nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  *\r
  19  */\r
  20 \r
  21 if ( !function_exists('requestVar') ) exit;\r
  22 require_once dirname(__FILE__) . '/showlist.php';\r
  23 \r
  24 /**\r
  25  * Builds the admin area and executes admin actions\r
  26  */\r
  27 class Admin\r
  28 {\r
  29         private $xml_version_info         = '1.0';\r
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  31         private $system_identifier        = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  32         private $xhtml_namespace          = 'http://www.w3.org/1999/xhtml';\r
  33         \r
  34         /**\r
  35          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)\r
  36          */\r
  37         public $action;\r
  38 \r
  39         /**\r
  40          * @var object $adminSkin\r
  41          */\r
  42         public $adminSkin;\r
  43 \r
  44         /**\r
  45          * @var string $extrahead\r
  46          */\r
  47         public $extrahead;\r
  48 \r
  49         /**\r
  50          * @var bool $passvar\r
  51          */\r
  52         public $passvar;\r
  53 \r
  54         /**\r
  55          * @var string $headMess\r
  56          */\r
  57         public $headMess;\r
  58 \r
  59         public $aOptions;\r
  60 \r
  61         /**\r
  62          * Class constructor\r
  63          */\r
  64         /* function ADMIN() {\r
  65         } */\r
  66         function __construct()\r
  67         {\r
  68                 global $member, $DIR_LIBS;\r
  69                         $query = 'SELECT '\r
  70                                    . '    COUNT(*) as result '\r
  71                                    . 'FROM '\r
  72                                    .      sql_table('adminskin_desc');\r
  73                 if ( !(quickQuery($query)) )\r
  74                 {\r
  75                         $this->action_importAdmin();\r
  76                 }\r
  77                 if ( !isset($adminSkinid) || !($adminSkinid) )\r
  78                 {\r
  79                         $adminSkinid = self::getAdminSkinID();\r
  80                 }\r
  81                 if ( Skin::existsID($adminSkinid) )\r
  82                 {\r
  83                         $this->adminSkin = new Skin($adminSkinid);\r
  84                 }\r
  85                 else\r
  86                 {\r
  87                         $this->adminSkin = 0;\r
  88                 }\r
  89         }\r
  90         \r
  91         static private function getAdminSkinID()\r
  92         {\r
  93                 global $CONF, $member, $manager;\r
  94                 if (isset($member) && $member->isLoggedIn()) {\r
  95                         $memskin = $member->getAdminSkin();\r
  96                         if ($memskin) {\r
  97                                 return $memskin;\r
  98                         }\r
  99                 }\r
 100                 return $CONF['DefaultAdminSkin'];\r
 101         }\r
 102         \r
 103         function getAdminskinEditActions()\r
 104         {\r
 105                 return array(\r
 106                                 'adminskinoverview',\r
 107                                 'adminskinieoverview',\r
 108                                 'adminskinedittype',\r
 109                                 'adminskinremovetype',\r
 110                                 'adminskindelete',\r
 111                                 'adminskinedit',\r
 112                                 'adminskinieimport',\r
 113                                 'adminskiniedoimport',\r
 114                                 'admintemplateedit',\r
 115                                 'admintemplateoverview',\r
 116                                 'admintemplatedelete',\r
 117                 );\r
 118         }\r
 119         \r
 120         function getSkinlessActions()\r
 121         {\r
 122                 return array(\r
 123                                 'plugindeleteconfirm',\r
 124                                 'pluginoptionsupdate',\r
 125                                 'skinremovetypeconfirm',\r
 126                                 'skinclone',\r
 127                                 'skindeleteconfirm',\r
 128                                 'skinnew',\r
 129                                 'skineditgeneral',\r
 130                                 'skinieexport',\r
 131                                 'skinupdate',\r
 132                                 'templateupdate',\r
 133                                 'templatedeleteconfirm',\r
 134                                 'templatenew',\r
 135                                 'templateclone',\r
 136                                 'adminskinremovetypeconfirm',\r
 137                                 'adminskinclone',\r
 138                                 'adminskindeleteconfirm',\r
 139                                 'adminskinnew',\r
 140                                 'adminskineditgeneral',\r
 141                                 'adminskinieexport',\r
 142                                 'adminskinupdate',\r
 143                                 'admintemplateupdate',\r
 144                                 'admintemplatedeleteconfirm',\r
 145                                 'admintemplatenew',\r
 146                                 'admintemplateclone',\r
 147                                 'blogsettingsupdate',\r
 148                                 'settingsupdate',\r
 149                                 'addnewlog2',\r
 150                                 'additem',\r
 151                                 'itemdeleteconfirm',\r
 152                                 'itemupdate',\r
 153                                 'changemembersettings',\r
 154                                 'clearactionlog',\r
 155                                 'memberedit',\r
 156                 );\r
 157         }\r
 158         \r
 159         /**\r
 160          * Executes an action\r
 161          *\r
 162          * @param string $action action to be performed\r
 163          */\r
 164         function action($action)\r
 165         {\r
 166                 global $CONF, $manager;\r
 167                 $f = false;\r
 168                 \r
 169                 // list of action aliases\r
 170                 $alias = array(\r
 171                         'login' => 'overview',\r
 172                         ''      => 'overview'\r
 173                 );\r
 174 \r
 175                 $customAction = postvar('customaction');\r
 176                 if ( !empty($customAction) )\r
 177                 {\r
 178                         $alias = array(\r
 179                                 'login' => $customAction,\r
 180                                 ''      => $customAction\r
 181                         );\r
 182                 }\r
 183                 if ( isset($alias[$action]) )\r
 184                 {\r
 185                         $action = $alias[$action];\r
 186                 }\r
 187                 $methodName = 'action_' . $action;\r
 188 \r
 189                 $this->action = strtolower($action);\r
 190 \r
 191                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action\r
 192                 // is an action that requires user interaction before something is actually done)\r
 193                 // all safe actions are in this array:\r
 194                 $aActionsNotToCheck = array(\r
 195                         'showlogin',\r
 196                         'login',\r
 197                         'overview',\r
 198                         'itemlist',\r
 199                         'blogcommentlist',\r
 200                         'bookmarklet',\r
 201                         'blogsettings',\r
 202                         'banlist',\r
 203                         'deleteblog',\r
 204                         'editmembersettings',\r
 205                         'browseownitems',\r
 206                         'browseowncomments',\r
 207                         'createitem',\r
 208                         'itemedit',\r
 209                         'itemmove',\r
 210                         'categoryedit',\r
 211                         'categorydelete',\r
 212                         'manage',\r
 213                         'actionlog',\r
 214                         'settingsedit',\r
 215                         'backupoverview',\r
 216                         'pluginlist',\r
 217                         'createnewlog',\r
 218                         'usermanagement',\r
 219                         'skinoverview',\r
 220                         'templateoverview',\r
 221                         'skinieoverview',\r
 222                         'itemcommentlist',\r
 223                         'commentedit',\r
 224                         'commentdelete',\r
 225                         'banlistnewfromitem',\r
 226                         'banlistdelete',\r
 227                         'itemdelete',\r
 228                         'manageteam',\r
 229                         'teamdelete',\r
 230                         'banlistnew',\r
 231                         'memberedit',\r
 232                         'memberdelete',\r
 233                         'pluginhelp',\r
 234                         'pluginoptions',\r
 235                         'plugindelete',\r
 236                         'skinedittype',\r
 237                         'skinremovetype',\r
 238                         'skindelete',\r
 239                         'skinedit',\r
 240                         'templateedit',\r
 241                         'templatedelete',\r
 242                         'activate',\r
 243                         'systemoverview',\r
 244             'activatesetpwd',\r
 245                 );\r
 246         $synonimActions = array(\r
 247             'banlistnewfromitem',\r
 248             'memberedit',\r
 249             'login',\r
 250         );\r
 251 /*\r
 252                 // the rest of the actions needs to be checked\r
 253                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');\r
 254 */\r
 255         $adminskinEditActions = $this->getAdminskinEditActions();\r
 256         $skinLessActions      = $this->getSkinlessActions();\r
 257         $allowActions         = array_merge($synonimActions, $this->getSkinlessActions());\r
 258         $aActionsNotToCheck   = array_merge($aActionsNotToCheck, $adminskinEditActions, $allowActions);\r
 259                 if (!in_array($this->action, $aActionsNotToCheck) && !$this->existsSkinContents($action) )\r
 260                 {\r
 261                         if (!$manager->checkTicket())\r
 262                         {\r
 263                                 $this->error(_ERROR_BADTICKET);\r
 264                         }\r
 265                 }\r
 266                 if ( !$this->adminSkin && $CONF['DefaultAdminSkin'] )\r
 267                 {\r
 268                         $this->adminSkin = new Skin($CONF['DefaultAdminSkin']);\r
 269                 }\r
 270         \r
 271                 if ( !method_exists($this, $methodName) && !in_array($this->action, $allowActions) && $this->existsSkinContents($action) )\r
 272                 {\r
 273                         $this->action_parseSpecialskin;\r
 274                         $f = true;\r
 275                 }\r
 276                 elseif ( method_exists($this, $methodName) )\r
 277                 {\r
 278                         call_user_func(array(&$this, $methodName));\r
 279                         $f = true;\r
 280                 }\r
 281                 if ($f) {\r
 282                         exit;\r
 283                 }\r
 284                 $id              = self::getAdminSkinID();\r
 285                 $this->adminSkin = new Skin($id);\r
 286                 if ( $this->adminSkin && $this->existsSkinContents('adminerrorpage') )\r
 287                 {\r
 288                         $this->error(_BADACTION . ENTITY::hsc($action));\r
 289                         $f = true;\r
 290                 }\r
 291                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 292                 {\r
 293                         $this->adminSkin = new Skin($CONF['DefaultAdminSkin']);\r
 294                         if ( $this->adminSkin && $this->existsSkinContents('adminerrorpage') )\r
 295                         {\r
 296                                 $this->error(_BADACTION . ENTITY::hsc($action));\r
 297                                 $f = true;\r
 298                         }\r
 299                 }\r
 300                 if ($f)\r
 301                 {\r
 302                         exit;\r
 303                 }\r
 304                 $this->error(_BADACTION . ENTITY::hsc($action));\r
 305         }\r
 306 \r
 307         /**\r
 308          * Check skin contents\r
 309          *\r
 310          * @param  string action type\r
 311          * @return bool\r
 312          */\r
 313         function existsSkinContents($action)\r
 314         {\r
 315                 $nsActions = $this->getSkinlessActions();\r
 316                         $in_array  = in_array($action, $nsActions);\r
 317                 if ($in_array) {\r
 318                         return $in_array;\r
 319                 } else {\r
 320                         $query = 'SELECT '\r
 321                                    . '    scontent as result '\r
 322                                    . 'FROM '\r
 323                                    .      sql_table('adminskin') . ' '\r
 324                                    . 'WHERE '\r
 325                                    . '    sdesc = %d '\r
 326                                    . 'AND stype = "%s"';\r
 327                         if ( is_object($this->adminSkin) )\r
 328                         {\r
 329                                 return quickQuery(sprintf($query, $this->adminSkin->id, sql_real_escape_string($action)));\r
 330                         }\r
 331                         else\r
 332                         {\r
 333                                 return quickQuery(sprintf($query, 1, sql_real_escape_string($action)));\r
 334                         }\r
 335                 }\r
 336         }\r
 337         \r
 338         /**\r
 339          * Check exists specialskinparts\r
 340          *\r
 341          * @param string action type\r
 342          * @return bool\r
 343          */\r
 344         function specialActionsAllow($action)\r
 345         {\r
 346                 $query = 'SELECT '\r
 347                 . '    sdesc as result '\r
 348                 . 'FROM '\r
 349                 .      sql_table('adminskin') . ' '\r
 350                 . 'WHERE '\r
 351                 . '    sdesc = %d '\r
 352                 . 'AND stype = "%s"';\r
 353                 return quickQuery(sprintf($query, $this->adminSkin->id, sql_real_escape_string($action)));\r
 354         }\r
 355         \r
 356         /**\r
 357          * @todo document this\r
 358          */\r
 359         function action_showlogin()\r
 360         {\r
 361                 global $error;\r
 362                 $this->action_login($error);\r
 363         }\r
 364 \r
 365         /**\r
 366          * @todo document this\r
 367          */\r
 368         function action_login($msg = '', $passvars = 1)\r
 369         {\r
 370                 global $member;\r
 371 \r
 372                 // skip to overview when allowed\r
 373                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 374                 {\r
 375                         $this->action_overview();\r
 376                         exit;\r
 377                 }\r
 378 \r
 379                 $this->passvar = $passvars;\r
 380                 if ( $msg )\r
 381                 {\r
 382                         $this->headMess = $msg;\r
 383                 }\r
 384 \r
 385                 $this->pagehead();\r
 386                 $this->parse('showlogin');\r
 387                 $this->pagefoot();\r
 388         }\r
 389 \r
 390         /**\r
 391          * provides a screen with the overview of the actions available\r
 392          * @todo document parameter\r
 393          */\r
 394         function action_overview($msg = '')\r
 395         {\r
 396                 if ( $msg )\r
 397                 {\r
 398                         $this->headMess = $msg;\r
 399                 }\r
 400 \r
 401                 $this->pagehead();\r
 402                 $this->parse('overview');\r
 403                 $this->pagefoot();\r
 404         }\r
 405 \r
 406         /**\r
 407          * @todo document this\r
 408          */\r
 409         function action_manage($msg = '')\r
 410         {\r
 411                 global $member;\r
 412 \r
 413                 if ( $msg )\r
 414                 {\r
 415                         $this->headMess = $msg;\r
 416                 }\r
 417                 $member->isAdmin() or $this->disallow();\r
 418 \r
 419                 $this->pagehead();\r
 420                 $this->parse('manage');\r
 421                 $this->pagefoot();\r
 422         }\r
 423 \r
 424         /**\r
 425          * @todo document this\r
 426          */\r
 427         function action_itemlist($blogid = '')\r
 428         {\r
 429                 global $member, $manager, $CONF;\r
 430 \r
 431                 if ( $blogid == '' )\r
 432                 {\r
 433                         $blogid = intRequestVar('blogid');\r
 434                 }\r
 435 \r
 436                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
 437 \r
 438                 $this->pagehead();\r
 439                 $this->parse('itemlist');\r
 440                 $this->pagefoot();\r
 441         }\r
 442 \r
 443         /**\r
 444          * @todo document this\r
 445          */\r
 446         function action_batchitem()\r
 447         {\r
 448                 global $member, $manager;\r
 449 \r
 450                 // check if logged in\r
 451                 $member->isLoggedIn() or $this->disallow();\r
 452 \r
 453                 // more precise check will be done for each performed operation\r
 454 \r
 455                 // get array of itemids from request\r
 456                 $selected = requestIntArray('batch');\r
 457                 $action   = requestVar('batchaction');\r
 458 \r
 459                 // Show error when no items were selected\r
 460                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 461                 {\r
 462                         $this->error(_BATCH_NOSELECTION);\r
 463                 }\r
 464 \r
 465                 // On move: when no destination blog/category chosen, show choice now\r
 466                 $destCatid = intRequestVar('destcatid');\r
 467                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 468                 {\r
 469                         $this->batchMoveSelectDestination('item', $selected);\r
 470                 }\r
 471 \r
 472                 // On delete: check if confirmation has been given\r
 473                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 474                 {\r
 475                         $this->batchAskDeleteConfirmation('item',$selected);\r
 476                 }\r
 477 \r
 478                 $this->pagehead();\r
 479                 $this->parse('batchitem');\r
 480                 $this->pagefoot();\r
 481         }\r
 482 \r
 483         /**\r
 484          * @todo document this\r
 485          */\r
 486         function action_batchcomment()\r
 487         {\r
 488                 global $member;\r
 489 \r
 490                 // check if logged in\r
 491                 $member->isLoggedIn() or $this->disallow();\r
 492 \r
 493                 // more precise check will be done for each performed operation\r
 494 \r
 495                 // get array of itemids from request\r
 496                 $selected = requestIntArray('batch');\r
 497                 $action   = requestVar('batchaction');\r
 498 \r
 499                 // Show error when no items were selected\r
 500                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 501                 {\r
 502                         $this->error(_BATCH_NOSELECTION);\r
 503                 }\r
 504 \r
 505                 // On delete: check if confirmation has been given\r
 506                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 507                 {\r
 508                         $this->batchAskDeleteConfirmation('comment',$selected);\r
 509                 }\r
 510 \r
 511                 $this->pagehead();\r
 512                 $this->parse('batchcomment');\r
 513                 $this->pagefoot();\r
 514         }\r
 515 \r
 516         /**\r
 517          * @todo document this\r
 518          */\r
 519         function action_batchmember()\r
 520         {\r
 521                 global $member;\r
 522 \r
 523                 // check if logged in and admin\r
 524                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();\r
 525 \r
 526                 // get array of itemids from request\r
 527                 $selected = requestIntArray('batch');\r
 528                 $action   = requestVar('batchaction');\r
 529 \r
 530                 // Show error when no members selected\r
 531                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 532                 {\r
 533                         $this->error(_BATCH_NOSELECTION);\r
 534                 }\r
 535 \r
 536                 // On delete: check if confirmation has been given\r
 537                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 538                 {\r
 539                         $this->batchAskDeleteConfirmation('member',$selected);\r
 540                 }\r
 541 \r
 542                 $this->pagehead();\r
 543                 $this->parse('batchmember');\r
 544                 $this->pagefoot();\r
 545         }\r
 546 \r
 547         /**\r
 548          * @todo document this\r
 549          */\r
 550         function action_batchteam()\r
 551         {\r
 552                 global $member;\r
 553 \r
 554                 $blogid = intRequestVar('blogid');\r
 555 \r
 556                 // check if logged in and admin\r
 557                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();\r
 558 \r
 559                 // get array of itemids from request\r
 560                 $selected = requestIntArray('batch');\r
 561                 $action   = requestVar('batchaction');\r
 562 \r
 563                 // Show error when no members selected\r
 564                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 565                 {\r
 566                         $this->error(_BATCH_NOSELECTION);\r
 567                 }\r
 568 \r
 569                 // On delete: check if confirmation has been given\r
 570                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 571                 {\r
 572                         $this->batchAskDeleteConfirmation('team',$selected);\r
 573                 }\r
 574 \r
 575                 $this->pagehead();\r
 576                 $this->parse('batchmember');\r
 577                 $this->pagefoot();\r
 578         }\r
 579 \r
 580         /**\r
 581          * @todo document this\r
 582          */\r
 583         function action_batchcategory()\r
 584         {\r
 585                 global $member, $manager;\r
 586 \r
 587                 // check if logged in\r
 588                 $member->isLoggedIn() or $this->disallow();\r
 589 \r
 590                 // more precise check will be done for each performed operation\r
 591 \r
 592                 // get array of itemids from request\r
 593                 $selected = requestIntArray('batch');\r
 594                 $action   = requestVar('batchaction');\r
 595 \r
 596                 // Show error when no items were selected\r
 597                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 598                 {\r
 599                         $this->error(_BATCH_NOSELECTION);\r
 600                 }\r
 601 \r
 602                 // On move: when no destination blog chosen, show choice now\r
 603                 $destBlogId = intRequestVar('destblogid');\r
 604                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 605                 {\r
 606                         $this->batchMoveCategorySelectDestination('category', $selected);\r
 607                 }\r
 608 \r
 609                 // On delete: check if confirmation has been given\r
 610                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 611                 {\r
 612                         $this->batchAskDeleteConfirmation('category', $selected);\r
 613                 }\r
 614 \r
 615                 $this->pagehead();\r
 616                 $this->parse('batchcategory');\r
 617                 $this->pagefoot();\r
 618         }\r
 619 \r
 620         /**\r
 621          * @todo document this\r
 622          */\r
 623         function batchMoveSelectDestination($type, $ids)\r
 624         {\r
 625                 $this->pagehead();\r
 626                 $this->parse('batchmove');\r
 627                 $this->pagefoot();\r
 628                 exit;\r
 629         }\r
 630 \r
 631         /**\r
 632          * @todo document this\r
 633          */\r
 634         function batchMoveCategorySelectDestination($type, $ids)\r
 635         {\r
 636                 global $manager;\r
 637                 $this->pagehead();\r
 638                 $this->parse('batchmovecat');\r
 639                 $this->pagefoot();\r
 640                 exit;\r
 641         }\r
 642 \r
 643         /**\r
 644          * @todo document this\r
 645          */\r
 646         function batchAskDeleteConfirmation($type, $ids)\r
 647         {\r
 648         $this->pagehead();\r
 649         $this->parse('batchdelete');\r
 650         $this->pagefoot();\r
 651                 exit;\r
 652         }\r
 653 \r
 654 \r
 655         /**\r
 656          * Inserts a HTML select element with choices for all categories to which the current\r
 657          * member has access\r
 658          * @see function selectBlog\r
 659          */\r
 660         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 661         {\r
 662                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 663         }\r
 664 \r
 665         /**\r
 666          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 667          *      mode = 'blog' => shows blognames and values are blogids\r
 668          *      mode = 'category' => show category names and values are catids\r
 669          *\r
 670          * @param $iForcedBlogInclude\r
 671          *      ID of a blog that always needs to be included, without checking if the\r
 672          *      member is on the blog team (-1 = none)\r
 673          * @todo document parameters\r
 674          */\r
 675         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 676         {\r
 677                 global $member, $CONF;\r
 678 \r
 679                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 680                 $aBlogIds = array();\r
 681                 if ( $iForcedBlogInclude != -1 )\r
 682                 {\r
 683                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 684                 }\r
 685 \r
 686                 if ( ($member->isAdmin()) && ($CONF['ShowAllBlogs']) )\r
 687                 {\r
 688                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';\r
 689                 }\r
 690                 else\r
 691                 {\r
 692                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();\r
 693                 }\r
 694                 $rblogids = sql_query($queryBlogs);\r
 695                 while ($o = sql_fetch_object($rblogids))\r
 696                 {\r
 697                         if ( $o->bnumber != $iForcedBlogInclude )\r
 698                         {\r
 699                                 $aBlogIds[] = intval($o->bnumber);\r
 700                         }\r
 701                 }\r
 702 \r
 703                 if ( count($aBlogIds) == 0 )\r
 704                 {\r
 705                         return;\r
 706                 }\r
 707 \r
 708                 $_REQUEST['selectData'] = array(\r
 709                         'name'       => $name,\r
 710                         'tabindex'   => $tabindex,\r
 711                         'mode'       => $mode,\r
 712                         'selected'   => $selected,\r
 713                         'showNewCat' => $showNewCat,\r
 714                         'aBlogIds'   => $aBlogIds,\r
 715                 );\r
 716                 $this->parse('blogselectbox');\r
 717         }\r
 718 \r
 719         /**\r
 720          * @todo document this\r
 721          */\r
 722         function action_browseownitems() {\r
 723                 global $member, $manager, $CONF;\r
 724 \r
 725                 $this->pagehead();\r
 726                 $this->parse('browseownitems');\r
 727                 $this->pagefoot();\r
 728         }\r
 729 \r
 730         /**\r
 731          * Show all the comments for a given item\r
 732          * @param int $itemid\r
 733          */\r
 734         function action_itemcommentlist($itemid = '') {\r
 735                 global $member, $manager, $CONF;\r
 736 \r
 737                 if ( $itemid == '' )\r
 738                 {\r
 739                         $itemid = intRequestVar('itemid');\r
 740                 }\r
 741                 $_REQUEST['itemid'] = $itemid;\r
 742                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 743                 \r
 744                 // only allow if user is allowed to alter item\r
 745                 $member->canAlterItem($itemid) or $this->disallow();\r
 746 \r
 747                 $blogid = getBlogIdFromItemId($itemid);\r
 748 \r
 749                 $this->pagehead();\r
 750                 $this->parse('itemcommentlist');\r
 751                 $this->pagefoot();\r
 752         }\r
 753 \r
 754         /**\r
 755          * Browse own comments\r
 756          */\r
 757         function action_browseowncomments() {\r
 758                 $this->pagehead();\r
 759                 $this->parse('browseowncomments');\r
 760                 $this->pagefoot();\r
 761         }\r
 762 \r
 763         /**\r
 764          * Browse all comments for a weblog\r
 765          * @param int $blogid\r
 766          */\r
 767         function action_blogcommentlist($blogid = '')\r
 768         {\r
 769                 global $member, $manager, $CONF;\r
 770 \r
 771                 if ( $blogid == '' )\r
 772                 {\r
 773                         $blogid = intRequestVar('blogid');\r
 774                 }\r
 775                 else\r
 776                 {\r
 777                         $blogid = intval($blogid);\r
 778                 }\r
 779 \r
 780                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();\r
 781 \r
 782                 $_REQUEST['blogid'] = $blogid;\r
 783 \r
 784                 $this->pagehead();\r
 785                 $this->parse('blogcommentlist');\r
 786                 $this->pagefoot();\r
 787         }\r
 788 \r
 789         /**\r
 790          * Provide a page to item a new item to the given blog\r
 791          */\r
 792         function action_createitem()\r
 793         {\r
 794                 global $member, $manager;\r
 795 \r
 796                 $blogid = intRequestVar('blogid');\r
 797 \r
 798                 // check if allowed\r
 799                 $member->teamRights($blogid) or $this->disallow();\r
 800 \r
 801                 $memberid = $member->getID();\r
 802 \r
 803                 $blog =& $manager->getBlog($blogid);\r
 804 \r
 805                 $this->pagehead();\r
 806                 $this->parse('createitem');\r
 807                 $this->pagefoot();\r
 808         }\r
 809 \r
 810         /**\r
 811          * @todo document this\r
 812          */\r
 813         function action_itemedit()\r
 814         {\r
 815                 global $member, $manager;\r
 816 \r
 817                 $itemid = intRequestVar('itemid');\r
 818 \r
 819                 // only allow if user is allowed to alter item\r
 820                 $member->canAlterItem($itemid) or $this->disallow();\r
 821 \r
 822                 $item =& $manager->getItem($itemid, 1, 1);\r
 823                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
 824                 $this->pagehead();\r
 825                 $this->parse('itemedit');\r
 826                 $this->pagefoot();\r
 827         }\r
 828 \r
 829         /**\r
 830          * @todo document this\r
 831          */\r
 832         function action_itemupdate()\r
 833         {\r
 834                 global $member, $manager, $CONF;\r
 835 \r
 836                 $itemid = intRequestVar('itemid');\r
 837                 $catid  = postVar('catid');\r
 838 \r
 839                 // only allow if user is allowed to alter item\r
 840                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
 841 \r
 842                 $actiontype = postVar('actiontype');\r
 843 \r
 844                 // delete actions are handled by itemdelete (which has confirmation)\r
 845                 if ( $actiontype == 'delete' )\r
 846                 {\r
 847                         $this->action_itemdelete();\r
 848                         return;\r
 849                 }\r
 850 \r
 851                 $body    = postVar('body');\r
 852                 $title   = postVar('title');\r
 853                 $more    = postVar('more');\r
 854                 $closed  = intPostVar('closed');\r
 855                 $draftid = intPostVar('draftid');\r
 856 \r
 857                 // default action = add now\r
 858                 if ( !$actiontype )\r
 859                 {\r
 860                         $actiontype='addnow';\r
 861                 }\r
 862 \r
 863                 // create new category if needed\r
 864                 if ( strstr($catid,'newcat') )\r
 865                 {\r
 866                         // get blogid\r
 867                         list($blogid) = sscanf($catid,"newcat-%d");\r
 868 \r
 869                         // create\r
 870                         $blog =& $manager->getBlog($blogid);\r
 871                         $catid = $blog->createNewCategory();\r
 872 \r
 873                         // show error when sth goes wrong\r
 874                         if ( !$catid )\r
 875                         {\r
 876                                 $this->doError(_ERROR_CATCREATEFAIL);\r
 877                         }\r
 878                 }\r
 879 \r
 880                 /*\r
 881                         set some variables based on actiontype\r
 882 \r
 883                         actiontypes:\r
 884                                 draft items -> addnow, addfuture, adddraft, delete\r
 885                                 non-draft items -> edit, changedate, delete\r
 886 \r
 887                         variables set:\r
 888                                 $timestamp: set to a nonzero value for future dates or date changes\r
 889                                 $wasdraft: set to 1 when the item used to be a draft item\r
 890                                 $publish: set to 1 when the edited item is not a draft\r
 891          */\r
 892                 $blogid =  getBlogIDFromItemID($itemid);\r
 893                 $blog   =& $manager->getBlog($blogid);\r
 894 \r
 895                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 896                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 897                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 898                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 899                 {\r
 900                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 901                 }\r
 902                 else\r
 903                 {\r
 904                         $timestamp =0;\r
 905                 }\r
 906 \r
 907                 // edit the item for real\r
 908                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 909 \r
 910                 $this->updateFuturePosted($blogid);\r
 911 \r
 912                 if ( $draftid > 0 )\r
 913                 {\r
 914                         // delete permission is checked inside Item::delete()\r
 915                         Item::delete($draftid);\r
 916                 }\r
 917 \r
 918                 // show category edit window when we created a new category\r
 919                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')\r
 920                 if ( $catid != intPostVar('catid') )\r
 921                 {\r
 922                         $this->action_categoryedit(\r
 923                                 $catid,\r
 924                                 $blog->getID(),\r
 925                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 926                         );\r
 927                 }\r
 928                 else\r
 929                 {\r
 930                         // TODO: set start item correctly for itemlist\r
 931                         $item = Item::getItem($itemid, 0, 0);\r
 932                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 933                         $_REQUEST['start'] = $cnt + 1;\r
 934                         $this->action_itemlist(getBlogIDFromItemID($itemid));\r
 935                 }\r
 936         }\r
 937         \r
 938         /**\r
 939          * Admin::action_itemdelete()\r
 940          * Delete item\r
 941          * \r
 942          * @param       Void\r
 943          * @return      Void\r
 944          */\r
 945         function action_itemdelete()\r
 946         {\r
 947                 global $member, $manager;\r
 948                 \r
 949                 $itemid = intRequestVar('itemid');\r
 950                 \r
 951                 // only allow if user is allowed to alter item\r
 952                 $member->canAlterItem($itemid) or $this->disallow();\r
 953                 \r
 954                 if ( !$manager->existsItem($itemid,1,1) )\r
 955                 {\r
 956                         $this->error(_ERROR_NOSUCHITEM);\r
 957                 }\r
 958                 \r
 959                 $this->pagehead();\r
 960                 $this->parse('itemdelete');\r
 961                 $this->pagefoot();\r
 962                 return;\r
 963         }\r
 964         \r
 965         /**\r
 966          * @todo document this\r
 967          */\r
 968         function action_itemdeleteconfirm()\r
 969         {\r
 970                 global $member;\r
 971 \r
 972                 $itemid = intRequestVar('itemid');\r
 973 \r
 974                 // only allow if user is allowed to alter item\r
 975                 $member->canAlterItem($itemid) or $this->disallow();\r
 976 \r
 977                 // get blogid first\r
 978                 $blogid = getBlogIdFromItemId($itemid);\r
 979 \r
 980                 // delete item (note: some checks will be performed twice)\r
 981                 $this->deleteOneItem($itemid);\r
 982 \r
 983                 $this->action_itemlist($blogid);\r
 984         }\r
 985 \r
 986         /**\r
 987          * Deletes one item and returns error if something goes wrong\r
 988          * @param int $itemid\r
 989          */\r
 990         function deleteOneItem($itemid)\r
 991         {\r
 992                 global $member, $manager;\r
 993 \r
 994                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
 995                 if ( !$member->canAlterItem($itemid) )\r
 996                 {\r
 997                         return _ERROR_DISALLOWED;\r
 998                 }\r
 999 \r
1000                 // need to get blogid before the item is deleted\r
1001                 $blogid = getBlogIDFromItemId($itemid);\r
1002 \r
1003                 $manager->loadClass('ITEM');\r
1004                 Item::delete($itemid);\r
1005 \r
1006                 // update blog's futureposted\r
1007                 $this->updateFuturePosted($blogid);\r
1008         }\r
1009 \r
1010         /**\r
1011          * Admin::updateFuturePosted()\r
1012          * Update a blog's future posted flag\r
1013          * \r
1014          * @param integer $blogid\r
1015          * @return      void\r
1016          * \r
1017          */\r
1018         function updateFuturePosted($blogid)\r
1019         {\r
1020                 global $manager;\r
1021                 \r
1022                 $blogid      =  intval($blogid);\r
1023                 $blog        =& $manager->getBlog($blogid);\r
1024                 $currenttime =  $blog->getCorrectTime(time());\r
1025                 \r
1026                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1027                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1028                 $result = sql_query($query);\r
1029                 \r
1030                 if ( sql_num_rows($result) > 0 )\r
1031                 {\r
1032                                 $blog->setFuturePost();\r
1033                 }\r
1034                 else\r
1035                 {\r
1036                                 $blog->clearFuturePost();\r
1037                 }\r
1038                 return;\r
1039         }\r
1040 \r
1041         /**\r
1042          * @todo document this\r
1043          */\r
1044         function action_itemmove()\r
1045         {\r
1046                 global $member, $manager;\r
1047 \r
1048                 $itemid = intRequestVar('itemid');\r
1049 \r
1050                 // only allow if user is allowed to alter item\r
1051                 $member->canAlterItem($itemid) or $this->disallow();\r
1052 \r
1053                 $this->pagehead();\r
1054                 $this->parse('itemmove');\r
1055                 $this->pagefoot();\r
1056         }\r
1057 \r
1058         /**\r
1059          * @todo document this\r
1060          */\r
1061         function action_itemmoveto()\r
1062         {\r
1063                 global $member, $manager;\r
1064 \r
1065                 $itemid = intRequestVar('itemid');\r
1066                 $catid = requestVar('catid');\r
1067 \r
1068                 // create new category if needed\r
1069                 if ( strstr($catid,'newcat') )\r
1070                 {\r
1071                         // get blogid\r
1072                         list($blogid) = sscanf($catid,'newcat-%d');\r
1073 \r
1074                         // create\r
1075                         $blog =& $manager->getBlog($blogid);\r
1076                         $catid = $blog->createNewCategory();\r
1077 \r
1078                         // show error when sth goes wrong\r
1079                         if ( !$catid )\r
1080                         {\r
1081                                 $this->doError(_ERROR_CATCREATEFAIL);\r
1082                         }\r
1083                 }\r
1084 \r
1085                 // only allow if user is allowed to alter item\r
1086                 $member->canUpdateItem($itemid, $catid) or $this->disallow();\r
1087 \r
1088                 $old_blogid = getBlogIDFromItemId($itemid);\r
1089 \r
1090                 Item::move($itemid, $catid);\r
1091 \r
1092                 // set the futurePosted flag on the blog\r
1093                 $this->updateFuturePosted(getBlogIDFromItemId($itemid));\r
1094 \r
1095                 // reset the futurePosted in case the item is moved from one blog to another\r
1096                 $this->updateFuturePosted($old_blogid);\r
1097 \r
1098                 if ( $catid != intRequestVar('catid') )\r
1099                 {\r
1100                         $this->action_categoryedit($catid, $blog->getID());\r
1101                 }\r
1102                 else\r
1103                 {\r
1104                         $this->action_itemlist(getBlogIDFromCatID($catid));\r
1105                 }\r
1106         }\r
1107 \r
1108         /**\r
1109          * Moves one item to a given category (category existance should be checked by caller)\r
1110          * errors are returned\r
1111          * @param int $itemid\r
1112          * @param int $destCatid category ID to which the item will be moved\r
1113          */\r
1114         function moveOneItem($itemid, $destCatid)\r
1115         {\r
1116                 global $member;\r
1117 \r
1118                 // only allow if user is allowed to move item\r
1119                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1120                 {\r
1121                         return _ERROR_DISALLOWED;\r
1122                 }\r
1123 \r
1124                 Item::move($itemid, $destCatid);\r
1125         }\r
1126 \r
1127         /**\r
1128          * Adds a item to the chosen blog\r
1129          */\r
1130         function action_additem()\r
1131         {\r
1132                 global $manager, $CONF;\r
1133 \r
1134                 $manager->loadClass('ITEM');\r
1135 \r
1136                 $result = Item::createFromRequest();\r
1137 \r
1138                 if ( $result['status'] == 'error' )\r
1139                 {\r
1140                         $this->error($result['message']);\r
1141                 }\r
1142 \r
1143                 $blogid     =  getBlogIDFromItemID($result['itemid']);\r
1144                 $blog       =& $manager->getBlog($blogid);\r
1145                 $btimestamp =  $blog->getCorrectTime();\r
1146                 $item       =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1147 \r
1148                 if ( $result['status'] == 'newcategory' )\r
1149                 {\r
1150                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1151                         $this->action_categoryedit($result['catid'], $blogid, $distURI);\r
1152                 }\r
1153                 else\r
1154                 {\r
1155                         $methodName = 'action_itemList';\r
1156                         call_user_func(array(&$this, $methodName), $blogid);\r
1157                 }\r
1158         }\r
1159 \r
1160         /**\r
1161          * Allows to edit previously made comments\r
1162          **/\r
1163         function action_commentedit()\r
1164         {\r
1165 \r
1166                 global $member, $manager;\r
1167 \r
1168                 $commentid = intRequestVar('commentid');\r
1169 \r
1170                 $member->canAlterComment($commentid) or $this->disallow();\r
1171 \r
1172                 $this->pagehead();\r
1173                 $this->parse('commentedit');\r
1174                 $this->pagefoot();\r
1175         }\r
1176 \r
1177         /**\r
1178          * @todo document this\r
1179          */\r
1180         function action_commentupdate()\r
1181         {\r
1182                 global $member, $manager;\r
1183 \r
1184                 $commentid = intRequestVar('commentid');\r
1185 \r
1186                 $member->canAlterComment($commentid) or $this->disallow();\r
1187 \r
1188                 $url   = postVar('url');\r
1189                 $email = postVar('email');\r
1190                 $body  = postVar('body');\r
1191 \r
1192                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1193                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE\r
1194                 # important note that '\' must be matched with '\\\\' in preg* expressions\r
1195 \r
1196                 // intercept words that are too long\r
1197                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1198                 {\r
1199                         $this->error(_ERROR_COMMENT_LONGWORD);\r
1200                 }\r
1201 \r
1202                 // check length\r
1203                 if ( i18n::strlen($body) < 3 )\r
1204                 {\r
1205                         $this->error(_ERROR_COMMENT_NOCOMMENT);\r
1206                 }\r
1207 \r
1208                 if ( i18n::strlen($body) > 5000 )\r
1209                 {\r
1210                         $this->error(_ERROR_COMMENT_TOOLONG);\r
1211                 }\r
1212 \r
1213                 // prepare body\r
1214                 $body = Comment::prepareBody($body);\r
1215 \r
1216                 // call plugins\r
1217                 $manager->notify(\r
1218                         'PreUpdateComment',\r
1219                         array(\r
1220                                         'body' => &$body\r
1221                         )\r
1222                 );\r
1223 \r
1224                 $query = 'UPDATE ' . sql_table('comment')\r
1225                            . " SET "\r
1226                            . "    cmail   = '" . sql_real_escape_string($url) . "',"\r
1227                            . "    cemail  = '" . sql_real_escape_string($email) . "',"\r
1228                            . "    cbody   = '" . sql_real_escape_string($body) . "'"\r
1229                            . " WHERE "\r
1230                            . "    cnumber = " . $commentid;\r
1231                 sql_query($query);\r
1232 \r
1233                 // get itemid\r
1234                 $res    = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);\r
1235                 $o      = sql_fetch_object($res);\r
1236                 $itemid = $o->citem;\r
1237 \r
1238                 if ( $member->canAlterItem($itemid) )\r
1239                 {\r
1240                         $this->action_itemcommentlist($itemid);\r
1241                 }\r
1242                 else\r
1243                 {\r
1244                         $this->action_browseowncomments();\r
1245                 }\r
1246         }\r
1247         \r
1248         /**\r
1249          * Admin::action_commentdelete()\r
1250          * Update comment\r
1251          * \r
1252          * @param       Void\r
1253          * @return      Void\r
1254          */\r
1255         function action_commentdelete()\r
1256         {\r
1257                 global $member, $manager;\r
1258                 \r
1259                 $commentid = intRequestVar('commentid');\r
1260                 $member->canAlterComment($commentid) or $this->disallow();\r
1261 \r
1262                 $this->pagehead();\r
1263                 $this->parse('commentdelete');\r
1264                 $this->pagefoot();\r
1265                 return;\r
1266         }\r
1267         \r
1268         /**\r
1269          * @todo document this\r
1270          */\r
1271         function action_commentdeleteconfirm()\r
1272         {\r
1273                 global $member;\r
1274 \r
1275                 $commentid = intRequestVar('commentid');\r
1276 \r
1277                 // get item id first\r
1278                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);\r
1279                 $o = sql_fetch_object($res);\r
1280                 $itemid = $o->citem;\r
1281 \r
1282                 $error = $this->deleteOneComment($commentid);\r
1283                 if ( $error )\r
1284                 {\r
1285                         $this->doError($error);\r
1286                 }\r
1287 \r
1288                 if ( $member->canAlterItem($itemid) )\r
1289                 {\r
1290                         $this->action_itemcommentlist($itemid);\r
1291                 }\r
1292                 else\r
1293                 {\r
1294                         $this->action_browseowncomments();\r
1295                 }\r
1296         }\r
1297 \r
1298         /**\r
1299          * @todo document this\r
1300          */\r
1301         function deleteOneComment($commentid) {\r
1302                 global $member, $manager;\r
1303 \r
1304                 $commentid = intval($commentid);\r
1305 \r
1306                 if ( !$member->canAlterComment($commentid) )\r
1307                 {\r
1308                         return _ERROR_DISALLOWED;\r
1309                 }\r
1310 \r
1311                 $manager->notify(\r
1312                         'PreDeleteComment',\r
1313                         array(\r
1314                                 'commentid' => $commentid\r
1315                         )\r
1316                 );\r
1317 \r
1318                 // delete the comments associated with the item\r
1319                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cnumber=' . $commentid;\r
1320                 sql_query($query);\r
1321 \r
1322                 $manager->notify(\r
1323                         'PostDeleteComment',\r
1324                         array(\r
1325                                 'commentid' => $commentid\r
1326                         )\r
1327                 );\r
1328 \r
1329                 return '';\r
1330         }\r
1331 \r
1332         /**\r
1333          * Usermanagement main\r
1334          */\r
1335         function action_usermanagement()\r
1336         {\r
1337                 global $member, $manager;\r
1338 \r
1339                 // check if allowed\r
1340                 $member->isAdmin() or $this->disallow();\r
1341 \r
1342                 $this->pagehead();\r
1343                 $this->parse('usermanagement');\r
1344                 $this->pagefoot();\r
1345         }\r
1346 \r
1347         /**\r
1348          * Edit member settings\r
1349          */\r
1350         function action_memberedit()\r
1351         {\r
1352                 $this->action_editmembersettings(intRequestVar('memberid'));\r
1353         }\r
1354 \r
1355         /**\r
1356          * @todo document this\r
1357          */\r
1358         function action_editmembersettings($memberid = '') {\r
1359                 global $member, $manager, $CONF;\r
1360                 \r
1361                 if ( $memberid == '' )\r
1362                 {\r
1363                         $memberid = $member->getID();\r
1364                 }\r
1365                 $_REQUEST['memberid'] = $memberid;\r
1366 \r
1367                 // check if allowed\r
1368                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1369                 \r
1370                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1371                 $this->pagehead($extrahead);\r
1372                 $this->parse('editmembersettings');\r
1373                 $this->pagefoot();\r
1374         }\r
1375         \r
1376         /**\r
1377          * @todo document this\r
1378          */\r
1379         function action_changemembersettings() {\r
1380                 global $member, $CONF, $manager;\r
1381 \r
1382                 $memberid = intRequestVar('memberid');\r
1383 \r
1384                 // check if allowed\r
1385                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
1386 \r
1387                 $name           = trim(strip_tags(postVar('name')));\r
1388                 $realname       = trim(strip_tags(postVar('realname')));\r
1389                 $password       = postVar('password');\r
1390                 $repeatpassword = postVar('repeatpassword');\r
1391                 $email          = strip_tags(postVar('email'));\r
1392                 $url            = strip_tags(postVar('url'));\r
1393                 $adminskin      = intPostVar('adminskin');\r
1394                 \r
1395                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0\r
1396                 # original eregi: !eregi("^https?://", $url)\r
1397 \r
1398                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1399                 if ( !preg_match('#^https?://#', $url) )\r
1400                 {\r
1401                         $url = 'http://' . $url;\r
1402                 }\r
1403 \r
1404                 $admin          = postVar('admin');\r
1405                 $canlogin       = postVar('canlogin');\r
1406                 $notes          = strip_tags(postVar('notes'));\r
1407                 $locale         = postVar('locale');\r
1408 \r
1409                 $mem = Member::createFromID($memberid);\r
1410 \r
1411                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {\r
1412 \r
1413                         if ( !isValidDisplayName($name) )\r
1414                         {\r
1415                                 $this->error(_ERROR_BADNAME);\r
1416                         }\r
1417 \r
1418                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1419                         {\r
1420                                 $this->error(_ERROR_NICKNAMEINUSE);\r
1421                         }\r
1422 \r
1423                         if ( $password != $repeatpassword )\r
1424                         {\r
1425                                 $this->error(_ERROR_PASSWORDMISMATCH);\r
1426                         }\r
1427 \r
1428                         if ( $password && (i18n::strlen($password) < 6) )\r
1429                         {\r
1430                                 $this->error(_ERROR_PASSWORDTOOSHORT);\r
1431                         }\r
1432                                 \r
1433                         if ( $password )\r
1434                         {\r
1435                                 $pwdvalid = true;\r
1436                                 $pwderror = '';\r
1437                                 $manager->notify(\r
1438                                         'PrePasswordSet',\r
1439                                         array(\r
1440                                                 'password'     => $password,\r
1441                                                 'errormessage' => &$pwderror,\r
1442                                                 'valid'        => &$pwdvalid\r
1443                                         )\r
1444                                 );\r
1445                                 if ( !$pwdvalid )\r
1446                                 {\r
1447                                         $this->error($pwderror);\r
1448                                 }\r
1449                         }\r
1450                 }\r
1451                 \r
1452                 if ( !NOTIFICATION::address_validation($email) )\r
1453                 {\r
1454                         $this->error(_ERROR_BADMAILADDRESS);\r
1455                 }\r
1456                 if ( !$realname )\r
1457                 {\r
1458                         $this->error(_ERROR_REALNAMEMISSING);\r
1459                 }\r
1460                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1461                 {\r
1462                         $this->error(_ERROR_NOSUCHTRANSLATION);\r
1463                 }\r
1464 \r
1465                 // check if there will remain at least one site member with both the logon and admin rights\r
1466                 // (check occurs when taking away one of these rights from such a member)\r
1467                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1468                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1469                         )\r
1470                 {\r
1471                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1472                         if ( sql_num_rows($r) < 2 )\r
1473                         {\r
1474                                 $this->error(_ERROR_ATLEASTONEADMIN);\r
1475                         }\r
1476                 }\r
1477 \r
1478                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1479                 {\r
1480                         $mem->setDisplayName($name);\r
1481                         if ( $password )\r
1482                         {\r
1483                                 $mem->setPassword($password);\r
1484                         }\r
1485                 }\r
1486 \r
1487                 $oldEmail = $mem->getEmail();\r
1488 \r
1489                 $mem->setRealName($realname);\r
1490                 $mem->setEmail($email);\r
1491                 $mem->setURL($url);\r
1492                 $mem->setNotes($notes);\r
1493                 $mem->setLocale($locale);\r
1494 \r
1495 \r
1496                 // only allow super-admins to make changes to the admin status\r
1497                 if ( $member->isAdmin() )\r
1498                 {\r
1499                         $mem->setAdmin($admin);\r
1500                         $mem->setCanLogin($canlogin);\r
1501                 }\r
1502 \r
1503                 $autosave = postVar('autosave');\r
1504                 $mem->setAutosave($autosave);\r
1505 \r
1506                 $mem->write();\r
1507 \r
1508                 // store plugin options\r
1509                 $aOptions = requestArray('plugoption');\r
1510                 NucleusPlugin::apply_plugin_options($aOptions);\r
1511                 $manager->notify(\r
1512                         'PostPluginOptionsUpdate',\r
1513                         array(\r
1514                                 'context'  => 'member',\r
1515                                 'memberid' => $memberid,\r
1516                                 'member'   => &$mem\r
1517                         )\r
1518                 );\r
1519 \r
1520                 // if email changed, generate new password\r
1521                 if ( $oldEmail != $mem->getEmail() )\r
1522                 {\r
1523                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1524                         // logout member\r
1525                         $mem->newCookieKey();\r
1526 \r
1527                         // only log out if the member being edited is the current member.\r
1528                         if ( $member->getID() == $memberid )\r
1529                         {\r
1530                                 $member->logout();\r
1531                         }\r
1532                         $this->action_login(_MSG_ACTIVATION_SENT, 0);\r
1533                         return;\r
1534                 }\r
1535 \r
1536 \r
1537                 if (    ( $mem->getID() == $member->getID() )\r
1538                         &&      ( $mem->getDisplayName() != $member->getDisplayName() )\r
1539                         )\r
1540                 {\r
1541                         $mem->newCookieKey();\r
1542                         $member->logout();\r
1543                         $this->action_login(_MSG_LOGINAGAIN, 0);\r
1544                 }\r
1545                 else\r
1546                 {\r
1547                         $this->action_overview(_MSG_SETTINGSCHANGED);\r
1548                 }\r
1549         }\r
1550 \r
1551         /**\r
1552          * Admin::action_memberadd()\r
1553          * \r
1554          * @param       void\r
1555          * @return      void\r
1556          * \r
1557         */\r
1558         function action_memberadd()\r
1559         {\r
1560                 global $member, $manager;\r
1561                 \r
1562                 // check if allowed\r
1563                 $member->isAdmin() or $this->disallow();\r
1564                 \r
1565                 if ( postVar('password') != postVar('repeatpassword') )\r
1566                 {\r
1567                         $this->error(_ERROR_PASSWORDMISMATCH);\r
1568                 }\r
1569                 \r
1570                 if ( i18n::strlen(postVar('password')) < 6 )\r
1571                 {\r
1572                         $this->error(_ERROR_PASSWORDTOOSHORT);\r
1573                 }\r
1574                 \r
1575                 $res = Member::create(\r
1576                                         postVar('name'),\r
1577                                         postVar('realname'),\r
1578                                         postVar('password'),\r
1579                                         postVar('email'),\r
1580                                         postVar('url'),\r
1581                                         postVar('admin'),\r
1582                                         postVar('canlogin'),\r
1583                                         postVar('notes')\r
1584                                 );\r
1585                 if ( $res != 1 )\r
1586                 {\r
1587                         $this->error($res);\r
1588                 }\r
1589                 \r
1590                 // fire PostRegister event\r
1591                 $newmem = new Member();\r
1592                 $newmem->readFromName(postVar('name'));\r
1593                 $manager->notify(\r
1594                         'PostRegister',\r
1595                         array(\r
1596                                 'member' => &$newmem\r
1597                         )\r
1598                 );\r
1599                 \r
1600                 $this->action_usermanagement();\r
1601                 return;\r
1602         }\r
1603 \r
1604         /**\r
1605          * Account activation\r
1606          *\r
1607          * @author dekarma\r
1608          */\r
1609         function action_activate()\r
1610         {\r
1611 \r
1612                 $key = getVar('key');\r
1613                 $this->_showActivationPage($key);\r
1614         }\r
1615 \r
1616         /**\r
1617          * @todo document this\r
1618          */\r
1619         function _showActivationPage($key, $message = '')\r
1620         {\r
1621                 global $manager;\r
1622 \r
1623                 // clean up old activation keys\r
1624                 Member::cleanupActivationTable();\r
1625 \r
1626                 // get activation info\r
1627                 $info = Member::getActivationInfo($key);\r
1628 \r
1629                 if ( !$info )\r
1630                 {\r
1631                         $this->error(_ERROR_ACTIVATE);\r
1632                 }\r
1633 \r
1634                 $mem = Member::createFromId($info->vmember);\r
1635 \r
1636                 if ( !$mem )\r
1637                 {\r
1638                         $this->error(_ERROR_ACTIVATE);\r
1639                 }\r
1640                 $_POST['ackey']                = $key;\r
1641                 $this->headMess                = $message;\r
1642                 $_POST['bNeedsPasswordChange'] = true;\r
1643                 $this->pagehead();\r
1644                 $this->parse('activate');\r
1645                 $this->pagefoot();\r
1646 \r
1647         }\r
1648 \r
1649         /**\r
1650          * Account activation - set password part\r
1651          *\r
1652          * @author dekarma\r
1653          */\r
1654         function action_activatesetpwd()\r
1655         {\r
1656 \r
1657                 $key = postVar('key');\r
1658 \r
1659                 // clean up old activation keys\r
1660                 Member::cleanupActivationTable();\r
1661 \r
1662                 // get activation info\r
1663                 $info = Member::getActivationInfo($key);\r
1664 \r
1665                 if ( !$info || ($info->type == 'addresschange') )\r
1666                 {\r
1667                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
1668                 }\r
1669 \r
1670                 $mem = Member::createFromId($info->vmember);\r
1671 \r
1672                 if ( !$mem )\r
1673                 {\r
1674                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);\r
1675                 }\r
1676 \r
1677                 $password       = postVar('password');\r
1678                 $repeatpassword = postVar('repeatpassword');\r
1679 \r
1680                 if ( $password != $repeatpassword )\r
1681                 {\r
1682                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1683                 }\r
1684 \r
1685                 if ( $password && (i18n::strlen($password) < 6) )\r
1686                 {\r
1687                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1688                 }\r
1689                         \r
1690                 if ( $password )\r
1691                 {\r
1692                         $pwdvalid = true;\r
1693                         $pwderror = '';\r
1694                         global $manager;\r
1695                         $manager->notify(\r
1696                                 'PrePasswordSet',\r
1697                                 array(\r
1698                                         'password'     => $password,\r
1699                                         'errormessage' => &$pwderror,\r
1700                                         'valid'        => &$pwdvalid\r
1701                                 )\r
1702                         );\r
1703                         if ( !$pwdvalid )\r
1704                         {\r
1705                                 return $this->_showActivationPage($key,$pwderror);\r
1706                         }\r
1707                 }\r
1708 \r
1709                 $error = '';\r
1710                 \r
1711                 $manager->notify(\r
1712                         'ValidateForm',\r
1713                         array(\r
1714                                 'type'   => 'activation',\r
1715                                 'member' => $mem,\r
1716                                 'error'  => &$error\r
1717                         )\r
1718                 );\r
1719                 if ( $error != '' )\r
1720                 {\r
1721                         return $this->_showActivationPage($key, $error);\r
1722                 }\r
1723 \r
1724 \r
1725                 // set password\r
1726                 $mem->setPassword($password);\r
1727                 $mem->write();\r
1728 \r
1729                 // do the activation\r
1730                 Member::activate($key);\r
1731 \r
1732                 $this->pagehead();\r
1733                 $this->parse('activatesetpwd');\r
1734                 $this->pagefoot();\r
1735         }\r
1736 \r
1737         /**\r
1738          * Manage team\r
1739          */\r
1740         function action_manageteam()\r
1741         {\r
1742                 global $member, $manager;\r
1743 \r
1744                 $blogid = intRequestVar('blogid');\r
1745 \r
1746                 // check if allowed\r
1747                 $member->blogAdminRights($blogid) or $this->disallow();\r
1748 \r
1749                 $this->pagehead();\r
1750                 $this->parse('manageteam');\r
1751                 $this->pagefoot();\r
1752         }\r
1753 \r
1754         /**\r
1755          * Add member to team\r
1756          */\r
1757         function action_teamaddmember()\r
1758         {\r
1759                 global $member, $manager;\r
1760 \r
1761                 $memberid = intPostVar('memberid');\r
1762                 $blogid = intPostVar('blogid');\r
1763                 $admin = intPostVar('admin');\r
1764 \r
1765                 // check if allowed\r
1766                 $member->blogAdminRights($blogid) or $this->disallow();\r
1767 \r
1768                 $blog =& $manager->getBlog($blogid);\r
1769                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1770                 {\r
1771                         $this->error(_ERROR_ALREADYONTEAM);\r
1772                 }\r
1773 \r
1774                 $this->action_manageteam();\r
1775 \r
1776         }\r
1777 \r
1778         /**\r
1779          * @todo document this\r
1780          */\r
1781         function action_teamdelete()\r
1782         {\r
1783                 global $member, $manager;\r
1784 \r
1785                 $memberid = intRequestVar('memberid');\r
1786                 $blogid   = intRequestVar('blogid');\r
1787 \r
1788                 // check if allowed\r
1789                 $member->blogAdminRights($blogid) or $this->disallow();\r
1790 \r
1791                 $teammem =  Member::createFromID($memberid);\r
1792                 $blog    =& $manager->getBlog($blogid);\r
1793 \r
1794                 $this->pagehead();\r
1795                 $this->parse('teamdelete');\r
1796                 $this->pagefoot();\r
1797         }\r
1798 \r
1799         /**\r
1800          * @todo document this\r
1801          */\r
1802         function action_teamdeleteconfirm()\r
1803         {\r
1804                 global $member;\r
1805 \r
1806                 $memberid = intRequestVar('memberid');\r
1807                 $blogid = intRequestVar('blogid');\r
1808 \r
1809                 $error = $this->deleteOneTeamMember($blogid, $memberid);\r
1810                 if ( $error )\r
1811                 {\r
1812                         $this->error($error);\r
1813                 }\r
1814                 $this->action_manageteam();\r
1815         }\r
1816 \r
1817         /**\r
1818          * @todo document this\r
1819          */\r
1820         function deleteOneTeamMember($blogid, $memberid)\r
1821         {\r
1822                 global $member, $manager;\r
1823 \r
1824                 $blogid   = intval($blogid);\r
1825                 $memberid = intval($memberid);\r
1826 \r
1827                 // check if allowed\r
1828                 if ( !$member->blogAdminRights($blogid) )\r
1829                 {\r
1830                         return _ERROR_DISALLOWED;\r
1831                 }\r
1832 \r
1833                 // check if: - there remains at least one blog admin\r
1834                 //           - (there remains at least one team member)\r
1835                 $tmem = Member::createFromID($memberid);\r
1836 \r
1837                 $manager->notify(\r
1838                         'PreDeleteTeamMember',\r
1839                         array(\r
1840                                 'member' => &$tmem,\r
1841                                 'blogid' => $blogid\r
1842                         )\r
1843                 );\r
1844 \r
1845                 if ( $tmem->isBlogAdmin($blogid) )\r
1846                 {\r
1847                         // check if there are more blog members left and at least one admin\r
1848                         // (check for at least two admins before deletion)\r
1849                         $query = 'SELECT * FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid . ' and tadmin=1';\r
1850                         $r     = sql_query($query);\r
1851                         if ( sql_num_rows($r) < 2 )\r
1852                         {\r
1853                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1854                         }\r
1855                 }\r
1856 \r
1857                 $query = 'DELETE FROM ' . sql_table('team') . " WHERE tblog=$blogid and tmember=$memberid";\r
1858                 sql_query($query);\r
1859 \r
1860                 $manager->notify(\r
1861                         'PostDeleteTeamMember',\r
1862                         array(\r
1863                                 'member' => &$tmem,\r
1864                                 'blogid' => $blogid\r
1865                         )\r
1866                 );\r
1867 \r
1868                 return '';\r
1869         }\r
1870 \r
1871         /**\r
1872          * @todo document this\r
1873          */\r
1874         function action_teamchangeadmin()\r
1875         {\r
1876                 global $member;\r
1877 \r
1878                 $blogid   = intRequestVar('blogid');\r
1879                 $memberid = intRequestVar('memberid');\r
1880 \r
1881                 // check if allowed\r
1882                 $member->blogAdminRights($blogid) or $this->disallow();\r
1883 \r
1884                 $mem = Member::createFromID($memberid);\r
1885 \r
1886                 // don't allow when there is only one admin at this moment\r
1887                 if ( $mem->isBlogAdmin($blogid) )\r
1888                 {\r
1889                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");\r
1890                         if ( sql_num_rows($r) == 1 )\r
1891                         {\r
1892                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);\r
1893                         }\r
1894                 }\r
1895 \r
1896                 if ( $mem->isBlogAdmin($blogid) )\r
1897                 {\r
1898                         $newval = 0;\r
1899                 }\r
1900                 else\r
1901                 {\r
1902                         $newval = 1;\r
1903                 }\r
1904 \r
1905                 $query = 'UPDATE ' . sql_table('team') . " SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";\r
1906                 sql_query($query);\r
1907 \r
1908                 // only show manageteam if member did not change its own admin privileges\r
1909                 if ( $member->isBlogAdmin($blogid) )\r
1910                 {\r
1911                         $this->action_manageteam();\r
1912                 }\r
1913                 else\r
1914                 {\r
1915                         $this->action_overview(_MSG_ADMINCHANGED);\r
1916                 }\r
1917         }\r
1918 \r
1919         /**\r
1920          * @todo document this\r
1921          */\r
1922         function action_blogsettings()\r
1923         {\r
1924                 global $member, $manager;\r
1925 \r
1926                 $blogid = intRequestVar('blogid');\r
1927 \r
1928                 // check if allowed\r
1929                 $member->blogAdminRights($blogid) or $this->disallow();\r
1930 \r
1931                 $blog =& $manager->getBlog($blogid);\r
1932 \r
1933                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1934                 $this->pagehead($extrahead);\r
1935                 $this->parse('blogsettings');\r
1936                 $this->pagefoot();\r
1937         }\r
1938 \r
1939         /**\r
1940          * @todo document this\r
1941          */\r
1942         function action_categorynew()\r
1943         {\r
1944                 global $member, $manager;\r
1945 \r
1946                 $blogid = intRequestVar('blogid');\r
1947 \r
1948                 $member->blogAdminRights($blogid) or $this->disallow();\r
1949 \r
1950                 $cname = postVar('cname');\r
1951                 $cdesc = postVar('cdesc');\r
1952 \r
1953                 if ( !isValidCategoryName($cname) )\r
1954                 {\r
1955                         $this->error(_ERROR_BADCATEGORYNAME);\r
1956                 }\r
1957 \r
1958                 $query = 'SELECT * FROM ' . sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname) . '\' and cblog=' . intval($blogid);\r
1959                 $res = sql_query($query);\r
1960                 if ( sql_num_rows($res) > 0 )\r
1961                 {\r
1962                         $this->error(_ERROR_DUPCATEGORYNAME);\r
1963                 }\r
1964 \r
1965                 $blog       =& $manager->getBlog($blogid);\r
1966                 $newCatID   =  $blog->createNewCategory($cname, $cdesc);\r
1967 \r
1968                 $this->action_blogsettings();\r
1969         }\r
1970 \r
1971         /**\r
1972          * @todo document this\r
1973          */\r
1974         function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
1975         {\r
1976                 global $member, $manager;\r
1977 \r
1978                 if ( $blogid == '' )\r
1979                 {\r
1980                         $blogid = intGetVar('blogid');\r
1981                 }\r
1982                 else\r
1983                 {\r
1984                         $blogid = intval($blogid);\r
1985                 }\r
1986                 if ( $catid == '' )\r
1987                 {\r
1988                         $catid = intGetVar('catid');\r
1989                 }\r
1990                 else\r
1991                 {\r
1992                         $catid = intval($catid);\r
1993                 }\r
1994                 $_REQUEST['blogid']  = $blogid;\r
1995                 $_REQUEST['catid']   = $catid;\r
1996                 $_REQUEST['desturl'] = $desturl;\r
1997                 $member->blogAdminRights($blogid) or $this->disallow();\r
1998 \r
1999                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2000                 $this->pagehead($extrahead);\r
2001                 $this->parse('categoryedit');\r
2002                 $this->pagefoot();\r
2003         }\r
2004 \r
2005         /**\r
2006          * @todo document this\r
2007          */\r
2008         function action_categoryupdate()\r
2009         {\r
2010                 global $member, $manager;\r
2011 \r
2012                 $blogid  = intPostVar('blogid');\r
2013                 $catid   = intPostVar('catid');\r
2014                 $cname   = postVar('cname');\r
2015                 $cdesc   = postVar('cdesc');\r
2016                 $desturl = postVar('desturl');\r
2017 \r
2018                 $member->blogAdminRights($blogid) or $this->disallow();\r
2019 \r
2020                 if ( !isValidCategoryName($cname) )\r
2021                 {\r
2022                         $this->error(_ERROR_BADCATEGORYNAME);\r
2023                 }\r
2024 \r
2025                 $query = "SELECT *"\r
2026                            . " FROM " . sql_table('category')\r
2027                            . " WHERE cname='" . sql_real_escape_string($cname) . "'"\r
2028                            . " and cblog=" . intval($blogid)\r
2029                            . " and not(catid=" . intval($catid) . ")";\r
2030                 $res   = sql_query($query);\r
2031                 if ( sql_num_rows($res) > 0 )\r
2032                 {\r
2033                         $this->error(_ERROR_DUPCATEGORYNAME);\r
2034                 }\r
2035 \r
2036                 $query =  'UPDATE '.sql_table('category').' SET'\r
2037                                 . " cname='" . sql_real_escape_string($cname) . "',"\r
2038                                 . " cdesc='" . sql_real_escape_string($cdesc) . "'"\r
2039                                 . " WHERE catid=" . intval($catid);\r
2040 \r
2041                 sql_query($query);\r
2042 \r
2043                 // store plugin options\r
2044                 $aOptions = requestArray('plugoption');\r
2045                 NucleusPlugin::apply_plugin_options($aOptions);\r
2046                 $manager->notify(\r
2047                         'PostPluginOptionsUpdate',\r
2048                         array(\r
2049                                 'context' => 'category',\r
2050                                 'catid'   => $catid\r
2051                         )\r
2052                 );\r
2053 \r
2054 \r
2055                 if ( $desturl )\r
2056                 {\r
2057                         redirect($desturl);\r
2058                         exit;\r
2059                 }\r
2060                 else\r
2061                 {\r
2062                         $this->action_blogsettings();\r
2063                 }\r
2064         }\r
2065 \r
2066         /**\r
2067          * @todo document this\r
2068          */\r
2069         function action_categorydelete()\r
2070         {\r
2071                 global $member, $manager;\r
2072 \r
2073                 $blogid = intRequestVar('blogid');\r
2074                 $catid  = intRequestVar('catid');\r
2075 \r
2076                 $member->blogAdminRights($blogid) or $this->disallow();\r
2077 \r
2078                 $blog =& $manager->getBlog($blogid);\r
2079 \r
2080                 // check if the category is valid\r
2081                 if ( !$blog->isValidCategory($catid) )\r
2082                 {\r
2083                         $this->error(_ERROR_NOSUCHCATEGORY);\r
2084                 }\r
2085 \r
2086                 // don't allow deletion of default category\r
2087                 if ( $blog->getDefaultCategory() == $catid )\r
2088                 {\r
2089                         $this->error(_ERROR_DELETEDEFCATEGORY);\r
2090                 }\r
2091 \r
2092                 // check if catid is the only category left for blogid\r
2093                 $query = 'SELECT catid FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2094                 $res = sql_query($query);\r
2095                 if ( sql_num_rows($res) == 1 )\r
2096                 {\r
2097                         $this->error(_ERROR_DELETELASTCATEGORY);\r
2098                 }\r
2099 \r
2100 \r
2101                 $this->pagehead();\r
2102                 $this->parse('categorydelete');\r
2103                 $this->pagefoot();\r
2104         }\r
2105 \r
2106         /**\r
2107          * @todo document this\r
2108          */\r
2109         function action_categorydeleteconfirm()\r
2110         {\r
2111                 global $member, $manager;\r
2112 \r
2113                 $blogid = intRequestVar('blogid');\r
2114                 $catid  = intRequestVar('catid');\r
2115 \r
2116                 $member->blogAdminRights($blogid) or $this->disallow();\r
2117 \r
2118                 $error = $this->deleteOneCategory($catid);\r
2119                 if ( $error )\r
2120                 {\r
2121                         $this->error($error);\r
2122                 }\r
2123 \r
2124                 $this->action_blogsettings();\r
2125         }\r
2126         \r
2127         /**\r
2128          * Admin::deleteOneCategory()\r
2129          * Delete a category by its id\r
2130          * \r
2131          * @param       String  $catid  category id for deleting\r
2132          * @return      Void\r
2133          */\r
2134         function deleteOneCategory($catid)\r
2135         {\r
2136                 global $manager, $member;\r
2137                 \r
2138                 $catid  = intval($catid);\r
2139                 $blogid = getBlogIDFromCatID($catid);\r
2140 \r
2141                 if ( !$member->blogAdminRights($blogid) )\r
2142                 {\r
2143                         return ERROR_DISALLOWED;\r
2144                 }\r
2145 \r
2146                 // get blog\r
2147                 $blog =& $manager->getBlog($blogid);\r
2148 \r
2149                 // check if the category is valid\r
2150                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2151                 {\r
2152                         return _ERROR_NOSUCHCATEGORY;\r
2153                 }\r
2154 \r
2155                 $destcatid = $blog->getDefaultCategory();\r
2156 \r
2157                 // don't allow deletion of default category\r
2158                 if ( $blog->getDefaultCategory() == $catid )\r
2159                 {\r
2160                         return _ERROR_DELETEDEFCATEGORY;\r
2161                 }\r
2162 \r
2163                 // check if catid is the only category left for blogid\r
2164                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;\r
2165                 $res = sql_query($query);\r
2166                 if ( sql_num_rows($res) == 1 )\r
2167                 {\r
2168                         return _ERROR_DELETELASTCATEGORY;\r
2169                 }\r
2170 \r
2171                 $manager->notify(\r
2172                         'PreDeleteCategory',\r
2173                         array(\r
2174                                 'catid' => $catid\r
2175                         )\r
2176                 );\r
2177 \r
2178                 // change category for all items to the default category\r
2179                 $query = 'UPDATE ' . sql_table('item') . " SET icat=$destcatid WHERE icat=$catid";\r
2180                 sql_query($query);\r
2181                 \r
2182                 // delete all associated plugin options\r
2183                 NucleusPlugin::delete_option_values('category', $catid);\r
2184                 \r
2185                 // delete category\r
2186                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE catid=' . $catid;\r
2187                 sql_query($query);\r
2188                 \r
2189                 $manager->notify(\r
2190                         'PostDeleteCategory',\r
2191                         array(\r
2192                                 'catid' => $catid\r
2193                         )\r
2194                 );\r
2195                 return;\r
2196         }\r
2197         \r
2198         /**\r
2199          * Admin::action_blogsettingsupdate\r
2200          * Updating blog settings\r
2201          * \r
2202          * @param       Void\r
2203          * @return      Void\r
2204          */\r
2205         function action_blogsettingsupdate()\r
2206         {\r
2207                 global $member, $manager;\r
2208                 \r
2209                 $blogid = intRequestVar('blogid');\r
2210                 \r
2211                 $member->blogAdminRights($blogid) or $this->disallow();\r
2212                 \r
2213                 $blog =& $manager->getBlog($blogid);\r
2214                 \r
2215                 $notify_address = trim(postVar('notify'));\r
2216                 $shortname              = trim(postVar('shortname'));\r
2217                 $updatefile     = trim(postVar('update'));\r
2218                 \r
2219                 $notifyComment  = intPostVar('notifyComment');\r
2220                 $notifyVote             = intPostVar('notifyVote');\r
2221                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2222                 \r
2223                 if ( $notifyComment == 0 )\r
2224                 {\r
2225                         $notifyComment = 1;\r
2226                 }\r
2227                 if ( $notifyVote == 0 )\r
2228                 {\r
2229                         $notifyVote = 1;\r
2230                 }\r
2231                 if ( $notifyNewItem == 0 )\r
2232                 {\r
2233                         $notifyNewItem = 1;\r
2234                 }\r
2235                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2236                 \r
2237                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2238                 {\r
2239                         $this->error(_ERROR_BADNOTIFY);\r
2240                 }\r
2241                 \r
2242                 if ( !isValidShortName($shortname) )\r
2243                 {\r
2244                         $this->error(_ERROR_BADSHORTBLOGNAME);\r
2245                 }\r
2246                 \r
2247                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2248                 {\r
2249                         $this->error(_ERROR_DUPSHORTBLOGNAME);\r
2250                 }\r
2251                 // check if update file is writable\r
2252                 if ( $updatefile && !is_writeable($updatefile) )\r
2253                 {\r
2254                         $this->error(_ERROR_UPDATEFILE);\r
2255                 }\r
2256                 \r
2257                 $blog->setName(trim(postVar('name')));\r
2258                 $blog->setShortName($shortname);\r
2259                 $blog->setNotifyAddress($notify_address);\r
2260                 $blog->setNotifyType($notifyType);\r
2261                 $blog->setMaxComments(postVar('maxcomments'));\r
2262                 $blog->setCommentsEnabled(postVar('comments'));\r
2263                 $blog->setTimeOffset(postVar('timeoffset'));\r
2264                 $blog->setUpdateFile($updatefile);\r
2265                 $blog->setURL(trim(postVar('url')));\r
2266                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2267                 $blog->setDescription(trim(postVar('desc')));\r
2268                 $blog->setPublic(postVar('public'));\r
2269                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2270                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2271                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2272                 $blog->setSearchable(intPostVar('searchable'));\r
2273                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2274                 $blog->writeSettings();\r
2275                 \r
2276                 // store plugin options\r
2277                 $aOptions = requestArray('plugoption');\r
2278                 NucleusPlugin::apply_plugin_options($aOptions);\r
2279                 $manager->notify(\r
2280                         'PostPluginOptionsUpdate',\r
2281                         array(\r
2282                                 'context' => 'blog',\r
2283                                 'blogid'  => $blogid,\r
2284                                 'blog'    => &$blog\r
2285                         )\r
2286                 );\r
2287                 \r
2288                 $this->action_overview(_MSG_SETTINGSCHANGED);\r
2289                 return;\r
2290         }\r
2291 \r
2292         /**\r
2293          * @todo document this\r
2294          */\r
2295         function action_deleteblog()\r
2296         {\r
2297                 global $member, $CONF, $manager;\r
2298 \r
2299                 $blogid = intRequestVar('blogid');\r
2300 \r
2301                 $member->blogAdminRights($blogid) or $this->disallow();\r
2302 \r
2303                 // check if blog is default blog\r
2304                 if ( $CONF['DefaultBlog'] == $blogid )\r
2305                 {\r
2306                         $this->error(_ERROR_DELDEFBLOG);\r
2307                 }\r
2308 \r
2309                 $blog =& $manager->getBlog($blogid);\r
2310 \r
2311                 $this->pagehead();\r
2312                 $this->parse('deleteblog');\r
2313                 $this->pagefoot();\r
2314         }\r
2315         \r
2316         /**\r
2317          * Admin::action_deleteblogconfirm()\r
2318          * Delete Blog\r
2319          * \r
2320          * @param       Void\r
2321          * @return      Void\r
2322          */\r
2323         function action_deleteblogconfirm()\r
2324         {\r
2325                 global $member, $CONF, $manager;\r
2326                 \r
2327                 $blogid = intRequestVar('blogid');\r
2328                 $manager->notify(\r
2329                         'PreDeleteBlog',\r
2330                         array(\r
2331                                 'blogid' => $blogid\r
2332                         )\r
2333                 );\r
2334                 $member->blogAdminRights($blogid) or $this->disallow();\r
2335                 \r
2336                 // check if blog is default blog\r
2337                 if ( $CONF['DefaultBlog'] == $blogid )\r
2338                 {\r
2339                         $this->error(_ERROR_DELDEFBLOG);\r
2340                 }\r
2341                 \r
2342                 // delete all comments\r
2343                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2344                 sql_query($query);\r
2345                 \r
2346                 // delete all items\r
2347                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2348                 sql_query($query);\r
2349                 \r
2350                 // delete all team members\r
2351                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2352                 sql_query($query);\r
2353                 \r
2354                 // delete all bans\r
2355                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2356                 sql_query($query);\r
2357                 \r
2358                 // delete all categories\r
2359                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2360                 sql_query($query);\r
2361                 \r
2362                 // delete all associated plugin options\r
2363                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2364                 \r
2365                 // delete the blog itself\r
2366                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2367                 sql_query($query);\r
2368                 \r
2369                 $manager->notify(\r
2370                         'PostDeleteBlog',\r
2371                         array(\r
2372                                 'blogid' => $blogid\r
2373                         )\r
2374                 );\r
2375                 \r
2376                 $this->action_overview(_DELETED_BLOG);\r
2377                 return;\r
2378         }\r
2379         \r
2380         /**\r
2381          * @todo document this\r
2382          */\r
2383         function action_memberdelete()\r
2384         {\r
2385                 global $member, $manager;\r
2386 \r
2387                 $memberid = intRequestVar('memberid');\r
2388 \r
2389                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
2390 \r
2391                 $mem = Member::createFromID($memberid);\r
2392 \r
2393                 $this->pagehead();\r
2394                 $this->parse('memberdelete');\r
2395                 $this->pagefoot();\r
2396         }\r
2397 \r
2398         /**\r
2399          * @todo document this\r
2400          */\r
2401         function action_memberdeleteconfirm()\r
2402         {\r
2403                 global $member;\r
2404 \r
2405                 $memberid = intRequestVar('memberid');\r
2406 \r
2407                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();\r
2408 \r
2409                 $error = $this->deleteOneMember($memberid);\r
2410                 if ( $error )\r
2411                 {\r
2412                         $this->error($error);\r
2413                 }\r
2414 \r
2415                 if ( $member->isAdmin() )\r
2416                 {\r
2417                         $this->action_usermanagement();\r
2418                 }\r
2419                 else\r
2420                 {\r
2421                         $this->action_overview(_DELETED_MEMBER);\r
2422                 }\r
2423         }\r
2424         \r
2425         /**\r
2426          * Admin::deleteOneMember()\r
2427          * Delete a member by id\r
2428          * \r
2429          * @static\r
2430          * @params      Integer $memberid       member id\r
2431          * @return      String  null string or error messages\r
2432          */\r
2433         function deleteOneMember($memberid)\r
2434         {\r
2435                 global $manager;\r
2436                 \r
2437                 $memberid = intval($memberid);\r
2438                 $mem = Member::createFromID($memberid);\r
2439                 \r
2440                 if ( !$mem->canBeDeleted() )\r
2441                 {\r
2442                         return _ERROR_DELETEMEMBER;\r
2443                 }\r
2444                 \r
2445                 $manager->notify(\r
2446                         'PreDeleteMember',\r
2447                         array(\r
2448                                 'member' => &$mem\r
2449                         )\r
2450                 );\r
2451                 \r
2452                 /* unlink comments from memberid */\r
2453                 if ( $memberid )\r
2454                 {\r
2455                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";\r
2456                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2457                         sql_query($query);\r
2458                 }\r
2459                 \r
2460                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2461                 sql_query($query);\r
2462                 \r
2463                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2464                 sql_query($query);\r
2465                 \r
2466                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2467                 sql_query($query);\r
2468                 \r
2469                 // delete all associated plugin options\r
2470                 NucleusPlugin::delete_option_values('member', $memberid);\r
2471                 \r
2472                 $manager->notify(\r
2473                         'PostDeleteMember',\r
2474                         array(\r
2475                                 'member' => &$mem\r
2476                         )\r
2477                 );\r
2478                 \r
2479                 return '';\r
2480         }\r
2481         \r
2482         /**\r
2483          * @todo document this\r
2484          */\r
2485         function action_createnewlog()\r
2486         {\r
2487                 global $member, $CONF, $manager;\r
2488 \r
2489                 // Only Super-Admins can do this\r
2490                 $member->isAdmin() or $this->disallow();\r
2491 \r
2492                 $this->pagehead();\r
2493                 $this->parse('createnewlog');\r
2494                 $this->pagefoot();\r
2495         }\r
2496 \r
2497         /**\r
2498          * @todo document this\r
2499          */\r
2500         function action_addnewlog()\r
2501         {\r
2502                 global $member, $manager, $CONF;\r
2503 \r
2504                 // Only Super-Admins can do this\r
2505                 $member->isAdmin() or $this->disallow();\r
2506 \r
2507                 $bname          = trim(postVar('name'));\r
2508                 $bshortname     = trim(postVar('shortname'));\r
2509                 $btimeoffset    = postVar('timeoffset');\r
2510                 $bdesc          = trim(postVar('desc'));\r
2511                 $bdefskin       = postVar('defskin');\r
2512 \r
2513                 if ( !isValidShortName($bshortname) )\r
2514                 {\r
2515                         $this->error(_ERROR_BADSHORTBLOGNAME);\r
2516                 }\r
2517 \r
2518                 if ( $manager->existsBlog($bshortname) )\r
2519                 {\r
2520                         $this->error(_ERROR_DUPSHORTBLOGNAME);\r
2521                 }\r
2522 \r
2523                 $manager->notify(\r
2524                         'PreAddBlog',\r
2525                         array(\r
2526                                 'name'        => &$bname,\r
2527                                 'shortname'   => &$bshortname,\r
2528                                 'timeoffset'  => &$btimeoffset,\r
2529                                 'description' => &$bdesc,\r
2530                                 'defaultskin' => &$bdefskin\r
2531                         )\r
2532                 );\r
2533 \r
2534 \r
2535                 // add slashes for sql queries\r
2536                 $bname       = sql_real_escape_string($bname);\r
2537                 $bshortname  = sql_real_escape_string($bshortname);\r
2538                 $btimeoffset = sql_real_escape_string($btimeoffset);\r
2539                 $bdesc       = sql_real_escape_string($bdesc);\r
2540                 $bdefskin    = sql_real_escape_string($bdefskin);\r
2541 \r
2542                 // create blog\r
2543                 $query = 'INSERT '\r
2544                            . 'INTO '\r
2545                            .      sql_table('blog')\r
2546                            . '('\r
2547                            . '    bname, '\r
2548                            . '    bshortname, '\r
2549                            . '    bdesc, '\r
2550                            . '    btimeoffset, '\r
2551                            . '    bdefskin'\r
2552                            . ') VALUES ('\r
2553                            . "'" . $bname . "'," \r
2554                            . "'" . $bshortname . "'," \r
2555                            . "'" . $bdesc . "'," \r
2556                            . "'" . $btimeoffset . "'," \r
2557                            . "'" . $bdefskin . "'" \r
2558                            . ")";\r
2559                 sql_query($query);\r
2560                 $blogid =  sql_insert_id();\r
2561                 $blog   =& $manager->getBlog($blogid);\r
2562 \r
2563                 // create new category\r
2564                 $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');\r
2565                 $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');\r
2566                 $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2567                 sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));\r
2568                 $catid = sql_insert_id();\r
2569 \r
2570                 // set as default category\r
2571                 $blog->setDefaultCategory($catid);\r
2572                 $blog->writeSettings();\r
2573 \r
2574                 // create team member\r
2575                 $memberid = $member->getID();\r
2576                 $query    = 'INSERT '\r
2577                                   . 'INTO '\r
2578                                   .      sql_table('team')\r
2579                                   . '('\r
2580                                   . '    tmember, '\r
2581                                   . '    tblog, '\r
2582                                   . '    tadmin'\r
2583                                   . ') VALUES ('\r
2584                                   . '%d, '\r
2585                                   . '%d, '\r
2586                                   . '    1'\r
2587                                   . ')';\r
2588                 sql_query(sprintf($query), $memberid, $blogid);\r
2589 \r
2590                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2591                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2592 \r
2593                 $blog->additem(\r
2594                         $blog->getDefaultCategory(),\r
2595                         $itemdeftitle,$itemdefbody,\r
2596                         '',\r
2597                         $blogid,\r
2598                         $memberid,\r
2599                         $blog->getCorrectTime(),\r
2600                         0,\r
2601                         0,\r
2602                         0\r
2603                 );\r
2604                 $manager->notify(\r
2605                         'PostAddBlog',\r
2606                         array(\r
2607                                 'blog' => &$blog\r
2608                         )\r
2609                 );\r
2610 \r
2611                 $manager->notify(\r
2612                         'PostAddCategory',\r
2613                         array(\r
2614                                 'blog'        => &$blog,\r
2615                                 'name'        => _EBLOGDEFAULTCATEGORY_NAME,\r
2616                                 'description' => _EBLOGDEFAULTCATEGORY_DESC,\r
2617                                 'catid'       => $catid\r
2618                         )\r
2619                 );\r
2620 \r
2621                 $_REQUEST['blogid'] = $blogid;\r
2622                 $_REQUEST['catid']  = $catid;\r
2623                 $this->pagehead();\r
2624                 $this->parse('addnewlog');\r
2625                 $this->pagefoot();\r
2626         }\r
2627 \r
2628         /**\r
2629          * @todo document this\r
2630          */\r
2631         function action_addnewlog2()\r
2632         {\r
2633                 global $member, $manager;\r
2634                 $blogid = intRequestVar('blogid');\r
2635 \r
2636                 $member->blogAdminRights($blogid) or $this->disallow();\r
2637 \r
2638                 $burl   = requestVar('url');\r
2639 \r
2640                 $blog =& $manager->getBlog($blogid);\r
2641                 $blog->setURL(trim($burl));\r
2642                 $blog->writeSettings();\r
2643 \r
2644                 $this->action_overview(_MSG_NEWBLOG);\r
2645         }\r
2646 \r
2647         /**\r
2648          * @todo document this\r
2649          */\r
2650         function action_skinieoverview()\r
2651         {\r
2652                 global $member, $DIR_LIBS, $manager;\r
2653 \r
2654                 $member->isAdmin() or $this->disallow();\r
2655 \r
2656                 // load skinie class\r
2657                 include_once($DIR_LIBS . 'skinie.php');\r
2658 \r
2659                 $this->pagehead();\r
2660                 $this->parse('skinieoverview');\r
2661                 $this->pagefoot();\r
2662 \r
2663         }\r
2664 \r
2665         /**\r
2666          * @todo document this\r
2667          */\r
2668         function action_skinieimport() {\r
2669                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2670 \r
2671                 $member->isAdmin() or $this->disallow();\r
2672 \r
2673                 // load skinie class\r
2674                 include_once($DIR_LIBS . 'skinie.php');\r
2675 \r
2676                 $skinFileRaw = postVar('skinfile');\r
2677                 $mode        = postVar('mode');\r
2678 \r
2679                 $importer = new SkinImport();\r
2680 \r
2681                 // get full filename\r
2682                 if ($mode == 'file')\r
2683                 {\r
2684                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2685 \r
2686                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2687                         if ( !file_exists($skinFile) )\r
2688                         {\r
2689                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2690                         }\r
2691                 } else {\r
2692                         $skinFile = $skinFileRaw;\r
2693                 }\r
2694 \r
2695                 // read only metadata\r
2696                 $error = $importer->readFile($skinFile, 1);\r
2697 \r
2698                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2699                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2700                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2701 \r
2702                 // clashes\r
2703                 $skinNameClashes     = $importer->checkSkinNameClashes();\r
2704                 $templateNameClashes = $importer->checkTemplateNameClashes();\r
2705                 $hasNameClashes      = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2706 \r
2707                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2708                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2709                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2710                 \r
2711                 if ( $error )\r
2712                 {\r
2713                         $this->error($error);\r
2714                 }\r
2715 \r
2716                 $this->pagehead();\r
2717                 $this->parse('skinieimport');\r
2718                 $this->pagefoot();\r
2719         }\r
2720 \r
2721         /**\r
2722          * @todo document this\r
2723          */\r
2724         function action_skiniedoimport()\r
2725         {\r
2726                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2727 \r
2728                 $member->isAdmin() or $this->disallow();\r
2729 \r
2730                 // load skinie class\r
2731                 include_once($DIR_LIBS . 'skinie.php');\r
2732 \r
2733                 $skinFileRaw= postVar('skinfile');\r
2734                 $mode       = postVar('mode');\r
2735 \r
2736                 $allowOverwrite = intPostVar('overwrite');\r
2737 \r
2738                 // get full filename\r
2739                 if ( $mode == 'file' )\r
2740                 {\r
2741                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2742 \r
2743                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2744                         if ( !file_exists($skinFile) )\r
2745                         {\r
2746                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2747                         }\r
2748 \r
2749                 }\r
2750                 else\r
2751                 {\r
2752                         $skinFile = $skinFileRaw;\r
2753                 }\r
2754 \r
2755                 $importer = new SkinImport();\r
2756 \r
2757                 $error    = $importer->readFile($skinFile);\r
2758 \r
2759                 if ( $error )\r
2760                 {\r
2761                         $this->error($error);\r
2762                 }\r
2763 \r
2764                 $error = $importer->writeToDatabase($allowOverwrite);\r
2765 \r
2766                 if ( $error )\r
2767                 {\r
2768                         $this->error($error);\r
2769                 }\r
2770 \r
2771                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2772                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2773                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2774 \r
2775                 $this->pagehead();\r
2776                 $this->parse('skiniedoimport');\r
2777                 $this->pagefoot();\r
2778         }\r
2779 \r
2780         /**\r
2781          * @todo document this\r
2782          */\r
2783         function action_skinieexport()\r
2784         {\r
2785                 global $member, $DIR_LIBS;\r
2786 \r
2787                 $member->isAdmin() or $this->disallow();\r
2788 \r
2789                 // load skinie class\r
2790                 include_once($DIR_LIBS . 'skinie.php');\r
2791 \r
2792                 $aSkins     = requestIntArray('skin');\r
2793                 $aTemplates = requestIntArray('template');\r
2794 \r
2795                 if ( !is_array($aTemplates) )\r
2796                 {\r
2797                         $aTemplates = array();\r
2798                 }\r
2799                 if ( !is_array($aSkins) )\r
2800                 {\r
2801                         $aSkins = array();\r
2802                 }\r
2803 \r
2804                 $skinList     = array_keys($aSkins);\r
2805                 $templateList = array_keys($aTemplates);\r
2806 \r
2807                 $info = postVar('info');\r
2808 \r
2809                 $exporter = new SkinExport();\r
2810                 foreach ($skinList as $skinId)\r
2811                 {\r
2812                         $exporter->addSkin($skinId);\r
2813                 }\r
2814                 foreach ($templateList as $templateId)\r
2815                 {\r
2816                         $exporter->addTemplate($templateId);\r
2817                 }\r
2818                 $exporter->setInfo($info);\r
2819 \r
2820                 $exporter->export();\r
2821         }\r
2822 \r
2823         /**\r
2824          * @todo document this\r
2825          */\r
2826         function action_templateoverview()\r
2827         {\r
2828                 global $member, $manager;\r
2829 \r
2830                 $member->isAdmin() or $this->disallow();\r
2831 \r
2832                 $this->pagehead();\r
2833                 $this->parse('templateoverview');\r
2834                 $this->pagefoot();\r
2835         }\r
2836 \r
2837         /**\r
2838          * @todo document this\r
2839          */\r
2840         function action_templateedit($msg = '')\r
2841         {\r
2842                 global $member, $manager;\r
2843                 if ( $msg )\r
2844                 {\r
2845                         $this->headMess = $msg;\r
2846                 }\r
2847                 \r
2848                 $templateid = intRequestVar('templateid');\r
2849 \r
2850                 $member->isAdmin() or $this->disallow();\r
2851 \r
2852                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';\r
2853                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>';\r
2854 \r
2855                 $this->pagehead($extrahead);\r
2856                 $this->parse('templateedit');\r
2857                 $this->pagefoot();\r
2858         }\r
2859 \r
2860         /**\r
2861          * @todo document this\r
2862          *\r
2863         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
2864                 static $count = 1;\r
2865                 if (!isset($template[$name])) $template[$name] = '';\r
2866         ?>\r
2867                 </tr><tr>\r
2868                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
2869                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
2870         <?php       $count++;\r
2871         }\r
2872         */\r
2873 \r
2874         /**\r
2875          * @todo document this\r
2876          */\r
2877         function action_templateupdate()\r
2878         {\r
2879                 global $member,$manager;\r
2880 \r
2881                 $templateid = intRequestVar('templateid');\r
2882 \r
2883                 $member->isAdmin() or $this->disallow();\r
2884 \r
2885                 $name = postVar('tname');\r
2886                 $desc = postVar('tdesc');\r
2887 \r
2888                 if ( !isValidTemplateName($name) )\r
2889                 {\r
2890                         $this->error(_ERROR_BADTEMPLATENAME);\r
2891                 }\r
2892 \r
2893                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
2894                 {\r
2895                         $this->error(_ERROR_DUPTEMPLATENAME);\r
2896                 }\r
2897 \r
2898                 $name = sql_real_escape_string($name);\r
2899                 $desc = sql_real_escape_string($desc);\r
2900 \r
2901                 // 1. Remove all template parts\r
2902                 $query = 'DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid;\r
2903                 sql_query($query);\r
2904 \r
2905                 // 2. Update description\r
2906                 $query = 'UPDATE '\r
2907                            .      sql_table('template_desc')\r
2908                            . ' SET'\r
2909                            . "    tdname='" . $name . "',"\r
2910                            . "    tddesc='" . $desc . "'"\r
2911                            . " WHERE"\r
2912                            . "    tdnumber=" . $templateid;\r
2913                 sql_query($query);\r
2914 \r
2915                 // 3. Add non-empty template parts\r
2916                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));\r
2917                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));\r
2918                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));\r
2919                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));\r
2920                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));\r
2921                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));\r
2922                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));\r
2923                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));\r
2924                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));\r
2925                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));\r
2926                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));\r
2927                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));\r
2928                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));\r
2929                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));\r
2930                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));\r
2931                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));\r
2932                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
2933                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));\r
2934                 $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));\r
2935                 $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));\r
2936                 $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));\r
2937                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));\r
2938                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));\r
2939                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));\r
2940                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));\r
2941                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));\r
2942                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));\r
2943                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));\r
2944                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));\r
2945                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));\r
2946                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
2947                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));\r
2948                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));\r
2949                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));\r
2950 \r
2951                 $pluginfields = array();\r
2952                 $manager->notify(\r
2953                         'TemplateExtraFields',\r
2954                         array(\r
2955                                 'fields'=>&$pluginfields\r
2956                         )\r
2957                 );\r
2958                 foreach ($pluginfields as $pfkey=>$pfvalue)\r
2959                 {\r
2960                         foreach ($pfvalue as $pffield=>$pfdesc)\r
2961                         {\r
2962                                 $this->addToTemplate($templateid, $pffield, postVar($pffield));\r
2963                         }\r
2964                 }\r
2965 \r
2966                 // jump back to template edit\r
2967                 $this->action_templateedit(_TEMPLATE_UPDATED);\r
2968 \r
2969         }\r
2970 \r
2971         /**\r
2972          * Admin::addToTemplate()\r
2973          * \r
2974          * @param       Integer $id     ID for template\r
2975          * @param       String  $partname       parts name\r
2976          * @param       String  $content        template contents\r
2977          * @return      Integer record index\r
2978          * \r
2979          */\r
2980         function addToTemplate($id, $partname, $content)\r
2981         {\r
2982                 // don't add empty parts:\r
2983                 if ( !trim($content) )\r
2984                 {\r
2985                         return -1;\r
2986                 }\r
2987                 \r
2988                 $partname = sql_real_escape_string($partname);\r
2989                 $content  = sql_real_escape_string($content);\r
2990                 \r
2991                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";\r
2992                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
2993                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
2994                 return sql_insert_id();\r
2995         }\r
2996         \r
2997         /**\r
2998          * @todo document this\r
2999          */\r
3000         function action_templatedelete() {\r
3001                 global $member, $manager;\r
3002 \r
3003                 $member->isAdmin() or $this->disallow();\r
3004 \r
3005                 $templateid = intRequestVar('templateid');\r
3006                 // TODO: check if template can be deleted\r
3007 \r
3008                 $this->pagehead();\r
3009                 $this->parse('templatedelete');\r
3010                 $this->pagefoot();\r
3011         }\r
3012 \r
3013         /**\r
3014          * @todo document this\r
3015          */\r
3016         function action_templatedeleteconfirm() {\r
3017                 global $member, $manager;\r
3018 \r
3019                 $templateid = intRequestVar('templateid');\r
3020 \r
3021                 $member->isAdmin() or $this->disallow();\r
3022 \r
3023                 $manager->notify(\r
3024                         'PreDeleteTemplate',\r
3025                         array(\r
3026                                 'templateid' => $templateid\r
3027                         )\r
3028                 );\r
3029 \r
3030                 // 1. delete description\r
3031                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3032 \r
3033                 // 2. delete parts\r
3034                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3035 \r
3036                 $manager->notify(\r
3037                         'PostDeleteTemplate',\r
3038                         array(\r
3039                                 'templateid' => $templateid\r
3040                         )\r
3041                 );\r
3042 \r
3043                 $this->action_templateoverview();\r
3044         }\r
3045 \r
3046         /**\r
3047          * @todo document this\r
3048          */\r
3049         function action_templatenew()\r
3050         {\r
3051                 global $member;\r
3052 \r
3053                 $member->isAdmin() or $this->disallow();\r
3054 \r
3055                 $name = postVar('name');\r
3056                 $desc = postVar('desc');\r
3057 \r
3058                 if ( !isValidTemplateName($name) )\r
3059                 {\r
3060                         $this->error(_ERROR_BADTEMPLATENAME);\r
3061                 }\r
3062 \r
3063                 if ( Template::exists($name) )\r
3064                 {\r
3065                         $this->error(_ERROR_DUPTEMPLATENAME);\r
3066                 }\r
3067 \r
3068                 $newTemplateId = Template::createNew($name, $desc);\r
3069 \r
3070                 $this->action_templateoverview();\r
3071         }\r
3072 \r
3073         /**\r
3074          * @todo document this\r
3075          */\r
3076         function action_templateclone()\r
3077         {\r
3078                 global $member;\r
3079 \r
3080                 $templateid = intRequestVar('templateid');\r
3081 \r
3082                 $member->isAdmin() or $this->disallow();\r
3083 \r
3084                 // 1. read old template\r
3085                 $name = Template::getNameFromId($templateid);\r
3086                 $desc = Template::getDesc($templateid);\r
3087 \r
3088                 // 2. create desc thing\r
3089                 $name = "cloned" . $name;\r
3090 \r
3091                 // if a template with that name already exists:\r
3092                 if (Template::exists($name)) {\r
3093                         $i = 1;\r
3094                         while (Template::exists($name . $i))\r
3095                         {\r
3096                                 $i++;\r
3097                         }\r
3098                         $name .= $i;\r
3099                 }\r
3100 \r
3101                 $newid = Template::createNew($name, $desc);\r
3102 \r
3103                 // 3. create clone\r
3104                 // go through parts of old template and add them to the new one\r
3105                 $que = 'SELECT '\r
3106                          . '    tpartname,'\r
3107                          . '    tcontent '\r
3108                          . 'FROM '\r
3109                          .      sql_table('template')\r
3110                          . ' WHERE'\r
3111                          . '    tdesc=' . intval($templateid);\r
3112                 $res = sql_query($que);\r
3113                 while ($o = sql_fetch_object($res)) {\r
3114                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3115                 }\r
3116 \r
3117                 $this->action_templateoverview();\r
3118         }\r
3119         \r
3120         /**\r
3121          * @todo document this\r
3122          */\r
3123         function action_admintemplateoverview()\r
3124         {\r
3125                 global $member, $manager;\r
3126                 $member->isAdmin() or $this->disallow();\r
3127                 $this->pagehead();\r
3128                 $this->parse('admintemplateoverview');\r
3129                 $this->pagefoot();\r
3130         }\r
3131         \r
3132         /**\r
3133          * @todo document this\r
3134          */\r
3135         function action_admintemplateedit($msg = '')\r
3136         {\r
3137                 global $member, $manager;\r
3138                 if ($msg) {\r
3139                         $this->headMess = $msg;\r
3140                 }\r
3141                 $member->isAdmin() or $this->disallow();\r
3142                 $extrahead  = '<script type="text/javascript" src="javascript/templateEdit.js"></script>' . "\n";\r
3143                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>';\r
3144                 $this->pagehead($extrahead);\r
3145                 $this->parse('admintemplateedit');\r
3146                 $this->pagefoot();\r
3147         }\r
3148         \r
3149         /**\r
3150          * @todo document this\r
3151          */\r
3152         function action_admintemplateupdate()\r
3153         {\r
3154                 global $member, $manager;\r
3155                 $templateid = intRequestVar('templateid');\r
3156                 $member->isAdmin() or $this->disallow();\r
3157                 $name = postVar('tname');\r
3158                 $desc = postVar('tdesc');\r
3159         \r
3160                 if (!isValidTemplateName($name)) {\r
3161                         $this->error(_ERROR_BADTEMPLATENAME);\r
3162                 }\r
3163                 //        if (!class_exists('Template')) {\r
3164                 //            NP_SkinableAdmin::loadSkinableClass('Template');\r
3165                 //        }\r
3166                 if ((Template::getNameFromId($templateid) != $name) && Template::exists($name)) {\r
3167                         $this->error(_ERROR_DUPTEMPLATENAME);\r
3168                 }\r
3169                 $name = sql_real_escape_string($name);\r
3170                 $desc = sql_real_escape_string($desc);\r
3171         \r
3172                 // 1. Remove all template parts\r
3173                 $query = 'DELETE '\r
3174                 . 'FROM '\r
3175                 .      sql_table('admintemplate') . ' '\r
3176                 . 'WHERE '\r
3177                 . '    tdesc = %d';\r
3178                 sql_query(sprintf($query, $templateid));\r
3179         \r
3180                 // 2. Update description\r
3181                 $query = 'UPDATE '\r
3182                 .      sql_table('admintemplate_desc') . ' '\r
3183                 . 'SET '\r
3184                 . '    tdname = "' . sql_real_escape_string($name) . '", '\r
3185                 . '    tddesc = "' . sql_real_escape_string($desc) . '" '\r
3186                 . 'WHERE '\r
3187                 . '    tdnumber = %d';\r
3188                 sql_query(sprintf($query, $templateid));\r
3189         \r
3190                 // 3. Add non-empty template parts\r
3191                 $this->addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3192                 $this->addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                 postVar('ADMINSKINTYPELIST_BODY'));\r
3193                 $this->addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3194                 $this->addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3195                 $this->addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',            postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3196                 $this->addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                         postVar('ADMIN_BLOGLINK'));\r
3197                 $this->addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                        postVar('ADMIN_BATCHLIST'));\r
3198                 $this->addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3199                 $this->addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3200                 $this->addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                postVar('ACTIVATE_REGISTER_TITLE'));\r
3201                 $this->addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3202                 $this->addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3203                 $this->addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3204                 $this->addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3205                 $this->addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3206                 $this->addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3207                 $this->addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                   postVar('SPECIALSKINLIST_HEAD'));\r
3208                 $this->addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                   postVar('SPECIALSKINLIST_BODY'));\r
3209                 $this->addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                   postVar('SPECIALSKINLIST_FOOT'));\r
3210                 $this->addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3211                 $this->addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                   postVar('BANLIST_DELETED_LIST'));\r
3212                 $this->addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                postVar('INSERT_PLUGOPTION_TITLE'));\r
3213                 $this->addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                 postVar('INSERT_PLUGOPTION_BODY'));\r
3214                 $this->addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3215                 $this->addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3216                 $this->addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3217                 $this->addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3218                 $this->addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3219                 $this->addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                     postVar('SKINIE_EXPORT_LIST'));\r
3220                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',          postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3221                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',          postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3222                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',          postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3223                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',           postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3224                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',           postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3225                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',           postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3226                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3227                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3228                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3229                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3230                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3231                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3232                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3233                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3234                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3235                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3236                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3237                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3238                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3239                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3240                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3241                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3242                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3243                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3244                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3245                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3246                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3247                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3248                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3249                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3250                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3251                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3252                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3253                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3254                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3255                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3256                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3257                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3258                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3259                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3260                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3261                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3262                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3263                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3264                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3265                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3266                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3267                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3268                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3269                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3270                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3271                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3272                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3273                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3274                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3275                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3276                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3277                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3278                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3279                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3280                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3281                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3282                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3283                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3284                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3285                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3286                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3287                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3288                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3289                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3290                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3291                 $this->addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3292                 $this->addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3293                 $this->addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3294                 $this->addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3295                 $this->addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3296         \r
3297                 $pluginfields = array();\r
3298                 $manager->notify(\r
3299                                 'TemplateExtraFields',\r
3300                                 array(\r
3301                                                 'fields' => &$pluginfields\r
3302                                 )\r
3303                 );\r
3304                 foreach ($pluginfields as $pfkey => $pfvalue) {\r
3305                         foreach ($pfvalue as $pffield => $pfdesc) {\r
3306                                 $this->addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3307                         }\r
3308                 }\r
3309         \r
3310                 // jump back to template edit\r
3311                 $this->action_admintemplateedit(_TEMPLATE_UPDATED);\r
3312         }\r
3313         \r
3314         /**\r
3315          * @todo document this\r
3316          */\r
3317         function addToAdminTemplate($id, $partname, $content)\r
3318         {\r
3319                 $partname = sql_real_escape_string($partname);\r
3320                 $content  = sql_real_escape_string($content);\r
3321         \r
3322         \r
3323                 $id = intval($id);\r
3324         \r
3325                 // don't add empty parts:\r
3326                 if (!trim($content)) {\r
3327                         return -1;\r
3328                 }\r
3329                 $query = 'INSERT '\r
3330                 . 'INTO '\r
3331                 .      sql_table('admintemplate') . ' '\r
3332                 . '('\r
3333                 . '    tdesc, '\r
3334                 . '    tpartname, '\r
3335                 . '    tcontent '\r
3336                 . ') VALUES ('\r
3337                 . '    %d, '\r
3338                 . '    "%s", '\r
3339                 . '    "%s"'\r
3340                 . ')';\r
3341                 sql_query(sprintf($query, $id, $partname, $content)) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3342                 return sql_insert_id();\r
3343         }\r
3344         \r
3345         /**\r
3346          * @todo document this\r
3347          */\r
3348         function action_admintemplatedelete()\r
3349         {\r
3350                 global $member, $manager;\r
3351                 $member->isAdmin() or $this->disallow();\r
3352                 // TODO: check if template can be deleted\r
3353                 $this->pagehead();\r
3354                 $this->parse('admintemplatedelete');\r
3355                 $this->pagefoot();\r
3356         }\r
3357         \r
3358         /**\r
3359          * @todo document this\r
3360          */\r
3361         function action_admintemplatedeleteconfirm()\r
3362         {\r
3363                 global $member, $manager;\r
3364                 $templateid = intRequestVar('templateid');\r
3365                 $member->isAdmin() or $this->disallow();\r
3366                 $manager->notify(\r
3367                                 'PreDeleteAdminTemplate',\r
3368                                 array(\r
3369                                                 'templateid' => $templateid\r
3370                                 )\r
3371                 );\r
3372         \r
3373                 $query = 'DELETE '\r
3374                 . 'FROM '\r
3375                 . '    %s '\r
3376                 . 'WHERE '\r
3377                 . '    %s = ' .intval($templateid);\r
3378                 // 1. delete description\r
3379                 sql_query(sprintf($query, sql_table('admintemplate_desc'), 'tdnumber'));\r
3380                 // 2. delete parts\r
3381                 sql_query(sprintf($query, sql_table('admintemplate'), 'tdesc'));\r
3382         \r
3383                 $manager->notify(\r
3384                                 'PostDeleteAdminTemplate',\r
3385                                 array(\r
3386                                                 'templateid' => $templateid\r
3387                                 )\r
3388                 );\r
3389                 $this->action_admintemplateoverview();\r
3390         }\r
3391         \r
3392         /**\r
3393          * @todo document this\r
3394          */\r
3395         function action_admintemplatenew()\r
3396         {\r
3397                 global $member;\r
3398                 $member->isAdmin() or $this->disallow();\r
3399                 $name = postVar('name');\r
3400                 $desc = postVar('desc');\r
3401         \r
3402                 if (!isValidTemplateName($name)) {\r
3403                         $this->error(_ERROR_BADTEMPLATENAME);\r
3404                 }\r
3405                 if (Template::exists($name)) {\r
3406                         $this->error(_ERROR_DUPTEMPLATENAME);\r
3407                 }\r
3408         \r
3409                 $newTemplateId = Template::createNew($name, $desc);\r
3410                 $this->action_admintemplateoverview();\r
3411         }\r
3412         \r
3413         /**\r
3414          * @todo document this\r
3415          */\r
3416         function action_admintemplateclone()\r
3417         {\r
3418                 global $member;\r
3419                 $templateid = intRequestVar('templateid');\r
3420                 $member->isAdmin() or $this->disallow();\r
3421         \r
3422                 //        if (!class_exists('Template')) {\r
3423                 //            NP_SkinableAdmin::loadSkinableClass('Template');\r
3424                 //        }\r
3425         \r
3426                 // 1. read old template\r
3427                 $name = Template::getNameFromId($templateid);\r
3428                 $desc = Template::getDesc($templateid);\r
3429                 // 2. create desc thing\r
3430                 $name = "cloned" . $name;\r
3431         \r
3432                 // if a template with that name already exists:\r
3433                 if (Template::exists($name)) {\r
3434                         $i = 1;\r
3435                         while (Template::exists($name . $i)) {\r
3436                                 $i++;\r
3437                         }\r
3438                         $name .= $i;\r
3439                 }\r
3440         \r
3441                 $newid = Template::admincreateNew($name, $desc);\r
3442         \r
3443                 // 3. create clone\r
3444                 // go through parts of old template and add them to the new one\r
3445                 $que = 'SELECT '\r
3446                 . '    tpartname, '\r
3447                 . '    tcontent '\r
3448                 . 'FROM '\r
3449                 .      sql_table('admintemplate') . ' '\r
3450                 . 'WHERE '\r
3451                 . '    tdesc = ' . intval($templateid);\r
3452                 $res = sql_query($que);\r
3453                 while ($o = sql_fetch_object($res)) {\r
3454                         $this->addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3455                 }\r
3456                 $this->action_admintemplateoverview();\r
3457         }\r
3458 \r
3459         /**\r
3460          * @todo document this\r
3461          */\r
3462         function action_skinoverview()\r
3463         {\r
3464                 global $member, $manager;\r
3465 \r
3466                 $member->isAdmin() or $this->disallow();\r
3467 \r
3468                 $this->pagehead();\r
3469                 $this->parse('skinoverview');\r
3470                 $this->pagefoot();\r
3471         }\r
3472 \r
3473         /**\r
3474          * @todo document this\r
3475          */\r
3476         function action_skinnew()\r
3477         {\r
3478                 global $member;\r
3479 \r
3480                 $member->isAdmin() or $this->disallow();\r
3481 \r
3482                 $name = trim(postVar('name'));\r
3483                 $desc = trim(postVar('desc'));\r
3484 \r
3485                 if ( !isValidSkinName($name) )\r
3486                 {\r
3487                         $this->error(_ERROR_BADSKINNAME);\r
3488                 }\r
3489 \r
3490                 if ( SKIN::exists($name) )\r
3491                 {\r
3492                         $this->error(_ERROR_DUPSKINNAME);\r
3493                 }\r
3494 \r
3495                 $newId = SKIN::createNew($name, $desc);\r
3496 \r
3497                 $this->action_skinoverview();\r
3498         }\r
3499 \r
3500         /**\r
3501          * @todo document this\r
3502          */\r
3503         function action_skinedit()\r
3504         {\r
3505                 global $member, $manager;\r
3506 \r
3507 //              $skinid = intRequestVar('skinid');\r
3508 \r
3509                 $member->isAdmin() or $this->disallow();\r
3510 \r
3511 //              $skin = new SKIN($skinid);\r
3512 \r
3513                 $this->pagehead();\r
3514                 $this->parse('skinedit');\r
3515                 $this->pagefoot();\r
3516         }\r
3517 \r
3518         /**\r
3519          * @todo document this\r
3520          */\r
3521         function action_skineditgeneral()\r
3522         {\r
3523                 global $member;\r
3524 \r
3525                 $skinid = intRequestVar('skinid');\r
3526 \r
3527                 $member->isAdmin() or $this->disallow();\r
3528 \r
3529                 $name = postVar('name');\r
3530                 $desc = postVar('desc');\r
3531                 $type = postVar('type');\r
3532                 $inc_mode = postVar('inc_mode');\r
3533                 $inc_prefix = postVar('inc_prefix');\r
3534 \r
3535                 $skin = new Skin($skinid);\r
3536 \r
3537                 // 1. Some checks\r
3538                 if ( !isValidSkinName($name) )\r
3539                 {\r
3540                         $this->error(_ERROR_BADSKINNAME);\r
3541                 }\r
3542 \r
3543                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3544                 {\r
3545                         $this->error(_ERROR_DUPSKINNAME);\r
3546                 }\r
3547 \r
3548                 if ( !$type )\r
3549                 {\r
3550                         $type = 'text/html';\r
3551                 }\r
3552                 if ( !$inc_mode )\r
3553                 {\r
3554                         $inc_mode = 'normal';\r
3555                 }\r
3556 \r
3557                 // 2. Update description\r
3558                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3559 \r
3560                 $this->action_skinedit();\r
3561 \r
3562         }\r
3563 \r
3564         /**\r
3565          * @todo document this\r
3566          */\r
3567         function action_skinedittype($msg = '')\r
3568         {\r
3569                 global $member, $manager;\r
3570 \r
3571                 $member->isAdmin() or $this->disallow();\r
3572 \r
3573                 if ($msg) {\r
3574                         $this->headMess = $msg;\r
3575                 }\r
3576                 $skinid = intRequestVar('skinid');\r
3577                 $type   = requestVar('type');\r
3578                 $type   = trim($type);\r
3579                 $type   = strtolower($type);\r
3580 \r
3581                 if ( !isValidShortName($type) )\r
3582                 {\r
3583                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3584                 }\r
3585 \r
3586                 $this->pagehead();\r
3587                 $this->parse('skinedittype');\r
3588                 $this->pagefoot();\r
3589         }\r
3590 \r
3591         /**\r
3592          * @todo document this\r
3593          */\r
3594         function action_skinupdate()\r
3595         {\r
3596                 global $member;\r
3597 \r
3598                 $skinid = intRequestVar('skinid');\r
3599                 $content = trim(postVar('content'));\r
3600                 $type = postVar('type');\r
3601 \r
3602                 $member->isAdmin() or $this->disallow();\r
3603 \r
3604                 $skin = new SKIN($skinid);\r
3605                 $skin->update($type, $content);\r
3606 \r
3607                 $this->action_skinedittype(_SKIN_UPDATED);\r
3608         }\r
3609 \r
3610         /**\r
3611          * @todo document this\r
3612          */\r
3613         function action_skindelete()\r
3614         {\r
3615                 global $member, $manager, $CONF;\r
3616 \r
3617                 $skinid = intRequestVar('skinid');\r
3618 \r
3619                 $member->isAdmin() or $this->disallow();\r
3620 \r
3621                 // don't allow default skin to be deleted\r
3622                 if ( $skinid == $CONF['BaseSkin'] )\r
3623                 {\r
3624                         $this->error(_ERROR_DEFAULTSKIN);\r
3625                 }\r
3626 \r
3627                 // don't allow deletion of default skins for blogs\r
3628                 $query = 'SELECT bname FROM ' . sql_table('blog') . ' WHERE bdefskin=' . $skinid;\r
3629                 $r = sql_query($query);\r
3630                 if ( $o = sql_fetch_object($r) )\r
3631                 {\r
3632                         $this->error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3633                 }\r
3634 \r
3635                 $this->pagehead();\r
3636                 $this->parse('skindelete');\r
3637                 $this->pagefoot();\r
3638         }\r
3639 \r
3640         /**\r
3641          * @todo document this\r
3642          */\r
3643         function action_skindeleteconfirm()\r
3644         {\r
3645                 global $member, $CONF, $manager;\r
3646 \r
3647                 $skinid = intRequestVar('skinid');\r
3648 \r
3649                 $member->isAdmin() or $this->disallow();\r
3650 \r
3651                 // don't allow default skin to be deleted\r
3652                 if ( $skinid == $CONF['BaseSkin'] )\r
3653                 {\r
3654                         $this->error(_ERROR_DEFAULTSKIN);\r
3655                 }\r
3656 \r
3657                 // don't allow deletion of default skins for blogs\r
3658                 $query = 'SELECT'\r
3659                            . '    bname '\r
3660                            . 'FROM '\r
3661                            .      sql_table('blog') . ' '\r
3662                            . 'WHERE'\r
3663                            . '    bdefskin=' . $skinid;\r
3664                 $r = sql_query($query);\r
3665                 if ( $o = sql_fetch_object($r) )\r
3666                 {\r
3667                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);\r
3668                 }\r
3669 \r
3670                 $manager->notify(\r
3671                         'PreDeleteSkin',\r
3672                         array(\r
3673                                 'skinid' => $skinid\r
3674                         )\r
3675                 );\r
3676 \r
3677                 // 1. delete description\r
3678                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);\r
3679 \r
3680                 // 2. delete parts\r
3681                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);\r
3682 \r
3683                 $manager->notify(\r
3684                         'PostDeleteSkin',\r
3685                         array(\r
3686                                 'skinid' => $skinid\r
3687                         )\r
3688                 );\r
3689 \r
3690                 $this->action_skinoverview();\r
3691         }\r
3692 \r
3693         /**\r
3694          * @todo document this\r
3695          */\r
3696         function action_skinremovetype() {\r
3697                 global $member, $manager, $CONF;\r
3698 \r
3699                 $member->isAdmin() or $this->disallow();\r
3700 \r
3701                 $skinid = intRequestVar('skinid');\r
3702                 $skintype = requestVar('type');\r
3703 \r
3704                 if ( !isValidShortName($skintype) )\r
3705                 {\r
3706                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3707                 }\r
3708 \r
3709 \r
3710                 // don't allow default skinparts to be deleted\r
3711                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3712                 {\r
3713                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3714                 }\r
3715 \r
3716                 $this->pagehead();\r
3717                 $this->parse('skinremovetype');\r
3718                 $this->pagefoot();\r
3719         }\r
3720 \r
3721         /**\r
3722          * @todo document this\r
3723          */\r
3724         function action_skinremovetypeconfirm() {\r
3725                 global $member, $CONF, $manager;\r
3726 \r
3727                 $member->isAdmin() or $this->disallow();\r
3728 \r
3729                 $skinid = intRequestVar('skinid');\r
3730                 $skintype = requestVar('type');\r
3731 \r
3732                 if ( !isValidShortName($skintype) )\r
3733                 {\r
3734                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3735                 }\r
3736 \r
3737                 // don't allow default skinparts to be deleted\r
3738                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3739                 {\r
3740                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3741                 }\r
3742 \r
3743                 $manager->notify(\r
3744                         'PreDeleteSkinPart',\r
3745                         array(\r
3746                                 'skinid'   => $skinid,\r
3747                                 'skintype' => $skintype\r
3748                         )\r
3749                 );\r
3750 \r
3751                 // delete part\r
3752                 sql_query("DELETE FROM " . sql_table('skin') . " WHERE sdesc=" . $skinid . " AND stype='" . $skintype . "'");\r
3753 \r
3754                 $manager->notify(\r
3755                         'PostDeleteSkinPart',\r
3756                         array(\r
3757                                 'skinid'   => $skinid,\r
3758                                 'skintype' => $skintype\r
3759                         )\r
3760                 );\r
3761 \r
3762                 $this->action_skinedit();\r
3763         }\r
3764 \r
3765         /**\r
3766          * @todo document this\r
3767          */\r
3768         function action_skinclone()\r
3769         {\r
3770                 global $member;\r
3771 \r
3772                 $member->isAdmin() or $this->disallow();\r
3773 \r
3774                 $skinid = intRequestVar('skinid');\r
3775 \r
3776                 // 1. read skin to clone\r
3777                 $skin = new SKIN($skinid);\r
3778 \r
3779                 $name = "clone_" . $skin->getName();\r
3780 \r
3781                 // if a skin with that name already exists:\r
3782                 if (Skin::exists($name)) {\r
3783                         $i = 1;\r
3784                         while (Skin::exists($name . $i))\r
3785                                 $i++;\r
3786                         $name .= $i;\r
3787                 }\r
3788 \r
3789                 // 2. create skin desc\r
3790                 $newid = Skin::createNew(\r
3791                         $name,\r
3792                         $skin->getDescription(),\r
3793                         $skin->getContentType(),\r
3794                         $skin->getIncludeMode(),\r
3795                         $skin->getIncludePrefix()\r
3796                 );\r
3797 \r
3798 \r
3799                 // 3. clone\r
3800                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;\r
3801                 $res = sql_query($query);\r
3802                 while ($row = sql_fetch_assoc($res)) {\r
3803                         $this->skinclonetype($skin, $newid, $row['stype']);\r
3804                 }\r
3805 \r
3806                 $this->action_skinoverview();\r
3807 \r
3808         }\r
3809 \r
3810         /**\r
3811          * Admin::skinclonetype()\r
3812          * \r
3813          * @param       String  $skin   Skin object\r
3814          * @param       Integer $newid  ID for this clone\r
3815          * @param       String  $type   type of skin\r
3816          * @return      Void\r
3817          */\r
3818         function skinclonetype($skin, $newid, $type)\r
3819         {\r
3820                 $newid = intval($newid);\r
3821                 $content = $skin->getContent($type);\r
3822                 \r
3823                 if ( $content )\r
3824                 {\r
3825                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
3826                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
3827                         sql_query($query);\r
3828                 }\r
3829                 return;\r
3830         }\r
3831         \r
3832         /**\r
3833          * @todo document this\r
3834          */\r
3835         function action_adminskinoverview() {\r
3836                 global $member, $manager;\r
3837 \r
3838                 $member->isAdmin() or $this->disallow();\r
3839 \r
3840                 $this->pagehead();\r
3841                 $this->parse('adminskinoverview');\r
3842                 $this->pagefoot();\r
3843         }\r
3844 \r
3845         /**\r
3846          * @todo document this\r
3847          */\r
3848         function action_adminskinnew()\r
3849         {\r
3850                 global $member;\r
3851                 $member->isAdmin() or $this->disallow();\r
3852                 $name = trim(postVar('name'));\r
3853                 $desc = trim(postVar('desc'));\r
3854 \r
3855                 if (!isValidSkinName($name)) {\r
3856                         $this->error(_ERROR_BADSKINNAME);\r
3857                 }\r
3858                 if (SkinSKIN::exists($name)) {\r
3859                         $this->error(_ERROR_DUPSKINNAME);\r
3860                 }\r
3861                 $newId = Skin::createNew($name, $desc);\r
3862                 $this->action_adminskinoverview();\r
3863         }\r
3864 \r
3865         /**\r
3866          * @todo document this\r
3867          */\r
3868         function action_adminskinedit()\r
3869         {\r
3870                 global $member, $manager;\r
3871 \r
3872                 $member->isAdmin() or $this->disallow();\r
3873                 $this->pagehead();\r
3874                 $this->parse('adminskinedit');\r
3875                 $this->pagefoot();\r
3876         }\r
3877 \r
3878         /**\r
3879          * @todo document this\r
3880          */\r
3881         function action_adminskineditgeneral()\r
3882         {\r
3883                 global $member;\r
3884 \r
3885                 $skinid = intRequestVar('skinid');\r
3886 \r
3887                 $member->isAdmin() or $this->disallow();\r
3888 \r
3889                 $name       = postVar('name');\r
3890                 $desc       = postVar('desc');\r
3891                 $type       = postVar('type');\r
3892                 $inc_mode   = postVar('inc_mode');\r
3893                 $inc_prefix = postVar('inc_prefix');\r
3894 \r
3895                 $skin = new Skin($skinid);\r
3896 \r
3897                 // 1. Some checks\r
3898                 if (!isValidSkinName($name)) {\r
3899                         $this->error(_ERROR_BADSKINNAME);\r
3900                 }\r
3901                 if (($skin->getName() != $name) && Skin::exists($name)) {\r
3902                         $this->error(_ERROR_DUPSKINNAME);\r
3903                 }\r
3904                 if (!$type) {\r
3905                         $type = 'text/html';\r
3906                 }\r
3907                 if (!$inc_mode) {\r
3908                         $inc_mode = 'normal';\r
3909                 }\r
3910                 // 2. Update description\r
3911                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3912                 $this->action_adminskinedit();\r
3913         }\r
3914 \r
3915         /**\r
3916          * @todo document this\r
3917          */\r
3918         function action_adminskinedittype($msg = '')\r
3919         {\r
3920                 global $member, $manager;\r
3921 \r
3922                 $member->isAdmin() or $this->disallow();\r
3923                 if ($msg) {\r
3924                         $this->headMess = $msg;\r
3925                 }\r
3926                 $type = requestVar('type');\r
3927                 $type = trim($type);\r
3928                 $type = strtolower($type);\r
3929                 if (!isValidShortName($type)) {\r
3930                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3931                 }\r
3932                 $this->pagehead();\r
3933                 $this->parse('adminskinedittype');\r
3934                 $this->pagefoot();\r
3935         }\r
3936 \r
3937         /**\r
3938          * @todo document this\r
3939          */\r
3940         function action_adminskinupdate()\r
3941         {\r
3942                 global $member;\r
3943                 $skinid  = intRequestVar('skinid');\r
3944                 $content = trim(postVar('content'));\r
3945                 $type    = postVar('type');\r
3946 \r
3947                 $member->isAdmin() or $this->disallow();\r
3948 \r
3949                 $skin = new Skin($skinid);\r
3950                 $skin->update($type, $content);\r
3951                 $this->action_adminskinedittype(_SKIN_UPDATED);\r
3952         }\r
3953 \r
3954         /**\r
3955          * @todo document this\r
3956          */\r
3957         function action_adminskindelete()\r
3958         {\r
3959                 global $member, $manager, $CONF;\r
3960                 $member->isAdmin() or $this->disallow();\r
3961                 $skinid = intRequestVar('skinid');\r
3962                 $this->pagehead();\r
3963                 $this->parse('adminskindelete');\r
3964                 $this->pagefoot();\r
3965         }\r
3966 \r
3967         /**\r
3968          * @todo document this\r
3969          */\r
3970         function action_adminskindeleteconfirm()\r
3971         {\r
3972                 global $member, $CONF, $manager;\r
3973                 $member->isAdmin() or $this->disallow();\r
3974                 $skinid = intRequestVar('skinid');\r
3975                 // don't allow default skin to be deleted\r
3976                 if ($skinid == $CONF['DefaultAdminSkin']) {\r
3977                         $this->error(_ERROR_DEFAULTSKIN);\r
3978                 }\r
3979                 // don't allow deletion of default skins for members\r
3980                 $memberDefaults =  $member->getAdminSkin();\r
3981                 foreach ($memberDefaults as $memID => $adminskin) {\r
3982                         if ($skinid == $adminskin) {\r
3983                                 $mem = MEMBER::createFromID($memID);\r
3984                                 $this->error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
3985                         }\r
3986                 }\r
3987                 $manager->notify(\r
3988                         'PreDeleteAdminSkin',\r
3989                         array(\r
3990                                 'skinid' => intval($skinid)\r
3991                         )\r
3992                 );\r
3993                 $query = 'DELETE FROM %s WHERE %s = ' . intval($skinid);\r
3994                 // 1. delete description\r
3995                 sql_query(sprintf($query, sql_table('adminskin_desc'), 'sdnumber'));\r
3996                 // 2. delete parts\r
3997                 sql_query(sprintf($query, sql_table('adminskin'), 'sdesc'));\r
3998                 $manager->notify(\r
3999                         'PostDeleteAdminSkin',\r
4000                         array(\r
4001                                 'skinid' => intval($skinid)\r
4002                         )\r
4003                 );\r
4004                 $this->action_adminskinoverview();\r
4005         }\r
4006 \r
4007         /**\r
4008          * @todo document this\r
4009          */\r
4010         function action_adminskinremovetype()\r
4011         {\r
4012                 global $member, $manager, $CONF;\r
4013 \r
4014                 $member->isAdmin() or $this->disallow();\r
4015                 $skinid   = intRequestVar('skinid');\r
4016                 $skintype = requestVar('type');\r
4017                 if (!isValidShortName($skintype)) {\r
4018                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4019                 }\r
4020                 $this->pagehead();\r
4021                 $this->parse('adminskinremovetype');\r
4022                 $this->pagefoot();\r
4023         }\r
4024 \r
4025         /**\r
4026          * @todo document this\r
4027          */\r
4028         function action_adminskinremovetypeconfirm()\r
4029         {\r
4030                 global $member, $CONF, $manager;\r
4031 \r
4032                 $member->isAdmin() or $this->disallow();\r
4033                 $skinid   = intRequestVar('skinid');\r
4034                 $skintype = requestVar('type');\r
4035                 if (!isValidShortName($skintype)) {\r
4036                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4037                 }\r
4038                 $manager->notify(\r
4039                         'PreDeleteAdminSkinPart',\r
4040                         array(\r
4041                                 'skinid'   => $skinid,\r
4042                                 'skintype' => $skintype\r
4043                         )\r
4044                 );\r
4045                 // delete part\r
4046                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4047                 sql_query(sprintf($query, sql_table('adminskin'), intval($skinid), $skintype ));\r
4048                 $manager->notify(\r
4049                         'PostDeleteAdminSkinPart',\r
4050                         array(\r
4051                                 'skinid'   => $skinid,\r
4052                                 'skintype' => $skintype\r
4053                         )\r
4054                 );\r
4055                 $this->action_adminskinedit();\r
4056         }\r
4057 \r
4058         /**\r
4059          * @todo document this\r
4060          */\r
4061         function action_adminskinclone()\r
4062         {\r
4063                 global $member;\r
4064                 $member->isAdmin() or $this->disallow();\r
4065                 $skinid = intRequestVar('skinid');\r
4066                 // 1. read skin to clone\r
4067                 $skin = new Skin($skinid);\r
4068                 $name = "clone_" . $skin->getName();\r
4069                 // if a skin with that name already exists:\r
4070                 if (Skin::exists($name)) {\r
4071                         $i = 1;\r
4072                         while (Skin::exists($name . $i)) {\r
4073                                 $i++;\r
4074                         }\r
4075                         $name .= $i;\r
4076                 }\r
4077                 // 2. create skin desc\r
4078                 $newid = Skin::createNew(\r
4079                         $name,\r
4080                         $skin->getDescription(),\r
4081                         $skin->getContentType(),\r
4082                         $skin->getIncludeMode(),\r
4083                         $skin->getIncludePrefix()\r
4084                 );\r
4085                 $query = 'SELECT '\r
4086                                 . '    stype '\r
4087                                 . 'FROM '\r
4088                                 .      sql_table('adminskin') . ' '\r
4089                                 . 'WHERE '\r
4090                                 . '    sdesc = ' . $skinid;\r
4091                 $res   = sql_query($query);\r
4092                 while ($row = sql_fetch_assoc($res)) {\r
4093                         $this->adminskinclonetype($skin, $newid, $row['stype']);\r
4094                 }\r
4095                 $this->action_adminskinoverview();\r
4096         }\r
4097 \r
4098         /**\r
4099          * @todo document this\r
4100          */\r
4101         function adminskinclonetype($skin, $newid, $type)\r
4102         {\r
4103                 $newid   = intval($newid);\r
4104                 $content = $skin->getContent($type);\r
4105                 if ($content) {\r
4106                         $query = 'INSERT '\r
4107                                         . 'INTO '\r
4108                                         .      sql_table('adminskin') . ' '\r
4109                                         . '('\r
4110                                         . '    sdesc, '\r
4111                                         . '    scontent, '\r
4112                                         . '    stype'\r
4113                                         . ') VALUES ('\r
4114                                         .      intval($newid) . ', '\r
4115                                         . '"' . sql_real_escape_string($content) . '", '\r
4116                                         . '"' . sql_real_escape_string($type) . '" '\r
4117                                         . ')';\r
4118                         sql_query($query);\r
4119                 }\r
4120         }\r
4121 \r
4122         /**\r
4123          * @todo document this\r
4124          */\r
4125         function action_adminskinieoverview()\r
4126         {\r
4127                 global $member, $DIR_LIBS, $manager;\r
4128                 $member->isAdmin() or $this->disallow();\r
4129                 // load skinie class\r
4130                 include_once($DIR_LIBS . 'skinie.php');\r
4131                 $this->pagehead();\r
4132                 $this->parse('adminskinieoverview');\r
4133                 $this->pagefoot();\r
4134 \r
4135         }\r
4136 \r
4137         /**\r
4138          * @todo document this\r
4139          */\r
4140         function action_adminskinieimport()\r
4141         {\r
4142                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4143                 $member->isAdmin() or $this->disallow();\r
4144                 // load skinie class\r
4145                 include_once($DIR_LIBS . 'skinie.php');\r
4146                 $skinFileRaw= postVar('skinfile');\r
4147                 $mode       = postVar('mode');\r
4148                 $importer   = new SKINIMPORT();\r
4149                 // get full filename\r
4150                 if ($mode == 'file') {\r
4151                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4152                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4153                         if (!file_exists($skinFile)) {\r
4154                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4155                         }\r
4156                 } else {\r
4157                         $skinFile = $skinFileRaw;\r
4158                 }\r
4159                 // read only metadata\r
4160                 $error = $importer->readFile($skinFile, 1);\r
4161                 if ($error) {\r
4162                         $this->error($error);\r
4163                 }\r
4164 \r
4165                 $_REQUEST['skininfo']  = $importer->getInfo();\r
4166                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
4167                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
4168 \r
4169                 // clashes\r
4170                 $skinNameClashes         = $importer->checkSkinNameClashes();\r
4171                 $templateNameClashes     = $importer->checkTemplateNameClashes();\r
4172                 $hasNameClashes          = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4173                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
4174                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
4175                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
4176 \r
4177                 $this->pagehead();\r
4178                 $this->parse('adminskinieimport');\r
4179                 $this->pagefoot();\r
4180         }\r
4181 \r
4182         /**\r
4183          * @todo document this\r
4184          */\r
4185         function action_adminskiniedoimport()\r
4186         {\r
4187                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4188                 $member->isAdmin() or $this->disallow();\r
4189                 // load skinie class\r
4190                 include_once($DIR_LIBS . 'skinie.php');\r
4191                 $skinFileRaw    = postVar('skinfile');\r
4192                 $mode           = postVar('mode');\r
4193                 $allowOverwrite = intPostVar('overwrite');\r
4194                 // get full filename\r
4195                 if ($mode == 'file') {\r
4196                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4197                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4198                         if (!file_exists($skinFile)) {\r
4199                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4200                         }\r
4201                 } else {\r
4202                         $skinFile = $skinFileRaw;\r
4203                 }\r
4204                 $importer = new SKINIMPORT();\r
4205                 $error    = $importer->readFile($skinFile);\r
4206                 if ($error) {\r
4207                         $this->error($error);\r
4208                 }\r
4209                 $error = $importer->writeToDatabase($allowOverwrite);\r
4210                 if ($error) {\r
4211                         $this->error($error);\r
4212                 }\r
4213 \r
4214                 $_REQUEST['skininfo']  = $importer->getInfo();\r
4215                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
4216                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
4217 \r
4218                 $this->pagehead();\r
4219                 $this->parse('adminskiniedoimport');\r
4220                 $this->pagefoot();\r
4221 \r
4222         }\r
4223 \r
4224         /**\r
4225          * @todo document this\r
4226          */\r
4227         function action_adminskinieexport()\r
4228         {\r
4229                 global $member, $DIR_PLUGINS;\r
4230                 $member->isAdmin() or $this->disallow();\r
4231                 // load skinie class\r
4232                 $aSkins     = requestIntArray('skin');\r
4233                 $aTemplates = requestIntArray('template');\r
4234                 if (!is_array($aTemplates)) {\r
4235                         $aTemplates = array();\r
4236                 }\r
4237                 if (!is_array($aSkins)) {\r
4238                         $aSkins = array();\r
4239                 }\r
4240                 $skinList     = array_keys($aSkins);\r
4241                 $templateList = array_keys($aTemplates);\r
4242 \r
4243                 $info = postVar('info');\r
4244 \r
4245                 $exporter = new SkinEXPORT();\r
4246                 foreach ($skinList as $skinId) {\r
4247                         $exporter->addSkin($skinId);\r
4248                 }\r
4249                 foreach ($templateList as $templateId) {\r
4250                         $exporter->addTemplate($templateId);\r
4251                 }\r
4252                 $exporter->setInfo($info);\r
4253                 $exporter->export();\r
4254                 \r
4255         }\r
4256 \r
4257         /**\r
4258          * Admin::action_settingsedit()\r
4259          * \r
4260          * @param       Void\r
4261          * @return      Void\r
4262          */\r
4263         function action_settingsedit() {\r
4264                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4265 \r
4266                 $member->isAdmin() or $this->disallow();\r
4267 \r
4268                 $this->pagehead();\r
4269                 $this->parse('settingsedit');\r
4270                 $this->pagefoot();\r
4271         }\r
4272         \r
4273         /**\r
4274          * Admin::action_settingsupdate()\r
4275          * Update $CONFIG and redirect\r
4276          * \r
4277          * @param       void\r
4278          * @return      void\r
4279          */\r
4280         function action_settingsupdate() {\r
4281                 global $member, $CONF;\r
4282                 \r
4283                 $member->isAdmin() or $this->disallow();\r
4284                 \r
4285                 // check if email address for admin is valid\r
4286                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4287                 {\r
4288                         $this->error(_ERROR_BADMAILADDRESS);\r
4289                 }\r
4290                 \r
4291                 // save settings\r
4292                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));\r
4293                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));\r
4294                 $this->updateConfig('IndexURL',          postVar('IndexURL'));\r
4295                 $this->updateConfig('AdminURL',          postVar('AdminURL'));\r
4296                 $this->updateConfig('PluginURL',                postVar('PluginURL'));\r
4297                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));\r
4298                 $this->updateConfig('ActionURL',                postVar('ActionURL'));\r
4299                 $this->updateConfig('Locale',              postVar('Locale'));\r
4300                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));\r
4301                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));\r
4302                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));\r
4303                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));\r
4304                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));\r
4305                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));\r
4306                 $this->updateConfig('SiteName',          postVar('SiteName'));\r
4307                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));\r
4308                 $this->updateConfig('DisableSite',        postVar('DisableSite'));\r
4309                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));\r
4310                 $this->updateConfig('LastVisit',                postVar('LastVisit'));\r
4311                 $this->updateConfig('MediaURL',          postVar('MediaURL'));\r
4312                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));\r
4313                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));\r
4314                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));\r
4315                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));\r
4316                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));\r
4317                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));\r
4318                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));\r
4319                 $this->updateConfig('CookiePath',          postVar('CookiePath'));\r
4320                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));\r
4321                 $this->updateConfig('URLMode',            postVar('URLMode'));\r
4322                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));\r
4323                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));\r
4324                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));\r
4325                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));\r
4326                 \r
4327                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4328                 // note that when changing cookie settings, this redirect might cause the user\r
4329                 // to have to log in again.\r
4330                 getConfig();\r
4331                 redirect($CONF['AdminURL'] . '?action=manage');\r
4332                 exit;\r
4333         }\r
4334 \r
4335         /**\r
4336          * Admin::action_systemoverview()\r
4337          * Output system overview\r
4338          * \r
4339          * @param       void\r
4340          * @return      void\r
4341          */\r
4342         function action_systemoverview()\r
4343         {\r
4344                 $this->pagehead();\r
4345                 $this->parse('systemoverview');\r
4346                 $this->pagefoot();\r
4347         }\r
4348 \r
4349         /**\r
4350          * Admin::updateConfig()\r
4351          * \r
4352          * @param       string  $name   \r
4353          * @param       string  $val    \r
4354          * @return      integer return the ID in which the latest query posted\r
4355          */\r
4356         function updateConfig($name, $val)\r
4357         {\r
4358                 $name = sql_real_escape_string($name);\r
4359                 $val = trim(sql_real_escape_string($val));\r
4360                 \r
4361                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4362                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4363 //              sql_query($query) or die("Query error: " . sql_error());\r
4364         sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4365                 return sql_insert_id();\r
4366         }\r
4367         \r
4368         /**\r
4369          * Error message\r
4370          * @param string $msg message that will be shown\r
4371          */\r
4372         function error($msg)\r
4373         {\r
4374                 $this->pagehead();\r
4375                 $this->parse('adminerrorpage');\r
4376                 $this->pagefoot();\r
4377                 exit;\r
4378         }\r
4379         \r
4380         /**\r
4381          * Admin::disallow()\r
4382          * add error log and show error page \r
4383          * \r
4384          * @param       void\r
4385          * @return      void\r
4386          */\r
4387         function disallow()\r
4388         {\r
4389                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4390                 $this->error(_ERROR_DISALLOWED);\r
4391         }\r
4392         \r
4393         /**\r
4394          * Admin::pagehead()\r
4395          * Output admin page head\r
4396          * \r
4397          * @param       void\r
4398          * @return      void\r
4399          */\r
4400         function pagehead($extrahead = '')\r
4401         {\r
4402                 if ( $this->existsSkinContents('pagehead') )\r
4403                 {\r
4404                         if ( isset($extrahead) && !empty($extrahead) )\r
4405                         {\r
4406                         $this->extrahead = $extrahead;\r
4407                         }\r
4408                         $this->parse('pagehead');\r
4409                 }\r
4410                 else\r
4411                 {\r
4412                         global $member, $nucleus, $CONF, $manager;\r
4413                         \r
4414                         $manager->notify(\r
4415                                 'AdminPrePageHead',\r
4416                                 array(\r
4417                                         'extrahead' => &$extrahead,\r
4418                                         'action'    => $this->action\r
4419                                 )\r
4420                         );\r
4421                         \r
4422                         $baseUrl = Entity::hsc($CONF['AdminURL']);\r
4423                         if ( !array_key_exists('AdminCSS',$CONF) )\r
4424                         {\r
4425                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4426                                 $CONF['AdminCSS'] = 'original';\r
4427                         }\r
4428                         \r
4429                         /* HTTP 1.1 application for no caching */\r
4430                         header("Cache-Control: no-cache, must-revalidate");\r
4431                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4432                         \r
4433                         $root_element = 'html';\r
4434                         $charset = i18n::get_current_charset();\r
4435                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4436         \r
4437                         echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4438                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";\r
4439                         echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4440                         echo "<head>\n";\r
4441                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4442                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4443                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";\r
4444                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4445                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4446                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4447                         echo "{$extrahead}\n";\r
4448                         echo "</head>\n\n";\r
4449                         echo "<body>\n";\r
4450                         echo "<div id=\"adminwrapper\">\n";\r
4451                         echo "<div class=\"header\">\n";\r
4452                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4453                         echo "</div>\n";\r
4454                         echo "<div id=\"container\">\n";\r
4455                         echo "<div id=\"content\">\n";\r
4456                         echo "<div class=\"loginname\">\n";\r
4457                         if ( $member->isLoggedIn() )\r
4458                         {\r
4459                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4460                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4461                         }\r
4462                         else\r
4463                         {\r
4464                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4465                         }\r
4466                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4467                         echo '(';\r
4468                         \r
4469                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4470                         {\r
4471                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4472                         }\r
4473                         else\r
4474                         {\r
4475                                 $codenamestring = '';\r
4476                         }\r
4477                         \r
4478                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4479                         {\r
4480                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4481                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4482                                 \r
4483                                 $newestVersion = getLatestVersion();\r
4484                                 $newestCompare = str_replace('/','.',$newestVersion);\r
4485                                 $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);\r
4486                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4487                                 {\r
4488                                         echo "<br />\n";\r
4489                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4490                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4491                                         echo "</a>";\r
4492                                 }\r
4493                         }\r
4494                         else\r
4495                         {\r
4496                                 echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;\r
4497                         }\r
4498                         echo ')';\r
4499                         echo '</div>';\r
4500                 }\r
4501                 return;\r
4502         }\r
4503         \r
4504         /**\r
4505          * Admin::pagefoot()\r
4506          * Output admin page foot include quickmenu\r
4507          * \r
4508          * @param       void\r
4509          * @return      void\r
4510          */\r
4511         function pagefoot()\r
4512         {\r
4513                 if ($this->existsSkinContents('pagefoot')) {\r
4514                         $this->parse('pagefoot');\r
4515                         exit;\r
4516                 }\r
4517                 else\r
4518                 {\r
4519                         global $action, $member, $manager;\r
4520                         \r
4521                         $manager->notify(\r
4522                                 'AdminPrePageFoot',\r
4523                                 array(\r
4524                                         'action' => $this->action\r
4525                                 )\r
4526                         );\r
4527                         \r
4528                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4529                         {\r
4530                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4531                                 echo "<ul>\n";\r
4532                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4533                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4534                                 echo "</ul>\n";\r
4535                         }\r
4536                         \r
4537                         echo "<div class=\"foot\">\n";\r
4538                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4539                         echo '-';\r
4540                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4541                         echo "</div>\n";\r
4542                         \r
4543                         echo "<!-- content -->\n";\r
4544                         echo "<div id=\"quickmenu\">\n";\r
4545                         \r
4546                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4547                         {\r
4548                                 echo "<ul>\n";\r
4549                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4550                                 echo "</ul>\n";\r
4551                                 \r
4552                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4553                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4554                                 echo "<p>\n";\r
4555                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4556                                 \r
4557                                 $showAll = requestVar('showall');\r
4558                                 \r
4559                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4560                                 {\r
4561                                         // Super-Admins have access to all blogs! (no add item support though)\r
4562                                         $query =  'SELECT bnumber as value, bname as text'\r
4563                                                         . ' FROM ' . sql_table('blog')\r
4564                                                         . ' ORDER BY bname';\r
4565                                 }\r
4566                                 else\r
4567                                 {\r
4568                                         $query =  'SELECT bnumber as value, bname as text'\r
4569                                                         . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')\r
4570                                                         . ' WHERE tblog=bnumber and tmember=' . $member->getID()\r
4571                                                         . ' ORDER BY bname';\r
4572                                 }\r
4573                                 $template['name'] = 'blogid';\r
4574                                 $template['tabindex'] = 15000;\r
4575                                 $template['extra'] = _QMENU_ADD_SELECT;\r
4576                                 $template['selected'] = -1;\r
4577                                 $template['shorten'] = 10;\r
4578                                 $template['shortenel'] = '';\r
4579                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4580                                 showlist($query,'select',$template);\r
4581                                 \r
4582                                 echo "</p>\n";\r
4583                                 echo "</form>\n";\r
4584                                 \r
4585                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4586                                 echo "<ul>\n";\r
4587                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4588                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4589                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4590                                 echo "</ul>\n";\r
4591                                 \r
4592                                 // ---- general settings ----\r
4593                                 if ( $member->isAdmin() )\r
4594                                 {\r
4595                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4596                                         echo "<ul>\n";\r
4597                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4598                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4599                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4600                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4601                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4602                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4603                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4604                                         echo "</ul>\n";\r
4605                                         \r
4606                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4607                                         echo "<ul>\n";\r
4608                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4609                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4610                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4611                                         echo "</ul>\n";\r
4612                                 }\r
4613                                 \r
4614                                 $aPluginExtras = array();\r
4615                                 $manager->notify(\r
4616                                         'QuickMenu',\r
4617                                         array(\r
4618                                                 'options' => &$aPluginExtras));\r
4619                                 \r
4620                                 if ( count($aPluginExtras) > 0 )\r
4621                                 {\r
4622                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4623                                         echo "<ul>\n";\r
4624                                         foreach ( $aPluginExtras as $aInfo )\r
4625                                         {\r
4626                                                 echo '<li><a href="' . Entity::hsc($aInfo['url']) . '" title="' . Entity::hsc($aInfo['tooltip']) . '">' . Entity::hsc($aInfo['title']) . "</a></li>\n";\r
4627                                         }\r
4628                                         echo "</ul>\n";\r
4629                                 }\r
4630                         }\r
4631                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
4632                         {\r
4633                         \r
4634                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
4635                         }\r
4636                         else\r
4637                         {\r
4638                                 // introduction text on login screen\r
4639                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
4640                         }\r
4641                         \r
4642                         echo "<!-- quickmenu -->\n";\r
4643                         echo "</div>\n";\r
4644                         \r
4645                         echo "<!-- content -->\n";\r
4646                         echo "</div>\n";\r
4647                         \r
4648                         echo "<!-- container -->\n";\r
4649                         echo "</div>\n";\r
4650                         \r
4651                         echo "<!-- adminwrapper -->\n";\r
4652                         echo "</div>\n";\r
4653                         \r
4654                         echo "</body>\n";\r
4655                         echo "</html>\n";\r
4656                 }\r
4657                 return;\r
4658         }\r
4659         \r
4660         /**\r
4661          * @todo document this\r
4662          */\r
4663         function action_regfile()\r
4664         {\r
4665                 global $member, $CONF;\r
4666 \r
4667                 $blogid = intRequestVar('blogid');\r
4668 \r
4669                 $member->teamRights($blogid) or $this->disallow();\r
4670 \r
4671                 // header-code stolen from phpMyAdmin\r
4672                 // REGEDIT and bookmarklet code stolen from GreyMatter\r
4673 \r
4674                 $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));\r
4675 \r
4676 \r
4677                 header('Content-Type: application/octetstream');\r
4678                 header('Content-Disposition: filename="nucleus.reg"');\r
4679                 header('Pragma: no-cache');\r
4680                 header('Expires: 0');\r
4681 \r
4682                 echo "REGEDIT4\n";\r
4683                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";\r
4684                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";\r
4685                 echo '"contexts"=hex:31';\r
4686         }\r
4687 \r
4688         /**\r
4689          * @todo document this\r
4690          */\r
4691         function action_bookmarklet()\r
4692         {\r
4693                 global $member, $manager;\r
4694 \r
4695                 $member->teamRights($blogid) or $this->disallow();\r
4696 \r
4697                 $blogid = intRequestVar('blogid');\r
4698 \r
4699                 $this->pagehead();\r
4700                 $this->parse('bookmarklet');\r
4701                 $this->pagefoot();\r
4702 \r
4703         }\r
4704 \r
4705         /**\r
4706          * @todo document this\r
4707          */\r
4708         function action_actionlog()\r
4709         {\r
4710                 global $member, $manager;\r
4711 \r
4712                 $member->isAdmin() or $this->disallow();\r
4713 \r
4714                 $this->pagehead();\r
4715                 $this->parse('actionlog');\r
4716                 $this->pagefoot();\r
4717 \r
4718         }\r
4719 \r
4720         /**\r
4721          * @todo document this\r
4722          */\r
4723         function action_banlist() {\r
4724                 global $member, $manager;\r
4725 \r
4726                 $member->blogAdminRights($blogid) or $this->disallow();\r
4727 \r
4728                 $blogid = intRequestVar('blogid');\r
4729 \r
4730                 $this->pagehead();\r
4731                 $this->parse('banlist');\r
4732                 $this->pagefoot();\r
4733 \r
4734         }\r
4735 \r
4736         /**\r
4737          * @todo document this\r
4738          */\r
4739         function action_banlistdelete() {\r
4740                 global $member, $manager;\r
4741 \r
4742                 $blogid = intRequestVar('blogid');\r
4743                 $member->blogAdminRights($blogid) or $this->disallow();\r
4744 \r
4745                 $this->pagehead();\r
4746                 $this->parse('banlistdelete');\r
4747                 $this->pagefoot();\r
4748         }\r
4749 \r
4750         /**\r
4751          * @todo document this\r
4752          */\r
4753         function action_banlistdeleteconfirm()\r
4754         {\r
4755                 global $member, $manager;\r
4756 \r
4757                 $member->blogAdminRights($blogid) or $this->disallow();\r
4758 \r
4759                 $blogid = intPostVar('blogid');\r
4760                 $allblogs = postVar('allblogs');\r
4761                 $iprange = postVar('iprange');\r
4762 \r
4763                 $deleted = array();\r
4764 \r
4765                 if ( !$allblogs )\r
4766                 {\r
4767                         if ( Ban::removeBan($blogid, $iprange) )\r
4768                         {\r
4769                                 array_push($deleted, $blogid);\r
4770                         }\r
4771                 }\r
4772                 else\r
4773                 {\r
4774                         // get blogs fot which member has admin rights\r
4775                         $adminblogs = $member->getAdminBlogs();\r
4776                         foreach ($adminblogs as $blogje)\r
4777                         {\r
4778                                 if ( Ban::removeBan($blogje, $iprange) )\r
4779                                 {\r
4780                                         array_push($deleted, $blogje);\r
4781                                 }\r
4782                         }\r
4783                 }\r
4784 \r
4785                 if ( sizeof($deleted) == 0 )\r
4786                 {\r
4787                         $this->error(_ERROR_DELETEBAN);\r
4788                 }\r
4789 \r
4790                 $this->pagehead();\r
4791                 $this->parse('banlistdeleteconfirm');\r
4792                 $this->pagefoot();\r
4793 \r
4794         }\r
4795 \r
4796         /**\r
4797          * @todo document this\r
4798          */\r
4799         function action_banlistnewfromitem()\r
4800         {\r
4801                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
4802         }\r
4803 \r
4804         /**\r
4805          * @todo document this\r
4806          */\r
4807         function action_banlistnew($blogid = '')\r
4808         {\r
4809                 global $member, $manager;\r
4810 \r
4811                 if ( $blogid == '' )\r
4812                 {\r
4813                         $blogid = intRequestVar('blogid');\r
4814                 }\r
4815 \r
4816                 $ip = requestVar('ip');\r
4817 \r
4818                 $member->blogAdminRights($blogid) or $this->disallow();\r
4819 \r
4820                 $_REQUEST['blogid'] = $blogid;          \r
4821 \r
4822                 $this->pagehead();\r
4823                 $this->parse('banlistnew');\r
4824                 $this->pagefoot();\r
4825         }\r
4826 \r
4827         /**\r
4828          * @todo document this\r
4829          */\r
4830         function action_banlistadd() {\r
4831                 global $member;\r
4832 \r
4833                 $blogid   = intPostVar('blogid');\r
4834                 $allblogs = postVar('allblogs');\r
4835                 $iprange  = postVar('iprange');\r
4836                 if ( $iprange == "custom" )\r
4837                 {\r
4838                         $iprange = postVar('customiprange');\r
4839                 }\r
4840                 $reason   = postVar('reason');\r
4841 \r
4842                 $member->blogAdminRights($blogid) or $this->disallow();\r
4843 \r
4844                 // TODO: check IP range validity\r
4845 \r
4846                 if ( !$allblogs )\r
4847                 {\r
4848                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4849                         {\r
4850                                 $this->error(_ERROR_ADDBAN);\r
4851                         }\r
4852                 }\r
4853                 else\r
4854                 {\r
4855                         // get blogs fot which member has admin rights\r
4856                         $adminblogs = $member->getAdminBlogs();\r
4857                         $failed = 0;\r
4858                         foreach ($adminblogs as $blogje)\r
4859                         {\r
4860                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4861                                 {\r
4862                                         $failed = 1;\r
4863                                 }\r
4864                         }\r
4865                         if ( $failed )\r
4866                         {\r
4867                                 $this->error(_ERROR_ADDBAN);\r
4868                         }\r
4869                 }\r
4870                 $this->action_banlist();\r
4871         }\r
4872 \r
4873         /**\r
4874          * @todo document this\r
4875          */\r
4876         function action_clearactionlog()\r
4877         {\r
4878                 global $member;\r
4879 \r
4880                 $member->isAdmin() or $this->disallow();\r
4881 \r
4882                 ActionLog::clear();\r
4883 \r
4884                 $this->action_manage(_MSG_ACTIONLOGCLEARED);\r
4885         }\r
4886 \r
4887         /**\r
4888          * @todo document this\r
4889          */\r
4890         function action_backupoverview()\r
4891         {\r
4892                 global $member, $manager;\r
4893 \r
4894                 $member->isAdmin() or $this->disallow();\r
4895 \r
4896                 $this->pagehead();\r
4897                 $this->parse('backupoverview');\r
4898                 $this->pagefoot();\r
4899         }\r
4900 \r
4901         /**\r
4902          * Admin::action_backupcreate()\r
4903          * create file for backup\r
4904          * \r
4905          * @param               void\r
4906          * @return      void\r
4907          * \r
4908          */\r
4909         function action_backupcreate()\r
4910         {\r
4911                 global $member, $DIR_LIBS;\r
4912                 \r
4913                 $member->isAdmin() or $this->disallow();\r
4914                 \r
4915                 // use compression ?\r
4916                 $useGzip = (integer) postVar('gzip');\r
4917                 \r
4918                 include($DIR_LIBS . 'backup.php');\r
4919                 \r
4920                 // try to extend time limit\r
4921                 // (creating/restoring dumps might take a while)\r
4922                 @set_time_limit(1200);\r
4923                 \r
4924                 Backup::do_backup($useGzip);\r
4925                 exit;\r
4926         }\r
4927         \r
4928         /**\r
4929          * Admin::action_backuprestore()\r
4930          * restoring from uploaded file\r
4931          * \r
4932          * @param               void\r
4933          * @return      void\r
4934          */\r
4935         function action_backuprestore()\r
4936         {\r
4937                 global $member, $DIR_LIBS;\r
4938                 \r
4939                 $member->isAdmin() or $this->disallow();\r
4940                 \r
4941                 if ( intPostVar('letsgo') != 1 )\r
4942                 {\r
4943                         $this->error(_ERROR_BACKUP_NOTSURE);\r
4944                 }\r
4945                 \r
4946                 include($DIR_LIBS . 'backup.php');\r
4947                 \r
4948                 // try to extend time limit\r
4949                 // (creating/restoring dumps might take a while)\r
4950                 @set_time_limit(1200);\r
4951                 \r
4952                 $message = Backup::do_restore();\r
4953                 if ( $message != '' )\r
4954                 {\r
4955                         $this->error($message);\r
4956                 }\r
4957                 $this->pagehead();\r
4958                 $this->parse('backuprestore');\r
4959                 $this->pagefoot();\r
4960                 return;\r
4961         }\r
4962         \r
4963         /**\r
4964          * Admin::action_pluginlist()\r
4965          * output the list of installed plugins\r
4966          * \r
4967          * @param       void\r
4968          * @return      void\r
4969          * \r
4970          */\r
4971         function action_pluginlist()\r
4972         {\r
4973                 global $DIR_PLUGINS, $member, $manager;\r
4974                 \r
4975                 // check if allowed\r
4976                 $member->isAdmin() or $this->disallow();\r
4977                 \r
4978                 $this->pagehead();\r
4979                 $this->parse('pluginlist');\r
4980                 $this->pagefoot();\r
4981                 return;\r
4982         }\r
4983         \r
4984         /**\r
4985          * @todo document this\r
4986          */\r
4987         function action_pluginhelp()\r
4988         {\r
4989                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
4990 \r
4991                 // check if allowed\r
4992                 $member->isAdmin() or $this->disallow();\r
4993 \r
4994                 $plugid = intGetVar('plugid');\r
4995 \r
4996                 if ( !$manager->pidInstalled($plugid) )\r
4997                 {\r
4998                         $this->error(_ERROR_NOSUCHPLUGIN);\r
4999                 }\r
5000 \r
5001                 $this->pagehead();\r
5002                 $this->parse('pluginhelp');\r
5003                 $this->pagefoot();\r
5004         }\r
5005 \r
5006         /**\r
5007          * Admin::action_pluginadd()\r
5008          * \r
5009          * @param       Void\r
5010          * @return      Void\r
5011          * \r
5012          */\r
5013         function action_pluginadd()\r
5014         {\r
5015                 global $member, $manager, $DIR_PLUGINS;\r
5016                 \r
5017                 // check if allowed\r
5018                 $member->isAdmin() or $this->disallow();\r
5019                 \r
5020                 $name = postVar('filename');\r
5021                 \r
5022                 if ( $manager->pluginInstalled($name) )\r
5023                 {\r
5024                         $this->error(_ERROR_DUPPLUGIN);\r
5025                 }\r
5026                 \r
5027                 if ( !checkPlugin($name) )\r
5028                 {\r
5029                         $this->error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5030                 }\r
5031                 \r
5032                 // get number of currently installed plugins\r
5033                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5034                 $numCurrent = sql_num_rows($res);\r
5035                 \r
5036                 // plugin will be added as last one in the list\r
5037                 $newOrder = $numCurrent + 1;\r
5038                 \r
5039                 $manager->notify(\r
5040                         'PreAddPlugin',\r
5041                         array(\r
5042                                 'file' => &$name\r
5043                         )\r
5044                 );\r
5045                 \r
5046                 // do this before calling getPlugin (in case the plugin id is used there)\r
5047                 $query = 'INSERT INTO '\r
5048                            .      sql_table('plugin')\r
5049                            . ' ('\r
5050                            . '    porder,'\r
5051                            . '    pfile'\r
5052                            . ') VALUES ('\r
5053                            .      $newOrder . ','\r
5054                            . '"' . sql_real_escape_string($name) . '"'\r
5055                            . ')';\r
5056                 sql_query($query);\r
5057                 $iPid = sql_insert_id();\r
5058                 \r
5059                 $manager->clearCachedInfo('installedPlugins');\r
5060                 \r
5061                 // Load the plugin for condition checking and instalation\r
5062                 $plugin =& $manager->getPlugin($name);\r
5063                 \r
5064                 // check if it got loaded (could have failed)\r
5065                 if ( !$plugin )\r
5066                 {\r
5067                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));\r
5068                         $manager->clearCachedInfo('installedPlugins');\r
5069                         $this->error(_ERROR_PLUGIN_LOAD);\r
5070                 }\r
5071                 \r
5072                 // check if plugin needs a newer Nucleus version\r
5073                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5074                 {\r
5075                         // uninstall plugin again...\r
5076                         $this->deleteOnePlugin($plugin->getID());\r
5077                         \r
5078                         // ...and show error\r
5079                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5080                 }\r
5081                 \r
5082                 // check if plugin needs a newer Nucleus version\r
5083                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5084                 {\r
5085                         // uninstall plugin again...\r
5086                         $this->deleteOnePlugin($plugin->getID());\r
5087                         \r
5088                         // ...and show error\r
5089                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5090                 }\r
5091                 \r
5092                 $pluginList = $plugin->getPluginDep();\r
5093                 foreach ( $pluginList as $pluginName )\r
5094                 {\r
5095                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5096                         if (sql_num_rows($res) == 0)\r
5097                         {\r
5098                                 // uninstall plugin again...\r
5099                                 $this->deleteOnePlugin($plugin->getID());\r
5100                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5101                         }\r
5102                 }\r
5103                 \r
5104                 // call the install method of the plugin\r
5105                 $plugin->install();\r
5106                 \r
5107                 $manager->notify(\r
5108                         'PostAddPlugin',\r
5109                         array(\r
5110                                 'plugin' => &$plugin\r
5111                         )\r
5112                 );\r
5113                 \r
5114                 // update all events\r
5115                 $this->action_pluginupdate();\r
5116                 return;\r
5117         }\r
5118         \r
5119         /**\r
5120          * ADMIN:action_pluginupdate():\r
5121          * \r
5122          * @param       Void\r
5123          * @return      Void\r
5124          * \r
5125          */\r
5126         function action_pluginupdate()\r
5127         {\r
5128                 global $member, $manager, $CONF;\r
5129                 \r
5130                 // check if allowed\r
5131                 $member->isAdmin() or $this->disallow();\r
5132                 \r
5133                 // delete everything from plugin_events\r
5134                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5135                 \r
5136                 // loop over all installed plugins\r
5137                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5138                 while ( $o = sql_fetch_object($res) )\r
5139                 {\r
5140                         $pid  =  $o->pid;\r
5141                         $plug =& $manager->getPlugin($o->pfile);\r
5142                         if ( $plug )\r
5143                         {\r
5144                                 $eventList = $plug->getEventList();\r
5145                                 foreach ( $eventList as $eventName )\r
5146                                 {\r
5147                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5148                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5149                                         sql_query($query);\r
5150                                 }\r
5151                         }\r
5152                 }\r
5153                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5154                 return;\r
5155         }\r
5156         \r
5157         /**\r
5158          * @todo document this\r
5159          */\r
5160         function action_plugindelete()\r
5161         {\r
5162                 global $member, $manager;\r
5163 \r
5164                 // check if allowed\r
5165                 $member->isAdmin() or $this->disallow();\r
5166 \r
5167                 $pid = intGetVar('plugid');\r
5168 \r
5169                 if ( !$manager->pidInstalled($pid) )\r
5170                 {\r
5171                         $this->error(_ERROR_NOSUCHPLUGIN);\r
5172                 }\r
5173 \r
5174                 $this->pagehead();\r
5175                 $this->parse('plugindelete');\r
5176                 $this->pagefoot();\r
5177         }\r
5178 \r
5179         /**\r
5180          * @todo document this\r
5181          */\r
5182         function action_plugindeleteconfirm()\r
5183         {\r
5184                 global $member, $manager, $CONF;\r
5185 \r
5186                 // check if allowed\r
5187                 $member->isAdmin() or $this->disallow();\r
5188 \r
5189                 $pid = intPostVar('plugid');\r
5190 \r
5191                 $error = $this->deleteOnePlugin($pid, 1);\r
5192                 if ($error) {\r
5193                         $this->error($error);\r
5194                 }\r
5195 \r
5196                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5197 //              $this->action_pluginlist();\r
5198         }\r
5199 \r
5200         /**\r
5201          * @todo document this\r
5202          */\r
5203         function deleteOnePlugin($pid, $callUninstall = 0)\r
5204         {\r
5205                 global $manager;\r
5206 \r
5207                 $pid = intval($pid);\r
5208 \r
5209                 if ( !$manager->pidInstalled($pid) )\r
5210                 {\r
5211                         return _ERROR_NOSUCHPLUGIN;\r
5212                 }\r
5213 \r
5214                 $name = quickQuery('SELECT pfile as result FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5215 \r
5216 /*              // call the unInstall method of the plugin\r
5217                 if ($callUninstall) {\r
5218                         $plugin =& $manager->getPlugin($name);\r
5219                         if ($plugin) $plugin->unInstall();\r
5220                 }*/\r
5221 \r
5222                 // check dependency before delete\r
5223                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5224                 while ($o = sql_fetch_object($res))\r
5225                 {\r
5226                         $plug =& $manager->getPlugin($o->pfile);\r
5227                         if ($plug)\r
5228                         {\r
5229                                 $depList = $plug->getPluginDep();\r
5230                                 foreach ($depList as $depName)\r
5231                                 {\r
5232                                         if ($name == $depName)\r
5233                                         {\r
5234                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5235                                         }\r
5236                                 }\r
5237                         }\r
5238                 }\r
5239 \r
5240                 $manager->notify(\r
5241                         'PreDeletePlugin',\r
5242                         array(\r
5243                                 'plugid' => $pid\r
5244                         )\r
5245                 );\r
5246 \r
5247                 // call the unInstall method of the plugin\r
5248                 if ( $callUninstall )\r
5249                 {\r
5250                         $plugin =& $manager->getPlugin($name);\r
5251                         if ( $plugin )\r
5252                         {\r
5253                                 $plugin->unInstall();\r
5254                         }\r
5255                 }\r
5256 \r
5257                 // delete all subscriptions\r
5258                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5259 \r
5260                 // delete all options\r
5261                 // get OIDs from plugin_option_desc\r
5262                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5263                 $aOIDs = array();\r
5264                 while ($o = sql_fetch_object($res))\r
5265                 {\r
5266                         array_push($aOIDs, $o->oid);\r
5267                 }\r
5268 \r
5269                 // delete from plugin_option and plugin_option_desc\r
5270                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5271                 if (count($aOIDs) > 0)\r
5272                 {\r
5273                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',',$aOIDs) . ')');\r
5274                 }\r
5275 \r
5276                 // update order numbers\r
5277                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5278                 $o = sql_fetch_object($res);\r
5279                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5280 \r
5281                 // delete row\r
5282                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5283 \r
5284                 $manager->clearCachedInfo('installedPlugins');\r
5285                 $manager->notify(\r
5286                         'PostDeletePlugin',\r
5287                         array(\r
5288                                 'plugid' => $pid\r
5289                         )\r
5290                 );\r
5291 \r
5292                 return '';\r
5293         }\r
5294 \r
5295         /**\r
5296          * @todo document this\r
5297          */\r
5298         function action_pluginup()\r
5299         {\r
5300                 global $member, $manager, $CONF;\r
5301 \r
5302                 // check if allowed\r
5303                 $member->isAdmin() or $this->disallow();\r
5304 \r
5305                 $plugid = intGetVar('plugid');\r
5306 \r
5307                 if ( !$manager->pidInstalled($plugid) )\r
5308                 {\r
5309                         $this->error(_ERROR_NOSUCHPLUGIN);\r
5310                 }\r
5311 \r
5312                 // 1. get old order number\r
5313                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5314                 $o = sql_fetch_object($res);\r
5315                 $oldOrder = $o->porder;\r
5316 \r
5317                 // 2. calculate new order number\r
5318                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5319 \r
5320                 // 3. update plug numbers\r
5321                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5322                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5323 \r
5324                 //$this->action_pluginlist();\r
5325                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5326                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5327         }\r
5328 \r
5329         /**\r
5330          * @todo document this\r
5331          */\r
5332         function action_plugindown()\r
5333         {\r
5334                 global $member, $manager, $CONF;\r
5335 \r
5336                 // check if allowed\r
5337                 $member->isAdmin() or $this->disallow();\r
5338 \r
5339                 $plugid = intGetVar('plugid');\r
5340                 if ( !$manager->pidInstalled($plugid) )\r
5341                 {\r
5342                         $this->error(_ERROR_NOSUCHPLUGIN);\r
5343                 }\r
5344 \r
5345                 // 1. get old order number\r
5346                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5347                 $o   = sql_fetch_object($res);\r
5348                 $oldOrder = $o->porder;\r
5349 \r
5350                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5351                 $maxOrder = sql_num_rows($res);\r
5352 \r
5353                 // 2. calculate new order number\r
5354                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5355 \r
5356                 // 3. update plug numbers\r
5357                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5358                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5359 \r
5360                 //$this->action_pluginlist();\r
5361                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5362                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5363         }\r
5364         \r
5365         /**\r
5366          * Admin::action_pluginoptions()\r
5367          * \r
5368          * Output Plugin option page\r
5369          * \r
5370          * @access      public\r
5371          * @param       string $message message when fallbacked\r
5372          * @return      void\r
5373          * \r
5374          */\r
5375         public function action_pluginoptions($message = '')\r
5376         {\r
5377                 global $member, $manager;\r
5378                 \r
5379                 // check if allowed\r
5380                 $member->isAdmin() or $this->disallow();\r
5381                 \r
5382 //              $pid = (integer) requestVar('plugid');\r
5383                 $pid = intRequestVar('plugid');\r
5384                 if ( !$manager->pidInstalled($pid) )\r
5385                 {\r
5386                         $this->error(_ERROR_NOSUCHPLUGIN);\r
5387                 }\r
5388 \r
5389                 if ( isset($message) )\r
5390                 {\r
5391                         $this->headMess = $message;\r
5392                 }\r
5393                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5394                 $this->pagehead($extrahead);\r
5395                 $this->parse('pluginoptions');\r
5396                 $this->pagefoot();\r
5397                 return;\r
5398         }\r
5399         \r
5400         /**\r
5401          * Admin::action_pluginoptionsupdate()\r
5402          * \r
5403          * Update plugin options and fallback to plugin option page\r
5404          * \r
5405          * @access      public\r
5406          * @param       void\r
5407          * @return      void\r
5408          */\r
5409         public function action_pluginoptionsupdate()\r
5410         {\r
5411                 global $member, $manager;\r
5412                 \r
5413                 // check if allowed\r
5414                 $member->isAdmin() or $this->disallow();\r
5415                 \r
5416                 $pid = intRequestVar('plugid');\r
5417 //              $pid = (integer) requestVar('plugid');\r
5418                 if ( !$manager->pidInstalled($pid) )\r
5419                 {\r
5420                         $this->error(_ERROR_NOSUCHPLUGIN);\r
5421                 }\r
5422                 \r
5423                 $aOptions = requestArray('plugoption');\r
5424                 NucleusPlugin::apply_plugin_options($aOptions);\r
5425 \r
5426                 $manager->notify(\r
5427                         'PostPluginOptionsUpdate',\r
5428                         array(\r
5429                                 'context' => 'global',\r
5430                                 'plugid' => $pid\r
5431                         )\r
5432                 );\r
5433                 \r
5434                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5435                 return;\r
5436         }\r
5437         \r
5438         /**\r
5439          * Admin::_insertPluginOptions()\r
5440          * \r
5441          * Output plugin option field\r
5442          * \r
5443          * @access      public\r
5444          * @param string        $context        plugin option context\r
5445          * @param integer       $contextid      plugin option context id\r
5446          * @return      void\r
5447          */\r
5448         public function _insertPluginOptions($context, $contextid = 0)\r
5449         {\r
5450                 // get all current values for this contextid\r
5451                 // (note: this might contain doubles for overlapping contextids)\r
5452                 $aIdToValue = array();\r
5453                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));\r
5454                 while ( $object = sql_fetch_object($res) )\r
5455                 {\r
5456                         $aIdToValue[$object->oid] = $object->ovalue;\r
5457                 }\r
5458                 \r
5459                 // get list of oids per pid\r
5460                 $query = 'SELECT '\r
5461                            . '    * '\r
5462                            . 'FROM '\r
5463                            .      sql_table('plugin_option_desc') . ', '\r
5464                            .      sql_table('plugin') . ' '\r
5465                            . 'WHERE '\r
5466                            . '    opid     = pid '\r
5467                            . 'and ocontext = "' . sql_real_escape_string($context) . '" '\r
5468                            . 'ORDER BY '\r
5469                            . '    porder, oid ASC';\r
5470                 $res   = sql_query($query);\r
5471                 $aOptions = array();\r
5472                 while ( $object = sql_fetch_object($res) )\r
5473                 {\r
5474                         if (in_array($object->oid, array_keys($aIdToValue)))\r
5475                         {\r
5476                                 $value = $aIdToValue[$object->oid];\r
5477                         }\r
5478                         else\r
5479                         {\r
5480                                 $value = $object->odef;\r
5481                         }\r
5482                         \r
5483                         array_push(\r
5484                                 $aOptions,\r
5485                                 array(\r
5486                                         'pid'         => $object->pid,\r
5487                                         'pfile'       => $object->pfile,\r
5488                                         'oid'         => $object->oid,\r
5489                                         'value'       => $value,\r
5490                                         'name'        => $object->oname,\r
5491                                         'description' => $object->odesc,\r
5492                                         'type'        => $object->otype,\r
5493                                         'typeinfo'    => $object->oextra,\r
5494                                         'contextid'   => $contextid,\r
5495                                         'extra'       => ''\r
5496                                 )\r
5497                         );\r
5498                 }\r
5499                 \r
5500                 global $manager;\r
5501                 $manager->notify(\r
5502                         'PrePluginOptionsEdit',\r
5503                         array(\r
5504                                 'context'   =>  $context,\r
5505                                 'contextid' =>  $contextid,\r
5506                                 'options'   =>& $aOptions\r
5507                         )\r
5508                 );\r
5509                 \r
5510                 $this->aOptions = $aOptions;\r
5511                 $this->parse('insertpluginoptions');\r
5512                 return;\r
5513         }\r
5514         \r
5515         /**\r
5516          * TODO: this document\r
5517          */\r
5518         function action_parseSpecialskin()\r
5519         {\r
5520                 $this->pagehead();\r
5521                 $this->parse($this->action);\r
5522                 $this->pagefoot();\r
5523         }\r
5524         \r
5525         function parse($type)\r
5526         {\r
5527                 global $manager, $CONF;\r
5528                 if ( $type == 'pagehead' )\r
5529                 {\r
5530                         $manager->notify(\r
5531                                         'InitAdminSkinParse',\r
5532                                         array(\r
5533                                                         'skin' => &$this->adminSkin,\r
5534                                                         'type' => $type\r
5535                                         )\r
5536                         );\r
5537                         // set output type\r
5538                         sendContentType($this->adminSkin->getContentType(), 'skin', i18n::get_current_charset());\r
5539                 }\r
5540                 // set skin name as global var (so plugins can access it)\r
5541                 global $currentSkinName;\r
5542                 $currentSkinName = $this->adminSkin->getName();\r
5543         \r
5544                 $contents = $this->adminSkin->getContent($type);\r
5545         \r
5546                 if ( !$contents )\r
5547                 {\r
5548                         // use base skin if this skin does not have contents\r
5549                         $defskin  = new Skin($CONF['DefaultAdminSkin']);\r
5550                         $contents = $defskin->getContent($type);\r
5551                         if ( !$contents )\r
5552                         {\r
5553                                 echo _ERROR_SKIN;\r
5554                                 return;\r
5555                         }\r
5556                 }\r
5557         \r
5558                 $actions = $this->adminSkin->getAllowedActionsForType($type);\r
5559         \r
5560                 if ( $type == 'pagehead' )\r
5561                 {\r
5562                         $manager->notify(\r
5563                                         'PreAdminSkinParse',\r
5564                                         array(\r
5565                                                         'skin'     => &$this->adminSkin,\r
5566                                                         'type'     => $type,\r
5567                                                         'contents' => &$contents\r
5568                                         )\r
5569                         );\r
5570                 }\r
5571         \r
5572                 // set IncludeMode properties of parser\r
5573                 PARSER::setProperty('IncludeMode', $this->adminSkin->getIncludeMode());\r
5574                 PARSER::setProperty('IncludePrefix', $this->adminSkin->getIncludePrefix());\r
5575         \r
5576                 if ( $type == 'createitem' || $type == 'itemedit' )\r
5577                 {\r
5578                         $handler = new Factory(intRequestVar('blogid'), $type, $this->adminSkin, $this);\r
5579                         $actions = array_merge($actions, $handler->actions);\r
5580                 } else {\r
5581                         $handler = new AdminActions($type, $this->adminSkin, $this);\r
5582                         $actions = array_merge($actions, AdminActions::get_allowed_actions_for_type($type));\r
5583                 }\r
5584                 $parser = new Parser($actions, $handler);\r
5585                 $handler->setParser($parser);\r
5586                 $handler->setSkin($this->adminSkin);\r
5587                 $parser->parse($contents);\r
5588         \r
5589                 if ( $type == 'pagefoot' )\r
5590                 {\r
5591                         $manager->notify(\r
5592                                 'PostAdminSkinParse',\r
5593                                 array(\r
5594                                         'skin' => &$this->adminSkin,\r
5595                                         'type' => $type,\r
5596                                 )\r
5597                         );\r
5598                 }\r
5599         }\r
5600         \r
5601         function getAdminskinIDFromName($skinname)\r
5602         {\r
5603                 $query     = 'SELECT `sdnumber` as result FROM `%s` WHERE `sdname` = "%s"';\r
5604                 $admnSknID = quickQuery(sprintf($query, sql_table('nucleus_adminskin_desc'), mysql_real_escape_string($skinname)));\r
5605                 return intval($adminSkinID);\r
5606         }\r
5607         \r
5608         function getAdminskinNameFromID($skinid)\r
5609         {\r
5610                 $query     = 'SELECT `sdname` as result FROM `%s` WHERE `sdnumber` = "%d"';\r
5611                 $admnSknID = quickQuery(sprintf($query, sql_table('nucleus_adminskin_desc'), intval($skinid)));\r
5612                 return intval($adminSkinID);\r
5613         }\r
5614         \r
5615         function action_importAdmin()\r
5616         {\r
5617                 global $DIR_ADMINSKINS, $action;\r
5618                 if ( $action == 'adminskinieimport' )\r
5619                 {\r
5620                         $this->_doAdminskinimport();\r
5621                 }\r
5622                 $skn = array();\r
5623                 if ( $action == 'showlogin' )\r
5624                 {\r
5625                         $skinName = 'showlogin';\r
5626                         $actnName = 'showlogin';\r
5627                 }\r
5628                 else\r
5629                 {\r
5630                         $skinName = 'defaultimporter';\r
5631                         $actnName = 'importAdmin';\r
5632                 }\r
5633                 $contents             = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5634                 $skn['id']            = 0;\r
5635                 $skn['description']   = $skinName;\r
5636                 $skn['contentType']   = 'importAdmin';\r
5637                 $skn['includeMode']   = 'normal';\r
5638                 $skn['includePrefix'] = '';\r
5639                 $skn['name']          = 'defaultinporter';\r
5640                 $this->adminSkin      = (object)$skn;\r
5641                 $handler              = new AdminActions($actnName, $this->adminSkin, $this);\r
5642                 $actions              = Skin::getAllowedActionsForType($actnName);\r
5643                 $parser = new PARSER($actions, $handler);\r
5644                 $handler->setParser($parser);\r
5645                 $handler->setSkin($this->adminSkin);\r
5646                 $parser->parse($contents);\r
5647         }\r
5648         \r
5649         /**\r
5650          * @todo document this\r
5651          */\r
5652         private function _doAdminskinimport()\r
5653         {\r
5654                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5655                 $member->isAdmin() or $this->disallow();\r
5656                 // load skinie class\r
5657                 include_once($DIR_LIBS . 'Skinie.php');\r
5658                 $skinFileRaw    = postVar('skinfile');\r
5659                 $mode           = postVar('mode');\r
5660                 $allowOverwrite = intPostVar('overwrite');\r
5661                 // get full filename\r
5662                 if ($mode == 'file') {\r
5663                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5664                 } else {\r
5665                         $skinFile = $skinFileRaw;\r
5666                 }\r
5667                 $importer = new SKINIMPORT();\r
5668                 $error    = $importer->readFile($skinFile);\r
5669                 if ($error) {\r
5670                         $this->error($error);\r
5671                 }\r
5672                 $error = $importer->writeToDatabase($allowOverwrite);\r
5673                 if ($error) {\r
5674                         $this->error($error);\r
5675                 }\r
5676         \r
5677                 $_REQUEST['skininfo']  = $importer->getInfo();\r
5678                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
5679                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
5680         \r
5681                 header('Location: ' . $CONF['AdminURL']);\r
5682                 exit;\r
5683         \r
5684         }\r
5685 \r
5686         /**\r
5687          * Returns a link to a weblog\r
5688          * @param object BLOG\r
5689          */\r
5690         function bloglink(&$blog) {\r
5691                 return '<a href="'.Entity::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. Entity::hsc( $blog->getName() ) .'</a>';\r
5692         }\r
5693 }\r