nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static public $headMess;\r
  31         \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $extrahead;\r
  35         static private $passvar;\r
  36         static private $aOptions;\r
  37         \r
  38         /**\r
  39          * Admin::$edit_actions\r
  40          */\r
  41         static private $edit_actions = array(\r
  42                 'adminskinoverview',\r
  43                 'adminskinieoverview',\r
  44                 'adminskinedittype',\r
  45                 'adminskinremovetype',\r
  46                 'adminskindelete',\r
  47                 'adminskinedit',\r
  48                 'adminskinieimport',\r
  49                 'adminskiniedoimport',\r
  50                 'admintemplateedit',\r
  51                 'admintemplateoverview',\r
  52                 'admintemplatedelete'\r
  53         );\r
  54         \r
  55         /**\r
  56          * Admin::$skinless_actions\r
  57          */\r
  58         static private $skinless_actions = array(\r
  59                 'plugindeleteconfirm',\r
  60                 'pluginoptionsupdate',\r
  61                 'skinremovetypeconfirm',\r
  62                 'skinclone',\r
  63                 'skindeleteconfirm',\r
  64                 'skinnew',\r
  65                 'skineditgeneral',\r
  66                 'skinieexport',\r
  67                 'skinupdate',\r
  68                 'templateupdate',\r
  69                 'templatedeleteconfirm',\r
  70                 'templatenew',\r
  71                 'templateclone',\r
  72                 'adminskinremovetypeconfirm',\r
  73                 'adminskinclone',\r
  74                 'adminskindeleteconfirm',\r
  75                 'adminskinnew',\r
  76                 'adminskineditgeneral',\r
  77                 'adminskinieexport',\r
  78                 'adminskinupdate',\r
  79                 'admintemplateupdate',\r
  80                 'admintemplatedeleteconfirm',\r
  81                 'admintemplatenew',\r
  82                 'admintemplateclone',\r
  83                 'blogsettingsupdate',\r
  84                 'settingsupdate',\r
  85                 'addnewlog2',\r
  86                 'additem',\r
  87                 'itemdeleteconfirm',\r
  88                 'itemupdate',\r
  89                 'changemembersettings',\r
  90                 'clearactionlog',\r
  91                 'memberedit'\r
  92         );\r
  93         \r
  94         static private $actions_needless_to_check = array(\r
  95                 'showlogin',\r
  96                 'login',\r
  97                 'overview',\r
  98                 'itemlist',\r
  99                 'blogcommentlist',\r
 100                 'bookmarklet',\r
 101                 'blogsettings',\r
 102                 'banlist',\r
 103                 'deleteblog',\r
 104                 'editmembersettings',\r
 105                 'browseownitems',\r
 106                 'browseowncomments',\r
 107                 'createitem',\r
 108                 'itemedit',\r
 109                 'itemmove',\r
 110                 'categoryedit',\r
 111                 'categorydelete',\r
 112                 'manage',\r
 113                 'actionlog',\r
 114                 'settingsedit',\r
 115                 'backupoverview',\r
 116                 'pluginlist',\r
 117                 'createnewlog',\r
 118                 'usermanagement',\r
 119                 'skinoverview',\r
 120                 'templateoverview',\r
 121                 'skinieoverview',\r
 122                 'itemcommentlist',\r
 123                 'commentedit',\r
 124                 'commentdelete',\r
 125                 'banlistnewfromitem',\r
 126                 'banlistdelete',\r
 127                 'itemdelete',\r
 128                 'manageteam',\r
 129                 'teamdelete',\r
 130                 'banlistnew',\r
 131                 'memberedit',\r
 132                 'memberdelete',\r
 133                 'pluginhelp',\r
 134                 'pluginoptions',\r
 135                 'plugindelete',\r
 136                 'skinedittype',\r
 137                 'skinremovetype',\r
 138                 'skindelete',\r
 139                 'skinedit',\r
 140                 'templateedit',\r
 141                 'templatedelete',\r
 142                 'activate',\r
 143                 'systemoverview',\r
 144                 'activatesetpwd',\r
 145         );\r
 146         \r
 147         static public function initialize()\r
 148         {\r
 149                 global $CONF, $DIR_LIBS;\r
 150                 \r
 151                 /* NOTE: 1. decide which skinid to use */\r
 152                 $skinid = $CONF['DefaultAdminSkin'];\r
 153                 /*\r
 154                  * NOTE: this is temporary escaped because not implemented yet\r
 155                 if (isset($member) && $member->isLoggedIn())\r
 156                 {\r
 157                         $memskin = $member->getAdminSkin();\r
 158                         if ( $memskin )\r
 159                         {\r
 160                                 $skinid = $memskin;\r
 161                         }\r
 162                 }\r
 163                 */\r
 164                 \r
 165                 /* NOTE: 2. make an instance of skin object */\r
 166                 if ( !Skin::existsID($skinid) )\r
 167                 {\r
 168                         return FALSE;\r
 169                 }\r
 170                 \r
 171                 /* NOTE: 3. initializing each members */\r
 172                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 173                 self::$action           = '';\r
 174                 self::$extrahead        = '';\r
 175                 self::$passvar          = '';\r
 176                 self::$headMess         = '';\r
 177                 self::$aOptions         = '';\r
 178                 return TRUE;\r
 179         }\r
 180         \r
 181         /**\r
 182          * Admin::action()\r
 183          * Executes an action\r
 184          *\r
 185          * @param       string  $action action to be performed\r
 186          * @return      void\r
 187          */\r
 188         static public function action($action)\r
 189         {\r
 190                 global $CONF, $DIR_LIBS, $manager, $member;\r
 191                 \r
 192                 /* 1. decide action name */\r
 193                 $customAction = postvar('customaction');\r
 194                 if ( !empty($customAction) )\r
 195                 {\r
 196                         $alias = array(\r
 197                                 'login' => $customAction,\r
 198                                 ''              => $customAction\r
 199                         );\r
 200                 }\r
 201                 else\r
 202                 {\r
 203                         $alias = array(\r
 204                                 'login' => 'overview',\r
 205                                 ''              => 'overview'\r
 206                         );\r
 207                 }\r
 208                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 209                 {\r
 210                         $action = $alias[$action];\r
 211                 }\r
 212                 $methodName = "action_{$action}";\r
 213                 self::$action = strtolower($action);\r
 214                 \r
 215                 /* 2. check the action */\r
 216                 $synonimActions = array(\r
 217                         'banlistnewfromitem',\r
 218                         'memberedit',\r
 219                         'login',\r
 220                 );\r
 221                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 222                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 223                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 224                 {\r
 225                         if (!$manager->checkTicket())\r
 226                         {\r
 227                                 self::error(_ERROR_BADTICKET);\r
 228                         }\r
 229                 }\r
 230 \r
 231                 /* 3. parse according to the action */\r
 232                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 233                 {\r
 234                         /* TODO: what is this?\r
 235                         self::action_parseSpecialskin();\r
 236                         */\r
 237                 }\r
 238                 elseif ( method_exists('Admin', $methodName) )\r
 239                 {\r
 240                         call_user_func(array(__CLASS__, $methodName));\r
 241                 }\r
 242                 else if ( self::existsSkinContents('adminerrorpage') )\r
 243                 {\r
 244                         self::error(_BADACTION . ENTITY::hsc($action));\r
 245                 }\r
 246                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 247                 {\r
 248                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 249                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 250                         {\r
 251                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 252                         }\r
 253                 }\r
 254                 else\r
 255                 {\r
 256                         self::error(_BADACTION . ENTITY::hsc($action));\r
 257                 }\r
 258                 exit;\r
 259         }\r
 260         \r
 261         /**\r
 262          * Action::existsSkinContents()\r
 263          * Check skin contents\r
 264          *\r
 265          * @param       string  $action action type\r
 266          * @return      boolean\r
 267          */\r
 268         static private function existsSkinContents($action)\r
 269         {\r
 270                 $in_array  = in_array($action, self::$skinless_actions);\r
 271                 \r
 272                 if ( $in_array )\r
 273                 {\r
 274                         return $in_array;\r
 275                 }\r
 276                 else\r
 277                 {\r
 278                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 279                         /* TODO: skinid should be a default */\r
 280                         if ( !is_object(self::$skin) )\r
 281                         {\r
 282                                 global $CONF;\r
 283                                 return quickQuery(sprintf($query, sql_table('skin'), $CONF['DefaultAdminSkin'], sql_real_escape_string($action)));\r
 284                         }\r
 285                         else\r
 286                         {\r
 287                                 return quickQuery(sprintf($query, sql_table('skin'), self::$skin->getID(), sql_real_escape_string($action)));\r
 288                         }\r
 289                 }\r
 290                 return;\r
 291         }\r
 292         \r
 293         /**\r
 294          * Action::specialActionsAllow()\r
 295          * Check exists specialskinparts\r
 296          *\r
 297          * @param       string  $action action type\r
 298          * @return boolean\r
 299          */\r
 300         static private function specialActionsAllow($action)\r
 301         {\r
 302                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 303                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 304                 return quickQuery($query);\r
 305         }\r
 306         \r
 307         /**\r
 308          * Action::action_showlogin()\r
 309          * \r
 310          * @param       void\r
 311          * @return      void\r
 312          */\r
 313         static private function action_showlogin()\r
 314         {\r
 315                 global $error;\r
 316                 self::action_login($error);\r
 317                 return;\r
 318         }\r
 319         \r
 320         /**\r
 321          * Action::action_login()\r
 322          * \r
 323          * @param       string  $msg            message for pageheader\r
 324          * @param       integer $passvars       ???\r
 325          */\r
 326         static private function action_login($msg = '', $passvars = 1)\r
 327         {\r
 328                 global $member;\r
 329                 \r
 330                 // skip to overview when allowed\r
 331                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 332                 {\r
 333                         self::action_overview();\r
 334                         exit;\r
 335                 }\r
 336                 \r
 337                 /* TODO: needless variable??? */\r
 338                 self::$passvar = $passvars;\r
 339                 if ( $msg )\r
 340                 {\r
 341                         self::$headMess = $msg;\r
 342                 }\r
 343                 \r
 344                 self::pagehead();\r
 345                 self::$skin->parse('showlogin');\r
 346                 self::pagefoot();\r
 347         }\r
 348         \r
 349         /**\r
 350          * Action::action_overview()\r
 351          * provides a screen with the overview of the actions available\r
 352          * \r
 353          * @param       string  $msg    message for pageheader\r
 354          * @return      void\r
 355          */\r
 356         static private function action_overview($msg = '')\r
 357         {\r
 358                 if ( $msg )\r
 359                 {\r
 360                         self::$headMess = $msg;\r
 361                 }\r
 362                 \r
 363                 self::pagehead();\r
 364                 self::$skin->parse('overview');\r
 365                 self::pagefoot();\r
 366                 return;\r
 367         }\r
 368         \r
 369         /**\r
 370          * Admin::action_manage()\r
 371          * \r
 372          * @param       string  $msg    message for pageheader\r
 373          * @retrn       void\r
 374          */\r
 375         static private function action_manage($msg = '')\r
 376         {\r
 377                 global $member;\r
 378                 \r
 379                 if ( $msg )\r
 380                 {\r
 381                         self::$headMess = $msg;\r
 382                 }\r
 383                 $member->isAdmin() or self::disallow();\r
 384                 \r
 385                 self::pagehead();\r
 386                 self::$skin->parse('manage');\r
 387                 self::pagefoot();\r
 388                 return;\r
 389         }\r
 390         \r
 391         /**\r
 392          * Action::action_itemlist()\r
 393          * \r
 394          * @param       integer id for weblod\r
 395          * @return      void\r
 396          */\r
 397         static private function action_itemlist($blogid = '')\r
 398         {\r
 399                 global $member, $manager, $CONF;\r
 400                 \r
 401                 if ( $blogid == '' )\r
 402                 {\r
 403                         $blogid = intRequestVar('blogid');\r
 404                 }\r
 405                 \r
 406                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 407                 \r
 408                 self::pagehead();\r
 409                 self::$skin->parse('itemlist');\r
 410                 self::pagefoot();\r
 411                 return;\r
 412         }\r
 413         \r
 414         /**\r
 415          * Action::action_batchitem()\r
 416          * \r
 417          * @param       void\r
 418          * @return      void\r
 419          */\r
 420         static private function action_batchitem()\r
 421         {\r
 422                 global $member, $manager;\r
 423                 \r
 424                 $member->isLoggedIn() or self::disallow();\r
 425                 \r
 426                 $selected       = requestIntArray('batch');\r
 427                 $action         = requestVar('batchaction');\r
 428                 \r
 429                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 430                 {\r
 431                         self::error(_BATCH_NOSELECTION);\r
 432                 }\r
 433                 \r
 434                 // On move: when no destination blog/category chosen, show choice now\r
 435                 $destCatid = intRequestVar('destcatid');\r
 436                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 437                 {\r
 438                         self::batchMoveSelectDestination('item', $selected);\r
 439                 }\r
 440                 \r
 441                 // On delete: check if confirmation has been given\r
 442                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 443                 {\r
 444                         self::batchAskDeleteConfirmation('item', $selected);\r
 445                 }\r
 446                 \r
 447                 self::pagehead();\r
 448                 self::$skin->parse('batchitem');\r
 449                 self::pagefoot();\r
 450                 return;\r
 451         }\r
 452         \r
 453         /**\r
 454          * Action::action_batchcomment()\r
 455          * \r
 456          * @param       void\r
 457          * @return      void\r
 458          */\r
 459         static private function action_batchcomment()\r
 460         {\r
 461                 global $member;\r
 462                 \r
 463                 $member->isLoggedIn() or self::disallow();\r
 464                 \r
 465                 $selected       = requestIntArray('batch');\r
 466                 $action         = requestVar('batchaction');\r
 467                 \r
 468                 // Show error when no items were selected\r
 469                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 470                 {\r
 471                         self::error(_BATCH_NOSELECTION);\r
 472                 }\r
 473                 \r
 474                 // On delete: check if confirmation has been given\r
 475                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 476                 {\r
 477                         self::batchAskDeleteConfirmation('comment',$selected);\r
 478                 }\r
 479                 \r
 480                 self::pagehead();\r
 481                 self::$skin->parse('batchcomment');\r
 482                 self::pagefoot();\r
 483                 return;\r
 484         }\r
 485         \r
 486         /**\r
 487          * Admin::setAdminAction()\r
 488          *\r
 489          * @param       string  $action\r
 490          * @return      void\r
 491          */\r
 492         static public function setAdminAction($action)\r
 493         {\r
 494                 self::$action = $action;\r
 495                 return;\r
 496         }\r
 497         \r
 498         /**\r
 499          * Admin::action_batchmember()\r
 500          * \r
 501          * @param       void\r
 502          * @return      void\r
 503          */\r
 504         static private function action_batchmember()\r
 505         {\r
 506                 global $member;\r
 507                 \r
 508                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 509                 \r
 510                 $selected       = requestIntArray('batch');\r
 511                 $action         = requestVar('batchaction');\r
 512                 \r
 513                 // Show error when no members selected\r
 514                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 515                 {\r
 516                         self::error(_BATCH_NOSELECTION);\r
 517                 }\r
 518                 \r
 519                 // On delete: check if confirmation has been given\r
 520                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 521                 {\r
 522                         self::batchAskDeleteConfirmation('member',$selected);\r
 523                 }\r
 524                 \r
 525                 self::pagehead();\r
 526                 self::$skin->parse('batchmember');\r
 527                 self::pagefoot();\r
 528                 return;\r
 529         }\r
 530         \r
 531         /**\r
 532          * Admin::action_batchteam()\r
 533          * \r
 534          * @param       void\r
 535          * @return      void\r
 536          */\r
 537         static private function action_batchteam()\r
 538         {\r
 539                 global $member;\r
 540                 \r
 541                 $blogid = intRequestVar('blogid');\r
 542                 \r
 543                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 544                 \r
 545                 $selected       = requestIntArray('batch');\r
 546                 $action         = requestVar('batchaction');\r
 547                 \r
 548                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 549                 {\r
 550                         self::error(_BATCH_NOSELECTION);\r
 551                 }\r
 552                 \r
 553                 // On delete: check if confirmation has been given\r
 554                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 555                 {\r
 556                         self::batchAskDeleteConfirmation('team',$selected);\r
 557                 }\r
 558                 \r
 559                 self::pagehead();\r
 560                 self::$skin->parse('batchteam');\r
 561                 self::pagefoot();\r
 562                 return;\r
 563         }\r
 564         \r
 565         /**\r
 566          * Admin::action_batchcategory()\r
 567          * \r
 568          * @param       void\r
 569          * @return      void\r
 570          */\r
 571         static private function action_batchcategory()\r
 572         {\r
 573                 global $member, $manager;\r
 574                 \r
 575                 $member->isLoggedIn() or self::disallow();\r
 576                 \r
 577                 $selected       = requestIntArray('batch');\r
 578                 $action         = requestVar('batchaction');\r
 579                 \r
 580                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 581                 {\r
 582                         self::error(_BATCH_NOSELECTION);\r
 583                 }\r
 584                 \r
 585                 // On move: when no destination blog chosen, show choice now\r
 586                 $destBlogId = intRequestVar('destblogid');\r
 587                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 588                 {\r
 589                         self::batchMoveCategorySelectDestination('category', $selected);\r
 590                 }\r
 591                 \r
 592                 // On delete: check if confirmation has been given\r
 593                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 594                 {\r
 595                         self::batchAskDeleteConfirmation('category', $selected);\r
 596                 }\r
 597                 \r
 598                 self::pagehead();\r
 599                 self::$skin->parse('batchcategory');\r
 600                 self::pagefoot();\r
 601                 return;\r
 602         }\r
 603         \r
 604         /**\r
 605          * Admin::batchMoveSelectDestination()\r
 606          * \r
 607          * @param       string  $type   type of batch action\r
 608          * @param       integer $ids    needless???\r
 609          * @return      void\r
 610          * \r
 611          * TODO: remove needless argument\r
 612          */\r
 613         static private function batchMoveSelectDestination($type, $ids)\r
 614         {\r
 615                 $_POST['batchmove'] = $type;\r
 616                 self::pagehead();\r
 617                 self::$skin->parse('batchmove');\r
 618                 self::pagefoot();\r
 619                 return;\r
 620         }\r
 621         \r
 622         /**\r
 623          * Admin::batchMoveCategorySelectDestination()\r
 624          * \r
 625          * @param       string  $type   type of batch action\r
 626          * @param       integer $ids    needless???\r
 627          * @return      void\r
 628          * \r
 629          * TODO: remove needless argument\r
 630          */\r
 631         static private function batchMoveCategorySelectDestination($type, $ids)\r
 632         {\r
 633                 $_POST['batchmove'] = $type;\r
 634                 global $manager;\r
 635                 self::pagehead();\r
 636                 self::$skin->parse('batchmovecat');\r
 637                 self::pagefoot();\r
 638                 return;\r
 639         }\r
 640         \r
 641         /**\r
 642          * Admin::batchAskDeleteConfirmation()\r
 643          * \r
 644          * @param       string  $type   type of batch action\r
 645          * @param       integer $ids    needless???\r
 646          * @return      void\r
 647          * \r
 648          * TODO: remove needless argument\r
 649          */\r
 650         static private function batchAskDeleteConfirmation($type, $ids)\r
 651         {\r
 652                 self::pagehead();\r
 653                 self::$skin->parse('batchdelete');\r
 654                 self::pagefoot();\r
 655                 return;\r
 656         }\r
 657         \r
 658         /**\r
 659          * Admin::selectBlogCategory()\r
 660          * Inserts a HTML select element with choices for all categories to which the current\r
 661          * member has access\r
 662          *\r
 663          * @see function selectBlog\r
 664          * @param       string  $name                           name of weblod\r
 665          * @param       integer $selected                       \r
 666          * @param       integer $tabindex                       \r
 667          * @param       integer $showNewCat                     \r
 668          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 669          * @return      void\r
 670          *\r
 671          * NOTE: callback from AdminAction\r
 672          */\r
 673         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 674         {\r
 675                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 676                 return;\r
 677         }\r
 678         \r
 679         /**\r
 680          * Admin::selectBlog()\r
 681          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 682          *      mode = 'blog' => shows blognames and values are blogids\r
 683          *      mode = 'category' => show category names and values are catids\r
 684          *\r
 685          * @param       string  $name                           name of weblod\r
 686          * @param       string  $mode                           \r
 687          * @param       integer $selected                       \r
 688          * @param       integer $tabindex                       \r
 689          * @param       integer $showNewCat                     \r
 690          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 691          * @param $iForcedBlogInclude\r
 692          *      ID of a blog that always needs to be included, without checking if the\r
 693          *      member is on the blog team (-1 = none)\r
 694          * @return      void\r
 695          */\r
 696         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 697         {\r
 698                 global $member, $CONF;\r
 699                 \r
 700                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 701                 $aBlogIds = array();\r
 702                 if ( $iForcedBlogInclude != -1 )\r
 703                 {\r
 704                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 705                 }\r
 706                 \r
 707                 if ( $member->isAdmin() && array_key_exists('ShowAllBlogs', $CONF) && $CONF['ShowAllBlogs'] )\r
 708                 {\r
 709                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 710                         $query = sprintf($query, sql_table('blog'));\r
 711                 }\r
 712                 else\r
 713                 {\r
 714                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 715                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 716                 }\r
 717                 \r
 718                 $rblogids = sql_query($query);\r
 719                 while ($o = sql_fetch_object($rblogids))\r
 720                 {\r
 721                         if ( $o->bnumber != $iForcedBlogInclude )\r
 722                         {\r
 723                                 $aBlogIds[] = intval($o->bnumber);\r
 724                         }\r
 725                 }\r
 726                 \r
 727                 if ( count($aBlogIds) == 0 )\r
 728                 {\r
 729                         return;\r
 730                 }\r
 731                 \r
 732                 /* TODO: we should consider to use the other way instead of this */\r
 733                 $_REQUEST['selectData'] = array(\r
 734                         'name'                  => $name,\r
 735                         'tabindex'              => $tabindex,\r
 736                         'mode'                  => $mode,\r
 737                         'selected'              => $selected,\r
 738                         'showNewCat'    => $showNewCat,\r
 739                         'aBlogIds'              => $aBlogIds,\r
 740                 );\r
 741                 self::$skin->parse('blogselectbox');\r
 742                 return;\r
 743         }\r
 744         \r
 745         /**\r
 746          * Admin::action_browseownitems()\r
 747          * \r
 748          * @param       void\r
 749          * @return      void\r
 750          */\r
 751         static private function action_browseownitems()\r
 752         {\r
 753                 global $member, $manager, $CONF;\r
 754                 \r
 755                 self::pagehead();\r
 756                 self::$skin->parse('browseownitems');\r
 757                 self::pagefoot();\r
 758                 return;\r
 759         }\r
 760         \r
 761         /**\r
 762          * Admin::action_itemcommentlist()\r
 763          * Show all the comments for a given item\r
 764          * \r
 765          * @param       integer $itemid ID for item\r
 766          * @return      void\r
 767          */\r
 768         static private function action_itemcommentlist($itemid = '')\r
 769         {\r
 770                 global $member, $manager, $CONF;\r
 771                 \r
 772                 if ( $itemid == '' )\r
 773                 {\r
 774                         $itemid = intRequestVar('itemid');\r
 775                 }\r
 776                 \r
 777                 /* TODO: we consider to use the other way insterad of this */\r
 778                 $_REQUEST['itemid'] = $itemid;\r
 779                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 780                 \r
 781                 // only allow if user is allowed to alter item\r
 782                 $member->canAlterItem($itemid) or self::disallow();\r
 783                 \r
 784                 $blogid = getBlogIdFromItemId($itemid);\r
 785                 \r
 786                 self::pagehead();\r
 787                 self::$skin->parse('itemcommentlist');\r
 788                 self::pagefoot();\r
 789                 return;\r
 790         }\r
 791         \r
 792         /**\r
 793          * Admin::action_browseowncomments()\r
 794          * Browse own comments\r
 795          * \r
 796          * @param       void\r
 797          * @return      void\r
 798          */\r
 799         static private function action_browseowncomments()\r
 800         {\r
 801                 self::pagehead();\r
 802                 self::$skin->parse('browseowncomments');\r
 803                 self::pagefoot();\r
 804                 return;\r
 805         }\r
 806         \r
 807         /**\r
 808          * Admin::action_blogcommentlist()\r
 809          * Browse all comments for a weblog\r
 810          * \r
 811          * @param       integer $blogid ID for weblog\r
 812          * @return      void\r
 813          */\r
 814         static private function action_blogcommentlist($blogid = '')\r
 815         {\r
 816                 global $member, $manager, $CONF;\r
 817                 \r
 818                 if ( $blogid == '' )\r
 819                 {\r
 820                         $blogid = intRequestVar('blogid');\r
 821                 }\r
 822                 else\r
 823                 {\r
 824                         $blogid = intval($blogid);\r
 825                 }\r
 826                 \r
 827                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 828                 \r
 829                 /* TODO: we consider to use the other way insterad of this */\r
 830                 $_REQUEST['blogid'] = $blogid;\r
 831                 \r
 832                 self::pagehead();\r
 833                 self::$skin->parse('blogcommentlist');\r
 834                 self::pagefoot();\r
 835                 return;\r
 836         }\r
 837         \r
 838         /**\r
 839          * Admin::action_createitem()\r
 840          * Provide a page to item a new item to the given blog\r
 841          * \r
 842          * @param       void\r
 843          * @return      void\r
 844          */\r
 845         static private function action_createitem()\r
 846         {\r
 847                 global $member, $manager;\r
 848                 \r
 849                 $blogid = intRequestVar('blogid');\r
 850                 \r
 851                 // check if allowed\r
 852                 $member->teamRights($blogid) or self::disallow();\r
 853                 \r
 854                 $memberid = $member->getID();\r
 855                 \r
 856                 $blog =& $manager->getBlog($blogid);\r
 857                 \r
 858                 self::pagehead();\r
 859                 self::$skin->parse('createitem');\r
 860                 self::pagefoot();\r
 861                 return;\r
 862         }\r
 863         \r
 864         /**\r
 865          * Admin::action_itemedit()\r
 866          * \r
 867          * @param       void\r
 868          * @return      void\r
 869          */\r
 870         static private function action_itemedit()\r
 871         {\r
 872                 global $member, $manager;\r
 873                 \r
 874                 $itemid = intRequestVar('itemid');\r
 875                 \r
 876                 // only allow if user is allowed to alter item\r
 877                 $member->canAlterItem($itemid) or self::disallow();\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $blogid = getBlogIDFromItemID($itemid);\r
 881                 $item   =& $manager->getItem($itemid, 1, 1);\r
 882                 $manager->notify(\r
 883                                 'PrepareItemForEdit',\r
 884                                 array(\r
 885                                                 'item' => &$item\r
 886                                 )\r
 887                 );\r
 888                 \r
 889                 self::pagehead();\r
 890                 self::$skin->parse('itemedit');\r
 891                 self::pagefoot();\r
 892                 return;\r
 893         }\r
 894         \r
 895         /**\r
 896          * Admin::action_itemupdate()\r
 897          * \r
 898          * @param       void\r
 899          * @return      void\r
 900          */\r
 901         static private function action_itemupdate()\r
 902         {\r
 903                 global $member, $manager, $CONF;\r
 904                 \r
 905                 $itemid = intRequestVar('itemid');\r
 906                 $catid  = postVar('catid');\r
 907                 \r
 908                 // only allow if user is allowed to alter item\r
 909                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 910                 \r
 911                 $actiontype = postVar('actiontype');\r
 912                 \r
 913                 // delete actions are handled by itemdelete (which has confirmation)\r
 914                 if ( $actiontype == 'delete' )\r
 915                 {\r
 916                         self::action_itemdelete();\r
 917                         return;\r
 918                 }\r
 919                 \r
 920                 $body           = postVar('body');\r
 921                 $title          = postVar('title');\r
 922                 $more           = postVar('more');\r
 923                 $closed         = intPostVar('closed');\r
 924                 $draftid        = intPostVar('draftid');\r
 925                 \r
 926                 // default action = add now\r
 927                 if ( !$actiontype )\r
 928                 {\r
 929                         $actiontype='addnow';\r
 930                 }\r
 931                 \r
 932                 // create new category if needed\r
 933                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 934                 {\r
 935                         // get blogid\r
 936                         list($blogid) = sscanf($catid,"newcat-%d");\r
 937                         \r
 938                         // create\r
 939                         $blog =& $manager->getBlog($blogid);\r
 940                         $catid = $blog->createNewCategory();\r
 941                         \r
 942                         // show error when sth goes wrong\r
 943                         if ( !$catid )\r
 944                         {\r
 945                                 self::doError(_ERROR_CATCREATEFAIL);\r
 946                         }\r
 947                 }\r
 948                 \r
 949                 /*\r
 950                         set some variables based on actiontype\r
 951 \r
 952                         actiontypes:\r
 953                                 draft items -> addnow, addfuture, adddraft, delete\r
 954                                 non-draft items -> edit, changedate, delete\r
 955 \r
 956                         variables set:\r
 957                                 $timestamp: set to a nonzero value for future dates or date changes\r
 958                                 $wasdraft: set to 1 when the item used to be a draft item\r
 959                                 $publish: set to 1 when the edited item is not a draft\r
 960          */\r
 961                 $blogid =  getBlogIDFromItemID($itemid);\r
 962                 $blog   =& $manager->getBlog($blogid);\r
 963                 \r
 964                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 965                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 966                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 967                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 968                 {\r
 969                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 970                 }\r
 971                 else\r
 972                 {\r
 973                         $timestamp =0;\r
 974                 }\r
 975                 \r
 976                 // edit the item for real\r
 977                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 978                 \r
 979                 self::updateFuturePosted($blogid);\r
 980                 \r
 981                 if ( $draftid > 0 )\r
 982                 {\r
 983                         // delete permission is checked inside Item::delete()\r
 984                         Item::delete($draftid);\r
 985                 }\r
 986                 \r
 987                 if ( $catid != intPostVar('catid') )\r
 988                 {\r
 989                         self::action_categoryedit(\r
 990                                 $catid,\r
 991                                 $blog->getID(),\r
 992                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 993                         );\r
 994                 }\r
 995                 else\r
 996                 {\r
 997                         // TODO: set start item correctly for itemlist\r
 998                         $item = Item::getItem($itemid, 0, 0);\r
 999                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
1000                         $_REQUEST['start'] = $cnt + 1;\r
1001                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
1002                 }\r
1003                 return;\r
1004         }\r
1005         \r
1006         /**\r
1007          * Admin::action_itemdelete()\r
1008          * Delete item\r
1009          * \r
1010          * @param       Void\r
1011          * @return      Void\r
1012          */\r
1013         static private function action_itemdelete()\r
1014         {\r
1015                 global $member, $manager;\r
1016                 \r
1017                 $itemid = intRequestVar('itemid');\r
1018                 \r
1019                 // only allow if user is allowed to alter item\r
1020                 $member->canAlterItem($itemid) or self::disallow();\r
1021                 \r
1022                 if ( !$manager->existsItem($itemid,1,1) )\r
1023                 {\r
1024                         self::error(_ERROR_NOSUCHITEM);\r
1025                 }\r
1026                 \r
1027                 self::pagehead();\r
1028                 self::$skin->parse('itemdelete');\r
1029                 self::pagefoot();\r
1030                 return;\r
1031         }\r
1032         \r
1033         /**\r
1034          * Admin::action_itemdeleteconfirm()\r
1035          * \r
1036          * @param       void\r
1037          * @return      void\r
1038          */\r
1039         static private function action_itemdeleteconfirm()\r
1040         {\r
1041                 global $member;\r
1042                 \r
1043                 $itemid = intRequestVar('itemid');\r
1044                 \r
1045                 // only allow if user is allowed to alter item\r
1046                 $member->canAlterItem($itemid) or self::disallow();\r
1047                 \r
1048                 // get blogid first\r
1049                 $blogid = getBlogIdFromItemId($itemid);\r
1050                 \r
1051                 // delete item (note: some checks will be performed twice)\r
1052                 self::deleteOneItem($itemid);\r
1053                 \r
1054                 self::action_itemlist($blogid);\r
1055                 return;\r
1056         }\r
1057         \r
1058         /**\r
1059          * Admin::deleteOneItem()\r
1060          * Deletes one item and returns error if something goes wrong\r
1061          * \r
1062          * @param       integer $itemid ID for item\r
1063          * @return      void\r
1064          */\r
1065         static private function deleteOneItem($itemid)\r
1066         {\r
1067                 global $member, $manager;\r
1068                 \r
1069                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1070                 if ( !$member->canAlterItem($itemid) )\r
1071                 {\r
1072                         return _ERROR_DISALLOWED;\r
1073                 }\r
1074                 \r
1075                 // need to get blogid before the item is deleted\r
1076                 $blogid = getBlogIDFromItemId($itemid);\r
1077                 \r
1078                 $manager->loadClass('ITEM');\r
1079                 Item::delete($itemid);\r
1080                 \r
1081                 // update blog's futureposted\r
1082                 self::updateFuturePosted($blogid);\r
1083                 return;\r
1084         }\r
1085         \r
1086         /**\r
1087          * Admin::updateFuturePosted()\r
1088          * Update a blog's future posted flag\r
1089          * \r
1090          * @param integer $blogid\r
1091          * @return      void\r
1092          */\r
1093         static private function updateFuturePosted($blogid)\r
1094         {\r
1095                 global $manager;\r
1096                 \r
1097                 $blogid                 =  intval($blogid);\r
1098                 $blog                   =& $manager->getBlog($blogid);\r
1099                 $currenttime    =  $blog->getCorrectTime(time());\r
1100                 \r
1101                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1102                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1103                 $result = sql_query($query);\r
1104                 \r
1105                 if ( sql_num_rows($result) > 0 )\r
1106                 {\r
1107                                 $blog->setFuturePost();\r
1108                 }\r
1109                 else\r
1110                 {\r
1111                                 $blog->clearFuturePost();\r
1112                 }\r
1113                 return;\r
1114         }\r
1115 \r
1116         /**\r
1117          * Admin::action_itemmove()\r
1118          * \r
1119          * @param       void\r
1120          * @return      void\r
1121          */\r
1122         static private function action_itemmove()\r
1123         {\r
1124                 global $member, $manager;\r
1125                 \r
1126                 $itemid = intRequestVar('itemid');\r
1127                 \r
1128                 $member->canAlterItem($itemid) or self::disallow();\r
1129                 \r
1130                 self::pagehead();\r
1131                 self::$skin->parse('itemmove');\r
1132                 self::pagefoot();\r
1133                 return;\r
1134         }\r
1135         \r
1136         /**\r
1137          * Admin::action_itemmoveto()\r
1138          * \r
1139          * @param       void\r
1140          * @return      void\r
1141          */\r
1142         static private function action_itemmoveto()\r
1143         {\r
1144                 global $member, $manager;\r
1145                 \r
1146                 $itemid = intRequestVar('itemid');\r
1147                 $catid = requestVar('catid');\r
1148                 \r
1149                 // create new category if needed\r
1150                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1151                 {\r
1152                         // get blogid\r
1153                         list($blogid) = sscanf($catid,'newcat-%d');\r
1154                         \r
1155                         // create\r
1156                         $blog =& $manager->getBlog($blogid);\r
1157                         $catid = $blog->createNewCategory();\r
1158                         \r
1159                         // show error when sth goes wrong\r
1160                         if ( !$catid )\r
1161                         {\r
1162                                 self::doError(_ERROR_CATCREATEFAIL);\r
1163                         }\r
1164                 }\r
1165                 \r
1166                 // only allow if user is allowed to alter item\r
1167                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1168                 \r
1169                 $old_blogid = getBlogIDFromItemId($itemid);\r
1170                 \r
1171                 Item::move($itemid, $catid);\r
1172                 \r
1173                 // set the futurePosted flag on the blog\r
1174                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1175                 \r
1176                 // reset the futurePosted in case the item is moved from one blog to another\r
1177                 self::updateFuturePosted($old_blogid);\r
1178                 \r
1179                 if ( $catid != intRequestVar('catid') )\r
1180                 {\r
1181                         self::action_categoryedit($catid, $blog->getID());\r
1182                 }\r
1183                 else\r
1184                 {\r
1185                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1186                 }\r
1187                 return;\r
1188         }\r
1189         \r
1190         /**\r
1191          * Admin::moveOneItem()\r
1192          * Moves one item to a given category (category existance should be checked by caller)\r
1193          * errors are returned\r
1194          * \r
1195          * @param       integer $itemid         ID for item\r
1196          * @param       integer $destCatid      ID for category to which the item will be moved\r
1197          * @return      void\r
1198          */\r
1199         static private function moveOneItem($itemid, $destCatid)\r
1200         {\r
1201                 global $member;\r
1202                 \r
1203                 // only allow if user is allowed to move item\r
1204                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1205                 {\r
1206                         return _ERROR_DISALLOWED;\r
1207                 }\r
1208                 \r
1209                 Item::move($itemid, $destCatid);\r
1210                 return;\r
1211         }\r
1212         \r
1213         /**\r
1214          * Admin::action_additem()\r
1215          * Adds a item to the chosen blog\r
1216          * \r
1217          * @param       void\r
1218          * @return      void\r
1219          */\r
1220         static private function action_additem()\r
1221         {\r
1222                 global $manager, $CONF;\r
1223                 \r
1224                 $manager->loadClass('ITEM');\r
1225                 \r
1226                 $result = Item::createFromRequest();\r
1227                 \r
1228                 if ( $result['status'] == 'error' )\r
1229                 {\r
1230                         self::error($result['message']);\r
1231                 }\r
1232                 \r
1233                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1234                 $blog           =& $manager->getBlog($blogid);\r
1235                 $btimestamp     =  $blog->getCorrectTime();\r
1236                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1237                 \r
1238                 if ( $result['status'] == 'newcategory' )\r
1239                 {\r
1240                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1241                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1242                 }\r
1243                 else\r
1244                 {\r
1245                         $methodName = 'action_itemList';\r
1246                         call_user_func(array(&$this, $methodName), $blogid);\r
1247                 }\r
1248                 return;\r
1249         }\r
1250         \r
1251         /**\r
1252          * Admin::action_commentedit()\r
1253          * Allows to edit previously made comments\r
1254          * \r
1255          * @param       void\r
1256          * @return      void\r
1257          */\r
1258         static private function action_commentedit()\r
1259         {\r
1260                 global $member, $manager;\r
1261                 \r
1262                 $commentid = intRequestVar('commentid');\r
1263                 \r
1264                 $member->canAlterComment($commentid) or self::disallow();\r
1265                 \r
1266                 self::pagehead();\r
1267                 self::$skin->parse('commentedit');\r
1268                 self::pagefoot();\r
1269                 return;\r
1270         }\r
1271         \r
1272         /**\r
1273          * Admin::action_commentupdate()\r
1274          * \r
1275          * @param       void\r
1276          * @return      void\r
1277          */\r
1278         static private function action_commentupdate()\r
1279         {\r
1280                 global $member, $manager;\r
1281                 \r
1282                 $commentid = intRequestVar('commentid');\r
1283                 \r
1284                 $member->canAlterComment($commentid) or self::disallow();\r
1285                 \r
1286                 $url    = postVar('url');\r
1287                 $email  = postVar('email');\r
1288                 $body   = postVar('body');\r
1289                 \r
1290                 // intercept words that are too long\r
1291                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1292                 {\r
1293                         self::error(_ERROR_COMMENT_LONGWORD);\r
1294                 }\r
1295                 \r
1296                 // check length\r
1297                 if ( i18n::strlen($body) < 3 )\r
1298                 {\r
1299                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1300                 }\r
1301                 \r
1302                 if ( i18n::strlen($body) > 5000 )\r
1303                 {\r
1304                         self::error(_ERROR_COMMENT_TOOLONG);\r
1305                 }\r
1306                 \r
1307                 // prepare body\r
1308                 $body = Comment::prepareBody($body);\r
1309                 \r
1310                 // call plugins\r
1311                 $data = array(\r
1312                         'body' => &$body\r
1313                 );\r
1314                 $manager->notify('PreUpdateComment', $data);\r
1315                 \r
1316                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1317                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1318                 sql_query($query);\r
1319                 \r
1320                 // get itemid\r
1321                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1322                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1323                 \r
1324                 $res    = sql_query($query);\r
1325                 $o              = sql_fetch_object($res);\r
1326                 $itemid = $o->citem;\r
1327                 \r
1328                 if ( $member->canAlterItem($itemid) )\r
1329                 {\r
1330                         self::action_itemcommentlist($itemid);\r
1331                 }\r
1332                 else\r
1333                 {\r
1334                         self::action_browseowncomments();\r
1335                 }\r
1336                 return;\r
1337         }\r
1338         \r
1339         /**\r
1340          * Admin::action_commentdelete()\r
1341          * Update comment\r
1342          * \r
1343          * @param       void\r
1344          * @return      void\r
1345          */\r
1346         static private function action_commentdelete()\r
1347         {\r
1348                 global $member, $manager;\r
1349                 \r
1350                 $commentid = intRequestVar('commentid');\r
1351                 $member->canAlterComment($commentid) or self::disallow();\r
1352                 \r
1353                 self::pagehead();\r
1354                 self::$skin->parse('commentdelete');\r
1355                 self::pagefoot();\r
1356                 return;\r
1357         }\r
1358         \r
1359         /**\r
1360          * Admin::action_commentdeleteconfirm()\r
1361          * \r
1362          * @param       void\r
1363          * @return      void\r
1364          */\r
1365         static private function action_commentdeleteconfirm()\r
1366         {\r
1367                 global $member;\r
1368                 \r
1369                 $commentid = intRequestVar('commentid');\r
1370                 \r
1371                 // get item id first\r
1372                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1373                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1374                 \r
1375                 $res = sql_query($query);\r
1376                 $o = sql_fetch_object($res);\r
1377                 $itemid = $o->citem;\r
1378                 \r
1379                 $error = self::deleteOneComment($commentid);\r
1380                 if ( $error )\r
1381                 {\r
1382                         self::doError($error);\r
1383                 }\r
1384                 \r
1385                 if ( $member->canAlterItem($itemid) )\r
1386                 {\r
1387                         self::action_itemcommentlist($itemid);\r
1388                 }\r
1389                 else\r
1390                 {\r
1391                         self::action_browseowncomments();\r
1392                 }\r
1393                 return;\r
1394         }\r
1395         \r
1396         /**\r
1397          * Admin::deleteOneComment()\r
1398          * \r
1399          * @param       integer $commentid      ID for comment\r
1400          * @return      void\r
1401          */\r
1402         static private function deleteOneComment($commentid)\r
1403         {\r
1404                 global $member, $manager;\r
1405                 \r
1406                 $commentid = (integer) $commentid;\r
1407                 \r
1408                 if ( !$member->canAlterComment($commentid) )\r
1409                 {\r
1410                         return _ERROR_DISALLOWED;\r
1411                 }\r
1412                 \r
1413                 $data = array(\r
1414                         'commentid' => $commentid\r
1415                 );\r
1416                 \r
1417                 $manager->notify('PreDeleteComment', $data);\r
1418                 \r
1419                 // delete the comments associated with the item\r
1420                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1421                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1422                 sql_query($query);\r
1423                 \r
1424                 $data = array(\r
1425                         'commentid' => $commentid\r
1426                 );\r
1427                 \r
1428                 $manager->notify('PostDeleteComment', $data);\r
1429                 \r
1430                 return '';\r
1431         }\r
1432         \r
1433         /**\r
1434          * Admin::action_usermanagement()\r
1435          * Usermanagement main\r
1436          * \r
1437          * @param       void\r
1438          * @return      void\r
1439          */\r
1440         static private function action_usermanagement()\r
1441         {\r
1442                 global $member, $manager;\r
1443                 \r
1444                 // check if allowed\r
1445                 $member->isAdmin() or self::disallow();\r
1446                 \r
1447                 self::pagehead();\r
1448                 self::$skin->parse('usermanagement');\r
1449                 self::pagefoot();\r
1450                 return;\r
1451         }\r
1452         \r
1453         /**\r
1454          * Admin::action_memberedit()\r
1455          * Edit member settings\r
1456          * \r
1457          * @param       void\r
1458          * @return      void\r
1459          */\r
1460         static private function action_memberedit()\r
1461         {\r
1462                 self::action_editmembersettings(intRequestVar('memberid'));\r
1463                 return;\r
1464         }\r
1465         \r
1466         /**\r
1467          * Admin::action_editmembersettings()\r
1468          * \r
1469          * @param       integer $memberid       ID for member\r
1470          * @return      void\r
1471          * \r
1472          */\r
1473         static private function action_editmembersettings($memberid = '')\r
1474         {\r
1475                 global $member, $manager, $CONF;\r
1476                 \r
1477                 if ( $memberid == '' )\r
1478                 {\r
1479                         $memberid = $member->getID();\r
1480                 }\r
1481                 \r
1482                 /* TODO: we should consider to use the other way insterad of this */\r
1483                 $_REQUEST['memberid'] = $memberid;\r
1484                 \r
1485                 // check if allowed\r
1486                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1487                 \r
1488                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1489                 self::pagehead($extrahead);\r
1490                 self::$skin->parse('editmembersettings');\r
1491                 self::pagefoot();\r
1492                 return;\r
1493         }\r
1494         \r
1495         /**\r
1496          * Admin::action_changemembersettings()\r
1497          * \r
1498          * @param       void\r
1499          * @return      void\r
1500          */\r
1501         static private function action_changemembersettings()\r
1502         {\r
1503                 global $member, $CONF, $manager;\r
1504                 \r
1505                 $memberid = intRequestVar('memberid');\r
1506                 \r
1507                 // check if allowed\r
1508                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1509                 \r
1510                 $name                   = trim(strip_tags(postVar('name')));\r
1511                 $realname               = trim(strip_tags(postVar('realname')));\r
1512                 $password               = postVar('password');\r
1513                 $repeatpassword = postVar('repeatpassword');\r
1514                 $email                  = strip_tags(postVar('email'));\r
1515                 $url                    = strip_tags(postVar('url'));\r
1516                 $adminskin              = intPostVar('adminskin');\r
1517                 \r
1518                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1519                 if ( !preg_match('#^https?://#', $url) )\r
1520                 {\r
1521                         $url = 'http://' . $url;\r
1522                 }\r
1523                 \r
1524                 $admin          = postVar('admin');\r
1525                 $canlogin       = postVar('canlogin');\r
1526                 $notes          = strip_tags(postVar('notes'));\r
1527                 $locale         = postVar('locale');\r
1528                 \r
1529                 $mem = Member::createFromID($memberid);\r
1530                 \r
1531                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1532                 {\r
1533                         if ( !isValidDisplayName($name) )\r
1534                         {\r
1535                                 self::error(_ERROR_BADNAME);\r
1536                         }\r
1537                         \r
1538                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1539                         {\r
1540                                 self::error(_ERROR_NICKNAMEINUSE);\r
1541                         }\r
1542                         \r
1543                         if ( $password != $repeatpassword )\r
1544                         {\r
1545                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1546                         }\r
1547                         \r
1548                         if ( $password && (i18n::strlen($password) < 6) )\r
1549                         {\r
1550                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1551                         }\r
1552                                 \r
1553                         if ( $password )\r
1554                         {\r
1555                                 $pwdvalid = true;\r
1556                                 $pwderror = '';\r
1557                                 \r
1558                                 $data = array(\r
1559                                         'password'     => $password,\r
1560                                         'errormessage' => &$pwderror,\r
1561                                         'valid'        => &$pwdvalid\r
1562                                 );\r
1563                                 $manager->notify('PrePasswordSet', $data);\r
1564                                 \r
1565                                 if ( !$pwdvalid )\r
1566                                 {\r
1567                                         self::error($pwderror);\r
1568                                 }\r
1569                         }\r
1570                 }\r
1571                 \r
1572                 if ( !NOTIFICATION::address_validation($email) )\r
1573                 {\r
1574                         self::error(_ERROR_BADMAILADDRESS);\r
1575                 }\r
1576                 if ( !$realname )\r
1577                 {\r
1578                         self::error(_ERROR_REALNAMEMISSING);\r
1579                 }\r
1580                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1581                 {\r
1582                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1583                 }\r
1584                 \r
1585                 // check if there will remain at least one site member with both the logon and admin rights\r
1586                 // (check occurs when taking away one of these rights from such a member)\r
1587                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1588                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1589                         )\r
1590                 {\r
1591                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1592                         if ( sql_num_rows($r) < 2 )\r
1593                         {\r
1594                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1595                         }\r
1596                 }\r
1597                 \r
1598                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1599                 {\r
1600                         $mem->setDisplayName($name);\r
1601                         if ( $password )\r
1602                         {\r
1603                                 $mem->setPassword($password);\r
1604                         }\r
1605                 }\r
1606                 \r
1607                 $oldEmail = $mem->getEmail();\r
1608                 \r
1609                 $mem->setRealName($realname);\r
1610                 $mem->setEmail($email);\r
1611                 $mem->setURL($url);\r
1612                 $mem->setNotes($notes);\r
1613                 $mem->setLocale($locale);\r
1614                 \r
1615                 // only allow super-admins to make changes to the admin status\r
1616                 if ( $member->isAdmin() )\r
1617                 {\r
1618                         $mem->setAdmin($admin);\r
1619                         $mem->setCanLogin($canlogin);\r
1620                 }\r
1621                 \r
1622                 $autosave = postVar('autosave');\r
1623                 $mem->setAutosave($autosave);\r
1624                 \r
1625                 $mem->write();\r
1626                 \r
1627                 // store plugin options\r
1628                 $aOptions = requestArray('plugoption');\r
1629                 NucleusPlugin::apply_plugin_options($aOptions);\r
1630                 $data = array(\r
1631                         'context'  => 'member',\r
1632                         'memberid' => $memberid,\r
1633                         'member'   => &$mem\r
1634                 );\r
1635                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1636                 \r
1637                 // if email changed, generate new password\r
1638                 if ( $oldEmail != $mem->getEmail() )\r
1639                 {\r
1640                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1641                         // logout member\r
1642                         $mem->newCookieKey();\r
1643                         \r
1644                         // only log out if the member being edited is the current member.\r
1645                         if ( $member->getID() == $memberid )\r
1646                         {\r
1647                                 $member->logout();\r
1648                         }\r
1649                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1650                         return;\r
1651                 }\r
1652                 \r
1653                 if ( ($mem->getID() == $member->getID())\r
1654                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1655                 {\r
1656                         $mem->newCookieKey();\r
1657                         $member->logout();\r
1658                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1659                 }\r
1660                 else\r
1661                 {\r
1662                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1663                 }\r
1664                 return;\r
1665         }\r
1666 \r
1667         /**\r
1668          * Admin::action_memberadd()\r
1669          * \r
1670          * @param       void\r
1671          * @return      void\r
1672          * \r
1673          */\r
1674         static private function action_memberadd()\r
1675         {\r
1676                 global $member, $manager;\r
1677                 \r
1678                 // check if allowed\r
1679                 $member->isAdmin() or self::disallow();\r
1680                 \r
1681                 if ( postVar('password') != postVar('repeatpassword') )\r
1682                 {\r
1683                         self::error(_ERROR_PASSWORDMISMATCH);\r
1684                 }\r
1685                 \r
1686                 if ( i18n::strlen(postVar('password')) < 6 )\r
1687                 {\r
1688                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1689                 }\r
1690                 \r
1691                 $res = Member::create(\r
1692                         postVar('name'),\r
1693                         postVar('realname'),\r
1694                         postVar('password'),\r
1695                         postVar('email'),\r
1696                         postVar('url'),\r
1697                         postVar('admin'),\r
1698                         postVar('canlogin'),\r
1699                         postVar('notes')\r
1700                 );\r
1701                 \r
1702                 if ( $res != 1 )\r
1703                 {\r
1704                         self::error($res);\r
1705                 }\r
1706                 \r
1707                 // fire PostRegister event\r
1708                 $newmem = new Member();\r
1709                 $newmem->readFromName(postVar('name'));\r
1710                 $data = array(\r
1711                         'member' => &$newmem\r
1712                 );\r
1713                 $manager->notify('PostRegister', $data);\r
1714                 \r
1715                 self::action_usermanagement();\r
1716                 return;\r
1717         }\r
1718         \r
1719         /**\r
1720          * Admin::action_activate()\r
1721          * Account activation\r
1722          * \r
1723          * @param       void\r
1724          * @return      void\r
1725          */\r
1726         static private function action_activate()\r
1727         {\r
1728                 $key = getVar('key');\r
1729                 self::showActivationPage($key);\r
1730                 return;\r
1731         }\r
1732         \r
1733         /**\r
1734          * Admin::showActivationPage()\r
1735          * \r
1736          * @param       void\r
1737          * @return      void\r
1738          */\r
1739         static private function showActivationPage($key, $message = '')\r
1740         {\r
1741                 global $manager;\r
1742                 \r
1743                 // clean up old activation keys\r
1744                 Member::cleanupActivationTable();\r
1745                 \r
1746                 // get activation info\r
1747                 $info = Member::getActivationInfo($key);\r
1748                 \r
1749                 if ( !$info )\r
1750                 {\r
1751                         self::error(_ERROR_ACTIVATE);\r
1752                 }\r
1753                 \r
1754                 $mem = Member::createFromId($info->vmember);\r
1755                 \r
1756                 if ( !$mem )\r
1757                 {\r
1758                         self::error(_ERROR_ACTIVATE);\r
1759                 }\r
1760                 \r
1761                 /* TODO: we should consider to use the other way insterad of this */\r
1762                 $_POST['ackey']                                 = $key;\r
1763                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1764                 \r
1765                 self::$headMess = $message;\r
1766                 self::pagehead();\r
1767                 self::$skin->parse('activate');\r
1768                 self::pagefoot();\r
1769                 return;\r
1770         }\r
1771         \r
1772         /**\r
1773          * Admin::action_activatesetpwd()\r
1774          * Account activation - set password part\r
1775          * \r
1776          * @param       void\r
1777          * @return      void\r
1778          */\r
1779         static private function action_activatesetpwd()\r
1780         {\r
1781                 global $manager;\r
1782                 $key = postVar('key');\r
1783                 \r
1784                 // clean up old activation keys\r
1785                 Member::cleanupActivationTable();\r
1786                 \r
1787                 // get activation info\r
1788                 $info = Member::getActivationInfo($key);\r
1789                 \r
1790                 if ( !$info || ($info->type == 'addresschange') )\r
1791                 {\r
1792                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1793                 }\r
1794                 \r
1795                 $mem = Member::createFromId($info->vmember);\r
1796                 \r
1797                 if ( !$mem )\r
1798                 {\r
1799                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1800                 }\r
1801                 \r
1802                 $password               = postVar('password');\r
1803                 $repeatpassword = postVar('repeatpassword');\r
1804                 \r
1805                 if ( $password != $repeatpassword )\r
1806                 {\r
1807                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1808                 }\r
1809                 \r
1810                 if ( $password && (i18n::strlen($password) < 6) )\r
1811                 {\r
1812                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1813                 }\r
1814                         \r
1815                 if ( $password )\r
1816                 {\r
1817                         $pwdvalid = true;\r
1818                         $pwderror = '';\r
1819                         \r
1820                         $data = array(\r
1821                                 'password'              => $password,\r
1822                                 'errormessage'  => &$pwderror,\r
1823                                 'valid'                 => &$pwdvalid\r
1824                         );\r
1825                         $manager->notify('PrePasswordSet', $data);\r
1826                         if ( !$pwdvalid )\r
1827                         {\r
1828                                 return self::showActivationPage($key,$pwderror);\r
1829                         }\r
1830                 }\r
1831                 \r
1832                 $error = '';\r
1833                 \r
1834                 $data = array(\r
1835                         'type'   => 'activation',\r
1836                         'member' => $mem,\r
1837                         'error'  => &$error\r
1838                 );\r
1839                 $manager->notify('ValidateForm', $data);\r
1840                 if ( $error != '' )\r
1841                 {\r
1842                         return self::showActivationPage($key, $error);\r
1843                 }\r
1844                 \r
1845                 // set password\r
1846                 $mem->setPassword($password);\r
1847                 $mem->write();\r
1848                 \r
1849                 // do the activation\r
1850                 Member::activate($key);\r
1851                 \r
1852                 self::pagehead();\r
1853                 self::$skin->parse('activatesetpwd');\r
1854                 self::pagefoot();\r
1855                 return;\r
1856         }\r
1857         \r
1858         /**\r
1859          * Admin::action_manageteam()\r
1860          * Manage team\r
1861          * \r
1862          * @param       void\r
1863          * @return      void\r
1864          */\r
1865         static private function action_manageteam()\r
1866         {\r
1867                 global $member, $manager;\r
1868                 \r
1869                 $blogid = intRequestVar('blogid');\r
1870                 \r
1871                 // check if allowed\r
1872                 $member->blogAdminRights($blogid) or self::disallow();\r
1873                 \r
1874                 self::pagehead();\r
1875                 self::$skin->parse('manageteam');\r
1876                 self::pagefoot();\r
1877                 return;\r
1878         }\r
1879         \r
1880         /**\r
1881          * Admin::action_teamaddmember()\r
1882          * Add member to team\r
1883          * \r
1884          * @param       void\r
1885          * @return      void\r
1886          */\r
1887         static private function action_teamaddmember()\r
1888         {\r
1889                 global $member, $manager;\r
1890                 \r
1891                 $memberid       = intPostVar('memberid');\r
1892                 $blogid         = intPostVar('blogid');\r
1893                 $admin          = intPostVar('admin');\r
1894                 \r
1895                 // check if allowed\r
1896                 $member->blogAdminRights($blogid) or self::disallow();\r
1897                 \r
1898                 $blog =& $manager->getBlog($blogid);\r
1899                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1900                 {\r
1901                         self::error(_ERROR_ALREADYONTEAM);\r
1902                 }\r
1903                 \r
1904                 self::action_manageteam();\r
1905                 return;\r
1906         }\r
1907         \r
1908         /**\r
1909          * Admin::action_teamdelete()\r
1910          * \r
1911          * @param       void\r
1912          * @return      void\r
1913          */\r
1914         static private function action_teamdelete()\r
1915         {\r
1916                 global $member, $manager;\r
1917                 \r
1918                 $memberid       = intRequestVar('memberid');\r
1919                 $blogid         = intRequestVar('blogid');\r
1920                 \r
1921                 // check if allowed\r
1922                 $member->blogAdminRights($blogid) or self::disallow();\r
1923                 \r
1924                 $teammem =  Member::createFromID($memberid);\r
1925                 $blog =& $manager->getBlog($blogid);\r
1926                 \r
1927                 self::pagehead();\r
1928                 self::$skin->parse('teamdelete');\r
1929                 self::pagefoot();\r
1930                 return;\r
1931         }\r
1932         \r
1933         /**\r
1934          * Admin::action_teamdeleteconfirm()\r
1935          * \r
1936          * @param       void\r
1937          * @return      void\r
1938          */\r
1939         static private function action_teamdeleteconfirm()\r
1940         {\r
1941                 global $member;\r
1942                 \r
1943                 $memberid = intRequestVar('memberid');\r
1944                 $blogid = intRequestVar('blogid');\r
1945                 \r
1946                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1947                 if ( $error )\r
1948                 {\r
1949                         self::error($error);\r
1950                 }\r
1951                 self::action_manageteam();\r
1952                 return;\r
1953         }\r
1954         \r
1955         /**\r
1956          * Admin::deleteOneTeamMember()\r
1957          * \r
1958          * @param       void\r
1959          * @return      void\r
1960          */\r
1961         static private function deleteOneTeamMember($blogid, $memberid)\r
1962         {\r
1963                 global $member, $manager;\r
1964                 \r
1965                 $blogid   = intval($blogid);\r
1966                 $memberid = intval($memberid);\r
1967                 \r
1968                 // check if allowed\r
1969                 if ( !$member->blogAdminRights($blogid) )\r
1970                 {\r
1971                         return _ERROR_DISALLOWED;\r
1972                 }\r
1973                 \r
1974                 // check if: - there remains at least one blog admin\r
1975                 //           - (there remains at least one team member)\r
1976                 $tmem = Member::createFromID($memberid);\r
1977                 \r
1978                 \r
1979                 $data = array(\r
1980                         'member' => &$tmem,\r
1981                         'blogid' => $blogid\r
1982                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1983                 \r
1984                 if ( $tmem->isBlogAdmin($blogid) )\r
1985                 {\r
1986                         /* TODO: why we did double check? */\r
1987                         // check if there are more blog members left and at least one admin\r
1988                         // (check for at least two admins before deletion)\r
1989                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1990                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1991                         $r     = sql_query($query);\r
1992                         if ( sql_num_rows($r) < 2 )\r
1993                         {\r
1994                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1995                         }\r
1996                 }\r
1997                 \r
1998                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1999                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
2000                 sql_query($query);\r
2001                 \r
2002                 $data = array(\r
2003                         'member' => &$tmem,\r
2004                         'blogid' => $blogid\r
2005                 );\r
2006                 $manager->notify('PostDeleteTeamMember', $data);\r
2007                 \r
2008                 return '';\r
2009         }\r
2010         \r
2011         /**\r
2012          * Admin::action_teamchangeadmin()\r
2013          * \r
2014          * @param       void\r
2015          * @return      void\r
2016          */\r
2017         static private function action_teamchangeadmin()\r
2018         {\r
2019                 global $member;\r
2020                 \r
2021                 $blogid         = intRequestVar('blogid');\r
2022                 $memberid       = intRequestVar('memberid');\r
2023                 \r
2024                 // check if allowed\r
2025                 $member->blogAdminRights($blogid) or self::disallow();\r
2026                 \r
2027                 $mem = Member::createFromID($memberid);\r
2028                 \r
2029                 // don't allow when there is only one admin at this moment\r
2030                 if ( $mem->isBlogAdmin($blogid) )\r
2031                 {\r
2032                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2033                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2034                         $r = sql_query($query);\r
2035                         if ( sql_num_rows($r) == 1 )\r
2036                         {\r
2037                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2038                         }\r
2039                 }\r
2040                 \r
2041                 if ( $mem->isBlogAdmin($blogid) )\r
2042                 {\r
2043                         $newval = 0;\r
2044                 }\r
2045                 else\r
2046                 {\r
2047                         $newval = 1;\r
2048                 }\r
2049                 \r
2050                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2051                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2052                 sql_query($query);\r
2053                 \r
2054                 // only show manageteam if member did not change its own admin privileges\r
2055                 if ( $member->isBlogAdmin($blogid) )\r
2056                 {\r
2057                         self::action_manageteam();\r
2058                 }\r
2059                 else\r
2060                 {\r
2061                         self::action_overview(_MSG_ADMINCHANGED);\r
2062                 }\r
2063                 return;\r
2064         }\r
2065         \r
2066         /**\r
2067          * Admin::action_blogsettings()\r
2068          * \r
2069          * @param       void\r
2070          * @return      void\r
2071          */\r
2072         static private function action_blogsettings()\r
2073         {\r
2074                 global $member, $manager;\r
2075                 \r
2076                 $blogid = intRequestVar('blogid');\r
2077                 \r
2078                 // check if allowed\r
2079                 $member->blogAdminRights($blogid) or self::disallow();\r
2080                 \r
2081                 $blog =& $manager->getBlog($blogid);\r
2082                 \r
2083                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2084                 self::pagehead($extrahead);\r
2085                 self::$skin->parse('blogsettings');\r
2086                 self::pagefoot();\r
2087                 return;\r
2088         }\r
2089         \r
2090         /**\r
2091          * Admin::action_categorynew()\r
2092          * \r
2093          * @param       void\r
2094          * @return      void\r
2095          */\r
2096         static private function action_categorynew()\r
2097         {\r
2098                 global $member, $manager;\r
2099                 \r
2100                 $blogid = intRequestVar('blogid');\r
2101                 \r
2102                 $member->blogAdminRights($blogid) or self::disallow();\r
2103                 \r
2104                 $cname = postVar('cname');\r
2105                 $cdesc = postVar('cdesc');\r
2106                 \r
2107                 if ( !isValidCategoryName($cname) )\r
2108                 {\r
2109                         self::error(_ERROR_BADCATEGORYNAME);\r
2110                 }\r
2111                 \r
2112                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2113                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2114                 $res = sql_query($query);\r
2115                 if ( sql_num_rows($res) > 0 )\r
2116                 {\r
2117                         self::error(_ERROR_DUPCATEGORYNAME);\r
2118                 }\r
2119                 \r
2120                 $blog           =& $manager->getBlog($blogid);\r
2121                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2122                 \r
2123                 self::action_blogsettings();\r
2124                 return;\r
2125         }\r
2126         \r
2127         /**\r
2128          * Admin::action_categoryedit()\r
2129          * \r
2130          * @param       void\r
2131          * @return      void\r
2132          */\r
2133         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2134         {\r
2135                 global $member, $manager;\r
2136                 \r
2137                 if ( $blogid == '' )\r
2138                 {\r
2139                         $blogid = intGetVar('blogid');\r
2140                 }\r
2141                 else\r
2142                 {\r
2143                         $blogid = intval($blogid);\r
2144                 }\r
2145                 if ( $catid == '' )\r
2146                 {\r
2147                         $catid = intGetVar('catid');\r
2148                 }\r
2149                 else\r
2150                 {\r
2151                         $catid = intval($catid);\r
2152                 }\r
2153                 \r
2154                 /* TODO: we should consider to use the other way insterad of this */\r
2155                 $_REQUEST['blogid']             = $blogid;\r
2156                 $_REQUEST['catid']              = $catid;\r
2157                 $_REQUEST['desturl']    = $desturl;\r
2158                 $member->blogAdminRights($blogid) or self::disallow();\r
2159                 \r
2160                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2161                 self::pagehead($extrahead);\r
2162                 self::$skin->parse('categoryedit');\r
2163                 self::pagefoot();\r
2164                 return;\r
2165         }\r
2166         \r
2167         /**\r
2168          * Admin::action_categoryupdate()\r
2169          * \r
2170          * @param       void\r
2171          * @return      void\r
2172          */\r
2173         static private function action_categoryupdate()\r
2174         {\r
2175                 global $member, $manager;\r
2176                 \r
2177                 $blogid         = intPostVar('blogid');\r
2178                 $catid          = intPostVar('catid');\r
2179                 $cname          = postVar('cname');\r
2180                 $cdesc          = postVar('cdesc');\r
2181                 $desturl        = postVar('desturl');\r
2182                 \r
2183                 $member->blogAdminRights($blogid) or self::disallow();\r
2184                 \r
2185                 if ( !isValidCategoryName($cname) )\r
2186                 {\r
2187                         self::error(_ERROR_BADCATEGORYNAME);\r
2188                 }\r
2189                 \r
2190                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2191                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2192                 $res    = sql_query($query);\r
2193                 if ( sql_num_rows($res) > 0 )\r
2194                 {\r
2195                         self::error(_ERROR_DUPCATEGORYNAME);\r
2196                 }\r
2197                 \r
2198                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2199                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2200                 sql_query($query);\r
2201                 \r
2202                 // store plugin options\r
2203                 $aOptions = requestArray('plugoption');\r
2204                 NucleusPlugin::apply_plugin_options($aOptions);\r
2205                 $data = array(\r
2206                         'context'       => 'category',\r
2207                         'catid'         => $catid\r
2208                 );\r
2209                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2210                 \r
2211                 if ( $desturl )\r
2212                 {\r
2213                         redirect($desturl);\r
2214                         exit;\r
2215                 }\r
2216                 else\r
2217                 {\r
2218                         self::action_blogsettings();\r
2219                 }\r
2220                 return;\r
2221         }\r
2222         \r
2223         /**\r
2224          * Admin::action_categorydelete()\r
2225          * \r
2226          * @param       void\r
2227          * @return      void\r
2228          */\r
2229         static private function action_categorydelete()\r
2230         {\r
2231                 global $member, $manager;\r
2232                 \r
2233                 $blogid = intRequestVar('blogid');\r
2234                 $catid  = intRequestVar('catid');\r
2235                 \r
2236                 $member->blogAdminRights($blogid) or self::disallow();\r
2237                 \r
2238                 $blog =& $manager->getBlog($blogid);\r
2239                 \r
2240                 // check if the category is valid\r
2241                 if ( !$blog->isValidCategory($catid) )\r
2242                 {\r
2243                         self::error(_ERROR_NOSUCHCATEGORY);\r
2244                 }\r
2245                 \r
2246                 // don't allow deletion of default category\r
2247                 if ( $blog->getDefaultCategory() == $catid )\r
2248                 {\r
2249                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2250                 }\r
2251                 \r
2252                 // check if catid is the only category left for blogid\r
2253                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2254                 $query = sprintf($query, sql_table('category'), $blogid);\r
2255                 $res = sql_query($query);\r
2256                 if ( sql_num_rows($res) == 1 )\r
2257                 {\r
2258                         self::error(_ERROR_DELETELASTCATEGORY);\r
2259                 }\r
2260                 \r
2261                 self::pagehead();\r
2262                 self::$skin->parse('categorydelete');\r
2263                 self::pagefoot();\r
2264                 return;\r
2265         }\r
2266         \r
2267         /**\r
2268          * Admin::action_categorydeleteconfirm()\r
2269          * \r
2270          * @param       void\r
2271          * @return      void\r
2272          */\r
2273         static private function action_categorydeleteconfirm()\r
2274         {\r
2275                 global $member, $manager;\r
2276                 \r
2277                 $blogid = intRequestVar('blogid');\r
2278                 $catid  = intRequestVar('catid');\r
2279                 \r
2280                 $member->blogAdminRights($blogid) or self::disallow();\r
2281                 \r
2282                 $error = self::deleteOneCategory($catid);\r
2283                 if ( $error )\r
2284                 {\r
2285                         self::error($error);\r
2286                 }\r
2287                 \r
2288                 self::action_blogsettings();\r
2289                 return;\r
2290         }\r
2291         \r
2292         /**\r
2293          * Admin::deleteOneCategory()\r
2294          * Delete a category by its id\r
2295          * \r
2296          * @param       String  $catid  category id for deleting\r
2297          * @return      Void\r
2298          */\r
2299         static private function deleteOneCategory($catid)\r
2300         {\r
2301                 global $manager, $member;\r
2302                 \r
2303                 $catid  = intval($catid);\r
2304                 $blogid = getBlogIDFromCatID($catid);\r
2305                 \r
2306                 if ( !$member->blogAdminRights($blogid) )\r
2307                 {\r
2308                         return ERROR_DISALLOWED;\r
2309                 }\r
2310                 \r
2311                 // get blog\r
2312                 $blog =& $manager->getBlog($blogid);\r
2313                 \r
2314                 // check if the category is valid\r
2315                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2316                 {\r
2317                         return _ERROR_NOSUCHCATEGORY;\r
2318                 }\r
2319                 \r
2320                 $destcatid = $blog->getDefaultCategory();\r
2321                 \r
2322                 // don't allow deletion of default category\r
2323                 if ( $blog->getDefaultCategory() == $catid )\r
2324                 {\r
2325                         return _ERROR_DELETEDEFCATEGORY;\r
2326                 }\r
2327                 \r
2328                 // check if catid is the only category left for blogid\r
2329                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2330                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2331                 \r
2332                 $res = sql_query($query);\r
2333                 if ( sql_num_rows($res) == 1 )\r
2334                 {\r
2335                         return _ERROR_DELETELASTCATEGORY;\r
2336                 }\r
2337                 \r
2338                 $data = array('catid' => $catid);\r
2339                 $manager->notify('PreDeleteCategory', $data);\r
2340                 \r
2341                 // change category for all items to the default category\r
2342                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2343                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2344                 sql_query($query);\r
2345                 \r
2346                 // delete all associated plugin options\r
2347                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2348                 \r
2349                 // delete category\r
2350                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2351                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2352                 sql_query($query);\r
2353                 \r
2354                 $data = array('catid' => $catid);\r
2355                 $manager->notify('PostDeleteCategory', $data);\r
2356                 return;\r
2357         }\r
2358         \r
2359         /**\r
2360          * Admin::action_blogsettingsupdate\r
2361          * Updating blog settings\r
2362          * \r
2363          * @param       Void\r
2364          * @return      Void\r
2365          */\r
2366         static private function action_blogsettingsupdate()\r
2367         {\r
2368                 global $member, $manager;\r
2369                 \r
2370                 $blogid = intRequestVar('blogid');\r
2371                 \r
2372                 $member->blogAdminRights($blogid) or self::disallow();\r
2373                 \r
2374                 $blog =& $manager->getBlog($blogid);\r
2375                 \r
2376                 $notify_address = trim(postVar('notify'));\r
2377                 $shortname              = trim(postVar('shortname'));\r
2378                 $updatefile             = trim(postVar('update'));\r
2379                 \r
2380                 $notifyComment  = intPostVar('notifyComment');\r
2381                 $notifyVote             = intPostVar('notifyVote');\r
2382                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2383                 \r
2384                 if ( $notifyComment == 0 )\r
2385                 {\r
2386                         $notifyComment = 1;\r
2387                 }\r
2388                 if ( $notifyVote == 0 )\r
2389                 {\r
2390                         $notifyVote = 1;\r
2391                 }\r
2392                 if ( $notifyNewItem == 0 )\r
2393                 {\r
2394                         $notifyNewItem = 1;\r
2395                 }\r
2396                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2397                 \r
2398                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2399                 {\r
2400                         self::error(_ERROR_BADNOTIFY);\r
2401                 }\r
2402                 \r
2403                 if ( !isValidShortName($shortname) )\r
2404                 {\r
2405                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2406                 }\r
2407                 \r
2408                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2409                 {\r
2410                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2411                 }\r
2412                 // check if update file is writable\r
2413                 if ( $updatefile && !is_writeable($updatefile) )\r
2414                 {\r
2415                         self::error(_ERROR_UPDATEFILE);\r
2416                 }\r
2417                 \r
2418                 $blog->setName(trim(postVar('name')));\r
2419                 $blog->setShortName($shortname);\r
2420                 $blog->setNotifyAddress($notify_address);\r
2421                 $blog->setNotifyType($notifyType);\r
2422                 $blog->setMaxComments(postVar('maxcomments'));\r
2423                 $blog->setCommentsEnabled(postVar('comments'));\r
2424                 $blog->setTimeOffset(postVar('timeoffset'));\r
2425                 $blog->setUpdateFile($updatefile);\r
2426                 $blog->setURL(trim(postVar('url')));\r
2427                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2428                 $blog->setDescription(trim(postVar('desc')));\r
2429                 $blog->setPublic(postVar('public'));\r
2430                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2431                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2432                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2433                 $blog->setSearchable(intPostVar('searchable'));\r
2434                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2435                 $blog->writeSettings();\r
2436                 \r
2437                 // store plugin options\r
2438                 $aOptions = requestArray('plugoption');\r
2439                 NucleusPlugin::apply_plugin_options($aOptions);\r
2440                 \r
2441                 $data = array(\r
2442                         'context' => 'blog',\r
2443                         'blogid'  => $blogid,\r
2444                         'blog'    => &$blog\r
2445                 );\r
2446                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2447                 \r
2448                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2449                 return;\r
2450         }\r
2451         \r
2452         /**\r
2453          * Admin::action_deleteblog()\r
2454          * \r
2455          * @param       void\r
2456          * @return      void\r
2457          */\r
2458         static private function action_deleteblog()\r
2459         {\r
2460                 global $member, $CONF, $manager;\r
2461                 \r
2462                 $blogid = intRequestVar('blogid');\r
2463                 \r
2464                 $member->blogAdminRights($blogid) or self::disallow();\r
2465                 \r
2466                 // check if blog is default blog\r
2467                 if ( $CONF['DefaultBlog'] == $blogid )\r
2468                 {\r
2469                         self::error(_ERROR_DELDEFBLOG);\r
2470                 }\r
2471                 \r
2472                 $blog =& $manager->getBlog($blogid);\r
2473                 \r
2474                 self::pagehead();\r
2475                 self::$skin->parse('deleteblog');\r
2476                 self::pagefoot();\r
2477                 return;\r
2478         }\r
2479         \r
2480         /**\r
2481          * Admin::action_deleteblogconfirm()\r
2482          * Delete Blog\r
2483          * \r
2484          * @param       Void\r
2485          * @return      Void\r
2486          */\r
2487         static private function action_deleteblogconfirm()\r
2488         {\r
2489                 global $member, $CONF, $manager;\r
2490                 \r
2491                 $blogid = intRequestVar('blogid');\r
2492                 \r
2493                 $data = array('blogid' => $blogid);\r
2494                 $manager->notify('PreDeleteBlog', $data);\r
2495                 \r
2496                 $member->blogAdminRights($blogid) or self::disallow();\r
2497                 \r
2498                 // check if blog is default blog\r
2499                 if ( $CONF['DefaultBlog'] == $blogid )\r
2500                 {\r
2501                         self::error(_ERROR_DELDEFBLOG);\r
2502                 }\r
2503                 \r
2504                 // delete all comments\r
2505                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2506                 sql_query($query);\r
2507                 \r
2508                 // delete all items\r
2509                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2510                 sql_query($query);\r
2511                 \r
2512                 // delete all team members\r
2513                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2514                 sql_query($query);\r
2515                 \r
2516                 // delete all bans\r
2517                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2518                 sql_query($query);\r
2519                 \r
2520                 // delete all categories\r
2521                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2522                 sql_query($query);\r
2523                 \r
2524                 // delete all associated plugin options\r
2525                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2526                 \r
2527                 // delete the blog itself\r
2528                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2529                 sql_query($query);\r
2530                 \r
2531                 $data = array('blogid' => $blogid);\r
2532                 $manager->notify('PostDeleteBlog', $data);\r
2533                 \r
2534                 self::action_overview(_DELETED_BLOG);\r
2535                 return;\r
2536         }\r
2537         \r
2538         /**\r
2539          * Admin::action_memberdelete()\r
2540          * \r
2541          * @param       void\r
2542          * @return      void\r
2543          */\r
2544         static private function action_memberdelete()\r
2545         {\r
2546                 global $member, $manager;\r
2547                 \r
2548                 $memberid = intRequestVar('memberid');\r
2549                 \r
2550                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2551                 \r
2552                 $mem = Member::createFromID($memberid);\r
2553                 \r
2554                 self::pagehead();\r
2555                 self::$skin->parse('memberdelete');\r
2556                 self::pagefoot();\r
2557                 return;\r
2558         }\r
2559         \r
2560         /**\r
2561          * Admin::action_memberdeleteconfirm()\r
2562          * \r
2563          * @param       void\r
2564          * @return      void\r
2565          */\r
2566         static private function action_memberdeleteconfirm()\r
2567         {\r
2568                 global $member;\r
2569                 \r
2570                 $memberid = intRequestVar('memberid');\r
2571                 \r
2572                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2573                 \r
2574                 $error = self::deleteOneMember($memberid);\r
2575                 if ( $error )\r
2576                 {\r
2577                         self::error($error);\r
2578                 }\r
2579                 \r
2580                 if ( $member->isAdmin() )\r
2581                 {\r
2582                         self::action_usermanagement();\r
2583                 }\r
2584                 else\r
2585                 {\r
2586                         self::action_overview(_DELETED_MEMBER);\r
2587                 }\r
2588                 return;\r
2589         }\r
2590         \r
2591         /**\r
2592          * Admin::deleteOneMember()\r
2593          * Delete a member by id\r
2594          * \r
2595          * @static\r
2596          * @params      Integer $memberid       member id\r
2597          * @return      String  null string or error messages\r
2598          */\r
2599         static private function deleteOneMember($memberid)\r
2600         {\r
2601                 global $manager;\r
2602                 \r
2603                 $memberid = intval($memberid);\r
2604                 $mem = Member::createFromID($memberid);\r
2605                 \r
2606                 if ( !$mem->canBeDeleted() )\r
2607                 {\r
2608                         return _ERROR_DELETEMEMBER;\r
2609                 }\r
2610                 \r
2611                 $data = array('member' => &$mem);\r
2612                 $manager->notify('PreDeleteMember', $data);\r
2613                 \r
2614                 /* unlink comments from memberid */\r
2615                 if ( $memberid )\r
2616                 {\r
2617                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2618                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2619                         sql_query($query);\r
2620                 }\r
2621                 \r
2622                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2623                 sql_query($query);\r
2624                 \r
2625                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2626                 sql_query($query);\r
2627                 \r
2628                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2629                 sql_query($query);\r
2630                 \r
2631                 // delete all associated plugin options\r
2632                 NucleusPlugin::delete_option_values('member', $memberid);\r
2633                 \r
2634                 $data = array('member' => &$mem);\r
2635                 $manager->notify('PostDeleteMember', $data);\r
2636                 \r
2637                 return '';\r
2638         }\r
2639         \r
2640         /**\r
2641          * Admin::action_createnewlog()\r
2642          * \r
2643          * @param       void\r
2644          * @return      void\r
2645          */\r
2646         static private function action_createnewlog()\r
2647         {\r
2648                 global $member, $CONF, $manager;\r
2649                 \r
2650                 // Only Super-Admins can do this\r
2651                 $member->isAdmin() or self::disallow();\r
2652                 \r
2653                 self::pagehead();\r
2654                 self::$skin->parse('createnewlog');\r
2655                 self::pagefoot();\r
2656                 return;\r
2657         }\r
2658         \r
2659         /**\r
2660          * Admin::action_addnewlog()\r
2661          * \r
2662          * @param       void\r
2663          * @return      void\r
2664          */\r
2665         static private function action_addnewlog()\r
2666         {\r
2667                 global $member, $manager, $CONF;\r
2668                 \r
2669                 // Only Super-Admins can do this\r
2670                 $member->isAdmin() or self::disallow();\r
2671                 \r
2672                 $bname                  = trim(postVar('name'));\r
2673                 $bshortname             = trim(postVar('shortname'));\r
2674                 $btimeoffset    = postVar('timeoffset');\r
2675                 $bdesc                  = trim(postVar('desc'));\r
2676                 $bdefskin               = postVar('defskin');\r
2677                 \r
2678                 if ( !isValidShortName($bshortname) )\r
2679                 {\r
2680                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2681                 }\r
2682                 \r
2683                 if ( $manager->existsBlog($bshortname) )\r
2684                 {\r
2685                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2686                 }\r
2687                 \r
2688                 $data = array(\r
2689                         'name'        => &$bname,\r
2690                         'shortname'   => &$bshortname,\r
2691                         'timeoffset'  => &$btimeoffset,\r
2692                         'description' => &$bdesc,\r
2693                         'defaultskin' => &$bdefskin\r
2694                 );\r
2695                 $manager->notify('PreAddBlog', $data);\r
2696                 \r
2697                 // add slashes for sql queries\r
2698                 $bname                  = sql_real_escape_string($bname);\r
2699                 $bshortname             = sql_real_escape_string($bshortname);\r
2700                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2701                 $bdesc                  = sql_real_escape_string($bdesc);\r
2702                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2703                 \r
2704                 // create blog\r
2705                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2706                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2707                 sql_query($query);\r
2708                 \r
2709                 $blogid =  sql_insert_id();\r
2710                 $blog   =& $manager->getBlog($blogid);\r
2711                 \r
2712                 // create new category\r
2713                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2714                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2715                 \r
2716                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2717                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2718                 $catid = sql_insert_id();\r
2719                 \r
2720                 // set as default category\r
2721                 $blog->setDefaultCategory($catid);\r
2722                 $blog->writeSettings();\r
2723                 \r
2724                 // create team member\r
2725                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2726                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2727                 sql_query($query);\r
2728                 \r
2729                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2730                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2731                 \r
2732                 $blog->additem(\r
2733                         $blog->getDefaultCategory(),\r
2734                         $itemdeftitle,$itemdefbody,\r
2735                         '',\r
2736                         $blogid,\r
2737                         $member->getID(),\r
2738                         $blog->getCorrectTime(),\r
2739                         0,\r
2740                         0,\r
2741                         0\r
2742                 );\r
2743                 \r
2744                 $data = array('blog' => &$blog);\r
2745                 $manager->notify('PostAddBlog', $data);\r
2746                 \r
2747                 $data = array(\r
2748                         'blog'                  => &$blog,\r
2749                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2750                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2751                         'catid'                 => $catid\r
2752                 );\r
2753                 $manager->notify('PostAddCategory', $data);\r
2754                 \r
2755                 /* TODO: we should consider to use the other way insterad of this */\r
2756                 $_REQUEST['blogid'] = $blogid;\r
2757                 $_REQUEST['catid']  = $catid;\r
2758                 self::pagehead();\r
2759                 self::$skin->parse('addnewlog');\r
2760                 self::pagefoot();\r
2761                 return;\r
2762         }\r
2763         \r
2764         /**\r
2765          * Admin::action_addnewlog2()\r
2766          * \r
2767          * @param       void\r
2768          * @return      void\r
2769          */\r
2770         static private function action_addnewlog2()\r
2771         {\r
2772                 global $member, $manager;\r
2773                 $blogid = intRequestVar('blogid');\r
2774                 \r
2775                 $member->blogAdminRights($blogid) or self::disallow();\r
2776                 \r
2777                 $burl = requestVar('url');\r
2778                 \r
2779                 $blog =& $manager->getBlog($blogid);\r
2780                 $blog->setURL(trim($burl));\r
2781                 $blog->writeSettings();\r
2782                 \r
2783                 self::action_overview(_MSG_NEWBLOG);\r
2784                 return;\r
2785         }\r
2786         \r
2787         /**\r
2788          * Admin::action_skinieoverview()\r
2789          * \r
2790          * @param       void\r
2791          * @return      void\r
2792          */\r
2793         static private function action_skinieoverview()\r
2794         {\r
2795                 global $member, $DIR_LIBS, $manager;\r
2796                 \r
2797                 $member->isAdmin() or self::disallow();\r
2798                 \r
2799                 include_once($DIR_LIBS . 'skinie.php');\r
2800                 \r
2801                 self::pagehead();\r
2802                 self::$skin->parse('skinieoverview');\r
2803                 self::pagefoot();\r
2804                 return;\r
2805         }\r
2806         \r
2807         /**\r
2808          * Admin::action_skinieimport()\r
2809          * \r
2810          * @param       void\r
2811          * @return      void\r
2812          */\r
2813         static private function action_skinieimport()\r
2814         {\r
2815                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2816                 \r
2817                 $member->isAdmin() or self::disallow();\r
2818                 \r
2819                 // load skinie class\r
2820                 include_once($DIR_LIBS . 'skinie.php');\r
2821                 \r
2822                 $skinFileRaw    = postVar('skinfile');\r
2823                 $mode                   = postVar('mode');\r
2824                 \r
2825                 $importer = new SkinImport();\r
2826                 \r
2827                 // get full filename\r
2828                 if ( $mode == 'file' )\r
2829                 {\r
2830                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2831                         \r
2832                         /* TODO: remove this\r
2833                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2834                         if ( !file_exists($skinFile) )\r
2835                         {\r
2836                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2837                         }\r
2838                          */\r
2839                 }\r
2840                 else\r
2841                 {\r
2842                         $skinFile = $skinFileRaw;\r
2843                 }\r
2844                 \r
2845                 // read only metadata\r
2846                 $error = $importer->readFile($skinFile, 1);\r
2847                 \r
2848                 /* TODO: we should consider to use the other way insterad of this */\r
2849                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2850                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2851                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2852                 \r
2853                 // clashes\r
2854                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2855                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2856                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2857                 \r
2858                 /* TODO: we should consider to use the other way insterad of this */\r
2859                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2860                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2861                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2862                 \r
2863                 if ( $error )\r
2864                 {\r
2865                         self::error($error);\r
2866                 }\r
2867                 \r
2868                 self::pagehead();\r
2869                 self::$skin->parse('skinieimport');\r
2870                 self::pagefoot();\r
2871                 return;\r
2872         }\r
2873         \r
2874         /**\r
2875          * Admin::action_skiniedoimport()\r
2876          * \r
2877          * @param       void\r
2878          * @return      void\r
2879          */\r
2880         static private function action_skiniedoimport()\r
2881         {\r
2882                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2883                 \r
2884                 $member->isAdmin() or self::disallow();\r
2885                 \r
2886                 // load skinie class\r
2887                 include_once($DIR_LIBS . 'skinie.php');\r
2888                 \r
2889                 $skinFileRaw    = postVar('skinfile');\r
2890                 $mode                   = postVar('mode');\r
2891                 \r
2892                 $allowOverwrite = intPostVar('overwrite');\r
2893                 \r
2894                 // get full filename\r
2895                 if ( $mode == 'file' )\r
2896                 {\r
2897                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2898                         \r
2899                         /* TODO: remove this\r
2900                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2901                         if ( !file_exists($skinFile) )\r
2902                         {\r
2903                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2904                         }\r
2905                         */\r
2906                 }\r
2907                 else\r
2908                 {\r
2909                         $skinFile = $skinFileRaw;\r
2910                 }\r
2911                 \r
2912                 $importer = new SkinImport();\r
2913                 \r
2914                 $error = $importer->readFile($skinFile);\r
2915                 \r
2916                 if ( $error )\r
2917                 {\r
2918                         self::error($error);\r
2919                 }\r
2920                 \r
2921                 $error = $importer->writeToDatabase($allowOverwrite);\r
2922                 \r
2923                 if ( $error )\r
2924                 {\r
2925                         self::error($error);\r
2926                 }\r
2927                 \r
2928                 /* TODO: we should consider to use the other way insterad of this */\r
2929                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2930                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2931                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2932                 \r
2933                 self::pagehead();\r
2934                 self::$skin->parse('skiniedoimport');\r
2935                 self::pagefoot();\r
2936                 return;\r
2937         }\r
2938 \r
2939         /**\r
2940          * Admin::action_skinieexport()\r
2941          * \r
2942          * @param       void\r
2943          * @return      void\r
2944          */\r
2945         static private function action_skinieexport()\r
2946         {\r
2947                 global $member, $DIR_LIBS;\r
2948                 \r
2949                 $member->isAdmin() or self::disallow();\r
2950                 \r
2951                 // load skinie class\r
2952                 include_once($DIR_LIBS . 'skinie.php');\r
2953                 \r
2954                 $aSkins         = requestIntArray('skin');\r
2955                 $aTemplates     = requestIntArray('template');\r
2956                 \r
2957                 if ( !is_array($aTemplates) )\r
2958                 {\r
2959                         $aTemplates = array();\r
2960                 }\r
2961                 if ( !is_array($aSkins) )\r
2962                 {\r
2963                         $aSkins = array();\r
2964                 }\r
2965                 \r
2966                 $skinList               = array_keys($aSkins);\r
2967                 $templateList   = array_keys($aTemplates);\r
2968                 \r
2969                 $info = postVar('info');\r
2970                 \r
2971                 $exporter = new SkinExport();\r
2972                 foreach ( $skinList as $skinId )\r
2973                 {\r
2974                         $exporter->addSkin($skinId);\r
2975                 }\r
2976                 foreach ($templateList as $templateId)\r
2977                 {\r
2978                         $exporter->addTemplate($templateId);\r
2979                 }\r
2980                 $exporter->setInfo($info);\r
2981                 \r
2982                 $exporter->export();\r
2983                 return;\r
2984         }\r
2985         \r
2986         /**\r
2987          * Admin::action_templateoverview()\r
2988          * \r
2989          * @param       void\r
2990          * @return      void\r
2991          */\r
2992         static private function action_templateoverview()\r
2993         {\r
2994                 global $member, $manager;\r
2995                 \r
2996                 $member->isAdmin() or self::disallow();\r
2997                 \r
2998                 self::pagehead();\r
2999                 self::$skin->parse('templateoverview');\r
3000                 self::pagefoot();\r
3001                 return;\r
3002         }\r
3003         \r
3004         /**\r
3005          * Admin::action_templateedit()\r
3006          * \r
3007          * @param       string  $msg    message for pageheader\r
3008          * @return      void\r
3009          */\r
3010         static private function action_templateedit($msg = '')\r
3011         {\r
3012                 global $member, $manager;\r
3013                 if ( $msg )\r
3014                 {\r
3015                         self::$headMess = $msg;\r
3016                 }\r
3017                 \r
3018                 $templateid = intRequestVar('templateid');\r
3019                 \r
3020                 $member->isAdmin() or self::disallow();\r
3021                 \r
3022                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3023                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3024                 \r
3025                 self::pagehead($extrahead);\r
3026                 self::$skin->parse('templateedit');\r
3027                 self::pagefoot();\r
3028                 return;\r
3029         }\r
3030         \r
3031         /**\r
3032          * TODO: remove this\r
3033          *\r
3034         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3035                 static $count = 1;\r
3036                 if (!isset($template[$name])) $template[$name] = '';\r
3037         ?>\r
3038                 </tr><tr>\r
3039                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3040                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3041         <?php       $count++;\r
3042         }\r
3043         */\r
3044         \r
3045         /**\r
3046          * Admin::action_templateupdate()\r
3047          * \r
3048          * @param       void\r
3049          * @return      void\r
3050          */\r
3051         static private function action_templateupdate()\r
3052         {\r
3053                 global $member,$manager;\r
3054                 \r
3055                 $templateid = intRequestVar('templateid');\r
3056                 \r
3057                 $member->isAdmin() or self::disallow();\r
3058                 \r
3059                 $name = postVar('tname');\r
3060                 $desc = postVar('tdesc');\r
3061                 \r
3062                 if ( !isValidTemplateName($name) )\r
3063                 {\r
3064                         self::error(_ERROR_BADTEMPLATENAME);\r
3065                 }\r
3066                 \r
3067                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3068                 {\r
3069                         self::error(_ERROR_DUPTEMPLATENAME);\r
3070                 }\r
3071                 \r
3072                 $name = sql_real_escape_string($name);\r
3073                 $desc = sql_real_escape_string($desc);\r
3074                 \r
3075                 // 1. Remove all template parts\r
3076                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3077                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3078                 sql_query($query);\r
3079                 \r
3080                 // 2. Update description\r
3081                 $query = "UPDATE %s SET tdname='%s', tddesc='%s' WHERE tdnumber=%d;";\r
3082                 $query = sprintf($query, sql_table('template_desc'), sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3083                 sql_query($query);\r
3084                 \r
3085                 // 3. Add non-empty template parts\r
3086                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3087                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3088                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3089                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3090                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3091                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3092                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3093                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3094                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3095                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3096                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3097                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3098                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3099                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3100                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3101                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3102                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3103                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3104                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3105                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3106                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3107                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3108                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3109                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3110                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3111                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3112                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3113                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3114                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3115                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3116                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3117                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3118                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3119                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3120                 \r
3121                 $data = array('fields' => array());\r
3122                 $manager->notify('TemplateExtraFields', $data);\r
3123                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3124                 {\r
3125                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3126                         {\r
3127                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3128                         }\r
3129                 }\r
3130                 \r
3131                 // jump back to template edit\r
3132                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3133                 return;\r
3134         }\r
3135         \r
3136         /**\r
3137          * Admin::addToTemplate()\r
3138          * \r
3139          * @param       Integer $id     ID for template\r
3140          * @param       String  $partname       parts name\r
3141          * @param       String  $content        template contents\r
3142          * @return      Integer record index\r
3143          * \r
3144          */\r
3145         static private function addToTemplate($id, $partname, $content)\r
3146         {\r
3147                 // don't add empty parts:\r
3148                 if ( !trim($content) )\r
3149                 {\r
3150                         return -1;\r
3151                 }\r
3152                 \r
3153                 $partname = sql_real_escape_string($partname);\r
3154                 $content  = sql_real_escape_string($content);\r
3155                 \r
3156                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3157                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3158                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3159                 return sql_insert_id();\r
3160         }\r
3161         \r
3162         /**\r
3163          * Admin::action_templatedelete()\r
3164          * \r
3165          * @param       void\r
3166          * @return      void\r
3167          */\r
3168         static private function action_templatedelete()\r
3169         {\r
3170                 global $member, $manager;\r
3171                 \r
3172                 $member->isAdmin() or self::disallow();\r
3173                 \r
3174                 $templateid = intRequestVar('templateid');\r
3175                 // TODO: check if template can be deleted\r
3176                 \r
3177                 self::pagehead();\r
3178                 self::$skin->parse('templatedelete');\r
3179                 self::pagefoot();\r
3180                 return;\r
3181         }\r
3182         \r
3183         /**\r
3184          * Admin::action_templatedeleteconfirm()\r
3185          * \r
3186          * @param       void\r
3187          * @return      void\r
3188          */\r
3189         static private function action_templatedeleteconfirm()\r
3190         {\r
3191                 global $member, $manager;\r
3192                 \r
3193                 $templateid = intRequestVar('templateid');\r
3194                 \r
3195                 $member->isAdmin() or self::disallow();\r
3196                 \r
3197                 $data = array('templateid' => $templateid);\r
3198                 $manager->notify('PreDeleteTemplate', $data);\r
3199                 \r
3200                 // 1. delete description\r
3201                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3202                 \r
3203                 // 2. delete parts\r
3204                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3205                 \r
3206                 \r
3207                 $data = array('templateid' => $templateid);\r
3208                 $manager->notify('PostDeleteTemplate', $data);\r
3209                 \r
3210                 self::action_templateoverview();\r
3211                 return;\r
3212         }\r
3213         \r
3214         /**\r
3215          * Admin::action_templatenew()\r
3216          * \r
3217          * @param       void\r
3218          * @return      void\r
3219          */\r
3220         static private function action_templatenew()\r
3221         {\r
3222                 global $member;\r
3223                 \r
3224                 $member->isAdmin() or self::disallow();\r
3225                 \r
3226                 $name = postVar('name');\r
3227                 $desc = postVar('desc');\r
3228                 \r
3229                 if ( !isValidTemplateName($name) )\r
3230                 {\r
3231                         self::error(_ERROR_BADTEMPLATENAME);\r
3232                 }\r
3233                 \r
3234                 if ( Template::exists($name) )\r
3235                 {\r
3236                         self::error(_ERROR_DUPTEMPLATENAME);\r
3237                 }\r
3238                 \r
3239                 $newTemplateId = Template::createNew($name, $desc);\r
3240                 \r
3241                 self::action_templateoverview();\r
3242                 return;\r
3243         }\r
3244         \r
3245         /**\r
3246          * Admin::action_templateclone()\r
3247          * \r
3248          * @param       void\r
3249          * @return      void\r
3250          */\r
3251         static private function action_templateclone()\r
3252         {\r
3253                 global $member;\r
3254                 \r
3255                 $templateid = intRequestVar('templateid');\r
3256                 \r
3257                 $member->isAdmin() or self::disallow();\r
3258                 \r
3259                 // 1. read old template\r
3260                 $name = Template::getNameFromId($templateid);\r
3261                 $desc = Template::getDesc($templateid);\r
3262                 \r
3263                 // 2. create desc thing\r
3264                 $name = "cloned" . $name;\r
3265                 \r
3266                 // if a template with that name already exists:\r
3267                 if ( Template::exists($name) )\r
3268                 {\r
3269                         $i = 1;\r
3270                         while (Template::exists($name . $i))\r
3271                         {\r
3272                                 $i++;\r
3273                         }\r
3274                         $name .= $i;\r
3275                 }\r
3276                 \r
3277                 $newid = Template::createNew($name, $desc);\r
3278                 \r
3279                 // 3. create clone\r
3280                 // go through parts of old template and add them to the new one\r
3281                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3282                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3283                 \r
3284                 $res = sql_query($query);\r
3285                 while ( $o = sql_fetch_object($res) )\r
3286                 {\r
3287                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3288                 }\r
3289                 \r
3290                 self::action_templateoverview();\r
3291                 return;\r
3292         }\r
3293         \r
3294         /**\r
3295          * Admin::action_admintemplateoverview()\r
3296          * \r
3297          * @param       void\r
3298          * @return      void\r
3299          */\r
3300         static private function action_admintemplateoverview()\r
3301         {\r
3302                 global $member, $manager;\r
3303                 $member->isAdmin() or self::disallow();\r
3304                 self::pagehead();\r
3305                 self::$skin->parse('admntemplateoverview');\r
3306                 self::pagefoot();\r
3307                 return;\r
3308         }\r
3309         \r
3310         /**\r
3311          * Admin::action_admintemplateedit()\r
3312          * \r
3313          * @param       string  $msg    message for pageheader\r
3314          * @return      void\r
3315          */\r
3316         static private function action_admintemplateedit($msg = '')\r
3317         {\r
3318                 global $member, $manager;\r
3319                 if ( $msg )\r
3320                 {\r
3321                         self::$headMess = $msg;\r
3322                 }\r
3323                 $member->isAdmin() or self::disallow();\r
3324                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3325                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3326                 self::pagehead($extrahead);\r
3327                 self::$skin->parse('admintemplateedit');\r
3328                 self::pagefoot();\r
3329                 return;\r
3330         }\r
3331         \r
3332         /**\r
3333          * Admin::action_admintemplateupdate()\r
3334          * \r
3335          * @param       void\r
3336          * @return      void\r
3337          */\r
3338         static private function action_admintemplateupdate()\r
3339         {\r
3340                 global $member, $manager;\r
3341                 $templateid = intRequestVar('templateid');\r
3342                 $member->isAdmin() or self::disallow();\r
3343                 $name = postVar('tname');\r
3344                 $desc = postVar('tdesc');\r
3345                 \r
3346                 if ( !isValidTemplateName($name) )\r
3347                 {\r
3348                         self::error(_ERROR_BADTEMPLATENAME);\r
3349                 }\r
3350                 \r
3351                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3352                 {\r
3353                         self::error(_ERROR_DUPTEMPLATENAME);\r
3354                 }\r
3355                 $name = sql_real_escape_string($name);\r
3356                 $desc = sql_real_escape_string($desc);\r
3357                 \r
3358                 // 1. Remove all template parts\r
3359                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3360                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3361                 sql_query($query);\r
3362                 \r
3363                 // 2. Update description\r
3364                 $query = "UPDATE %s SET tdname='%s', tddesc='%s' WHERE tdnumber=%d;";\r
3365                 $query = sprintf($query, sql_table('template_desc'), sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3366                 sql_query($query);\r
3367                 \r
3368                 // 3. Add non-empty template parts\r
3369                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3370                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3371                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3372                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3376                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3377                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3378                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3379                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3380                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3381                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3382                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3383                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3384                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3385                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3386                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3387                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3388                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3389                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3390                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3391                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3392                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3393                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3394                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3395                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3396                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3397                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3470                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3471                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3472                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3473                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3474                 \r
3475                 $data = array('fields' => array());\r
3476                 $manager->notify('TemplateExtraFields', $data);\r
3477                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3478                 {\r
3479                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3480                         {\r
3481                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3482                         }\r
3483                 }\r
3484                 \r
3485                 // jump back to template edit\r
3486                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3487                 return;\r
3488         }\r
3489         \r
3490         /**\r
3491          * Admin::addToAdminTemplate()\r
3492          * \r
3493          * @param       integer $id                     ID for template\r
3494          * @param       string  $partname       name of part for template\r
3495          * @param       void    $contents       content for part of template\r
3496          * @return      integer ID for newly inserted Template\r
3497          */\r
3498         static private function addToAdminTemplate($id, $partname, $content)\r
3499         {\r
3500                 // don't add empty parts:\r
3501                 if ( !trim($content) )\r
3502                 {\r
3503                         return -1;\r
3504                 }\r
3505                 \r
3506                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3507                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($content));\r
3508                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3509                 return sql_insert_id();\r
3510         }\r
3511         \r
3512         /**\r
3513          * Admin::action_admintemplatedelete()\r
3514          * \r
3515          * @param       void\r
3516          * @return      void\r
3517          */\r
3518         static private function action_admintemplatedelete()\r
3519         {\r
3520                 global $member, $manager;\r
3521                 $member->isAdmin() or self::disallow();\r
3522                 \r
3523                 // TODO: check if template can be deleted\r
3524                 self::pagehead();\r
3525                 self::$skin->parse('admintemplatedelete');\r
3526                 self::pagefoot();\r
3527                 return;\r
3528         }\r
3529         \r
3530         /**\r
3531          * Admin::action_admintemplatedeleteconfirm()\r
3532          * \r
3533          * @param       void\r
3534          * @return      void\r
3535          */\r
3536         static private function action_admintemplatedeleteconfirm()\r
3537         {\r
3538                 global $member, $manager;\r
3539                 \r
3540                 $templateid = intRequestVar('templateid');\r
3541                 $member->isAdmin() or self::disallow();\r
3542                 \r
3543                 $data = array('templateid' => $templateid);\r
3544                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3545                 \r
3546                 // 1. delete description\r
3547                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3548                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3549                 sql_query($query);\r
3550                 \r
3551                 // 2. delete parts\r
3552                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3553                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3554                 sql_query($query);\r
3555                 \r
3556                 $data = array('templateid' => $templateid);\r
3557                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3558                 \r
3559                 self::action_admintemplateoverview();\r
3560                 return;\r
3561         }\r
3562         \r
3563         /**\r
3564          * Admin::action_admintemplatenew()\r
3565          * \r
3566          * @param       void\r
3567          * @return      void\r
3568          */\r
3569         static private function action_admintemplatenew()\r
3570         {\r
3571                 global $member;\r
3572                 $member->isAdmin() or self::disallow();\r
3573                 $name = postVar('name');\r
3574                 $desc = postVar('desc');\r
3575                 \r
3576                 if ( !isValidTemplateName($name) )\r
3577                 {\r
3578                         self::error(_ERROR_BADTEMPLATENAME);\r
3579                 }\r
3580                 else if ( !preg_match('#^admin/#', $name) )\r
3581                 {\r
3582                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3583                 }\r
3584                 else if ( Template::exists($name) )\r
3585                 {\r
3586                         self::error(_ERROR_DUPTEMPLATENAME);\r
3587                 }\r
3588                 \r
3589                 $newTemplateId = Template::createNew($name, $desc);\r
3590                 self::action_admintemplateoverview();\r
3591                 return;\r
3592         }\r
3593         \r
3594         /**\r
3595          * Admin::action_admintemplateclone()\r
3596          * \r
3597          * @param       void\r
3598          * @return      void\r
3599          */\r
3600         static private function action_admintemplateclone()\r
3601         {\r
3602                 global $member;\r
3603                 $templateid = intRequestVar('templateid');\r
3604                 $member->isAdmin() or self::disallow();\r
3605                 \r
3606                 // 1. read old template\r
3607                 $name = Template::getNameFromId($templateid);\r
3608                 $desc = Template::getDesc($templateid);\r
3609                 \r
3610                 // 2. create desc thing\r
3611                 $name = $name . "cloned";\r
3612                 \r
3613                 // if a template with that name already exists:\r
3614                 if ( Template::exists($name) )\r
3615                 {\r
3616                         $i = 1;\r
3617                         while ( Template::exists($name . $i) )\r
3618                         {\r
3619                                 $i++;\r
3620                         }\r
3621                         $name .= $i;\r
3622                 }\r
3623                 \r
3624                 $newid = Template::createNew($name, $desc);\r
3625                 \r
3626                 // 3. create clone\r
3627                 // go through parts of old template and add them to the new one\r
3628                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3629                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3630                 \r
3631                 $res = sql_query($query);\r
3632                 while ( $o = sql_fetch_object($res) )\r
3633                 {\r
3634                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3635                 }\r
3636                 \r
3637                 self::action_admintemplateoverview();\r
3638                 return;\r
3639         }\r
3640 \r
3641         /**\r
3642          * Admin::action_skinoverview()\r
3643          * \r
3644          * @param       void\r
3645          * @return      void\r
3646          */\r
3647         static private function action_skinoverview()\r
3648         {\r
3649                 global $member, $manager;\r
3650                 \r
3651                 $member->isAdmin() or self::disallow();\r
3652                 \r
3653                 self::pagehead();\r
3654                 self::$skin->parse('skinoverview');\r
3655                 self::pagefoot();\r
3656                 return;\r
3657         }\r
3658         \r
3659         /**\r
3660          * Admin::action_skinnew()\r
3661          * \r
3662          * @param       void\r
3663          * @return      void\r
3664          */\r
3665         static private function action_skinnew()\r
3666         {\r
3667                 global $member;\r
3668                 \r
3669                 $member->isAdmin() or self::disallow();\r
3670                 \r
3671                 $name = trim(postVar('name'));\r
3672                 $desc = trim(postVar('desc'));\r
3673                 \r
3674                 if ( !isValidSkinName($name) )\r
3675                 {\r
3676                         self::error(_ERROR_BADSKINNAME);\r
3677                 }\r
3678                 \r
3679                 if ( SKIN::exists($name) )\r
3680                 {\r
3681                         self::error(_ERROR_DUPSKINNAME);\r
3682                 }\r
3683                 \r
3684                 $newId = SKIN::createNew($name, $desc);\r
3685                 \r
3686                 self::action_skinoverview();\r
3687                 return;\r
3688         }\r
3689         \r
3690         /**\r
3691          * Admin::action_skinedit()\r
3692          * \r
3693          * @param       void\r
3694          * @return      void\r
3695          */\r
3696         static private function action_skinedit()\r
3697         {\r
3698                 global $member, $manager;\r
3699                 \r
3700                 $member->isAdmin() or self::disallow();\r
3701                 \r
3702                 self::pagehead();\r
3703                 self::$skin->parse('skinedit');\r
3704                 self::pagefoot();\r
3705                 return;\r
3706         }\r
3707         \r
3708         /**\r
3709          * Admin::action_skineditgeneral()\r
3710          * \r
3711          * @param       void\r
3712          * @return      void\r
3713          */\r
3714         static private function action_skineditgeneral()\r
3715         {\r
3716                 global $member;\r
3717                 \r
3718                 $skinid = intRequestVar('skinid');\r
3719                 \r
3720                 $member->isAdmin() or self::disallow();\r
3721                 \r
3722                 $name           = postVar('name');\r
3723                 $desc           = postVar('desc');\r
3724                 $type           = postVar('type');\r
3725                 $inc_mode       = postVar('inc_mode');\r
3726                 $inc_prefix     = postVar('inc_prefix');\r
3727                 \r
3728                 $skin = new Skin($skinid);\r
3729                 \r
3730                 // 1. Some checks\r
3731                 if ( !isValidSkinName($name) )\r
3732                 {\r
3733                         self::error(_ERROR_BADSKINNAME);\r
3734                 }\r
3735                 \r
3736                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3737                 {\r
3738                         self::error(_ERROR_DUPSKINNAME);\r
3739                 }\r
3740                 \r
3741                 if ( !$type )\r
3742                 {\r
3743                         $type = 'text/html';\r
3744                 }\r
3745                 if ( !$inc_mode )\r
3746                 {\r
3747                         $inc_mode = 'normal';\r
3748                 }\r
3749                 \r
3750                 // 2. Update description\r
3751                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3752                 \r
3753                 self::action_skinedit();\r
3754                 return;\r
3755         }\r
3756         \r
3757         static private function action_skinedittype($msg = '')\r
3758         {\r
3759                 global $member, $manager;\r
3760                 \r
3761                 $member->isAdmin() or self::disallow();\r
3762                 \r
3763                 if ( $msg )\r
3764                 {\r
3765                         self::$headMess = $msg;\r
3766                 }\r
3767                 \r
3768                 $skinid = intRequestVar('skinid');\r
3769                 $type   = requestVar('type');\r
3770                 $type   = trim($type);\r
3771                 $type   = strtolower($type);\r
3772                 \r
3773                 if ( !isValidShortName($type) )\r
3774                 {\r
3775                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3776                 }\r
3777                 \r
3778                 self::pagehead();\r
3779                 self::$skin->parse('skinedittype');\r
3780                 self::pagefoot();\r
3781                 return;\r
3782         }\r
3783         \r
3784         /**\r
3785          * Admin::action_skinupdate()\r
3786          * \r
3787          * @param       void\r
3788          * @return      void\r
3789          */\r
3790         static private function action_skinupdate()\r
3791         {\r
3792                 global $member;\r
3793                 \r
3794                 $skinid = intRequestVar('skinid');\r
3795                 $content = trim(postVar('content'));\r
3796                 $type = postVar('type');\r
3797                 \r
3798                 $member->isAdmin() or self::disallow();\r
3799                 \r
3800                 $skin = new SKIN($skinid);\r
3801                 $skin->update($type, $content);\r
3802                 \r
3803                 self::action_skinedittype(_SKIN_UPDATED);\r
3804                 return;\r
3805         }\r
3806         \r
3807         /**\r
3808          * Admin::action_skindelete()\r
3809          * \r
3810          * @param       void\r
3811          * @return      void\r
3812          */\r
3813         static private function action_skindelete()\r
3814         {\r
3815                 global $member, $manager, $CONF;\r
3816                 \r
3817                 $skinid = intRequestVar('skinid');\r
3818                 \r
3819                 $member->isAdmin() or self::disallow();\r
3820                 \r
3821                 // don't allow default skin to be deleted\r
3822                 if ( $skinid == $CONF['BaseSkin'] )\r
3823                 {\r
3824                         self::error(_ERROR_DEFAULTSKIN);\r
3825                 }\r
3826                 \r
3827                 // don't allow deletion of default skins for blogs\r
3828                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3829                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3830                 \r
3831                 $r = sql_query($query);\r
3832                 if ( $o = sql_fetch_object($r) )\r
3833                 {\r
3834                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3835                 }\r
3836                 \r
3837                 self::pagehead();\r
3838                 self::$skin->parse('skindelete');\r
3839                 self::pagefoot();\r
3840                 return;\r
3841         }\r
3842         \r
3843         /**\r
3844          * Admin::action_skindeleteconfirm()\r
3845          * \r
3846          * @param       void\r
3847          * @return      void\r
3848          */\r
3849         static private function action_skindeleteconfirm()\r
3850         {\r
3851                 global $member, $CONF, $manager;\r
3852                 \r
3853                 $skinid = intRequestVar('skinid');\r
3854                 \r
3855                 $member->isAdmin() or self::disallow();\r
3856                 \r
3857                 // don't allow default skin to be deleted\r
3858                 if ( $skinid == $CONF['BaseSkin'] )\r
3859                 {\r
3860                         self::error(_ERROR_DEFAULTSKIN);\r
3861                 }\r
3862                 \r
3863                 // don't allow deletion of default skins for blogs\r
3864                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3865                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3866                 \r
3867                 $r = sql_query($query);\r
3868                 if ( $o = sql_fetch_object($r) )\r
3869                 {\r
3870                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3871                 }\r
3872                 \r
3873                 $data = array('skinid' => $skinid);\r
3874                 $manager->notify('PreDeleteSkin', $data);\r
3875                 \r
3876                 // 1. delete description\r
3877                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3878                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3879                 sql_query($query);\r
3880                 \r
3881                 // 2. delete parts\r
3882                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3883                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3884                 sql_query($query);\r
3885                 \r
3886                 $data = array('skinid' => $skinid);\r
3887                 $manager->notify('PostDeleteSkin', $data);\r
3888                 \r
3889                 self::action_skinoverview();\r
3890                 return;\r
3891         }\r
3892         \r
3893         /**\r
3894          * Admin::action_skinremovetype()\r
3895          * \r
3896          * @param       void\r
3897          * @return      void\r
3898          */\r
3899         static private function action_skinremovetype()\r
3900         {\r
3901                 global $member, $manager, $CONF;\r
3902                 \r
3903                 $member->isAdmin() or self::disallow();\r
3904                 \r
3905                 $skinid = intRequestVar('skinid');\r
3906                 $skintype = requestVar('type');\r
3907                 \r
3908                 if ( !isValidShortName($skintype) )\r
3909                 {\r
3910                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3911                 }\r
3912                 \r
3913                 // don't allow default skinparts to be deleted\r
3914                 /* TODO: this array should be retrieved from Action class */\r
3915                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3916                 {\r
3917                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3918                 }\r
3919                 \r
3920                 self::pagehead();\r
3921                 self::$skin->parse('skinremovetype');\r
3922                 self::pagefoot();\r
3923                 return;\r
3924         }\r
3925         \r
3926         /**\r
3927          * Admin::action_skinremovetypeconfirm()\r
3928          * \r
3929          * @param       void\r
3930          * @return      void\r
3931          */\r
3932         static private function action_skinremovetypeconfirm()\r
3933         {\r
3934                 global $member, $CONF, $manager;\r
3935                 \r
3936                 $member->isAdmin() or self::disallow();\r
3937                 \r
3938                 $skinid = intRequestVar('skinid');\r
3939                 $skintype = requestVar('type');\r
3940                 \r
3941                 if ( !isValidShortName($skintype) )\r
3942                 {\r
3943                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3944                 }\r
3945                 \r
3946                 // don't allow default skinparts to be deleted\r
3947                 /* TODO: this array should be retrieved from Action class */\r
3948                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3949                 {\r
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3951                 }\r
3952                 \r
3953                 $data = array(\r
3954                         'skinid'   => $skinid,\r
3955                         'skintype' => $skintype\r
3956                 );\r
3957                 $manager->notify('PreDeleteSkinPart', $data);\r
3958                 \r
3959                 // delete part\r
3960                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3961                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3962                 sql_query($query);\r
3963                 \r
3964                 $data = array(\r
3965                         'skinid'   => $skinid,\r
3966                         'skintype' => $skintype\r
3967                 );\r
3968                 $manager->notify('PostDeleteSkinPart', $data);\r
3969                 \r
3970                 self::action_skinedit();\r
3971                 return;\r
3972         }\r
3973 \r
3974         /**\r
3975          * Admin::action_skinclone()\r
3976          * \r
3977          * @param       void\r
3978          * @return      void\r
3979          */\r
3980         static private function action_skinclone()\r
3981         {\r
3982                 global $member;\r
3983                 \r
3984                 $member->isAdmin() or self::disallow();\r
3985                 \r
3986                 $skinid = intRequestVar('skinid');\r
3987                 \r
3988                 // 1. read skin to clone\r
3989                 $skin = new Skin($skinid);\r
3990                 \r
3991                 $name = "{$skin->getName()}_clone";\r
3992                 \r
3993                 // if a skin with that name already exists:\r
3994                 if ( Skin::exists($name) )\r
3995                 {\r
3996                         $i = 1;\r
3997                         while ( Skin::exists($name . $i) )\r
3998                         {\r
3999                                 $i++;\r
4000                         }\r
4001                         $name .= $i;\r
4002                 }\r
4003                 \r
4004                 // 2. create skin desc\r
4005                 $newid = Skin::createNew(\r
4006                         $name,\r
4007                         $skin->getDescription(),\r
4008                         $skin->getContentType(),\r
4009                         $skin->getIncludeMode(),\r
4010                         $skin->getIncludePrefix()\r
4011                 );\r
4012                 \r
4013                 // 3. clone\r
4014                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4015                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4016                 \r
4017                 $res = sql_query($query);\r
4018                 while ( $row = sql_fetch_assoc($res) )\r
4019                 {\r
4020                         self::skinclonetype($skin, $newid, $row['stype']);\r
4021                 }\r
4022                 \r
4023                 self::action_skinoverview();\r
4024                 return;\r
4025         }\r
4026         \r
4027         /**\r
4028          * Admin::skinclonetype()\r
4029          * \r
4030          * @param       String  $skin   Skin object\r
4031          * @param       Integer $newid  ID for this clone\r
4032          * @param       String  $type   type of skin\r
4033          * @return      Void\r
4034          */\r
4035         static private function skinclonetype($skin, $newid, $type)\r
4036         {\r
4037                 $newid = intval($newid);\r
4038                 $content = $skin->getContentFromDB($type);\r
4039                 \r
4040                 if ( $content )\r
4041                 {\r
4042                         $content = sql_real_escape_string($content);\r
4043                         $type = sql_real_escape_string($type);\r
4044                         \r
4045                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4046                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4047                         sql_query($query);\r
4048                 }\r
4049                 return;\r
4050         }\r
4051         \r
4052         /**\r
4053          * Admin::action_adminskinoverview()\r
4054          * \r
4055          * @param       void\r
4056          * @return      void\r
4057          */\r
4058         static private function action_adminskinoverview()\r
4059         {\r
4060                 global $member, $manager;\r
4061                 \r
4062                 $member->isAdmin() or self::disallow();\r
4063                 \r
4064                 self::pagehead();\r
4065                 self::$skin->parse('adminskinoverview');\r
4066                 self::pagefoot();\r
4067                 return;\r
4068         }\r
4069         \r
4070         /**\r
4071          * Admin::action_adminskinnew()\r
4072          * \r
4073          * @param       void\r
4074          * @return      void\r
4075          */\r
4076         static private function action_adminskinnew()\r
4077         {\r
4078                 global $member;\r
4079                 $member->isAdmin() or self::disallow();\r
4080                 $name = trim(postVar('name'));\r
4081                 $desc = trim(postVar('desc'));\r
4082                 \r
4083                 if ( !isValidSkinName($name) )\r
4084                 {\r
4085                         self::error(_ERROR_BADSKINNAME);\r
4086                 }\r
4087                 else if ( !preg_match('#^admin/#', $name) )\r
4088                 {\r
4089                         self::error(_ERROR_BADADMINSKINNAME);\r
4090                 }\r
4091                 else if ( Skin::exists($name) )\r
4092                 {\r
4093                         self::error(_ERROR_DUPSKINNAME);\r
4094                 }\r
4095                 /* TODO: $newId is not reused... */\r
4096                 $newId = Skin::createNew($name, $desc);\r
4097                 self::action_adminskinoverview();\r
4098                 return;\r
4099         }\r
4100         \r
4101         /**\r
4102          * Admin::action_adminskinedit()\r
4103          * \r
4104          * @param       void\r
4105          * @return      void\r
4106          */\r
4107         static private function action_adminskinedit()\r
4108         {\r
4109                 global $member, $manager;\r
4110                 \r
4111                 $member->isAdmin() or self::disallow();\r
4112                 self::pagehead();\r
4113                 self::$skin->parse('adminskinedit');\r
4114                 self::pagefoot();\r
4115                 return;\r
4116         }\r
4117         \r
4118         /**\r
4119          * Admin::action_adminskineditgeneral()\r
4120          * \r
4121          * @param       void\r
4122          * @return      void\r
4123          */\r
4124         static private function action_adminskineditgeneral()\r
4125         {\r
4126                 global $member;\r
4127                 \r
4128                 $skinid = intRequestVar('skinid');\r
4129                 \r
4130                 $member->isAdmin() or self::disallow();\r
4131                 \r
4132                 $name           = postVar('name');\r
4133                 $desc           = postVar('desc');\r
4134                 $type           = postVar('type');\r
4135                 $inc_mode       = postVar('inc_mode');\r
4136                 $inc_prefix     = postVar('inc_prefix');\r
4137                 \r
4138                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4139                 \r
4140                 // 1. Some checks\r
4141                 if ( !isValidSkinName($name) )\r
4142                 {\r
4143                         self::error(_ERROR_BADSKINNAME);\r
4144                 }\r
4145                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4146                 {\r
4147                         self::error(_ERROR_DUPSKINNAME);\r
4148                 }\r
4149                 if ( !$type )\r
4150                 {\r
4151                         $type = 'text/html';\r
4152                 }\r
4153                 if ( !$inc_mode )\r
4154                 {\r
4155                         $inc_mode = 'normal';\r
4156                 }\r
4157                 // 2. Update description\r
4158                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4159                 self::action_adminskinedit();\r
4160                 return;\r
4161         }\r
4162         \r
4163         /**\r
4164          * Admin::action_adminskinedittype()\r
4165          * \r
4166          * @param       string  $msg    message for pageheader\r
4167          * @return      void\r
4168          */\r
4169         static private function action_adminskinedittype($msg = '')\r
4170         {\r
4171                 global $member, $manager;\r
4172                 \r
4173                 $member->isAdmin() or self::disallow();\r
4174                 \r
4175                 if ( $msg )\r
4176                 {\r
4177                         self::$headMess = $msg;\r
4178                 }\r
4179                 $type = requestVar('type');\r
4180                 $type = trim($type);\r
4181                 $type = strtolower($type);\r
4182                 \r
4183                 if ( !isValidShortName($type) )\r
4184                 {\r
4185                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4186                 }\r
4187                 \r
4188                 self::pagehead();\r
4189                 self::$skin->parse('adminskinedittype');\r
4190                 self::pagefoot();\r
4191                 return;\r
4192         }\r
4193         \r
4194         /**\r
4195          * Admin::action_adminskinupdate()\r
4196          * \r
4197          * @param       void\r
4198          * @return      void\r
4199          */\r
4200         static private function action_adminskinupdate()\r
4201         {\r
4202                 global $member;\r
4203                 $skinid         = intRequestVar('skinid');\r
4204                 $content        = trim(postVar('content'));\r
4205                 $type           = postVar('type');\r
4206                 \r
4207                 $member->isAdmin() or self::disallow();\r
4208                 \r
4209                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4210                 $skin->update($type, $content);\r
4211                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4212                 return;\r
4213         }\r
4214         \r
4215         /**\r
4216          * Admin::action_adminskindelete()\r
4217          * \r
4218          * @param       void\r
4219          * @return      void\r
4220          */\r
4221         static private function action_adminskindelete()\r
4222         {\r
4223                 global $member, $manager, $CONF;\r
4224                 $member->isAdmin() or self::disallow();\r
4225                 \r
4226                 /* TODO: needless variable $skinid... */\r
4227                 $skinid = intRequestVar('skinid');\r
4228                 self::pagehead();\r
4229                 self::$skin->parse('adminskindelete');\r
4230                 self::pagefoot();\r
4231                 return;\r
4232         }\r
4233 \r
4234         /**\r
4235          * Admin::action_adminskindeleteconfirm()\r
4236          * \r
4237          * @param       void\r
4238          * @return      void\r
4239          */\r
4240         static private function action_adminskindeleteconfirm()\r
4241         {\r
4242                 global $member, $CONF, $manager;\r
4243                 \r
4244                 $member->isAdmin() or self::disallow();\r
4245                 $skinid = intRequestVar('skinid');\r
4246                 \r
4247                 // don't allow default skin to be deleted\r
4248                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4249                 {\r
4250                         self::error(_ERROR_DEFAULTSKIN);\r
4251                 }\r
4252                 \r
4253                 /*\r
4254                  * TODO: NOT Implemented\r
4255                  *  don't allow deletion of default skins for members\r
4256                 $memberDefaults =  $member->getAdminSkin();\r
4257                 foreach ( $memberDefaults as $memID => $adminskin )\r
4258                 {\r
4259                         if ( $skinid == $adminskin )\r
4260                         {\r
4261                                 $mem = MEMBER::createFromID($memID);\r
4262                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4263                         }\r
4264                 }\r
4265                 */\r
4266                 \r
4267                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4268                 \r
4269                 // 1. delete description\r
4270                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4271                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4272                 sql_query($query);\r
4273                 \r
4274                 // 2. delete parts\r
4275                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4276                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4277                 \r
4278                 sql_query($query);\r
4279                 \r
4280                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4281                 self::action_adminskinoverview();\r
4282                 return;\r
4283         }\r
4284         \r
4285         /**\r
4286          * Admin::action_adminskinremovetype()\r
4287          * \r
4288          * @param       void\r
4289          * @return      void\r
4290          */\r
4291         static private function action_adminskinremovetype()\r
4292         {\r
4293                 global $member, $manager, $CONF;\r
4294 \r
4295                 $member->isAdmin() or self::disallow();\r
4296                 \r
4297                 $skinid         = intRequestVar('skinid');\r
4298                 $skintype       = requestVar('type');\r
4299                 \r
4300                 if ( !isValidShortName($skintype) )\r
4301                 {\r
4302                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4303                 }\r
4304                 \r
4305                 self::pagehead();\r
4306                 self::$skin->parse('adminskinremovetype');\r
4307                 self::pagefoot();\r
4308                 return;\r
4309         }\r
4310         \r
4311         /**\r
4312          * Admin::action_adminskinremovetypeconfirm()\r
4313          * \r
4314          * @param       void\r
4315          * @return      void\r
4316          */\r
4317         static private function action_adminskinremovetypeconfirm()\r
4318         {\r
4319                 global $member, $CONF, $manager;\r
4320                 \r
4321                 $member->isAdmin() or self::disallow();\r
4322                 \r
4323                 $skinid         = intRequestVar('skinid');\r
4324                 $skintype       = requestVar('type');\r
4325                 \r
4326                 if ( !isValidShortName($skintype) )\r
4327                 {\r
4328                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4329                 }\r
4330                 \r
4331                 $data =array(\r
4332                         'skinid'        => $skinid,\r
4333                         'skintype'      => $skintype\r
4334                 );\r
4335                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4336                 \r
4337                 // delete part\r
4338                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4339                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4340                 sql_query($query);\r
4341                 \r
4342                 $data = array(\r
4343                         'skinid'        => $skinid,\r
4344                         'skintype'      => $skintype\r
4345                 );\r
4346                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4347                 \r
4348                 self::action_adminskinedit();\r
4349                 return;\r
4350         }\r
4351 \r
4352         /**\r
4353          * Admin::action_adminskinclone()\r
4354          * \r
4355          * @param       void\r
4356          * @return      void\r
4357          */\r
4358         static private function action_adminskinclone()\r
4359         {\r
4360                 global $member;\r
4361                 \r
4362                 $member->isAdmin() or self::disallow();\r
4363                 \r
4364                 $skinid = intRequestVar('skinid');\r
4365                 \r
4366                 // 1. read skin to clone\r
4367                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4368                 $name = "{$skin->getName()}_clone";\r
4369                 \r
4370                 // if a skin with that name already exists:\r
4371                 if ( Skin::exists($name) )\r
4372                 {\r
4373                         $i = 1;\r
4374                         while ( Skin::exists($name . $i) )\r
4375                         {\r
4376                                 $i++;\r
4377                         }\r
4378                         $name .= $i;\r
4379                 }\r
4380                 \r
4381                 // 2. create skin desc\r
4382                 $newid = Skin::createNew(\r
4383                         $name,\r
4384                         $skin->getDescription(),\r
4385                         $skin->getContentType(),\r
4386                         $skin->getIncludeMode(),\r
4387                         $skin->getIncludePrefix()\r
4388                 );\r
4389                 \r
4390                 // 3. clone\r
4391                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4392                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4393                 \r
4394                 $res = sql_query($query);\r
4395                 while ( $row = sql_fetch_assoc($res) )\r
4396                 {\r
4397                         self::skinclonetype($skin, $newid, $row['stype']);\r
4398                 }\r
4399                 self::action_adminskinoverview();\r
4400                 return;\r
4401         }\r
4402         \r
4403         /**\r
4404          * Admin::adminskinclonetype()\r
4405          * \r
4406          * @param       string  $skin   an instance of Skin class\r
4407          * @param       integer $newid  ID for new skin\r
4408          * @param       string  $type   skin type\r
4409          * @return      void\r
4410          */\r
4411         static private function adminskinclonetype($skin, $newid, $type)\r
4412         {\r
4413                 $content = $skin->getContentFromDB($type);\r
4414                 \r
4415                 if ( $content )\r
4416                 {\r
4417                         $content        = sql_real_escape_string($content);\r
4418                         $type           = sql_real_escape_string($type);\r
4419                         \r
4420                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4421                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4422                         sql_query($query);\r
4423                 }\r
4424                 return;\r
4425         }\r
4426         \r
4427         /**\r
4428          * Admin::action_adminskinieoverview()\r
4429          * \r
4430          * @param       void\r
4431          * @return      void\r
4432          */\r
4433         static private function action_adminskinieoverview()\r
4434         {\r
4435                 global $member, $DIR_LIBS, $manager;\r
4436                 \r
4437                 $member->isAdmin() or self::disallow();\r
4438                 \r
4439                 // load skinie class\r
4440                 include_once($DIR_LIBS . 'skinie.php');\r
4441                 \r
4442                 self::pagehead();\r
4443                 self::$skin->parse('adminskinieoverview');\r
4444                 self::pagefoot();\r
4445                 return;\r
4446         }\r
4447 \r
4448         /**\r
4449          * Admin::action_adminskinieimport()\r
4450          * \r
4451          * @param       void\r
4452          * @return      void\r
4453          */\r
4454         static private function action_adminskinieimport()\r
4455         {\r
4456                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4457                 \r
4458                 $member->isAdmin() or self::disallow();\r
4459                 \r
4460                 // load skinie class\r
4461                 include_once($DIR_LIBS . 'skinie.php');\r
4462                 \r
4463                 $skinFileRaw    = postVar('skinfile');\r
4464                 $mode                   = postVar('mode');\r
4465                 \r
4466                 $importer = new SKINIMPORT();\r
4467                 \r
4468                 // get full filename\r
4469                 if ( $mode == 'file' )\r
4470                 {\r
4471                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4472                         \r
4473                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4474                         if ( !file_exists($skinFile) )\r
4475                         {\r
4476                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4477                         }\r
4478                 }\r
4479                 else\r
4480                 {\r
4481                         $skinFile = $skinFileRaw;\r
4482                 }\r
4483                 \r
4484                 // read only metadata\r
4485                 $error = $importer->readFile($skinFile, 1);\r
4486                 if ( $error )\r
4487                 {\r
4488                         self::error($error);\r
4489                 }\r
4490                 \r
4491                 /* TODO: we should consider to use the other way instead of this */\r
4492                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4493                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4494                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4495                 \r
4496                 // clashes\r
4497                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4498                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4499                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4500                 /* TODO: we should consider to use the other way instead of this */\r
4501                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4502                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4503                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4504                 \r
4505                 self::pagehead();\r
4506                 self::$skin->parse('adminskinieimport');\r
4507                 self::pagefoot();\r
4508                 return;\r
4509         }\r
4510         \r
4511         /**\r
4512          * Admin::action_adminskiniedoimport()\r
4513          * \r
4514          * @param       void\r
4515          * @return      void\r
4516          */\r
4517         static private function action_adminskiniedoimport()\r
4518         {\r
4519                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4520                 \r
4521                 $member->isAdmin() or self::disallow();\r
4522                 \r
4523                 // load skinie class\r
4524                 include_once($DIR_LIBS . 'skinie.php');\r
4525                 \r
4526                 $skinFileRaw    = postVar('skinfile');\r
4527                 $mode                   = postVar('mode');\r
4528                 $allowOverwrite = intPostVar('overwrite');\r
4529                 \r
4530                 // get full filename\r
4531                 if ( $mode == 'file' )\r
4532                 {\r
4533                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4534                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4535                         if ( !file_exists($skinFile) )\r
4536                         {\r
4537                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4538                         }\r
4539                 }\r
4540                 else\r
4541                 {\r
4542                         $skinFile = $skinFileRaw;\r
4543                 }\r
4544                 \r
4545                 $importer = new SKINIMPORT();\r
4546                 \r
4547                 $error = $importer->readFile($skinFile);\r
4548                 if ( $error )\r
4549                 {\r
4550                         self::error($error);\r
4551                 }\r
4552                 \r
4553                 $error = $importer->writeToDatabase($allowOverwrite);\r
4554                 if ( $error )\r
4555                 {\r
4556                         self::error($error);\r
4557                 }\r
4558                 \r
4559                 /* TODO: we should consider to use the other way instead of this */\r
4560                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4561                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4562                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4563                 \r
4564                 self::pagehead();\r
4565                 self::$skin->parse('adminskiniedoimport');\r
4566                 self::pagefoot();\r
4567                 return;\r
4568         }\r
4569 \r
4570         /**\r
4571          * Admin::action_adminskinieexport()\r
4572          * \r
4573          * @param       void\r
4574          * @return      void\r
4575          */\r
4576         static private function action_adminskinieexport()\r
4577         {\r
4578                 global $member, $DIR_PLUGINS;\r
4579                 \r
4580                 $member->isAdmin() or self::disallow();\r
4581                 \r
4582                 // load skinie class\r
4583                 $aSkins = requestIntArray('skin');\r
4584                 if (!is_array($aSkins)) {\r
4585                         $aSkins = array();\r
4586                 }\r
4587                 $skinList = array_keys($aSkins);\r
4588                 \r
4589                 $aTemplates = requestIntArray('template');\r
4590                 if (!is_array($aTemplates))\r
4591                 {\r
4592                         $aTemplates = array();\r
4593                 }\r
4594                 $templateList = array_keys($aTemplates);\r
4595                 \r
4596                 $info = postVar('info');\r
4597                 \r
4598                 include_libs('skinie.php');\r
4599                 $exporter = new SkinExport();\r
4600                 foreach ( $skinList as $skinId )\r
4601                 {\r
4602                         $exporter->addSkin($skinId);\r
4603                 }\r
4604                 foreach ( $templateList as $templateId )\r
4605                 {\r
4606                         $exporter->addTemplate($templateId);\r
4607                 }\r
4608                 $exporter->setInfo($info);\r
4609                 $exporter->export();\r
4610                 return;\r
4611         }\r
4612         \r
4613         /**\r
4614          * Admin::action_settingsedit()\r
4615          * \r
4616          * @param       Void\r
4617          * @return      Void\r
4618          */\r
4619         static private function action_settingsedit()\r
4620         {\r
4621                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4622                 \r
4623                 $member->isAdmin() or self::disallow();\r
4624                 \r
4625                 self::pagehead();\r
4626                 self::$skin->parse('settingsedit');\r
4627                 self::pagefoot();\r
4628                 return;\r
4629         }\r
4630         \r
4631         /**\r
4632          * Admin::action_settingsupdate()\r
4633          * Update $CONFIG and redirect\r
4634          * \r
4635          * @param       void\r
4636          * @return      void\r
4637          */\r
4638         static private function action_settingsupdate()\r
4639         {\r
4640                 global $member, $CONF;\r
4641                 \r
4642                 $member->isAdmin() or self::disallow();\r
4643                 \r
4644                 // check if email address for admin is valid\r
4645                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4646                 {\r
4647                         self::error(_ERROR_BADMAILADDRESS);\r
4648                 }\r
4649                 \r
4650                 // save settings\r
4651                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4652                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4653                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4654                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4655                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4656                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4657                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4658                 self::updateConfig('Locale',                    postVar('Locale'));\r
4659                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4660                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4661                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4662                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4663                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4664                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4665                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4666                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4667                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4668                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4669                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4670                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4671                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4672                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4673                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4674                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4675                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4676                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4677                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4678                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4679                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4680                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4681                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4682                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4683                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4684                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4685                 \r
4686                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4687                 // note that when changing cookie settings, this redirect might cause the user\r
4688                 // to have to log in again.\r
4689                 getConfig();\r
4690                 redirect($CONF['AdminURL'] . '?action=manage');\r
4691                 return;\r
4692         }\r
4693         \r
4694         /**\r
4695          * Admin::action_systemoverview()\r
4696          * Output system overview\r
4697          * \r
4698          * @param       void\r
4699          * @return      void\r
4700          */\r
4701         static private function action_systemoverview()\r
4702         {\r
4703                 self::pagehead();\r
4704                 self::$skin->parse('systemoverview');\r
4705                 self::pagefoot();\r
4706                 return;\r
4707         }\r
4708         \r
4709         /**\r
4710          * Admin::updateConfig()\r
4711          * \r
4712          * @param       string  $name   \r
4713          * @param       string  $val    \r
4714          * @return      integer return the ID in which the latest query posted\r
4715          */\r
4716         static private function updateConfig($name, $val)\r
4717         {\r
4718                 $name = sql_real_escape_string($name);\r
4719                 $val = trim(sql_real_escape_string($val));\r
4720                 \r
4721                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4722                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4723                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4724                 return sql_insert_id();\r
4725         }\r
4726         \r
4727         /**\r
4728          * Admin::error()\r
4729          * Error message\r
4730          * \r
4731          * @param       string  $msg    message that will be shown\r
4732          * @return      void\r
4733          */\r
4734         static private function error($msg)\r
4735         {\r
4736                 self::$headMess = $msg;\r
4737                 self::pagehead();\r
4738                 self::$skin->parse('adminerrorpage');\r
4739                 self::pagefoot();\r
4740                 return;\r
4741         }\r
4742         \r
4743         /**\r
4744          * Admin::disallow()\r
4745          * add error log and show error page \r
4746          * \r
4747          * @param       void\r
4748          * @return      void\r
4749          */\r
4750         static private function disallow()\r
4751         {\r
4752                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4753                 self::error(_ERROR_DISALLOWED);\r
4754                 return;\r
4755         }\r
4756         \r
4757         /**\r
4758          * Admin::PluninAdminPagehead()\r
4759          * Output pluginadmin page head\r
4760          *\r
4761          * @param       string  $extrahead\r
4762          * @return      void\r
4763          */\r
4764         static public function PluninAdminPagehead($extrahead = '')\r
4765         {\r
4766                 self::pagehead();\r
4767                 return;\r
4768         }\r
4769         \r
4770         /**\r
4771          * Admin::PluninAdminPagefoot()\r
4772          * Output pluginadmin page foot\r
4773          *\r
4774          * @param       void\r
4775          * @return      void\r
4776          */\r
4777         static public function PluninAdminPagefoot()\r
4778         {\r
4779                 self::pagefoot();\r
4780                 return;\r
4781         }\r
4782         \r
4783         /**\r
4784          * Admin::pagehead()\r
4785          * Output admin page head\r
4786          * \r
4787          * @param       string  PluninAdminPagehead\r
4788          * @return      void\r
4789          */\r
4790         static private function pagehead($extrahead = '')\r
4791         {\r
4792                 global $member, $nucleus, $CONF, $manager;\r
4793 \r
4794                 if ( self::existsSkinContents('pagehead') )\r
4795                 {\r
4796                         if ( isset($extrahead) && !empty($extrahead) )\r
4797                         {\r
4798                         self::$extrahead = $extrahead;\r
4799                         }\r
4800                         self::$skin->parse('pagehead');\r
4801                 }\r
4802                 else\r
4803                 {\r
4804                         $data = array(\r
4805                                 'extrahead'     => &$extrahead,\r
4806                                 'action'        => self::$action\r
4807                         );\r
4808                         \r
4809                         $manager->notify('AdminPrePageHead', $data);\r
4810                         \r
4811                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4812                         \r
4813                         /*\r
4814                          * TODO: obsoleted\r
4815                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4816                         {\r
4817                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4818                                 $CONF['AdminCSS'] = 'original';\r
4819                         }\r
4820                         */\r
4821                         \r
4822                         /* HTTP 1.1 application for no caching */\r
4823                         header("Cache-Control: no-cache, must-revalidate");\r
4824                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4825                         \r
4826                         $root_element = 'html';\r
4827                         $charset = i18n::get_current_charset();\r
4828                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4829                         $xml_version_info = self::$xml_version_info;\r
4830                         $formal_public_identifier = self::$formal_public_identifier;\r
4831                         $system_identifier = self::$system_identifier;\r
4832                         $xhtml_namespace = self::$xhtml_namespace;\r
4833                         \r
4834                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4835                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4836                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4837                         echo "<head>\n";\r
4838                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4839                         /*\r
4840                          * TODO: obsoleted\r
4841                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4842                         */\r
4843                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4844                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4845                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4846                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4847                         echo "{$extrahead}\n";\r
4848                         echo "</head>\n\n";\r
4849                         echo "<body>\n";\r
4850                         echo "<div id=\"adminwrapper\">\n";\r
4851                         echo "<div class=\"header\">\n";\r
4852                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4853                         echo "</div>\n";\r
4854                         echo "<div id=\"container\">\n";\r
4855                         echo "<div id=\"content\">\n";\r
4856                         echo "<div class=\"loginname\">\n";\r
4857                         if ( $member->isLoggedIn() )\r
4858                         {\r
4859                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4860                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4861                         }\r
4862                         else\r
4863                         {\r
4864                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4865                         }\r
4866                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4867                         echo '(';\r
4868                         \r
4869                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4870                         {\r
4871                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4872                         }\r
4873                         else\r
4874                         {\r
4875                                 $codenamestring = '';\r
4876                         }\r
4877                         \r
4878                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4879                         {\r
4880                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4881                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4882                                 \r
4883                                 $newestVersion = getLatestVersion();\r
4884                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4885                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4886                                 \r
4887                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4888                                 {\r
4889                                         echo "<br />\n";\r
4890                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4891                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4892                                         echo "</a>";\r
4893                                 }\r
4894                         }\r
4895                         else\r
4896                         {\r
4897                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4898                         }\r
4899                         echo ')';\r
4900                         echo '</div>';\r
4901                 }\r
4902                 return;\r
4903         }\r
4904         \r
4905         /**\r
4906          * Admin::pagefoot()\r
4907          * Output admin page foot include quickmenu\r
4908          * \r
4909          * @param       void\r
4910          * @return      void\r
4911          */\r
4912         static private function pagefoot()\r
4913         {\r
4914                 global $action, $member, $manager;\r
4915                 \r
4916                 if ( self::existsSkinContents('pagefoot') )\r
4917                 {\r
4918                         self::$skin->parse('pagefoot');\r
4919                         exit;\r
4920                 }\r
4921                 else\r
4922                 {\r
4923                         $data = array(\r
4924                                 'action' => self::$action\r
4925                         );\r
4926                         \r
4927                         $manager->notify('AdminPrePageFoot', $data);\r
4928                         \r
4929                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4930                         {\r
4931                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4932                                 echo "<ul>\n";\r
4933                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4934                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4935                                 echo "</ul>\n";\r
4936                         }\r
4937                         \r
4938                         echo "<div class=\"foot\">\n";\r
4939                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4940                         echo '-';\r
4941                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4942                         echo "</div>\n";\r
4943                         \r
4944                         echo "<div id=\"quickmenu\">\n";\r
4945                         \r
4946                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4947                         {\r
4948                                 echo "<ul>\n";\r
4949                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4950                                 echo "</ul>\n";\r
4951                                 \r
4952                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4953                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4954                                 echo "<p>\n";\r
4955                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4956                                 \r
4957                                 $showAll = requestVar('showall');\r
4958                                 \r
4959                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4960                                 {\r
4961                                         // Super-Admins have access to all blogs! (no add item support though)\r
4962                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4963                                         $query = sprintf($query, sql_table('blog'));\r
4964                                 }\r
4965                                 else\r
4966                                 {\r
4967                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4968                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4969                                 }\r
4970                                 $template['name']               = 'blogid';\r
4971                                 $template['tabindex']   = 15000;\r
4972                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4973                                 $template['selected']   = -1;\r
4974                                 $template['shorten']    = 10;\r
4975                                 $template['shortenel']  = '';\r
4976                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4977                                 showlist($query, 'select', $template);\r
4978                                 \r
4979                                 echo "</p>\n";\r
4980                                 echo "</form>\n";\r
4981                                 \r
4982                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4983                                 echo "<ul>\n";\r
4984                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4985                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4986                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4987                                 echo "</ul>\n";\r
4988                                 \r
4989                                 if ( $member->isAdmin() )\r
4990                                 {\r
4991                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4992                                         echo "<ul>\n";\r
4993                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4994                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4995                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4996                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4997                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4998                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4999                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
5000                                         echo "</ul>\n";\r
5001                                         \r
5002                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
5003                                         echo "<ul>\n";\r
5004                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
5005                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
5006                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
5007                                         echo "</ul>\n";\r
5008                                 }\r
5009                                 \r
5010                                 $data = array('options' => array());\r
5011                                 \r
5012                                 $manager->notify('QuickMenu', $data);\r
5013                                 \r
5014                                 if ( count($data['options']) > 0 )\r
5015                                 {\r
5016                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
5017                                         echo "<ul>\n";\r
5018                                         foreach ( $data['options'] as $option )\r
5019                                         {\r
5020                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
5021                                         }\r
5022                                         echo "</ul>\n";\r
5023                                 }\r
5024                         }\r
5025                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
5026                         {\r
5027                         \r
5028                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
5029                         }\r
5030                         else\r
5031                         {\r
5032                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
5033                         }\r
5034                         \r
5035                         echo "<!-- quickmenu -->\n";\r
5036                         echo "</div>\n";\r
5037                         \r
5038                         echo "<!-- content -->\n";\r
5039                         echo "</div>\n";\r
5040                         \r
5041                         echo "<!-- container -->\n";\r
5042                         echo "</div>\n";\r
5043                         \r
5044                         echo "<!-- adminwrapper -->\n";\r
5045                         echo "</div>\n";\r
5046                         \r
5047                         echo "</body>\n";\r
5048                         echo "</html>\n";\r
5049                 }\r
5050                 return;\r
5051         }\r
5052         \r
5053         /**\r
5054          * Admin::action_bookmarklet()\r
5055          * \r
5056          * @param       void\r
5057          * @return      void\r
5058          */\r
5059         static private function action_bookmarklet()\r
5060         {\r
5061                 global $member, $manager;\r
5062                 \r
5063                 $blogid = intRequestVar('blogid');\r
5064                 $member->teamRights($blogid) or self::disallow();\r
5065                 \r
5066                 self::pagehead();\r
5067                 self::$skin->parse('bookmarklet');\r
5068                 self::pagefoot();\r
5069                 return;\r
5070         }\r
5071         \r
5072         /**\r
5073          * Admin::action_actionlog()\r
5074          * \r
5075          * @param       void\r
5076          * @return      void\r
5077          */\r
5078         static private function action_actionlog()\r
5079         {\r
5080                 global $member, $manager;\r
5081                 \r
5082                 $member->isAdmin() or self::disallow();\r
5083                 \r
5084                 self::pagehead();\r
5085                 self::$skin->parse('actionlog');\r
5086                 self::pagefoot();\r
5087                 return;\r
5088         }\r
5089         \r
5090         /**\r
5091          * Admin::action_banlist()\r
5092          * \r
5093          * @param       void\r
5094          * @return      void\r
5095          */\r
5096         static private function action_banlist()\r
5097         {\r
5098                 global $member, $manager;\r
5099                 \r
5100                 $member->blogAdminRights($blogid) or self::disallow();\r
5101                 \r
5102                 $blogid = intRequestVar('blogid');\r
5103                 \r
5104                 self::pagehead();\r
5105                 self::$skin->parse('banlist');\r
5106                 self::pagefoot();\r
5107                 return;\r
5108         }\r
5109         \r
5110         /**\r
5111          * Admin::action_banlistdelete()\r
5112          * \r
5113          * @param       void\r
5114          * @return      void\r
5115          */\r
5116         static private function action_banlistdelete()\r
5117         {\r
5118                 global $member, $manager;\r
5119                 \r
5120                 $blogid = intRequestVar('blogid');\r
5121                 $member->blogAdminRights($blogid) or self::disallow();\r
5122                 \r
5123                 self::pagehead();\r
5124                 self::$skin->parse('banlistdelete');\r
5125                 self::pagefoot();\r
5126                 return;\r
5127         }\r
5128         \r
5129         /**\r
5130          * Admin::action_banlistdeleteconfirm()\r
5131          * \r
5132          * @param       void\r
5133          * @return      void\r
5134          */\r
5135         static private function action_banlistdeleteconfirm()\r
5136         {\r
5137                 global $member, $manager;\r
5138                 \r
5139                 $member->blogAdminRights($blogid) or self::disallow();\r
5140                 \r
5141                 $blogid         = intPostVar('blogid');\r
5142                 $allblogs       = postVar('allblogs');\r
5143                 $iprange        = postVar('iprange');\r
5144                 \r
5145                 $deleted = array();\r
5146                 \r
5147                 if ( !$allblogs )\r
5148                 {\r
5149                         if ( Ban::removeBan($blogid, $iprange) )\r
5150                         {\r
5151                                 array_push($deleted, $blogid);\r
5152                         }\r
5153                 }\r
5154                 else\r
5155                 {\r
5156                         // get blogs fot which member has admin rights\r
5157                         $adminblogs = $member->getAdminBlogs();\r
5158                         foreach ($adminblogs as $blogje)\r
5159                         {\r
5160                                 if ( Ban::removeBan($blogje, $iprange) )\r
5161                                 {\r
5162                                         array_push($deleted, $blogje);\r
5163                                 }\r
5164                         }\r
5165                 }\r
5166                 \r
5167                 if ( sizeof($deleted) == 0 )\r
5168                 {\r
5169                         self::error(_ERROR_DELETEBAN);\r
5170                 }\r
5171                 \r
5172                 self::pagehead();\r
5173                 self::$skin->parse('banlistdeleteconfirm');\r
5174                 self::pagefoot();\r
5175                 return;\r
5176         }\r
5177         \r
5178         /**\r
5179          * Admin::action_banlistnewfromitem()\r
5180          * \r
5181          * @param       void\r
5182          * @return      void\r
5183          */\r
5184         static private function action_banlistnewfromitem()\r
5185         {\r
5186                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5187                 return;\r
5188         }\r
5189         \r
5190         /**\r
5191          * Admin::action_banlistnew()\r
5192          * \r
5193          * @param       integer $blogid ID for weblog\r
5194          * @return      void\r
5195          */\r
5196         static private function action_banlistnew($blogid = '')\r
5197         {\r
5198                 global $member, $manager;\r
5199                 \r
5200                 if ( $blogid == '' )\r
5201                 {\r
5202                         $blogid = intRequestVar('blogid');\r
5203                 }\r
5204                 \r
5205                 $ip = requestVar('ip');\r
5206                 \r
5207                 $member->blogAdminRights($blogid) or self::disallow();\r
5208                 \r
5209                 /* TODO: we should consider to use the other way instead of this */\r
5210                 $_REQUEST['blogid'] = $blogid;          \r
5211                 \r
5212                 self::pagehead();\r
5213                 self::$skin->parse('banlistnew');\r
5214                 self::pagefoot();\r
5215                 \r
5216                 return;\r
5217         }\r
5218 \r
5219         /**\r
5220          * Admin::action_banlistadd()\r
5221          * \r
5222          * @param       void\r
5223          * @return      void\r
5224          */\r
5225         static private function action_banlistadd()\r
5226         {\r
5227                 global $member;\r
5228                 \r
5229                 $blogid         = intPostVar('blogid');\r
5230                 $allblogs       = postVar('allblogs');\r
5231                 $iprange        = postVar('iprange');\r
5232                 \r
5233                 if ( $iprange == "custom" )\r
5234                 {\r
5235                         $iprange = postVar('customiprange');\r
5236                 }\r
5237                 $reason   = postVar('reason');\r
5238                 \r
5239                 $member->blogAdminRights($blogid) or self::disallow();\r
5240                 \r
5241                 // TODO: check IP range validity\r
5242                 \r
5243                 if ( !$allblogs )\r
5244                 {\r
5245                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5246                         {\r
5247                                 self::error(_ERROR_ADDBAN);\r
5248                         }\r
5249                 }\r
5250                 else\r
5251                 {\r
5252                         // get blogs fot which member has admin rights\r
5253                         $adminblogs = $member->getAdminBlogs();\r
5254                         $failed = 0;\r
5255                         foreach ($adminblogs as $blogje)\r
5256                         {\r
5257                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5258                                 {\r
5259                                         $failed = 1;\r
5260                                 }\r
5261                         }\r
5262                         if ( $failed )\r
5263                         {\r
5264                                 self::error(_ERROR_ADDBAN);\r
5265                         }\r
5266                 }\r
5267                 self::action_banlist();\r
5268                 return;\r
5269         }\r
5270         \r
5271         /**\r
5272          * Admin::action_clearactionlog()\r
5273          * \r
5274          * @param       void\r
5275          * @return      void\r
5276          */\r
5277         static private function action_clearactionlog()\r
5278         {\r
5279                 global $member;\r
5280                 \r
5281                 $member->isAdmin() or self::disallow();\r
5282                 \r
5283                 ActionLog::clear();\r
5284                 \r
5285                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5286                 return;\r
5287         }\r
5288         \r
5289         /**\r
5290          * Admin::action_backupoverview()\r
5291          * \r
5292          * @param       void\r
5293          * @return      void\r
5294          */\r
5295         static private function action_backupoverview()\r
5296         {\r
5297                 global $member, $manager;\r
5298                 \r
5299                 $member->isAdmin() or self::disallow();\r
5300                 \r
5301                 self::pagehead();\r
5302                 self::$skin->parse('backupoverview');\r
5303                 self::pagefoot();\r
5304                 return;\r
5305         }\r
5306 \r
5307         /**\r
5308          * Admin::action_backupcreate()\r
5309          * create file for backup\r
5310          * \r
5311          * @param               void\r
5312          * @return      void\r
5313          * \r
5314          */\r
5315         static private function action_backupcreate()\r
5316         {\r
5317                 global $member, $DIR_LIBS;\r
5318                 \r
5319                 $member->isAdmin() or self::disallow();\r
5320                 \r
5321                 // use compression ?\r
5322                 $useGzip = (integer) postVar('gzip');\r
5323                 \r
5324                 include($DIR_LIBS . 'backup.php');\r
5325                 \r
5326                 // try to extend time limit\r
5327                 // (creating/restoring dumps might take a while)\r
5328                 @set_time_limit(1200);\r
5329                 \r
5330                 Backup::do_backup($useGzip);\r
5331                 exit;\r
5332         }\r
5333         \r
5334         /**\r
5335          * Admin::action_backuprestore()\r
5336          * restoring from uploaded file\r
5337          * \r
5338          * @param               void\r
5339          * @return      void\r
5340          */\r
5341         static private function action_backuprestore()\r
5342         {\r
5343                 global $member, $DIR_LIBS;\r
5344                 \r
5345                 $member->isAdmin() or self::disallow();\r
5346                 \r
5347                 if ( intPostVar('letsgo') != 1 )\r
5348                 {\r
5349                         self::error(_ERROR_BACKUP_NOTSURE);\r
5350                 }\r
5351                 \r
5352                 include($DIR_LIBS . 'backup.php');\r
5353                 \r
5354                 // try to extend time limit\r
5355                 // (creating/restoring dumps might take a while)\r
5356                 @set_time_limit(1200);\r
5357                 \r
5358                 $message = Backup::do_restore();\r
5359                 if ( $message != '' )\r
5360                 {\r
5361                         self::error($message);\r
5362                 }\r
5363                 self::pagehead();\r
5364                 self::$skin->parse('backuprestore');\r
5365                 self::pagefoot();\r
5366                 return;\r
5367         }\r
5368         \r
5369         /**\r
5370          * Admin::action_pluginlist()\r
5371          * output the list of installed plugins\r
5372          * \r
5373          * @param       void\r
5374          * @return      void\r
5375          * \r
5376          */\r
5377         static private function action_pluginlist()\r
5378         {\r
5379                 global $DIR_PLUGINS, $member, $manager;\r
5380                 \r
5381                 // check if allowed\r
5382                 $member->isAdmin() or self::disallow();\r
5383                 \r
5384                 self::pagehead();\r
5385                 self::$skin->parse('pluginlist');\r
5386                 self::pagefoot();\r
5387                 return;\r
5388         }\r
5389         \r
5390         /**\r
5391          * Admin::action_pluginhelp()\r
5392          * \r
5393          * @param       void\r
5394          * @return      void\r
5395          */\r
5396         static private function action_pluginhelp()\r
5397         {\r
5398                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5399                 \r
5400                 // check if allowed\r
5401                 $member->isAdmin() or self::disallow();\r
5402                 \r
5403                 $plugid = intGetVar('plugid');\r
5404                 \r
5405                 if ( !$manager->pidInstalled($plugid) )\r
5406                 {\r
5407                         self::error(_ERROR_NOSUCHPLUGIN);\r
5408                 }\r
5409                 \r
5410                 self::pagehead();\r
5411                 self::$skin->parse('pluginhelp');\r
5412                 self::pagefoot();\r
5413                 return;\r
5414         }\r
5415         \r
5416         /**\r
5417          * Admin::action_pluginadd()\r
5418          * \r
5419          * @param       Void\r
5420          * @return      Void\r
5421          * \r
5422          */\r
5423         static private function action_pluginadd()\r
5424         {\r
5425                 global $member, $manager, $DIR_PLUGINS;\r
5426                 \r
5427                 // check if allowed\r
5428                 $member->isAdmin() or self::disallow();\r
5429                 \r
5430                 $name = postVar('filename');\r
5431                 \r
5432                 if ( $manager->pluginInstalled($name) )\r
5433                 {\r
5434                         self::error(_ERROR_DUPPLUGIN);\r
5435                 }\r
5436                 \r
5437                 if ( !checkPlugin($name) )\r
5438                 {\r
5439                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5440                 }\r
5441                 \r
5442                 // get number of currently installed plugins\r
5443                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5444                 $numCurrent = sql_num_rows($res);\r
5445                 \r
5446                 // plugin will be added as last one in the list\r
5447                 $newOrder = $numCurrent + 1;\r
5448                 \r
5449                 $data = array('file' => &$name);\r
5450                 $manager->notify('PreAddPlugin', $data);\r
5451                 \r
5452                 // do this before calling getPlugin (in case the plugin id is used there)\r
5453                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5454                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5455                 sql_query($query);\r
5456                 $iPid = sql_insert_id();\r
5457                 \r
5458                 $manager->clearCachedInfo('installedPlugins');\r
5459                 \r
5460                 // Load the plugin for condition checking and instalation\r
5461                 $plugin =& $manager->getPlugin($name);\r
5462                 \r
5463                 // check if it got loaded (could have failed)\r
5464                 if ( !$plugin )\r
5465                 {\r
5466                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5467                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5468                         \r
5469                         sql_query($query);\r
5470                         \r
5471                         $manager->clearCachedInfo('installedPlugins');\r
5472                         self::error(_ERROR_PLUGIN_LOAD);\r
5473                 }\r
5474                 \r
5475                 // check if plugin needs a newer Nucleus version\r
5476                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5477                 {\r
5478                         // uninstall plugin again...\r
5479                         self::deleteOnePlugin($plugin->getID());\r
5480                         \r
5481                         // ...and show error\r
5482                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5483                 }\r
5484                 \r
5485                 // check if plugin needs a newer Nucleus version\r
5486                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5487                 {\r
5488                         // uninstall plugin again...\r
5489                         self::deleteOnePlugin($plugin->getID());\r
5490                         \r
5491                         // ...and show error\r
5492                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5493                 }\r
5494                 \r
5495                 $pluginList = $plugin->getPluginDep();\r
5496                 foreach ( $pluginList as $pluginName )\r
5497                 {\r
5498                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5499                         if (sql_num_rows($res) == 0)\r
5500                         {\r
5501                                 // uninstall plugin again...\r
5502                                 self::deleteOnePlugin($plugin->getID());\r
5503                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5504                         }\r
5505                 }\r
5506                 \r
5507                 // call the install method of the plugin\r
5508                 $plugin->install();\r
5509                 \r
5510                 $data = array('plugin' => &$plugin);\r
5511                 $manager->notify('PostAddPlugin', $data);\r
5512                 \r
5513                 // update all events\r
5514                 self::action_pluginupdate();\r
5515                 return;\r
5516         }\r
5517         \r
5518         /**\r
5519          * ADMIN:action_pluginupdate():\r
5520          * \r
5521          * @param       Void\r
5522          * @return      Void\r
5523          * \r
5524          */\r
5525         static private function action_pluginupdate()\r
5526         {\r
5527                 global $member, $manager, $CONF;\r
5528                 \r
5529                 // check if allowed\r
5530                 $member->isAdmin() or self::disallow();\r
5531                 \r
5532                 // delete everything from plugin_events\r
5533                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5534                 \r
5535                 // loop over all installed plugins\r
5536                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5537                 while ( $o = sql_fetch_object($res) )\r
5538                 {\r
5539                         $pid  =  $o->pid;\r
5540                         $plug =& $manager->getPlugin($o->pfile);\r
5541                         if ( $plug )\r
5542                         {\r
5543                                 $eventList = $plug->getEventList();\r
5544                                 foreach ( $eventList as $eventName )\r
5545                                 {\r
5546                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5547                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5548                                         sql_query($query);\r
5549                                 }\r
5550                         }\r
5551                 }\r
5552                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5553                 return;\r
5554         }\r
5555         \r
5556         /**\r
5557          * Admin::action_plugindelete()\r
5558          * \r
5559          * @param       void\r
5560          * @return      void\r
5561          */\r
5562         static private function action_plugindelete()\r
5563         {\r
5564                 global $member, $manager;\r
5565                 \r
5566                 // check if allowed\r
5567                 $member->isAdmin() or self::disallow();\r
5568                 \r
5569                 $pid = intGetVar('plugid');\r
5570                 \r
5571                 if ( !$manager->pidInstalled($pid) )\r
5572                 {\r
5573                         self::error(_ERROR_NOSUCHPLUGIN);\r
5574                 }\r
5575                 \r
5576                 self::pagehead();\r
5577                 self::$skin->parse('plugindelete');\r
5578                 self::pagefoot();\r
5579                 return;\r
5580         }\r
5581 \r
5582         /**\r
5583          * Admin::action_plugindeleteconfirm()\r
5584          * \r
5585          * @param       void\r
5586          * @return      void\r
5587          */\r
5588         static private function action_plugindeleteconfirm()\r
5589         {\r
5590                 global $member, $manager, $CONF;\r
5591                 \r
5592                 // check if allowed\r
5593                 $member->isAdmin() or self::disallow();\r
5594                 \r
5595                 $pid = intPostVar('plugid');\r
5596                 \r
5597                 $error = self::deleteOnePlugin($pid, 1);\r
5598                 if ( $error )\r
5599                 {\r
5600                         self::error($error);\r
5601                 }\r
5602                 \r
5603                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5604                 return;\r
5605         }\r
5606         \r
5607         /**\r
5608          * Admin::\r
5609          * \r
5610          * @param       void\r
5611          * @return      void\r
5612          */\r
5613         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5614         {\r
5615                 global $manager;\r
5616                 \r
5617                 $pid = intval($pid);\r
5618                 \r
5619                 if ( !$manager->pidInstalled($pid) )\r
5620                 {\r
5621                         return _ERROR_NOSUCHPLUGIN;\r
5622                 }\r
5623                 \r
5624                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5625                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5626                 $name = quickQuery($query);\r
5627                 \r
5628                 // check dependency before delete\r
5629                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5630                 while ($o = sql_fetch_object($res))\r
5631                 {\r
5632                         $plug =& $manager->getPlugin($o->pfile);\r
5633                         if ( $plug )\r
5634                         {\r
5635                                 $depList = $plug->getPluginDep();\r
5636                                 foreach ( $depList as $depName )\r
5637                                 {\r
5638                                         if ( $name == $depName )\r
5639                                         {\r
5640                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5641                                         }\r
5642                                 }\r
5643                         }\r
5644                 }\r
5645                 \r
5646                 $data = array('plugid' => $pid);\r
5647                 $manager->notify('PreDeletePlugin', $data);\r
5648                 \r
5649                 // call the unInstall method of the plugin\r
5650                 if ( $callUninstall )\r
5651                 {\r
5652                         $plugin =& $manager->getPlugin($name);\r
5653                         if ( $plugin )\r
5654                         {\r
5655                                 $plugin->unInstall();\r
5656                         }\r
5657                 }\r
5658                 \r
5659                 // delete all subscriptions\r
5660                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5661                 \r
5662                 // delete all options\r
5663                 // get OIDs from plugin_option_desc\r
5664                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5665                 $aOIDs = array();\r
5666                 while ($o = sql_fetch_object($res))\r
5667                 {\r
5668                         array_push($aOIDs, $o->oid);\r
5669                 }\r
5670                 \r
5671                 // delete from plugin_option and plugin_option_desc\r
5672                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5673                 if (count($aOIDs) > 0)\r
5674                 {\r
5675                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5676                 }\r
5677                 \r
5678                 // update order numbers\r
5679                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5680                 $o = sql_fetch_object($res);\r
5681                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5682                 \r
5683                 // delete row\r
5684                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5685                 \r
5686                 $manager->clearCachedInfo('installedPlugins');\r
5687                 $data = array('plugid' => $pid);\r
5688                 $manager->notify('PostDeletePlugin', $data);\r
5689                 \r
5690                 return '';\r
5691         }\r
5692         \r
5693         /**\r
5694          * Admin::action_pluginup()\r
5695          * \r
5696          * @param       void\r
5697          * @return      void\r
5698          */\r
5699         static private function action_pluginup()\r
5700         {\r
5701                 global $member, $manager, $CONF;\r
5702                 \r
5703                 // check if allowed\r
5704                 $member->isAdmin() or self::disallow();\r
5705                 \r
5706                 $plugid = intGetVar('plugid');\r
5707                 \r
5708                 if ( !$manager->pidInstalled($plugid) )\r
5709                 {\r
5710                         self::error(_ERROR_NOSUCHPLUGIN);\r
5711                 }\r
5712                 \r
5713                 // 1. get old order number\r
5714                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5715                 $o = sql_fetch_object($res);\r
5716                 $oldOrder = $o->porder;\r
5717                 \r
5718                 // 2. calculate new order number\r
5719                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5720                 \r
5721                 // 3. update plug numbers\r
5722                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5723                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5724                 \r
5725                 //self::action_pluginlist();\r
5726                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5727                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5728                 return;\r
5729         }\r
5730         \r
5731         /**\r
5732          * Admin::action_plugindown()\r
5733          * \r
5734          * @param       void\r
5735          * @return      void\r
5736          */\r
5737         static private function action_plugindown()\r
5738         {\r
5739                 global $member, $manager, $CONF;\r
5740                 \r
5741                 // check if allowed\r
5742                 $member->isAdmin() or self::disallow();\r
5743                 \r
5744                 $plugid = intGetVar('plugid');\r
5745                 if ( !$manager->pidInstalled($plugid) )\r
5746                 {\r
5747                         self::error(_ERROR_NOSUCHPLUGIN);\r
5748                 }\r
5749                 \r
5750                 // 1. get old order number\r
5751                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5752                 $o = sql_fetch_object($res);\r
5753                 $oldOrder = $o->porder;\r
5754                 \r
5755                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5756                 $maxOrder = sql_num_rows($res);\r
5757                 \r
5758                 // 2. calculate new order number\r
5759                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5760                 \r
5761                 // 3. update plug numbers\r
5762                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5763                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5764                 \r
5765                 //self::action_pluginlist();\r
5766                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5767                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5768                 return;\r
5769         }\r
5770         \r
5771         /**\r
5772          * Admin::action_pluginoptions()\r
5773          * \r
5774          * Output Plugin option page\r
5775          * \r
5776          * @access      public\r
5777          * @param       string $message message when fallbacked\r
5778          * @return      void\r
5779          * \r
5780          */\r
5781         static private function action_pluginoptions($message = '')\r
5782         {\r
5783                 global $member, $manager;\r
5784                 \r
5785                 // check if allowed\r
5786                 $member->isAdmin() or self::disallow();\r
5787                 \r
5788                 $pid = intRequestVar('plugid');\r
5789                 if ( !$manager->pidInstalled($pid) )\r
5790                 {\r
5791                         self::error(_ERROR_NOSUCHPLUGIN);\r
5792                 }\r
5793                 \r
5794                 if ( isset($message) )\r
5795                 {\r
5796                         self::$headMess = $message;\r
5797                 }\r
5798                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5799                 self::pagehead($extrahead);\r
5800                 self::$skin->parse('pluginoptions');\r
5801                 self::pagefoot();\r
5802                 return;\r
5803         }\r
5804         \r
5805         /**\r
5806          * Admin::action_pluginoptionsupdate()\r
5807          * \r
5808          * Update plugin options and fallback to plugin option page\r
5809          * \r
5810          * @access      public\r
5811          * @param       void\r
5812          * @return      void\r
5813          */\r
5814         static private function action_pluginoptionsupdate()\r
5815         {\r
5816                 global $member, $manager;\r
5817                 \r
5818                 // check if allowed\r
5819                 $member->isAdmin() or self::disallow();\r
5820                 \r
5821                 $pid = intRequestVar('plugid');\r
5822                 \r
5823                 if ( !$manager->pidInstalled($pid) )\r
5824                 {\r
5825                         self::error(_ERROR_NOSUCHPLUGIN);\r
5826                 }\r
5827                 \r
5828                 $aOptions = requestArray('plugoption');\r
5829                 NucleusPlugin::apply_plugin_options($aOptions);\r
5830                 \r
5831                 $data = array(\r
5832                         'context'       => 'global',\r
5833                         'plugid'        => $pid\r
5834                 );\r
5835                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5836                 \r
5837                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5838                 return;\r
5839         }\r
5840         \r
5841         /**\r
5842          * Admin::insertPluginOptions()\r
5843          * \r
5844          * Output plugin option field\r
5845          * \r
5846          * @access      public\r
5847          * @param string        $context        plugin option context\r
5848          * @param integer       $contextid      plugin option context id\r
5849          * @return      void\r
5850          */\r
5851         static public function insertPluginOptions($context, $contextid = 0)\r
5852         {\r
5853                 global $manager;\r
5854                 \r
5855                 // get all current values for this contextid\r
5856                 // (note: this might contain doubles for overlapping contextids)\r
5857                 $aIdToValue = array();\r
5858                 \r
5859                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5860                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5861                 \r
5862                 $res = sql_query($query);\r
5863                 while ( $object = sql_fetch_object($res) )\r
5864                 {\r
5865                         $aIdToValue[$object->oid] = $object->ovalue;\r
5866                 }\r
5867                 \r
5868                 // get list of oids per pid\r
5869                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5870                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5871                 $res    = sql_query($query);\r
5872                 \r
5873                 $aOptions = array();\r
5874                 while ( $object = sql_fetch_object($res) )\r
5875                 {\r
5876                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5877                         {\r
5878                                 $value = $object->odef;\r
5879                         }\r
5880                         else\r
5881                         {\r
5882                                 $value = $aIdToValue[$object->oid];\r
5883                         }\r
5884                         \r
5885                         array_push(\r
5886                                 $aOptions,\r
5887                                 array(\r
5888                                         'pid'                   => $object->pid,\r
5889                                         'pfile'                 => $object->pfile,\r
5890                                         'oid'                   => $object->oid,\r
5891                                         'value'                 => $value,\r
5892                                         'name'                  => $object->oname,\r
5893                                         'description'   => $object->odesc,\r
5894                                         'type'                  => $object->otype,\r
5895                                         'typeinfo'              => $object->oextra,\r
5896                                         'contextid'             => $contextid,\r
5897                                         'extra'                 => ''\r
5898                                 )\r
5899                         );\r
5900                 }\r
5901                 \r
5902                 $data = array(\r
5903                         'context'       =>  $context,\r
5904                         'contextid'     =>  $contextid,\r
5905                         'options'       =>& $aOptions\r
5906                 );\r
5907                 $manager->notify('PrePluginOptionsEdit', $data);\r
5908                 \r
5909                 self::$aOptions = $aOptions;\r
5910                 self::$skin->parse('insertpluginoptions');\r
5911                 return;\r
5912         }\r
5913         \r
5914         /**\r
5915          * Admin::action_parseSpecialskin()\r
5916          * \r
5917          * @param       void\r
5918          * @return      void\r
5919          */\r
5920         static private function action_parseSpecialskin()\r
5921         {\r
5922                 self::pagehead();\r
5923                 self::$skin->parse(self::$action);\r
5924                 self::pagefoot();\r
5925                 return;\r
5926         }\r
5927         \r
5928         /**\r
5929          * Admin::getAdminskinIDFromName()\r
5930          * \r
5931          * @param       string  $skinname       name of skin\r
5932          * @return      integer ID for skin\r
5933          */\r
5934         static private function getAdminskinIDFromName($skinname)\r
5935         {\r
5936                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5937                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5938                 $admnSknID      = quickQuery($query);\r
5939                 return (integer) $adminSkinID;\r
5940         }\r
5941         \r
5942         /**\r
5943          * Admin::getAdminskinNameFromID()\r
5944          * \r
5945          * @param       integer $skinid ID for skin\r
5946          * @return      integer ID for skin\r
5947          */\r
5948         static private function getAdminskinNameFromID($skinid)\r
5949         {\r
5950                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5951                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5952                 $admnSknID      = quickQuery($query);\r
5953                 return (integer) $adminSkinID;\r
5954         }\r
5955         \r
5956         /**\r
5957          * Admin::getAdminextrahead()\r
5958          */\r
5959         static function getAdminextrahead()\r
5960         {\r
5961                 return self::$extrahead;\r
5962         }\r
5963         \r
5964         /**\r
5965          * Admin::getAdminpassvar()\r
5966          */\r
5967         static function getAdminpassvar()\r
5968         {\r
5969                 return self::$passvar;\r
5970         }\r
5971         \r
5972         /**\r
5973          * Admin::getAdminAction()\r
5974          */\r
5975         static function getAdminAction()\r
5976         {\r
5977                 return self::$action;\r
5978         }\r
5979         \r
5980         /**\r
5981          * Admin::getAdminaOption()\r
5982          */\r
5983         static function getAdminaOption()\r
5984         {\r
5985                 return self::$aOptions;\r
5986         }\r
5987         \r
5988         /**\r
5989          * Admin::action_importAdmin()\r
5990          * \r
5991          * @param       void\r
5992          * @return      void\r
5993          */\r
5994         static private function action_importAdmin()\r
5995         {\r
5996                 global $DIR_ADMINSKINS, $action;\r
5997                 if ( $action == 'adminskinieimport' )\r
5998                 {\r
5999                         self::doAdminskinimport();\r
6000                 }\r
6001                 $skn = array();\r
6002                 if ( $action == 'showlogin' )\r
6003                 {\r
6004                         $skinName = 'showlogin';\r
6005                         $actnName = 'showlogin';\r
6006                 }\r
6007                 else\r
6008                 {\r
6009                         $skinName = 'defaultimporter';\r
6010                         $actnName = 'importAdmin';\r
6011                 }\r
6012                 \r
6013                 /* TODO: why??? */\r
6014                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6015                 $skn['id']                              = 0;\r
6016                 $skn['description']             = $skinName;\r
6017                 $skn['contentType']             = 'importAdmin';\r
6018                 $skn['includeMode']             = 'normal';\r
6019                 $skn['includePrefix']   = '';\r
6020                 $skn['name']                    = 'defaultinporter';\r
6021                 \r
6022                 self::$skin                             = (object) $skn;\r
6023                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6024                 $handler->setSkin(self::$skin);\r
6025                 \r
6026                 $parser = new PARSER($handler);\r
6027                 $parser->parse($contents);\r
6028                 \r
6029                 return;\r
6030         }\r
6031         \r
6032         /**\r
6033          * Admin::doAdminskinimport()\r
6034          * \r
6035          * @param       void\r
6036          * @return      void\r
6037          */\r
6038         static private function doAdminskinimport()\r
6039         {\r
6040                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6041                 \r
6042                 $member->isAdmin() or self::disallow();\r
6043                 \r
6044                 include_once($DIR_LIBS . 'Skinie.php');\r
6045                 $skinFileRaw    = postVar('skinfile');\r
6046                 $mode                   = postVar('mode');\r
6047                 $allowOverwrite = intPostVar('overwrite');\r
6048                 \r
6049                 if ( $mode == 'file' )\r
6050                 {\r
6051                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6052                 }\r
6053                 else\r
6054                 {\r
6055                         $skinFile = $skinFileRaw;\r
6056                 }\r
6057                 \r
6058                 $importer       = new SKINIMPORT();\r
6059                 $error          = $importer->readFile($skinFile);\r
6060                 if ( $error )\r
6061                 {\r
6062                         self::error($error);\r
6063                 }\r
6064                 $error = $importer->writeToDatabase($allowOverwrite);\r
6065                 if ( $error )\r
6066                 {\r
6067                         self::error($error);\r
6068                 }\r
6069                 \r
6070                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6071                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6072                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6073                 \r
6074                 header('Location: ' . $CONF['AdminURL']);\r
6075                 exit;\r
6076         }\r
6077 }\r