nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1626 2012-01-09 15:46:54Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN {
  28         private $xml_version_info = '1.0';
  29         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  30         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  31         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  32     /**
  33      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  34      */
  35     var $action;
  36
  37     /**
  38      * Class constructor
  39      */
  40     function ADMIN() {
  41
  42     }
  43
  44     /**
  45      * Executes an action
  46      *
  47      * @param string $action action to be performed
  48      */
  49     function action($action) {
  50         global $CONF, $manager;
  51
  52         // list of action aliases
  53         $alias = array(
  54             'login' => 'overview',
  55             '' => 'overview'
  56         );
  57
  58         if (isset($alias[$action]))
  59             $action = $alias[$action];
  60
  61         $methodName = 'action_' . $action;
  62
  63         $this->action = strtolower($action);
  64
  65         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  66         // is an action that requires user interaction before something is actually done)
  67         // all safe actions are in this array:
  68         $aActionsNotToCheck = array(
  69             'showlogin',
  70             'login',
  71             'overview',
  72             'itemlist',
  73             'blogcommentlist',
  74             'bookmarklet',
  75             'blogsettings',
  76             'banlist',
  77             'deleteblog',
  78             'editmembersettings',
  79             'browseownitems',
  80             'browseowncomments',
  81             'createitem',
  82             'itemedit',
  83             'itemmove',
  84             'categoryedit',
  85             'categorydelete',
  86             'manage',
  87             'actionlog',
  88             'settingsedit',
  89             'backupoverview',
  90             'pluginlist',
  91             'createnewlog',
  92             'usermanagement',
  93             'skinoverview',
  94             'templateoverview',
  95             'skinieoverview',
  96             'itemcommentlist',
  97             'commentedit',
  98             'commentdelete',
  99             'banlistnewfromitem',
 100             'banlistdelete',
 101             'itemdelete',
 102             'manageteam',
 103             'teamdelete',
 104             'banlistnew',
 105             'memberedit',
 106             'memberdelete',
 107             'pluginhelp',
 108             'pluginoptions',
 109             'plugindelete',
 110             'skinedittype',
 111             'skinremovetype',
 112             'skindelete',
 113             'skinedit',
 114             'templateedit',
 115             'templatedelete',
 116             'activate',
 117             'systemoverview'
 118         );
 119 /*
 120         // the rest of the actions needs to be checked
 121         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 122 */
 123         if (!in_array($this->action, $aActionsNotToCheck))
 124         {
 125             if (!$manager->checkTicket())
 126                 $this->error(_ERROR_BADTICKET);
 127         }
 128
 129         if (method_exists($this, $methodName))
 130             call_user_func(array(&$this, $methodName));
 131         else
 132             $this->error(_BADACTION . i18n::hsc(" ($action)"));
 133
 134     }
 135
 136     /**
 137      * @todo document this
 138      */
 139     function action_showlogin() {
 140         global $error;
 141         $this->action_login($error);
 142     }
 143
 144     /**
 145      * @todo document this
 146      */
 147     function action_login($msg = '', $passvars = 1) {
 148         global $member;
 149
 150         // skip to overview when allowed
 151         if ($member->isLoggedIn() && $member->canLogin()) {
 152             $this->action_overview();
 153             exit;
 154         }
 155
 156         $this->pagehead();
 157
 158         echo '<h2>', _LOGIN ,'</h2>';
 159         if ($msg) echo _MESSAGE , ': ', i18n::hsc($msg);
 160         ?>
 161
 162         <form action="index.php" method="post"><p>
 163         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 164         <br />
 165         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 166         <br />
 167         <input name="action" value="login" type="hidden" />
 168         <br />
 169         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 170         <br />
 171         <small>
 172             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 173             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 174         </small>
 175         <?php           // pass through vars
 176
 177             $oldaction = postVar('oldaction');
 178             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 179                 passRequestVars();
 180             }
 181
 182
 183         ?>
 184         </p></form>
 185         <?php       $this->pagefoot();
 186     }
 187
 188
 189     /**
 190      * provides a screen with the overview of the actions available
 191      * @todo document parameter
 192      */
 193     function action_overview($msg = '') {
 194         global $member;
 195
 196         $this->pagehead();
 197
 198         if ($msg)
 199             echo _MESSAGE , ': ', $msg;
 200
 201         /* ---- add items ---- */
 202         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 203
 204         $showAll = requestVar('showall');
 205
 206         if (($member->isAdmin()) && ($showAll == 'yes')) {
 207             // Super-Admins have access to all blogs! (no add item support though)
 208             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 209                    . ' FROM ' . sql_table('blog')
 210                    . ' ORDER BY bname';
 211         } else {
 212             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 213                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 214                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 215                    . ' ORDER BY bname';
 216         }
 217         $template['content'] = 'bloglist';
 218         $template['superadmin'] = $member->isAdmin();
 219         $amount = showlist($query,'table',$template);
 220
 221         if (($showAll != 'yes') && ($member->isAdmin())) {
 222             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 223             if ($total > $amount)
 224                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 225         }
 226
 227         if ($amount == 0)
 228             echo _OVERVIEW_NOBLOGS;
 229
 230         if ($amount != 0) {
 231             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 232             $query =  'SELECT ititle, inumber, bshortname'
 233                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 234                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 235             $template['content'] = 'draftlist';
 236             $amountdrafts = showlist($query, 'table', $template);
 237             if ($amountdrafts == 0)
 238                 echo _OVERVIEW_NODRAFTS;
 239         }
 240
 241                 if ($amount != 0) {
 242                         $yrBlogs = $member->getAdminBlogs();
 243                         if ($showAll != 'yes') {
 244                                 $admBlogs = array();
 245                                 foreach ($yrBlogs as $value) {
 246                                         if ($member->isBlogAdmin(intval($value))) {
 247                                                 $admBlogs[] = intval($value);
 248                                         }
 249                                 }
 250                                 $yrBlogs = $admBlogs;
 251                         }
 252
 253                         if (count($yrBlogs) > 0) {
 254                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 255                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 256                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 257                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 258                                            . ' ORDER BY iblog ASC';
 259                                 $template['content'] = 'otherdraftlist';
 260                                 $amountdrafts = showlist($query, 'table', $template);
 261                                 if ($amountdrafts == 0)
 262                                         echo _OVERVIEW_NODRAFTS;
 263                         }
 264         }
 265
 266         /* ---- user settings ---- */
 267         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 268         echo '<ul>';
 269         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 270         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 271         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 272         echo '</ul>';
 273
 274         /* ---- general settings ---- */
 275         if ($member->isAdmin()) {
 276             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 277             echo '<ul>';
 278             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 279             echo '</ul>';
 280         }
 281
 282
 283         $this->pagefoot();
 284     }
 285
 286     /**
 287      * Returns a link to a weblog
 288      * @param object BLOG
 289      */
 290     function bloglink(&$blog) {
 291         return '<a href="'.i18n::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. i18n::hsc( $blog->getName() ) .'</a>';
 292     }
 293
 294     /**
 295      * @todo document this
 296      */
 297     function action_manage($msg = '') {
 298         global $member;
 299
 300         $member->isAdmin() or $this->disallow();
 301
 302         $this->pagehead();
 303
 304         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 305
 306         if ($msg)
 307             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 308
 309
 310         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 311
 312         echo '<ul>';
 313         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 314         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 315         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 316         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 317         echo '</ul>';
 318
 319         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 320         echo '<ul>';
 321         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 322         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 323         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 324         echo '</ul>';
 325
 326         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 327         echo '<ul>';
 328         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 329         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 330         echo '</ul>';
 331
 332         $this->pagefoot();
 333     }
 334
 335     /**
 336      * @todo document this
 337      */
 338     function action_itemlist($blogid = '') {
 339         global $member, $manager, $CONF;
 340
 341         if ($blogid == '')
 342             $blogid = intRequestVar('blogid');
 343
 344         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 345
 346         $this->pagehead();
 347         $blog =& $manager->getBlog($blogid);
 348
 349         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 350         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 351
 352         // start index
 353         if (postVar('start'))
 354             $start = intPostVar('start');
 355         else
 356             $start = 0;
 357
 358         if ($start == 0)
 359             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 360
 361         // amount of items to show
 362         if (postVar('amount'))
 363             $amount = intPostVar('amount');
 364         else {
 365             $amount = intval($CONF['DefaultListSize']);
 366             if ($amount < 1)
 367                 $amount = 10;
 368         }
 369
 370         $search = postVar('search');    // search through items
 371
 372         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 373                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 374                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 375
 376         if ($search)
 377             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 378
 379         // non-blog-admins can only edit/delete their own items
 380         if (!$member->blogAdminRights($blogid))
 381             $query .= ' and iauthor=' . $member->getID();
 382
 383
 384         $query .= ' ORDER BY itime DESC'
 385                 . " LIMIT $start,$amount";
 386
 387         $template['content'] = 'itemlist';
 388         $template['now'] = $blog->getCorrectTime(time());
 389
 390         $manager->loadClass("ENCAPSULATE");
 391         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 392         $navList->showBatchList('item',$query,'table',$template);
 393
 394
 395         $this->pagefoot();
 396     }
 397
 398     /**
 399      * @todo document this
 400      */
 401     function action_batchitem() {
 402         global $member, $manager;
 403
 404         // check if logged in
 405         $member->isLoggedIn() or $this->disallow();
 406
 407         // more precise check will be done for each performed operation
 408
 409         // get array of itemids from request
 410         $selected = requestIntArray('batch');
 411         $action = requestVar('batchaction');
 412
 413         // Show error when no items were selected
 414         if (!is_array($selected) || sizeof($selected) == 0)
 415             $this->error(_BATCH_NOSELECTION);
 416
 417         // On move: when no destination blog/category chosen, show choice now
 418         $destCatid = intRequestVar('destcatid');
 419         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 420             $this->batchMoveSelectDestination('item',$selected);
 421
 422         // On delete: check if confirmation has been given
 423         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 424             $this->batchAskDeleteConfirmation('item',$selected);
 425
 426         $this->pagehead();
 427
 428         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 429         echo '<h2>',_BATCH_ITEMS,'</h2>';
 430         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 431         echo '<ul>';
 432
 433
 434         // walk over all itemids and perform action
 435         foreach ($selected as $itemid) {
 436             $itemid = intval($itemid);
 437             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 438
 439             // perform action, display errors if needed
 440             switch($action) {
 441                 case 'delete':
 442                     $error = $this->deleteOneItem($itemid);
 443                     break;
 444                 case 'move':
 445                     $error = $this->moveOneItem($itemid, $destCatid);
 446                     break;
 447                 default:
 448                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 449             }
 450
 451             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 452             echo '</li>';
 453         }
 454
 455         echo '</ul>';
 456         echo '<b>',_BATCH_DONE,'</b>';
 457
 458         $this->pagefoot();
 459
 460
 461     }
 462
 463     /**
 464      * @todo document this
 465      */
 466     function action_batchcomment() {
 467         global $member;
 468
 469         // check if logged in
 470         $member->isLoggedIn() or $this->disallow();
 471
 472         // more precise check will be done for each performed operation
 473
 474         // get array of itemids from request
 475         $selected = requestIntArray('batch');
 476         $action = requestVar('batchaction');
 477
 478         // Show error when no items were selected
 479         if (!is_array($selected) || sizeof($selected) == 0)
 480             $this->error(_BATCH_NOSELECTION);
 481
 482         // On delete: check if confirmation has been given
 483         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 484             $this->batchAskDeleteConfirmation('comment',$selected);
 485
 486         $this->pagehead();
 487
 488         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 489         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 490         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 491         echo '<ul>';
 492
 493         // walk over all itemids and perform action
 494         foreach ($selected as $commentid) {
 495             $commentid = intval($commentid);
 496             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 497
 498             // perform action, display errors if needed
 499             switch($action) {
 500                 case 'delete':
 501                     $error = $this->deleteOneComment($commentid);
 502                     break;
 503                 default:
 504                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 505             }
 506
 507             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 508             echo '</li>';
 509         }
 510
 511         echo '</ul>';
 512         echo '<b>',_BATCH_DONE,'</b>';
 513
 514         $this->pagefoot();
 515
 516
 517     }
 518
 519     /**
 520      * @todo document this
 521      */
 522     function action_batchmember() {
 523         global $member;
 524
 525         // check if logged in and admin
 526         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 527
 528         // get array of itemids from request
 529         $selected = requestIntArray('batch');
 530         $action = requestVar('batchaction');
 531
 532         // Show error when no members selected
 533         if (!is_array($selected) || sizeof($selected) == 0)
 534             $this->error(_BATCH_NOSELECTION);
 535
 536         // On delete: check if confirmation has been given
 537         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 538             $this->batchAskDeleteConfirmation('member',$selected);
 539
 540         $this->pagehead();
 541
 542         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 543         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 544         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 545         echo '<ul>';
 546
 547         // walk over all itemids and perform action
 548         foreach ($selected as $memberid) {
 549             $memberid = intval($memberid);
 550             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 551
 552             // perform action, display errors if needed
 553             switch($action) {
 554                 case 'delete':
 555                     $error = $this->deleteOneMember($memberid);
 556                     break;
 557                 case 'setadmin':
 558                     // always succeeds
 559                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 560                     $error = '';
 561                     break;
 562                 case 'unsetadmin':
 563                     // there should always remain at least one super-admin
 564                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 565                     if (sql_num_rows($r) < 2)
 566                         $error = _ERROR_ATLEASTONEADMIN;
 567                     else
 568                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 569                     break;
 570                 default:
 571                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 572             }
 573
 574             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 575             echo '</li>';
 576         }
 577
 578         echo '</ul>';
 579         echo '<b>',_BATCH_DONE,'</b>';
 580
 581         $this->pagefoot();
 582
 583
 584     }
 585
 586     /**
 587      * @todo document this
 588      */
 589     function action_batchteam() {
 590         global $member;
 591
 592         $blogid = intRequestVar('blogid');
 593
 594         // check if logged in and admin
 595         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 596
 597         // get array of itemids from request
 598         $selected = requestIntArray('batch');
 599         $action = requestVar('batchaction');
 600
 601         // Show error when no members selected
 602         if (!is_array($selected) || sizeof($selected) == 0)
 603             $this->error(_BATCH_NOSELECTION);
 604
 605         // On delete: check if confirmation has been given
 606         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 607             $this->batchAskDeleteConfirmation('team',$selected);
 608
 609         $this->pagehead();
 610
 611         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 612
 613         echo '<h2>',_BATCH_TEAM,'</h2>';
 614         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 615         echo '<ul>';
 616
 617         // walk over all itemids and perform action
 618         foreach ($selected as $memberid) {
 619             $memberid = intval($memberid);
 620             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 621
 622             // perform action, display errors if needed
 623             switch($action) {
 624                 case 'delete':
 625                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 626                     break;
 627                 case 'setadmin':
 628                     // always succeeds
 629                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 630                     $error = '';
 631                     break;
 632                 case 'unsetadmin':
 633                     // there should always remain at least one admin
 634                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 635                     if (sql_num_rows($r) < 2)
 636                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 637                     else
 638                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 639                     break;
 640                 default:
 641                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 642             }
 643
 644             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 645             echo '</li>';
 646         }
 647
 648         echo '</ul>';
 649         echo '<b>',_BATCH_DONE,'</b>';
 650
 651         $this->pagefoot();
 652
 653
 654     }
 655
 656     /**
 657      * @todo document this
 658      */
 659     function action_batchcategory() {
 660         global $member, $manager;
 661
 662         // check if logged in
 663         $member->isLoggedIn() or $this->disallow();
 664
 665         // more precise check will be done for each performed operation
 666
 667         // get array of itemids from request
 668         $selected = requestIntArray('batch');
 669         $action = requestVar('batchaction');
 670
 671         // Show error when no items were selected
 672         if (!is_array($selected) || sizeof($selected) == 0)
 673             $this->error(_BATCH_NOSELECTION);
 674
 675         // On move: when no destination blog chosen, show choice now
 676         $destBlogId = intRequestVar('destblogid');
 677         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 678             $this->batchMoveCategorySelectDestination('category',$selected);
 679
 680         // On delete: check if confirmation has been given
 681         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 682             $this->batchAskDeleteConfirmation('category',$selected);
 683
 684         $this->pagehead();
 685
 686         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 687         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 688         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 689         echo '<ul>';
 690
 691         // walk over all itemids and perform action
 692         foreach ($selected as $catid) {
 693             $catid = intval($catid);
 694             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 695
 696             // perform action, display errors if needed
 697             switch($action) {
 698                 case 'delete':
 699                     $error = $this->deleteOneCategory($catid);
 700                     break;
 701                 case 'move':
 702                     $error = $this->moveOneCategory($catid, $destBlogId);
 703                     break;
 704                 default:
 705                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 706             }
 707
 708             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 709             echo '</li>';
 710         }
 711
 712         echo '</ul>';
 713         echo '<b>',_BATCH_DONE,'</b>';
 714
 715         $this->pagefoot();
 716
 717     }
 718
 719     /**
 720      * @todo document this
 721      */
 722     function batchMoveSelectDestination($type, $ids) {
 723         global $manager;
 724         $this->pagehead();
 725         ?>
 726         <h2><?php echo _MOVE_TITLE?></h2>
 727         <form method="post" action="index.php"><div>
 728
 729             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 730             <input type="hidden" name="batchaction" value="move" />
 731             <?php
 732                 $manager->addTicketHidden();
 733
 734                 // insert selected item numbers
 735                 $idx = 0;
 736                 foreach ($ids as $id)
 737                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 738
 739                 // show blog/category selection list
 740                 $this->selectBlogCategory('destcatid');
 741
 742             ?>
 743
 744
 745             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 746
 747         </div></form>
 748         <?php       $this->pagefoot();
 749         exit;
 750     }
 751
 752     /**
 753      * @todo document this
 754      */
 755     function batchMoveCategorySelectDestination($type, $ids) {
 756         global $manager;
 757         $this->pagehead();
 758         ?>
 759         <h2><?php echo _MOVECAT_TITLE?></h2>
 760         <form method="post" action="index.php"><div>
 761
 762             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 763             <input type="hidden" name="batchaction" value="move" />
 764             <?php
 765                 $manager->addTicketHidden();
 766
 767                 // insert selected item numbers
 768                 $idx = 0;
 769                 foreach ($ids as $id)
 770                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 771
 772                 // show blog/category selection list
 773                 $this->selectBlog('destblogid');
 774
 775             ?>
 776
 777
 778             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 779
 780         </div></form>
 781         <?php       $this->pagefoot();
 782         exit;
 783     }
 784
 785     /**
 786      * @todo document this
 787      */
 788     function batchAskDeleteConfirmation($type, $ids) {
 789         global $manager;
 790
 791         $this->pagehead();
 792         ?>
 793         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 794         <form method="post" action="index.php"><div>
 795
 796             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 797             <?php $manager->addTicketHidden() ?>
 798             <input type="hidden" name="batchaction" value="delete" />
 799             <input type="hidden" name="confirmation" value="yes" />
 800             <?php               // insert selected item numbers
 801                 $idx = 0;
 802                 foreach ($ids as $id)
 803                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 804
 805                 // add hidden vars for team & comment
 806                 if ($type == 'team')
 807                 {
 808                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 809                 }
 810                 if ($type == 'comment')
 811                 {
 812                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 813                 }
 814
 815             ?>
 816
 817             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 818
 819         </div></form>
 820         <?php       $this->pagefoot();
 821         exit;
 822     }
 823
 824
 825     /**
 826      * Inserts a HTML select element with choices for all categories to which the current
 827      * member has access
 828      * @see function selectBlog
 829      */
 830     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 831         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 832     }
 833
 834     /**
 835      * Inserts a HTML select element with choices for all blogs to which the user has access
 836      *      mode = 'blog' => shows blognames and values are blogids
 837      *      mode = 'category' => show category names and values are catids
 838      *
 839      * @param $iForcedBlogInclude
 840      *      ID of a blog that always needs to be included, without checking if the
 841      *      member is on the blog team (-1 = none)
 842      * @todo document parameters
 843      */
 844     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 845         global $member, $CONF;
 846
 847         // 0. get IDs of blogs to which member can post items (+ forced blog)
 848         $aBlogIds = array();
 849         if ($iForcedBlogInclude != -1)
 850             $aBlogIds[] = intval($iForcedBlogInclude);
 851
 852         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 853             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 854         else
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 856         $rblogids = sql_query($queryBlogs);
 857         while ($o = sql_fetch_object($rblogids))
 858             if ($o->bnumber != $iForcedBlogInclude)
 859                 $aBlogIds[] = intval($o->bnumber);
 860
 861         if (count($aBlogIds) == 0)
 862             return;
 863
 864         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 865
 866         // 1. select blogs (we'll create optiongroups)
 867         // (only select those blogs that have the user on the team)
 868         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 869         $blogs = sql_query($queryBlogs);
 870         if ($mode == 'category') {
 871             if (sql_num_rows($blogs) > 1)
 872                 $multipleBlogs = 1;
 873
 874             while ($oBlog = sql_fetch_object($blogs)) {
 875                 if ($multipleBlogs)
 876                     echo '<optgroup label="',i18n::hsc($oBlog->bname),'">';
 877
 878                 // show selection to create new category when allowed/wanted
 879                 if ($showNewCat) {
 880                     // check if allowed to do so
 881                     if ($member->blogAdminRights($oBlog->bnumber))
 882                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 883                 }
 884
 885                 // 2. for each category in that blog
 886                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 887                 while ($oCat = sql_fetch_object($categories)) {
 888                     if ($oCat->catid == $selected)
 889                         $selectText = ' selected="selected" ';
 890                     else
 891                         $selectText = '';
 892                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',i18n::hsc($oCat->cname),'</option>';
 893                 }
 894
 895                 if ($multipleBlogs)
 896                     echo '</optgroup>';
 897             }
 898         } else {
 899             // blog mode
 900             while ($oBlog = sql_fetch_object($blogs)) {
 901                 echo '<option value="',$oBlog->bnumber,'"';
 902                 if ($oBlog->bnumber == $selected)
 903                     echo ' selected="selected"';
 904                 echo'>',i18n::hsc($oBlog->bname),'</option>';
 905             }
 906         }
 907         echo '</select>';
 908
 909     }
 910
 911     /**
 912      * @todo document this
 913      */
 914     function action_browseownitems() {
 915         global $member, $manager, $CONF;
 916
 917         $this->pagehead();
 918
 919         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 920         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 921
 922         // start index
 923         if (postVar('start'))
 924             $start = intPostVar('start');
 925         else
 926             $start = 0;
 927
 928         // amount of items to show
 929         if (postVar('amount'))
 930             $amount = intPostVar('amount');
 931         else {
 932             $amount = intval($CONF['DefaultListSize']);
 933             if ($amount < 1)
 934                 $amount = 10;
 935         }
 936
 937         $search = postVar('search');    // search through items
 938
 939         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 940                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 941                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 942
 943         if ($search)
 944             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 945
 946         $query .= ' ORDER BY itime DESC'
 947                 . " LIMIT $start,$amount";
 948
 949         $template['content'] = 'itemlist';
 950         $template['now'] = time();
 951
 952         $manager->loadClass("ENCAPSULATE");
 953         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 954         $navList->showBatchList('item',$query,'table',$template);
 955
 956         $this->pagefoot();
 957
 958     }
 959
 960     /**
 961      * Show all the comments for a given item
 962      * @param int $itemid
 963      */
 964     function action_itemcommentlist($itemid = '') {
 965         global $member, $manager, $CONF;
 966
 967         if ($itemid == '')
 968             $itemid = intRequestVar('itemid');
 969
 970         // only allow if user is allowed to alter item
 971         $member->canAlterItem($itemid) or $this->disallow();
 972
 973         $blogid = getBlogIdFromItemId($itemid);
 974
 975         $this->pagehead();
 976
 977         // start index
 978         if (postVar('start'))
 979             $start = intPostVar('start');
 980         else
 981             $start = 0;
 982
 983         // amount of items to show
 984         if (postVar('amount'))
 985             $amount = intPostVar('amount');
 986         else {
 987             $amount = intval($CONF['DefaultListSize']);
 988             if ($amount < 1)
 989                 $amount = 10;
 990         }
 991
 992         $search = postVar('search');
 993
 994         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 995         echo '<h2>',_COMMENTS,'</h2>';
 996
 997         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
 998
 999         if ($search)
1000             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1001
1002         $query .= ' ORDER BY ctime ASC'
1003                 . " LIMIT $start,$amount";
1004
1005         $template['content'] = 'commentlist';
1006         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1007
1008         $manager->loadClass("ENCAPSULATE");
1009         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1010         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1011
1012         $this->pagefoot();
1013     }
1014
1015     /**
1016      * Browse own comments
1017      */
1018     function action_browseowncomments() {
1019         global $member, $manager, $CONF;
1020
1021         // start index
1022         if (postVar('start'))
1023             $start = intPostVar('start');
1024         else
1025             $start = 0;
1026
1027         // amount of items to show
1028         if (postVar('amount'))
1029             $amount = intPostVar('amount');
1030         else {
1031             $amount = intval($CONF['DefaultListSize']);
1032             if ($amount < 1)
1033                 $amount = 10;
1034         }
1035
1036         $search = postVar('search');
1037
1038
1039         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1040
1041         if ($search)
1042             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1043
1044         $query .= ' ORDER BY ctime DESC'
1045                 . " LIMIT $start,$amount";
1046
1047         $this->pagehead();
1048
1049         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1050         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1051
1052         $template['content'] = 'commentlist';
1053         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1054
1055         $manager->loadClass("ENCAPSULATE");
1056         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1057         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1058
1059         $this->pagefoot();
1060     }
1061
1062     /**
1063      * Browse all comments for a weblog
1064      * @param int $blogid
1065      */
1066     function action_blogcommentlist($blogid = '')
1067     {
1068         global $member, $manager, $CONF;
1069
1070         if ($blogid == '')
1071             $blogid = intRequestVar('blogid');
1072         else
1073             $blogid = intval($blogid);
1074
1075         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1076
1077         // start index
1078         if (postVar('start'))
1079             $start = intPostVar('start');
1080         else
1081             $start = 0;
1082
1083         // amount of items to show
1084         if (postVar('amount'))
1085             $amount = intPostVar('amount');
1086         else {
1087             $amount = intval($CONF['DefaultListSize']);
1088             if ($amount < 1)
1089                 $amount = 10;
1090         }
1091
1092         $search = postVar('search');        // search through comments
1093
1094
1095         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1096
1097         if ($search != '')
1098             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1099
1100
1101         $query .= ' ORDER BY ctime DESC'
1102                 . " LIMIT $start,$amount";
1103
1104
1105         $blog =& $manager->getBlog($blogid);
1106
1107         $this->pagehead();
1108
1109         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1110         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1111
1112         $template['content'] = 'commentlist';
1113         $template['canAddBan'] = $member->blogAdminRights($blogid);
1114
1115         $manager->loadClass("ENCAPSULATE");
1116         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1117         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1118
1119         $this->pagefoot();
1120     }
1121
1122     /**
1123      * Provide a page to item a new item to the given blog
1124      */
1125     function action_createitem() {
1126         global $member, $manager;
1127
1128         $blogid = intRequestVar('blogid');
1129
1130         // check if allowed
1131         $member->teamRights($blogid) or $this->disallow();
1132
1133         $memberid = $member->getID();
1134
1135         $blog =& $manager->getBlog($blogid);
1136
1137         $this->pagehead();
1138
1139         // generate the add-item form
1140         $formfactory = new PAGEFACTORY($blogid);
1141         $formfactory->createAddForm('admin');
1142
1143         $this->pagefoot();
1144     }
1145
1146     /**
1147      * @todo document this
1148      */
1149     function action_itemedit()
1150         {
1151                 global $member, $manager;
1152
1153                 $itemid = intRequestVar('itemid');
1154
1155                 // only allow if user is allowed to alter item
1156                 $member->canAlterItem($itemid) or $this->disallow();
1157
1158                 $item =& $manager->getItem($itemid, 1, 1);
1159                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1160
1161                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1162
1163                 if ($blog->convertBreaks())
1164                 {
1165                         $item['body'] = removeBreaks($item['body']);
1166                         $item['more'] = removeBreaks($item['more']);
1167                 }
1168
1169                 // form to edit blog items
1170                 $this->pagehead();
1171                 $formfactory = new PAGEFACTORY($blog->getID());
1172                 $formfactory->createEditForm('admin', $item);
1173                 $this->pagefoot();
1174     }
1175
1176     /**
1177      * @todo document this
1178      */
1179     function action_itemupdate() {
1180         global $member, $manager, $CONF;
1181
1182         $itemid = intRequestVar('itemid');
1183         $catid = postVar('catid');
1184
1185         // only allow if user is allowed to alter item
1186         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1187
1188         $actiontype = postVar('actiontype');
1189
1190         // delete actions are handled by itemdelete (which has confirmation)
1191         if ($actiontype == 'delete') {
1192             $this->action_itemdelete();
1193             return;
1194         }
1195
1196         $body   = postVar('body');
1197         $title  = postVar('title');
1198         $more   = postVar('more');
1199         $closed = intPostVar('closed');
1200         $draftid = intPostVar('draftid');
1201
1202         // default action = add now
1203         if (!$actiontype)
1204             $actiontype='addnow';
1205
1206         // create new category if needed
1207         if (strstr($catid,'newcat')) {
1208             // get blogid
1209             list($blogid) = sscanf($catid,"newcat-%d");
1210
1211             // create
1212             $blog =& $manager->getBlog($blogid);
1213             $catid = $blog->createNewCategory();
1214
1215             // show error when sth goes wrong
1216             if (!$catid)
1217                 $this->doError(_ERROR_CATCREATEFAIL);
1218         }
1219
1220         /*
1221             set some variables based on actiontype
1222
1223             actiontypes:
1224                 draft items -> addnow, addfuture, adddraft, delete
1225                 non-draft items -> edit, changedate, delete
1226
1227             variables set:
1228                 $timestamp: set to a nonzero value for future dates or date changes
1229                 $wasdraft: set to 1 when the item used to be a draft item
1230                 $publish: set to 1 when the edited item is not a draft
1231         */
1232         $blogid =  getBlogIDFromItemID($itemid);
1233         $blog   =& $manager->getBlog($blogid);
1234
1235         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1236         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1237         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1238         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1239             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1240         } else {
1241             $timestamp =0;
1242         }
1243
1244         // edit the item for real
1245         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1246
1247         $this->updateFuturePosted($blogid);
1248
1249         if ($draftid > 0) {
1250             // delete permission is checked inside ITEM::delete()
1251             ITEM::delete($draftid);
1252         }
1253
1254         // show category edit window when we created a new category
1255         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1256         if ($catid != intPostVar('catid')) {
1257             $this->action_categoryedit(
1258                 $catid,
1259                 $blog->getID(),
1260                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1261             );
1262         } else {
1263             // TODO: set start item correctly for itemlist
1264             $this->action_itemlist(getBlogIDFromItemID($itemid));
1265         }
1266     }
1267
1268     /**
1269      * @todo document this
1270      */
1271     function action_itemdelete() {
1272         global $member, $manager;
1273
1274         $itemid = intRequestVar('itemid');
1275
1276         // only allow if user is allowed to alter item
1277         $member->canAlterItem($itemid) or $this->disallow();
1278
1279         if (!$manager->existsItem($itemid,1,1))
1280             $this->error(_ERROR_NOSUCHITEM);
1281
1282         $item =& $manager->getItem($itemid,1,1);
1283         $title = i18n::hsc(strip_tags($item['title']));
1284         $body = strip_tags($item['body']);
1285         $body = i18n::hsc(shorten($body,300,'...'));
1286
1287         $this->pagehead();
1288         ?>
1289             <h2><?php echo _DELETE_CONFIRM?></h2>
1290
1291             <p><?php echo _CONFIRMTXT_ITEM?></p>
1292
1293             <div class="note">
1294                 <b>"<?php echo  $title ?>"</b>
1295                 <br />
1296                 <?php echo $body?>
1297             </div>
1298
1299             <form method="post" action="index.php"><div>
1300                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1301                 <?php $manager->addTicketHidden() ?>
1302                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1303                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1304             </div></form>
1305         <?php
1306         $this->pagefoot();
1307     }
1308
1309     /**
1310      * @todo document this
1311      */
1312     function action_itemdeleteconfirm() {
1313         global $member;
1314
1315         $itemid = intRequestVar('itemid');
1316
1317         // only allow if user is allowed to alter item
1318         $member->canAlterItem($itemid) or $this->disallow();
1319
1320         // get blogid first
1321         $blogid = getBlogIdFromItemId($itemid);
1322
1323         // delete item (note: some checks will be performed twice)
1324         $this->deleteOneItem($itemid);
1325
1326         $this->action_itemlist($blogid);
1327     }
1328
1329     /**
1330      * Deletes one item and returns error if something goes wrong
1331      * @param int $itemid
1332      */
1333     function deleteOneItem($itemid) {
1334         global $member, $manager;
1335
1336         // only allow if user is allowed to alter item (also checks if itemid exists)
1337         if (!$member->canAlterItem($itemid))
1338             return _ERROR_DISALLOWED;
1339
1340         // need to get blogid before the item is deleted
1341         $blogid = getBlogIDFromItemId($itemid);
1342
1343         $manager->loadClass('ITEM');
1344         ITEM::delete($itemid);
1345
1346         // update blog's futureposted
1347         $this->updateFuturePosted($blogid);
1348     }
1349
1350     /**
1351      * Update a blog's future posted flag
1352      * @param int $blogid
1353      */
1354     function updateFuturePosted($blogid) {
1355         global $manager;
1356
1357         $blog =& $manager->getBlog($blogid);
1358         $currenttime = $blog->getCorrectTime(time());
1359         $result = sql_query("SELECT * FROM ".sql_table('item').
1360             " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1361         if (sql_num_rows($result) > 0) {
1362                 $blog->setFuturePost();
1363         }
1364         else {
1365                 $blog->clearFuturePost();
1366         }
1367     }
1368
1369     /**
1370      * @todo document this
1371      */
1372     function action_itemmove() {
1373         global $member, $manager;
1374
1375         $itemid = intRequestVar('itemid');
1376
1377         // only allow if user is allowed to alter item
1378         $member->canAlterItem($itemid) or $this->disallow();
1379
1380         $item =& $manager->getItem($itemid,1,1);
1381
1382         $this->pagehead();
1383         ?>
1384             <h2><?php echo _MOVE_TITLE?></h2>
1385             <form method="post" action="index.php"><div>
1386                 <input type="hidden" name="action" value="itemmoveto" />
1387                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1388
1389                 <?php
1390
1391                     $manager->addTicketHidden();
1392                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1393                 ?>
1394
1395                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1396             </div></form>
1397         <?php
1398         $this->pagefoot();
1399     }
1400
1401     /**
1402      * @todo document this
1403      */
1404     function action_itemmoveto() {
1405         global $member, $manager;
1406
1407         $itemid = intRequestVar('itemid');
1408         $catid = requestVar('catid');
1409
1410         // create new category if needed
1411         if (strstr($catid,'newcat')) {
1412             // get blogid
1413             list($blogid) = sscanf($catid,'newcat-%d');
1414
1415             // create
1416             $blog =& $manager->getBlog($blogid);
1417             $catid = $blog->createNewCategory();
1418
1419             // show error when sth goes wrong
1420             if (!$catid)
1421                 $this->doError(_ERROR_CATCREATEFAIL);
1422         }
1423
1424         // only allow if user is allowed to alter item
1425         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1426
1427         $old_blogid = getBlogIDFromItemId($itemid);
1428
1429         ITEM::move($itemid, $catid);
1430
1431         // set the futurePosted flag on the blog
1432         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1433
1434         // reset the futurePosted in case the item is moved from one blog to another
1435         $this->updateFuturePosted($old_blogid);
1436
1437         if ($catid != intRequestVar('catid'))
1438             $this->action_categoryedit($catid, $blog->getID());
1439         else
1440             $this->action_itemlist(getBlogIDFromCatID($catid));
1441     }
1442
1443     /**
1444      * Moves one item to a given category (category existance should be checked by caller)
1445      * errors are returned
1446      * @param int $itemid
1447      * @param int $destCatid category ID to which the item will be moved
1448      */
1449     function moveOneItem($itemid, $destCatid) {
1450         global $member;
1451
1452         // only allow if user is allowed to move item
1453         if (!$member->canUpdateItem($itemid, $destCatid))
1454             return _ERROR_DISALLOWED;
1455
1456         ITEM::move($itemid, $destCatid);
1457     }
1458
1459     /**
1460      * Adds a item to the chosen blog
1461      */
1462     function action_additem() {
1463         global $manager, $CONF;
1464
1465         $manager->loadClass('ITEM');
1466
1467         $result = ITEM::createFromRequest();
1468
1469         if ($result['status'] == 'error')
1470             $this->error($result['message']);
1471
1472         $blogid = getBlogIDFromItemID($result['itemid']);
1473         $blog =& $manager->getBlog($blogid);
1474         $btimestamp = $blog->getCorrectTime();
1475         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1476
1477         if ($result['status'] == 'newcategory') {
1478             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1479             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1480         } else {
1481             $methodName = 'action_itemList';
1482             call_user_func(array(&$this, $methodName), $blogid);
1483         }
1484     }
1485
1486         /**
1487          * Allows to edit previously made comments
1488          **/
1489         function action_commentedit() {
1490
1491                 global $member, $manager;
1492
1493                 $commentid = intRequestVar('commentid');
1494
1495                 $member->canAlterComment($commentid) or $this->disallow();
1496
1497                 $comment = COMMENT::getComment($commentid);
1498
1499                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1500
1501                 // change <br /> to \n
1502                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1503
1504                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1505                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1506
1507         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1508
1509         $this->pagehead();
1510
1511         ?>
1512         <h2><?php echo _EDITC_TITLE?></h2>
1513
1514         <form action="index.php" method="post"><div>
1515
1516         <input type="hidden" name="action" value="commentupdate" />
1517         <?php $manager->addTicketHidden(); ?>
1518         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1519         <table><tr>
1520             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1521         </tr><tr>
1522             <td><?php echo _EDITC_WHO?></td>
1523             <td>
1524             <?php               if ($comment['member'])
1525                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1526                 else
1527                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1528             ?>
1529             </td>
1530         </tr><tr>
1531             <td><?php echo _EDITC_WHEN?></td>
1532             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1533         </tr><tr>
1534             <td><?php echo _EDITC_HOST?></td>
1535             <td><?php echo  $comment['host']; ?></td>
1536         </tr>
1537         <tr>
1538             <td><?php echo _EDITC_URL; ?></td>
1539             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1540         </tr>
1541         <tr>
1542             <td><?php echo _EDITC_EMAIL; ?></td>
1543             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1544         </tr>
1545         <tr>
1546             <td><?php echo _EDITC_TEXT?></td>
1547             <td>
1548                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1549                     echo $comment['body'];
1550                 ?></textarea>
1551             </td>
1552         </tr><tr>
1553             <td><?php echo _EDITC_EDIT?></td>
1554             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1555         </tr></table>
1556
1557         </div></form>
1558         <?php
1559         $this->pagefoot();
1560     }
1561
1562     /**
1563      * @todo document this
1564      */
1565     function action_commentupdate() {
1566         global $member, $manager;
1567
1568         $commentid = intRequestVar('commentid');
1569
1570         $member->canAlterComment($commentid) or $this->disallow();
1571
1572         $url = postVar('url');
1573         $email = postVar('email');
1574         $body = postVar('body');
1575
1576                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1577                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1578                 # important note that '\' must be matched with '\\\\' in preg* expressions
1579
1580                 // intercept words that are too long
1581                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1582                 {
1583                         $this->error(_ERROR_COMMENT_LONGWORD);
1584                 }
1585
1586                 // check length
1587                 if (i18n::strlen($body) < 3)
1588                 {
1589                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1590                 }
1591
1592                 if (i18n::strlen($body) > 5000)
1593                 {
1594                         $this->error(_ERROR_COMMENT_TOOLONG);
1595                 }
1596
1597         // prepare body
1598         $body = COMMENT::prepareBody($body);
1599
1600         // call plugins
1601         $manager->notify('PreUpdateComment',array('body' => &$body));
1602
1603         $query = 'UPDATE ' . sql_table('comment')
1604                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1605                . " WHERE cnumber = " . $commentid;
1606         sql_query($query);
1607
1608         // get itemid
1609         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1610         $o = sql_fetch_object($res);
1611         $itemid = $o->citem;
1612
1613         if ($member->canAlterItem($itemid))
1614             $this->action_itemcommentlist($itemid);
1615         else
1616             $this->action_browseowncomments();
1617
1618     }
1619
1620     /**
1621      * @todo document this
1622      */
1623     function action_commentdelete() {
1624         global $member, $manager;
1625
1626         $commentid = intRequestVar('commentid');
1627
1628         $member->canAlterComment($commentid) or $this->disallow();
1629
1630         $comment = COMMENT::getComment($commentid);
1631
1632         $body = strip_tags($comment['body']);
1633         $body = i18n::hsc(shorten($body, 300, '...'));
1634
1635         if ($comment['member'])
1636             $author = $comment['member'];
1637         else
1638             $author = $comment['user'];
1639
1640         $this->pagehead();
1641         ?>
1642
1643             <h2><?php echo _DELETE_CONFIRM?></h2>
1644
1645             <p><?php echo _CONFIRMTXT_COMMENT?></p>
1646
1647             <div class="note">
1648             <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1649             <br />
1650             <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1651             </div>
1652
1653             <form method="post" action="index.php"><div>
1654                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1655                 <?php $manager->addTicketHidden() ?>
1656                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1657                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1658             </div></form>
1659         <?php
1660         $this->pagefoot();
1661     }
1662
1663     /**
1664      * @todo document this
1665      */
1666     function action_commentdeleteconfirm() {
1667         global $member;
1668
1669         $commentid = intRequestVar('commentid');
1670
1671         // get item id first
1672         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1673         $o = sql_fetch_object($res);
1674         $itemid = $o->citem;
1675
1676         $error = $this->deleteOneComment($commentid);
1677         if ($error)
1678             $this->doError($error);
1679
1680         if ($member->canAlterItem($itemid))
1681             $this->action_itemcommentlist($itemid);
1682         else
1683             $this->action_browseowncomments();
1684     }
1685
1686     /**
1687      * @todo document this
1688      */
1689     function deleteOneComment($commentid) {
1690         global $member, $manager;
1691
1692         $commentid = intval($commentid);
1693
1694         if (!$member->canAlterComment($commentid))
1695             return _ERROR_DISALLOWED;
1696
1697         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1698
1699         // delete the comments associated with the item
1700         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1701         sql_query($query);
1702
1703         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1704
1705         return '';
1706     }
1707
1708     /**
1709      * Usermanagement main
1710      */
1711     function action_usermanagement() {
1712         global $member, $manager;
1713
1714         // check if allowed
1715         $member->isAdmin() or $this->disallow();
1716
1717         $this->pagehead();
1718
1719         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1720
1721         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1722
1723         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1724
1725         // show list of members with actions
1726         $query =  'SELECT *'
1727                . ' FROM '.sql_table('member');
1728         $template['content'] = 'memberlist';
1729         $template['tabindex'] = 10;
1730
1731         $manager->loadClass("ENCAPSULATE");
1732         $batch = new BATCH('member');
1733         $batch->showlist($query,'table',$template);
1734
1735         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1736         ?>
1737             <form method="post" action="index.php" name="memberedit"><div>
1738
1739             <input type="hidden" name="action" value="memberadd" />
1740             <?php $manager->addTicketHidden() ?>
1741
1742             <table>
1743             <tr>
1744                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1745             </tr><tr>
1746                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1747                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1748                 </td>
1749                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1750             </tr><tr>
1751                 <td><?php echo _MEMBERS_REALNAME?></td>
1752                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1753             </tr><tr>
1754                 <td><?php echo _MEMBERS_PWD?></td>
1755                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1756             </tr><tr>
1757                 <td><?php echo _MEMBERS_REPPWD?></td>
1758                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1759             </tr><tr>
1760                 <td><?php echo _MEMBERS_EMAIL?></td>
1761                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1762             </tr><tr>
1763                 <td><?php echo _MEMBERS_URL?></td>
1764                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1765             </tr><tr>
1766                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1767                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1768             </tr><tr>
1769                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1770                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1771             </tr><tr>
1772                 <td><?php echo _MEMBERS_NOTES?></td>
1773                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1774             </tr><tr>
1775                 <td><?php echo _MEMBERS_NEW?></td>
1776                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1777             </tr></table>
1778
1779             </div></form>
1780         <?php
1781         $this->pagefoot();
1782     }
1783
1784     /**
1785      * Edit member settings
1786      */
1787     function action_memberedit() {
1788         $this->action_editmembersettings(intRequestVar('memberid'));
1789     }
1790
1791         /**
1792          * @todo document this
1793          */
1794         function action_editmembersettings($memberid = '') {
1795                 global $member, $manager, $CONF;
1796
1797                 if ($memberid == '')
1798                 {
1799                         $memberid = $member->getID();
1800                 }
1801
1802                 // check if allowed
1803                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1804
1805                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1806                 $this->pagehead($extrahead);
1807
1808                 // show message to go back to member overview (only for admins)
1809                 if ($member->isAdmin())
1810                 {
1811                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1812                 }
1813                 else
1814                 {
1815                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1816                 }
1817                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1818
1819                 $mem = MEMBER::createFromID($memberid);
1820                 ?>
1821                 <form method="post" action="index.php" name="memberedit"><div>
1822
1823                 <input type="hidden" name="action" value="changemembersettings" />
1824                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1825                 <?php $manager->addTicketHidden() ?>
1826
1827                 <table><tr>
1828                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1829                 </tr><tr>
1830                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1831                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1832                         </td>
1833                         <td>
1834                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1835                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  i18n::hsc($mem->getDisplayName()); ?>" />
1836                         <?php } else {
1837                                 echo i18n::hsc($member->getDisplayName());
1838                            }
1839                         ?>
1840                         </td>
1841                 </tr><tr>
1842                         <td><?php echo _MEMBERS_REALNAME?></td>
1843                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  i18n::hsc($mem->getRealName()); ?>" /></td>
1844                 </tr><tr>
1845                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1846                         <td><?php echo _MEMBERS_PWD?></td>
1847                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1848                 </tr><tr>
1849                         <td><?php echo _MEMBERS_REPPWD?></td>
1850                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1851                 <?php } ?>
1852                 </tr><tr>
1853                         <td><?php echo _MEMBERS_EMAIL?>
1854                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1855                         </td>
1856                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  i18n::hsc($mem->getEmail()); ?>" /></td>
1857                 </tr><tr>
1858                         <td><?php echo _MEMBERS_URL?></td>
1859                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  i18n::hsc($mem->getURL()); ?>" /></td>
1860                 <?php // only allow to change this by super-admins
1861                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1862                    if ($member->isAdmin()) {
1863                 ?>
1864                         </tr><tr>
1865                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1866                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1867                         </tr><tr>
1868                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1869                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1870                 <?php } ?>
1871                 </tr><tr>
1872                         <td><?php echo _MEMBERS_NOTES?></td>
1873                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  i18n::hsc($mem->getNotes()); ?>" /></td>
1874                 </tr><tr>
1875                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1876                         </td>
1877                         <td>
1878
1879                                 <select name="deflang" tabindex="85">
1880                                 <?php
1881                                 $locales = i18n::get_available_locale_list();
1882                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1883                                 {
1884                                         echo "<option value=\"\" selected=\"selected\">" . i18n::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1885                                 }
1886                                 else
1887                                 {
1888                                         echo "<option value=\"\">" . i18n::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1889                                 }
1890
1891                                 foreach( $locales as $locale )
1892                                 {
1893                                         if( $locale == $mem->getLocale() )
1894                                         {
1895                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1896                                         }
1897                                         else
1898                                         {
1899                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1900                                         }
1901                                 }
1902                                 ?>
1903                                 </select>
1904
1905                         </td>
1906                 </tr>
1907                 <tr>
1908                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1909                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1910                 </tr>
1911                 <?php
1912                         // plugin options
1913                         $this->_insertPluginOptions('member',$memberid);
1914                 ?>
1915                 <tr>
1916                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1917                 </tr><tr>
1918                         <td><?php echo _MEMBERS_EDIT?></td>
1919                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1920                 </tr></table>
1921
1922                 </div></form>
1923
1924                 <?php
1925                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1926
1927                         $manager->notify(
1928                                 'MemberSettingsFormExtras',
1929                                 array(
1930                                         'member' => &$mem
1931                                 )
1932                         );
1933                 $this->pagefoot();
1934         }
1935
1936     /**
1937      * @todo document this
1938      */
1939     function action_changemembersettings() {
1940         global $member, $CONF, $manager;
1941
1942         $memberid = intRequestVar('memberid');
1943
1944         // check if allowed
1945         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1946
1947         $name           = trim(strip_tags(postVar('name')));
1948         $realname       = trim(strip_tags(postVar('realname')));
1949         $password       = postVar('password');
1950         $repeatpassword = postVar('repeatpassword');
1951         $email          = strip_tags(postVar('email'));
1952         $url            = strip_tags(postVar('url'));
1953
1954                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1955                 # original eregi: !eregi("^https?://", $url)
1956
1957                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1958                 if (!preg_match('#^https?://#', $url) )
1959                 {
1960                         $url = 'http://' . $url;
1961                 }
1962
1963         $admin          = postVar('admin');
1964         $canlogin       = postVar('canlogin');
1965         $notes          = strip_tags(postVar('notes'));
1966         $locale        = postVar('deflang');
1967
1968         $mem = MEMBER::createFromID($memberid);
1969
1970         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1971
1972             if (!isValidDisplayName($name))
1973                 $this->error(_ERROR_BADNAME);
1974
1975             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1976                 $this->error(_ERROR_NICKNAMEINUSE);
1977
1978             if ($password != $repeatpassword)
1979                 $this->error(_ERROR_PASSWORDMISMATCH);
1980
1981             if ($password && (i18n::strlen($password) < 6))
1982                 $this->error(_ERROR_PASSWORDTOOSHORT);
1983
1984             if ($password) {
1985                                 $pwdvalid = true;
1986                                 $pwderror = '';
1987                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
1988                                 if (!$pwdvalid) {
1989                                         $this->error($pwderror);
1990                                 }
1991                         }
1992                 }
1993
1994                 if ( !isValidMailAddress($email) )
1995                 {
1996                         $this->error(_ERROR_BADMAILADDRESS);
1997                 }
1998                 if ( !$realname )
1999                 {
2000                         $this->error(_ERROR_REALNAMEMISSING);
2001                 }
2002         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2003             $this->error(_ERROR_NOSUCHLANGUAGE);
2004
2005         // check if there will remain at least one site member with both the logon and admin rights
2006         // (check occurs when taking away one of these rights from such a member)
2007         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2008              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2009            )
2010         {
2011             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2012             if (sql_num_rows($r) < 2)
2013                 $this->error(_ERROR_ATLEASTONEADMIN);
2014         }
2015
2016         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2017             $mem->setDisplayName($name);
2018             if ($password)
2019                 $mem->setPassword($password);
2020         }
2021
2022         $oldEmail = $mem->getEmail();
2023
2024         $mem->setRealName($realname);
2025         $mem->setEmail($email);
2026         $mem->setURL($url);
2027         $mem->setNotes($notes);
2028         $mem->setLocale($locale);
2029
2030
2031         // only allow super-admins to make changes to the admin status
2032         if ($member->isAdmin()) {
2033             $mem->setAdmin($admin);
2034             $mem->setCanLogin($canlogin);
2035         }
2036
2037         $autosave = postVar ('autosave');
2038         $mem->setAutosave($autosave);
2039
2040         $mem->write();
2041
2042         // store plugin options
2043         $aOptions = requestArray('plugoption');
2044         NucleusPlugin::_applyPluginOptions($aOptions);
2045         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2046
2047         // if email changed, generate new password
2048         if ($oldEmail != $mem->getEmail())
2049         {
2050             $mem->sendActivationLink('addresschange', $oldEmail);
2051             // logout member
2052             $mem->newCookieKey();
2053
2054             // only log out if the member being edited is the current member.
2055             if ($member->getID() == $memberid)
2056                 $member->logout();
2057             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2058             return;
2059         }
2060
2061
2062         if (  ( $mem->getID() == $member->getID() )
2063            && ( $mem->getDisplayName() != $member->getDisplayName() )
2064            ) {
2065             $mem->newCookieKey();
2066             $member->logout();
2067             $this->action_login(_MSG_LOGINAGAIN, 0);
2068         } else {
2069             $this->action_overview(_MSG_SETTINGSCHANGED);
2070         }
2071     }
2072
2073     /**
2074      * @todo document this
2075      */
2076     function action_memberadd() {
2077         global $member, $manager;
2078
2079         // check if allowed
2080         $member->isAdmin() or $this->disallow();
2081
2082         if (postVar('password') != postVar('repeatpassword'))
2083             $this->error(_ERROR_PASSWORDMISMATCH);
2084         if (i18n::strlen(postVar('password')) < 6)
2085             $this->error(_ERROR_PASSWORDTOOSHORT);
2086
2087         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2088         if ($res != 1)
2089             $this->error($res);
2090
2091         // fire PostRegister event
2092         $newmem = new MEMBER();
2093         $newmem->readFromName(postVar('name'));
2094         $manager->notify('PostRegister',array('member' => &$newmem));
2095
2096         $this->action_usermanagement();
2097     }
2098
2099     /**
2100      * Account activation
2101      *
2102      * @author dekarma
2103      */
2104     function action_activate() {
2105
2106         $key = getVar('key');
2107         $this->_showActivationPage($key);
2108     }
2109
2110     /**
2111      * @todo document this
2112      */
2113     function _showActivationPage($key, $message = '')
2114     {
2115         global $manager;
2116
2117         // clean up old activation keys
2118         MEMBER::cleanupActivationTable();
2119
2120         // get activation info
2121         $info = MEMBER::getActivationInfo($key);
2122
2123         if (!$info)
2124             $this->error(_ERROR_ACTIVATE);
2125
2126         $mem = MEMBER::createFromId($info->vmember);
2127
2128         if (!$mem)
2129             $this->error(_ERROR_ACTIVATE);
2130
2131         $text = '';
2132         $title = '';
2133         $bNeedsPasswordChange = true;
2134
2135         switch ($info->vtype)
2136         {
2137             case 'forgot':
2138                 $title = _ACTIVATE_FORGOT_TITLE;
2139                 $text = _ACTIVATE_FORGOT_TEXT;
2140                 break;
2141             case 'register':
2142                 $title = _ACTIVATE_REGISTER_TITLE;
2143                 $text = _ACTIVATE_REGISTER_TEXT;
2144                 break;
2145             case 'addresschange':
2146                 $title = _ACTIVATE_CHANGE_TITLE;
2147                 $text = _ACTIVATE_CHANGE_TEXT;
2148                 $bNeedsPasswordChange = false;
2149                 MEMBER::activate($key);
2150                 break;
2151         }
2152
2153         $aVars = array(
2154             'memberName' => i18n::hsc($mem->getDisplayName())
2155         );
2156         $title = TEMPLATE::fill($title, $aVars);
2157         $text = TEMPLATE::fill($text, $aVars);
2158
2159         $this->pagehead();
2160
2161             echo '<h2>' , $title, '</h2>';
2162             echo '<p>' , $text, '</p>';
2163
2164             if ($message != '')
2165             {
2166                 echo '<p class="error">',$message,'</p>';
2167             }
2168
2169             if ($bNeedsPasswordChange)
2170             {
2171                 ?>
2172                     <div><form action="index.php" method="post">
2173
2174                         <input type="hidden" name="action" value="activatesetpwd" />
2175                         <?php $manager->addTicketHidden() ?>
2176                         <input type="hidden" name="key" value="<?php echo i18n::hsc($key) ?>" />
2177
2178                         <table><tr>
2179                             <td><?php echo _MEMBERS_PWD?></td>
2180                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2181                         </tr><tr>
2182                             <td><?php echo _MEMBERS_REPPWD?></td>
2183                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2184                         <?php
2185
2186                             global $manager;
2187                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2188
2189                         ?>
2190                         </tr><tr>
2191                             <td><?php echo _MEMBERS_SETPWD ?></td>
2192                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2193                         </tr></table>
2194
2195
2196                     </form></div>
2197
2198                 <?php
2199
2200             }
2201
2202         $this->pagefoot();
2203
2204     }
2205
2206     /**
2207      * Account activation - set password part
2208      *
2209      * @author dekarma
2210      */
2211     function action_activatesetpwd() {
2212
2213         $key = postVar('key');
2214
2215         // clean up old activation keys
2216         MEMBER::cleanupActivationTable();
2217
2218         // get activation info
2219         $info = MEMBER::getActivationInfo($key);
2220
2221         if (!$info || ($info->type == 'addresschange'))
2222             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2223
2224         $mem = MEMBER::createFromId($info->vmember);
2225
2226         if (!$mem)
2227             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2228
2229         $password       = postVar('password');
2230         $repeatpassword = postVar('repeatpassword');
2231
2232         if ($password != $repeatpassword)
2233             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2234
2235         if ($password && (i18n::strlen($password) < 6))
2236             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2237
2238         if ($password) {
2239                         $pwdvalid = true;
2240                         $pwderror = '';
2241                         global $manager;
2242                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2243                         if (!$pwdvalid) {
2244                                 return $this->_showActivationPage($key,$pwderror);
2245                         }
2246                 }
2247
2248         $error = '';
2249
2250         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2251         if ($error != '')
2252             return $this->_showActivationPage($key, $error);
2253
2254
2255         // set password
2256         $mem->setPassword($password);
2257         $mem->write();
2258
2259         // do the activation
2260         MEMBER::activate($key);
2261
2262         $this->pagehead();
2263             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2264             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2265         $this->pagefoot();
2266     }
2267
2268     /**
2269      * Manage team
2270      */
2271     function action_manageteam() {
2272         global $member, $manager;
2273
2274         $blogid = intRequestVar('blogid');
2275
2276         // check if allowed
2277         $member->blogAdminRights($blogid) or $this->disallow();
2278
2279         $this->pagehead();
2280
2281         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2282
2283         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2284
2285         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2286
2287
2288
2289         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2290                . ' FROM '.sql_table('member').', '.sql_table('team')
2291                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2292
2293         $template['content'] = 'teamlist';
2294         $template['tabindex'] = 10;
2295
2296         $manager->loadClass("ENCAPSULATE");
2297         $batch = new BATCH('team');
2298         $batch->showlist($query, 'table', $template);
2299
2300         ?>
2301             <h3><?php echo _TEAM_ADDNEW?></h3>
2302
2303             <form method='post' action='index.php'><div>
2304
2305             <input type='hidden' name='action' value='teamaddmember' />
2306             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2307             <?php $manager->addTicketHidden() ?>
2308
2309             <table><tr>
2310                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2311                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2312                     $query =  'SELECT mname as text, mnumber as value'
2313                            . ' FROM '.sql_table('member');
2314
2315                     $template['name'] = 'memberid';
2316                     $template['tabindex'] = 10000;
2317                     showlist($query,'select',$template);
2318                 ?></td>
2319             </tr><tr>
2320                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2321                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2322             </tr><tr>
2323                 <td><?php echo _TEAM_ADD?></td>
2324                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2325             </tr></table>
2326
2327             </div></form>
2328         <?php
2329         $this->pagefoot();
2330     }
2331
2332     /**
2333      * Add member to team
2334      */
2335     function action_teamaddmember() {
2336         global $member, $manager;
2337
2338         $memberid = intPostVar('memberid');
2339         $blogid = intPostVar('blogid');
2340         $admin = intPostVar('admin');
2341
2342         // check if allowed
2343         $member->blogAdminRights($blogid) or $this->disallow();
2344
2345         $blog =& $manager->getBlog($blogid);
2346         if (!$blog->addTeamMember($memberid, $admin))
2347             $this->error(_ERROR_ALREADYONTEAM);
2348
2349         $this->action_manageteam();
2350
2351     }
2352
2353     /**
2354      * @todo document this
2355      */
2356     function action_teamdelete() {
2357         global $member, $manager;
2358
2359         $memberid = intRequestVar('memberid');
2360         $blogid = intRequestVar('blogid');
2361
2362         // check if allowed
2363         $member->blogAdminRights($blogid) or $this->disallow();
2364
2365         $teammem = MEMBER::createFromID($memberid);
2366         $blog =& $manager->getBlog($blogid);
2367
2368         $this->pagehead();
2369         ?>
2370             <h2><?php echo _DELETE_CONFIRM?></h2>
2371
2372             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  i18n::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  i18n::hsc(strip_tags($blog->getName())) ?></b>
2373             </p>
2374
2375
2376             <form method="post" action="index.php"><div>
2377             <input type="hidden" name="action" value="teamdeleteconfirm" />
2378             <?php $manager->addTicketHidden() ?>
2379             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2380             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2381             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2382             </div></form>
2383         <?php
2384         $this->pagefoot();
2385     }
2386
2387     /**
2388      * @todo document this
2389      */
2390     function action_teamdeleteconfirm() {
2391         global $member;
2392
2393         $memberid = intRequestVar('memberid');
2394         $blogid = intRequestVar('blogid');
2395
2396         $error = $this->deleteOneTeamMember($blogid, $memberid);
2397         if ($error)
2398             $this->error($error);
2399
2400
2401         $this->action_manageteam();
2402     }
2403
2404     /**
2405      * @todo document this
2406      */
2407     function deleteOneTeamMember($blogid, $memberid) {
2408         global $member, $manager;
2409
2410         $blogid = intval($blogid);
2411         $memberid = intval($memberid);
2412
2413         // check if allowed
2414         if (!$member->blogAdminRights($blogid))
2415             return _ERROR_DISALLOWED;
2416
2417         // check if: - there remains at least one blog admin
2418         //           - (there remains at least one team member)
2419         $tmem = MEMBER::createFromID($memberid);
2420
2421         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2422
2423         if ($tmem->isBlogAdmin($blogid)) {
2424             // check if there are more blog members left and at least one admin
2425             // (check for at least two admins before deletion)
2426             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2427             $r = sql_query($query);
2428             if (sql_num_rows($r) < 2)
2429                 return _ERROR_ATLEASTONEBLOGADMIN;
2430         }
2431
2432         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2433         sql_query($query);
2434
2435         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2436
2437         return '';
2438     }
2439
2440     /**
2441      * @todo document this
2442      */
2443     function action_teamchangeadmin() {
2444         global $member;
2445
2446         $blogid = intRequestVar('blogid');
2447         $memberid = intRequestVar('memberid');
2448
2449         // check if allowed
2450         $member->blogAdminRights($blogid) or $this->disallow();
2451
2452         $mem = MEMBER::createFromID($memberid);
2453
2454         // don't allow when there is only one admin at this moment
2455         if ($mem->isBlogAdmin($blogid)) {
2456             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2457             if (sql_num_rows($r) == 1)
2458                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2459         }
2460
2461         if ($mem->isBlogAdmin($blogid))
2462             $newval = 0;
2463         else
2464             $newval = 1;
2465
2466         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2467         sql_query($query);
2468
2469         // only show manageteam if member did not change its own admin privileges
2470         if ($member->isBlogAdmin($blogid))
2471             $this->action_manageteam();
2472         else
2473             $this->action_overview(_MSG_ADMINCHANGED);
2474     }
2475
2476     /**
2477      * @todo document this
2478      */
2479     function action_blogsettings() {
2480         global $member, $manager;
2481
2482         $blogid = intRequestVar('blogid');
2483
2484         // check if allowed
2485         $member->blogAdminRights($blogid) or $this->disallow();
2486
2487         $blog =& $manager->getBlog($blogid);
2488
2489         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2490         $this->pagehead($extrahead);
2491
2492         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2493         ?>
2494         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2495
2496         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2497
2498         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2499         <?php
2500             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2501             $aMemberNames = array();
2502             while ($o = sql_fetch_object($res))
2503                 array_push($aMemberNames, i18n::hsc($o->mname) . ' (' . i18n::hsc($o->mrealname). ')');
2504             echo implode(',', $aMemberNames);
2505         ?>
2506         </p>
2507
2508
2509
2510         <p>
2511         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2512         </p>
2513
2514         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2515
2516         <form method="post" action="index.php"><div>
2517
2518         <input type="hidden" name="action" value="blogsettingsupdate" />
2519         <?php $manager->addTicketHidden() ?>
2520         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2521         <table><tr>
2522             <td><?php echo _EBLOG_NAME?></td>
2523             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  i18n::hsc($blog->getName()) ?>" /></td>
2524         </tr><tr>
2525             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2526                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2527             </td>
2528             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  i18n::hsc($blog->getShortName()) ?>" /></td>
2529         </tr><tr>
2530             <td><?php echo _EBLOG_DESC?></td>
2531             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  i18n::hsc($blog->getDescription()) ?>" /></td>
2532         </tr><tr>
2533             <td><?php echo _EBLOG_URL?></td>
2534             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  i18n::hsc($blog->getURL()) ?>" /></td>
2535         </tr><tr>
2536             <td><?php echo _EBLOG_DEFSKIN?>
2537                 <?php help('blogdefaultskin'); ?>
2538             </td>
2539             <td>
2540                 <?php
2541                     $query =  'SELECT sdname as text, sdnumber as value'
2542                            . ' FROM '.sql_table('skin_desc');
2543                     $template['name'] = 'defskin';
2544                     $template['selected'] = $blog->getDefaultSkin();
2545                     $template['tabindex'] = 50;
2546                     showlist($query,'select',$template);
2547                 ?>
2548
2549             </td>
2550         </tr><tr>
2551             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2552             </td>
2553             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2554         </tr><tr>
2555             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2556             </td>
2557             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2558         </tr><tr>
2559             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2560             </td>
2561             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2562         </tr><tr>
2563             <td><?php echo _EBLOG_ANONYMOUS?>
2564             </td>
2565             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2566         </tr><tr>
2567     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2568          </td>
2569          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2570       </tr><tr>
2571             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2572             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  i18n::hsc($blog->getNotifyAddress()); ?>" /></td>
2573         </tr><tr>
2574             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2575             <td>
2576                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2577                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2578                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2579                 <br />
2580                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2581                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2582                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2583                 <br />
2584                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2585                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2586                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2587             </td>
2588         </tr><tr>
2589             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2590             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  i18n::hsc($blog->getMaxComments()); ?>" /></td>
2591         </tr><tr>
2592             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2593             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  i18n::hsc($blog->getUpdateFile()) ?>" /></td>
2594         </tr><tr>
2595             <td><?php echo _EBLOG_DEFCAT?></td>
2596             <td>
2597                 <?php
2598                     $query =  'SELECT cname as text, catid as value'
2599                            . ' FROM '.sql_table('category')
2600                            . ' WHERE cblog=' . $blog->getID();
2601                     $template['name'] = 'defcat';
2602                     $template['selected'] = $blog->getDefaultCategory();
2603                     $template['tabindex'] = 110;
2604                     showlist($query,'select',$template);
2605                 ?>
2606             </td>
2607         </tr><tr>
2608             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2609                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2610                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2611                 </td>
2612             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  i18n::hsc($blog->getTimeOffset()); ?>" /></td>
2613         </tr><tr>
2614             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2615             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2616         </tr>
2617         <?php
2618             // plugin options
2619             $this->_insertPluginOptions('blog',$blogid);
2620         ?>
2621         <tr>
2622             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2623         </tr><tr>
2624             <td><?php echo _EBLOG_CHANGE?></td>
2625             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2626         </tr></table>
2627
2628         </div></form>
2629
2630         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2631
2632
2633         <?php
2634         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2635         $template['content'] = 'categorylist';
2636         $template['tabindex'] = 200;
2637
2638         $manager->loadClass("ENCAPSULATE");
2639         $batch = new BATCH('category');
2640         $batch->showlist($query,'table',$template);
2641
2642         ?>
2643
2644
2645         <form action="index.php" method="post"><div>
2646         <input name="action" value="categorynew" type="hidden" />
2647         <?php $manager->addTicketHidden() ?>
2648         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2649
2650         <table><tr>
2651             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2652         </tr><tr>
2653             <td><?php echo _EBLOG_CAT_NAME?></td>
2654             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2655         </tr><tr>
2656             <td><?php echo _EBLOG_CAT_DESC?></td>
2657             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2658         </tr><tr>
2659             <td><?php echo _EBLOG_CAT_CREATE?></td>
2660             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2661         </tr></table>
2662
2663         </div></form>
2664
2665         <?php
2666
2667             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2668
2669             $manager->notify(
2670                 'BlogSettingsFormExtras',
2671                 array(
2672                     'blog' => &$blog
2673                 )
2674             );
2675
2676         $this->pagefoot();
2677     }
2678
2679     /**
2680      * @todo document this
2681      */
2682     function action_categorynew() {
2683         global $member, $manager;
2684
2685         $blogid = intRequestVar('blogid');
2686
2687         $member->blogAdminRights($blogid) or $this->disallow();
2688
2689         $cname = postVar('cname');
2690         $cdesc = postVar('cdesc');
2691
2692         if (!isValidCategoryName($cname))
2693             $this->error(_ERROR_BADCATEGORYNAME);
2694
2695         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2696         $res = sql_query($query);
2697         if (sql_num_rows($res) > 0)
2698             $this->error(_ERROR_DUPCATEGORYNAME);
2699
2700         $blog       =& $manager->getBlog($blogid);
2701         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2702
2703         $this->action_blogsettings();
2704     }
2705
2706     /**
2707      * @todo document this
2708      */
2709     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2710         global $member, $manager;
2711
2712         if ($blogid == '')
2713             $blogid = intGetVar('blogid');
2714         else
2715             $blogid = intval($blogid);
2716         if ($catid == '')
2717             $catid = intGetVar('catid');
2718         else
2719             $catid = intval($catid);
2720
2721         $member->blogAdminRights($blogid) or $this->disallow();
2722
2723         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2724         $obj = sql_fetch_object($res);
2725
2726         $cname = $obj->cname;
2727         $cdesc = $obj->cdesc;
2728
2729         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2730         $this->pagehead($extrahead);
2731
2732         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2733
2734         ?>
2735         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo i18n::hsc($cname)?>'</h2>
2736         <form method='post' action='index.php'><div>
2737         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2738         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2739         <input name="desturl" type="hidden" value="<?php echo i18n::hsc($desturl) ?>" />
2740         <input name="action" type="hidden" value="categoryupdate" />
2741         <?php $manager->addTicketHidden(); ?>
2742
2743         <table><tr>
2744             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2745         </tr><tr>
2746             <td><?php echo _EBLOG_CAT_NAME?></td>
2747             <td><input type="text" name="cname" value="<?php echo i18n::hsc($cname)?>" size="40" maxlength="40" /></td>
2748         </tr><tr>
2749             <td><?php echo _EBLOG_CAT_DESC?></td>
2750             <td><input type="text" name="cdesc" value="<?php echo i18n::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2751         </tr>
2752         <?php
2753             // insert plugin options
2754             $this->_insertPluginOptions('category',$catid);
2755         ?>
2756         <tr>
2757             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2758         </tr><tr>
2759             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2760             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2761         </tr></table>
2762
2763         </div></form>
2764         <?php
2765         $this->pagefoot();
2766     }
2767
2768     /**
2769      * @todo document this
2770      */
2771     function action_categoryupdate() {
2772         global $member, $manager;
2773
2774         $blogid = intPostVar('blogid');
2775         $catid = intPostVar('catid');
2776         $cname = postVar('cname');
2777         $cdesc = postVar('cdesc');
2778         $desturl = postVar('desturl');
2779
2780         $member->blogAdminRights($blogid) or $this->disallow();
2781
2782         if (!isValidCategoryName($cname))
2783             $this->error(_ERROR_BADCATEGORYNAME);
2784
2785         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2786         $res = sql_query($query);
2787         if (sql_num_rows($res) > 0)
2788             $this->error(_ERROR_DUPCATEGORYNAME);
2789
2790         $query =  'UPDATE '.sql_table('category').' SET'
2791                . " cname='" . sql_real_escape_string($cname) . "',"
2792                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2793                . " WHERE catid=" . $catid;
2794
2795         sql_query($query);
2796
2797         // store plugin options
2798         $aOptions = requestArray('plugoption');
2799         NucleusPlugin::_applyPluginOptions($aOptions);
2800         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2801
2802
2803         if ($desturl) {
2804             redirect($desturl);
2805             exit;
2806         } else {
2807             $this->action_blogsettings();
2808         }
2809     }
2810
2811     /**
2812      * @todo document this
2813      */
2814     function action_categorydelete() {
2815         global $member, $manager;
2816
2817         $blogid = intRequestVar('blogid');
2818         $catid = intRequestVar('catid');
2819
2820         $member->blogAdminRights($blogid) or $this->disallow();
2821
2822         $blog =& $manager->getBlog($blogid);
2823
2824         // check if the category is valid
2825         if (!$blog->isValidCategory($catid))
2826             $this->error(_ERROR_NOSUCHCATEGORY);
2827
2828         // don't allow deletion of default category
2829         if ($blog->getDefaultCategory() == $catid)
2830             $this->error(_ERROR_DELETEDEFCATEGORY);
2831
2832         // check if catid is the only category left for blogid
2833         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2834         $res = sql_query($query);
2835         if (sql_num_rows($res) == 1)
2836             $this->error(_ERROR_DELETELASTCATEGORY);
2837
2838
2839         $this->pagehead();
2840         ?>
2841             <h2><?php echo _DELETE_CONFIRM?></h2>
2842
2843             <div>
2844             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  i18n::hsc($blog->getCategoryName($catid))?></b>
2845             </div>
2846
2847             <form method="post" action="index.php"><div>
2848             <input type="hidden" name="action" value="categorydeleteconfirm" />
2849             <?php $manager->addTicketHidden() ?>
2850             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2851             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2852             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2853             </div></form>
2854         <?php
2855         $this->pagefoot();
2856     }
2857
2858     /**
2859      * @todo document this
2860      */
2861     function action_categorydeleteconfirm() {
2862         global $member, $manager;
2863
2864         $blogid = intRequestVar('blogid');
2865         $catid = intRequestVar('catid');
2866
2867         $member->blogAdminRights($blogid) or $this->disallow();
2868
2869         $error = $this->deleteOneCategory($catid);
2870         if ($error)
2871             $this->error($error);
2872
2873         $this->action_blogsettings();
2874     }
2875
2876     /**
2877      * @todo document this
2878      */
2879     function deleteOneCategory($catid) {
2880         global $manager, $member;
2881
2882         $catid = intval($catid);
2883
2884         $blogid = getBlogIDFromCatID($catid);
2885
2886         if (!$member->blogAdminRights($blogid))
2887             return ERROR_DISALLOWED;
2888
2889         // get blog
2890         $blog =& $manager->getBlog($blogid);
2891
2892         // check if the category is valid
2893         if (!$blog || !$blog->isValidCategory($catid))
2894             return _ERROR_NOSUCHCATEGORY;
2895
2896         $destcatid = $blog->getDefaultCategory();
2897
2898         // don't allow deletion of default category
2899         if ($blog->getDefaultCategory() == $catid)
2900             return _ERROR_DELETEDEFCATEGORY;
2901
2902         // check if catid is the only category left for blogid
2903         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2904         $res = sql_query($query);
2905         if (sql_num_rows($res) == 1)
2906             return _ERROR_DELETELASTCATEGORY;
2907
2908         $manager->notify('PreDeleteCategory', array('catid' => $catid));
2909
2910         // change category for all items to the default category
2911         $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2912         sql_query($query);
2913
2914         // delete all associated plugin options
2915         NucleusPlugin::_deleteOptionValues('category', $catid);
2916
2917         // delete category
2918         $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2919         sql_query($query);
2920
2921         $manager->notify('PostDeleteCategory', array('catid' => $catid));
2922
2923     }
2924
2925     /**
2926      * @todo document this
2927      */
2928     function moveOneCategory($catid, $destblogid) {
2929         global $manager, $member;
2930
2931         $catid = intval($catid);
2932         $destblogid = intval($destblogid);
2933
2934         $blogid = getBlogIDFromCatID($catid);
2935
2936         // mover should have admin rights on both blogs
2937         if (!$member->blogAdminRights($blogid))
2938             return _ERROR_DISALLOWED;
2939         if (!$member->blogAdminRights($destblogid))
2940             return _ERROR_DISALLOWED;
2941
2942         // cannot move to self
2943         if ($blogid == $destblogid)
2944             return _ERROR_MOVETOSELF;
2945
2946         // get blogs
2947         $blog =& $manager->getBlog($blogid);
2948         $destblog =& $manager->getBlog($destblogid);
2949
2950         // check if the category is valid
2951         if (!$blog || !$blog->isValidCategory($catid))
2952             return _ERROR_NOSUCHCATEGORY;
2953
2954         // don't allow default category to be moved
2955         if ($blog->getDefaultCategory() == $catid)
2956             return _ERROR_MOVEDEFCATEGORY;
2957
2958         $manager->notify(
2959             'PreMoveCategory',
2960             array(
2961                 'catid' => &$catid,
2962                 'sourceblog' => &$blog,
2963                 'destblog' => &$destblog
2964             )
2965         );
2966
2967         // update comments table (cblog)
2968         $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2969         $items = sql_query($query);
2970         while ($oItem = sql_fetch_object($items)) {
2971             sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2972         }
2973
2974         // update items (iblog)
2975         $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2976         sql_query($query);
2977
2978         // move category
2979         $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2980         sql_query($query);
2981
2982         $manager->notify(
2983             'PostMoveCategory',
2984             array(
2985                 'catid' => &$catid,
2986                 'sourceblog' => &$blog,
2987                 'destblog' => $destblog
2988             )
2989         );
2990
2991     }
2992
2993         /**
2994          * @todo document this
2995          */
2996         function action_blogsettingsupdate()
2997         {
2998                 global $member, $manager;
2999
3000                 $blogid = intRequestVar('blogid');
3001
3002                 $member->blogAdminRights($blogid) or $this->disallow();
3003
3004                 $blog =& $manager->getBlog($blogid);
3005
3006                 $notify         = trim(postVar('notify'));
3007                 $shortname              = trim(postVar('shortname'));
3008                 $updatefile     = trim(postVar('update'));
3009
3010                 $notifyComment  = intPostVar('notifyComment');
3011                 $notifyVote             = intPostVar('notifyVote');
3012                 $notifyNewItem  = intPostVar('notifyNewItem');
3013
3014                 if ($notifyComment == 0)
3015                 {
3016                         $notifyComment = 1;
3017                 }
3018                 if ($notifyVote == 0)
3019                 {
3020                         $notifyVote = 1;
3021                 }
3022                 if ($notifyNewItem == 0)
3023                 {
3024                         $notifyNewItem = 1;
3025                 }
3026                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3027
3028                 if ($notify)
3029                 {
3030                         $not = new NOTIFICATION($notify);
3031                         if (!$not->validAddresses())
3032                         {
3033                                 $this->error(_ERROR_BADNOTIFY);
3034                         }
3035                 }
3036
3037                 if (!isValidShortName($shortname))
3038                 {
3039                         $this->error(_ERROR_BADSHORTBLOGNAME);
3040                 }
3041
3042                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
3043                 {
3044                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3045                 }
3046                 // check if update file is writable
3047                 if ($updatefile && !is_writeable($updatefile))
3048                 {
3049                         $this->error(_ERROR_UPDATEFILE);
3050                 }
3051
3052                 $blog->setName(trim(postVar('name')));
3053                 $blog->setShortName($shortname);
3054                 $blog->setNotifyAddress($notify);
3055                 $blog->setNotifyType($notifyType);
3056                 $blog->setMaxComments(postVar('maxcomments'));
3057                 $blog->setCommentsEnabled(postVar('comments'));
3058                 $blog->setTimeOffset(postVar('timeoffset'));
3059                 $blog->setUpdateFile($updatefile);
3060                 $blog->setURL(trim(postVar('url')));
3061                 $blog->setDefaultSkin(intPostVar('defskin'));
3062                 $blog->setDescription(trim(postVar('desc')));
3063                 $blog->setPublic(postVar('public'));
3064                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3065                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3066                 $blog->setDefaultCategory(intPostVar('defcat'));
3067                 $blog->setSearchable(intPostVar('searchable'));
3068                 $blog->setEmailRequired(intPostVar('reqemail'));
3069                 $blog->writeSettings();
3070
3071                 // store plugin options
3072                 $aOptions = requestArray('plugoption');
3073                 NucleusPlugin::_applyPluginOptions($aOptions);
3074                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3075
3076                 $this->action_overview(_MSG_SETTINGSCHANGED);
3077         }
3078
3079     /**
3080      * @todo document this
3081      */
3082     function action_deleteblog() {
3083         global $member, $CONF, $manager;
3084
3085         $blogid = intRequestVar('blogid');
3086
3087         $member->blogAdminRights($blogid) or $this->disallow();
3088
3089         // check if blog is default blog
3090         if ($CONF['DefaultBlog'] == $blogid)
3091             $this->error(_ERROR_DELDEFBLOG);
3092
3093         $blog =& $manager->getBlog($blogid);
3094
3095         $this->pagehead();
3096         ?>
3097             <h2><?php echo _DELETE_CONFIRM?></h2>
3098
3099             <p><?php echo _WARNINGTXT_BLOGDEL?>
3100             </p>
3101
3102             <div>
3103             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  i18n::hsc($blog->getName())?></b>
3104             </div>
3105
3106             <form method="post" action="index.php"><div>
3107             <input type="hidden" name="action" value="deleteblogconfirm" />
3108             <?php $manager->addTicketHidden() ?>
3109             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3110             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3111             </div></form>
3112         <?php
3113         $this->pagefoot();
3114     }
3115
3116     /**
3117      * @todo document this
3118      */
3119     function action_deleteblogconfirm() {
3120         global $member, $CONF, $manager;
3121
3122         $blogid = intRequestVar('blogid');
3123
3124         $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3125
3126         $member->blogAdminRights($blogid) or $this->disallow();
3127
3128         // check if blog is default blog
3129         if ($CONF['DefaultBlog'] == $blogid)
3130             $this->error(_ERROR_DELDEFBLOG);
3131
3132         // delete all comments
3133         $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3134         sql_query($query);
3135
3136         // delete all items
3137         $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3138         sql_query($query);
3139
3140         // delete all team members
3141         $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3142         sql_query($query);
3143
3144         // delete all bans
3145         $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3146         sql_query($query);
3147
3148         // delete all categories
3149         $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3150         sql_query($query);
3151
3152         // delete all associated plugin options
3153         NucleusPlugin::_deleteOptionValues('blog', $blogid);
3154
3155         // delete the blog itself
3156         $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3157         sql_query($query);
3158
3159         $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3160
3161         $this->action_overview(_DELETED_BLOG);
3162     }
3163
3164     /**
3165      * @todo document this
3166      */
3167     function action_memberdelete() {
3168         global $member, $manager;
3169
3170         $memberid = intRequestVar('memberid');
3171
3172         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3173
3174         $mem = MEMBER::createFromID($memberid);
3175
3176         $this->pagehead();
3177         ?>
3178             <h2><?php echo _DELETE_CONFIRM?></h2>
3179
3180             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo i18n::hsc($mem->getDisplayName()) ?></b>
3181             </p>
3182
3183             <p>
3184             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3185             </p>
3186
3187             <form method="post" action="index.php"><div>
3188             <input type="hidden" name="action" value="memberdeleteconfirm" />
3189             <?php $manager->addTicketHidden() ?>
3190             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3191             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3192             </div></form>
3193         <?php
3194         $this->pagefoot();
3195     }
3196
3197     /**
3198      * @todo document this
3199      */
3200     function action_memberdeleteconfirm() {
3201         global $member;
3202
3203         $memberid = intRequestVar('memberid');
3204
3205         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3206
3207         $error = $this->deleteOneMember($memberid);
3208         if ($error)
3209             $this->error($error);
3210
3211         if ($member->isAdmin())
3212             $this->action_usermanagement();
3213         else
3214             $this->action_overview(_DELETED_MEMBER);
3215     }
3216
3217     /**
3218      * @static
3219      * @todo document this
3220      */
3221     function deleteOneMember($memberid) {
3222         global $manager;
3223
3224         $memberid = intval($memberid);
3225         $mem = MEMBER::createFromID($memberid);
3226
3227         if (!$mem->canBeDeleted())
3228             return _ERROR_DELETEMEMBER;
3229
3230         $manager->notify('PreDeleteMember', array('member' => &$mem));
3231
3232         /* unlink comments from memberid */
3233         if ($memberid) {
3234             $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. sql_real_escape_string($mem->getDisplayName())
3235                         .'" WHERE cmember='.$memberid;
3236             sql_query($query);
3237         }
3238
3239         $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3240         sql_query($query);
3241
3242         $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3243         sql_query($query);
3244
3245         $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3246         sql_query($query);
3247
3248         // delete all associated plugin options
3249         NucleusPlugin::_deleteOptionValues('member', $memberid);
3250
3251         $manager->notify('PostDeleteMember', array('member' => &$mem));
3252
3253         return '';
3254     }
3255
3256     /**
3257      * @todo document this
3258      */
3259     function action_createnewlog() {
3260         global $member, $CONF, $manager;
3261
3262         // Only Super-Admins can do this
3263         $member->isAdmin() or $this->disallow();
3264
3265         $this->pagehead();
3266
3267         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3268         ?>
3269         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3270
3271         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3272
3273         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3274
3275         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3276
3277         <ol>
3278             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3279             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3280         </ol>
3281
3282         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3283
3284         <p>
3285         <?php echo _EBLOG_CREATE_TEXT?>
3286         </p>
3287
3288         <form method="post" action="index.php"><div>
3289
3290         <input type="hidden" name="action" value="addnewlog" />
3291         <?php $manager->addTicketHidden() ?>
3292
3293
3294         <table><tr>
3295             <td><?php echo _EBLOG_NAME?></td>
3296             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3297         </tr><tr>
3298             <td><?php echo _EBLOG_SHORTNAME?>
3299                 <?php help('shortblogname'); ?>
3300             </td>
3301             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3302         </tr><tr>
3303             <td><?php echo _EBLOG_DESC?></td>
3304             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3305         </tr><tr>
3306             <td><?php echo _EBLOG_DEFSKIN?>
3307                 <?php help('blogdefaultskin'); ?>
3308             </td>
3309             <td>
3310                 <?php
3311                     $query =  'SELECT sdname as text, sdnumber as value'
3312                            . ' FROM '.sql_table('skin_desc');
3313                     $template['name'] = 'defskin';
3314                     $template['tabindex'] = 50;
3315                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3316                     showlist($query,'select',$template);
3317                 ?>
3318             </td>
3319         </tr><tr>
3320             <td><?php echo _EBLOG_OFFSET?>
3321                 <?php help('blogtimeoffset'); ?>
3322                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3323             </td>
3324             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3325         </tr><tr>
3326             <td><?php echo _EBLOG_ADMIN?>
3327                 <?php help('teamadmin'); ?>
3328             </td>
3329             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3330         </tr><tr>
3331             <td><?php echo _EBLOG_CREATE?></td>
3332             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3333         </tr></table>
3334
3335         </div></form>
3336         <?php
3337         $this->pagefoot();
3338     }
3339
3340     /**
3341      * @todo document this
3342      */
3343     function action_addnewlog() {
3344         global $member, $manager, $CONF;
3345
3346         // Only Super-Admins can do this
3347         $member->isAdmin() or $this->disallow();
3348
3349         $bname          = trim(postVar('name'));
3350         $bshortname     = trim(postVar('shortname'));
3351         $btimeoffset    = postVar('timeoffset');
3352         $bdesc          = trim(postVar('desc'));
3353         $bdefskin       = postVar('defskin');
3354
3355         if (!isValidShortName($bshortname))
3356             $this->error(_ERROR_BADSHORTBLOGNAME);
3357
3358         if ($manager->existsBlog($bshortname))
3359             $this->error(_ERROR_DUPSHORTBLOGNAME);
3360
3361         $manager->notify(
3362             'PreAddBlog',
3363             array(
3364                 'name' => &$bname,
3365                 'shortname' => &$bshortname,
3366                 'timeoffset' => &$btimeoffset,
3367                 'description' => &$bdesc,
3368                 'defaultskin' => &$bdefskin
3369             )
3370         );
3371
3372
3373         // add slashes for sql queries
3374         $bname =        sql_real_escape_string($bname);
3375         $bshortname =   sql_real_escape_string($bshortname);
3376         $btimeoffset =  sql_real_escape_string($btimeoffset);
3377         $bdesc =        sql_real_escape_string($bdesc);
3378         $bdefskin =     sql_real_escape_string($bdefskin);
3379
3380         // create blog
3381         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3382         sql_query($query);
3383         $blogid = sql_insert_id();
3384         $blog   =& $manager->getBlog($blogid);
3385
3386         // create new category
3387         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3388         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3389         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3390         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3391 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3392 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3393         $catid = sql_insert_id();
3394
3395         // set as default category
3396         $blog->setDefaultCategory($catid);
3397         $blog->writeSettings();
3398
3399         // create team member
3400         $memberid = $member->getID();
3401         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3402         sql_query($query);
3403
3404         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3405         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3406
3407         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3408         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3409
3410
3411
3412         $manager->notify(
3413             'PostAddBlog',
3414             array(
3415                 'blog' => &$blog
3416             )
3417         );
3418
3419         $manager->notify(
3420             'PostAddCategory',
3421             array(
3422                 'blog' => &$blog,
3423                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3424                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3425                 'catid' => $catid
3426             )
3427         );
3428
3429         $this->pagehead();
3430         ?>
3431         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3432
3433         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, i18n::hsc($bname)) ?></p>
3434
3435         <ol>
3436             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, i18n::hsc($bshortname)) ?></a></li>
3437             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3438         </ol>
3439
3440         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, i18n::hsc($bshortname)) ?></a></h3>
3441
3442         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, i18n::hsc($bshortname)) ?></p>
3443 <pre><code>&lt;?php
3444
3445 $CONF['Self'] = '<b><?php echo i18n::hsc($bshortname)?>.php</b>';
3446
3447 include('<i>./config.php</i>');
3448
3449 selectBlog('<b><?php echo i18n::hsc($bshortname)?></b>');
3450 selector();
3451
3452 ?&gt;</code></pre>
3453
3454         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3455
3456         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3457
3458         <form action="index.php" method="post"><div>
3459             <input type="hidden" name="action" value="addnewlog2" />
3460             <?php $manager->addTicketHidden() ?>
3461             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3462             <table><tr>
3463                 <td><?php echo _EBLOG_URL?></td>
3464                 <td><input name="url" maxlength="100" size="40" value="<?php echo i18n::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3465             </tr><tr>
3466                 <td><?php echo _EBLOG_CREATE?></td>
3467                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3468             </tr></table>
3469         </div></form>
3470
3471         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3472
3473         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3474
3475         <form action="index.php" method="post"><div>
3476             <input type="hidden" name="action" value="addnewlog2" />
3477             <?php $manager->addTicketHidden() ?>
3478             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3479             <table><tr>
3480                 <td><?php echo _EBLOG_URL?></td>
3481                 <td><input name="url" maxlength="100" size="40" /></td>
3482             </tr><tr>
3483                 <td><?php echo _EBLOG_CREATE?></td>
3484                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3485             </tr></table>
3486         </div></form>
3487
3488         <?php       $this->pagefoot();
3489
3490     }
3491
3492     /**
3493      * @todo document this
3494      */
3495     function action_addnewlog2() {
3496         global $member, $manager;
3497
3498         $member->blogAdminRights($blogid) or $this->disallow();
3499
3500         $burl   = requestVar('url');
3501         $blogid = intRequestVar('blogid');
3502
3503         $blog =& $manager->getBlog($blogid);
3504         $blog->setURL(trim($burl));
3505         $blog->writeSettings();
3506
3507         $this->action_overview(_MSG_NEWBLOG);
3508     }
3509
3510     /**
3511      * @todo document this
3512      */
3513     function action_skinieoverview() {
3514         global $member, $DIR_LIBS, $manager;
3515
3516         $member->isAdmin() or $this->disallow();
3517
3518         // load skinie class
3519         include_once($DIR_LIBS . 'skinie.php');
3520
3521         $this->pagehead();
3522
3523         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3524
3525     ?>
3526         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3527
3528                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3529                 <?php                   global $DIR_SKINS;
3530
3531                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3532
3533                     if (sizeof($candidates) > 0) {
3534                         ?>
3535                             <form method="post" action="index.php"><div>
3536                                 <input type="hidden" name="action" value="skinieimport" />
3537                                 <?php $manager->addTicketHidden() ?>
3538                                 <input type="hidden" name="mode" value="file" />
3539                                 <select name="skinfile" id="skinie_import_local">
3540                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3541                                         $html = i18n::hsc($skinfile);
3542                                         echo '<option value="',$html,'">',$skinname,'</option>';
3543                                     }
3544                                 ?>
3545                                 </select>
3546                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3547                             </div></form>
3548                         <?php                   } else {
3549                         echo _SKINIE_NOCANDIDATES;
3550                     }
3551                 ?>
3552                 </p>
3553
3554                 <p><em><?php echo _OR?></em></p>
3555
3556                 <form method="post" action="index.php"><p>
3557                     <?php $manager->addTicketHidden() ?>
3558                     <input type="hidden" name="action" value="skinieimport" />
3559                     <input type="hidden" name="mode" value="url" />
3560                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3561                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3562                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3563                 </p></form>
3564
3565
3566         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3567         <form method="post" action="index.php"><div>
3568             <input type="hidden" name="action" value="skinieexport" />
3569             <?php $manager->addTicketHidden() ?>
3570
3571             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3572
3573             <table><tr>
3574                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3575             </tr><tr>
3576     <?php       // show list of skins
3577         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3578         while ($skinObj = sql_fetch_object($res)) {
3579             $id = 'skinexp' . $skinObj->sdnumber;
3580             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3581             echo '<label for="',$id,'">',i18n::hsc($skinObj->sdname),'</label></td>';
3582             echo '<td>',i18n::hsc($skinObj->sddesc),'</td>';
3583             echo '</tr><tr>';
3584         }
3585
3586         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3587
3588         // show list of templates
3589         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3590         while ($templateObj = sql_fetch_object($res)) {
3591             $id = 'templateexp' . $templateObj->tdnumber;
3592             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3593             echo '<label for="',$id,'">',i18n::hsc($templateObj->tdname),'</label></td>';
3594             echo '<td>',i18n::hsc($templateObj->tddesc),'</td>';
3595             echo '</tr><tr>';
3596         }
3597
3598     ?>
3599                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3600             </tr><tr>
3601                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3602             </tr><tr>
3603                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3604             </tr><tr>
3605                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3606             </tr></table>
3607         </div></form>
3608
3609     <?php
3610         $this->pagefoot();
3611
3612     }
3613
3614     /**
3615      * @todo document this
3616      */
3617     function action_skinieimport() {
3618         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3619
3620         $member->isAdmin() or $this->disallow();
3621
3622         // load skinie class
3623         include_once($DIR_LIBS . 'skinie.php');
3624
3625         $skinFileRaw= postVar('skinfile');
3626         $mode       = postVar('mode');
3627
3628         $importer = new SKINIMPORT();
3629
3630         // get full filename
3631         if ($mode == 'file')
3632         {
3633             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3634
3635             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3636             if (!file_exists($skinFile))
3637                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3638         } else {
3639             $skinFile = $skinFileRaw;
3640         }
3641
3642         // read only metadata
3643         $error = $importer->readFile($skinFile, 1);
3644
3645         // clashes
3646         $skinNameClashes = $importer->checkSkinNameClashes();
3647         $templateNameClashes = $importer->checkTemplateNameClashes();
3648         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3649
3650         if ($error) $this->error($error);
3651
3652         $this->pagehead();
3653
3654         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3655         ?>
3656         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3657
3658         <ul>
3659             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo i18n::hsc($importer->getInfo())?></p></li>
3660             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3661             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3662             <?php
3663                 if ($hasNameClashes)
3664                 {
3665             ?>
3666             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3667             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3668             <?php
3669                 } // if (hasNameClashes)
3670             ?>
3671         </ul>
3672
3673         <form method="post" action="index.php"><div>
3674             <input type="hidden" name="action" value="skiniedoimport" />
3675             <?php $manager->addTicketHidden() ?>
3676             <input type="hidden" name="skinfile" value="<?php echo i18n::hsc(postVar('skinfile'))?>" />
3677             <input type="hidden" name="mode" value="<?php echo i18n::hsc($mode)?>" />
3678             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3679             <?php
3680                 if ($hasNameClashes)
3681                 {
3682             ?>
3683             <br />
3684             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3685             <?php
3686                 } // if (hasNameClashes)
3687             ?>
3688         </div></form>
3689
3690
3691         <?php
3692         $this->pagefoot();
3693     }
3694
3695     /**
3696      * @todo document this
3697      */
3698     function action_skiniedoimport() {
3699         global $member, $DIR_LIBS, $DIR_SKINS;
3700
3701         $member->isAdmin() or $this->disallow();
3702
3703         // load skinie class
3704         include_once($DIR_LIBS . 'skinie.php');
3705
3706         $skinFileRaw= postVar('skinfile');
3707         $mode       = postVar('mode');
3708
3709         $allowOverwrite = intPostVar('overwrite');
3710
3711         // get full filename
3712         if ($mode == 'file')
3713         {
3714             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3715
3716             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3717             if (!file_exists($skinFile))
3718                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3719
3720         } else {
3721             $skinFile = $skinFileRaw;
3722         }
3723
3724         $importer = new SKINIMPORT();
3725
3726         $error = $importer->readFile($skinFile);
3727
3728         if ($error)
3729             $this->error($error);
3730
3731         $error = $importer->writeToDatabase($allowOverwrite);
3732
3733         if ($error)
3734             $this->error($error);
3735
3736         $this->pagehead();
3737
3738         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3739     ?>
3740         <h2><?php echo _SKINIE_DONE?></h2>
3741
3742         <ul>
3743             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo i18n::hsc($importer->getInfo())?></p></li>
3744             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3745             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3746         </ul>
3747
3748     <?php       $this->pagefoot();
3749
3750     }
3751
3752     /**
3753      * @todo document this
3754      */
3755     function action_skinieexport() {
3756         global $member, $DIR_LIBS;
3757
3758         $member->isAdmin() or $this->disallow();
3759
3760         // load skinie class
3761         include_once($DIR_LIBS . 'skinie.php');
3762
3763         $aSkins = requestIntArray('skin');
3764         $aTemplates = requestIntArray('template');
3765
3766         if (!is_array($aTemplates)) $aTemplates = array();
3767         if (!is_array($aSkins)) $aSkins = array();
3768
3769         $skinList = array_keys($aSkins);
3770         $templateList = array_keys($aTemplates);
3771
3772         $info = postVar('info');
3773
3774         $exporter = new SKINEXPORT();
3775         foreach ($skinList as $skinId) {
3776             $exporter->addSkin($skinId);
3777         }
3778         foreach ($templateList as $templateId) {
3779             $exporter->addTemplate($templateId);
3780         }
3781         $exporter->setInfo($info);
3782
3783         $exporter->export();
3784     }
3785
3786     /**
3787      * @todo document this
3788      */
3789     function action_templateoverview() {
3790         global $member, $manager;
3791
3792         $member->isAdmin() or $this->disallow();
3793
3794         $this->pagehead();
3795
3796         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3797
3798         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3799         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3800
3801         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3802         $template['content'] = 'templatelist';
3803         $template['tabindex'] = 10;
3804         showlist($query,'table',$template);
3805
3806         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3807
3808         ?>
3809         <form method="post" action="index.php"><div>
3810
3811         <input name="action" value="templatenew" type="hidden" />
3812         <?php $manager->addTicketHidden() ?>
3813         <table><tr>
3814             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3815             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3816         </tr><tr>
3817             <td><?php echo _TEMPLATE_DESC?></td>
3818             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3819         </tr><tr>
3820             <td><?php echo _TEMPLATE_CREATE?></td>
3821             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3822         </tr></table>
3823
3824         </div></form>
3825
3826         <?php
3827         $this->pagefoot();
3828     }
3829
3830     /**
3831      * @todo document this
3832      */
3833     function action_templateedit($msg = '') {
3834         global $member, $manager;
3835
3836         $templateid = intRequestVar('templateid');
3837
3838         $member->isAdmin() or $this->disallow();
3839
3840         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3841         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3842
3843         $this->pagehead($extrahead);
3844
3845         $templatename = TEMPLATE::getNameFromId($templateid);
3846         $templatedescription = TEMPLATE::getDesc($templateid);
3847         $template =& $manager->getTemplate($templatename);
3848
3849         ?>
3850         <p>
3851         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3852         </p>
3853
3854         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  i18n::hsc($templatename); ?>'</h2>
3855
3856         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3857         ?>
3858
3859         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3860
3861         <form method="post" action="index.php">
3862         <div>
3863
3864         <input type="hidden" name="action" value="templateupdate" />
3865         <?php $manager->addTicketHidden() ?>
3866         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3867
3868         <table><tr>
3869             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3870         </tr><tr>
3871             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3872             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  i18n::hsc($templatename) ?>" /></td>
3873         </tr><tr>
3874             <td><?php echo _TEMPLATE_DESC?></td>
3875             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  i18n::hsc($templatedescription) ?>" /></td>
3876         </tr><tr>
3877             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3878         </tr><tr>
3879             <td><?php echo _TEMPLATE_UPDATE?></td>
3880             <td>
3881                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3882                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3883             </td>
3884         </tr><tr>
3885             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3886 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3887     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3888     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3889     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3890     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3891     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3892 ?>
3893         </tr><tr>
3894             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3895 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3896     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3897     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3898     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3899     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3900     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3901     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3902 ?>
3903         </tr><tr>
3904             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3905 <?php
3906     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3907 ?>
3908         </tr><tr>
3909             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3910 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3911 ?>
3912         </tr><tr>
3913             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3914 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3915     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3916     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3917 ?>
3918         </tr><tr>
3919             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3920 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3921     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3922     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3923 ?>
3924         </tr><tr>
3925             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3926 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3927     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3928     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3929 ?>
3930         </tr><tr>
3931             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3932 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3933     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3934     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3935     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3936     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3937 ?>
3938         </tr><tr>
3939             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3940 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3941     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3942     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3943 ?>
3944         </tr><tr>
3945             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3946 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3947     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3948 ?>
3949         </tr><tr>
3950             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3951 <?php
3952         $tab = 600;
3953         $pluginfields = array();
3954         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3955
3956         foreach ($pluginfields as $pfkey=>$pfvalue) {
3957             echo "</tr><tr>\n";
3958             echo '<th colspan="2">' . i18n::hen($pfkey) . "</th>\n";
3959             foreach ($pfvalue as $pffield=>$pfdesc) {
3960                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3961             }
3962         }
3963 ?>
3964         </tr><tr>
3965             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3966         </tr><tr>
3967             <td><?php echo _TEMPLATE_UPDATE?></td>
3968             <td>
3969                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3970                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3971             </td>
3972         </tr></table>
3973
3974         </div>
3975         </form>
3976         <?php
3977         $this->pagefoot();
3978     }
3979
3980     /**
3981      * @todo document this
3982      */
3983     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3984         static $count = 1;
3985         if (!isset($template[$name])) $template[$name] = '';
3986     ?>
3987         </tr><tr>
3988             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3989             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  i18n::hsc($template[$name]); ?></textarea></td>
3990     <?php       $count++;
3991     }
3992
3993     /**
3994      * @todo document this
3995      */
3996     function action_templateupdate() {
3997         global $member,$manager;
3998
3999         $templateid = intRequestVar('templateid');
4000
4001         $member->isAdmin() or $this->disallow();
4002
4003         $name = postVar('tname');
4004         $desc = postVar('tdesc');
4005
4006         if (!isValidTemplateName($name))
4007             $this->error(_ERROR_BADTEMPLATENAME);
4008
4009         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
4010             $this->error(_ERROR_DUPTEMPLATENAME);
4011
4012
4013         $name = sql_real_escape_string($name);
4014         $desc = sql_real_escape_string($desc);
4015
4016         // 1. Remove all template parts
4017         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4018         sql_query($query);
4019
4020         // 2. Update description
4021         $query =  'UPDATE '.sql_table('template_desc').' SET'
4022                . " tdname='" . $name . "',"
4023                . " tddesc='" . $desc . "'"
4024                . " WHERE tdnumber=" . $templateid;
4025         sql_query($query);
4026
4027         // 3. Add non-empty template parts
4028         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4029         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4030         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4031         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4032         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4033         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4034         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4035         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4036         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4037         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4038         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4039         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4040         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4041         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4042         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4043         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4044         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4045         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4046         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4047         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4048         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4049         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4050         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4051         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4052         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4053         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4054         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4055         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4056         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4057         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4058         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4059         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4060         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4061         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4062
4063         $pluginfields = array();
4064         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4065         foreach ($pluginfields as $pfkey=>$pfvalue) {
4066             foreach ($pfvalue as $pffield=>$pfdesc) {
4067                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4068             }
4069         }
4070
4071         // jump back to template edit
4072         $this->action_templateedit(_TEMPLATE_UPDATED);
4073
4074     }
4075
4076     /**
4077      * @todo document this
4078      */
4079     function addToTemplate($id, $partname, $content) {
4080         $partname = sql_real_escape_string($partname);
4081         $content = sql_real_escape_string($content);
4082
4083         $id = intval($id);
4084
4085         // don't add empty parts:
4086         if (!trim($content)) return -1;
4087
4088         $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
4089                . "VALUES ($id, '$partname', '$content')";
4090         sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4091         return sql_insert_id();
4092     }
4093
4094     /**
4095      * @todo document this
4096      */
4097     function action_templatedelete() {
4098         global $member, $manager;
4099
4100         $member->isAdmin() or $this->disallow();
4101
4102         $templateid = intRequestVar('templateid');
4103         // TODO: check if template can be deleted
4104
4105         $this->pagehead();
4106
4107         $name = TEMPLATE::getNameFromId($templateid);
4108         $desc = TEMPLATE::getDesc($templateid);
4109
4110         ?>
4111             <h2><?php echo _DELETE_CONFIRM?></h2>
4112
4113             <p>
4114             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo i18n::hsc($name)?></b> (<?php echo  i18n::hsc($desc) ?>)
4115             </p>
4116
4117             <form method="post" action="index.php"><div>
4118                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4119                 <?php $manager->addTicketHidden() ?>
4120                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4121                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4122             </div></form>
4123         <?php
4124         $this->pagefoot();
4125     }
4126
4127     /**
4128      * @todo document this
4129      */
4130     function action_templatedeleteconfirm() {
4131         global $member, $manager;
4132
4133         $templateid = intRequestVar('templateid');
4134
4135         $member->isAdmin() or $this->disallow();
4136
4137         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4138
4139         // 1. delete description
4140         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4141
4142         // 2. delete parts
4143         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4144
4145         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4146
4147         $this->action_templateoverview();
4148     }
4149
4150     /**
4151      * @todo document this
4152      */
4153     function action_templatenew() {
4154         global $member;
4155
4156         $member->isAdmin() or $this->disallow();
4157
4158         $name = postVar('name');
4159         $desc = postVar('desc');
4160
4161         if (!isValidTemplateName($name))
4162             $this->error(_ERROR_BADTEMPLATENAME);
4163
4164         if (TEMPLATE::exists($name))
4165             $this->error(_ERROR_DUPTEMPLATENAME);
4166
4167         $newTemplateId = TEMPLATE::createNew($name, $desc);
4168
4169         $this->action_templateoverview();
4170     }
4171
4172     /**
4173      * @todo document this
4174      */
4175     function action_templateclone() {
4176         global $member;
4177
4178         $templateid = intRequestVar('templateid');
4179
4180         $member->isAdmin() or $this->disallow();
4181
4182         // 1. read old template
4183         $name = TEMPLATE::getNameFromId($templateid);
4184         $desc = TEMPLATE::getDesc($templateid);
4185
4186         // 2. create desc thing
4187         $name = "cloned" . $name;
4188
4189         // if a template with that name already exists:
4190         if (TEMPLATE::exists($name)) {
4191             $i = 1;
4192             while (TEMPLATE::exists($name . $i))
4193                 $i++;
4194             $name .= $i;
4195         }
4196
4197         $newid = TEMPLATE::createNew($name, $desc);
4198
4199         // 3. create clone
4200         // go through parts of old template and add them to the new one
4201         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4202         while ($o = sql_fetch_object($res)) {
4203             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4204         }
4205
4206         $this->action_templateoverview();
4207     }
4208
4209     /**
4210      * @todo document this
4211      */
4212     function action_skinoverview() {
4213         global $member, $manager;
4214
4215         $member->isAdmin() or $this->disallow();
4216
4217         $this->pagehead();
4218
4219         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4220
4221         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4222
4223         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4224
4225         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4226         $template['content'] = 'skinlist';
4227         $template['tabindex'] = 10;
4228         showlist($query,'table',$template);
4229
4230         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4231
4232         ?>
4233         <form method="post" action="index.php">
4234         <div>
4235
4236         <input name="action" value="skinnew" type="hidden" />
4237         <?php $manager->addTicketHidden() ?>
4238         <table><tr>
4239             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4240             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4241         </tr><tr>
4242             <td><?php echo _SKIN_DESC?></td>
4243             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4244         </tr><tr>
4245             <td><?php echo _SKIN_CREATE?></td>
4246             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4247         </tr></table>
4248
4249         </div>
4250         </form>
4251
4252         <?php
4253         $this->pagefoot();
4254     }
4255
4256     /**
4257      * @todo document this
4258      */
4259     function action_skinnew() {
4260         global $member;
4261
4262         $member->isAdmin() or $this->disallow();
4263
4264         $name = trim(postVar('name'));
4265         $desc = trim(postVar('desc'));
4266
4267         if (!isValidSkinName($name))
4268             $this->error(_ERROR_BADSKINNAME);
4269
4270         if (SKIN::exists($name))
4271             $this->error(_ERROR_DUPSKINNAME);
4272
4273         $newId = SKIN::createNew($name, $desc);
4274
4275         $this->action_skinoverview();
4276     }
4277
4278     /**
4279      * @todo document this
4280      */
4281     function action_skinedit() {
4282         global $member, $manager;
4283
4284         $skinid = intRequestVar('skinid');
4285
4286         $member->isAdmin() or $this->disallow();
4287
4288         $skin = new SKIN($skinid);
4289
4290         $this->pagehead();
4291         ?>
4292         <p>
4293             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4294         </p>
4295         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4296
4297         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4298         <?php echo _SKIN_PARTS_MSG?>
4299         <ul>
4300             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4301             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4302             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4303             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4304             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4305             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4306             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4307             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4308         </ul>
4309
4310         <?php
4311
4312         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4313         $res = sql_query($query);
4314
4315         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4316         echo '<form method="get" action="index.php">' . "\r\n";
4317         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4318         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4319         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4320         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4321         echo '</form>' . "\r\n";
4322
4323         if ($res && sql_num_rows($res) > 0) {
4324             echo '<ul>';
4325             $tabstart = 75;
4326
4327             while ($row = sql_fetch_assoc($res)) {
4328                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . i18n::hsc(strtolower($row['stype'])) . '">' . i18n::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . i18n::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4329             }
4330
4331             echo '</ul>';
4332         }
4333
4334         ?>
4335
4336         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4337         <form method="post" action="index.php">
4338         <div>
4339
4340         <input type="hidden" name="action" value="skineditgeneral" />
4341         <?php $manager->addTicketHidden() ?>
4342         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4343         <table><tr>
4344             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4345             <td><input name="name" tabindex="90" value="<?php echo  i18n::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4346         </tr><tr>
4347             <td><?php echo _SKIN_DESC?></td>
4348             <td><input name="desc" tabindex="100" value="<?php echo  i18n::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4349         </tr><tr>
4350             <td><?php echo _SKIN_TYPE?></td>
4351             <td><input name="type" tabindex="110" value="<?php echo  i18n::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4352         </tr><tr>
4353             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4354             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4355         </tr><tr>
4356             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4357             <td><input name="inc_prefix" tabindex="130" value="<?php echo  i18n::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4358         </tr><tr>
4359             <td><?php echo _SKIN_CHANGE?></td>
4360             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4361         </tr></table>
4362
4363         </div>
4364         </form>
4365
4366
4367         <?php       $this->pagefoot();
4368     }
4369
4370     /**
4371      * @todo document this
4372      */
4373     function action_skineditgeneral() {
4374         global $member;
4375
4376         $skinid = intRequestVar('skinid');
4377
4378         $member->isAdmin() or $this->disallow();
4379
4380         $name = postVar('name');
4381         $desc = postVar('desc');
4382         $type = postVar('type');
4383         $inc_mode = postVar('inc_mode');
4384         $inc_prefix = postVar('inc_prefix');
4385
4386         $skin = new SKIN($skinid);
4387
4388         // 1. Some checks
4389         if (!isValidSkinName($name))
4390             $this->error(_ERROR_BADSKINNAME);
4391
4392         if (($skin->getName() != $name) && SKIN::exists($name))
4393             $this->error(_ERROR_DUPSKINNAME);
4394
4395         if (!$type) $type = 'text/html';
4396         if (!$inc_mode) $inc_mode = 'normal';
4397
4398         // 2. Update description
4399         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4400
4401         $this->action_skinedit();
4402
4403     }
4404
4405     /**
4406      * @todo document this
4407      */
4408     function action_skinedittype($msg = '') {
4409         global $member, $manager;
4410
4411         $skinid = intRequestVar('skinid');
4412         $type = requestVar('type');
4413
4414         $member->isAdmin() or $this->disallow();
4415
4416         $type = trim($type);
4417         $type = strtolower($type);
4418
4419         if (!isValidShortName($type)) {
4420             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4421         }
4422
4423         $skin = new SKIN($skinid);
4424
4425         $friendlyNames = SKIN::getFriendlyNames();
4426
4427         $this->pagehead();
4428         ?>
4429         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4430
4431         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo i18n::hsc($skin->getName()) ?>': <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4432
4433         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4434         ?>
4435
4436
4437         <form method="post" action="index.php">
4438         <div>
4439
4440         <input type="hidden" name="action" value="skinupdate" />
4441         <?php $manager->addTicketHidden() ?>
4442         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4443         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4444
4445         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4446         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4447         (skin type: <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4448         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4449             help('skinpart' . $type);
4450         } else {
4451             help('skinpartspecial');
4452         }?>
4453         <br />
4454
4455         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  i18n::hsc($skin->getContent($type)) ?></textarea>
4456
4457         <br />
4458         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4459         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4460         (skin type: <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4461
4462         <br /><br />
4463         <?php echo _SKIN_ALLOWEDVARS?>
4464         <?php           $actions = SKIN::getAllowedActionsForType($type);
4465
4466             sort($actions);
4467
4468             while ($current = array_shift($actions)) {
4469                 // skip deprecated vars
4470                 if ($current == 'ifcat') continue;
4471                 if ($current == 'imagetext') continue;
4472                 if ($current == 'vars') continue;
4473
4474                 echo helplink('skinvar-' . $current) . "$current</a>";
4475                 if (count($actions) != 0) echo ", ";
4476             }
4477         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4478         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4479         showlist($query,'table',array('content'=>'shortblognames'));
4480         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4481         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4482         showlist($query,'table',array('content'=>'shortnames'));
4483         echo '</div></form>';
4484         $this->pagefoot();
4485     }
4486
4487     /**
4488      * @todo document this
4489      */
4490     function action_skinupdate() {
4491         global $member;
4492
4493         $skinid = intRequestVar('skinid');
4494         $content = trim(postVar('content'));
4495         $type = postVar('type');
4496
4497         $member->isAdmin() or $this->disallow();
4498
4499         $skin = new SKIN($skinid);
4500         $skin->update($type, $content);
4501
4502         $this->action_skinedittype(_SKIN_UPDATED);
4503     }
4504
4505     /**
4506      * @todo document this
4507      */
4508     function action_skindelete() {
4509         global $member, $manager, $CONF;
4510
4511         $skinid = intRequestVar('skinid');
4512
4513         $member->isAdmin() or $this->disallow();
4514
4515         // don't allow default skin to be deleted
4516         if ($skinid == $CONF['BaseSkin'])
4517             $this->error(_ERROR_DEFAULTSKIN);
4518
4519         // don't allow deletion of default skins for blogs
4520         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4521         $r = sql_query($query);
4522         if ($o = sql_fetch_object($r))
4523             $this->error(_ERROR_SKINDEFDELETE . i18n::hsc($o->bname));
4524
4525         $this->pagehead();
4526
4527         $skin = new SKIN($skinid);
4528         $name = $skin->getName();
4529         $desc = $skin->getDescription();
4530
4531         ?>
4532             <h2><?php echo _DELETE_CONFIRM?></h2>
4533
4534             <p>
4535                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo i18n::hsc($name) ?></b> (<?php echo  i18n::hsc($desc)?>)
4536             </p>
4537
4538             <form method="post" action="index.php"><div>
4539                 <input type="hidden" name="action" value="skindeleteconfirm" />
4540                 <?php $manager->addTicketHidden() ?>
4541                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4542                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4543             </div></form>
4544         <?php
4545         $this->pagefoot();
4546     }
4547
4548     /**
4549      * @todo document this
4550      */
4551     function action_skindeleteconfirm() {
4552         global $member, $CONF, $manager;
4553
4554         $skinid = intRequestVar('skinid');
4555
4556         $member->isAdmin() or $this->disallow();
4557
4558         // don't allow default skin to be deleted
4559         if ($skinid == $CONF['BaseSkin'])
4560             $this->error(_ERROR_DEFAULTSKIN);
4561
4562         // don't allow deletion of default skins for blogs
4563         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4564         $r = sql_query($query);
4565         if ($o = sql_fetch_object($r))
4566             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4567
4568         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4569
4570         // 1. delete description
4571         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4572
4573         // 2. delete parts
4574         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4575
4576         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4577
4578         $this->action_skinoverview();
4579     }
4580
4581     /**
4582      * @todo document this
4583      */
4584     function action_skinremovetype() {
4585         global $member, $manager, $CONF;
4586
4587         $skinid = intRequestVar('skinid');
4588         $skintype = requestVar('type');
4589
4590         if (!isValidShortName($skintype)) {
4591             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4592         }
4593
4594         $member->isAdmin() or $this->disallow();
4595
4596         // don't allow default skinparts to be deleted
4597         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4598             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4599         }
4600
4601         $this->pagehead();
4602
4603         $skin = new SKIN($skinid);
4604         $name = $skin->getName();
4605         $desc = $skin->getDescription();
4606
4607         ?>
4608             <h2><?php echo _DELETE_CONFIRM?></h2>
4609
4610             <p>
4611                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo i18n::hsc($skintype); ?> (<?php echo i18n::hsc($name); ?>)</b> (<?php echo  i18n::hsc($desc)?>)
4612             </p>
4613
4614             <form method="post" action="index.php"><div>
4615                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4616                 <?php $manager->addTicketHidden() ?>
4617                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4618                 <input type="hidden" name="type" value="<?php echo i18n::hsc($skintype); ?>" />
4619                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4620             </div></form>
4621         <?php
4622         $this->pagefoot();
4623     }
4624
4625     /**
4626      * @todo document this
4627      */
4628     function action_skinremovetypeconfirm() {
4629         global $member, $CONF, $manager;
4630
4631         $skinid = intRequestVar('skinid');
4632         $skintype = requestVar('type');
4633
4634         if (!isValidShortName($skintype)) {
4635             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4636         }
4637
4638         $member->isAdmin() or $this->disallow();
4639
4640         // don't allow default skinparts to be deleted
4641         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4642             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4643         }
4644
4645         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4646
4647         // delete part
4648         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4649
4650         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4651
4652         $this->action_skinedit();
4653     }
4654
4655     /**
4656      * @todo document this
4657      */
4658     function action_skinclone() {
4659         global $member;
4660
4661         $skinid = intRequestVar('skinid');
4662
4663         $member->isAdmin() or $this->disallow();
4664
4665         // 1. read skin to clone
4666         $skin = new SKIN($skinid);
4667
4668         $name = "clone_" . $skin->getName();
4669
4670         // if a skin with that name already exists:
4671         if (SKIN::exists($name)) {
4672             $i = 1;
4673             while (SKIN::exists($name . $i))
4674                 $i++;
4675             $name .= $i;
4676         }
4677
4678         // 2. create skin desc
4679         $newid = SKIN::createNew(
4680             $name,
4681             $skin->getDescription(),
4682             $skin->getContentType(),
4683             $skin->getIncludeMode(),
4684             $skin->getIncludePrefix()
4685         );
4686
4687
4688         // 3. clone
4689         /*
4690         $this->skinclonetype($skin, $newid, 'index');
4691         $this->skinclonetype($skin, $newid, 'item');
4692         $this->skinclonetype($skin, $newid, 'archivelist');
4693         $this->skinclonetype($skin, $newid, 'archive');
4694         $this->skinclonetype($skin, $newid, 'search');
4695         $this->skinclonetype($skin, $newid, 'error');
4696         $this->skinclonetype($skin, $newid, 'member');
4697         $this->skinclonetype($skin, $newid, 'imagepopup');
4698         */
4699
4700         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4701         $res = sql_query($query);
4702         while ($row = sql_fetch_assoc($res)) {
4703             $this->skinclonetype($skin, $newid, $row['stype']);
4704         }
4705
4706         $this->action_skinoverview();
4707
4708     }
4709
4710     /**
4711      * @todo document this
4712      */
4713     function skinclonetype($skin, $newid, $type) {
4714         $newid = intval($newid);
4715         $content = $skin->getContent($type);
4716         if ($content) {
4717             $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
4718             sql_query($query);
4719         }
4720     }
4721
4722     /**
4723      * @todo document this
4724      */
4725     function action_settingsedit() {
4726         global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4727
4728         $member->isAdmin() or $this->disallow();
4729
4730         $this->pagehead();
4731
4732         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4733         ?>
4734
4735         <h2><?php echo _SETTINGS_TITLE?></h2>
4736
4737         <form action="index.php" method="post">
4738         <div>
4739
4740         <input type="hidden" name="action" value="settingsupdate" />
4741         <?php $manager->addTicketHidden() ?>
4742
4743         <table><tr>
4744             <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4745         </tr><tr>
4746             <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4747             <td>
4748                 <?php
4749                     $query =  'SELECT bname as text, bnumber as value'
4750                            . ' FROM '.sql_table('blog');
4751                     $template['name'] = 'DefaultBlog';
4752                     $template['selected'] = $CONF['DefaultBlog'];
4753                     $template['tabindex'] = 10;
4754                     showlist($query,'select',$template);
4755                 ?>
4756             </td>
4757         </tr><tr>
4758             <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4759             <td>
4760                 <?php
4761                     $query =  'SELECT sdname as text, sdnumber as value'
4762                            . ' FROM '.sql_table('skin_desc');
4763                     $template['name'] = 'BaseSkin';
4764                     $template['selected'] = $CONF['BaseSkin'];
4765                     $template['tabindex'] = 1;
4766                     showlist($query,'select',$template);
4767                 ?>
4768             </td>
4769         </tr><tr>
4770             <td><?php echo _SETTINGS_ADMINMAIL?></td>
4771             <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  i18n::hsc($CONF['AdminEmail']) ?>" /></td>
4772         </tr><tr>
4773             <td><?php echo _SETTINGS_SITENAME?></td>
4774             <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  i18n::hsc($CONF['SiteName']) ?>" /></td>
4775         </tr><tr>
4776             <td><?php echo _SETTINGS_SITEURL?></td>
4777             <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  i18n::hsc($CONF['IndexURL']) ?>" /></td>
4778         </tr><tr>
4779             <td><?php echo _SETTINGS_ADMINURL?></td>
4780             <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  i18n::hsc($CONF['AdminURL']) ?>" /></td>
4781         </tr><tr>
4782             <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4783             <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  i18n::hsc($CONF['PluginURL']) ?>" /></td>
4784         </tr><tr>
4785             <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4786             <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  i18n::hsc($CONF['SkinsURL']) ?>" /></td>
4787         </tr><tr>
4788             <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4789             <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  i18n::hsc($CONF['ActionURL']) ?>" /></td>
4790         </tr><tr>
4791             <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4792             </td>
4793             <td>
4794                 <select name="Language" tabindex="10050">
4795                         <?php
4796                                 $locales = i18n::get_available_locale_list();
4797                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4798                                 {
4799                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4800                                 }
4801                                 else
4802                                 {
4803                                         echo "<option value=\"\">en_Latn_US</option>\n";
4804                                 }
4805
4806                                 foreach ( $locales as $locale )
4807                                 {
4808                                         if ( $locale == 'en_Latn_US' )
4809                                         {
4810                                                 continue;
4811                                         }
4812                                         if ( $locale == i18n::get_current_locale() )
4813                                         {
4814                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4815                                         }
4816                                         else
4817                                         {
4818                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4819                                         }
4820                                 }
4821                         ?>
4822                         </select>
4823
4824             </td>
4825         </tr><tr>
4826             <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4827             </td>
4828             <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4829                     <br />
4830                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  i18n::hsc($CONF['DisableSiteURL'])?>" />
4831             </td>
4832         </tr><tr>
4833             <td><?php echo _SETTINGS_DIRS?></td>
4834             <td><?php echo  i18n::hsc($DIR_NUCLEUS) ?>
4835                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4836         </tr><tr>
4837             <td><?php echo _SETTINGS_DBLOGIN?></td>
4838             <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4839         </tr><tr>
4840             <td>
4841             <?php
4842                 echo _SETTINGS_JSTOOLBAR
4843                 /* =_SETTINGS_DISABLEJS
4844
4845                     I temporary changed the meaning of DisableJsTools, until I can find a good
4846                     way to select the javascript version to use
4847
4848                     now, its:
4849                         0 : IE
4850                         1 : all javascript disabled
4851                         2 : 'simpler' javascript (for mozilla/opera/mac)
4852                 */
4853                ?>
4854             </td>
4855             <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4856                 <select name="DisableJsTools" tabindex="10075">
4857             <?php                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4858                     echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4859                     $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4860                     echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4861                     $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4862                     echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4863             ?>
4864                 </select>
4865             </td>
4866         </tr><tr>
4867             <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4868                        <td><?php
4869
4870                        $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4871                               'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4872
4873                        echo ' ', _SETTINGS_URLMODE_HELP;
4874
4875                              ?>
4876
4877                        </td>
4878         </tr><tr>
4879             <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4880                        <td><?php
4881
4882                         $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4883
4884                              ?>
4885
4886                        </td>
4887         </tr><tr>
4888             <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4889             <td>
4890             <?php
4891                 if (!array_key_exists('DefaultListSize',$CONF)) {
4892                     sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4893                     $CONF['DefaultListSize'] = 10;
4894                 }
4895             ?>
4896                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  i18n::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4897             </td>
4898         </tr><tr>
4899             <td><?php echo _SETTINGS_ADMINCSS?>
4900             </td>
4901             <td>
4902
4903                 <select name="AdminCSS" tabindex="10080">
4904                 <?php               // show a dropdown list of all available admin css files
4905                 global $DIR_NUCLEUS;
4906
4907                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4908
4909                                 while ($filename = readdir($dirhandle) )
4910                                 {
4911
4912                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4913                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4914
4915                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4916                                         {
4917
4918                                                 $name = $matches[1];
4919                                                 echo "<option value=\"$name\"";
4920
4921                                                 if ($name == $CONF['AdminCSS'])
4922                                                 {
4923                                                         echo " selected=\"selected\"";
4924                                                 }
4925
4926                                                 echo ">$name</option>";
4927
4928                                         }
4929
4930                                 }
4931
4932                                 closedir($dirhandle);
4933
4934                                 ?>
4935                                 </select>
4936
4937             </td>
4938         </tr><tr>
4939             <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4940         </tr><tr>
4941             <td><?php echo _SETTINGS_MEDIADIR?></td>
4942             <td><?php echo  i18n::hsc($DIR_MEDIA) ?>
4943                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4944                 <?php                   if (!is_dir($DIR_MEDIA))
4945                         echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4946                     if (!is_readable($DIR_MEDIA))
4947                         echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4948                     if (!is_writeable($DIR_MEDIA))
4949                         echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4950                 ?>
4951             </td>
4952         </tr><tr>
4953             <td><?php echo _SETTINGS_MEDIAURL?></td>
4954             <td>
4955                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  i18n::hsc($CONF['MediaURL']) ?>" />
4956             </td>
4957         </tr><tr>
4958             <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4959             <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4960         </tr><tr>
4961             <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4962             <td>
4963                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  i18n::hsc($CONF['AllowedTypes']) ?>" />
4964             </td>
4965         </tr><tr>
4966             <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4967             <td>
4968                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  i18n::hsc($CONF['MaxUploadSize']) ?>" />
4969             </td>
4970         </tr><tr>
4971             <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4972             <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4973
4974         </tr><tr>
4975             <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4976         </tr><tr>
4977             <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4978             <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4979         </tr><tr>
4980             <td><?php echo _SETTINGS_ALLOWCREATE?>
4981                 <?php help('allowaccountcreation'); ?>
4982             </td>
4983             <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4984             </td>
4985         </tr><tr>
4986             <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4987                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4988             </td>
4989             <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4990             </td>
4991         </tr><tr>
4992             <td><?php echo _SETTINGS_MEMBERMSGS?>
4993                 <?php help('messageservice'); ?>
4994             </td>
4995             <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4996             </td>
4997         </tr><tr>
4998             <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4999                 <?php help('messageservice'); ?>
5000             </td>
5001             <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5002             </td>
5003         </tr><tr>
5004             <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5005                 <?php help('protectmemnames'); ?>
5006             </td>
5007             <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5008             </td>
5009
5010
5011
5012         </tr><tr>
5013             <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5014         </tr><tr>
5015             <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5016             <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  i18n::hsc($CONF['CookiePrefix'])?>" /></td>
5017         </tr><tr>
5018             <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5019             <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  i18n::hsc($CONF['CookieDomain'])?>" /></td>
5020         </tr><tr>
5021             <td><?php echo _SETTINGS_COOKIEPATH?></td>
5022             <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  i18n::hsc($CONF['CookiePath'])?>" /></td>
5023         </tr><tr>
5024             <td><?php echo _SETTINGS_COOKIESECURE?></td>
5025             <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5026         </tr><tr>
5027             <td><?php echo _SETTINGS_COOKIELIFE?></td>
5028             <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5029                               1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5030             </td>
5031         </tr><tr>
5032             <td><?php echo _SETTINGS_LASTVISIT?></td>
5033             <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5034
5035
5036
5037         </tr><tr>
5038             <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5039         </tr><tr>
5040             <td><?php echo _SETTINGS_UPDATE?></td>
5041             <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5042         </tr></table>
5043
5044         </div>
5045         </form>
5046
5047         <?php
5048             echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5049
5050             $manager->notify(
5051                 'GeneralSettingsFormExtras',
5052                 array()
5053             );
5054
5055         $this->pagefoot();
5056     }
5057
5058         /**
5059          * @todo document this
5060          */
5061         function action_settingsupdate() {
5062                 global $member, $CONF;
5063
5064                 $member->isAdmin() or $this->disallow();
5065
5066                 // check if email address for admin is valid
5067                 if ( !isValidMailAddress(postVar('AdminEmail')) )
5068                 {
5069                         $this->error(_ERROR_BADMAILADDRESS);
5070                 }
5071
5072                 // save settings
5073                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5074                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5075                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5076                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5077                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5078                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5079                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5080                 $this->updateConfig('Language',            postVar('Language'));
5081                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5082                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5083                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5084                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5085                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5086                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5087                 $this->updateConfig('SiteName',          postVar('SiteName'));
5088                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5089                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5090                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5091                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5092                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5093                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5094                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5095                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5096                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5097                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5098                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5099                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5100                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5101                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5102                 $this->updateConfig('URLMode',            postVar('URLMode'));
5103                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5104                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5105                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5106                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5107
5108                 // load new config and redirect (this way, the new language will be used is necessary)
5109                 // note that when changing cookie settings, this redirect might cause the user
5110                 // to have to log in again.
5111                 getConfig();
5112                 redirect($CONF['AdminURL'] . '?action=manage');
5113                 exit;
5114         }
5115
5116     /**
5117      *  Give an overview over the used system
5118      */
5119     function action_systemoverview() {
5120         global $member, $nucleus, $CONF;
5121
5122         $this->pagehead();
5123
5124         echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5125
5126         if ($member->isLoggedIn() && $member->isAdmin()) {
5127
5128             // Information about the used PHP and MySQL installation
5129             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n";
5130
5131             // Version of PHP MySQL
5132             echo "<table>\n";
5133             echo "\t<tr>\n";
5134             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5135             echo "\t</tr><tr>\n";
5136             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5137             echo "\t\t" . '<td>' . phpversion() . "</td>\n";
5138             echo "\t</tr><tr>\n";
5139             echo "\t\t" . '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5140             echo "\t\t" . '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5141             echo "\t</tr>";
5142             echo "</table>\n";
5143
5144             // Important PHP settings
5145             echo "<table>\n";
5146             echo "\t<tr>\n";
5147             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5148             echo "\t</tr><tr>\n";
5149             echo "\t\t" . '<td width="50%">magic_quotes_gpc' . "</td>\n";
5150             $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5151             echo "\t\t" . '<td>' . $mqg . "</td>\n";
5152             echo "\t</tr><tr>\n";
5153             echo "\t\t" . '<td>magic_quotes_runtime' . "</td>\n";
5154             $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5155             echo "\t\t" . '<td>' . $mqr . "</td>\n";
5156             echo "\t</tr><tr>\n";
5157             echo "\t\t" . '<td>register_globals' . "</td>\n";
5158             $rg = ini_get('register_globals') ? 'On' : 'Off';
5159             echo "\t\t" . '<td>' . $rg . "</td>\n";
5160             echo "\t</tr>";
5161             echo "</table>\n";
5162
5163             // Information about GD library
5164             $gdinfo = gd_info();
5165             echo "<table>\n";
5166             echo "\t<tr>";
5167             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5168             echo "\t</tr>\n";
5169             foreach ($gdinfo as $key=>$value) {
5170                 if (is_bool($value)) {
5171                     $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5172                 } else {
5173                     $value = i18n::hsc($value);
5174                 }
5175                 echo "\t<tr>";
5176                 echo "\t\t" . '<td width="50%">' . $key . "</td>\n";
5177                 echo "\t\t" . '<td>' . $value . "</td>\n";
5178                 echo "\t</tr>\n";
5179             }
5180             echo "</table>\n";
5181
5182             // Check if special modules are loaded
5183             ob_start();
5184             phpinfo(INFO_MODULES);
5185             $im = ob_get_contents();
5186             ob_clean();
5187             echo "<table>\n";
5188             echo "\t<tr>";
5189             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5190             echo "\t</tr><tr>\n";
5191             echo "\t\t" . '<td width="50%">mod_rewrite' . "</td>\n";
5192             $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5193                         _ADMIN_SYSTEMOVERVIEW_ENABLE :
5194                         _ADMIN_SYSTEMOVERVIEW_DISABLE;
5195             echo "\t\t" . '<td>' . $modrewrite . "</td>\n";
5196             echo "\t</tr>\n";
5197             echo "</table>\n";
5198
5199             // Information about the used Nucleus CMS
5200             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5201             global $nucleus;
5202             $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5203             $np = getNucleusPatchLevel();
5204             echo "<table>\n";
5205             echo "\t<tr>";
5206             echo "\t\t" . '<th colspan="2">Nucleus CMS' . "</th>\n";
5207             echo "\t</tr><tr>\n";
5208             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5209             echo "\t\t" . '<td>' . $nv . "</td>\n";
5210             echo "\t</tr><tr>\n";
5211             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5212             echo "\t\t" . '<td>' . $np . "</td>\n";
5213             echo "\t</tr>\n";
5214             echo "</table>\n";
5215
5216             // Important settings of the installation
5217             echo "<table>\n";
5218             echo "\t<tr>";
5219             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5220             echo "\t</tr><tr>\n";
5221             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'Self']</td>\n";
5222             echo "\t\t" . '<td>' . $CONF['Self'] . "</td>\n";
5223             echo "\t</tr><tr>\n";
5224             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'ItemURL']</td>\n";
5225             echo "\t\t" . '<td>' . $CONF['ItemURL'] . "</td>\n";
5226             echo "\t</tr><tr>\n";
5227             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5228             $ohs = $CONF['alertOnHeadersSent'] ?
5229                         _ADMIN_SYSTEMOVERVIEW_ENABLE :
5230                         _ADMIN_SYSTEMOVERVIEW_DISABLE;
5231             echo "\t\t" . '<td>' . $ohs . "</td>\n";
5232             echo "\t</tr>\n";
5233             echo "</table>\n";
5234
5235             // Link to the online version test at the Nucleus CMS website
5236             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5237             if ($nucleus['codename'] != '') {
5238                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5239             } else {
5240                 $codenamestring = '';
5241             }
5242             echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5243             $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5244             echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5245             echo 'Nucleus CMS ' . $nv . $codenamestring;
5246             echo '</a>';
5247         //echo '<br />';
5248         }
5249         else {
5250             echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5251         }
5252
5253         $this->pagefoot();
5254     }
5255
5256     /**
5257      * @todo document this
5258      */
5259     function updateConfig($name, $val) {
5260         $name = sql_real_escape_string($name);
5261         $val = trim(sql_real_escape_string($val));
5262
5263         $query = 'UPDATE '.sql_table('config')
5264                . " SET value='$val'"
5265                . " WHERE name='$name'";
5266
5267         sql_query($query) or die("Query error: " . sql_error());
5268         return sql_insert_id();
5269     }
5270
5271     /**
5272      * Error message
5273      * @param string $msg message that will be shown
5274      */
5275     function error($msg) {
5276         $this->pagehead();
5277         ?>
5278         <h2>Error!</h2>
5279         <?php       echo $msg;
5280         echo "<br />";
5281         echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
5282         $this->pagefoot();
5283         exit;
5284     }
5285
5286     /**
5287      * @todo document this
5288      */
5289     function disallow() {
5290         ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5291
5292         $this->error(_ERROR_DISALLOWED);
5293     }
5294
5295     /**
5296      * @todo document this
5297      */
5298     function pagehead($extrahead = '') {
5299         global $member, $nucleus, $CONF, $manager;
5300
5301         $manager->notify(
5302             'AdminPrePageHead',
5303             array(
5304                 'extrahead' => &$extrahead,
5305                 'action' => $this->action
5306             )
5307         );
5308
5309         $baseUrl = i18n::hsc($CONF['AdminURL']);
5310                 if (!array_key_exists('AdminCSS',$CONF))
5311                 {
5312                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5313                         $CONF['AdminCSS'] = 'original';
5314                 }
5315
5316                 $root_element = 'html';
5317                 $charset = i18n::get_current_charset();
5318                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5319
5320                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5321                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5322                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5323                 ?>
5324         <head>
5325             <title><?php echo i18n::hsc($CONF['SiteName'])?> - Admin</title>
5326             <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin_<?php echo $CONF["AdminCSS"]?>.css" />
5327             <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
5328             href="<?php echo $baseUrl?>styles/addedit.css" />
5329
5330             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
5331             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
5332             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
5333
5334       <meta http-equiv='Pragma' content='no-cache' />
5335       <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
5336       <meta http-equiv='Expires' content='-1' />
5337
5338             <?php echo $extrahead?>
5339         </head>
5340         <body>
5341         <div id="adminwrapper">
5342         <div class="header">
5343         <h1><?php echo i18n::hsc($CONF['SiteName'])?></h1>
5344         </div>
5345         <div id="container">
5346         <div id="content">
5347         <div class="loginname">
5348         <?php           if ($member->isLoggedIn())
5349                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
5350                     ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
5351                     . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5352             else
5353                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
5354
5355             echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
5356
5357             echo '<br />(';
5358
5359             $codenamestring = ($nucleus['codename']!='')? ' &quot;'.$nucleus['codename'].'&quot;':'';
5360
5361             if ($member->isLoggedIn() && $member->isAdmin()) {
5362                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5363                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5364                 $newestVersion = getLatestVersion();
5365                 $newestCompare = str_replace('/','.',$newestVersion);
5366                 $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5367                 if ($newestVersion && version_compare($newestCompare,$currentVersion) > 0) {
5368                     echo '<br /><a style="color:red" href="http://nucleuscms.org/upgrade.php" title="'._ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE.'">'._ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT.$newestVersion.'</a>';
5369                 }
5370             } else {
5371                 echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5372             }
5373             echo ')';
5374         echo '</div>';
5375     }
5376
5377     /**
5378      * @todo document this
5379      */
5380     function pagefoot() {
5381         global $action, $member, $manager;
5382
5383         $manager->notify(
5384             'AdminPrePageFoot',
5385             array(
5386                 'action' => $this->action
5387             )
5388         );
5389
5390         if ($member->isLoggedIn() && ($action != 'showlogin')) {
5391             ?>
5392             <h2><?php echo  _LOGOUT ?></h2>
5393             <ul>
5394                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5395                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5396             </ul>
5397             <?php       }
5398         ?>
5399             <div class="foot">
5400                 <a href="<?php echo _ADMINPAGEFOOT_OFFICIALURL ?>">Nucleus CMS</a> &copy; 2002-<?php echo date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT; ?>
5401                 -
5402                 <a href="<?php echo _ADMINPAGEFOOT_DONATEURL ?>"><?php echo _ADMINPAGEFOOT_DONATE ?></a>
5403             </div>
5404
5405             </div><!-- content -->
5406
5407             <div id="quickmenu">
5408
5409                 <?php               // ---- user settings ----
5410                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5411                     echo '<ul>';
5412                     echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5413                     echo '</ul>';
5414
5415                     echo '<h2>',_QMENU_ADD,'</h2>';
5416                     echo '<form method="get" action="index.php"><div>';
5417                     echo '<input type="hidden" name="action" value="createitem" />';
5418
5419                         $showAll = requestVar('showall');
5420                         if (($member->isAdmin()) && ($showAll == 'yes')) {
5421                             // Super-Admins have access to all blogs! (no add item support though)
5422                             $query =  'SELECT bnumber as value, bname as text'
5423                                    . ' FROM ' . sql_table('blog')
5424                                    . ' ORDER BY bname';
5425                         } else {
5426                             $query =  'SELECT bnumber as value, bname as text'
5427                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5428                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5429                                    . ' ORDER BY bname';
5430                         }
5431                         $template['name'] = 'blogid';
5432                         $template['tabindex'] = 15000;
5433                         $template['extra'] = _QMENU_ADD_SELECT;
5434                         $template['selected'] = -1;
5435                         $template['shorten'] = 10;
5436                         $template['shortenel'] = '';
5437                         $template['javascript'] = 'onchange="return form.submit()"';
5438                         showlist($query,'select',$template);
5439
5440                     echo '</div></form>';
5441
5442                     echo '<h2>' . $member->getDisplayName(). '</h2>';
5443                     echo '<ul>';
5444                     echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . '</a></li>';
5445                     echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . '</a></li>';
5446                     echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . '</a></li>';
5447                     echo '</ul>';
5448
5449
5450
5451
5452                     // ---- general settings ----
5453                     if ($member->isAdmin()) {
5454
5455                         echo '<h2>',_QMENU_MANAGE,'</h2>';
5456
5457                         echo '<ul>';
5458                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . '</a></li>';
5459                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . '</a></li>';
5460                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . '</a></li>';
5461                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . '</a></li>';
5462                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . '</a></li>';
5463                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . '</a></li>';
5464                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . '</a></li>';
5465                         echo '</ul>';
5466
5467                         echo '<h2>',_QMENU_LAYOUT,'</h2>';
5468                         echo '<ul>';
5469                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . '</a></li>';
5470                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . '</a></li>';
5471                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . '</a></li>';
5472                         echo '</ul>';
5473
5474                     }
5475
5476                     $aPluginExtras = array();
5477                     $manager->notify(
5478                         'QuickMenu',
5479                         array(
5480                             'options' => &$aPluginExtras
5481                         )
5482                     );
5483                     if (count($aPluginExtras) > 0)
5484                     {
5485                         echo '<h2>', _QMENU_PLUGINS, '</h2>';
5486                         echo '<ul>';
5487                         foreach ($aPluginExtras as $aInfo)
5488                         {
5489                             echo '<li><a href="'.i18n::hsc($aInfo['url']).'" title="'.i18n::hsc($aInfo['tooltip']).'">'.i18n::hsc($aInfo['title']).'</a></li>';
5490                         }
5491                         echo '</ul>';
5492                     }
5493
5494                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5495
5496                     echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5497                 } else {
5498                     // introduction text on login screen
5499                     echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5500                 }
5501                 ?>
5502             </div>
5503
5504             <!-- content / quickmenu container -->
5505             <div class="clear"></div>    <!-- new -->
5506             </div>
5507
5508             <!-- adminwrapper -->    <!-- new -->
5509             </div>     <!-- new -->
5510             </body>
5511             </html>
5512         <?php   }
5513
5514     /**
5515      * @todo document this
5516      */
5517     function action_regfile() {
5518         global $member, $CONF;
5519
5520         $blogid = intRequestVar('blogid');
5521
5522         $member->teamRights($blogid) or $this->disallow();
5523
5524         // header-code stolen from phpMyAdmin
5525         // REGEDIT and bookmarklet code stolen from GreyMatter
5526
5527         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5528
5529
5530         header('Content-Type: application/octetstream');
5531         header('Content-Disposition: filename="nucleus.reg"');
5532         header('Pragma: no-cache');
5533         header('Expires: 0');
5534
5535         echo "REGEDIT4\n";
5536         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5537         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5538         echo '"contexts"=hex:31';
5539     }
5540
5541     /**
5542      * @todo document this
5543      */
5544     function action_bookmarklet() {
5545         global $member, $manager;
5546
5547         $blogid = intRequestVar('blogid');
5548
5549         $member->teamRights($blogid) or $this->disallow();
5550
5551         $blog =& $manager->getBlog($blogid);
5552         $bm = getBookmarklet($blogid);
5553
5554         $this->pagehead();
5555
5556         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5557
5558         ?>
5559
5560         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5561
5562         <p>
5563         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5564         </p>
5565
5566         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5567         <p>
5568             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5569             <br />
5570             <br />
5571             <?php echo '<a href="' . i18n::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, i18n::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5572         </p>
5573
5574         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5575         <p>
5576             <?php
5577                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5578                 $url = $manager->addTicketToUrl($url);
5579             ?>
5580             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . i18n::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5581         </p>
5582
5583         <p>
5584             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5585         </p>
5586
5587         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5588         <p>
5589             <?php echo _BOOKMARKLET_DELETEBAR ?>
5590         </p>
5591
5592         <p>
5593             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5594         </p>
5595
5596         <ol>
5597             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5598             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5599             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5600             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5601             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5602         </ol>
5603
5604         <?php
5605         $this->pagefoot();
5606
5607     }
5608
5609     /**
5610      * @todo document this
5611      */
5612     function action_actionlog() {
5613         global $member, $manager;
5614
5615         $member->isAdmin() or $this->disallow();
5616
5617         $this->pagehead();
5618
5619         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5620
5621         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5622
5623         ?>
5624             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5625             <p><a href="<?php echo i18n::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5626         <?php
5627         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5628
5629         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5630         $template['content'] = 'actionlist';
5631         $amount = showlist($query,'table',$template);
5632
5633         $this->pagefoot();
5634
5635     }
5636
5637     /**
5638      * @todo document this
5639      */
5640     function action_banlist() {
5641         global $member, $manager;
5642
5643         $blogid = intRequestVar('blogid');
5644
5645         $member->blogAdminRights($blogid) or $this->disallow();
5646
5647         $blog =& $manager->getBlog($blogid);
5648
5649         $this->pagehead();
5650
5651         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5652
5653         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5654
5655         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5656         $template['content'] = 'banlist';
5657         $amount = showlist($query,'table',$template);
5658
5659         if ($amount == 0)
5660             echo _BAN_NONE;
5661
5662         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5663         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5664
5665
5666         $this->pagefoot();
5667
5668     }
5669
5670     /**
5671      * @todo document this
5672      */
5673     function action_banlistdelete() {
5674         global $member, $manager;
5675
5676         $blogid = intRequestVar('blogid');
5677         $iprange = requestVar('iprange');
5678
5679         $member->blogAdminRights($blogid) or $this->disallow();
5680
5681         $blog =& $manager->getBlog($blogid);
5682         $banBlogName =  i18n::hsc($blog->getName());
5683
5684         $this->pagehead();
5685         ?>
5686             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5687
5688             <form method="post" action="index.php">
5689
5690             <h3><?php echo _BAN_IPRANGE?></h3>
5691
5692             <p>
5693                 <?php echo _CONFIRMTXT_BAN?> <?php echo i18n::hsc($iprange) ?>
5694                 <input name="iprange" type="hidden" value="<?php echo i18n::hsc($iprange)?>" />
5695             </p>
5696
5697             <h3><?php echo _BAN_BLOGS?></h3>
5698
5699             <div>
5700                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5701                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5702                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5703                 <br />
5704                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5705             </div>
5706
5707             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5708
5709             <div>
5710                 <?php $manager->addTicketHidden() ?>
5711                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5712                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5713             </div>
5714
5715             </form>
5716         <?php
5717         $this->pagefoot();
5718     }
5719
5720     /**
5721      * @todo document this
5722      */
5723     function action_banlistdeleteconfirm() {
5724         global $member, $manager;
5725
5726         $blogid = intPostVar('blogid');
5727         $allblogs = postVar('allblogs');
5728         $iprange = postVar('iprange');
5729
5730         $member->blogAdminRights($blogid) or $this->disallow();
5731
5732         $deleted = array();
5733
5734         if (!$allblogs) {
5735             if (BAN::removeBan($blogid, $iprange))
5736                 array_push($deleted, $blogid);
5737         } else {
5738             // get blogs fot which member has admin rights
5739             $adminblogs = $member->getAdminBlogs();
5740             foreach ($adminblogs as $blogje) {
5741                 if (BAN::removeBan($blogje, $iprange))
5742                     array_push($deleted, $blogje);
5743             }
5744         }
5745
5746         if (sizeof($deleted) == 0)
5747             $this->error(_ERROR_DELETEBAN);
5748
5749         $this->pagehead();
5750
5751         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5752         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5753         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5754
5755         echo "<ul>";
5756         foreach ($deleted as $delblog) {
5757             $b =& $manager->getBlog($delblog);
5758             echo "<li>" . i18n::hsc($b->getName()). "</li>";
5759         }
5760         echo "</ul>";
5761
5762         $this->pagefoot();
5763
5764     }
5765
5766     /**
5767      * @todo document this
5768      */
5769     function action_banlistnewfromitem() {
5770         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5771     }
5772
5773     /**
5774      * @todo document this
5775      */
5776     function action_banlistnew($blogid = '') {
5777         global $member, $manager;
5778
5779         if ($blogid == '')
5780             $blogid = intRequestVar('blogid');
5781
5782         $ip = requestVar('ip');
5783
5784         $member->blogAdminRights($blogid) or $this->disallow();
5785
5786         $blog =& $manager->getBlog($blogid);
5787
5788         $this->pagehead();
5789         ?>
5790         <h2><?php echo _BAN_ADD_TITLE?></h2>
5791
5792
5793         <form method="post" action="index.php">
5794
5795         <h3><?php echo _BAN_IPRANGE?></h3>
5796
5797         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5798
5799         <div class="note">
5800             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5801             <?php echo _BAN_EXAMPLE_TEXT ?>
5802         </div>
5803
5804         <div>
5805         <?php
5806         if ($ip) {
5807             $iprangeVal = i18n::hsc($ip);
5808         ?>
5809             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5810             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5811             <br />
5812             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5813             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5814             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5815         <?php
5816         } else {
5817             echo "<input name='iprange' value='custom' type='hidden' />";
5818             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5819         }
5820         ?>
5821         </div>
5822
5823         <h3><?php echo _BAN_BLOGS?></h3>
5824
5825         <p><?php echo _BAN_BLOGS_TEXT?></p>
5826
5827         <div>
5828             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5829             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo i18n::hsc($blog->getName())?>'</label>
5830             <br />
5831             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5832         </div>
5833
5834         <h3><?php echo _BAN_REASON_TITLE?></h3>
5835
5836         <p><?php echo _BAN_REASON_TEXT?></p>
5837
5838         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5839
5840         <h3><?php echo _BAN_ADD_TITLE?></h3>
5841
5842         <div>
5843             <input name="action" type="hidden" value="banlistadd" />
5844             <?php $manager->addTicketHidden() ?>
5845             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5846         </div>
5847
5848         </form>
5849
5850         <?php       $this->pagefoot();
5851     }
5852
5853     /**
5854      * @todo document this
5855      */
5856     function action_banlistadd() {
5857         global $member;
5858
5859         $blogid =       intPostVar('blogid');
5860         $allblogs =     postVar('allblogs');
5861         $iprange =      postVar('iprange');
5862         if ($iprange == "custom")
5863             $iprange = postVar('customiprange');
5864         $reason =       postVar('reason');
5865
5866         $member->blogAdminRights($blogid) or $this->disallow();
5867
5868         // TODO: check IP range validity
5869
5870         if (!$allblogs) {
5871             if (!BAN::addBan($blogid, $iprange, $reason))
5872                 $this->error(_ERROR_ADDBAN);
5873         } else {
5874             // get blogs fot which member has admin rights
5875             $adminblogs = $member->getAdminBlogs();
5876             $failed = 0;
5877             foreach ($adminblogs as $blogje) {
5878                 if (!BAN::addBan($blogje, $iprange, $reason))
5879                     $failed = 1;
5880             }
5881             if ($failed)
5882                 $this->error(_ERROR_ADDBAN);
5883         }
5884
5885         $this->action_banlist();
5886
5887     }
5888
5889     /**
5890      * @todo document this
5891      */
5892     function action_clearactionlog() {
5893         global $member;
5894
5895         $member->isAdmin() or $this->disallow();
5896
5897         ACTIONLOG::clear();
5898
5899         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5900     }
5901
5902     /**
5903      * @todo document this
5904      */
5905     function action_backupoverview() {
5906         global $member, $manager;
5907
5908         $member->isAdmin() or $this->disallow();
5909
5910         $this->pagehead();
5911
5912         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5913         ?>
5914         <h2><?php echo _BACKUPS_TITLE?></h2>
5915
5916         <h3><?php echo _BACKUP_TITLE?></h3>
5917
5918         <p><?php echo _BACKUP_INTRO?></p>
5919
5920         <form method="post" action="index.php"><p>
5921         <input type="hidden" name="action" value="backupcreate" />
5922         <?php $manager->addTicketHidden() ?>
5923
5924         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5925         <br />
5926         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5927         <br /><br />
5928         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5929
5930         </p></form>
5931
5932         <div class="note"><?php echo _BACKUP_NOTE?></div>
5933
5934
5935         <h3><?php echo _RESTORE_TITLE?></h3>
5936
5937         <div class="note"><?php echo _RESTORE_NOTE?></div>
5938
5939         <p><?php echo _RESTORE_INTRO?></p>
5940
5941         <form method="post" action="index.php" enctype="multipart/form-data"><p>
5942             <input type="hidden" name="action" value="backuprestore" />
5943             <?php $manager->addTicketHidden() ?>
5944             <input name="backup_file" type="file" tabindex="30" />
5945             <br /><br />
5946             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5947             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5948             <br /><?php echo _RESTORE_WARNING?>
5949         </p></form>
5950
5951         <?php       $this->pagefoot();
5952     }
5953
5954     /**
5955      * @todo document this
5956      */
5957     function action_backupcreate() {
5958         global $member, $DIR_LIBS;
5959
5960         $member->isAdmin() or $this->disallow();
5961
5962         // use compression ?
5963         $useGzip = intval(postVar('gzip'));
5964
5965         include($DIR_LIBS . 'backup.php');
5966
5967         // try to extend time limit
5968         // (creating/restoring dumps might take a while)
5969         @set_time_limit(1200);
5970
5971         $bu = new Backup();
5972         $bu->do_backup($useGzip);
5973         exit;
5974     }
5975
5976     /**
5977      * @todo document this
5978      */
5979     function action_backuprestore() {
5980         global $member, $DIR_LIBS;
5981
5982         $member->isAdmin() or $this->disallow();
5983
5984         if (intPostVar('letsgo') != 1)
5985             $this->error(_ERROR_BACKUP_NOTSURE);
5986
5987         include($DIR_LIBS . 'backup.php');
5988
5989         // try to extend time limit
5990         // (creating/restoring dumps might take a while)
5991         @set_time_limit(1200);
5992
5993         $bu = new Backup();
5994         $message = $bu->do_restore();
5995         if ($message != '')
5996             $this->error($message);
5997
5998         $this->pagehead();
5999         ?>
6000         <h2><?php echo _RESTORE_COMPLETE?></h2>
6001         <?php       $this->pagefoot();
6002
6003     }
6004
6005     /**
6006      * @todo document this
6007      */
6008     function action_pluginlist() {
6009         global $member, $manager;
6010
6011         // check if allowed
6012         $member->isAdmin() or $this->disallow();
6013
6014         $this->pagehead();
6015
6016         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6017
6018         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6019
6020         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6021
6022
6023         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6024
6025         $template['content'] = 'pluginlist';
6026         $template['tabindex'] = 10;
6027         showlist($query, 'table', $template);
6028
6029 ?>
6030                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6031
6032                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6033
6034                         <form method="post" action="index.php"><div>
6035                                 <input type="hidden" name="action" value="pluginupdate" />
6036                                 <?php $manager->addTicketHidden() ?>
6037                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6038                         </div></form>
6039
6040                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6041
6042 <?php
6043                 // find a list of possibly non-installed plugins
6044                 $candidates = array();
6045
6046                 global $DIR_PLUGINS;
6047
6048                 $dirhandle = opendir($DIR_PLUGINS);
6049
6050                 while ($filename = readdir($dirhandle) )
6051                 {
6052
6053                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6054                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6055
6056                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6057                         {
6058
6059                                 $name = $matches[1];
6060                                 // only show in list when not yet installed
6061                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6062
6063                                 if (sql_num_rows($res) == 0)
6064                                 {
6065                                         array_push($candidates, $name);
6066                                 }
6067
6068                         }
6069
6070                 }
6071
6072                 closedir($dirhandle);
6073
6074                 if (sizeof($candidates) > 0)
6075                 {
6076 ?>
6077                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6078
6079                         <form method='post' action='index.php'><div>
6080                                 <input type='hidden' name='action' value='pluginadd' />
6081                                 <?php $manager->addTicketHidden() ?>
6082                                 <select name="filename" tabindex="30">
6083 <?php
6084                         foreach($candidates as $name)
6085                         {
6086                                 echo '<option value="NP_',$name,'">',i18n::hsc($name),'</option>';
6087                         }
6088 ?>
6089                                 </select>
6090                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6091                         </div></form>
6092
6093 <?php
6094                 }
6095                 else
6096                 {
6097                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6098                 }
6099
6100                 $this->pagefoot();
6101
6102         }
6103
6104     /**
6105      * @todo document this
6106      */
6107     function action_pluginhelp() {
6108         global $member, $manager, $DIR_PLUGINS, $CONF;
6109
6110         // check if allowed
6111         $member->isAdmin() or $this->disallow();
6112
6113         $plugid = intGetVar('plugid');
6114
6115         if (!$manager->pidInstalled($plugid))
6116             $this->error(_ERROR_NOSUCHPLUGIN);
6117
6118         $plugName = getPluginNameFromPid($plugid);
6119
6120         $this->pagehead();
6121
6122         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6123
6124         echo '<h2>',_PLUGS_HELP_TITLE,': ',i18n::hsc($plugName),'</h2>';
6125
6126         $plug =& $manager->getPlugin($plugName);
6127         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6128
6129         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6130             @readfile($helpFile);
6131         } else {
6132             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6133             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6134         }
6135
6136
6137         $this->pagefoot();
6138     }
6139
6140     /**
6141      * @todo document this
6142      */
6143     function action_pluginadd() {
6144         global $member, $manager, $DIR_PLUGINS;
6145
6146         // check if allowed
6147         $member->isAdmin() or $this->disallow();
6148
6149         $name = postVar('filename');
6150
6151         if ($manager->pluginInstalled($name))
6152             $this->error(_ERROR_DUPPLUGIN);
6153         if (!checkPlugin($name))
6154             $this->error(_ERROR_PLUGFILEERROR . ' (' . i18n::hsc($name) . ')');
6155
6156         // get number of currently installed plugins
6157         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6158         $numCurrent = sql_num_rows($res);
6159
6160         // plugin will be added as last one in the list
6161         $newOrder = $numCurrent + 1;
6162
6163         $manager->notify(
6164             'PreAddPlugin',
6165             array(
6166                 'file' => &$name
6167             )
6168         );
6169
6170         // do this before calling getPlugin (in case the plugin id is used there)
6171         $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6172         sql_query($query);
6173         $iPid = sql_insert_id();
6174
6175         $manager->clearCachedInfo('installedPlugins');
6176
6177         // Load the plugin for condition checking and instalation
6178         $plugin =& $manager->getPlugin($name);
6179
6180         // check if it got loaded (could have failed)
6181         if (!$plugin)
6182         {
6183             sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6184             $manager->clearCachedInfo('installedPlugins');
6185             $this->error(_ERROR_PLUGIN_LOAD);
6186         }
6187
6188         // check if plugin needs a newer Nucleus version
6189         if (getNucleusVersion() < $plugin->getMinNucleusVersion())
6190         {
6191             // uninstall plugin again...
6192             $this->deleteOnePlugin($plugin->getID());
6193
6194             // ...and show error
6195             $this->error(_ERROR_NUCLEUSVERSIONREQ . i18n::hsc($plugin->getMinNucleusVersion()));
6196         }
6197
6198         // check if plugin needs a newer Nucleus version
6199         if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
6200         {
6201             // uninstall plugin again...
6202             $this->deleteOnePlugin($plugin->getID());
6203
6204             // ...and show error
6205             $this->error(_ERROR_NUCLEUSVERSIONREQ . i18n::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6206         }
6207
6208         $pluginList = $plugin->getPluginDep();
6209         foreach ($pluginList as $pluginName)
6210         {
6211
6212             $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6213             if (sql_num_rows($res) == 0)
6214             {
6215                 // uninstall plugin again...
6216                 $this->deleteOnePlugin($plugin->getID());
6217
6218                 $this->error(sprintf(_ERROR_INSREQPLUGIN, i18n::hsc($pluginName)));
6219             }
6220         }
6221
6222         // call the install method of the plugin
6223         $plugin->install();
6224
6225         $manager->notify(
6226             'PostAddPlugin',
6227             array(
6228                 'plugin' => &$plugin
6229             )
6230         );
6231
6232         // update all events
6233         $this->action_pluginupdate();
6234     }
6235
6236     /**
6237      * @todo document this
6238      */
6239     function action_pluginupdate() {
6240         global $member, $manager, $CONF;
6241
6242         // check if allowed
6243         $member->isAdmin() or $this->disallow();
6244
6245         // delete everything from plugin_events
6246         sql_query('DELETE FROM '.sql_table('plugin_event'));
6247
6248         // loop over all installed plugins
6249         $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6250         while($o = sql_fetch_object($res)) {
6251             $pid = $o->pid;
6252             $plug =& $manager->getPlugin($o->pfile);
6253             if ($plug)
6254             {
6255                 $eventList = $plug->getEventList();
6256                 foreach ($eventList as $eventName)
6257                     sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
6258             }
6259         }
6260
6261         redirect($CONF['AdminURL'] . '?action=pluginlist');
6262 //              $this->action_pluginlist();
6263     }
6264
6265     /**
6266      * @todo document this
6267      */
6268     function action_plugindelete() {
6269         global $member, $manager;
6270
6271         // check if allowed
6272         $member->isAdmin() or $this->disallow();
6273
6274         $pid = intGetVar('plugid');
6275
6276         if (!$manager->pidInstalled($pid))
6277             $this->error(_ERROR_NOSUCHPLUGIN);
6278
6279         $this->pagehead();
6280         ?>
6281             <h2><?php echo _DELETE_CONFIRM?></h2>
6282
6283             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6284
6285             <form method="post" action="index.php"><div>
6286             <?php $manager->addTicketHidden() ?>
6287             <input type="hidden" name="action" value="plugindeleteconfirm" />
6288             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6289             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6290             </div></form>
6291         <?php
6292         $this->pagefoot();
6293     }
6294
6295     /**
6296      * @todo document this
6297      */
6298     function action_plugindeleteconfirm() {
6299         global $member, $manager, $CONF;
6300
6301         // check if allowed
6302         $member->isAdmin() or $this->disallow();
6303
6304         $pid = intPostVar('plugid');
6305
6306         $error = $this->deleteOnePlugin($pid, 1);
6307         if ($error) {
6308             $this->error($error);
6309         }
6310
6311         redirect($CONF['AdminURL'] . '?action=pluginlist');
6312 //              $this->action_pluginlist();
6313     }
6314
6315     /**
6316      * @todo document this
6317      */
6318     function deleteOnePlugin($pid, $callUninstall = 0) {
6319         global $manager;
6320
6321         $pid = intval($pid);
6322
6323         if (!$manager->pidInstalled($pid))
6324             return _ERROR_NOSUCHPLUGIN;
6325
6326         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6327
6328 /*              // call the unInstall method of the plugin
6329         if ($callUninstall) {
6330             $plugin =& $manager->getPlugin($name);
6331             if ($plugin) $plugin->unInstall();
6332         }*/
6333
6334         // check dependency before delete
6335         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6336         while($o = sql_fetch_object($res)) {
6337             $plug =& $manager->getPlugin($o->pfile);
6338             if ($plug)
6339             {
6340                 $depList = $plug->getPluginDep();
6341                 foreach ($depList as $depName)
6342                 {
6343                     if ($name == $depName)
6344                     {
6345                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6346                     }
6347                 }
6348             }
6349         }
6350
6351         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6352
6353         // call the unInstall method of the plugin
6354         if ($callUninstall) {
6355             $plugin =& $manager->getPlugin($name);
6356             if ($plugin) $plugin->unInstall();
6357         }
6358
6359         // delete all subscriptions
6360         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6361
6362         // delete all options
6363         // get OIDs from plugin_option_desc
6364         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6365         $aOIDs = array();
6366         while ($o = sql_fetch_object($res)) {
6367             array_push($aOIDs, $o->oid);
6368         }
6369
6370         // delete from plugin_option and plugin_option_desc
6371         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6372         if (count($aOIDs) > 0)
6373             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6374
6375         // update order numbers
6376         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6377         $o = sql_fetch_object($res);
6378         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6379
6380         // delete row
6381         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6382
6383         $manager->clearCachedInfo('installedPlugins');
6384         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6385
6386         return '';
6387     }
6388
6389     /**
6390      * @todo document this
6391      */
6392     function action_pluginup() {
6393         global $member, $manager, $CONF;
6394
6395         // check if allowed
6396         $member->isAdmin() or $this->disallow();
6397
6398         $plugid = intGetVar('plugid');
6399
6400         if (!$manager->pidInstalled($plugid))
6401             $this->error(_ERROR_NOSUCHPLUGIN);
6402
6403         // 1. get old order number
6404         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6405         $o = sql_fetch_object($res);
6406         $oldOrder = $o->porder;
6407
6408         // 2. calculate new order number
6409         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6410
6411         // 3. update plug numbers
6412         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6413         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6414
6415         //$this->action_pluginlist();
6416         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6417         redirect($CONF['AdminURL'] . '?action=pluginlist');
6418     }
6419
6420     /**
6421      * @todo document this
6422      */
6423     function action_plugindown() {
6424         global $member, $manager, $CONF;
6425
6426         // check if allowed
6427         $member->isAdmin() or $this->disallow();
6428
6429         $plugid = intGetVar('plugid');
6430         if (!$manager->pidInstalled($plugid))
6431             $this->error(_ERROR_NOSUCHPLUGIN);
6432
6433         // 1. get old order number
6434         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6435         $o = sql_fetch_object($res);
6436         $oldOrder = $o->porder;
6437
6438         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6439         $maxOrder = sql_num_rows($res);
6440
6441         // 2. calculate new order number
6442         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6443
6444         // 3. update plug numbers
6445         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6446         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6447
6448         //$this->action_pluginlist();
6449         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6450         redirect($CONF['AdminURL'] . '?action=pluginlist');
6451     }
6452
6453     /**
6454      * @todo document this
6455      */
6456     function action_pluginoptions($message = '') {
6457         global $member, $manager;
6458
6459         // check if allowed
6460         $member->isAdmin() or $this->disallow();
6461
6462         $pid = intRequestVar('plugid');
6463         if (!$manager->pidInstalled($pid))
6464             $this->error(_ERROR_NOSUCHPLUGIN);
6465
6466         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6467         $pluginName = i18n::hsc(getPluginNameFromPid($pid));
6468         $this->pagehead($extrahead);
6469
6470         ?>
6471             <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6472
6473             <h2><?php echo sprintf(_PLUGIN_OPTIONS_TITLE, $pluginName) ?></h2>
6474
6475             <?php if  ($message) echo $message?>
6476
6477             <form action="index.php" method="post">
6478             <div>
6479                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6480                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6481
6482         <?php
6483
6484         $manager->addTicketHidden();
6485
6486         $aOptions = array();
6487         $aOIDs = array();
6488         $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6489         $r = sql_query($query);
6490         while ($o = sql_fetch_object($r)) {
6491             array_push($aOIDs, $o->oid);
6492             $aOptions[$o->oid] = array(
6493                         'oid' => $o->oid,
6494                         'value' => $o->odef,
6495                         'name' => $o->oname,
6496                         'description' => $o->odesc,
6497                         'type' => $o->otype,
6498                         'typeinfo' => $o->oextra,
6499                         'contextid' => 0
6500             );
6501         }
6502         // fill out actual values
6503         if (count($aOIDs) > 0) {
6504             $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6505             while ($o = sql_fetch_object($r))
6506                 $aOptions[$o->oid]['value'] = $o->ovalue;
6507         }
6508
6509         // call plugins
6510         $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6511
6512         $template['content'] = 'plugoptionlist';
6513         $amount = showlist($aOptions,'table',$template);
6514         if ($amount == 0)
6515             echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6516
6517         ?>
6518             </div>
6519             </form>
6520         <?php       $this->pagefoot();
6521
6522
6523
6524     }
6525
6526     /**
6527      * @todo document this
6528      */
6529     function action_pluginoptionsupdate() {
6530         global $member, $manager;
6531
6532         // check if allowed
6533         $member->isAdmin() or $this->disallow();
6534
6535         $pid = intRequestVar('plugid');
6536         if (!$manager->pidInstalled($pid))
6537             $this->error(_ERROR_NOSUCHPLUGIN);
6538
6539         $aOptions = requestArray('plugoption');
6540         NucleusPlugin::_applyPluginOptions($aOptions);
6541
6542         $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6543
6544         $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6545     }
6546
6547     /**
6548      * @static
6549      * @todo document this
6550      */
6551     function _insertPluginOptions($context, $contextid = 0) {
6552         // get all current values for this contextid
6553         // (note: this might contain doubles for overlapping contextids)
6554         $aIdToValue = array();
6555         $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6556         while ($o = sql_fetch_object($res)) {
6557             $aIdToValue[$o->oid] = $o->ovalue;
6558         }
6559
6560         // get list of oids per pid
6561         $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6562                . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6563         $res = sql_query($query);
6564         $aOptions = array();
6565         while ($o = sql_fetch_object($res)) {
6566             if (in_array($o->oid, array_keys($aIdToValue)))
6567                 $value = $aIdToValue[$o->oid];
6568             else
6569                 $value = $o->odef;
6570
6571             array_push($aOptions, array(
6572                 'pid' => $o->pid,
6573                 'pfile' => $o->pfile,
6574                 'oid' => $o->oid,
6575                 'value' => $value,
6576                 'name' => $o->oname,
6577                 'description' => $o->odesc,
6578                 'type' => $o->otype,
6579                 'typeinfo' => $o->oextra,
6580                 'contextid' => $contextid,
6581                 'extra' => ''
6582             ));
6583         }
6584
6585         global $manager;
6586         $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6587
6588
6589         $iPrevPid = -1;
6590         foreach ($aOptions as $aOption) {
6591
6592             // new plugin?
6593             if ($iPrevPid != $aOption['pid']) {
6594                 $iPrevPid = $aOption['pid'];
6595                 if (!defined('_PLUGIN_OPTIONS_TITLE')) {
6596                     define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6597                 }
6598                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, i18n::hsc($aOption['pfile'])).'</th></tr>';
6599             }
6600
6601             $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6602             if (@$meta['access'] != 'hidden') {
6603                 echo '<tr>';
6604                 listplug_plugOptionRow($aOption);
6605                 echo '</tr>';
6606             }
6607
6608         }
6609
6610
6611     }
6612
6613         /**
6614          * ADMIN::input_yesno()
6615          * Output input elements with radio attribute for yes/no options
6616          *
6617          * @param       string  $name   name attribute
6618          * @param       string  $value_current  current value attribute
6619          * @param       integer $tabindex       tab index
6620          * @param       string  $value_yes      value attribute for yes option
6621          * @param       string  $value_no       value attribute for no option
6622          * @param       string  $text_yes       child text element for yes option
6623          * @param       string  $text_no        child text element for no option
6624          * @param       boolean $isAdmin        have admin right or not
6625          * @return      void
6626          */
6627         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6628         {
6629                 $id = preg_replace('#\[|\]#', '-', $name);
6630                 $id_yes = $id . $value_yes;
6631                 $id_no  = $id . $value_no;
6632
6633                 /* yes option */
6634                 echo '<input type="radio" id="' . i18n::hsc($id_yes) . '" name="' . i18n::hsc($name) . '" value="' . i18n::hsc($value_yes) . '"';
6635                 if ( $name=="admin" )
6636                 {
6637                         echo ' onclick="selectCanLogin(true);"';
6638                 }
6639                 if ( $value_current == $value_yes )
6640                 {
6641                         echo " tabindex='$tabindex' checked='checked'";
6642                 }
6643                 echo " />\n";
6644                 echo '<label for="' . i18n::hsc($id_yes) . '">' . i18n::hsc($text_yes) . "</label>\n";
6645
6646                 /* no option */
6647                 echo '<input type="radio" id="' . i18n::hsc($id_no) . '" name="' . i18n::hsc($name) . '" value="' . i18n::hsc($value_no) . '"';
6648                 if ( $name=="admin" )
6649                 {
6650                         echo ' onclick="selectCanLogin(false);"';
6651                 }
6652                 if ( $value_current != $value_yes )
6653                 {
6654                         echo " tabindex='$tabindex' checked='checked'";
6655                 }
6656                 if ($isAdmin && $name=="canlogin")
6657                 {
6658                         echo ' disabled="disabled"';
6659                 }
6660                 echo " />\n";
6661                 echo '<label for="' . i18n::hsc($id_no) . '">' . i18n::hsc($text_no) . "</label>\n";
6662
6663                 return;
6664         }
6665 }