog->writeSettings();\r
2776                 \r
2777                 self::$action_overview(_MSG_NEWBLOG);\r
2778                 return;\r
2779         }\r
2780         \r
2781         /**\r
2782          * Admin::action_skinieoverview()\r
2783          * \r
2784          * @param       void\r
2785          * @return      void\r
2786          */\r
2787         static private function action_skinieoverview()\r
2788         {\r
2789                 global $member, $DIR_LIBS, $manager;\r
2790                 \r
2791                 $member->isAdmin() or self::disallow();\r
2792                 \r
2793                 include_once($DIR_LIBS . 'skinie.php');\r
2794                 \r
2795                 self::pagehead();\r
2796                 self::$skin->parse('skinieoverview');\r
2797                 self::pagefoot();\r
2798                 return;\r
2799         }\r
2800         \r
2801         /**\r
2802          * Admin::action_skinieimport()\r
2803          * \r
2804          * @param       void\r
2805          * @return      void\r
2806          */\r
2807         static private function action_skinieimport()\r
2808         {\r
2809                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2810                 \r
2811                 $member->isAdmin() or self::disallow();\r
2812                 \r
2813                 // load skinie class\r
2814                 include_once($DIR_LIBS . 'skinie.php');\r
2815                 \r
2816                 $skinFileRaw    = postVar('skinfile');\r
2817                 $mode                   = postVar('mode');\r
2818                 \r
2819                 $importer = new SkinImport();\r
2820                 \r
2821                 // get full filename\r
2822                 if ($mode == 'file')\r
2823                 {\r
2824                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2825                         \r
2826                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2827                         /* TODO: remove this */\r
2828                         if ( !file_exists($skinFile) )\r
2829                         {\r
2830                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2831                         }\r
2832                 }\r
2833                 else\r
2834                 {\r
2835                         $skinFile = $skinFileRaw;\r
2836                 }\r
2837                 \r
2838                 // read only metadata\r
2839                 $error = $importer->readFile($skinFile, 1);\r
2840                 \r
2841                 /* TODO: we should consider to use the other way insterad of this */\r
2842                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2843                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2844                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2845                 \r
2846                 // clashes\r
2847                 $skinNameClashe                 = $importer->checkSkinNameClashes();\r
2848                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2849                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2850                 \r
2851                 /* TODO: we should consider to use the other way insterad of this */\r
2852                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2853                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2854                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2855                 \r
2856                 if ( $error )\r
2857                 {\r
2858                         self::error($error);\r
2859                 }\r
2860                 \r
2861                 self::pagehead();\r
2862                 self::$skin->parse('skinieimport');\r
2863                 self::pagefoot();\r
2864                 return;\r
2865         }\r
2866         \r
2867         /**\r
2868          * Admin::\r
2869          * \r
2870          * @param       void\r
2871          * @return      void\r
2872          */\r
2873         static private function action_skiniedoimport()\r
2874         {\r
2875                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2876 \r
2877                 $member->isAdmin() or self::disallow();\r
2878 \r
2879                 // load skinie class\r
2880                 include_once($DIR_LIBS . 'skinie.php');\r
2881 \r
2882                 $skinFileRaw= postVar('skinfile');\r
2883                 $mode       = postVar('mode');\r
2884 \r
2885                 $allowOverwrite = intPostVar('overwrite');\r
2886 \r
2887                 // get full filename\r
2888                 if ( $mode == 'file' )\r
2889                 {\r
2890                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2891 \r
2892                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2893                         if ( !file_exists($skinFile) )\r
2894                         {\r
2895                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2896                         }\r
2897 \r
2898                 }\r
2899                 else\r
2900                 {\r
2901                         $skinFile = $skinFileRaw;\r
2902                 }\r
2903 \r
2904                 $importer = new SkinImport();\r
2905 \r
2906                 $error    = $importer->readFile($skinFile);\r
2907 \r
2908                 if ( $error )\r
2909                 {\r
2910                         self::error($error);\r
2911                 }\r
2912 \r
2913                 $error = $importer->writeToDatabase($allowOverwrite);\r
2914 \r
2915                 if ( $error )\r
2916                 {\r
2917                         self::error($error);\r
2918                 }\r
2919 \r
2920                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2921                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2922                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2923 \r
2924                 self::pagehead();\r
2925                 self::$skin->parse('skiniedoimport');\r
2926                 self::pagefoot();\r
2927         }\r
2928 \r
2929         /**\r
2930          * Admin::\r
2931          * \r
2932          * @param       void\r
2933          * @return      void\r
2934          */\r
2935         static private function action_skinieexport()\r
2936         {\r
2937                 global $member, $DIR_LIBS;\r
2938 \r
2939                 $member->isAdmin() or self::disallow();\r
2940 \r
2941                 // load skinie class\r
2942                 include_once($DIR_LIBS . 'skinie.php');\r
2943 \r
2944                 $aSkins     = requestIntArray('skin');\r
2945                 $aTemplates = requestIntArray('template');\r
2946 \r
2947                 if ( !is_array($aTemplates) )\r
2948                 {\r
2949                         $aTemplates = array();\r
2950                 }\r
2951                 if ( !is_array($aSkins) )\r
2952                 {\r
2953                         $aSkins = array();\r
2954                 }\r
2955 \r
2956                 $skinList     = array_keys($aSkins);\r
2957                 $templateList = array_keys($aTemplates);\r
2958 \r
2959                 $info = postVar('info');\r
2960 \r
2961                 $exporter = new SkinExport();\r
2962                 foreach ($skinList as $skinId)\r
2963                 {\r
2964                         $exporter->addSkin($skinId);\r
2965                 }\r
2966                 foreach ($templateList as $templateId)\r
2967                 {\r
2968                         $exporter->addTemplate($templateId);\r
2969                 }\r
2970                 $exporter->setInfo($info);\r
2971 \r
2972                 $exporter->export();\r
2973         }\r
2974 \r
2975         /**\r
2976          * Admin::\r
2977          * \r
2978          * @param       void\r
2979          * @return      void\r
2980          */\r
2981         static private function action_templateoverview()\r
2982         {\r
2983                 global $member, $manager;\r
2984 \r
2985                 $member->isAdmin() or self::disallow();\r
2986 \r
2987                 self::pagehead();\r
2988                 self::$skin->parse('templateoverview');\r
2989                 self::pagefoot();\r
2990         }\r
2991 \r
2992         /**\r
2993          * Admin::\r
2994          * \r
2995          * @param       void\r
2996          * @return      void\r
2997          */\r
2998         static private function action_templateedit($msg = '')\r
2999         {\r
3000                 global $member, $manager;\r
3001                 if ( $msg )\r
3002                 {\r
3003                         self::$headMess = $msg;\r
3004                 }\r
3005                 \r
3006                 $templateid = intRequestVar('templateid');\r
3007 \r
3008                 $member->isAdmin() or self::disallow();\r
3009 \r
3010                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';\r
3011                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>';\r
3012 \r
3013                 self::pagehead($extrahead);\r
3014                 self::$skin->parse('templateedit');\r
3015                 self::pagefoot();\r
3016         }\r
3017 \r
3018         /**\r
3019          *\r
3020         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3021                 static $count = 1;\r
3022                 if (!isset($template[$name])) $template[$name] = '';\r
3023         ?>\r
3024                 </tr><tr>\r
3025                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3026                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3027         <?php       $count++;\r
3028         }\r
3029         */\r
3030 \r
3031         /**\r
3032          * Admin::\r
3033          * \r
3034          * @param       void\r
3035          * @return      void\r
3036          */\r
3037         static private function action_templateupdate()\r
3038         {\r
3039                 global $member,$manager;\r
3040 \r
3041                 $templateid = intRequestVar('templateid');\r
3042 \r
3043                 $member->isAdmin() or self::disallow();\r
3044 \r
3045                 $name = postVar('tname');\r
3046                 $desc = postVar('tdesc');\r
3047 \r
3048                 if ( !isValidTemplateName($name) )\r
3049                 {\r
3050                         self::error(_ERROR_BADTEMPLATENAME);\r
3051                 }\r
3052 \r
3053                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3054                 {\r
3055                         self::error(_ERROR_DUPTEMPLATENAME);\r
3056                 }\r
3057 \r
3058                 $name = sql_real_escape_string($name);\r
3059                 $desc = sql_real_escape_string($desc);\r
3060 \r
3061                 // 1. Remove all template parts\r
3062                 $query = 'DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid;\r
3063                 sql_query($query);\r
3064 \r
3065                 // 2. Update description\r
3066                 $query = 'UPDATE '\r
3067                            .      sql_table('template_desc')\r
3068                            . ' SET'\r
3069                            . "    tdname='" . $name . "',"\r
3070                            . "    tddesc='" . $desc . "'"\r
3071                            . " WHERE"\r
3072                            . "    tdnumber=" . $templateid;\r
3073                 sql_query($query);\r
3074 \r
3075                 // 3. Add non-empty template parts\r
3076                 self::addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));\r
3077                 self::addToTemplate($templateid, 'ITEM', postVar('ITEM'));\r
3078                 self::addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));\r
3079                 self::addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));\r
3080                 self::addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));\r
3081                 self::addToTemplate($templateid, 'NEW', postVar('NEW'));\r
3082                 self::addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));\r
3083                 self::addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));\r
3084                 self::addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));\r
3085                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));\r
3086                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));\r
3087                 self::addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));\r
3088                 self::addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));\r
3089                 self::addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));\r
3090                 self::addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));\r
3091                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));\r
3092                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3093                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));\r
3094                 self::addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));\r
3095                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));\r
3096                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));\r
3097                 self::addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));\r
3098                 self::addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));\r
3099                 self::addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));\r
3100                 self::addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));\r
3101                 self::addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));\r
3102                 self::addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));\r
3103                 self::addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));\r
3104                 self::addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));\r
3105                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));\r
3106                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3107                 self::addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));\r
3108                 self::addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));\r
3109                 self::addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));\r
3110 \r
3111                 $pluginfields = array();\r
3112                 $manager->notify(\r
3113                         'TemplateExtraFields',\r
3114                         array(\r
3115                                 'fields'=>&$pluginfields\r
3116                         )\r
3117                 );\r
3118                 foreach ($pluginfields as $pfkey=>$pfvalue)\r
3119                 {\r
3120                         foreach ($pfvalue as $pffield=>$pfdesc)\r
3121                         {\r
3122                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3123                         }\r
3124                 }\r
3125 \r
3126                 // jump back to template edit\r
3127                 self::$action_templateedit(_TEMPLATE_UPDATED);\r
3128 \r
3129         }\r
3130 \r
3131         /**\r
3132          * Admin::addToTemplate()\r
3133          * \r
3134          * @param       Integer $id     ID for template\r
3135          * @param       String  $partname       parts name\r
3136          * @param       String  $content        template contents\r
3137          * @return      Integer record index\r
3138          * \r
3139          */\r
3140         static private function addToTemplate($id, $partname, $content)\r
3141         {\r
3142                 // don't add empty parts:\r
3143                 if ( !trim($content) )\r
3144                 {\r
3145                         return -1;\r
3146                 }\r
3147                 \r
3148                 $partname = sql_real_escape_string($partname);\r
3149                 $content  = sql_real_escape_string($content);\r
3150                 \r
3151                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";\r
3152                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3153                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3154                 return sql_insert_id();\r
3155         }\r
3156         \r
3157         /**\r
3158          * Admin::\r
3159          * \r
3160          * @param       void\r
3161          * @return      void\r
3162          */\r
3163         static private function action_templatedelete() {\r
3164                 global $member, $manager;\r
3165 \r
3166                 $member->isAdmin() or self::disallow();\r
3167 \r
3168                 $templateid = intRequestVar('templateid');\r
3169                 // TODO: check if template can be deleted\r
3170 \r
3171                 self::pagehead();\r
3172                 self::$skin->parse('templatedelete');\r
3173                 self::pagefoot();\r
3174         }\r
3175 \r
3176         /**\r
3177          * Admin::\r
3178          * \r
3179          * @param       void\r
3180          * @return      void\r
3181          */\r
3182         static private function action_templatedeleteconfirm() {\r
3183                 global $member, $manager;\r
3184 \r
3185                 $templateid = intRequestVar('templateid');\r
3186 \r
3187                 $member->isAdmin() or self::disallow();\r
3188 \r
3189                 $manager->notify(\r
3190                         'PreDeleteTemplate',\r
3191                         array(\r
3192                                 'templateid' => $templateid\r
3193                         )\r
3194                 );\r
3195 \r
3196                 // 1. delete description\r
3197                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3198 \r
3199                 // 2. delete parts\r
3200                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3201 \r
3202                 $manager->notify(\r
3203                         'PostDeleteTemplate',\r
3204                         array(\r
3205                                 'templateid' => $templateid\r
3206                         )\r
3207                 );\r
3208 \r
3209                 self::$action_templateoverview();\r
3210         }\r
3211 \r
3212         /**\r
3213          * Admin::\r
3214          * \r
3215          * @param       void\r
3216          * @return      void\r
3217          */\r
3218         static private function action_templatenew()\r
3219         {\r
3220                 global $member;\r
3221 \r
3222                 $member->isAdmin() or self::disallow();\r
3223 \r
3224                 $name = postVar('name');\r
3225                 $desc = postVar('desc');\r
3226 \r
3227                 if ( !isValidTemplateName($name) )\r
3228                 {\r
3229                         self::error(_ERROR_BADTEMPLATENAME);\r
3230                 }\r
3231 \r
3232                 if ( Template::exists($name) )\r
3233                 {\r
3234                         self::error(_ERROR_DUPTEMPLATENAME);\r
3235                 }\r
3236 \r
3237                 $newTemplateId = Template::createNew($name, $desc);\r
3238 \r
3239                 self::$action_templateoverview();\r
3240         }\r
3241 \r
3242         /**\r
3243          * Admin::\r
3244          * \r
3245          * @param       void\r
3246          * @return      void\r
3247          */\r
3248         static private function action_templateclone()\r
3249         {\r
3250                 global $member;\r
3251 \r
3252                 $templateid = intRequestVar('templateid');\r
3253 \r
3254                 $member->isAdmin() or self::disallow();\r
3255 \r
3256                 // 1. read old template\r
3257                 $name = Template::getNameFromId($templateid);\r
3258                 $desc = Template::getDesc($templateid);\r
3259 \r
3260                 // 2. create desc thing\r
3261                 $name = "cloned" . $name;\r
3262 \r
3263                 // if a template with that name already exists:\r
3264                 if (Template::exists($name)) {\r
3265                         $i = 1;\r
3266                         while (Template::exists($name . $i))\r
3267                         {\r
3268                                 $i++;\r
3269                         }\r
3270                         $name .= $i;\r
3271                 }\r
3272 \r
3273                 $newid = Template::createNew($name, $desc);\r
3274 \r
3275                 // 3. create clone\r
3276                 // go through parts of old template and add them to the new one\r
3277                 $que = 'SELECT '\r
3278                          . '    tpartname,'\r
3279                          . '    tcontent '\r
3280                          . 'FROM '\r
3281                          .      sql_table('template')\r
3282                          . ' WHERE'\r
3283                          . '    tdesc=' . intval($templateid);\r
3284                 $res = sql_query($que);\r
3285                 while ($o = sql_fetch_object($res)) {\r
3286                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3287                 }\r
3288 \r
3289                 self::$action_templateoverview();\r
3290         }\r
3291         \r
3292         /**\r
3293          * Admin::\r
3294          * \r
3295          * @param       void\r
3296          * @return      void\r
3297          */\r
3298         static private function action_admintemplateoverview()\r
3299         {\r
3300                 global $member, $manager;\r
3301                 $member->isAdmin() or self::disallow();\r
3302                 self::pagehead();\r
3303                 self::$skin->parse('admintemplateoverview');\r
3304                 self::pagefoot();\r
3305         }\r
3306         \r
3307         /**\r
3308          * Admin::\r
3309          * \r
3310          * @param       void\r
3311          * @return      void\r
3312          */\r
3313         static private function action_admintemplateedit($msg = '')\r
3314         {\r
3315                 global $member, $manager;\r
3316                 if ($msg) {\r
3317                         self::$headMess = $msg;\r
3318                 }\r
3319                 $member->isAdmin() or self::disallow();\r
3320                 $extrahead  = '<script type="text/javascript" src="javascript/templateEdit.js"></script>' . "\n";\r
3321                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>';\r
3322                 self::pagehead($extrahead);\r
3323                 self::$skin->parse('admintemplateedit');\r
3324                 self::pagefoot();\r
3325         }\r
3326         \r
3327         /**\r
3328          * Admin::\r
3329          * \r
3330          * @param       void\r
3331          * @return      void\r
3332          */\r
3333         static private function action_admintemplateupdate()\r
3334         {\r
3335                 global $member, $manager;\r
3336                 $templateid = intRequestVar('templateid');\r
3337                 $member->isAdmin() or self::disallow();\r
3338                 $name = postVar('tname');\r
3339                 $desc = postVar('tdesc');\r
3340         \r
3341                 if (!isValidTemplateName($name)) {\r
3342                         self::error(_ERROR_BADTEMPLATENAME);\r
3343                 }\r
3344                 //        if (!class_exists('Template')) {\r
3345                 //            NP_SkinableAdmin::loadSkinableClass('Template');\r
3346                 //        }\r
3347                 if ((Template::getNameFromId($templateid) != $name) && Template::exists($name)) {\r
3348                         self::error(_ERROR_DUPTEMPLATENAME);\r
3349                 }\r
3350                 $name = sql_real_escape_string($name);\r
3351                 $desc = sql_real_escape_string($desc);\r
3352         \r
3353                 // 1. Remove all template parts\r
3354                 $query = 'DELETE '\r
3355                 . 'FROM '\r
3356                 .      sql_table('admintemplate') . ' '\r
3357                 . 'WHERE '\r
3358                 . '    tdesc = %d';\r
3359                 sql_query(sprintf($query, $templateid));\r
3360         \r
3361                 // 2. Update description\r
3362                 $query = 'UPDATE '\r
3363                 .      sql_table('admintemplate_desc') . ' '\r
3364                 . 'SET '\r
3365                 . '    tdname = "' . sql_real_escape_string($name) . '", '\r
3366                 . '    tddesc = "' . sql_real_escape_string($desc) . '" '\r
3367                 . 'WHERE '\r
3368                 . '    tdnumber = %d';\r
3369                 sql_query(sprintf($query, $templateid));\r
3370         \r
3371                 // 3. Add non-empty template parts\r
3372                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                 postVar('ADMINSKINTYPELIST_BODY'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3376                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',            postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3377                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                         postVar('ADMIN_BLOGLINK'));\r
3378                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                        postVar('ADMIN_BATCHLIST'));\r
3379                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3380                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3381                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                postVar('ACTIVATE_REGISTER_TITLE'));\r
3382                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3383                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3384                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3385                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3386                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3387                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3388                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                   postVar('SPECIALSKINLIST_HEAD'));\r
3389                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                   postVar('SPECIALSKINLIST_BODY'));\r
3390                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                   postVar('SPECIALSKINLIST_FOOT'));\r
3391                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3392                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                   postVar('BANLIST_DELETED_LIST'));\r
3393                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                postVar('INSERT_PLUGOPTION_TITLE'));\r
3394                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                 postVar('INSERT_PLUGOPTION_BODY'));\r
3395                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3396                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3397                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3399                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3400                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                     postVar('SKINIE_EXPORT_LIST'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',          postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',          postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',          postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',           postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',           postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',           postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3473                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3474                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3475                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3476                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3477         \r
3478                 $pluginfields = array();\r
3479                 $manager->notify(\r
3480                                 'TemplateExtraFields',\r
3481                                 array(\r
3482                                                 'fields' => &$pluginfields\r
3483                                 )\r
3484                 );\r
3485                 foreach ($pluginfields as $pfkey => $pfvalue) {\r
3486                         foreach ($pfvalue as $pffield => $pfdesc) {\r
3487                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3488                         }\r
3489                 }\r
3490         \r
3491                 // jump back to template edit\r
3492                 self::$action_admintemplateedit(_TEMPLATE_UPDATED);\r
3493         }\r
3494         \r
3495         /**\r
3496          * Admin::\r
3497          * \r
3498          * @param       void\r
3499          * @return      void\r
3500          */\r
3501         static private function addToAdminTemplate($id, $partname, $content)\r
3502         {\r
3503                 $partname = sql_real_escape_string($partname);\r
3504                 $content  = sql_real_escape_string($content);\r
3505         \r
3506         \r
3507                 $id = intval($id);\r
3508         \r
3509                 // don't add empty parts:\r
3510                 if (!trim($content)) {\r
3511                         return -1;\r
3512                 }\r
3513                 $query = 'INSERT '\r
3514                 . 'INTO '\r
3515                 .      sql_table('admintemplate') . ' '\r
3516                 . '('\r
3517                 . '    tdesc, '\r
3518                 . '    tpartname, '\r
3519                 . '    tcontent '\r
3520                 . ') VALUES ('\r
3521                 . '    %d, '\r
3522                 . '    "%s", '\r
3523                 . '    "%s"'\r
3524                 . ')';\r
3525                 sql_query(sprintf($query, $id, $partname, $content)) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3526                 return sql_insert_id();\r
3527         }\r
3528         \r
3529         /**\r
3530          * Admin::\r
3531          * \r
3532          * @param       void\r
3533          * @return      void\r
3534          */\r
3535         static private function action_admintemplatedelete()\r
3536         {\r
3537                 global $member, $manager;\r
3538                 $member->isAdmin() or self::disallow();\r
3539                 // TODO: check if template can be deleted\r
3540                 self::pagehead();\r
3541                 self::$skin->parse('admintemplatedelete');\r
3542                 self::pagefoot();\r
3543         }\r
3544         \r
3545         /**\r
3546          * Admin::\r
3547          * \r
3548          * @param       void\r
3549          * @return      void\r
3550          */\r
3551         static private function action_admintemplatedeleteconfirm()\r
3552         {\r
3553                 global $member, $manager;\r
3554                 $templateid = intRequestVar('templateid');\r
3555                 $member->isAdmin() or self::disallow();\r
3556                 $manager->notify(\r
3557                                 'PreDeleteAdminTemplate',\r
3558                                 array(\r
3559                                                 'templateid' => $templateid\r
3560                                 )\r
3561                 );\r
3562         \r
3563                 $query = 'DELETE '\r
3564                 . 'FROM '\r
3565                 . '    %s '\r
3566                 . 'WHERE '\r
3567                 . '    %s = ' .intval($templateid);\r
3568                 // 1. delete description\r
3569                 sql_query(sprintf($query, sql_table('admintemplate_desc'), 'tdnumber'));\r
3570                 // 2. delete parts\r
3571                 sql_query(sprintf($query, sql_table('admintemplate'), 'tdesc'));\r
3572         \r
3573                 $manager->notify(\r
3574                                 'PostDeleteAdminTemplate',\r
3575                                 array(\r
3576                                                 'templateid' => $templateid\r
3577                                 )\r
3578                 );\r
3579                 self::$action_admintemplateoverview();\r
3580         }\r
3581         \r
3582         /**\r
3583          * Admin::\r
3584          * \r
3585          * @param       void\r
3586          * @return      void\r
3587          */\r
3588         static private function action_admintemplatenew()\r
3589         {\r
3590                 global $member;\r
3591                 $member->isAdmin() or self::disallow();\r
3592                 $name = postVar('name');\r
3593                 $desc = postVar('desc');\r
3594         \r
3595                 if (!isValidTemplateName($name)) {\r
3596                         self::error(_ERROR_BADTEMPLATENAME);\r
3597                 }\r
3598                 if (Template::exists($name)) {\r
3599                         self::error(_ERROR_DUPTEMPLATENAME);\r
3600                 }\r
3601         \r
3602                 $newTemplateId = Template::createNew($name, $desc);\r
3603                 self::$action_admintemplateoverview();\r
3604         }\r
3605         \r
3606         /**\r
3607          * Admin::\r
3608          * \r
3609          * @param       void\r
3610          * @return      void\r
3611          */\r
3612         static private function action_admintemplateclone()\r
3613         {\r
3614                 global $member;\r
3615                 $templateid = intRequestVar('templateid');\r
3616                 $member->isAdmin() or self::disallow();\r
3617         \r
3618                 //        if (!class_exists('Template')) {\r
3619                 //            NP_SkinableAdmin::loadSkinableClass('Template');\r
3620                 //        }\r
3621         \r
3622                 // 1. read old template\r
3623                 $name = Template::getNameFromId($templateid);\r
3624                 $desc = Template::getDesc($templateid);\r
3625                 // 2. create desc thing\r
3626                 $name = "cloned" . $name;\r
3627         \r
3628                 // if a template with that name already exists:\r
3629                 if (Template::exists($name)) {\r
3630                         $i = 1;\r
3631                         while (Template::exists($name . $i)) {\r
3632                                 $i++;\r
3633                         }\r
3634                         $name .= $i;\r
3635                 }\r
3636         \r
3637                 $newid = Template::admincreateNew($name, $desc);\r
3638         \r
3639                 // 3. create clone\r
3640                 // go through parts of old template and add them to the new one\r
3641                 $que = 'SELECT '\r
3642                 . '    tpartname, '\r
3643                 . '    tcontent '\r
3644                 . 'FROM '\r
3645                 .      sql_table('admintemplate') . ' '\r
3646                 . 'WHERE '\r
3647                 . '    tdesc = ' . intval($templateid);\r
3648                 $res = sql_query($que);\r
3649                 while ($o = sql_fetch_object($res)) {\r
3650                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3651                 }\r
3652                 self::$action_admintemplateoverview();\r
3653         }\r
3654 \r
3655         /**\r
3656          * Admin::\r
3657          * \r
3658          * @param       void\r
3659          * @return      void\r
3660          */\r
3661         static private function action_skinoverview()\r
3662         {\r
3663                 global $member, $manager;\r
3664 \r
3665                 $member->isAdmin() or self::disallow();\r
3666 \r
3667                 self::pagehead();\r
3668                 self::$skin->parse('skinoverview');\r
3669                 self::pagefoot();\r
3670         }\r
3671 \r
3672         /**\r
3673          * Admin::\r
3674          * \r
3675          * @param       void\r
3676          * @return      void\r
3677          */\r
3678         static private function action_skinnew()\r
3679         {\r
3680                 global $member;\r
3681 \r
3682                 $member->isAdmin() or self::disallow();\r
3683 \r
3684                 $name = trim(postVar('name'));\r
3685                 $desc = trim(postVar('desc'));\r
3686 \r
3687                 if ( !isValidSkinName($name) )\r
3688                 {\r
3689                         self::error(_ERROR_BADSKINNAME);\r
3690                 }\r
3691 \r
3692                 if ( SKIN::exists($name) )\r
3693                 {\r
3694                         self::error(_ERROR_DUPSKINNAME);\r
3695                 }\r
3696 \r
3697                 $newId = SKIN::createNew($name, $desc);\r
3698 \r
3699                 self::$action_skinoverview();\r
3700         }\r
3701 \r
3702         /**\r
3703          * Admin::\r
3704          * \r
3705          * @param       void\r
3706          * @return      void\r
3707          */\r
3708         static private function action_skinedit()\r
3709         {\r
3710                 global $member, $manager;\r
3711 \r
3712 //              $skinid = intRequestVar('skinid');\r
3713 \r
3714                 $member->isAdmin() or self::disallow();\r
3715 \r
3716 //              $skin = new SKIN($skinid);\r
3717 \r
3718                 self::pagehead();\r
3719                 self::$skin->parse('skinedit');\r
3720                 self::pagefoot();\r
3721         }\r
3722 \r
3723         /**\r
3724          * Admin::\r
3725          * \r
3726          * @param       void\r
3727          * @return      void\r
3728          */\r
3729         static private function action_skineditgeneral()\r
3730         {\r
3731                 global $member;\r
3732 \r
3733                 $skinid = intRequestVar('skinid');\r
3734 \r
3735                 $member->isAdmin() or self::disallow();\r
3736 \r
3737                 $name = postVar('name');\r
3738                 $desc = postVar('desc');\r
3739                 $type = postVar('type');\r
3740                 $inc_mode = postVar('inc_mode');\r
3741                 $inc_prefix = postVar('inc_prefix');\r
3742 \r
3743                 $skin = new Skin($skinid);\r
3744 \r
3745                 // 1. Some checks\r
3746                 if ( !isValidSkinName($name) )\r
3747                 {\r
3748                         self::error(_ERROR_BADSKINNAME);\r
3749                 }\r
3750 \r
3751                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3752                 {\r
3753                         self::error(_ERROR_DUPSKINNAME);\r
3754                 }\r
3755 \r
3756                 if ( !$type )\r
3757                 {\r
3758                         $type = 'text/html';\r
3759                 }\r
3760                 if ( !$inc_mode )\r
3761                 {\r
3762                         $inc_mode = 'normal';\r
3763                 }\r
3764 \r
3765                 // 2. Update description\r
3766                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3767 \r
3768                 self::$action_skinedit();\r
3769 \r
3770         }\r
3771 \r
3772         static private function action_skinedittype($msg = '')\r
3773         {\r
3774                 global $member, $manager;\r
3775 \r
3776                 $member->isAdmin() or self::disallow();\r
3777 \r
3778                 if ($msg) {\r
3779                         self::$headMess = $msg;\r
3780                 }\r
3781                 $skinid = intRequestVar('skinid');\r
3782                 $type   = requestVar('type');\r
3783                 $type   = trim($type);\r
3784                 $type   = strtolower($type);\r
3785 \r
3786                 if ( !isValidShortName($type) )\r
3787                 {\r
3788                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3789                 }\r
3790 \r
3791                 self::pagehead();\r
3792                 self::$skin->parse('skinedittype');\r
3793                 self::pagefoot();\r
3794         }\r
3795 \r
3796         /**\r
3797          * Admin::\r
3798          * \r
3799          * @param       void\r
3800          * @return      void\r
3801          */\r
3802         static private function action_skinupdate()\r
3803         {\r
3804                 global $member;\r
3805 \r
3806                 $skinid = intRequestVar('skinid');\r
3807                 $content = trim(postVar('content'));\r
3808                 $type = postVar('type');\r
3809 \r
3810                 $member->isAdmin() or self::disallow();\r
3811 \r
3812                 $skin = new SKIN($skinid);\r
3813                 $skin->update($type, $content);\r
3814 \r
3815                 self::$action_skinedittype(_SKIN_UPDATED);\r
3816         }\r
3817 \r
3818         /**\r
3819          * Admin::\r
3820          * \r
3821          * @param       void\r
3822          * @return      void\r
3823          */\r
3824         static private function action_skindelete()\r
3825         {\r
3826                 global $member, $manager, $CONF;\r
3827 \r
3828                 $skinid = intRequestVar('skinid');\r
3829 \r
3830                 $member->isAdmin() or self::disallow();\r
3831 \r
3832                 // don't allow default skin to be deleted\r
3833                 if ( $skinid == $CONF['BaseSkin'] )\r
3834                 {\r
3835                         self::error(_ERROR_DEFAULTSKIN);\r
3836                 }\r
3837 \r
3838                 // don't allow deletion of default skins for blogs\r
3839                 $query = 'SELECT bname FROM ' . sql_table('blog') . ' WHERE bdefskin=' . $skinid;\r
3840                 $r = sql_query($query);\r
3841                 if ( $o = sql_fetch_object($r) )\r
3842                 {\r
3843                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3844                 }\r
3845 \r
3846                 self::pagehead();\r
3847                 self::$skin->parse('skindelete');\r
3848                 self::pagefoot();\r
3849         }\r
3850 \r
3851         /**\r
3852          * Admin::\r
3853          * \r
3854          * @param       void\r
3855          * @return      void\r
3856          */\r
3857         static private function action_skindeleteconfirm()\r
3858         {\r
3859                 global $member, $CONF, $manager;\r
3860 \r
3861                 $skinid = intRequestVar('skinid');\r
3862 \r
3863                 $member->isAdmin() or self::disallow();\r
3864 \r
3865                 // don't allow default skin to be deleted\r
3866                 if ( $skinid == $CONF['BaseSkin'] )\r
3867                 {\r
3868                         self::error(_ERROR_DEFAULTSKIN);\r
3869                 }\r
3870 \r
3871                 // don't allow deletion of default skins for blogs\r
3872                 $query = 'SELECT'\r
3873                            . '    bname '\r
3874                            . 'FROM '\r
3875                            .      sql_table('blog') . ' '\r
3876                            . 'WHERE'\r
3877                            . '    bdefskin=' . $skinid;\r
3878                 $r = sql_query($query);\r
3879                 if ( $o = sql_fetch_object($r) )\r
3880                 {\r
3881                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3882                 }\r
3883 \r
3884                 $manager->notify(\r
3885                         'PreDeleteSkin',\r
3886                         array(\r
3887                                 'skinid' => $skinid\r
3888                         )\r
3889                 );\r
3890 \r
3891                 // 1. delete description\r
3892                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);\r
3893 \r
3894                 // 2. delete parts\r
3895                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);\r
3896 \r
3897                 $manager->notify(\r
3898                         'PostDeleteSkin',\r
3899                         array(\r
3900                                 'skinid' => $skinid\r
3901                         )\r
3902                 );\r
3903 \r
3904                 self::$action_skinoverview();\r
3905         }\r
3906 \r
3907         /**\r
3908          * Admin::\r
3909          * \r
3910          * @param       void\r
3911          * @return      void\r
3912          */\r
3913         static private function action_skinremovetype() {\r
3914                 global $member, $manager, $CONF;\r
3915 \r
3916                 $member->isAdmin() or self::disallow();\r
3917 \r
3918                 $skinid = intRequestVar('skinid');\r
3919                 $skintype = requestVar('type');\r
3920 \r
3921                 if ( !isValidShortName($skintype) )\r
3922                 {\r
3923                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3924                 }\r
3925 \r
3926 \r
3927                 // don't allow default skinparts to be deleted\r
3928                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3929                 {\r
3930                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3931                 }\r
3932 \r
3933                 self::pagehead();\r
3934                 self::$skin->parse('skinremovetype');\r
3935                 self::pagefoot();\r
3936         }\r
3937 \r
3938         /**\r
3939          * Admin::\r
3940          * \r
3941          * @param       void\r
3942          * @return      void\r
3943          */\r
3944         static private function action_skinremovetypeconfirm() {\r
3945                 global $member, $CONF, $manager;\r
3946 \r
3947                 $member->isAdmin() or self::disallow();\r
3948 \r
3949                 $skinid = intRequestVar('skinid');\r
3950                 $skintype = requestVar('type');\r
3951 \r
3952                 if ( !isValidShortName($skintype) )\r
3953                 {\r
3954                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3955                 }\r
3956 \r
3957                 // don't allow default skinparts to be deleted\r
3958                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3959                 {\r
3960                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3961                 }\r
3962 \r
3963                 $manager->notify(\r
3964                         'PreDeleteSkinPart',\r
3965                         array(\r
3966                                 'skinid'   => $skinid,\r
3967                                 'skintype' => $skintype\r
3968                         )\r
3969                 );\r
3970 \r
3971                 // delete part\r
3972                 sql_query("DELETE FROM " . sql_table('skin') . " WHERE sdesc=" . $skinid . " AND stype='" . $skintype . "'");\r
3973 \r
3974                 $manager->notify(\r
3975                         'PostDeleteSkinPart',\r
3976                         array(\r
3977                                 'skinid'   => $skinid,\r
3978                                 'skintype' => $skintype\r
3979                         )\r
3980                 );\r
3981 \r
3982                 self::$action_skinedit();\r
3983         }\r
3984 \r
3985         /**\r
3986          * Admin::\r
3987          * \r
3988          * @param       void\r
3989          * @return      void\r
3990          */\r
3991         static private function action_skinclone()\r
3992         {\r
3993                 global $member;\r
3994 \r
3995                 $member->isAdmin() or self::disallow();\r
3996 \r
3997                 $skinid = intRequestVar('skinid');\r
3998 \r
3999                 // 1. read skin to clone\r
4000                 $skin = new SKIN($skinid);\r
4001 \r
4002                 $name = "clone_" . $skin->getName();\r
4003 \r
4004                 // if a skin with that name already exists:\r
4005                 if (Skin::exists($name)) {\r
4006                         $i = 1;\r
4007                         while (Skin::exists($name . $i))\r
4008                                 $i++;\r
4009                         $name .= $i;\r
4010                 }\r
4011 \r
4012                 // 2. create skin desc\r
4013                 $newid = Skin::createNew(\r
4014                         $name,\r
4015                         $skin->getDescription(),\r
4016                         $skin->getContentType(),\r
4017                         $skin->getIncludeMode(),\r
4018                         $skin->getIncludePrefix()\r
4019                 );\r
4020 \r
4021 \r
4022                 // 3. clone\r
4023                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;\r
4024                 $res = sql_query($query);\r
4025                 while ($row = sql_fetch_assoc($res)) {\r
4026                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4027                 }\r
4028 \r
4029                 self::$action_skinoverview();\r
4030 \r
4031         }\r
4032 \r
4033         /**\r
4034          * Admin::skinclonetype()\r
4035          * \r
4036          * @param       String  $skin   Skin object\r
4037          * @param       Integer $newid  ID for this clone\r
4038          * @param       String  $type   type of skin\r
4039          * @return      Void\r
4040          */\r
4041         static private function skinclonetype($skin, $newid, $type)\r
4042         {\r
4043                 $newid = intval($newid);\r
4044                 $content = $skin->getContent($type);\r
4045                 \r
4046                 if ( $content )\r
4047                 {\r
4048                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4049                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4050                         sql_query($query);\r
4051                 }\r
4052                 return;\r
4053         }\r
4054         \r
4055         /**\r
4056          * Admin::\r
4057          * \r
4058          * @param       void\r
4059          * @return      void\r
4060          */\r
4061         static private function action_adminskinoverview() {\r
4062                 global $member, $manager;\r
4063 \r
4064                 $member->isAdmin() or self::disallow();\r
4065 \r
4066                 self::pagehead();\r
4067                 self::$skin->parse('adminskinoverview');\r
4068                 self::pagefoot();\r
4069         }\r
4070 \r
4071         /**\r
4072          * Admin::\r
4073          * \r
4074          * @param       void\r
4075          * @return      void\r
4076          */\r
4077         static private function action_adminskinnew()\r
4078         {\r
4079                 global $member;\r
4080                 $member->isAdmin() or self::disallow();\r
4081                 $name = trim(postVar('name'));\r
4082                 $desc = trim(postVar('desc'));\r
4083 \r
4084                 if (!isValidSkinName($name)) {\r
4085                         self::error(_ERROR_BADSKINNAME);\r
4086                 }\r
4087                 if (SkinSKIN::exists($name)) {\r
4088                         self::error(_ERROR_DUPSKINNAME);\r
4089                 }\r
4090                 $newId = Skin::createNew($name, $desc);\r
4091                 self::$action_adminskinoverview();\r
4092         }\r
4093 \r
4094         /**\r
4095          * Admin::\r
4096          * \r
4097          * @param       void\r
4098          * @return      void\r
4099          */\r
4100         static private function action_adminskinedit()\r
4101         {\r
4102                 global $member, $manager;\r
4103 \r
4104                 $member->isAdmin() or self::disallow();\r
4105                 self::pagehead();\r
4106                 self::$skin->parse('adminskinedit');\r
4107                 self::pagefoot();\r
4108         }\r
4109 \r
4110         /**\r
4111          * Admin::\r
4112          * \r
4113          * @param       void\r
4114          * @return      void\r
4115          */\r
4116         static private function action_adminskineditgeneral()\r
4117         {\r
4118                 global $member;\r
4119 \r
4120                 $skinid = intRequestVar('skinid');\r
4121 \r
4122                 $member->isAdmin() or self::disallow();\r
4123 \r
4124                 $name       = postVar('name');\r
4125                 $desc       = postVar('desc');\r
4126                 $type       = postVar('type');\r
4127                 $inc_mode   = postVar('inc_mode');\r
4128                 $inc_prefix = postVar('inc_prefix');\r
4129 \r
4130                 $skin = new Skin($skinid);\r
4131 \r
4132                 // 1. Some checks\r
4133                 if (!isValidSkinName($name)) {\r
4134                         self::error(_ERROR_BADSKINNAME);\r
4135                 }\r
4136                 if (($skin->getName() != $name) && Skin::exists($name)) {\r
4137                         self::error(_ERROR_DUPSKINNAME);\r
4138                 }\r
4139                 if (!$type) {\r
4140                         $type = 'text/html';\r
4141                 }\r
4142                 if (!$inc_mode) {\r
4143                         $inc_mode = 'normal';\r
4144                 }\r
4145                 // 2. Update description\r
4146                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4147                 self::$action_adminskinedit();\r
4148         }\r
4149 \r
4150         /**\r
4151          * Admin::\r
4152          * \r
4153          * @param       void\r
4154          * @return      void\r
4155          */\r
4156         static private function action_adminskinedittype($msg = '')\r
4157         {\r
4158                 global $member, $manager;\r
4159 \r
4160                 $member->isAdmin() or self::disallow();\r
4161                 if ($msg) {\r
4162                         self::$headMess = $msg;\r
4163                 }\r
4164                 $type = requestVar('type');\r
4165                 $type = trim($type);\r
4166                 $type = strtolower($type);\r
4167                 if (!isValidShortName($type)) {\r
4168                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4169                 }\r
4170                 self::pagehead();\r
4171                 self::$skin->parse('adminskinedittype');\r
4172                 self::pagefoot();\r
4173         }\r
4174 \r
4175         /**\r
4176          * Admin::\r
4177          * \r
4178          * @param       void\r
4179          * @return      void\r
4180          */\r
4181         static private function action_adminskinupdate()\r
4182         {\r
4183                 global $member;\r
4184                 $skinid  = intRequestVar('skinid');\r
4185                 $content = trim(postVar('content'));\r
4186                 $type    = postVar('type');\r
4187 \r
4188                 $member->isAdmin() or self::disallow();\r
4189 \r
4190                 $skin = new Skin($skinid);\r
4191                 $skin->update($type, $content);\r
4192                 self::$action_adminskinedittype(_SKIN_UPDATED);\r
4193         }\r
4194 \r
4195         /**\r
4196          * Admin::\r
4197          * \r
4198          * @param       void\r
4199          * @return      void\r
4200          */\r
4201         static private function action_adminskindelete()\r
4202         {\r
4203                 global $member, $manager, $CONF;\r
4204                 $member->isAdmin() or self::disallow();\r
4205                 $skinid = intRequestVar('skinid');\r
4206                 self::pagehead();\r
4207                 self::$skin->parse('adminskindelete');\r
4208                 self::pagefoot();\r
4209         }\r
4210 \r
4211         /**\r
4212          * Admin::\r
4213          * \r
4214          * @param       void\r
4215          * @return      void\r
4216          */\r
4217         static private function action_adminskindeleteconfirm()\r
4218         {\r
4219                 global $member, $CONF, $manager;\r
4220                 $member->isAdmin() or self::disallow();\r
4221                 $skinid = intRequestVar('skinid');\r
4222                 // don't allow default skin to be deleted\r
4223                 if ($skinid == $CONF['DefaultAdminSkin']) {\r
4224                         self::error(_ERROR_DEFAULTSKIN);\r
4225                 }\r
4226                 // don't allow deletion of default skins for members\r
4227                 $memberDefaults =  $member->getAdminSkin();\r
4228                 foreach ($memberDefaults as $memID => $adminskin) {\r
4229                         if ($skinid == $adminskin) {\r
4230                                 $mem = MEMBER::createFromID($memID);\r
4231                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4232                         }\r
4233                 }\r
4234                 $manager->notify(\r
4235                         'PreDeleteAdminSkin',\r
4236                         array(\r
4237                                 'skinid' => intval($skinid)\r
4238                         )\r
4239                 );\r
4240                 $query = 'DELETE FROM %s WHERE %s = ' . intval($skinid);\r
4241                 // 1. delete description\r
4242                 sql_query(sprintf($query, sql_table('adminskin_desc'), 'sdnumber'));\r
4243                 // 2. delete parts\r
4244                 sql_query(sprintf($query, sql_table('adminskin'), 'sdesc'));\r
4245                 $manager->notify(\r
4246                         'PostDeleteAdminSkin',\r
4247                         array(\r
4248                                 'skinid' => intval($skinid)\r
4249                         )\r
4250                 );\r
4251                 self::$action_adminskinoverview();\r
4252         }\r
4253 \r
4254         /**\r
4255          * Admin::\r
4256          * \r
4257          * @param       void\r
4258          * @return      void\r
4259          */\r
4260         static private function action_adminskinremovetype()\r
4261         {\r
4262                 global $member, $manager, $CONF;\r
4263 \r
4264                 $member->isAdmin() or self::disallow();\r
4265                 $skinid   = intRequestVar('skinid');\r
4266                 $skintype = requestVar('type');\r
4267                 if (!isValidShortName($skintype)) {\r
4268                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4269                 }\r
4270                 self::pagehead();\r
4271                 self::$skin->parse('adminskinremovetype');\r
4272                 self::pagefoot();\r
4273         }\r
4274 \r
4275         /**\r
4276          * Admin::\r
4277          * \r
4278          * @param       void\r
4279          * @return      void\r
4280          */\r
4281         static private function action_adminskinremovetypeconfirm()\r
4282         {\r
4283                 global $member, $CONF, $manager;\r
4284 \r
4285                 $member->isAdmin() or self::disallow();\r
4286                 $skinid   = intRequestVar('skinid');\r
4287                 $skintype = requestVar('type');\r
4288                 if (!isValidShortName($skintype)) {\r
4289                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4290                 }\r
4291                 $manager->notify(\r
4292                         'PreDeleteAdminSkinPart',\r
4293                         array(\r
4294                                 'skinid'   => $skinid,\r
4295                                 'skintype' => $skintype\r
4296                         )\r
4297                 );\r
4298                 // delete part\r
4299                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4300                 sql_query(sprintf($query, sql_table('adminskin'), intval($skinid), $skintype ));\r
4301                 $manager->notify(\r
4302                         'PostDeleteAdminSkinPart',\r
4303                         array(\r
4304                                 'skinid'   => $skinid,\r
4305                                 'skintype' => $skintype\r
4306                         )\r
4307                 );\r
4308                 self::$action_adminskinedit();\r
4309         }\r
4310 \r
4311         /**\r
4312          * Admin::\r
4313          * \r
4314          * @param       void\r
4315          * @return      void\r
4316          */\r
4317         static private function action_adminskinclone()\r
4318         {\r
4319                 global $member;\r
4320                 $member->isAdmin() or self::disallow();\r
4321                 $skinid = intRequestVar('skinid');\r
4322                 // 1. read skin to clone\r
4323                 $skin = new Skin($skinid);\r
4324                 $name = "clone_" . $skin->getName();\r
4325                 // if a skin with that name already exists:\r
4326                 if (Skin::exists($name)) {\r
4327                         $i = 1;\r
4328                         while (Skin::exists($name . $i)) {\r
4329                                 $i++;\r
4330                         }\r
4331                         $name .= $i;\r
4332                 }\r
4333                 // 2. create skin desc\r
4334                 $newid = Skin::createNew(\r
4335                         $name,\r
4336                         $skin->getDescription(),\r
4337                         $skin->getContentType(),\r
4338                         $skin->getIncludeMode(),\r
4339                         $skin->getIncludePrefix()\r
4340                 );\r
4341                 $query = 'SELECT '\r
4342                                 . '    stype '\r
4343                                 . 'FROM '\r
4344                                 .      sql_table('adminskin') . ' '\r
4345                                 . 'WHERE '\r
4346                                 . '    sdesc = ' . $skinid;\r
4347                 $res   = sql_query($query);\r
4348                 while ($row = sql_fetch_assoc($res)) {\r
4349                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4350                 }\r
4351                 self::$action_adminskinoverview();\r
4352         }\r
4353 \r
4354         /**\r
4355          * Admin::\r
4356          * \r
4357          * @param       void\r
4358          * @return      void\r
4359          */\r
4360         static private function adminskinclonetype($skin, $newid, $type)\r
4361         {\r
4362                 $newid   = intval($newid);\r
4363                 $content = $skin->getContent($type);\r
4364                 if ($content) {\r
4365                         $query = 'INSERT '\r
4366                                         . 'INTO '\r
4367                                         .      sql_table('adminskin') . ' '\r
4368                                         . '('\r
4369                                         . '    sdesc, '\r
4370                                         . '    scontent, '\r
4371                                         . '    stype'\r
4372                                         . ') VALUES ('\r
4373                                         .      intval($newid) . ', '\r
4374                                         . '"' . sql_real_escape_string($content) . '", '\r
4375                                         . '"' . sql_real_escape_string($type) . '" '\r
4376                                         . ')';\r
4377                         sql_query($query);\r
4378                 }\r
4379         }\r
4380 \r
4381         /**\r
4382          * Admin::\r
4383          * \r
4384          * @param       void\r
4385          * @return      void\r
4386          */\r
4387         static private function action_adminskinieoverview()\r
4388         {\r
4389                 global $member, $DIR_LIBS, $manager;\r
4390                 $member->isAdmin() or self::disallow();\r
4391                 // load skinie class\r
4392                 include_once($DIR_LIBS . 'skinie.php');\r
4393                 self::pagehead();\r
4394                 self::$skin->parse('adminskinieoverview');\r
4395                 self::pagefoot();\r
4396 \r
4397         }\r
4398 \r
4399         /**\r
4400          * Admin::\r
4401          * \r
4402          * @param       void\r
4403          * @return      void\r
4404          */\r
4405         static private function action_adminskinieimport()\r
4406         {\r
4407                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4408                 $member->isAdmin() or self::disallow();\r
4409                 // load skinie class\r
4410                 include_once($DIR_LIBS . 'skinie.php');\r
4411                 $skinFileRaw= postVar('skinfile');\r
4412                 $mode       = postVar('mode');\r
4413                 $importer   = new SKINIMPORT();\r
4414                 // get full filename\r
4415                 if ($mode == 'file') {\r
4416                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4417                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4418                         if (!file_exists($skinFile)) {\r
4419                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4420                         }\r
4421                 } else {\r
4422                         $skinFile = $skinFileRaw;\r
4423                 }\r
4424                 // read only metadata\r
4425                 $error = $importer->readFile($skinFile, 1);\r
4426                 if ($error) {\r
4427                         self::error($error);\r
4428                 }\r
4429 \r
4430                 $_REQUEST['skininfo']  = $importer->getInfo();\r
4431                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
4432                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
4433 \r
4434                 // clashes\r
4435                 $skinNameClashes         = $importer->checkSkinNameClashes();\r
4436                 $templateNameClashes     = $importer->checkTemplateNameClashes();\r
4437                 $hasNameClashes          = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4438                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
4439                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
4440                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
4441 \r
4442                 self::pagehead();\r
4443                 self::$skin->parse('adminskinieimport');\r
4444                 self::pagefoot();\r
4445         }\r
4446 \r
4447         /**\r
4448          * Admin::\r
4449          * \r
4450          * @param       void\r
4451          * @return      void\r
4452          */\r
4453         static private function action_adminskiniedoimport()\r
4454         {\r
4455                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4456                 $member->isAdmin() or self::disallow();\r
4457                 // load skinie class\r
4458                 include_once($DIR_LIBS . 'skinie.php');\r
4459                 $skinFileRaw    = postVar('skinfile');\r
4460                 $mode           = postVar('mode');\r
4461                 $allowOverwrite = intPostVar('overwrite');\r
4462                 // get full filename\r
4463                 if ($mode == 'file') {\r
4464                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4465                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4466                         if (!file_exists($skinFile)) {\r
4467                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4468                         }\r
4469                 } else {\r
4470                         $skinFile = $skinFileRaw;\r
4471                 }\r
4472                 $importer = new SKINIMPORT();\r
4473                 $error    = $importer->readFile($skinFile);\r
4474                 if ($error) {\r
4475                         self::error($error);\r
4476                 }\r
4477                 $error = $importer->writeToDatabase($allowOverwrite);\r
4478                 if ($error) {\r
4479                         self::error($error);\r
4480                 }\r
4481 \r
4482                 $_REQUEST['skininfo']  = $importer->getInfo();\r
4483                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
4484                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
4485 \r
4486                 self::pagehead();\r
4487                 self::$skin->parse('adminskiniedoimport');\r
4488                 self::pagefoot();\r
4489 \r
4490         }\r
4491 \r
4492         /**\r
4493          * Admin::\r
4494          * \r
4495          * @param       void\r
4496          * @return      void\r
4497          */\r
4498         static private function action_adminskinieexport()\r
4499         {\r
4500                 global $member, $DIR_PLUGINS;\r
4501                 $member->isAdmin() or self::disallow();\r
4502                 // load skinie class\r
4503                 $aSkins     = requestIntArray('skin');\r
4504                 $aTemplates = requestIntArray('template');\r
4505                 if (!is_array($aTemplates)) {\r
4506                         $aTemplates = array();\r
4507                 }\r
4508                 if (!is_array($aSkins)) {\r
4509                         $aSkins = array();\r
4510                 }\r
4511                 $skinList     = array_keys($aSkins);\r
4512                 $templateList = array_keys($aTemplates);\r
4513 \r
4514                 $info = postVar('info');\r
4515 \r
4516                 $exporter = new SkinEXPORT();\r
4517                 foreach ($skinList as $skinId) {\r
4518                         $exporter->addSkin($skinId);\r
4519                 }\r
4520                 foreach ($templateList as $templateId) {\r
4521                         $exporter->addTemplate($templateId);\r
4522                 }\r
4523                 $exporter->setInfo($info);\r
4524                 $exporter->export();\r
4525                 \r
4526         }\r
4527 \r
4528         /**\r
4529          * Admin::action_settingsedit()\r
4530          * \r
4531          * @param       Void\r
4532          * @return      Void\r
4533          */\r
4534         static private function action_settingsedit() {\r
4535                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4536 \r
4537                 $member->isAdmin() or self::disallow();\r
4538 \r
4539                 self::pagehead();\r
4540                 self::$skin->parse('settingsedit');\r
4541                 self::pagefoot();\r
4542         }\r
4543         \r
4544         /**\r
4545          * Admin::action_settingsupdate()\r
4546          * Update $CONFIG and redirect\r
4547          * \r
4548          * @param       void\r
4549          * @return      void\r
4550          */\r
4551         static private function action_settingsupdate() {\r
4552                 global $member, $CONF;\r
4553                 \r
4554                 $member->isAdmin() or self::disallow();\r
4555                 \r
4556                 // check if email address for admin is valid\r
4557                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4558                 {\r
4559                         self::error(_ERROR_BADMAILADDRESS);\r
4560                 }\r
4561                 \r
4562                 // save settings\r
4563                 self::updateConfig('DefaultBlog',         postVar('DefaultBlog'));\r
4564                 self::updateConfig('BaseSkin',           postVar('BaseSkin'));\r
4565                 self::updateConfig('IndexURL',           postVar('IndexURL'));\r
4566                 self::updateConfig('AdminURL',           postVar('AdminURL'));\r
4567                 self::updateConfig('PluginURL',         postVar('PluginURL'));\r
4568                 self::updateConfig('SkinsURL',           postVar('SkinsURL'));\r
4569                 self::updateConfig('ActionURL',         postVar('ActionURL'));\r
4570                 self::updateConfig('Locale',               postVar('Locale'));\r
4571                 self::updateConfig('AdminEmail',           postVar('AdminEmail'));\r
4572                 self::updateConfig('SessionCookie',     postVar('SessionCookie'));\r
4573                 self::updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));\r
4574                 self::updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));\r
4575                 self::updateConfig('NonmemberMail',     postVar('NonmemberMail'));\r
4576                 self::updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));\r
4577                 self::updateConfig('SiteName',           postVar('SiteName'));\r
4578                 self::updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));\r
4579                 self::updateConfig('DisableSite',         postVar('DisableSite'));\r
4580                 self::updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));\r
4581                 self::updateConfig('LastVisit',         postVar('LastVisit'));\r
4582                 self::updateConfig('MediaURL',           postVar('MediaURL'));\r
4583                 self::updateConfig('AllowedTypes',       postVar('AllowedTypes'));\r
4584                 self::updateConfig('AllowUpload',         postVar('AllowUpload'));\r
4585                 self::updateConfig('MaxUploadSize',     postVar('MaxUploadSize'));\r
4586                 self::updateConfig('MediaPrefix',         postVar('MediaPrefix'));\r
4587                 self::updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));\r
4588                 self::updateConfig('DisableJsTools',   postVar('DisableJsTools'));\r
4589                 self::updateConfig('CookieDomain',       postVar('CookieDomain'));\r
4590                 self::updateConfig('CookiePath',           postVar('CookiePath'));\r
4591                 self::updateConfig('CookieSecure',       postVar('CookieSecure'));\r
4592                 self::updateConfig('URLMode',             postVar('URLMode'));\r
4593                 self::updateConfig('CookiePrefix',       postVar('CookiePrefix'));\r
4594                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4595                 self::updateConfig('DefaultListSize',             postVar('DefaultListSize'));\r
4596                 self::updateConfig('AdminCSS',            postVar('AdminCSS'));\r
4597                 \r
4598                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4599                 // note that when changing cookie settings, this redirect might cause the user\r
4600                 // to have to log in again.\r
4601                 getConfig();\r
4602                 redirect($CONF['AdminURL'] . '?action=manage');\r
4603                 exit;\r
4604         }\r
4605 \r
4606         /**\r
4607          * Admin::action_systemoverview()\r
4608          * Output system overview\r
4609          * \r
4610          * @param       void\r
4611          * @return      void\r
4612          */\r
4613         static private function action_systemoverview()\r
4614         {\r
4615                 self::pagehead();\r
4616                 self::$skin->parse('systemoverview');\r
4617                 self::pagefoot();\r
4618         }\r
4619 \r
4620         /**\r
4621          * Admin::updateConfig()\r
4622          * \r
4623          * @param       string  $name   \r
4624          * @param       string  $val    \r
4625          * @return      integer return the ID in which the latest query posted\r
4626          */\r
4627         static private function updateConfig($name, $val)\r
4628         {\r
4629                 $name = sql_real_escape_string($name);\r
4630                 $val = trim(sql_real_escape_string($val));\r
4631                 \r
4632                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4633                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4634 //              sql_query($query) or die("Query error: " . sql_error());\r
4635         sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4636                 return sql_insert_id();\r
4637         }\r
4638         \r
4639         /**\r
4640          * Admin::error()\r
4641          * Error message\r
4642          * \r
4643          * @param       string  $msg    message that will be shown\r
4644          * @return      void\r
4645          */\r
4646         static private function error($msg)\r
4647         {\r
4648                 self::pagehead();\r
4649                 self::parse('adminerrorpage');\r
4650                 self::pagefoot();\r
4651                 exit;\r
4652         }\r
4653         \r
4654         /**\r
4655          * Admin::disallow()\r
4656          * add error log and show error page \r
4657          * \r
4658          * @param       void\r
4659          * @return      void\r
4660          */\r
4661         static private function disallow()\r
4662         {\r
4663                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4664                 self::error(_ERROR_DISALLOWED);\r
4665                 return;\r
4666         }\r
4667         \r
4668         /**\r
4669          * Admin::pagehead()\r
4670          * Output admin page head\r
4671          * \r
4672          * @param       void\r
4673          * @return      void\r
4674          */\r
4675         static private function pagehead($extrahead = '')\r
4676         {\r
4677                 global $member, $nucleus, $CONF, $manager;\r
4678                 \r
4679                 if ( self::existsSkinContents('pagehead') )\r
4680                 {\r
4681                         if ( isset($extrahead) && !empty($extrahead) )\r
4682                         {\r
4683                         self::$extrahead = $extrahead;\r
4684                         }\r
4685                         self::parse('pagehead');\r
4686                 }\r
4687                 else\r
4688                 {\r
4689                         $data = array(\r
4690                                 'extrahead' => &$extrahead,\r
4691                                 'action'    => self::$action\r
4692                         );\r
4693                         \r
4694                         $manager->notify('AdminPrePageHead', $data);\r
4695                         \r
4696                         $baseUrl = Entity::hsc($CONF['AdminURL']);\r
4697                         \r
4698                         /*\r
4699                          * TODO: obsoleted\r
4700                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4701                         {\r
4702                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4703                                 $CONF['AdminCSS'] = 'original';\r
4704                         }\r
4705                         */\r
4706                         \r
4707                         /* HTTP 1.1 application for no caching */\r
4708                         header("Cache-Control: no-cache, must-revalidate");\r
4709                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4710                         \r
4711                         $root_element = 'html';\r
4712                         $charset = i18n::get_current_charset();\r
4713                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4714                         $xml_version_info = self::xml_version_info;\r
4715                         $formal_public_identifier = self::formal_public_identifier;\r
4716                         $system_identifier = self::system_identifier;\r
4717                         $xhtml_namespace = self::xhtml_namespace;\r
4718                         \r
4719                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4720                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4721                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4722                         echo "<head>\n";\r
4723                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4724                         /*\r
4725                          * TODO: obsoleted\r
4726                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4727                         */\r
4728                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";\r
4729                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4730                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4731                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4732                         echo "{$extrahead}\n";\r
4733                         echo "</head>\n\n";\r
4734                         echo "<body>\n";\r
4735                         echo "<div id=\"adminwrapper\">\n";\r
4736                         echo "<div class=\"header\">\n";\r
4737                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4738                         echo "</div>\n";\r
4739                         echo "<div id=\"container\">\n";\r
4740                         echo "<div id=\"content\">\n";\r
4741                         echo "<div class=\"loginname\">\n";\r
4742                         if ( $member->isLoggedIn() )\r
4743                         {\r
4744                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4745                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4746                         }\r
4747                         else\r
4748                         {\r
4749                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4750                         }\r
4751                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4752                         echo '(';\r
4753                         \r
4754                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4755                         {\r
4756                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4757                         }\r
4758                         else\r
4759                         {\r
4760                                 $codenamestring = '';\r
4761                         }\r
4762                         \r
4763                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4764                         {\r
4765                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4766                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4767                                 \r
4768                                 $newestVersion = getLatestVersion();\r
4769                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4770                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4771                                 \r
4772                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4773                                 {\r
4774                                         echo "<br />\n";\r
4775                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4776                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4777                                         echo "</a>";\r
4778                                 }\r
4779                         }\r
4780                         else\r
4781                         {\r
4782                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4783                         }\r
4784                         echo ')';\r
4785                         echo '</div>';\r
4786                 }\r
4787                 return;\r
4788         }\r
4789         \r
4790         /**\r
4791          * Admin::pagefoot()\r
4792          * Output admin page foot include quickmenu\r
4793          * \r
4794          * @param       void\r
4795          * @return      void\r
4796          */\r
4797         static private function pagefoot()\r
4798         {\r
4799                 global $action, $member, $manager;\r
4800                 \r
4801                 if ( self::existsSkinContents('pagefoot') )\r
4802                 {\r
4803                         self::parse('pagefoot');\r
4804                         exit;\r
4805                 }\r
4806                 else\r
4807                 {\r
4808                         $data = array(\r
4809                                 'action' => self::$action\r
4810                         );\r
4811                         \r
4812                         $manager->notify('AdminPrePageFoot', $data);\r
4813                         \r
4814                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4815                         {\r
4816                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4817                                 echo "<ul>\n";\r
4818                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4819                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4820                                 echo "</ul>\n";\r
4821                         }\r
4822                         \r
4823                         echo "<div class=\"foot\">\n";\r
4824                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4825                         echo '-';\r
4826                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4827                         echo "</div>\n";\r
4828                         \r
4829                         echo "<div id=\"quickmenu\">\n";\r
4830                         \r
4831                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4832                         {\r
4833                                 echo "<ul>\n";\r
4834                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4835                                 echo "</ul>\n";\r
4836                                 \r
4837                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4838                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4839                                 echo "<p>\n";\r
4840                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4841                                 \r
4842                                 $showAll = requestVar('showall');\r
4843                                 \r
4844                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4845                                 {\r
4846                                         // Super-Admins have access to all blogs! (no add item support though)\r
4847                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4848                                         $query = sprintf($query, sql_table('blog'));\r
4849                                 }\r
4850                                 else\r
4851                                 {\r
4852                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4853                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4854                                 }\r
4855                                 $template['name']               = 'blogid';\r
4856                                 $template['tabindex']   = 15000;\r
4857                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4858                                 $template['selected']   = -1;\r
4859                                 $template['shorten']    = 10;\r
4860                                 $template['shortenel']  = '';\r
4861                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4862                                 showlist($query, 'select', $template);\r
4863                                 \r
4864                                 echo "</p>\n";\r
4865                                 echo "</form>\n";\r
4866                                 \r
4867                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4868                                 echo "<ul>\n";\r
4869                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4870                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4871                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4872                                 echo "</ul>\n";\r
4873                                 \r
4874                                 if ( $member->isAdmin() )\r
4875                                 {\r
4876                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4877                                         echo "<ul>\n";\r
4878                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4879                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4880                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4881                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4882                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4883                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4884                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4885                                         echo "</ul>\n";\r
4886                                         \r
4887                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4888                                         echo "<ul>\n";\r
4889                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4890                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4891                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4892                                         echo "</ul>\n";\r
4893                                 }\r
4894                                 \r
4895                                 $data = array('options' => array());\r
4896                                 \r
4897                                 $manager->notify('QuickMenu', $data);\r
4898                                 \r
4899                                 if ( count($data['options']) > 0 )\r
4900                                 {\r
4901                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4902                                         echo "<ul>\n";\r
4903                                         foreach ( $data['options'] as $option )\r
4904                                         {\r
4905                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
4906                                         }\r
4907                                         echo "</ul>\n";\r
4908                                 }\r
4909                         }\r
4910                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
4911                         {\r
4912                         \r
4913                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
4914                         }\r
4915                         else\r
4916                         {\r
4917                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
4918                         }\r
4919                         \r
4920                         echo "<!-- quickmenu -->\n";\r
4921                         echo "</div>\n";\r
4922                         \r
4923                         echo "<!-- content -->\n";\r
4924                         echo "</div>\n";\r
4925                         \r
4926                         echo "<!-- container -->\n";\r
4927                         echo "</div>\n";\r
4928                         \r
4929                         echo "<!-- adminwrapper -->\n";\r
4930                         echo "</div>\n";\r
4931                         \r
4932                         echo "</body>\n";\r
4933                         echo "</html>\n";\r
4934                 }\r
4935                 return;\r
4936         }\r
4937         \r
4938         /**\r
4939          * Admin::\r
4940          * \r
4941          * @param       void\r
4942          * @return      void\r
4943          */\r
4944         static private function action_regfile()\r
4945         {\r
4946                 global $member, $CONF;\r
4947 \r
4948                 $blogid = intRequestVar('blogid');\r
4949 \r
4950                 $member->teamRights($blogid) or self::disallow();\r
4951 \r
4952                 // header-code stolen from phpMyAdmin\r
4953                 // REGEDIT and bookmarklet code stolen from GreyMatter\r
4954 \r
4955                 $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));\r
4956 \r
4957 \r
4958                 header('Content-Type: application/octetstream');\r
4959                 header('Content-Disposition: filename="nucleus.reg"');\r
4960                 header('Pragma: no-cache');\r
4961                 header('Expires: 0');\r
4962 \r
4963                 echo "REGEDIT4\n";\r
4964                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";\r
4965                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";\r
4966                 echo '"contexts"=hex:31';\r
4967         }\r
4968 \r
4969         /**\r
4970          * Admin::\r
4971          * \r
4972          * @param       void\r
4973          * @return      void\r
4974          */\r
4975         static private function action_bookmarklet()\r
4976         {\r
4977                 global $member, $manager;\r
4978 \r
4979                 $member->teamRights($blogid) or self::disallow();\r
4980 \r
4981                 $blogid = intRequestVar('blogid');\r
4982 \r
4983                 self::pagehead();\r
4984                 self::$skin->parse('bookmarklet');\r
4985                 self::pagefoot();\r
4986 \r
4987         }\r
4988 \r
4989         /**\r
4990          * Admin::\r
4991          * \r
4992          * @param       void\r
4993          * @return      void\r
4994          */\r
4995         static private function action_actionlog()\r
4996         {\r
4997                 global $member, $manager;\r
4998 \r
4999                 $member->isAdmin() or self::disallow();\r
5000 \r
5001                 self::pagehead();\r
5002                 self::$skin->parse('actionlog');\r
5003                 self::pagefoot();\r
5004 \r
5005         }\r
5006 \r
5007         /**\r
5008          * Admin::\r
5009          * \r
5010          * @param       void\r
5011          * @return      void\r
5012          */\r
5013         static private function action_banlist() {\r
5014                 global $member, $manager;\r
5015 \r
5016                 $member->blogAdminRights($blogid) or self::disallow();\r
5017 \r
5018                 $blogid = intRequestVar('blogid');\r
5019 \r
5020                 self::pagehead();\r
5021                 self::$skin->parse('banlist');\r
5022                 self::pagefoot();\r
5023 \r
5024         }\r
5025 \r
5026         /**\r
5027          * Admin::\r
5028          * \r
5029          * @param       void\r
5030          * @return      void\r
5031          */\r
5032         static private function action_banlistdelete() {\r
5033                 global $member, $manager;\r
5034 \r
5035                 $blogid = intRequestVar('blogid');\r
5036                 $member->blogAdminRights($blogid) or self::disallow();\r
5037 \r
5038                 self::pagehead();\r
5039                 self::$skin->parse('banlistdelete');\r
5040                 self::pagefoot();\r
5041         }\r
5042 \r
5043         /**\r
5044          * Admin::\r
5045          * \r
5046          * @param       void\r
5047          * @return      void\r
5048          */\r
5049         static private function action_banlistdeleteconfirm()\r
5050         {\r
5051                 global $member, $manager;\r
5052 \r
5053                 $member->blogAdminRights($blogid) or self::disallow();\r
5054 \r
5055                 $blogid = intPostVar('blogid');\r
5056                 $allblogs = postVar('allblogs');\r
5057                 $iprange = postVar('iprange');\r
5058 \r
5059                 $deleted = array();\r
5060 \r
5061                 if ( !$allblogs )\r
5062                 {\r
5063                         if ( Ban::removeBan($blogid, $iprange) )\r
5064                         {\r
5065                                 array_push($deleted, $blogid);\r
5066                         }\r
5067                 }\r
5068                 else\r
5069                 {\r
5070                         // get blogs fot which member has admin rights\r
5071                         $adminblogs = $member->getAdminBlogs();\r
5072                         foreach ($adminblogs as $blogje)\r
5073                         {\r
5074                                 if ( Ban::removeBan($blogje, $iprange) )\r
5075                                 {\r
5076                                         array_push($deleted, $blogje);\r
5077                                 }\r
5078                         }\r
5079                 }\r
5080 \r
5081                 if ( sizeof($deleted) == 0 )\r
5082                 {\r
5083                         self::error(_ERROR_DELETEBAN);\r
5084                 }\r
5085 \r
5086                 self::pagehead();\r
5087                 self::$skin->parse('banlistdeleteconfirm');\r
5088                 self::pagefoot();\r
5089 \r
5090         }\r
5091 \r
5092         /**\r
5093          * Admin::\r
5094          * \r
5095          * @param       void\r
5096          * @return      void\r
5097          */\r
5098         static private function action_banlistnewfromitem()\r
5099         {\r
5100                 self::$action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5101         }\r
5102 \r
5103         /**\r
5104          * Admin::\r
5105          * \r
5106          * @param       void\r
5107          * @return      void\r
5108          */\r
5109         static private function action_banlistnew($blogid = '')\r
5110         {\r
5111                 global $member, $manager;\r
5112 \r
5113                 if ( $blogid == '' )\r
5114                 {\r
5115                         $blogid = intRequestVar('blogid');\r
5116                 }\r
5117 \r
5118                 $ip = requestVar('ip');\r
5119 \r
5120                 $member->blogAdminRights($blogid) or self::disallow();\r
5121 \r
5122                 $_REQUEST['blogid'] = $blogid;          \r
5123 \r
5124                 self::pagehead();\r
5125                 self::$skin->parse('banlistnew');\r
5126                 self::pagefoot();\r
5127         }\r
5128 \r
5129         /**\r
5130          * Admin::\r
5131          * \r
5132          * @param       void\r
5133          * @return      void\r
5134          */\r
5135         static private function action_banlistadd() {\r
5136                 global $member;\r
5137 \r
5138                 $blogid   = intPostVar('blogid');\r
5139                 $allblogs = postVar('allblogs');\r
5140                 $iprange  = postVar('iprange');\r
5141                 if ( $iprange == "custom" )\r
5142                 {\r
5143                         $iprange = postVar('customiprange');\r
5144                 }\r
5145                 $reason   = postVar('reason');\r
5146 \r
5147                 $member->blogAdminRights($blogid) or self::disallow();\r
5148 \r
5149                 // TODO: check IP range validity\r
5150 \r
5151                 if ( !$allblogs )\r
5152                 {\r
5153                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5154                         {\r
5155                                 self::error(_ERROR_ADDBAN);\r
5156                         }\r
5157                 }\r
5158                 else\r
5159                 {\r
5160                         // get blogs fot which member has admin rights\r
5161                         $adminblogs = $member->getAdminBlogs();\r
5162                         $failed = 0;\r
5163                         foreach ($adminblogs as $blogje)\r
5164                         {\r
5165                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5166                                 {\r
5167                                         $failed = 1;\r
5168                                 }\r
5169                         }\r
5170                         if ( $failed )\r
5171                         {\r
5172                                 self::error(_ERROR_ADDBAN);\r
5173                         }\r
5174                 }\r
5175                 self::$action_banlist();\r
5176         }\r
5177 \r
5178         /**\r
5179          * Admin::\r
5180          * \r
5181          * @param       void\r
5182          * @return      void\r
5183          */\r
5184         static private function action_clearactionlog()\r
5185         {\r
5186                 global $member;\r
5187 \r
5188                 $member->isAdmin() or self::disallow();\r
5189 \r
5190                 ActionLog::clear();\r
5191 \r
5192                 self::$action_manage(_MSG_ACTIONLOGCLEARED);\r
5193         }\r
5194 \r
5195         /**\r
5196          * Admin::\r
5197          * \r
5198          * @param       void\r
5199          * @return      void\r
5200          */\r
5201         static private function action_backupoverview()\r
5202         {\r
5203                 global $member, $manager;\r
5204 \r
5205                 $member->isAdmin() or self::disallow();\r
5206 \r
5207                 self::pagehead();\r
5208                 self::$skin->parse('backupoverview');\r
5209                 self::pagefoot();\r
5210         }\r
5211 \r
5212         /**\r
5213          * Admin::action_backupcreate()\r
5214          * create file for backup\r
5215          * \r
5216          * @param               void\r
5217          * @return      void\r
5218          * \r
5219          */\r
5220         static private function action_backupcreate()\r
5221         {\r
5222                 global $member, $DIR_LIBS;\r
5223                 \r
5224                 $member->isAdmin() or self::disallow();\r
5225                 \r
5226                 // use compression ?\r
5227                 $useGzip = (integer) postVar('gzip');\r
5228                 \r
5229                 include($DIR_LIBS . 'backup.php');\r
5230                 \r
5231                 // try to extend time limit\r
5232                 // (creating/restoring dumps might take a while)\r
5233                 @set_time_limit(1200);\r
5234                 \r
5235                 Backup::do_backup($useGzip);\r
5236                 exit;\r
5237         }\r
5238         \r
5239         /**\r
5240          * Admin::action_backuprestore()\r
5241          * restoring from uploaded file\r
5242          * \r
5243          * @param               void\r
5244          * @return      void\r
5245          */\r
5246         static private function action_backuprestore()\r
5247         {\r
5248                 global $member, $DIR_LIBS;\r
5249                 \r
5250                 $member->isAdmin() or self::disallow();\r
5251                 \r
5252                 if ( intPostVar('letsgo') != 1 )\r
5253                 {\r
5254                         self::error(_ERROR_BACKUP_NOTSURE);\r
5255                 }\r
5256                 \r
5257                 include($DIR_LIBS . 'backup.php');\r
5258                 \r
5259                 // try to extend time limit\r
5260                 // (creating/restoring dumps might take a while)\r
5261                 @set_time_limit(1200);\r
5262                 \r
5263                 $message = Backup::do_restore();\r
5264                 if ( $message != '' )\r
5265                 {\r
5266                         self::error($message);\r
5267                 }\r
5268                 self::pagehead();\r
5269                 self::$skin->parse('backuprestore');\r
5270                 self::pagefoot();\r
5271                 return;\r
5272         }\r
5273         \r
5274         /**\r
5275          * Admin::action_pluginlist()\r
5276          * output the list of installed plugins\r
5277          * \r
5278          * @param       void\r
5279          * @return      void\r
5280          * \r
5281          */\r
5282         static private function action_pluginlist()\r
5283         {\r
5284                 global $DIR_PLUGINS, $member, $manager;\r
5285                 \r
5286                 // check if allowed\r
5287                 $member->isAdmin() or self::disallow();\r
5288                 \r
5289                 self::pagehead();\r
5290                 self::$skin->parse('pluginlist');\r
5291                 self::pagefoot();\r
5292                 return;\r
5293         }\r
5294         \r
5295         /**\r
5296          * Admin::\r
5297          * \r
5298          * @param       void\r
5299          * @return      void\r
5300          */\r
5301         static private function action_pluginhelp()\r
5302         {\r
5303                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5304 \r
5305                 // check if allowed\r
5306                 $member->isAdmin() or self::disallow();\r
5307 \r
5308                 $plugid = intGetVar('plugid');\r
5309 \r
5310                 if ( !$manager->pidInstalled($plugid) )\r
5311                 {\r
5312                         self::error(_ERROR_NOSUCHPLUGIN);\r
5313                 }\r
5314 \r
5315                 self::pagehead();\r
5316                 self::$skin->parse('pluginhelp');\r
5317                 self::pagefoot();\r
5318         }\r
5319 \r
5320         /**\r
5321          * Admin::action_pluginadd()\r
5322          * \r
5323          * @param       Void\r
5324          * @return      Void\r
5325          * \r
5326          */\r
5327         static private function action_pluginadd()\r
5328         {\r
5329                 global $member, $manager, $DIR_PLUGINS;\r
5330                 \r
5331                 // check if allowed\r
5332                 $member->isAdmin() or self::disallow();\r
5333                 \r
5334                 $name = postVar('filename');\r
5335                 \r
5336                 if ( $manager->pluginInstalled($name) )\r
5337                 {\r
5338                         self::error(_ERROR_DUPPLUGIN);\r
5339                 }\r
5340                 \r
5341                 if ( !checkPlugin($name) )\r
5342                 {\r
5343                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5344                 }\r
5345                 \r
5346                 // get number of currently installed plugins\r
5347                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5348                 $numCurrent = sql_num_rows($res);\r
5349                 \r
5350                 // plugin will be added as last one in the list\r
5351                 $newOrder = $numCurrent + 1;\r
5352                 \r
5353                 $manager->notify(\r
5354                         'PreAddPlugin',\r
5355                         array(\r
5356                                 'file' => &$name\r
5357                         )\r
5358                 );\r
5359                 \r
5360                 // do this before calling getPlugin (in case the plugin id is used there)\r
5361                 $query = 'INSERT INTO '\r
5362                            .      sql_table('plugin')\r
5363                            . ' ('\r
5364                            . '    porder,'\r
5365                            . '    pfile'\r
5366                            . ') VALUES ('\r
5367                            .      $newOrder . ','\r
5368                            . '"' . sql_real_escape_string($name) . '"'\r
5369                            . ')';\r
5370                 sql_query($query);\r
5371                 $iPid = sql_insert_id();\r
5372                 \r
5373                 $manager->clearCachedInfo('installedPlugins');\r
5374                 \r
5375                 // Load the plugin for condition checking and instalation\r
5376                 $plugin =& $manager->getPlugin($name);\r
5377                 \r
5378                 // check if it got loaded (could have failed)\r
5379                 if ( !$plugin )\r
5380                 {\r
5381                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));\r
5382                         $manager->clearCachedInfo('installedPlugins');\r
5383                         self::error(_ERROR_PLUGIN_LOAD);\r
5384                 }\r
5385                 \r
5386                 // check if plugin needs a newer Nucleus version\r
5387                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5388                 {\r
5389                         // uninstall plugin again...\r
5390                         self::deleteOnePlugin($plugin->getID());\r
5391                         \r
5392                         // ...and show error\r
5393                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5394                 }\r
5395                 \r
5396                 // check if plugin needs a newer Nucleus version\r
5397                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5398                 {\r
5399                         // uninstall plugin again...\r
5400                         self::deleteOnePlugin($plugin->getID());\r
5401                         \r
5402                         // ...and show error\r
5403                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5404                 }\r
5405                 \r
5406                 $pluginList = $plugin->getPluginDep();\r
5407                 foreach ( $pluginList as $pluginName )\r
5408                 {\r
5409                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5410                         if (sql_num_rows($res) == 0)\r
5411                         {\r
5412                                 // uninstall plugin again...\r
5413                                 self::deleteOnePlugin($plugin->getID());\r
5414                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5415                         }\r
5416                 }\r
5417                 \r
5418                 // call the install method of the plugin\r
5419                 $plugin->install();\r
5420                 \r
5421                 $manager->notify(\r
5422                         'PostAddPlugin',\r
5423                         array(\r
5424                                 'plugin' => &$plugin\r
5425                         )\r
5426                 );\r
5427                 \r
5428                 // update all events\r
5429                 self::$action_pluginupdate();\r
5430                 return;\r
5431         }\r
5432         \r
5433         /**\r
5434          * ADMIN:action_pluginupdate():\r
5435          * \r
5436          * @param       Void\r
5437          * @return      Void\r
5438          * \r
5439          */\r
5440         static private function action_pluginupdate()\r
5441         {\r
5442                 global $member, $manager, $CONF;\r
5443                 \r
5444                 // check if allowed\r
5445                 $member->isAdmin() or self::disallow();\r
5446                 \r
5447                 // delete everything from plugin_events\r
5448                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5449                 \r
5450                 // loop over all installed plugins\r
5451                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5452                 while ( $o = sql_fetch_object($res) )\r
5453                 {\r
5454                         $pid  =  $o->pid;\r
5455                         $plug =& $manager->getPlugin($o->pfile);\r
5456                         if ( $plug )\r
5457                         {\r
5458                                 $eventList = $plug->getEventList();\r
5459                                 foreach ( $eventList as $eventName )\r
5460                                 {\r
5461                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5462                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5463                                         sql_query($query);\r
5464                                 }\r
5465                         }\r
5466                 }\r
5467                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5468                 return;\r
5469         }\r
5470         \r
5471         /**\r
5472          * Admin::\r
5473          * \r
5474          * @param       void\r
5475          * @return      void\r
5476          */\r
5477         static private function action_plugindelete()\r
5478         {\r
5479                 global $member, $manager;\r
5480 \r
5481                 // check if allowed\r
5482                 $member->isAdmin() or self::disallow();\r
5483 \r
5484                 $pid = intGetVar('plugid');\r
5485 \r
5486                 if ( !$manager->pidInstalled($pid) )\r
5487                 {\r
5488                         self::error(_ERROR_NOSUCHPLUGIN);\r
5489                 }\r
5490 \r
5491                 self::pagehead();\r
5492                 self::$skin->parse('plugindelete');\r
5493                 self::pagefoot();\r
5494         }\r
5495 \r
5496         /**\r
5497          * Admin::\r
5498          * \r
5499          * @param       void\r
5500          * @return      void\r
5501          */\r
5502         static private function action_plugindeleteconfirm()\r
5503         {\r
5504                 global $member, $manager, $CONF;\r
5505 \r
5506                 // check if allowed\r
5507                 $member->isAdmin() or self::disallow();\r
5508 \r
5509                 $pid = intPostVar('plugid');\r
5510 \r
5511                 $error = self::deleteOnePlugin($pid, 1);\r
5512                 if ($error) {\r
5513                         self::error($error);\r
5514                 }\r
5515 \r
5516                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5517 //              self::$action_pluginlist();\r
5518         }\r
5519 \r
5520         /**\r
5521          * Admin::\r
5522          * \r
5523          * @param       void\r
5524          * @return      void\r
5525          */\r
5526         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5527         {\r
5528                 global $manager;\r
5529 \r
5530                 $pid = intval($pid);\r
5531 \r
5532                 if ( !$manager->pidInstalled($pid) )\r
5533                 {\r
5534                         return _ERROR_NOSUCHPLUGIN;\r
5535                 }\r
5536 \r
5537                 $name = quickQuery('SELECT pfile as result FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5538 \r
5539 /*              // call the unInstall method of the plugin\r
5540                 if ($callUninstall) {\r
5541                         $plugin =& $manager->getPlugin($name);\r
5542                         if ($plugin) $plugin->unInstall();\r
5543                 }*/\r
5544 \r
5545                 // check dependency before delete\r
5546                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5547                 while ($o = sql_fetch_object($res))\r
5548                 {\r
5549                         $plug =& $manager->getPlugin($o->pfile);\r
5550                         if ($plug)\r
5551                         {\r
5552                                 $depList = $plug->getPluginDep();\r
5553                                 foreach ($depList as $depName)\r
5554                                 {\r
5555                                         if ($name == $depName)\r
5556                                         {\r
5557                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5558                                         }\r
5559                                 }\r
5560                         }\r
5561                 }\r
5562 \r
5563                 $manager->notify(\r
5564                         'PreDeletePlugin',\r
5565                         array(\r
5566                                 'plugid' => $pid\r
5567                         )\r
5568                 );\r
5569 \r
5570                 // call the unInstall method of the plugin\r
5571                 if ( $callUninstall )\r
5572                 {\r
5573                         $plugin =& $manager->getPlugin($name);\r
5574                         if ( $plugin )\r
5575                         {\r
5576                                 $plugin->unInstall();\r
5577                         }\r
5578                 }\r
5579 \r
5580                 // delete all subscriptions\r
5581                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5582 \r
5583                 // delete all options\r
5584                 // get OIDs from plugin_option_desc\r
5585                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5586                 $aOIDs = array();\r
5587                 while ($o = sql_fetch_object($res))\r
5588                 {\r
5589                         array_push($aOIDs, $o->oid);\r
5590                 }\r
5591 \r
5592                 // delete from plugin_option and plugin_option_desc\r
5593                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5594                 if (count($aOIDs) > 0)\r
5595                 {\r
5596                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',',$aOIDs) . ')');\r
5597                 }\r
5598 \r
5599                 // update order numbers\r
5600                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5601                 $o = sql_fetch_object($res);\r
5602                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5603 \r
5604                 // delete row\r
5605                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5606 \r
5607                 $manager->clearCachedInfo('installedPlugins');\r
5608                 $manager->notify(\r
5609                         'PostDeletePlugin',\r
5610                         array(\r
5611                                 'plugid' => $pid\r
5612                         )\r
5613                 );\r
5614 \r
5615                 return '';\r
5616         }\r
5617 \r
5618         /**\r
5619          * Admin::\r
5620          * \r
5621          * @param       void\r
5622          * @return      void\r
5623          */\r
5624         static private function action_pluginup()\r
5625         {\r
5626                 global $member, $manager, $CONF;\r
5627 \r
5628                 // check if allowed\r
5629                 $member->isAdmin() or self::disallow();\r
5630 \r
5631                 $plugid = intGetVar('plugid');\r
5632 \r
5633                 if ( !$manager->pidInstalled($plugid) )\r
5634                 {\r
5635                         self::error(_ERROR_NOSUCHPLUGIN);\r
5636                 }\r
5637 \r
5638                 // 1. get old order number\r
5639                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5640                 $o = sql_fetch_object($res);\r
5641                 $oldOrder = $o->porder;\r
5642 \r
5643                 // 2. calculate new order number\r
5644                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5645 \r
5646                 // 3. update plug numbers\r
5647                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5648                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5649 \r
5650                 //self::$action_pluginlist();\r
5651                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5652                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5653         }\r
5654 \r
5655         /**\r
5656          * Admin::\r
5657          * \r
5658          * @param       void\r
5659          * @return      void\r
5660          */\r
5661         static private function action_plugindown()\r
5662         {\r
5663                 global $member, $manager, $CONF;\r
5664 \r
5665                 // check if allowed\r
5666                 $member->isAdmin() or self::disallow();\r
5667 \r
5668                 $plugid = intGetVar('plugid');\r
5669                 if ( !$manager->pidInstalled($plugid) )\r
5670                 {\r
5671                         self::error(_ERROR_NOSUCHPLUGIN);\r
5672                 }\r
5673 \r
5674                 // 1. get old order number\r
5675                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5676                 $o   = sql_fetch_object($res);\r
5677                 $oldOrder = $o->porder;\r
5678 \r
5679                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5680                 $maxOrder = sql_num_rows($res);\r
5681 \r
5682                 // 2. calculate new order number\r
5683                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5684 \r
5685                 // 3. update plug numbers\r
5686                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5687                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5688 \r
5689                 //self::$action_pluginlist();\r
5690                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5691                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5692         }\r
5693         \r
5694         /**\r
5695          * Admin::action_pluginoptions()\r
5696          * \r
5697          * Output Plugin option page\r
5698          * \r
5699          * @access      public\r
5700          * @param       string $message message when fallbacked\r
5701          * @return      void\r
5702          * \r
5703          */\r
5704         static public function action_pluginoptions($message = '')\r
5705         {\r
5706                 global $member, $manager;\r
5707                 \r
5708                 // check if allowed\r
5709                 $member->isAdmin() or self::disallow();\r
5710                 \r
5711 //              $pid = (integer) requestVar('plugid');\r
5712                 $pid = intRequestVar('plugid');\r
5713                 if ( !$manager->pidInstalled($pid) )\r
5714                 {\r
5715                         self::error(_ERROR_NOSUCHPLUGIN);\r
5716                 }\r
5717 \r
5718                 if ( isset($message) )\r
5719                 {\r
5720                         self::$headMess = $message;\r
5721                 }\r
5722                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5723                 self::pagehead($extrahead);\r
5724                 self::$skin->parse('pluginoptions');\r
5725                 self::pagefoot();\r
5726                 return;\r
5727         }\r
5728         \r
5729         /**\r
5730          * Admin::action_pluginoptionsupdate()\r
5731          * \r
5732          * Update plugin options and fallback to plugin option page\r
5733          * \r
5734          * @access      public\r
5735          * @param       void\r
5736          * @return      void\r
5737          */\r
5738         static public function action_pluginoptionsupdate()\r
5739         {\r
5740                 global $member, $manager;\r
5741                 \r
5742                 // check if allowed\r
5743                 $member->isAdmin() or self::disallow();\r
5744                 \r
5745                 $pid = intRequestVar('plugid');\r
5746 //              $pid = (integer) requestVar('plugid');\r
5747                 if ( !$manager->pidInstalled($pid) )\r
5748                 {\r
5749                         self::error(_ERROR_NOSUCHPLUGIN);\r
5750                 }\r
5751                 \r
5752                 $aOptions = requestArray('plugoption');\r
5753                 NucleusPlugin::apply_plugin_options($aOptions);\r
5754 \r
5755                 $manager->notify(\r
5756                         'PostPluginOptionsUpdate',\r
5757                         array(\r
5758                                 'context' => 'global',\r
5759                                 'plugid' => $pid\r
5760                         )\r
5761                 );\r
5762                 \r
5763                 self::$action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5764                 return;\r
5765         }\r
5766         \r
5767         /**\r
5768          * Admin::_insertPluginOptions()\r
5769          * \r
5770          * Output plugin option field\r
5771          * \r
5772          * @access      public\r
5773          * @param string        $context        plugin option context\r
5774          * @param integer       $contextid      plugin option context id\r
5775          * @return      void\r
5776          */\r
5777         static public function _insertPluginOptions($context, $contextid = 0)\r
5778         {\r
5779                 // get all current values for this contextid\r
5780                 // (note: this might contain doubles for overlapping contextids)\r
5781                 $aIdToValue = array();\r
5782                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));\r
5783                 while ( $object = sql_fetch_object($res) )\r
5784                 {\r
5785                         $aIdToValue[$object->oid] = $object->ovalue;\r
5786                 }\r
5787                 \r
5788                 // get list of oids per pid\r
5789                 $query = 'SELECT '\r
5790                            . '    * '\r
5791                            . 'FROM '\r
5792                            .      sql_table('plugin_option_desc') . ', '\r
5793                            .      sql_table('plugin') . ' '\r
5794                            . 'WHERE '\r
5795                            . '    opid     = pid '\r
5796                            . 'and ocontext = "' . sql_real_escape_string($context) . '" '\r
5797                            . 'ORDER BY '\r
5798                            . '    porder, oid ASC';\r
5799                 $res   = sql_query($query);\r
5800                 $aOptions = array();\r
5801                 while ( $object = sql_fetch_object($res) )\r
5802                 {\r
5803                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5804                         {\r
5805                                 $value = $object->odef;\r
5806                         }\r
5807                         else\r
5808                         {\r
5809                                 $value = $aIdToValue[$object->oid];\r
5810                         }\r
5811                         \r
5812                         array_push(\r
5813                                 $aOptions,\r
5814                                 array(\r
5815                                         'pid'                   => $object->pid,\r
5816                                         'pfile'                 => $object->pfile,\r
5817                                         'oid'                   => $object->oid,\r
5818                                         'value'                 => $value,\r
5819                                         'name'                  => $object->oname,\r
5820                                         'description'   => $object->odesc,\r
5821                                         'type'                  => $object->otype,\r
5822                                         'typeinfo'              => $object->oextra,\r
5823                                         'contextid'             => $contextid,\r
5824                                         'extra'                 => ''\r
5825                                 )\r
5826                         );\r
5827                 }\r
5828                 \r
5829                 global $manager;\r
5830                 $manager->notify(\r
5831                         'PrePluginOptionsEdit',\r
5832                         array(\r
5833                                 'context'   =>  $context,\r
5834                                 'contextid' =>  $contextid,\r
5835                                 'options'   =>& $aOptions\r
5836                         )\r
5837                 );\r
5838                 \r
5839                 self::$aOptions = $aOptions;\r
5840                 self::$skin->parse('insertpluginoptions');\r
5841                 return;\r
5842         }\r
5843         \r
5844         /**\r
5845          * Admin::\r
5846          * \r
5847          * @param       void\r
5848          * @return      void\r
5849          */\r
5850         static private function action_parseSpecialskin()\r
5851         {\r
5852                 self::pagehead();\r
5853                 self::$skin->parse(self::$action);\r
5854                 self::pagefoot();\r
5855         }\r
5856         \r
5857         /*\r
5858          * TODO: I guess this method was simply copied from Skin class...\r
5859         static private function parse($type)\r
5860         {\r
5861                 global $manager, $CONF;\r
5862                 \r
5863                 if ( $type == 'pagehead' )\r
5864                 {\r
5865                         $data = array(\r
5866                                 'skin' => &self::$skin,\r
5867                                 'type' => $type\r
5868                         );\r
5869                         \r
5870                         $manager->notify('InitAdminSkinParse', $data);\r
5871                         sendContentType(self::$skin->getContentType(), 'skin', i18n::get_current_charset());\r
5872                 }\r
5873                 \r
5874                 $contents = self::$skin->getContent($type);\r
5875                 \r
5876                 if ( !$contents )\r
5877                 {\r
5878                         echo _ERROR_SKIN;\r
5879                         return;\r
5880                 }\r
5881                 \r
5882                 $actions = self::$skin->getAllowedActionsForType($type);\r
5883                 \r
5884                 if ( $type == 'pagehead' )\r
5885                 {\r
5886                         $data = array(\r
5887                                 'skin'          => &self::$skin,\r
5888                                 'type'          => $type,\r
5889                                 'contents'      => &$contents\r
5890                         );\r
5891                         \r
5892                         $manager->notify('PreAdminSkinParse', $data);\r
5893                 }\r
5894                 \r
5895                 PARSER::setProperty('IncludeMode', self::$skin->getIncludeMode());\r
5896                 PARSER::setProperty('IncludePrefix', self::$skin->getIncludePrefix());\r
5897                 \r
5898                 if ( $type == 'createitem' || $type == 'itemedit' )\r
5899                 {\r
5900                         // TODO: where is this class???\r
5901                         $handler = new Factory(intRequestVar('blogid'), $type, self::$skin, $this);\r
5902                         $actions = array_merge($actions, $handler->actions);\r
5903                 }\r
5904                 else\r
5905                 {\r
5906                         // TODO: why???\r
5907                         $actions = array_merge($actions, self::$skin->getAllowedActionsForType($type));\r
5908                 }\r
5909                 \r
5910                 $parser = new Parser($actions, $handler);\r
5911                 $handler->setParser($parser);\r
5912                 $handler->setSkin(self::$skin);\r
5913                 $parser->parse($contents);\r
5914                 \r
5915                 if ( $type == 'pagefoot' )\r
5916                 {\r
5917                         $data = array(\r
5918                                 'skin'  => &self::$skin,\r
5919                                 'type'  => $type,\r
5920                         );\r
5921                         \r
5922                         $manager->notify('PostAdminSkinParse', $data);\r
5923                 }\r
5924                 return;\r
5925         }\r
5926         */\r
5927         \r
5928         /**\r
5929          * Admin::\r
5930          * \r
5931          * @param       void\r
5932          * @return      void\r
5933          */\r
5934         static private function getAdminskinIDFromName($skinname)\r
5935         {\r
5936                 $query     = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5937                 $admnSknID = quickQuery(sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname)));\r
5938                 return (integer) $adminSkinID;\r
5939         }\r
5940         \r
5941         /**\r
5942          * Admin::\r
5943          * \r
5944          * @param       void\r
5945          * @return      void\r
5946          */\r
5947         static private function getAdminskinNameFromID($skinid)\r
5948         {\r
5949                 $query     = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5950                 $admnSknID = quickQuery(sprintf($query, sql_table('skin_desc'), (integer) $skinid));\r
5951                 return (integer) $adminSkinID;\r
5952         }\r
5953         \r
5954         /**\r
5955          * Admin::\r
5956          * \r
5957          * @param       void\r
5958          * @return      void\r
5959          */\r
5960         static private function action_importAdmin()\r
5961         {\r
5962                 global $DIR_ADMINSKINS, $action;\r
5963                 if ( $action == 'adminskinieimport' )\r
5964                 {\r
5965                         self::_doAdminskinimport();\r
5966                 }\r
5967                 $skn = array();\r
5968                 if ( $action == 'showlogin' )\r
5969                 {\r
5970                         $skinName = 'showlogin';\r
5971                         $actnName = 'showlogin';\r
5972                 }\r
5973                 else\r
5974                 {\r
5975                         $skinName = 'defaultimporter';\r
5976                         $actnName = 'importAdmin';\r
5977                 }\r
5978                 \r
5979                 /* TODO: why??? */\r
5980                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5981                 $skn['id']                              = 0;\r
5982                 $skn['description']             = $skinName;\r
5983                 $skn['contentType']             = 'importAdmin';\r
5984                 $skn['includeMode']             = 'normal';\r
5985                 $skn['includePrefix']   = '';\r
5986                 $skn['name']                    = 'defaultinporter';\r
5987                 \r
5988                 self::$skin                             = (object) $skn;\r
5989                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5990                 $actions = Skin::getAllowedActionsForType($actnName);\r
5991                 \r
5992                 $parser = new PARSER($actions, $handler);\r
5993                 $handler->setParser($parser);\r
5994                 $handler->setSkin(self::$skin);\r
5995                 $parser->parse($contents);\r
5996         }\r
5997         \r
5998         /**\r
5999          * Admin::\r
6000          * \r
6001          * @param       void\r
6002          * @return      void\r
6003          */\r
6004         static private function _doAdminskinimport()\r
6005         {\r
6006                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6007                 \r
6008                 $member->isAdmin() or self::disallow();\r
6009                 \r
6010                 include_once($DIR_LIBS . 'Skinie.php');\r
6011                 $skinFileRaw    = postVar('skinfile');\r
6012                 $mode                   = postVar('mode');\r
6013                 $allowOverwrite = intPostVar('overwrite');\r
6014                 \r
6015                 if ( $mode == 'file' )\r
6016                 {\r
6017                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6018                 }\r
6019                 else\r
6020                 {\r
6021                         $skinFile = $skinFileRaw;\r
6022                 }\r
6023                 \r
6024                 $importer       = new SKINIMPORT();\r
6025                 $error          = $importer->readFile($skinFile);\r
6026                 if ( $error )\r
6027                 {\r
6028                         self::error($error);\r
6029                 }\r
6030                 $error = $importer->writeToDatabase($allowOverwrite);\r
6031                 if ( $error )\r
6032                 {\r
6033                         self::error($error);\r
6034                 }\r
6035                 \r
6036                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6037                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6038                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6039                 \r
6040                 header('Location: ' . $CONF['AdminURL']);\r
6041                 exit;\r
6042         }\r
6043 \r
6044         /**\r
6045          * Returns a link to a weblog\r
6046          * @param object BLOG\r
6047          */\r
6048         static private function bloglink(&$blog) {\r
6049                 return '<a href="'.Entity::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. Entity::hsc( $blog->getName() ) .'</a>';\r
6050         }\r
6051 }\r