nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static private $action;\r
  31         static private $skin;\r
  32         static private $extrahead;\r
  33         static private $passvar;\r
  34         static private $headMess;\r
  35         static private $aOptions;\r
  36         \r
  37         /**\r
  38          * Admin::$edit_actions\r
  39          */\r
  40         static private $edit_actions = array(\r
  41                 'adminskinoverview',\r
  42                 'adminskinieoverview',\r
  43                 'adminskinedittype',\r
  44                 'adminskinremovetype',\r
  45                 'adminskindelete',\r
  46                 'adminskinedit',\r
  47                 'adminskinieimport',\r
  48                 'adminskiniedoimport',\r
  49                 'admintemplateedit',\r
  50                 'admintemplateoverview',\r
  51                 'admintemplatedelete'\r
  52         );\r
  53         \r
  54         /**\r
  55          * Admin::$skinless_actions\r
  56          */\r
  57         static private $skinless_actions = array(\r
  58                 'plugindeleteconfirm',\r
  59                 'pluginoptionsupdate',\r
  60                 'skinremovetypeconfirm',\r
  61                 'skinclone',\r
  62                 'skindeleteconfirm',\r
  63                 'skinnew',\r
  64                 'skineditgeneral',\r
  65                 'skinieexport',\r
  66                 'skinupdate',\r
  67                 'templateupdate',\r
  68                 'templatedeleteconfirm',\r
  69                 'templatenew',\r
  70                 'templateclone',\r
  71                 'adminskinremovetypeconfirm',\r
  72                 'adminskinclone',\r
  73                 'adminskindeleteconfirm',\r
  74                 'adminskinnew',\r
  75                 'adminskineditgeneral',\r
  76                 'adminskinieexport',\r
  77                 'adminskinupdate',\r
  78                 'admintemplateupdate',\r
  79                 'admintemplatedeleteconfirm',\r
  80                 'admintemplatenew',\r
  81                 'admintemplateclone',\r
  82                 'blogsettingsupdate',\r
  83                 'settingsupdate',\r
  84                 'addnewlog2',\r
  85                 'additem',\r
  86                 'itemdeleteconfirm',\r
  87                 'itemupdate',\r
  88                 'changemembersettings',\r
  89                 'clearactionlog',\r
  90                 'memberedit'\r
  91         );\r
  92         \r
  93         static private $actions_needless_to_check = array(\r
  94                 'showlogin',\r
  95                 'login',\r
  96                 'overview',\r
  97                 'itemlist',\r
  98                 'blogcommentlist',\r
  99                 'bookmarklet',\r
 100                 'blogsettings',\r
 101                 'banlist',\r
 102                 'deleteblog',\r
 103                 'editmembersettings',\r
 104                 'browseownitems',\r
 105                 'browseowncomments',\r
 106                 'createitem',\r
 107                 'itemedit',\r
 108                 'itemmove',\r
 109                 'categoryedit',\r
 110                 'categorydelete',\r
 111                 'manage',\r
 112                 'actionlog',\r
 113                 'settingsedit',\r
 114                 'backupoverview',\r
 115                 'pluginlist',\r
 116                 'createnewlog',\r
 117                 'usermanagement',\r
 118                 'skinoverview',\r
 119                 'templateoverview',\r
 120                 'skinieoverview',\r
 121                 'itemcommentlist',\r
 122                 'commentedit',\r
 123                 'commentdelete',\r
 124                 'banlistnewfromitem',\r
 125                 'banlistdelete',\r
 126                 'itemdelete',\r
 127                 'manageteam',\r
 128                 'teamdelete',\r
 129                 'banlistnew',\r
 130                 'memberedit',\r
 131                 'memberdelete',\r
 132                 'pluginhelp',\r
 133                 'pluginoptions',\r
 134                 'plugindelete',\r
 135                 'skinedittype',\r
 136                 'skinremovetype',\r
 137                 'skindelete',\r
 138                 'skinedit',\r
 139                 'templateedit',\r
 140                 'templatedelete',\r
 141                 'activate',\r
 142                 'systemoverview',\r
 143                 'activatesetpwd',\r
 144         );\r
 145         \r
 146         static public function initialize()\r
 147         {\r
 148                 global $CONF, $DIR_LIBS;\r
 149                 \r
 150                 /* NOTE: 1. decide which skinid to use */\r
 151                 $skinid = $CONF['DefaultAdminSkin'];\r
 152                 /*\r
 153                  * NOTE: this is temporary escaped because not implemented yet\r
 154                 if (isset($member) && $member->isLoggedIn())\r
 155                 {\r
 156                         $memskin = $member->getAdminSkin();\r
 157                         if ( $memskin )\r
 158                         {\r
 159                                 $skinid = $memskin;\r
 160                         }\r
 161                 }\r
 162                 */\r
 163                 \r
 164                 /* NOTE: 2. make an instance of skin object */\r
 165                 if ( !Skin::existsID($skinid) )\r
 166                 {\r
 167                         return FALSE;\r
 168                 }\r
 169                 \r
 170                 /* NOTE: 3. initializing each members */\r
 171                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 172                 self::$action           = '';\r
 173                 self::$extrahead        = '';\r
 174                 self::$passvar          = '';\r
 175                 self::$headMess         = '';\r
 176                 self::$aOptions         = '';\r
 177                 return TRUE;\r
 178         }\r
 179         \r
 180         /**\r
 181          * Admin::action()\r
 182          * Executes an action\r
 183          *\r
 184          * @param       string  $action action to be performed\r
 185          * @return      void\r
 186          */\r
 187         static public function action($action)\r
 188         {\r
 189                 global $CONF, $DIR_LIBS, $manager, $member;\r
 190                 \r
 191                 /* 1. decide action name */\r
 192                 $customAction = postvar('customaction');\r
 193                 if ( !empty($customAction) )\r
 194                 {\r
 195                         $alias = array(\r
 196                                 'login' => $customAction,\r
 197                                 ''              => $customAction\r
 198                         );\r
 199                 }\r
 200                 else\r
 201                 {\r
 202                         $alias = array(\r
 203                                 'login' => 'overview',\r
 204                                 ''              => 'overview'\r
 205                         );\r
 206                 }\r
 207                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 208                 {\r
 209                         $action = $alias[$action];\r
 210                 }\r
 211                 $methodName = "action_{$action}";\r
 212                 self::$action = strtolower($action);\r
 213                 \r
 214                 /* 2. check the action */\r
 215                 $synonimActions = array(\r
 216                         'banlistnewfromitem',\r
 217                         'memberedit',\r
 218                         'login',\r
 219                 );\r
 220                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 221                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 222                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 223                 {\r
 224                         if (!$manager->checkTicket())\r
 225                         {\r
 226                                 self::error(_ERROR_BADTICKET);\r
 227                         }\r
 228                 }\r
 229 \r
 230                 /* 3. parse according to the action */\r
 231                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 232                 {\r
 233                         /* TODO: what is this?\r
 234                         self::action_parseSpecialskin();\r
 235                         */\r
 236                 }\r
 237                 elseif ( method_exists('Admin', $methodName) )\r
 238                 {\r
 239                         call_user_func(array(__CLASS__, $methodName));\r
 240                 }\r
 241                 else if ( self::existsSkinContents('adminerrorpage') )\r
 242                 {\r
 243                         self::error(_BADACTION . ENTITY::hsc($action));\r
 244                 }\r
 245                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 246                 {\r
 247                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 248                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 249                         {\r
 250                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 251                         }\r
 252                 }\r
 253                 else\r
 254                 {\r
 255                         self::error(_BADACTION . ENTITY::hsc($action));\r
 256                 }\r
 257                 exit;\r
 258         }\r
 259         \r
 260         /**\r
 261          * Action::existsSkinContents()\r
 262          * Check skin contents\r
 263          *\r
 264          * @param       string  $action action type\r
 265          * @return      boolean\r
 266          */\r
 267         static private function existsSkinContents($action)\r
 268         {\r
 269                 $in_array  = in_array($action, self::$skinless_actions);\r
 270                 \r
 271                 if ( $in_array )\r
 272                 {\r
 273                         return $in_array;\r
 274                 }\r
 275                 else\r
 276                 {\r
 277                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 278                         /* TODO: skinid should be a default */\r
 279                         if ( !is_object(self::$skin) )\r
 280                         {\r
 281                                 global $CONF;\r
 282                                 return quickQuery(sprintf($query, sql_table('skin'), $CONF['DefaultAdminSkin'], sql_real_escape_string($action)));\r
 283                         }\r
 284                         else\r
 285                         {\r
 286                                 return quickQuery(sprintf($query, sql_table('skin'), self::$skin->getID(), sql_real_escape_string($action)));\r
 287                         }\r
 288                 }\r
 289                 return;\r
 290         }\r
 291         \r
 292         /**\r
 293          * Action::specialActionsAllow()\r
 294          * Check exists specialskinparts\r
 295          *\r
 296          * @param       string  $action action type\r
 297          * @return boolean\r
 298          */\r
 299         static private function specialActionsAllow($action)\r
 300         {\r
 301                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 302                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 303                 return quickQuery($query);\r
 304         }\r
 305         \r
 306         /**\r
 307          * Action::action_showlogin()\r
 308          * \r
 309          * @param       void\r
 310          * @return      void\r
 311          */\r
 312         static private function action_showlogin()\r
 313         {\r
 314                 global $error;\r
 315                 self::action_login($error);\r
 316                 return;\r
 317         }\r
 318         \r
 319         /**\r
 320          * Action::action_login()\r
 321          * \r
 322          * @param       string  $msg            message for pageheader\r
 323          * @param       integer $passvars       ???\r
 324          */\r
 325         static private function action_login($msg = '', $passvars = 1)\r
 326         {\r
 327                 global $member;\r
 328                 \r
 329                 // skip to overview when allowed\r
 330                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 331                 {\r
 332                         self::$action_overview();\r
 333                         exit;\r
 334                 }\r
 335                 \r
 336                 /* TODO: needless variable??? */\r
 337                 self::$passvar = $passvars;\r
 338                 if ( $msg )\r
 339                 {\r
 340                         self::$headMess = $msg;\r
 341                 }\r
 342                 \r
 343                 self::pagehead();\r
 344                 self::$skin->parse('showlogin');\r
 345                 self::pagefoot();\r
 346         }\r
 347         \r
 348         /**\r
 349          * Action::action_overview()\r
 350          * provides a screen with the overview of the actions available\r
 351          * \r
 352          * @param       string  $msg    message for pageheader\r
 353          * @return      void\r
 354          */\r
 355         static private function action_overview($msg = '')\r
 356         {\r
 357                 if ( $msg )\r
 358                 {\r
 359                         self::$headMess = $msg;\r
 360                 }\r
 361                 \r
 362                 self::pagehead();\r
 363                 self::$skin->parse('overview');\r
 364                 self::pagefoot();\r
 365                 return;\r
 366         }\r
 367         \r
 368         /**\r
 369          * Admin::action_manage()\r
 370          * \r
 371          * @param       string  $msg    message for pageheader\r
 372          * @retrn       void\r
 373          */\r
 374         static private function action_manage($msg = '')\r
 375         {\r
 376                 global $member;\r
 377                 \r
 378                 if ( $msg )\r
 379                 {\r
 380                         self::$headMess = $msg;\r
 381                 }\r
 382                 $member->isAdmin() or self::disallow();\r
 383                 \r
 384                 self::pagehead();\r
 385                 self::$skin->parse('manage');\r
 386                 self::pagefoot();\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::pagehead();\r
 408                 self::$skin->parse('itemlist');\r
 409                 self::pagefoot();\r
 410                 return;\r
 411         }\r
 412         \r
 413         /**\r
 414          * Action::action_batchitem()\r
 415          * \r
 416          * @param       void\r
 417          * @return      void\r
 418          */\r
 419         static private function action_batchitem()\r
 420         {\r
 421                 global $member, $manager;\r
 422                 \r
 423                 $member->isLoggedIn() or self::disallow();\r
 424                 \r
 425                 $selected       = requestIntArray('batch');\r
 426                 $action         = requestVar('batchaction');\r
 427                 \r
 428                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 429                 {\r
 430                         self::error(_BATCH_NOSELECTION);\r
 431                 }\r
 432                 \r
 433                 // On move: when no destination blog/category chosen, show choice now\r
 434                 $destCatid = intRequestVar('destcatid');\r
 435                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 436                 {\r
 437                         self::batchMoveSelectDestination('item', $selected);\r
 438                 }\r
 439                 \r
 440                 // On delete: check if confirmation has been given\r
 441                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 442                 {\r
 443                         self::batchAskDeleteConfirmation('item', $selected);\r
 444                 }\r
 445                 \r
 446                 self::pagehead();\r
 447                 self::$skin->parse('batchitem');\r
 448                 self::pagefoot();\r
 449                 return;\r
 450         }\r
 451         \r
 452         /**\r
 453          * Action::action_batchcomment()\r
 454          * \r
 455          * @param       void\r
 456          * @return      void\r
 457          */\r
 458         static private function action_batchcomment()\r
 459         {\r
 460                 global $member;\r
 461                 \r
 462                 $member->isLoggedIn() or self::disallow();\r
 463                 \r
 464                 $selected       = requestIntArray('batch');\r
 465                 $action         = requestVar('batchaction');\r
 466                 \r
 467                 // Show error when no items were selected\r
 468                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 469                 {\r
 470                         self::error(_BATCH_NOSELECTION);\r
 471                 }\r
 472                 \r
 473                 // On delete: check if confirmation has been given\r
 474                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 475                 {\r
 476                         self::batchAskDeleteConfirmation('comment',$selected);\r
 477                 }\r
 478                 \r
 479                 self::pagehead();\r
 480                 self::$skin->parse('batchcomment');\r
 481                 self::pagefoot();\r
 482                 return;\r
 483         }\r
 484         \r
 485         /**\r
 486          * Admin::setAdminAction()\r
 487          *\r
 488          * @param       string  $action\r
 489          * @return      void\r
 490          */\r
 491         static public function setAdminAction($action)\r
 492         {\r
 493                 self::$action = $action;\r
 494                 return;\r
 495         }\r
 496         \r
 497         /**\r
 498          * Admin::action_batchmember()\r
 499          * \r
 500          * @param       void\r
 501          * @return      void\r
 502          */\r
 503         static private function action_batchmember()\r
 504         {\r
 505                 global $member;\r
 506                 \r
 507                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 508                 \r
 509                 $selected       = requestIntArray('batch');\r
 510                 $action         = requestVar('batchaction');\r
 511                 \r
 512                 // Show error when no members selected\r
 513                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 514                 {\r
 515                         self::error(_BATCH_NOSELECTION);\r
 516                 }\r
 517                 \r
 518                 // On delete: check if confirmation has been given\r
 519                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 520                 {\r
 521                         self::batchAskDeleteConfirmation('member',$selected);\r
 522                 }\r
 523                 \r
 524                 self::pagehead();\r
 525                 self::$skin->parse('batchmember');\r
 526                 self::pagefoot();\r
 527                 return;\r
 528         }\r
 529         \r
 530         /**\r
 531          * Admin::action_batchteam()\r
 532          * \r
 533          * @param       void\r
 534          * @return      void\r
 535          */\r
 536         static private function action_batchteam()\r
 537         {\r
 538                 global $member;\r
 539                 \r
 540                 $blogid = intRequestVar('blogid');\r
 541                 \r
 542                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 543                 \r
 544                 $selected       = requestIntArray('batch');\r
 545                 $action         = requestVar('batchaction');\r
 546                 \r
 547                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 548                 {\r
 549                         self::error(_BATCH_NOSELECTION);\r
 550                 }\r
 551                 \r
 552                 // On delete: check if confirmation has been given\r
 553                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 554                 {\r
 555                         self::batchAskDeleteConfirmation('team',$selected);\r
 556                 }\r
 557                 \r
 558                 self::pagehead();\r
 559                 self::$skin->parse('batchteam');\r
 560                 self::pagefoot();\r
 561                 return;\r
 562         }\r
 563         \r
 564         /**\r
 565          * Admin::action_batchcategory()\r
 566          * \r
 567          * @param       void\r
 568          * @return      void\r
 569          */\r
 570         static private function action_batchcategory()\r
 571         {\r
 572                 global $member, $manager;\r
 573                 \r
 574                 $member->isLoggedIn() or self::disallow();\r
 575                 \r
 576                 $selected       = requestIntArray('batch');\r
 577                 $action         = requestVar('batchaction');\r
 578                 \r
 579                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 580                 {\r
 581                         self::error(_BATCH_NOSELECTION);\r
 582                 }\r
 583                 \r
 584                 // On move: when no destination blog chosen, show choice now\r
 585                 $destBlogId = intRequestVar('destblogid');\r
 586                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 587                 {\r
 588                         self::batchMoveCategorySelectDestination('category', $selected);\r
 589                 }\r
 590                 \r
 591                 // On delete: check if confirmation has been given\r
 592                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 593                 {\r
 594                         self::batchAskDeleteConfirmation('category', $selected);\r
 595                 }\r
 596                 \r
 597                 self::pagehead();\r
 598                 self::$skin->parse('batchcategory');\r
 599                 self::pagefoot();\r
 600                 return;\r
 601         }\r
 602         \r
 603         /**\r
 604          * Admin::batchMoveSelectDestination()\r
 605          * \r
 606          * @param       string  $type   type of batch action\r
 607          * @param       integer $ids    needless???\r
 608          * @return      void\r
 609          * \r
 610          * TODO: remove needless argument\r
 611          */\r
 612         static private function batchMoveSelectDestination($type, $ids)\r
 613         {\r
 614                 $_POST['batchmove'] = $type;\r
 615                 self::pagehead();\r
 616                 self::$skin->parse('batchmove');\r
 617                 self::pagefoot();\r
 618                 return;\r
 619         }\r
 620         \r
 621         /**\r
 622          * Admin::batchMoveCategorySelectDestination()\r
 623          * \r
 624          * @param       string  $type   type of batch action\r
 625          * @param       integer $ids    needless???\r
 626          * @return      void\r
 627          * \r
 628          * TODO: remove needless argument\r
 629          */\r
 630         static private function batchMoveCategorySelectDestination($type, $ids)\r
 631         {\r
 632                 $_POST['batchmove'] = $type;\r
 633                 global $manager;\r
 634                 self::pagehead();\r
 635                 self::$skin->parse('batchmovecat');\r
 636                 self::pagefoot();\r
 637                 return;\r
 638         }\r
 639         \r
 640         /**\r
 641          * Admin::batchAskDeleteConfirmation()\r
 642          * \r
 643          * @param       string  $type   type of batch action\r
 644          * @param       integer $ids    needless???\r
 645          * @return      void\r
 646          * \r
 647          * TODO: remove needless argument\r
 648          */\r
 649         static private function batchAskDeleteConfirmation($type, $ids)\r
 650         {\r
 651                 self::pagehead();\r
 652                 self::$skin->parse('batchdelete');\r
 653                 self::pagefoot();\r
 654                 return;\r
 655         }\r
 656         \r
 657         /**\r
 658          * Admin::selectBlogCategory()\r
 659          * Inserts a HTML select element with choices for all categories to which the current\r
 660          * member has access\r
 661          *\r
 662          * @see function selectBlog\r
 663          * @param       string  $name                           name of weblod\r
 664          * @param       integer $selected                       \r
 665          * @param       integer $tabindex                       \r
 666          * @param       integer $showNewCat                     \r
 667          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 668          * @return      void\r
 669          *\r
 670          * NOTE: callback from AdminAction\r
 671          */\r
 672         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 673         {\r
 674                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 675                 return;\r
 676         }\r
 677         \r
 678         /**\r
 679          * Admin::selectBlog()\r
 680          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 681          *      mode = 'blog' => shows blognames and values are blogids\r
 682          *      mode = 'category' => show category names and values are catids\r
 683          *\r
 684          * @param       string  $name                           name of weblod\r
 685          * @param       string  $mode                           \r
 686          * @param       integer $selected                       \r
 687          * @param       integer $tabindex                       \r
 688          * @param       integer $showNewCat                     \r
 689          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 690          * @param $iForcedBlogInclude\r
 691          *      ID of a blog that always needs to be included, without checking if the\r
 692          *      member is on the blog team (-1 = none)\r
 693          * @return      void\r
 694          */\r
 695         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 696         {\r
 697                 global $member, $CONF;\r
 698                 \r
 699                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 700                 $aBlogIds = array();\r
 701                 if ( $iForcedBlogInclude != -1 )\r
 702                 {\r
 703                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 704                 }\r
 705                 \r
 706                 if ( $member->isAdmin() && array_key_exists('ShowAllBlogs', $CONF) && $CONF['ShowAllBlogs'] )\r
 707                 {\r
 708                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 709                         $query = sprintf($query, sql_table('blog'));\r
 710                 }\r
 711                 else\r
 712                 {\r
 713                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 714                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 715                 }\r
 716                 \r
 717                 $rblogids = sql_query($query);\r
 718                 while ($o = sql_fetch_object($rblogids))\r
 719                 {\r
 720                         if ( $o->bnumber != $iForcedBlogInclude )\r
 721                         {\r
 722                                 $aBlogIds[] = intval($o->bnumber);\r
 723                         }\r
 724                 }\r
 725                 \r
 726                 if ( count($aBlogIds) == 0 )\r
 727                 {\r
 728                         return;\r
 729                 }\r
 730                 \r
 731                 /* TODO: we should consider to use the other way instead of this */\r
 732                 $_REQUEST['selectData'] = array(\r
 733                         'name'                  => $name,\r
 734                         'tabindex'              => $tabindex,\r
 735                         'mode'                  => $mode,\r
 736                         'selected'              => $selected,\r
 737                         'showNewCat'    => $showNewCat,\r
 738                         'aBlogIds'              => $aBlogIds,\r
 739                 );\r
 740                 self::$skin->parse('blogselectbox');\r
 741                 return;\r
 742         }\r
 743         \r
 744         /**\r
 745          * Admin::action_browseownitems()\r
 746          * \r
 747          * @param       void\r
 748          * @return      void\r
 749          */\r
 750         static private function action_browseownitems()\r
 751         {\r
 752                 global $member, $manager, $CONF;\r
 753                 \r
 754                 self::pagehead();\r
 755                 self::$skin->parse('browseownitems');\r
 756                 self::pagefoot();\r
 757                 return;\r
 758         }\r
 759         \r
 760         /**\r
 761          * Admin::action_itemcommentlist()\r
 762          * Show all the comments for a given item\r
 763          * \r
 764          * @param       integer $itemid ID for item\r
 765          * @return      void\r
 766          */\r
 767         static private function action_itemcommentlist($itemid = '')\r
 768         {\r
 769                 global $member, $manager, $CONF;\r
 770                 \r
 771                 if ( $itemid == '' )\r
 772                 {\r
 773                         $itemid = intRequestVar('itemid');\r
 774                 }\r
 775                 \r
 776                 /* TODO: we consider to use the other way insterad of this */\r
 777                 $_REQUEST['itemid'] = $itemid;\r
 778                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 779                 \r
 780                 // only allow if user is allowed to alter item\r
 781                 $member->canAlterItem($itemid) or self::disallow();\r
 782                 \r
 783                 $blogid = getBlogIdFromItemId($itemid);\r
 784                 \r
 785                 self::pagehead();\r
 786                 self::$skin->parse('itemcommentlist');\r
 787                 self::pagefoot();\r
 788                 return;\r
 789         }\r
 790         \r
 791         /**\r
 792          * Admin::action_browseowncomments()\r
 793          * Browse own comments\r
 794          * \r
 795          * @param       void\r
 796          * @return      void\r
 797          */\r
 798         static private function action_browseowncomments()\r
 799         {\r
 800                 self::pagehead();\r
 801                 self::$skin->parse('browseowncomments');\r
 802                 self::pagefoot();\r
 803                 return;\r
 804         }\r
 805         \r
 806         /**\r
 807          * Admin::action_blogcommentlist()\r
 808          * Browse all comments for a weblog\r
 809          * \r
 810          * @param       integer $blogid ID for weblog\r
 811          * @return      void\r
 812          */\r
 813         static private function action_blogcommentlist($blogid = '')\r
 814         {\r
 815                 global $member, $manager, $CONF;\r
 816                 \r
 817                 if ( $blogid == '' )\r
 818                 {\r
 819                         $blogid = intRequestVar('blogid');\r
 820                 }\r
 821                 else\r
 822                 {\r
 823                         $blogid = intval($blogid);\r
 824                 }\r
 825                 \r
 826                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 827                 \r
 828                 /* TODO: we consider to use the other way insterad of this */\r
 829                 $_REQUEST['blogid'] = $blogid;\r
 830                 \r
 831                 self::pagehead();\r
 832                 self::$skin->parse('blogcommentlist');\r
 833                 self::pagefoot();\r
 834                 return;\r
 835         }\r
 836         \r
 837         /**\r
 838          * Admin::action_createitem()\r
 839          * Provide a page to item a new item to the given blog\r
 840          * \r
 841          * @param       void\r
 842          * @return      void\r
 843          */\r
 844         static private function action_createitem()\r
 845         {\r
 846                 global $member, $manager;\r
 847                 \r
 848                 $blogid = intRequestVar('blogid');\r
 849                 \r
 850                 // check if allowed\r
 851                 $member->teamRights($blogid) or self::disallow();\r
 852                 \r
 853                 $memberid = $member->getID();\r
 854                 \r
 855                 $blog =& $manager->getBlog($blogid);\r
 856                 \r
 857                 self::pagehead();\r
 858                 self::$skin->parse('createitem');\r
 859                 self::pagefoot();\r
 860                 return;\r
 861         }\r
 862         \r
 863         /**\r
 864          * Admin::action_itemedit()\r
 865          * \r
 866          * @param       void\r
 867          * @return      void\r
 868          */\r
 869         static private function action_itemedit()\r
 870         {\r
 871                 global $member, $manager;\r
 872                 \r
 873                 $itemid = intRequestVar('itemid');\r
 874                 \r
 875                 // only allow if user is allowed to alter item\r
 876                 $member->canAlterItem($itemid) or self::disallow();\r
 877                 \r
 878                 $itemid = intRequestVar('itemid');\r
 879                 $blogid = getBlogIDFromItemID($itemid);\r
 880                 $item   =& $manager->getItem($itemid, 1, 1);\r
 881                 $manager->notify(\r
 882                                 'PrepareItemForEdit',\r
 883                                 array(\r
 884                                                 'item' => &$item\r
 885                                 )\r
 886                 );\r
 887                 \r
 888                 self::pagehead();\r
 889                 self::$skin->parse('itemedit');\r
 890                 self::pagefoot();\r
 891                 return;\r
 892         }\r
 893         \r
 894         /**\r
 895          * Admin::action_itemupdate()\r
 896          * \r
 897          * @param       void\r
 898          * @return      void\r
 899          */\r
 900         static private function action_itemupdate()\r
 901         {\r
 902                 global $member, $manager, $CONF;\r
 903                 \r
 904                 $itemid = intRequestVar('itemid');\r
 905                 $catid  = postVar('catid');\r
 906                 \r
 907                 // only allow if user is allowed to alter item\r
 908                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 909                 \r
 910                 $actiontype = postVar('actiontype');\r
 911                 \r
 912                 // delete actions are handled by itemdelete (which has confirmation)\r
 913                 if ( $actiontype == 'delete' )\r
 914                 {\r
 915                         self::$action_itemdelete();\r
 916                         return;\r
 917                 }\r
 918                 \r
 919                 $body           = postVar('body');\r
 920                 $title          = postVar('title');\r
 921                 $more           = postVar('more');\r
 922                 $closed         = intPostVar('closed');\r
 923                 $draftid        = intPostVar('draftid');\r
 924                 \r
 925                 // default action = add now\r
 926                 if ( !$actiontype )\r
 927                 {\r
 928                         $actiontype='addnow';\r
 929                 }\r
 930                 \r
 931                 // create new category if needed\r
 932                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 933                 {\r
 934                         // get blogid\r
 935                         list($blogid) = sscanf($catid,"newcat-%d");\r
 936                         \r
 937                         // create\r
 938                         $blog =& $manager->getBlog($blogid);\r
 939                         $catid = $blog->createNewCategory();\r
 940                         \r
 941                         // show error when sth goes wrong\r
 942                         if ( !$catid )\r
 943                         {\r
 944                                 self::doError(_ERROR_CATCREATEFAIL);\r
 945                         }\r
 946                 }\r
 947                 \r
 948                 /*\r
 949                         set some variables based on actiontype\r
 950 \r
 951                         actiontypes:\r
 952                                 draft items -> addnow, addfuture, adddraft, delete\r
 953                                 non-draft items -> edit, changedate, delete\r
 954 \r
 955                         variables set:\r
 956                                 $timestamp: set to a nonzero value for future dates or date changes\r
 957                                 $wasdraft: set to 1 when the item used to be a draft item\r
 958                                 $publish: set to 1 when the edited item is not a draft\r
 959          */\r
 960                 $blogid =  getBlogIDFromItemID($itemid);\r
 961                 $blog   =& $manager->getBlog($blogid);\r
 962                 \r
 963                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 964                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 965                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 966                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 967                 {\r
 968                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 969                 }\r
 970                 else\r
 971                 {\r
 972                         $timestamp =0;\r
 973                 }\r
 974                 \r
 975                 // edit the item for real\r
 976                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 977                 \r
 978                 self::updateFuturePosted($blogid);\r
 979                 \r
 980                 if ( $draftid > 0 )\r
 981                 {\r
 982                         // delete permission is checked inside Item::delete()\r
 983                         Item::delete($draftid);\r
 984                 }\r
 985                 \r
 986                 if ( $catid != intPostVar('catid') )\r
 987                 {\r
 988                         self::$action_categoryedit(\r
 989                                 $catid,\r
 990                                 $blog->getID(),\r
 991                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 992                         );\r
 993                 }\r
 994                 else\r
 995                 {\r
 996                         // TODO: set start item correctly for itemlist\r
 997                         $item = Item::getItem($itemid, 0, 0);\r
 998                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 999                         $_REQUEST['start'] = $cnt + 1;\r
1000                         self::$action_itemlist(getBlogIDFromItemID($itemid));\r
1001                 }\r
1002                 return;\r
1003         }\r
1004         \r
1005         /**\r
1006          * Admin::action_itemdelete()\r
1007          * Delete item\r
1008          * \r
1009          * @param       Void\r
1010          * @return      Void\r
1011          */\r
1012         static private function action_itemdelete()\r
1013         {\r
1014                 global $member, $manager;\r
1015                 \r
1016                 $itemid = intRequestVar('itemid');\r
1017                 \r
1018                 // only allow if user is allowed to alter item\r
1019                 $member->canAlterItem($itemid) or self::disallow();\r
1020                 \r
1021                 if ( !$manager->existsItem($itemid,1,1) )\r
1022                 {\r
1023                         self::error(_ERROR_NOSUCHITEM);\r
1024                 }\r
1025                 \r
1026                 self::pagehead();\r
1027                 self::$skin->parse('itemdelete');\r
1028                 self::pagefoot();\r
1029                 return;\r
1030         }\r
1031         \r
1032         /**\r
1033          * Admin::action_itemdeleteconfirm()\r
1034          * \r
1035          * @param       void\r
1036          * @return      void\r
1037          */\r
1038         static private function action_itemdeleteconfirm()\r
1039         {\r
1040                 global $member;\r
1041                 \r
1042                 $itemid = intRequestVar('itemid');\r
1043                 \r
1044                 // only allow if user is allowed to alter item\r
1045                 $member->canAlterItem($itemid) or self::disallow();\r
1046                 \r
1047                 // get blogid first\r
1048                 $blogid = getBlogIdFromItemId($itemid);\r
1049                 \r
1050                 // delete item (note: some checks will be performed twice)\r
1051                 self::deleteOneItem($itemid);\r
1052                 \r
1053                 self::$action_itemlist($blogid);\r
1054                 return;\r
1055         }\r
1056         \r
1057         /**\r
1058          * Admin::deleteOneItem()\r
1059          * Deletes one item and returns error if something goes wrong\r
1060          * \r
1061          * @param       integer $itemid ID for item\r
1062          * @return      void\r
1063          */\r
1064         static private function deleteOneItem($itemid)\r
1065         {\r
1066                 global $member, $manager;\r
1067                 \r
1068                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1069                 if ( !$member->canAlterItem($itemid) )\r
1070                 {\r
1071                         return _ERROR_DISALLOWED;\r
1072                 }\r
1073                 \r
1074                 // need to get blogid before the item is deleted\r
1075                 $blogid = getBlogIDFromItemId($itemid);\r
1076                 \r
1077                 $manager->loadClass('ITEM');\r
1078                 Item::delete($itemid);\r
1079                 \r
1080                 // update blog's futureposted\r
1081                 self::updateFuturePosted($blogid);\r
1082                 return;\r
1083         }\r
1084         \r
1085         /**\r
1086          * Admin::updateFuturePosted()\r
1087          * Update a blog's future posted flag\r
1088          * \r
1089          * @param integer $blogid\r
1090          * @return      void\r
1091          */\r
1092         static private function updateFuturePosted($blogid)\r
1093         {\r
1094                 global $manager;\r
1095                 \r
1096                 $blogid                 =  intval($blogid);\r
1097                 $blog                   =& $manager->getBlog($blogid);\r
1098                 $currenttime    =  $blog->getCorrectTime(time());\r
1099                 \r
1100                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1101                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1102                 $result = sql_query($query);\r
1103                 \r
1104                 if ( sql_num_rows($result) > 0 )\r
1105                 {\r
1106                                 $blog->setFuturePost();\r
1107                 }\r
1108                 else\r
1109                 {\r
1110                                 $blog->clearFuturePost();\r
1111                 }\r
1112                 return;\r
1113         }\r
1114 \r
1115         /**\r
1116          * Admin::action_itemmove()\r
1117          * \r
1118          * @param       void\r
1119          * @return      void\r
1120          */\r
1121         static private function action_itemmove()\r
1122         {\r
1123                 global $member, $manager;\r
1124                 \r
1125                 $itemid = intRequestVar('itemid');\r
1126                 \r
1127                 $member->canAlterItem($itemid) or self::disallow();\r
1128                 \r
1129                 self::pagehead();\r
1130                 self::$skin->parse('itemmove');\r
1131                 self::pagefoot();\r
1132                 return;\r
1133         }\r
1134         \r
1135         /**\r
1136          * Admin::action_itemmoveto()\r
1137          * \r
1138          * @param       void\r
1139          * @return      void\r
1140          */\r
1141         static private function action_itemmoveto()\r
1142         {\r
1143                 global $member, $manager;\r
1144                 \r
1145                 $itemid = intRequestVar('itemid');\r
1146                 $catid = requestVar('catid');\r
1147                 \r
1148                 // create new category if needed\r
1149                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1150                 {\r
1151                         // get blogid\r
1152                         list($blogid) = sscanf($catid,'newcat-%d');\r
1153                         \r
1154                         // create\r
1155                         $blog =& $manager->getBlog($blogid);\r
1156                         $catid = $blog->createNewCategory();\r
1157                         \r
1158                         // show error when sth goes wrong\r
1159                         if ( !$catid )\r
1160                         {\r
1161                                 self::doError(_ERROR_CATCREATEFAIL);\r
1162                         }\r
1163                 }\r
1164                 \r
1165                 // only allow if user is allowed to alter item\r
1166                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1167                 \r
1168                 $old_blogid = getBlogIDFromItemId($itemid);\r
1169                 \r
1170                 Item::move($itemid, $catid);\r
1171                 \r
1172                 // set the futurePosted flag on the blog\r
1173                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1174                 \r
1175                 // reset the futurePosted in case the item is moved from one blog to another\r
1176                 self::updateFuturePosted($old_blogid);\r
1177                 \r
1178                 if ( $catid != intRequestVar('catid') )\r
1179                 {\r
1180                         self::$action_categoryedit($catid, $blog->getID());\r
1181                 }\r
1182                 else\r
1183                 {\r
1184                         self::$action_itemlist(getBlogIDFromCatID($catid));\r
1185                 }\r
1186                 return;\r
1187         }\r
1188         \r
1189         /**\r
1190          * Admin::moveOneItem()\r
1191          * Moves one item to a given category (category existance should be checked by caller)\r
1192          * errors are returned\r
1193          * \r
1194          * @param       integer $itemid         ID for item\r
1195          * @param       integer $destCatid      ID for category to which the item will be moved\r
1196          * @return      void\r
1197          */\r
1198         static private function moveOneItem($itemid, $destCatid)\r
1199         {\r
1200                 global $member;\r
1201                 \r
1202                 // only allow if user is allowed to move item\r
1203                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1204                 {\r
1205                         return _ERROR_DISALLOWED;\r
1206                 }\r
1207                 \r
1208                 Item::move($itemid, $destCatid);\r
1209                 return;\r
1210         }\r
1211         \r
1212         /**\r
1213          * Admin::action_additem()\r
1214          * Adds a item to the chosen blog\r
1215          * \r
1216          * @param       void\r
1217          * @return      void\r
1218          */\r
1219         static private function action_additem()\r
1220         {\r
1221                 global $manager, $CONF;\r
1222                 \r
1223                 $manager->loadClass('ITEM');\r
1224                 \r
1225                 $result = Item::createFromRequest();\r
1226                 \r
1227                 if ( $result['status'] == 'error' )\r
1228                 {\r
1229                         self::error($result['message']);\r
1230                 }\r
1231                 \r
1232                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1233                 $blog           =& $manager->getBlog($blogid);\r
1234                 $btimestamp     =  $blog->getCorrectTime();\r
1235                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1236                 \r
1237                 if ( $result['status'] == 'newcategory' )\r
1238                 {\r
1239                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1240                         self::$action_categoryedit($result['catid'], $blogid, $distURI);\r
1241                 }\r
1242                 else\r
1243                 {\r
1244                         $methodName = 'action_itemList';\r
1245                         call_user_func(array(&$this, $methodName), $blogid);\r
1246                 }\r
1247                 return;\r
1248         }\r
1249         \r
1250         /**\r
1251          * Admin::action_commentedit()\r
1252          * Allows to edit previously made comments\r
1253          * \r
1254          * @param       void\r
1255          * @return      void\r
1256          */\r
1257         static private function action_commentedit()\r
1258         {\r
1259                 global $member, $manager;\r
1260                 \r
1261                 $commentid = intRequestVar('commentid');\r
1262                 \r
1263                 $member->canAlterComment($commentid) or self::disallow();\r
1264                 \r
1265                 self::pagehead();\r
1266                 self::$skin->parse('commentedit');\r
1267                 self::pagefoot();\r
1268                 return;\r
1269         }\r
1270         \r
1271         /**\r
1272          * Admin::action_commentupdate()\r
1273          * \r
1274          * @param       void\r
1275          * @return      void\r
1276          */\r
1277         static private function action_commentupdate()\r
1278         {\r
1279                 global $member, $manager;\r
1280                 \r
1281                 $commentid = intRequestVar('commentid');\r
1282                 \r
1283                 $member->canAlterComment($commentid) or self::disallow();\r
1284                 \r
1285                 $url    = postVar('url');\r
1286                 $email  = postVar('email');\r
1287                 $body   = postVar('body');\r
1288                 \r
1289                 // intercept words that are too long\r
1290                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1291                 {\r
1292                         self::error(_ERROR_COMMENT_LONGWORD);\r
1293                 }\r
1294                 \r
1295                 // check length\r
1296                 if ( i18n::strlen($body) < 3 )\r
1297                 {\r
1298                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1299                 }\r
1300                 \r
1301                 if ( i18n::strlen($body) > 5000 )\r
1302                 {\r
1303                         self::error(_ERROR_COMMENT_TOOLONG);\r
1304                 }\r
1305                 \r
1306                 // prepare body\r
1307                 $body = Comment::prepareBody($body);\r
1308                 \r
1309                 // call plugins\r
1310                 $data = array(\r
1311                         'body' => &$body\r
1312                 );\r
1313                 $manager->notify('PreUpdateComment', $data);\r
1314                 \r
1315                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1316                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1317                 sql_query($query);\r
1318                 \r
1319                 // get itemid\r
1320                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1321                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1322                 \r
1323                 $res    = sql_query($query);\r
1324                 $o              = sql_fetch_object($res);\r
1325                 $itemid = $o->citem;\r
1326                 \r
1327                 if ( $member->canAlterItem($itemid) )\r
1328                 {\r
1329                         self::$action_itemcommentlist($itemid);\r
1330                 }\r
1331                 else\r
1332                 {\r
1333                         self::$action_browseowncomments();\r
1334                 }\r
1335                 return;\r
1336         }\r
1337         \r
1338         /**\r
1339          * Admin::action_commentdelete()\r
1340          * Update comment\r
1341          * \r
1342          * @param       void\r
1343          * @return      void\r
1344          */\r
1345         static private function action_commentdelete()\r
1346         {\r
1347                 global $member, $manager;\r
1348                 \r
1349                 $commentid = intRequestVar('commentid');\r
1350                 $member->canAlterComment($commentid) or self::disallow();\r
1351                 \r
1352                 self::pagehead();\r
1353                 self::$skin->parse('commentdelete');\r
1354                 self::pagefoot();\r
1355                 return;\r
1356         }\r
1357         \r
1358         /**\r
1359          * Admin::action_commentdeleteconfirm()\r
1360          * \r
1361          * @param       void\r
1362          * @return      void\r
1363          */\r
1364         static private function action_commentdeleteconfirm()\r
1365         {\r
1366                 global $member;\r
1367                 \r
1368                 $commentid = intRequestVar('commentid');\r
1369                 \r
1370                 // get item id first\r
1371                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1372                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1373                 \r
1374                 $res = sql_query($query);\r
1375                 $o = sql_fetch_object($res);\r
1376                 $itemid = $o->citem;\r
1377                 \r
1378                 $error = self::deleteOneComment($commentid);\r
1379                 if ( $error )\r
1380                 {\r
1381                         self::doError($error);\r
1382                 }\r
1383                 \r
1384                 if ( $member->canAlterItem($itemid) )\r
1385                 {\r
1386                         self::$action_itemcommentlist($itemid);\r
1387                 }\r
1388                 else\r
1389                 {\r
1390                         self::$action_browseowncomments();\r
1391                 }\r
1392                 return;\r
1393         }\r
1394         \r
1395         /**\r
1396          * Admin::deleteOneComment()\r
1397          * \r
1398          * @param       integer $commentid      ID for comment\r
1399          * @return      void\r
1400          */\r
1401         static private function deleteOneComment($commentid)\r
1402         {\r
1403                 global $member, $manager;\r
1404                 \r
1405                 $commentid = (integer) $commentid;\r
1406                 \r
1407                 if ( !$member->canAlterComment($commentid) )\r
1408                 {\r
1409                         return _ERROR_DISALLOWED;\r
1410                 }\r
1411                 \r
1412                 $data = array(\r
1413                         'commentid' => $commentid\r
1414                 );\r
1415                 \r
1416                 $manager->notify('PreDeleteComment', $data);\r
1417                 \r
1418                 // delete the comments associated with the item\r
1419                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1420                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1421                 sql_query($query);\r
1422                 \r
1423                 $data = array(\r
1424                         'commentid' => $commentid\r
1425                 );\r
1426                 \r
1427                 $manager->notify('PostDeleteComment', $data);\r
1428                 \r
1429                 return '';\r
1430         }\r
1431         \r
1432         /**\r
1433          * Admin::action_usermanagement()\r
1434          * Usermanagement main\r
1435          * \r
1436          * @param       void\r
1437          * @return      void\r
1438          */\r
1439         static private function action_usermanagement()\r
1440         {\r
1441                 global $member, $manager;\r
1442                 \r
1443                 // check if allowed\r
1444                 $member->isAdmin() or self::disallow();\r
1445                 \r
1446                 self::pagehead();\r
1447                 self::$skin->parse('usermanagement');\r
1448                 self::pagefoot();\r
1449                 return;\r
1450         }\r
1451         \r
1452         /**\r
1453          * Admin::action_memberedit()\r
1454          * Edit member settings\r
1455          * \r
1456          * @param       void\r
1457          * @return      void\r
1458          */\r
1459         static private function action_memberedit()\r
1460         {\r
1461                 self::$action_editmembersettings(intRequestVar('memberid'));\r
1462                 return;\r
1463         }\r
1464         \r
1465         /**\r
1466          * Admin::action_editmembersettings()\r
1467          * \r
1468          * @param       integer $memberid       ID for member\r
1469          * @return      void\r
1470          * \r
1471          */\r
1472         static private function action_editmembersettings($memberid = '')\r
1473         {\r
1474                 global $member, $manager, $CONF;\r
1475                 \r
1476                 if ( $memberid == '' )\r
1477                 {\r
1478                         $memberid = $member->getID();\r
1479                 }\r
1480                 \r
1481                 /* TODO: we should consider to use the other way insterad of this */\r
1482                 $_REQUEST['memberid'] = $memberid;\r
1483                 \r
1484                 // check if allowed\r
1485                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1486                 \r
1487                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1488                 self::pagehead($extrahead);\r
1489                 self::$skin->parse('editmembersettings');\r
1490                 self::pagefoot();\r
1491                 return;\r
1492         }\r
1493         \r
1494         /**\r
1495          * Admin::action_changemembersettings()\r
1496          * \r
1497          * @param       void\r
1498          * @return      void\r
1499          */\r
1500         static private function action_changemembersettings()\r
1501         {\r
1502                 global $member, $CONF, $manager;\r
1503                 \r
1504                 $memberid = intRequestVar('memberid');\r
1505                 \r
1506                 // check if allowed\r
1507                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1508                 \r
1509                 $name                   = trim(strip_tags(postVar('name')));\r
1510                 $realname               = trim(strip_tags(postVar('realname')));\r
1511                 $password               = postVar('password');\r
1512                 $repeatpassword = postVar('repeatpassword');\r
1513                 $email                  = strip_tags(postVar('email'));\r
1514                 $url                    = strip_tags(postVar('url'));\r
1515                 $adminskin              = intPostVar('adminskin');\r
1516                 \r
1517                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1518                 if ( !preg_match('#^https?://#', $url) )\r
1519                 {\r
1520                         $url = 'http://' . $url;\r
1521                 }\r
1522                 \r
1523                 $admin          = postVar('admin');\r
1524                 $canlogin       = postVar('canlogin');\r
1525                 $notes          = strip_tags(postVar('notes'));\r
1526                 $locale         = postVar('locale');\r
1527                 \r
1528                 $mem = Member::createFromID($memberid);\r
1529                 \r
1530                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1531                 {\r
1532                         if ( !isValidDisplayName($name) )\r
1533                         {\r
1534                                 self::error(_ERROR_BADNAME);\r
1535                         }\r
1536                         \r
1537                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1538                         {\r
1539                                 self::error(_ERROR_NICKNAMEINUSE);\r
1540                         }\r
1541                         \r
1542                         if ( $password != $repeatpassword )\r
1543                         {\r
1544                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1545                         }\r
1546                         \r
1547                         if ( $password && (i18n::strlen($password) < 6) )\r
1548                         {\r
1549                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1550                         }\r
1551                                 \r
1552                         if ( $password )\r
1553                         {\r
1554                                 $pwdvalid = true;\r
1555                                 $pwderror = '';\r
1556                                 \r
1557                                 $data = array(\r
1558                                         'password'     => $password,\r
1559                                         'errormessage' => &$pwderror,\r
1560                                         'valid'        => &$pwdvalid\r
1561                                 );\r
1562                                 $manager->notify('PrePasswordSet', $data);\r
1563                                 \r
1564                                 if ( !$pwdvalid )\r
1565                                 {\r
1566                                         self::error($pwderror);\r
1567                                 }\r
1568                         }\r
1569                 }\r
1570                 \r
1571                 if ( !NOTIFICATION::address_validation($email) )\r
1572                 {\r
1573                         self::error(_ERROR_BADMAILADDRESS);\r
1574                 }\r
1575                 if ( !$realname )\r
1576                 {\r
1577                         self::error(_ERROR_REALNAMEMISSING);\r
1578                 }\r
1579                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1580                 {\r
1581                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1582                 }\r
1583                 \r
1584                 // check if there will remain at least one site member with both the logon and admin rights\r
1585                 // (check occurs when taking away one of these rights from such a member)\r
1586                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1587                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1588                         )\r
1589                 {\r
1590                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1591                         if ( sql_num_rows($r) < 2 )\r
1592                         {\r
1593                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1594                         }\r
1595                 }\r
1596                 \r
1597                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1598                 {\r
1599                         $mem->setDisplayName($name);\r
1600                         if ( $password )\r
1601                         {\r
1602                                 $mem->setPassword($password);\r
1603                         }\r
1604                 }\r
1605                 \r
1606                 $oldEmail = $mem->getEmail();\r
1607                 \r
1608                 $mem->setRealName($realname);\r
1609                 $mem->setEmail($email);\r
1610                 $mem->setURL($url);\r
1611                 $mem->setNotes($notes);\r
1612                 $mem->setLocale($locale);\r
1613                 \r
1614                 // only allow super-admins to make changes to the admin status\r
1615                 if ( $member->isAdmin() )\r
1616                 {\r
1617                         $mem->setAdmin($admin);\r
1618                         $mem->setCanLogin($canlogin);\r
1619                 }\r
1620                 \r
1621                 $autosave = postVar('autosave');\r
1622                 $mem->setAutosave($autosave);\r
1623                 \r
1624                 $mem->write();\r
1625                 \r
1626                 // store plugin options\r
1627                 $aOptions = requestArray('plugoption');\r
1628                 NucleusPlugin::apply_plugin_options($aOptions);\r
1629                 $data = array(\r
1630                         'context'  => 'member',\r
1631                         'memberid' => $memberid,\r
1632                         'member'   => &$mem\r
1633                 );\r
1634                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1635                 \r
1636                 // if email changed, generate new password\r
1637                 if ( $oldEmail != $mem->getEmail() )\r
1638                 {\r
1639                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1640                         // logout member\r
1641                         $mem->newCookieKey();\r
1642                         \r
1643                         // only log out if the member being edited is the current member.\r
1644                         if ( $member->getID() == $memberid )\r
1645                         {\r
1646                                 $member->logout();\r
1647                         }\r
1648                         self::$action_login(_MSG_ACTIVATION_SENT, 0);\r
1649                         return;\r
1650                 }\r
1651                 \r
1652                 if ( ($mem->getID() == $member->getID())\r
1653                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1654                 {\r
1655                         $mem->newCookieKey();\r
1656                         $member->logout();\r
1657                         self::$action_login(_MSG_LOGINAGAIN, 0);\r
1658                 }\r
1659                 else\r
1660                 {\r
1661                         self::$action_overview(_MSG_SETTINGSCHANGED);\r
1662                 }\r
1663                 return;\r
1664         }\r
1665 \r
1666         /**\r
1667          * Admin::action_memberadd()\r
1668          * \r
1669          * @param       void\r
1670          * @return      void\r
1671          * \r
1672          */\r
1673         static private function action_memberadd()\r
1674         {\r
1675                 global $member, $manager;\r
1676                 \r
1677                 // check if allowed\r
1678                 $member->isAdmin() or self::disallow();\r
1679                 \r
1680                 if ( postVar('password') != postVar('repeatpassword') )\r
1681                 {\r
1682                         self::error(_ERROR_PASSWORDMISMATCH);\r
1683                 }\r
1684                 \r
1685                 if ( i18n::strlen(postVar('password')) < 6 )\r
1686                 {\r
1687                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1688                 }\r
1689                 \r
1690                 $res = Member::create(\r
1691                         postVar('name'),\r
1692                         postVar('realname'),\r
1693                         postVar('password'),\r
1694                         postVar('email'),\r
1695                         postVar('url'),\r
1696                         postVar('admin'),\r
1697                         postVar('canlogin'),\r
1698                         postVar('notes')\r
1699                 );\r
1700                 \r
1701                 if ( $res != 1 )\r
1702                 {\r
1703                         self::error($res);\r
1704                 }\r
1705                 \r
1706                 // fire PostRegister event\r
1707                 $newmem = new Member();\r
1708                 $newmem->readFromName(postVar('name'));\r
1709                 $data = array(\r
1710                         'member' => &$newmem\r
1711                 );\r
1712                 $manager->notify('PostRegister', $data);\r
1713                 \r
1714                 self::$action_usermanagement();\r
1715                 return;\r
1716         }\r
1717         \r
1718         /**\r
1719          * Admin::action_activate()\r
1720          * Account activation\r
1721          * \r
1722          * @param       void\r
1723          * @return      void\r
1724          */\r
1725         static private function action_activate()\r
1726         {\r
1727                 $key = getVar('key');\r
1728                 self::showActivationPage($key);\r
1729                 return;\r
1730         }\r
1731         \r
1732         /**\r
1733          * Admin::showActivationPage()\r
1734          * \r
1735          * @param       void\r
1736          * @return      void\r
1737          */\r
1738         static private function showActivationPage($key, $message = '')\r
1739         {\r
1740                 global $manager;\r
1741                 \r
1742                 // clean up old activation keys\r
1743                 Member::cleanupActivationTable();\r
1744                 \r
1745                 // get activation info\r
1746                 $info = Member::getActivationInfo($key);\r
1747                 \r
1748                 if ( !$info )\r
1749                 {\r
1750                         self::error(_ERROR_ACTIVATE);\r
1751                 }\r
1752                 \r
1753                 $mem = Member::createFromId($info->vmember);\r
1754                 \r
1755                 if ( !$mem )\r
1756                 {\r
1757                         self::error(_ERROR_ACTIVATE);\r
1758                 }\r
1759                 \r
1760                 /* TODO: we should consider to use the other way insterad of this */\r
1761                 $_POST['ackey']                                 = $key;\r
1762                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1763                 \r
1764                 self::$headMess = $message;\r
1765                 self::pagehead();\r
1766                 self::$skin->parse('activate');\r
1767                 self::pagefoot();\r
1768                 return;\r
1769         }\r
1770         \r
1771         /**\r
1772          * Admin::action_activatesetpwd()\r
1773          * Account activation - set password part\r
1774          * \r
1775          * @param       void\r
1776          * @return      void\r
1777          */\r
1778         static private function action_activatesetpwd()\r
1779         {\r
1780                 global $manager;\r
1781                 $key = postVar('key');\r
1782                 \r
1783                 // clean up old activation keys\r
1784                 Member::cleanupActivationTable();\r
1785                 \r
1786                 // get activation info\r
1787                 $info = Member::getActivationInfo($key);\r
1788                 \r
1789                 if ( !$info || ($info->type == 'addresschange') )\r
1790                 {\r
1791                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1792                 }\r
1793                 \r
1794                 $mem = Member::createFromId($info->vmember);\r
1795                 \r
1796                 if ( !$mem )\r
1797                 {\r
1798                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1799                 }\r
1800                 \r
1801                 $password               = postVar('password');\r
1802                 $repeatpassword = postVar('repeatpassword');\r
1803                 \r
1804                 if ( $password != $repeatpassword )\r
1805                 {\r
1806                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1807                 }\r
1808                 \r
1809                 if ( $password && (i18n::strlen($password) < 6) )\r
1810                 {\r
1811                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1812                 }\r
1813                         \r
1814                 if ( $password )\r
1815                 {\r
1816                         $pwdvalid = true;\r
1817                         $pwderror = '';\r
1818                         \r
1819                         $data = array(\r
1820                                 'password'              => $password,\r
1821                                 'errormessage'  => &$pwderror,\r
1822                                 'valid'                 => &$pwdvalid\r
1823                         );\r
1824                         $manager->notify('PrePasswordSet', $data);\r
1825                         if ( !$pwdvalid )\r
1826                         {\r
1827                                 return self::showActivationPage($key,$pwderror);\r
1828                         }\r
1829                 }\r
1830                 \r
1831                 $error = '';\r
1832                 \r
1833                 $data = array(\r
1834                         'type'   => 'activation',\r
1835                         'member' => $mem,\r
1836                         'error'  => &$error\r
1837                 );\r
1838                 $manager->notify('ValidateForm', $data);\r
1839                 if ( $error != '' )\r
1840                 {\r
1841                         return self::showActivationPage($key, $error);\r
1842                 }\r
1843                 \r
1844                 // set password\r
1845                 $mem->setPassword($password);\r
1846                 $mem->write();\r
1847                 \r
1848                 // do the activation\r
1849                 Member::activate($key);\r
1850                 \r
1851                 self::pagehead();\r
1852                 self::$skin->parse('activatesetpwd');\r
1853                 self::pagefoot();\r
1854                 return;\r
1855         }\r
1856         \r
1857         /**\r
1858          * Admin::action_manageteam()\r
1859          * Manage team\r
1860          * \r
1861          * @param       void\r
1862          * @return      void\r
1863          */\r
1864         static private function action_manageteam()\r
1865         {\r
1866                 global $member, $manager;\r
1867                 \r
1868                 $blogid = intRequestVar('blogid');\r
1869                 \r
1870                 // check if allowed\r
1871                 $member->blogAdminRights($blogid) or self::disallow();\r
1872                 \r
1873                 self::pagehead();\r
1874                 self::$skin->parse('manageteam');\r
1875                 self::pagefoot();\r
1876                 return;\r
1877         }\r
1878         \r
1879         /**\r
1880          * Admin::action_teamaddmember()\r
1881          * Add member to team\r
1882          * \r
1883          * @param       void\r
1884          * @return      void\r
1885          */\r
1886         static private function action_teamaddmember()\r
1887         {\r
1888                 global $member, $manager;\r
1889                 \r
1890                 $memberid       = intPostVar('memberid');\r
1891                 $blogid         = intPostVar('blogid');\r
1892                 $admin          = intPostVar('admin');\r
1893                 \r
1894                 // check if allowed\r
1895                 $member->blogAdminRights($blogid) or self::disallow();\r
1896                 \r
1897                 $blog =& $manager->getBlog($blogid);\r
1898                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1899                 {\r
1900                         self::error(_ERROR_ALREADYONTEAM);\r
1901                 }\r
1902                 \r
1903                 self::$action_manageteam();\r
1904                 return;\r
1905         }\r
1906         \r
1907         /**\r
1908          * Admin::action_teamdelete()\r
1909          * \r
1910          * @param       void\r
1911          * @return      void\r
1912          */\r
1913         static private function action_teamdelete()\r
1914         {\r
1915                 global $member, $manager;\r
1916                 \r
1917                 $memberid       = intRequestVar('memberid');\r
1918                 $blogid         = intRequestVar('blogid');\r
1919                 \r
1920                 // check if allowed\r
1921                 $member->blogAdminRights($blogid) or self::disallow();\r
1922                 \r
1923                 $teammem =  Member::createFromID($memberid);\r
1924                 $blog =& $manager->getBlog($blogid);\r
1925                 \r
1926                 self::pagehead();\r
1927                 self::$skin->parse('teamdelete');\r
1928                 self::pagefoot();\r
1929                 return;\r
1930         }\r
1931         \r
1932         /**\r
1933          * Admin::action_teamdeleteconfirm()\r
1934          * \r
1935          * @param       void\r
1936          * @return      void\r
1937          */\r
1938         static private function action_teamdeleteconfirm()\r
1939         {\r
1940                 global $member;\r
1941                 \r
1942                 $memberid = intRequestVar('memberid');\r
1943                 $blogid = intRequestVar('blogid');\r
1944                 \r
1945                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1946                 if ( $error )\r
1947                 {\r
1948                         self::error($error);\r
1949                 }\r
1950                 self::$action_manageteam();\r
1951                 return;\r
1952         }\r
1953         \r
1954         /**\r
1955          * Admin::deleteOneTeamMember()\r
1956          * \r
1957          * @param       void\r
1958          * @return      void\r
1959          */\r
1960         static private function deleteOneTeamMember($blogid, $memberid)\r
1961         {\r
1962                 global $member, $manager;\r
1963                 \r
1964                 $blogid   = intval($blogid);\r
1965                 $memberid = intval($memberid);\r
1966                 \r
1967                 // check if allowed\r
1968                 if ( !$member->blogAdminRights($blogid) )\r
1969                 {\r
1970                         return _ERROR_DISALLOWED;\r
1971                 }\r
1972                 \r
1973                 // check if: - there remains at least one blog admin\r
1974                 //           - (there remains at least one team member)\r
1975                 $tmem = Member::createFromID($memberid);\r
1976                 \r
1977                 \r
1978                 $data = array(\r
1979                         'member' => &$tmem,\r
1980                         'blogid' => $blogid\r
1981                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1982                 \r
1983                 if ( $tmem->isBlogAdmin($blogid) )\r
1984                 {\r
1985                         /* TODO: why we did double check? */\r
1986                         // check if there are more blog members left and at least one admin\r
1987                         // (check for at least two admins before deletion)\r
1988                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1989                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1990                         $r     = sql_query($query);\r
1991                         if ( sql_num_rows($r) < 2 )\r
1992                         {\r
1993                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1994                         }\r
1995                 }\r
1996                 \r
1997                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1998                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1999                 sql_query($query);\r
2000                 \r
2001                 $data = array(\r
2002                         'member' => &$tmem,\r
2003                         'blogid' => $blogid\r
2004                 );\r
2005                 $manager->notify('PostDeleteTeamMember', $data);\r
2006                 \r
2007                 return '';\r
2008         }\r
2009         \r
2010         /**\r
2011          * Admin::action_teamchangeadmin()\r
2012          * \r
2013          * @param       void\r
2014          * @return      void\r
2015          */\r
2016         static private function action_teamchangeadmin()\r
2017         {\r
2018                 global $member;\r
2019                 \r
2020                 $blogid         = intRequestVar('blogid');\r
2021                 $memberid       = intRequestVar('memberid');\r
2022                 \r
2023                 // check if allowed\r
2024                 $member->blogAdminRights($blogid) or self::disallow();\r
2025                 \r
2026                 $mem = Member::createFromID($memberid);\r
2027                 \r
2028                 // don't allow when there is only one admin at this moment\r
2029                 if ( $mem->isBlogAdmin($blogid) )\r
2030                 {\r
2031                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2032                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2033                         $r = sql_query($query);\r
2034                         if ( sql_num_rows($r) == 1 )\r
2035                         {\r
2036                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2037                         }\r
2038                 }\r
2039                 \r
2040                 if ( $mem->isBlogAdmin($blogid) )\r
2041                 {\r
2042                         $newval = 0;\r
2043                 }\r
2044                 else\r
2045                 {\r
2046                         $newval = 1;\r
2047                 }\r
2048                 \r
2049                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2050                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2051                 sql_query($query);\r
2052                 \r
2053                 // only show manageteam if member did not change its own admin privileges\r
2054                 if ( $member->isBlogAdmin($blogid) )\r
2055                 {\r
2056                         self::$action_manageteam();\r
2057                 }\r
2058                 else\r
2059                 {\r
2060                         self::$action_overview(_MSG_ADMINCHANGED);\r
2061                 }\r
2062                 return;\r
2063         }\r
2064         \r
2065         /**\r
2066          * Admin::action_blogsettings()\r
2067          * \r
2068          * @param       void\r
2069          * @return      void\r
2070          */\r
2071         static private function action_blogsettings()\r
2072         {\r
2073                 global $member, $manager;\r
2074                 \r
2075                 $blogid = intRequestVar('blogid');\r
2076                 \r
2077                 // check if allowed\r
2078                 $member->blogAdminRights($blogid) or self::disallow();\r
2079                 \r
2080                 $blog =& $manager->getBlog($blogid);\r
2081                 \r
2082                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2083                 self::pagehead($extrahead);\r
2084                 self::$skin->parse('blogsettings');\r
2085                 self::pagefoot();\r
2086                 return;\r
2087         }\r
2088         \r
2089         /**\r
2090          * Admin::action_categorynew()\r
2091          * \r
2092          * @param       void\r
2093          * @return      void\r
2094          */\r
2095         static private function action_categorynew()\r
2096         {\r
2097                 global $member, $manager;\r
2098                 \r
2099                 $blogid = intRequestVar('blogid');\r
2100                 \r
2101                 $member->blogAdminRights($blogid) or self::disallow();\r
2102                 \r
2103                 $cname = postVar('cname');\r
2104                 $cdesc = postVar('cdesc');\r
2105                 \r
2106                 if ( !isValidCategoryName($cname) )\r
2107                 {\r
2108                         self::error(_ERROR_BADCATEGORYNAME);\r
2109                 }\r
2110                 \r
2111                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2112                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2113                 $res = sql_query($query);\r
2114                 if ( sql_num_rows($res) > 0 )\r
2115                 {\r
2116                         self::error(_ERROR_DUPCATEGORYNAME);\r
2117                 }\r
2118                 \r
2119                 $blog           =& $manager->getBlog($blogid);\r
2120                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2121                 \r
2122                 self::$action_blogsettings();\r
2123                 return;\r
2124         }\r
2125         \r
2126         /**\r
2127          * Admin::action_categoryedit()\r
2128          * \r
2129          * @param       void\r
2130          * @return      void\r
2131          */\r
2132         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2133         {\r
2134                 global $member, $manager;\r
2135                 \r
2136                 if ( $blogid == '' )\r
2137                 {\r
2138                         $blogid = intGetVar('blogid');\r
2139                 }\r
2140                 else\r
2141                 {\r
2142                         $blogid = intval($blogid);\r
2143                 }\r
2144                 if ( $catid == '' )\r
2145                 {\r
2146                         $catid = intGetVar('catid');\r
2147                 }\r
2148                 else\r
2149                 {\r
2150                         $catid = intval($catid);\r
2151                 }\r
2152                 \r
2153                 /* TODO: we should consider to use the other way insterad of this */\r
2154                 $_REQUEST['blogid']             = $blogid;\r
2155                 $_REQUEST['catid']              = $catid;\r
2156                 $_REQUEST['desturl']    = $desturl;\r
2157                 $member->blogAdminRights($blogid) or self::disallow();\r
2158                 \r
2159                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2160                 self::pagehead($extrahead);\r
2161                 self::$skin->parse('categoryedit');\r
2162                 self::pagefoot();\r
2163                 return;\r
2164         }\r
2165         \r
2166         /**\r
2167          * Admin::action_categoryupdate()\r
2168          * \r
2169          * @param       void\r
2170          * @return      void\r
2171          */\r
2172         static private function action_categoryupdate()\r
2173         {\r
2174                 global $member, $manager;\r
2175                 \r
2176                 $blogid         = intPostVar('blogid');\r
2177                 $catid          = intPostVar('catid');\r
2178                 $cname          = postVar('cname');\r
2179                 $cdesc          = postVar('cdesc');\r
2180                 $desturl        = postVar('desturl');\r
2181                 \r
2182                 $member->blogAdminRights($blogid) or self::disallow();\r
2183                 \r
2184                 if ( !isValidCategoryName($cname) )\r
2185                 {\r
2186                         self::error(_ERROR_BADCATEGORYNAME);\r
2187                 }\r
2188                 \r
2189                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2190                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2191                 $res    = sql_query($query);\r
2192                 if ( sql_num_rows($res) > 0 )\r
2193                 {\r
2194                         self::error(_ERROR_DUPCATEGORYNAME);\r
2195                 }\r
2196                 \r
2197                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2198                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2199                 sql_query($query);\r
2200                 \r
2201                 // store plugin options\r
2202                 $aOptions = requestArray('plugoption');\r
2203                 NucleusPlugin::apply_plugin_options($aOptions);\r
2204                 $data = array(\r
2205                         'context'       => 'category',\r
2206                         'catid'         => $catid\r
2207                 );\r
2208                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2209                 \r
2210                 if ( $desturl )\r
2211                 {\r
2212                         redirect($desturl);\r
2213                         exit;\r
2214                 }\r
2215                 else\r
2216                 {\r
2217                         self::$action_blogsettings();\r
2218                 }\r
2219                 return;\r
2220         }\r
2221         \r
2222         /**\r
2223          * Admin::action_categorydelete()\r
2224          * \r
2225          * @param       void\r
2226          * @return      void\r
2227          */\r
2228         static private function action_categorydelete()\r
2229         {\r
2230                 global $member, $manager;\r
2231                 \r
2232                 $blogid = intRequestVar('blogid');\r
2233                 $catid  = intRequestVar('catid');\r
2234                 \r
2235                 $member->blogAdminRights($blogid) or self::disallow();\r
2236                 \r
2237                 $blog =& $manager->getBlog($blogid);\r
2238                 \r
2239                 // check if the category is valid\r
2240                 if ( !$blog->isValidCategory($catid) )\r
2241                 {\r
2242                         self::error(_ERROR_NOSUCHCATEGORY);\r
2243                 }\r
2244                 \r
2245                 // don't allow deletion of default category\r
2246                 if ( $blog->getDefaultCategory() == $catid )\r
2247                 {\r
2248                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2249                 }\r
2250                 \r
2251                 // check if catid is the only category left for blogid\r
2252                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2253                 $query = sprintf($query, sql_table('category'), $blogid);\r
2254                 $res = sql_query($query);\r
2255                 if ( sql_num_rows($res) == 1 )\r
2256                 {\r
2257                         self::error(_ERROR_DELETELASTCATEGORY);\r
2258                 }\r
2259                 \r
2260                 self::pagehead();\r
2261                 self::$skin->parse('categorydelete');\r
2262                 self::pagefoot();\r
2263                 return;\r
2264         }\r
2265         \r
2266         /**\r
2267          * Admin::action_categorydeleteconfirm()\r
2268          * \r
2269          * @param       void\r
2270          * @return      void\r
2271          */\r
2272         static private function action_categorydeleteconfirm()\r
2273         {\r
2274                 global $member, $manager;\r
2275                 \r
2276                 $blogid = intRequestVar('blogid');\r
2277                 $catid  = intRequestVar('catid');\r
2278                 \r
2279                 $member->blogAdminRights($blogid) or self::disallow();\r
2280                 \r
2281                 $error = self::deleteOneCategory($catid);\r
2282                 if ( $error )\r
2283                 {\r
2284                         self::error($error);\r
2285                 }\r
2286                 \r
2287                 self::$action_blogsettings();\r
2288                 return;\r
2289         }\r
2290         \r
2291         /**\r
2292          * Admin::deleteOneCategory()\r
2293          * Delete a category by its id\r
2294          * \r
2295          * @param       String  $catid  category id for deleting\r
2296          * @return      Void\r
2297          */\r
2298         static private function deleteOneCategory($catid)\r
2299         {\r
2300                 global $manager, $member;\r
2301                 \r
2302                 $catid  = intval($catid);\r
2303                 $blogid = getBlogIDFromCatID($catid);\r
2304                 \r
2305                 if ( !$member->blogAdminRights($blogid) )\r
2306                 {\r
2307                         return ERROR_DISALLOWED;\r
2308                 }\r
2309                 \r
2310                 // get blog\r
2311                 $blog =& $manager->getBlog($blogid);\r
2312                 \r
2313                 // check if the category is valid\r
2314                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2315                 {\r
2316                         return _ERROR_NOSUCHCATEGORY;\r
2317                 }\r
2318                 \r
2319                 $destcatid = $blog->getDefaultCategory();\r
2320                 \r
2321                 // don't allow deletion of default category\r
2322                 if ( $blog->getDefaultCategory() == $catid )\r
2323                 {\r
2324                         return _ERROR_DELETEDEFCATEGORY;\r
2325                 }\r
2326                 \r
2327                 // check if catid is the only category left for blogid\r
2328                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2329                 $query = sprintf(sql_table('category'), (integer) $blogid);\r
2330                 \r
2331                 $res = sql_query($query);\r
2332                 if ( sql_num_rows($res) == 1 )\r
2333                 {\r
2334                         return _ERROR_DELETELASTCATEGORY;\r
2335                 }\r
2336                 \r
2337                 $data = array('catid' => $catid);\r
2338                 $manager->notify('PreDeleteCategory', $data);\r
2339                 \r
2340                 // change category for all items to the default category\r
2341                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2342                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2343                 sql_query($query);\r
2344                 \r
2345                 // delete all associated plugin options\r
2346                 NucleusPlugin::delete_option_values('category', $catid);\r
2347                 \r
2348                 // delete category\r
2349                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2350                 $query = sprintf($query, (integer) $catid);\r
2351                 sql_query($query);\r
2352                 \r
2353                 $data = array('catid' => $catid);\r
2354                 $manager->notify('PostDeleteCategory', $data);\r
2355                 return;\r
2356         }\r
2357         \r
2358         /**\r
2359          * Admin::action_blogsettingsupdate\r
2360          * Updating blog settings\r
2361          * \r
2362          * @param       Void\r
2363          * @return      Void\r
2364          */\r
2365         static private function action_blogsettingsupdate()\r
2366         {\r
2367                 global $member, $manager;\r
2368                 \r
2369                 $blogid = intRequestVar('blogid');\r
2370                 \r
2371                 $member->blogAdminRights($blogid) or self::disallow();\r
2372                 \r
2373                 $blog =& $manager->getBlog($blogid);\r
2374                 \r
2375                 $notify_address = trim(postVar('notify'));\r
2376                 $shortname              = trim(postVar('shortname'));\r
2377                 $updatefile             = trim(postVar('update'));\r
2378                 \r
2379                 $notifyComment  = intPostVar('notifyComment');\r
2380                 $notifyVote             = intPostVar('notifyVote');\r
2381                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2382                 \r
2383                 if ( $notifyComment == 0 )\r
2384                 {\r
2385                         $notifyComment = 1;\r
2386                 }\r
2387                 if ( $notifyVote == 0 )\r
2388                 {\r
2389                         $notifyVote = 1;\r
2390                 }\r
2391                 if ( $notifyNewItem == 0 )\r
2392                 {\r
2393                         $notifyNewItem = 1;\r
2394                 }\r
2395                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2396                 \r
2397                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2398                 {\r
2399                         self::error(_ERROR_BADNOTIFY);\r
2400                 }\r
2401                 \r
2402                 if ( !isValidShortName($shortname) )\r
2403                 {\r
2404                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2405                 }\r
2406                 \r
2407                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2408                 {\r
2409                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2410                 }\r
2411                 // check if update file is writable\r
2412                 if ( $updatefile && !is_writeable($updatefile) )\r
2413                 {\r
2414                         self::error(_ERROR_UPDATEFILE);\r
2415                 }\r
2416                 \r
2417                 $blog->setName(trim(postVar('name')));\r
2418                 $blog->setShortName($shortname);\r
2419                 $blog->setNotifyAddress($notify_address);\r
2420                 $blog->setNotifyType($notifyType);\r
2421                 $blog->setMaxComments(postVar('maxcomments'));\r
2422                 $blog->setCommentsEnabled(postVar('comments'));\r
2423                 $blog->setTimeOffset(postVar('timeoffset'));\r
2424                 $blog->setUpdateFile($updatefile);\r
2425                 $blog->setURL(trim(postVar('url')));\r
2426                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2427                 $blog->setDescription(trim(postVar('desc')));\r
2428                 $blog->setPublic(postVar('public'));\r
2429                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2430                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2431                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2432                 $blog->setSearchable(intPostVar('searchable'));\r
2433                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2434                 $blog->writeSettings();\r
2435                 \r
2436                 // store plugin options\r
2437                 $aOptions = requestArray('plugoption');\r
2438                 NucleusPlugin::apply_plugin_options($aOptions);\r
2439                 \r
2440                 $data = array(\r
2441                         'context' => 'blog',\r
2442                         'blogid'  => $blogid,\r
2443                         'blog'    => &$blog\r
2444                 );\r
2445                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2446                 \r
2447                 self::$action_overview(_MSG_SETTINGSCHANGED);\r
2448                 return;\r
2449         }\r
2450         \r
2451         /**\r
2452          * Admin::action_deleteblog()\r
2453          * \r
2454          * @param       void\r
2455          * @return      void\r
2456          */\r
2457         static private function action_deleteblog()\r
2458         {\r
2459                 global $member, $CONF, $manager;\r
2460                 \r
2461                 $blogid = intRequestVar('blogid');\r
2462                 \r
2463                 $member->blogAdminRights($blogid) or self::disallow();\r
2464                 \r
2465                 // check if blog is default blog\r
2466                 if ( $CONF['DefaultBlog'] == $blogid )\r
2467                 {\r
2468                         self::error(_ERROR_DELDEFBLOG);\r
2469                 }\r
2470                 \r
2471                 $blog =& $manager->getBlog($blogid);\r
2472                 \r
2473                 self::pagehead();\r
2474                 self::$skin->parse('deleteblog');\r
2475                 self::pagefoot();\r
2476                 return;\r
2477         }\r
2478         \r
2479         /**\r
2480          * Admin::action_deleteblogconfirm()\r
2481          * Delete Blog\r
2482          * \r
2483          * @param       Void\r
2484          * @return      Void\r
2485          */\r
2486         static private function action_deleteblogconfirm()\r
2487         {\r
2488                 global $member, $CONF, $manager;\r
2489                 \r
2490                 $blogid = intRequestVar('blogid');\r
2491                 \r
2492                 $data = array('blogid' => $blogid);\r
2493                 $manager->notify('PreDeleteBlog', $data);\r
2494                 \r
2495                 $member->blogAdminRights($blogid) or self::disallow();\r
2496                 \r
2497                 // check if blog is default blog\r
2498                 if ( $CONF['DefaultBlog'] == $blogid )\r
2499                 {\r
2500                         self::error(_ERROR_DELDEFBLOG);\r
2501                 }\r
2502                 \r
2503                 // delete all comments\r
2504                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2505                 sql_query($query);\r
2506                 \r
2507                 // delete all items\r
2508                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2509                 sql_query($query);\r
2510                 \r
2511                 // delete all team members\r
2512                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2513                 sql_query($query);\r
2514                 \r
2515                 // delete all bans\r
2516                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2517                 sql_query($query);\r
2518                 \r
2519                 // delete all categories\r
2520                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2521                 sql_query($query);\r
2522                 \r
2523                 // delete all associated plugin options\r
2524                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2525                 \r
2526                 // delete the blog itself\r
2527                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2528                 sql_query($query);\r
2529                 \r
2530                 $data = array('blogid' => $blogid);\r
2531                 $manager->notify('PostDeleteBlog', $data);\r
2532                 \r
2533                 self::$action_overview(_DELETED_BLOG);\r
2534                 return;\r
2535         }\r
2536         \r
2537         /**\r
2538          * Admin::action_memberdelete()\r
2539          * \r
2540          * @param       void\r
2541          * @return      void\r
2542          */\r
2543         static private function action_memberdelete()\r
2544         {\r
2545                 global $member, $manager;\r
2546                 \r
2547                 $memberid = intRequestVar('memberid');\r
2548                 \r
2549                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2550                 \r
2551                 $mem = Member::createFromID($memberid);\r
2552                 \r
2553                 self::pagehead();\r
2554                 self::$skin->parse('memberdelete');\r
2555                 self::pagefoot();\r
2556                 return;\r
2557         }\r
2558         \r
2559         /**\r
2560          * Admin::action_memberdeleteconfirm()\r
2561          * \r
2562          * @param       void\r
2563          * @return      void\r
2564          */\r
2565         static private function action_memberdeleteconfirm()\r
2566         {\r
2567                 global $member;\r
2568                 \r
2569                 $memberid = intRequestVar('memberid');\r
2570                 \r
2571                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2572                 \r
2573                 $error = self::deleteOneMember($memberid);\r
2574                 if ( $error )\r
2575                 {\r
2576                         self::error($error);\r
2577                 }\r
2578                 \r
2579                 if ( $member->isAdmin() )\r
2580                 {\r
2581                         self::$action_usermanagement();\r
2582                 }\r
2583                 else\r
2584                 {\r
2585                         self::$action_overview(_DELETED_MEMBER);\r
2586                 }\r
2587                 return;\r
2588         }\r
2589         \r
2590         /**\r
2591          * Admin::deleteOneMember()\r
2592          * Delete a member by id\r
2593          * \r
2594          * @static\r
2595          * @params      Integer $memberid       member id\r
2596          * @return      String  null string or error messages\r
2597          */\r
2598         static private function deleteOneMember($memberid)\r
2599         {\r
2600                 global $manager;\r
2601                 \r
2602                 $memberid = intval($memberid);\r
2603                 $mem = Member::createFromID($memberid);\r
2604                 \r
2605                 if ( !$mem->canBeDeleted() )\r
2606                 {\r
2607                         return _ERROR_DELETEMEMBER;\r
2608                 }\r
2609                 \r
2610                 $data = array('member' => &$mem);\r
2611                 $manager->notify('PreDeleteMember', $data);\r
2612                 \r
2613                 /* unlink comments from memberid */\r
2614                 if ( $memberid )\r
2615                 {\r
2616                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2617                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2618                         sql_query($query);\r
2619                 }\r
2620                 \r
2621                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2622                 sql_query($query);\r
2623                 \r
2624                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2625                 sql_query($query);\r
2626                 \r
2627                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2628                 sql_query($query);\r
2629                 \r
2630                 // delete all associated plugin options\r
2631                 NucleusPlugin::delete_option_values('member', $memberid);\r
2632                 \r
2633                 $data = array('member' => &$mem);\r
2634                 $manager->notify('PostDeleteMember', $data);\r
2635                 \r
2636                 return '';\r
2637         }\r
2638         \r
2639         /**\r
2640          * Admin::action_createnewlog()\r
2641          * \r
2642          * @param       void\r
2643          * @return      void\r
2644          */\r
2645         static private function action_createnewlog()\r
2646         {\r
2647                 global $member, $CONF, $manager;\r
2648                 \r
2649                 // Only Super-Admins can do this\r
2650                 $member->isAdmin() or self::disallow();\r
2651                 \r
2652                 self::pagehead();\r
2653                 self::$skin->parse('createnewlog');\r
2654                 self::pagefoot();\r
2655                 return;\r
2656         }\r
2657         \r
2658         /**\r
2659          * Admin::action_addnewlog()\r
2660          * \r
2661          * @param       void\r
2662          * @return      void\r
2663          */\r
2664         static private function action_addnewlog()\r
2665         {\r
2666                 global $member, $manager, $CONF;\r
2667                 \r
2668                 // Only Super-Admins can do this\r
2669                 $member->isAdmin() or self::disallow();\r
2670                 \r
2671                 $bname                  = trim(postVar('name'));\r
2672                 $bshortname             = trim(postVar('shortname'));\r
2673                 $btimeoffset    = postVar('timeoffset');\r
2674                 $bdesc                  = trim(postVar('desc'));\r
2675                 $bdefskin               = postVar('defskin');\r
2676                 \r
2677                 if ( !isValidShortName($bshortname) )\r
2678                 {\r
2679                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2680                 }\r
2681                 \r
2682                 if ( $manager->existsBlog($bshortname) )\r
2683                 {\r
2684                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2685                 }\r
2686                 \r
2687                 $data = array(\r
2688                         'name'        => &$bname,\r
2689                         'shortname'   => &$bshortname,\r
2690                         'timeoffset'  => &$btimeoffset,\r
2691                         'description' => &$bdesc,\r
2692                         'defaultskin' => &$bdefskin\r
2693                 );\r
2694                 $manager->notify('PreAddBlog', $data);\r
2695                 \r
2696                 // add slashes for sql queries\r
2697                 $bname                  = sql_real_escape_string($bname);\r
2698                 $bshortname             = sql_real_escape_string($bshortname);\r
2699                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2700                 $bdesc                  = sql_real_escape_string($bdesc);\r
2701                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2702                 \r
2703                 // create blog\r
2704                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2705                 $query = sprintf(sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2706                 sql_query($query);\r
2707                 \r
2708                 $blogid =  sql_insert_id();\r
2709                 $blog   =& $manager->getBlog($blogid);\r
2710                 \r
2711                 // create new category\r
2712                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2713                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2714                 \r
2715                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2716                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2717                 $catid = sql_insert_id();\r
2718                 \r
2719                 // set as default category\r
2720                 $blog->setDefaultCategory($catid);\r
2721                 $blog->writeSettings();\r
2722                 \r
2723                 // create team member\r
2724                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2725                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2726                 sql_query($query);\r
2727                 \r
2728                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2729                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2730                 \r
2731                 $blog->additem(\r
2732                         $blog->getDefaultCategory(),\r
2733                         $itemdeftitle,$itemdefbody,\r
2734                         '',\r
2735                         $blogid,\r
2736                         $member->getID(),\r
2737                         $blog->getCorrectTime(),\r
2738                         0,\r
2739                         0,\r
2740                         0\r
2741                 );\r
2742                 \r
2743                 $data = array('blog' => &$blog);\r
2744                 $manager->notify('PostAddBlog', $data);\r
2745                 \r
2746                 $data = array(\r
2747                         'blog'                  => &$blog,\r
2748                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2749                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2750                         'catid'                 => $catid\r
2751                 );\r
2752                 $manager->notify('PostAddCategory', $data);\r
2753                 \r
2754                 /* TODO: we should consider to use the other way insterad of this */\r
2755                 $_REQUEST['blogid'] = $blogid;\r
2756                 $_REQUEST['catid']  = $catid;\r
2757                 self::pagehead();\r
2758                 self::$skin->parse('addnewlog');\r
2759                 self::pagefoot();\r
2760                 return;\r
2761         }\r
2762         \r
2763         /**\r
2764          * Admin::action_addnewlog2()\r
2765          * \r
2766          * @param       void\r
2767          * @return      void\r
2768          */\r
2769         static private function action_addnewlog2()\r
2770         {\r
2771                 global $member, $manager;\r
2772                 $blogid = intRequestVar('blogid');\r
2773                 \r
2774                 $member->blogAdminRights($blogid) or self::disallow();\r
2775                 \r
2776                 $burl = requestVar('url');\r
2777                 \r
2778                 $blog =& $manager->getBlog($blogid);\r
2779                 $blog->setURL(trim($burl));\r
2780                 $blog->writeSettings();\r
2781                 \r
2782                 self::$action_overview(_MSG_NEWBLOG);\r
2783                 return;\r
2784         }\r
2785         \r
2786         /**\r
2787          * Admin::action_skinieoverview()\r
2788          * \r
2789          * @param       void\r
2790          * @return      void\r
2791          */\r
2792         static private function action_skinieoverview()\r
2793         {\r
2794                 global $member, $DIR_LIBS, $manager;\r
2795                 \r
2796                 $member->isAdmin() or self::disallow();\r
2797                 \r
2798                 include_once($DIR_LIBS . 'skinie.php');\r
2799                 \r
2800                 self::pagehead();\r
2801                 self::$skin->parse('skinieoverview');\r
2802                 self::pagefoot();\r
2803                 return;\r
2804         }\r
2805         \r
2806         /**\r
2807          * Admin::action_skinieimport()\r
2808          * \r
2809          * @param       void\r
2810          * @return      void\r
2811          */\r
2812         static private function action_skinieimport()\r
2813         {\r
2814                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2815                 \r
2816                 $member->isAdmin() or self::disallow();\r
2817                 \r
2818                 // load skinie class\r
2819                 include_once($DIR_LIBS . 'skinie.php');\r
2820                 \r
2821                 $skinFileRaw    = postVar('skinfile');\r
2822                 $mode                   = postVar('mode');\r
2823                 \r
2824                 $importer = new SkinImport();\r
2825                 \r
2826                 // get full filename\r
2827                 if ($mode == 'file')\r
2828                 {\r
2829                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2830                         \r
2831                         /* TODO: remove this\r
2832                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2833                         if ( !file_exists($skinFile) )\r
2834                         {\r
2835                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2836                         }\r
2837                          */\r
2838                 }\r
2839                 else\r
2840                 {\r
2841                         $skinFile = $skinFileRaw;\r
2842                 }\r
2843                 \r
2844                 // read only metadata\r
2845                 $error = $importer->readFile($skinFile, 1);\r
2846                 \r
2847                 /* TODO: we should consider to use the other way insterad of this */\r
2848                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2849                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2850                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2851                 \r
2852                 // clashes\r
2853                 $skinNameClashe                 = $importer->checkSkinNameClashes();\r
2854                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2855                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2856                 \r
2857                 /* TODO: we should consider to use the other way insterad of this */\r
2858                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2859                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2860                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2861                 \r
2862                 if ( $error )\r
2863                 {\r
2864                         self::error($error);\r
2865                 }\r
2866                 \r
2867                 self::pagehead();\r
2868                 self::$skin->parse('skinieimport');\r
2869                 self::pagefoot();\r
2870                 return;\r
2871         }\r
2872         \r
2873         /**\r
2874          * Admin::action_skiniedoimport()\r
2875          * \r
2876          * @param       void\r
2877          * @return      void\r
2878          */\r
2879         static private function action_skiniedoimport()\r
2880         {\r
2881                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2882                 \r
2883                 $member->isAdmin() or self::disallow();\r
2884                 \r
2885                 // load skinie class\r
2886                 include_once($DIR_LIBS . 'skinie.php');\r
2887                 \r
2888                 $skinFileRaw    = postVar('skinfile');\r
2889                 $mode                   = postVar('mode');\r
2890                 \r
2891                 $allowOverwrite = intPostVar('overwrite');\r
2892                 \r
2893                 // get full filename\r
2894                 if ( $mode == 'file' )\r
2895                 {\r
2896                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2897                         \r
2898                         /* TODO: remove this\r
2899                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2900                         if ( !file_exists($skinFile) )\r
2901                         {\r
2902                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2903                         }\r
2904                         */\r
2905                 }\r
2906                 else\r
2907                 {\r
2908                         $skinFile = $skinFileRaw;\r
2909                 }\r
2910                 \r
2911                 $importer = new SkinImport();\r
2912                 \r
2913                 $error = $importer->readFile($skinFile);\r
2914                 \r
2915                 if ( $error )\r
2916                 {\r
2917                         self::error($error);\r
2918                 }\r
2919                 \r
2920                 $error = $importer->writeToDatabase($allowOverwrite);\r
2921                 \r
2922                 if ( $error )\r
2923                 {\r
2924                         self::error($error);\r
2925                 }\r
2926                 \r
2927                 /* TODO: we should consider to use the other way insterad of this */\r
2928                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2929                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2930                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2931                 \r
2932                 self::pagehead();\r
2933                 self::$skin->parse('skiniedoimport');\r
2934                 self::pagefoot();\r
2935                 return;\r
2936         }\r
2937 \r
2938         /**\r
2939          * Admin::action_skinieexport()\r
2940          * \r
2941          * @param       void\r
2942          * @return      void\r
2943          */\r
2944         static private function action_skinieexport()\r
2945         {\r
2946                 global $member, $DIR_LIBS;\r
2947                 \r
2948                 $member->isAdmin() or self::disallow();\r
2949                 \r
2950                 // load skinie class\r
2951                 include_once($DIR_LIBS . 'skinie.php');\r
2952                 \r
2953                 $aSkins         = requestIntArray('skin');\r
2954                 $aTemplates     = requestIntArray('template');\r
2955                 \r
2956                 if ( !is_array($aTemplates) )\r
2957                 {\r
2958                         $aTemplates = array();\r
2959                 }\r
2960                 if ( !is_array($aSkins) )\r
2961                 {\r
2962                         $aSkins = array();\r
2963                 }\r
2964                 \r
2965                 $skinList               = array_keys($aSkins);\r
2966                 $templateList   = array_keys($aTemplates);\r
2967                 \r
2968                 $info = postVar('info');\r
2969                 \r
2970                 $exporter = new SkinExport();\r
2971                 foreach ( $skinList as $skinId )\r
2972                 {\r
2973                         $exporter->addSkin($skinId);\r
2974                 }\r
2975                 foreach ($templateList as $templateId)\r
2976                 {\r
2977                         $exporter->addTemplate($templateId);\r
2978                 }\r
2979                 $exporter->setInfo($info);\r
2980                 \r
2981                 $exporter->export();\r
2982                 return;\r
2983         }\r
2984         \r
2985         /**\r
2986          * Admin::action_templateoverview()\r
2987          * \r
2988          * @param       void\r
2989          * @return      void\r
2990          */\r
2991         static private function action_templateoverview()\r
2992         {\r
2993                 global $member, $manager;\r
2994                 \r
2995                 $member->isAdmin() or self::disallow();\r
2996                 \r
2997                 self::pagehead();\r
2998                 self::$skin->parse('templateoverview');\r
2999                 self::pagefoot();\r
3000                 return;\r
3001         }\r
3002         \r
3003         /**\r
3004          * Admin::action_templateedit()\r
3005          * \r
3006          * @param       string  $msg    message for pageheader\r
3007          * @return      void\r
3008          */\r
3009         static private function action_templateedit($msg = '')\r
3010         {\r
3011                 global $member, $manager;\r
3012                 if ( $msg )\r
3013                 {\r
3014                         self::$headMess = $msg;\r
3015                 }\r
3016                 \r
3017                 $templateid = intRequestVar('templateid');\r
3018                 \r
3019                 $member->isAdmin() or self::disallow();\r
3020                 \r
3021                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3022                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3023                 \r
3024                 self::pagehead($extrahead);\r
3025                 self::$skin->parse('templateedit');\r
3026                 self::pagefoot();\r
3027                 return;\r
3028         }\r
3029         \r
3030         /**\r
3031          * TODO: remove this\r
3032          *\r
3033         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3034                 static $count = 1;\r
3035                 if (!isset($template[$name])) $template[$name] = '';\r
3036         ?>\r
3037                 </tr><tr>\r
3038                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3039                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3040         <?php       $count++;\r
3041         }\r
3042         */\r
3043         \r
3044         /**\r
3045          * Admin::action_templateupdate()\r
3046          * \r
3047          * @param       void\r
3048          * @return      void\r
3049          */\r
3050         static private function action_templateupdate()\r
3051         {\r
3052                 global $member,$manager;\r
3053                 \r
3054                 $templateid = intRequestVar('templateid');\r
3055                 \r
3056                 $member->isAdmin() or self::disallow();\r
3057                 \r
3058                 $name = postVar('tname');\r
3059                 $desc = postVar('tdesc');\r
3060                 \r
3061                 if ( !isValidTemplateName($name) )\r
3062                 {\r
3063                         self::error(_ERROR_BADTEMPLATENAME);\r
3064                 }\r
3065                 \r
3066                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3067                 {\r
3068                         self::error(_ERROR_DUPTEMPLATENAME);\r
3069                 }\r
3070                 \r
3071                 $name = sql_real_escape_string($name);\r
3072                 $desc = sql_real_escape_string($desc);\r
3073                 \r
3074                 // 1. Remove all template parts\r
3075                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3076                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3077                 sql_query($query);\r
3078                 \r
3079                 // 2. Update description\r
3080                 $query = "UPDATE %s SET tdname='%s',tddesc='%s' WHERE tdnumber=%d;";\r
3081                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3082                 sql_query($query);\r
3083                 \r
3084                 // 3. Add non-empty template parts\r
3085                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3086                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3087                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3088                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3089                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3090                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3091                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3092                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3093                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3094                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3095                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3096                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3097                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3098                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3099                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3100                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3101                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3102                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3103                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3104                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3105                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3106                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3107                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3108                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3109                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3110                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3111                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3112                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3113                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3114                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3115                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3116                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3117                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3118                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3119                 \r
3120                 $data = array('fields' => array());\r
3121                 $manager->notify('TemplateExtraFields', $data);\r
3122                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3123                 {\r
3124                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3125                         {\r
3126                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3127                         }\r
3128                 }\r
3129                 \r
3130                 // jump back to template edit\r
3131                 self::$action_templateedit(_TEMPLATE_UPDATED);\r
3132                 return;\r
3133         }\r
3134         \r
3135         /**\r
3136          * Admin::addToTemplate()\r
3137          * \r
3138          * @param       Integer $id     ID for template\r
3139          * @param       String  $partname       parts name\r
3140          * @param       String  $content        template contents\r
3141          * @return      Integer record index\r
3142          * \r
3143          */\r
3144         static private function addToTemplate($id, $partname, $content)\r
3145         {\r
3146                 // don't add empty parts:\r
3147                 if ( !trim($content) )\r
3148                 {\r
3149                         return -1;\r
3150                 }\r
3151                 \r
3152                 $partname = sql_real_escape_string($partname);\r
3153                 $content  = sql_real_escape_string($content);\r
3154                 \r
3155                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3156                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3157                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3158                 return sql_insert_id();\r
3159         }\r
3160         \r
3161         /**\r
3162          * Admin::action_templatedelete()\r
3163          * \r
3164          * @param       void\r
3165          * @return      void\r
3166          */\r
3167         static private function action_templatedelete()\r
3168         {\r
3169                 global $member, $manager;\r
3170                 \r
3171                 $member->isAdmin() or self::disallow();\r
3172                 \r
3173                 $templateid = intRequestVar('templateid');\r
3174                 // TODO: check if template can be deleted\r
3175                 \r
3176                 self::pagehead();\r
3177                 self::$skin->parse('templatedelete');\r
3178                 self::pagefoot();\r
3179                 return;\r
3180         }\r
3181         \r
3182         /**\r
3183          * Admin::action_templatedeleteconfirm()\r
3184          * \r
3185          * @param       void\r
3186          * @return      void\r
3187          */\r
3188         static private function action_templatedeleteconfirm()\r
3189         {\r
3190                 global $member, $manager;\r
3191                 \r
3192                 $templateid = intRequestVar('templateid');\r
3193                 \r
3194                 $member->isAdmin() or self::disallow();\r
3195                 \r
3196                 $data = array('templateid' => $templateid);\r
3197                 $manager->notify('PreDeleteTemplate', $data);\r
3198                 \r
3199                 // 1. delete description\r
3200                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3201                 \r
3202                 // 2. delete parts\r
3203                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3204                 \r
3205                 \r
3206                 $data = array('templateid' => $templateid);\r
3207                 $manager->notify('PostDeleteTemplate', $data);\r
3208                 \r
3209                 self::$action_templateoverview();\r
3210                 return;\r
3211         }\r
3212         \r
3213         /**\r
3214          * Admin::action_templatenew()\r
3215          * \r
3216          * @param       void\r
3217          * @return      void\r
3218          */\r
3219         static private function action_templatenew()\r
3220         {\r
3221                 global $member;\r
3222                 \r
3223                 $member->isAdmin() or self::disallow();\r
3224                 \r
3225                 $name = postVar('name');\r
3226                 $desc = postVar('desc');\r
3227                 \r
3228                 if ( !isValidTemplateName($name) )\r
3229                 {\r
3230                         self::error(_ERROR_BADTEMPLATENAME);\r
3231                 }\r
3232                 \r
3233                 if ( Template::exists($name) )\r
3234                 {\r
3235                         self::error(_ERROR_DUPTEMPLATENAME);\r
3236                 }\r
3237                 \r
3238                 $newTemplateId = Template::createNew($name, $desc);\r
3239                 \r
3240                 self::$action_templateoverview();\r
3241                 return;\r
3242         }\r
3243         \r
3244         /**\r
3245          * Admin::action_templateclone()\r
3246          * \r
3247          * @param       void\r
3248          * @return      void\r
3249          */\r
3250         static private function action_templateclone()\r
3251         {\r
3252                 global $member;\r
3253                 \r
3254                 $templateid = intRequestVar('templateid');\r
3255                 \r
3256                 $member->isAdmin() or self::disallow();\r
3257                 \r
3258                 // 1. read old template\r
3259                 $name = Template::getNameFromId($templateid);\r
3260                 $desc = Template::getDesc($templateid);\r
3261                 \r
3262                 // 2. create desc thing\r
3263                 $name = "cloned" . $name;\r
3264                 \r
3265                 // if a template with that name already exists:\r
3266                 if ( Template::exists($name) )\r
3267                 {\r
3268                         $i = 1;\r
3269                         while (Template::exists($name . $i))\r
3270                         {\r
3271                                 $i++;\r
3272                         }\r
3273                         $name .= $i;\r
3274                 }\r
3275                 \r
3276                 $newid = Template::createNew($name, $desc);\r
3277                 \r
3278                 // 3. create clone\r
3279                 // go through parts of old template and add them to the new one\r
3280                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3281                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3282                 \r
3283                 $res = sql_query($query);\r
3284                 while ( $o = sql_fetch_object($res) )\r
3285                 {\r
3286                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3287                 }\r
3288                 \r
3289                 self::$action_templateoverview();\r
3290                 return;\r
3291         }\r
3292         \r
3293         /**\r
3294          * Admin::action_admintemplateoverview()\r
3295          * \r
3296          * @param       void\r
3297          * @return      void\r
3298          */\r
3299         static private function action_admintemplateoverview()\r
3300         {\r
3301                 global $member, $manager;\r
3302                 $member->isAdmin() or self::disallow();\r
3303                 self::pagehead();\r
3304                 self::$skin->parse('admntemplateoverview');\r
3305                 self::pagefoot();\r
3306                 return;\r
3307         }\r
3308         \r
3309         /**\r
3310          * Admin::action_admintemplateedit()\r
3311          * \r
3312          * @param       string  $msg    message for pageheader\r
3313          * @return      void\r
3314          */\r
3315         static private function action_admintemplateedit($msg = '')\r
3316         {\r
3317                 global $member, $manager;\r
3318                 if ( $msg )\r
3319                 {\r
3320                         self::$headMess = $msg;\r
3321                 }\r
3322                 $member->isAdmin() or self::disallow();\r
3323                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3324                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3325                 self::pagehead($extrahead);\r
3326                 self::$skin->parse('admintemplateedit');\r
3327                 self::pagefoot();\r
3328                 return;\r
3329         }\r
3330         \r
3331         /**\r
3332          * Admin::action_admintemplateupdate()\r
3333          * \r
3334          * @param       void\r
3335          * @return      void\r
3336          */\r
3337         static private function action_admintemplateupdate()\r
3338         {\r
3339                 global $member, $manager;\r
3340                 $templateid = intRequestVar('templateid');\r
3341                 $member->isAdmin() or self::disallow();\r
3342                 $name = postVar('tname');\r
3343                 $desc = postVar('tdesc');\r
3344                 \r
3345                 if ( !isValidTemplateName($name) )\r
3346                 {\r
3347                         self::error(_ERROR_BADTEMPLATENAME);\r
3348                 }\r
3349                 \r
3350                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3351                 {\r
3352                         self::error(_ERROR_DUPTEMPLATENAME);\r
3353                 }\r
3354                 $name = sql_real_escape_string($name);\r
3355                 $desc = sql_real_escape_string($desc);\r
3356                 \r
3357                 // 1. Remove all template parts\r
3358                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3359                 $query = sprintf($query, (integer) $templateid);\r
3360                 sql_query($query);\r
3361                 \r
3362                 // 2. Update description\r
3363                 $query = 'UPDATE %s SET tdname=%s tddesc=%s WHERE tdnumber=%d;';\r
3364                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3365                 sql_query($query);\r
3366                 \r
3367                 // 3. Add non-empty template parts\r
3368                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3369                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3370                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3371                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3372                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3375                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3376                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3377                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3378                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3379                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3380                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3381                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3382                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3383                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3384                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3385                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3386                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3387                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3388                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3389                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3390                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3391                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3392                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3393                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3394                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3395                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3396                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3397                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3470                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3473                 \r
3474                 $data = array('fields' => array());\r
3475                 $manager->notify('TemplateExtraFields', $data);\r
3476                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3477                 {\r
3478                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3479                         {\r
3480                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3481                         }\r
3482                 }\r
3483                 \r
3484                 // jump back to template edit\r
3485                 self::$action_admintemplateedit(_TEMPLATE_UPDATED);\r
3486                 return;\r
3487         }\r
3488         \r
3489         /**\r
3490          * Admin::addToAdminTemplate()\r
3491          * \r
3492          * @param       integer $id                     ID for template\r
3493          * @param       string  $partname       name of part for template\r
3494          * @param       void    $contents       content for part of template\r
3495          * @return      integer ID for newly inserted Template\r
3496          */\r
3497         static private function addToAdminTemplate($id, $partname, $content)\r
3498         {\r
3499                 // don't add empty parts:\r
3500                 if ( !trim($content) )\r
3501                 {\r
3502                         return -1;\r
3503                 }\r
3504                 \r
3505                 $query = "INSERT INTO (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3506                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($contents));\r
3507                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3508                 return sql_insert_id();\r
3509         }\r
3510         \r
3511         /**\r
3512          * Admin::action_admintemplatedelete()\r
3513          * \r
3514          * @param       void\r
3515          * @return      void\r
3516          */\r
3517         static private function action_admintemplatedelete()\r
3518         {\r
3519                 global $member, $manager;\r
3520                 $member->isAdmin() or self::disallow();\r
3521                 \r
3522                 // TODO: check if template can be deleted\r
3523                 self::pagehead();\r
3524                 self::$skin->parse('admintemplatedelete');\r
3525                 self::pagefoot();\r
3526                 return;\r
3527         }\r
3528         \r
3529         /**\r
3530          * Admin::action_admintemplatedeleteconfirm()\r
3531          * \r
3532          * @param       void\r
3533          * @return      void\r
3534          */\r
3535         static private function action_admintemplatedeleteconfirm()\r
3536         {\r
3537                 global $member, $manager;\r
3538                 \r
3539                 $templateid = intRequestVar('templateid');\r
3540                 $member->isAdmin() or self::disallow();\r
3541                 \r
3542                 $data = array('templateid' => $templateid);\r
3543                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3544                 \r
3545                 // 1. delete description\r
3546                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3547                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3548                 sql_query($query);\r
3549                 \r
3550                 // 2. delete parts\r
3551                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3552                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3553                 sql_query();\r
3554                 \r
3555                 $data = array('templateid' => $templateid);\r
3556                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3557                 \r
3558                 self::$action_admintemplateoverview();\r
3559                 return;\r
3560         }\r
3561         \r
3562         /**\r
3563          * Admin::action_admintemplatenew()\r
3564          * \r
3565          * @param       void\r
3566          * @return      void\r
3567          */\r
3568         static private function action_admintemplatenew()\r
3569         {\r
3570                 global $member;\r
3571                 $member->isAdmin() or self::disallow();\r
3572                 $name = postVar('name');\r
3573                 $desc = postVar('desc');\r
3574                 \r
3575                 if ( !isValidTemplateName($name) )\r
3576                 {\r
3577                         self::error(_ERROR_BADTEMPLATENAME);\r
3578                 }\r
3579                 if ( Template::exists($name) )\r
3580                 {\r
3581                         self::error(_ERROR_DUPTEMPLATENAME);\r
3582                 }\r
3583                 \r
3584                 $newTemplateId = Template::createNew($name, $desc);\r
3585                 self::$action_admintemplateoverview();\r
3586                 return;\r
3587         }\r
3588         \r
3589         /**\r
3590          * Admin::action_admintemplateclone()\r
3591          * \r
3592          * @param       void\r
3593          * @return      void\r
3594          */\r
3595         static private function action_admintemplateclone()\r
3596         {\r
3597                 global $member;\r
3598                 $templateid = intRequestVar('templateid');\r
3599                 $member->isAdmin() or self::disallow();\r
3600                 \r
3601                 // 1. read old template\r
3602                 $name = Template::getNameFromId($templateid);\r
3603                 $desc = Template::getDesc($templateid);\r
3604                 \r
3605                 // 2. create desc thing\r
3606                 $name = "cloned" . $name;\r
3607                 \r
3608                 // if a template with that name already exists:\r
3609                 if ( Template::exists($name) )\r
3610                 {\r
3611                         $i = 1;\r
3612                         while ( Template::exists($name . $i) )\r
3613                         {\r
3614                                 $i++;\r
3615                         }\r
3616                         $name .= $i;\r
3617                 }\r
3618                 \r
3619                 $newid = Template::admincreateNew($name, $desc);\r
3620                 \r
3621                 // 3. create clone\r
3622                 // go through parts of old template and add them to the new one\r
3623                 $query = "SELECT tpartname, tcontent FROM %sWHERE tdesc=%d;";\r
3624                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3625                 \r
3626                 $res = sql_query($query);\r
3627                 while ( $o = sql_fetch_object($res) )\r
3628                 {\r
3629                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3630                 }\r
3631                 \r
3632                 self::$action_admintemplateoverview();\r
3633                 return;\r
3634         }\r
3635 \r
3636         /**\r
3637          * Admin::action_skinoverview()\r
3638          * \r
3639          * @param       void\r
3640          * @return      void\r
3641          */\r
3642         static private function action_skinoverview()\r
3643         {\r
3644                 global $member, $manager;\r
3645                 \r
3646                 $member->isAdmin() or self::disallow();\r
3647                 \r
3648                 self::pagehead();\r
3649                 self::$skin->parse('skinoverview');\r
3650                 self::pagefoot();\r
3651                 return;\r
3652         }\r
3653         \r
3654         /**\r
3655          * Admin::action_skinnew()\r
3656          * \r
3657          * @param       void\r
3658          * @return      void\r
3659          */\r
3660         static private function action_skinnew()\r
3661         {\r
3662                 global $member;\r
3663                 \r
3664                 $member->isAdmin() or self::disallow();\r
3665                 \r
3666                 $name = trim(postVar('name'));\r
3667                 $desc = trim(postVar('desc'));\r
3668                 \r
3669                 if ( !isValidSkinName($name) )\r
3670                 {\r
3671                         self::error(_ERROR_BADSKINNAME);\r
3672                 }\r
3673                 \r
3674                 if ( SKIN::exists($name) )\r
3675                 {\r
3676                         self::error(_ERROR_DUPSKINNAME);\r
3677                 }\r
3678                 \r
3679                 $newId = SKIN::createNew($name, $desc);\r
3680                 \r
3681                 self::$action_skinoverview();\r
3682                 return;\r
3683         }\r
3684         \r
3685         /**\r
3686          * Admin::action_skinedit()\r
3687          * \r
3688          * @param       void\r
3689          * @return      void\r
3690          */\r
3691         static private function action_skinedit()\r
3692         {\r
3693                 global $member, $manager;\r
3694                 \r
3695                 $member->isAdmin() or self::disallow();\r
3696                 \r
3697                 self::pagehead();\r
3698                 self::$skin->parse('skinedit');\r
3699                 self::pagefoot();\r
3700                 return;\r
3701         }\r
3702         \r
3703         /**\r
3704          * Admin::action_skineditgeneral()\r
3705          * \r
3706          * @param       void\r
3707          * @return      void\r
3708          */\r
3709         static private function action_skineditgeneral()\r
3710         {\r
3711                 global $member;\r
3712                 \r
3713                 $skinid = intRequestVar('skinid');\r
3714                 \r
3715                 $member->isAdmin() or self::disallow();\r
3716                 \r
3717                 $name           = postVar('name');\r
3718                 $desc           = postVar('desc');\r
3719                 $type           = postVar('type');\r
3720                 $inc_mode       = postVar('inc_mode');\r
3721                 $inc_prefix     = postVar('inc_prefix');\r
3722                 \r
3723                 $skin = new Skin($skinid);\r
3724                 \r
3725                 // 1. Some checks\r
3726                 if ( !isValidSkinName($name) )\r
3727                 {\r
3728                         self::error(_ERROR_BADSKINNAME);\r
3729                 }\r
3730                 \r
3731                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3732                 {\r
3733                         self::error(_ERROR_DUPSKINNAME);\r
3734                 }\r
3735                 \r
3736                 if ( !$type )\r
3737                 {\r
3738                         $type = 'text/html';\r
3739                 }\r
3740                 if ( !$inc_mode )\r
3741                 {\r
3742                         $inc_mode = 'normal';\r
3743                 }\r
3744                 \r
3745                 // 2. Update description\r
3746                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3747                 \r
3748                 self::$action_skinedit();\r
3749                 return;\r
3750         }\r
3751         \r
3752         static private function action_skinedittype($msg = '')\r
3753         {\r
3754                 global $member, $manager;\r
3755                 \r
3756                 $member->isAdmin() or self::disallow();\r
3757                 \r
3758                 if ( $msg )\r
3759                 {\r
3760                         self::$headMess = $msg;\r
3761                 }\r
3762                 \r
3763                 $skinid = intRequestVar('skinid');\r
3764                 $type   = requestVar('type');\r
3765                 $type   = trim($type);\r
3766                 $type   = strtolower($type);\r
3767                 \r
3768                 if ( !isValidShortName($type) )\r
3769                 {\r
3770                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3771                 }\r
3772                 \r
3773                 self::pagehead();\r
3774                 self::$skin->parse('skinedittype');\r
3775                 self::pagefoot();\r
3776                 return;\r
3777         }\r
3778         \r
3779         /**\r
3780          * Admin::action_skinupdate()\r
3781          * \r
3782          * @param       void\r
3783          * @return      void\r
3784          */\r
3785         static private function action_skinupdate()\r
3786         {\r
3787                 global $member;\r
3788                 \r
3789                 $skinid = intRequestVar('skinid');\r
3790                 $content = trim(postVar('content'));\r
3791                 $type = postVar('type');\r
3792                 \r
3793                 $member->isAdmin() or self::disallow();\r
3794                 \r
3795                 $skin = new SKIN($skinid);\r
3796                 $skin->update($type, $content);\r
3797                 \r
3798                 self::$action_skinedittype(_SKIN_UPDATED);\r
3799                 return;\r
3800         }\r
3801         \r
3802         /**\r
3803          * Admin::action_skindelete()\r
3804          * \r
3805          * @param       void\r
3806          * @return      void\r
3807          */\r
3808         static private function action_skindelete()\r
3809         {\r
3810                 global $member, $manager, $CONF;\r
3811                 \r
3812                 $skinid = intRequestVar('skinid');\r
3813                 \r
3814                 $member->isAdmin() or self::disallow();\r
3815                 \r
3816                 // don't allow default skin to be deleted\r
3817                 if ( $skinid == $CONF['BaseSkin'] )\r
3818                 {\r
3819                         self::error(_ERROR_DEFAULTSKIN);\r
3820                 }\r
3821                 \r
3822                 // don't allow deletion of default skins for blogs\r
3823                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3824                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3825                 \r
3826                 $r = sql_query($query);\r
3827                 if ( $o = sql_fetch_object($r) )\r
3828                 {\r
3829                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3830                 }\r
3831                 \r
3832                 self::pagehead();\r
3833                 self::$skin->parse('skindelete');\r
3834                 self::pagefoot();\r
3835                 return;\r
3836         }\r
3837         \r
3838         /**\r
3839          * Admin::action_skindeleteconfirm()\r
3840          * \r
3841          * @param       void\r
3842          * @return      void\r
3843          */\r
3844         static private function action_skindeleteconfirm()\r
3845         {\r
3846                 global $member, $CONF, $manager;\r
3847                 \r
3848                 $skinid = intRequestVar('skinid');\r
3849                 \r
3850                 $member->isAdmin() or self::disallow();\r
3851                 \r
3852                 // don't allow default skin to be deleted\r
3853                 if ( $skinid == $CONF['BaseSkin'] )\r
3854                 {\r
3855                         self::error(_ERROR_DEFAULTSKIN);\r
3856                 }\r
3857                 \r
3858                 // don't allow deletion of default skins for blogs\r
3859                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3860                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3861                 \r
3862                 $r = sql_query($query);\r
3863                 if ( $o = sql_fetch_object($r) )\r
3864                 {\r
3865                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3866                 }\r
3867                 \r
3868                 $data = array('skinid' => $skinid);\r
3869                 $manager->notify('PreDeleteSkin', $data);\r
3870                 \r
3871                 // 1. delete description\r
3872                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3873                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3874                 sql_query($query);\r
3875                 \r
3876                 // 2. delete parts\r
3877                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3878                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3879                 sql_query($query);\r
3880                 \r
3881                 $data = array('skinid' => $skinid);\r
3882                 $manager->notify('PostDeleteSkin', $data);\r
3883                 \r
3884                 self::$action_skinoverview();\r
3885                 return;\r
3886         }\r
3887         \r
3888         /**\r
3889          * Admin::action_skinremovetype()\r
3890          * \r
3891          * @param       void\r
3892          * @return      void\r
3893          */\r
3894         static private function action_skinremovetype()\r
3895         {\r
3896                 global $member, $manager, $CONF;\r
3897                 \r
3898                 $member->isAdmin() or self::disallow();\r
3899                 \r
3900                 $skinid = intRequestVar('skinid');\r
3901                 $skintype = requestVar('type');\r
3902                 \r
3903                 if ( !isValidShortName($skintype) )\r
3904                 {\r
3905                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3906                 }\r
3907                 \r
3908                 // don't allow default skinparts to be deleted\r
3909                 /* TODO: this array should be retrieved from Action class */\r
3910                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3911                 {\r
3912                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3913                 }\r
3914                 \r
3915                 self::pagehead();\r
3916                 self::$skin->parse('skinremovetype');\r
3917                 self::pagefoot();\r
3918                 return;\r
3919         }\r
3920         \r
3921         /**\r
3922          * Admin::action_skinremovetypeconfirm()\r
3923          * \r
3924          * @param       void\r
3925          * @return      void\r
3926          */\r
3927         static private function action_skinremovetypeconfirm()\r
3928         {\r
3929                 global $member, $CONF, $manager;\r
3930                 \r
3931                 $member->isAdmin() or self::disallow();\r
3932                 \r
3933                 $skinid = intRequestVar('skinid');\r
3934                 $skintype = requestVar('type');\r
3935                 \r
3936                 if ( !isValidShortName($skintype) )\r
3937                 {\r
3938                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3939                 }\r
3940                 \r
3941                 // don't allow default skinparts to be deleted\r
3942                 /* TODO: this array should be retrieved from Action class */\r
3943                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3944                 {\r
3945                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3946                 }\r
3947                 \r
3948                 $data = array(\r
3949                         'skinid'   => $skinid,\r
3950                         'skintype' => $skintype\r
3951                 );\r
3952                 $manager->notify('PreDeleteSkinPart', $data);\r
3953                 \r
3954                 // delete part\r
3955                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3956                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3957                 sql_query($query);\r
3958                 \r
3959                 $data = array(\r
3960                         'skinid'   => $skinid,\r
3961                         'skintype' => $skintype\r
3962                 );\r
3963                 $manager->notify('PostDeleteSkinPart', $data);\r
3964                 \r
3965                 self::$action_skinedit();\r
3966                 return;\r
3967         }\r
3968 \r
3969         /**\r
3970          * Admin::action_skinclone()\r
3971          * \r
3972          * @param       void\r
3973          * @return      void\r
3974          */\r
3975         static private function action_skinclone()\r
3976         {\r
3977                 global $member;\r
3978                 \r
3979                 $member->isAdmin() or self::disallow();\r
3980                 \r
3981                 $skinid = intRequestVar('skinid');\r
3982                 \r
3983                 // 1. read skin to clone\r
3984                 $skin = new Skin($skinid);\r
3985                 \r
3986                 $name = "clone_{$skin->getName()}";\r
3987                 \r
3988                 // if a skin with that name already exists:\r
3989                 if ( Skin::exists($name) )\r
3990                 {\r
3991                         $i = 1;\r
3992                         while (Skin::exists($name . $i))\r
3993                                 $i++;\r
3994                         $name .= $i;\r
3995                 }\r
3996                 \r
3997                 // 2. create skin desc\r
3998                 $newid = Skin::createNew(\r
3999                         $name,\r
4000                         $skin->getDescription(),\r
4001                         $skin->getContentType(),\r
4002                         $skin->getIncludeMode(),\r
4003                         $skin->getIncludePrefix()\r
4004                 );\r
4005                 \r
4006                 // 3. clone\r
4007                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4008                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4009                 \r
4010                 $res = sql_query($query);\r
4011                 while ( $row = sql_fetch_assoc($res) )\r
4012                 {\r
4013                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4014                 }\r
4015                 \r
4016                 self::$action_skinoverview();\r
4017                 return;\r
4018         }\r
4019         \r
4020         /**\r
4021          * Admin::skinclonetype()\r
4022          * \r
4023          * @param       String  $skin   Skin object\r
4024          * @param       Integer $newid  ID for this clone\r
4025          * @param       String  $type   type of skin\r
4026          * @return      Void\r
4027          */\r
4028         static private function skinclonetype($skin, $newid, $type)\r
4029         {\r
4030                 $newid = intval($newid);\r
4031                 $content = $skin->getContent($type);\r
4032                 \r
4033                 if ( $content )\r
4034                 {\r
4035                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4036                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4037                         sql_query($query);\r
4038                 }\r
4039                 return;\r
4040         }\r
4041         \r
4042         /**\r
4043          * Admin::action_adminskinoverview()\r
4044          * \r
4045          * @param       void\r
4046          * @return      void\r
4047          */\r
4048         static private function action_adminskinoverview()\r
4049         {\r
4050                 global $member, $manager;\r
4051                 \r
4052                 $member->isAdmin() or self::disallow();\r
4053                 \r
4054                 self::pagehead();\r
4055                 self::$skin->parse('adminskinoverview');\r
4056                 self::pagefoot();\r
4057                 return;\r
4058         }\r
4059         \r
4060         /**\r
4061          * Admin::action_adminskinnew()\r
4062          * \r
4063          * @param       void\r
4064          * @return      void\r
4065          */\r
4066         static private function action_adminskinnew()\r
4067         {\r
4068                 global $member;\r
4069                 $member->isAdmin() or self::disallow();\r
4070                 $name = trim(postVar('name'));\r
4071                 $desc = trim(postVar('desc'));\r
4072                 \r
4073                 if ( !isValidSkinName($name) )\r
4074                 {\r
4075                         self::error(_ERROR_BADSKINNAME);\r
4076                 }\r
4077                 if ( Skin::exists($name) )\r
4078                 {\r
4079                         self::error(_ERROR_DUPSKINNAME);\r
4080                 }\r
4081                 /* TODO: $newId is not reused... */\r
4082                 $newId = Skin::createNew($name, $desc);\r
4083                 self::$action_adminskinoverview();\r
4084                 return;\r
4085         }\r
4086         \r
4087         /**\r
4088          * Admin::action_adminskinedit()\r
4089          * \r
4090          * @param       void\r
4091          * @return      void\r
4092          */\r
4093         static private function action_adminskinedit()\r
4094         {\r
4095                 global $member, $manager;\r
4096                 \r
4097                 $member->isAdmin() or self::disallow();\r
4098                 self::pagehead();\r
4099                 self::$skin->parse('adminskinedit');\r
4100                 self::pagefoot();\r
4101                 return;\r
4102         }\r
4103         \r
4104         /**\r
4105          * Admin::action_adminskineditgeneral()\r
4106          * \r
4107          * @param       void\r
4108          * @return      void\r
4109          */\r
4110         static private function action_adminskineditgeneral()\r
4111         {\r
4112                 global $member;\r
4113                 \r
4114                 $skinid = intRequestVar('skinid');\r
4115                 \r
4116                 $member->isAdmin() or self::disallow();\r
4117                 \r
4118                 $name           = postVar('name');\r
4119                 $desc           = postVar('desc');\r
4120                 $type           = postVar('type');\r
4121                 $inc_mode       = postVar('inc_mode');\r
4122                 $inc_prefix     = postVar('inc_prefix');\r
4123                 \r
4124                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4125                 \r
4126                 // 1. Some checks\r
4127                 if ( !isValidSkinName($name) )\r
4128                 {\r
4129                         self::error(_ERROR_BADSKINNAME);\r
4130                 }\r
4131                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4132                 {\r
4133                         self::error(_ERROR_DUPSKINNAME);\r
4134                 }\r
4135                 if ( !$type )\r
4136                 {\r
4137                         $type = 'text/html';\r
4138                 }\r
4139                 if ( !$inc_mode )\r
4140                 {\r
4141                         $inc_mode = 'normal';\r
4142                 }\r
4143                 // 2. Update description\r
4144                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4145                 self::$action_adminskinedit();\r
4146                 return;\r
4147         }\r
4148         \r
4149         /**\r
4150          * Admin::action_adminskinedittype()\r
4151          * \r
4152          * @param       string  $msg    message for pageheader\r
4153          * @return      void\r
4154          */\r
4155         static private function action_adminskinedittype($msg = '')\r
4156         {\r
4157                 global $member, $manager;\r
4158                 \r
4159                 $member->isAdmin() or self::disallow();\r
4160                 \r
4161                 if ( $msg )\r
4162                 {\r
4163                         self::$headMess = $msg;\r
4164                 }\r
4165                 $type = requestVar('type');\r
4166                 $type = trim($type);\r
4167                 $type = strtolower($type);\r
4168                 \r
4169                 if ( !isValidShortName($type) )\r
4170                 {\r
4171                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4172                 }\r
4173                 \r
4174                 self::pagehead();\r
4175                 self::$skin->parse('adminskinedittype');\r
4176                 self::pagefoot();\r
4177                 return;\r
4178         }\r
4179         \r
4180         /**\r
4181          * Admin::action_adminskinupdate()\r
4182          * \r
4183          * @param       void\r
4184          * @return      void\r
4185          */\r
4186         static private function action_adminskinupdate()\r
4187         {\r
4188                 global $member;\r
4189                 $skinid         = intRequestVar('skinid');\r
4190                 $content        = trim(postVar('content'));\r
4191                 $type           = postVar('type');\r
4192                 \r
4193                 $member->isAdmin() or self::disallow();\r
4194                 \r
4195                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4196                 $skin->update($type, $content);\r
4197                 self::$action_adminskinedittype(_SKIN_UPDATED);\r
4198                 return;\r
4199         }\r
4200         \r
4201         /**\r
4202          * Admin::action_adminskindelete()\r
4203          * \r
4204          * @param       void\r
4205          * @return      void\r
4206          */\r
4207         static private function action_adminskindelete()\r
4208         {\r
4209                 global $member, $manager, $CONF;\r
4210                 $member->isAdmin() or self::disallow();\r
4211                 \r
4212                 /* TODO: needless variable $skinid... */\r
4213                 $skinid = intRequestVar('skinid');\r
4214                 self::pagehead();\r
4215                 self::$skin->parse('adminskindelete');\r
4216                 self::pagefoot();\r
4217                 return;\r
4218         }\r
4219 \r
4220         /**\r
4221          * Admin::action_adminskindeleteconfirm()\r
4222          * \r
4223          * @param       void\r
4224          * @return      void\r
4225          */\r
4226         static private function action_adminskindeleteconfirm()\r
4227         {\r
4228                 global $member, $CONF, $manager;\r
4229                 $member->isAdmin() or self::disallow();\r
4230                 $skinid = intRequestVar('skinid');\r
4231                 // don't allow default skin to be deleted\r
4232                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4233                 {\r
4234                         self::error(_ERROR_DEFAULTSKIN);\r
4235                 }\r
4236                 \r
4237                 // don't allow deletion of default skins for members\r
4238                 $memberDefaults =  $member->getAdminSkin();\r
4239                 foreach ( $memberDefaults as $memID => $adminskin )\r
4240                 {\r
4241                         if ( $skinid == $adminskin )\r
4242                         {\r
4243                                 $mem = MEMBER::createFromID($memID);\r
4244                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4245                         }\r
4246                 }\r
4247                 \r
4248                 $data = array('skinid' => (integer) $skinid);\r
4249                 $manager->notify('PreDeleteAdminSkin', $data);\r
4250                 \r
4251                 // 1. delete description\r
4252                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
4253                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
4254                 sql_query($query);\r
4255                 \r
4256                 // 2. delete parts\r
4257                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
4258                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
4259                 \r
4260                 sql_query($query);\r
4261                 \r
4262                 $data = array('skinid' => intval($skinid));\r
4263                 $manager->notify('PostDeleteAdminSkin', $data);\r
4264                 self::$action_adminskinoverview();\r
4265                 return;\r
4266         }\r
4267         \r
4268         /**\r
4269          * Admin::action_adminskinremovetype()\r
4270          * \r
4271          * @param       void\r
4272          * @return      void\r
4273          */\r
4274         static private function action_adminskinremovetype()\r
4275         {\r
4276                 global $member, $manager, $CONF;\r
4277 \r
4278                 $member->isAdmin() or self::disallow();\r
4279                 \r
4280                 $skinid         = intRequestVar('skinid');\r
4281                 $skintype       = requestVar('type');\r
4282                 \r
4283                 if ( !isValidShortName($skintype) )\r
4284                 {\r
4285                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4286                 }\r
4287                 \r
4288                 self::pagehead();\r
4289                 self::$skin->parse('adminskinremovetype');\r
4290                 self::pagefoot();\r
4291                 return;\r
4292         }\r
4293         \r
4294         /**\r
4295          * Admin::action_adminskinremovetypeconfirm()\r
4296          * \r
4297          * @param       void\r
4298          * @return      void\r
4299          */\r
4300         static private function action_adminskinremovetypeconfirm()\r
4301         {\r
4302                 global $member, $CONF, $manager;\r
4303                 \r
4304                 $member->isAdmin() or self::disallow();\r
4305                 \r
4306                 $skinid         = intRequestVar('skinid');\r
4307                 $skintype       = requestVar('type');\r
4308                 \r
4309                 if ( !isValidShortName($skintype) )\r
4310                 {\r
4311                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4312                 }\r
4313                 \r
4314                 $data =array(\r
4315                         'skinid'        => $skinid,\r
4316                         'skintype'      => $skintype\r
4317                 );\r
4318                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4319                 \r
4320                 // delete part\r
4321                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4322                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4323                 sql_query($query);\r
4324                 \r
4325                 $data = array(\r
4326                         'skinid'        => $skinid,\r
4327                         'skintype'      => $skintype\r
4328                 );\r
4329                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4330                 \r
4331                 self::$action_adminskinedit();\r
4332                 return;\r
4333         }\r
4334 \r
4335         /**\r
4336          * Admin::action_adminskinclone()\r
4337          * \r
4338          * @param       void\r
4339          * @return      void\r
4340          */\r
4341         static private function action_adminskinclone()\r
4342         {\r
4343                 global $member;\r
4344                 \r
4345                 $member->isAdmin() or self::disallow();\r
4346                 \r
4347                 $skinid = intRequestVar('skinid');\r
4348                 \r
4349                 // 1. read skin to clone\r
4350                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4351                 $name = "clone_{$skin->getName()}";\r
4352                 \r
4353                 // if a skin with that name already exists:\r
4354                 if ( Skin::exists($name) )\r
4355                 {\r
4356                         $i = 1;\r
4357                         while ( Skin::exists($name . $i) )\r
4358                         {\r
4359                                 $i++;\r
4360                         }\r
4361                         $name .= $i;\r
4362                 }\r
4363                 \r
4364                 // 2. create skin desc\r
4365                 $newid = Skin::createNew(\r
4366                         $name,\r
4367                         $skin->getDescription(),\r
4368                         $skin->getContentType(),\r
4369                         $skin->getIncludeMode(),\r
4370                         $skin->getIncludePrefix()\r
4371                 );\r
4372                 \r
4373                 $query = "SELECT stype %s FROM WHERE sdesc=%d;";\r
4374                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4375                 \r
4376                 $res = sql_query($query);\r
4377                 while ( $row = sql_fetch_assoc($res) )\r
4378                 {\r
4379                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4380                 }\r
4381                 self::$action_adminskinoverview();\r
4382                 return;\r
4383         }\r
4384         \r
4385         /**\r
4386          * Admin::adminskinclonetype()\r
4387          * \r
4388          * @param       string  $skin   an instance of Skin class\r
4389          * @param       integer $newid  ID for new skin\r
4390          * @param       string  $type   skin type\r
4391          * @return      void\r
4392          */\r
4393         static private function adminskinclonetype($skin, $newid, $type)\r
4394         {\r
4395                 $content = $skin->getContentFromDB($type);\r
4396                 \r
4397                 if ( $content )\r
4398                 {\r
4399                         $content        = sql_real_escape_string($content);\r
4400                         $type           = sql_real_escape_string($type);\r
4401                         \r
4402                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4403                         $query = sprintf(sql_table('skin'), (integer) $newid, $content, $type);\r
4404                         sql_query($query);\r
4405                 }\r
4406                 return;\r
4407         }\r
4408         \r
4409         /**\r
4410          * Admin::action_adminskinieoverview()\r
4411          * \r
4412          * @param       void\r
4413          * @return      void\r
4414          */\r
4415         static private function action_adminskinieoverview()\r
4416         {\r
4417                 global $member, $DIR_LIBS, $manager;\r
4418                 \r
4419                 $member->isAdmin() or self::disallow();\r
4420                 \r
4421                 // load skinie class\r
4422                 include_once($DIR_LIBS . 'skinie.php');\r
4423                 \r
4424                 self::pagehead();\r
4425                 self::$skin->parse('adminskinieoverview');\r
4426                 self::pagefoot();\r
4427                 return;\r
4428         }\r
4429 \r
4430         /**\r
4431          * Admin::action_adminskinieimport()\r
4432          * \r
4433          * @param       void\r
4434          * @return      void\r
4435          */\r
4436         static private function action_adminskinieimport()\r
4437         {\r
4438                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4439                 \r
4440                 $member->isAdmin() or self::disallow();\r
4441                 \r
4442                 // load skinie class\r
4443                 include_once($DIR_LIBS . 'skinie.php');\r
4444                 \r
4445                 $skinFileRaw    = postVar('skinfile');\r
4446                 $mode                   = postVar('mode');\r
4447                 \r
4448                 $importer = new SKINIMPORT();\r
4449                 \r
4450                 // get full filename\r
4451                 if ( $mode == 'file' )\r
4452                 {\r
4453                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4454                         \r
4455                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4456                         if ( !file_exists($skinFile) )\r
4457                         {\r
4458                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4459                         }\r
4460                 }\r
4461                 else\r
4462                 {\r
4463                         $skinFile = $skinFileRaw;\r
4464                 }\r
4465                 \r
4466                 // read only metadata\r
4467                 $error = $importer->readFile($skinFile, 1);\r
4468                 if ( $error )\r
4469                 {\r
4470                         self::error($error);\r
4471                 }\r
4472                 \r
4473                 /* TODO: we should consider to use the other way instead of this */\r
4474                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4475                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4476                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4477                 \r
4478                 // clashes\r
4479                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4480                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4481                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4482                 /* TODO: we should consider to use the other way instead of this */\r
4483                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4484                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4485                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4486                 \r
4487                 self::pagehead();\r
4488                 self::$skin->parse('adminskinieimport');\r
4489                 self::pagefoot();\r
4490                 return;\r
4491         }\r
4492         \r
4493         /**\r
4494          * Admin::action_adminskiniedoimport()\r
4495          * \r
4496          * @param       void\r
4497          * @return      void\r
4498          */\r
4499         static private function action_adminskiniedoimport()\r
4500         {\r
4501                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4502                 \r
4503                 $member->isAdmin() or self::disallow();\r
4504                 \r
4505                 // load skinie class\r
4506                 include_once($DIR_LIBS . 'skinie.php');\r
4507                 \r
4508                 $skinFileRaw    = postVar('skinfile');\r
4509                 $mode                   = postVar('mode');\r
4510                 $allowOverwrite = intPostVar('overwrite');\r
4511                 \r
4512                 // get full filename\r
4513                 if ( $mode == 'file' )\r
4514                 {\r
4515                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4516                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4517                         if ( !file_exists($skinFile) )\r
4518                         {\r
4519                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4520                         }\r
4521                 }\r
4522                 else\r
4523                 {\r
4524                         $skinFile = $skinFileRaw;\r
4525                 }\r
4526                 \r
4527                 $importer = new SKINIMPORT();\r
4528                 \r
4529                 $error = $importer->readFile($skinFile);\r
4530                 if ( $error )\r
4531                 {\r
4532                         self::error($error);\r
4533                 }\r
4534                 \r
4535                 $error = $importer->writeToDatabase($allowOverwrite);\r
4536                 if ( $error )\r
4537                 {\r
4538                         self::error($error);\r
4539                 }\r
4540                 \r
4541                 /* TODO: we should consider to use the other way instead of this */\r
4542                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4543                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4544                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4545                 \r
4546                 self::pagehead();\r
4547                 self::$skin->parse('adminskiniedoimport');\r
4548                 self::pagefoot();\r
4549                 return;\r
4550         }\r
4551 \r
4552         /**\r
4553          * Admin::action_adminskinieexport()\r
4554          * \r
4555          * @param       void\r
4556          * @return      void\r
4557          */\r
4558         static private function action_adminskinieexport()\r
4559         {\r
4560                 global $member, $DIR_PLUGINS;\r
4561                 \r
4562                 $member->isAdmin() or self::disallow();\r
4563                 \r
4564                 // load skinie class\r
4565                 $aSkins = requestIntArray('skin');\r
4566                 if (!is_array($aSkins)) {\r
4567                         $aSkins = array();\r
4568                 }\r
4569                 $skinList = array_keys($aSkins);\r
4570                 \r
4571                 $aTemplates = requestIntArray('template');\r
4572                 if (!is_array($aTemplates))\r
4573                 {\r
4574                         $aTemplates = array();\r
4575                 }\r
4576                 $templateList = array_keys($aTemplates);\r
4577                 \r
4578                 $info = postVar('info');\r
4579                 \r
4580                 $exporter = new SkinEXPORT();\r
4581                 foreach ( $skinList as $skinId )\r
4582                 {\r
4583                         $exporter->addSkin($skinId);\r
4584                 }\r
4585                 foreach ( $templateList as $templateId )\r
4586                 {\r
4587                         $exporter->addTemplate($templateId);\r
4588                 }\r
4589                 $exporter->setInfo($info);\r
4590                 $exporter->export();\r
4591                 return;\r
4592         }\r
4593         \r
4594         /**\r
4595          * Admin::action_settingsedit()\r
4596          * \r
4597          * @param       Void\r
4598          * @return      Void\r
4599          */\r
4600         static private function action_settingsedit()\r
4601         {\r
4602                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4603                 \r
4604                 $member->isAdmin() or self::disallow();\r
4605                 \r
4606                 self::pagehead();\r
4607                 self::$skin->parse('settingsedit');\r
4608                 self::pagefoot();\r
4609                 return;\r
4610         }\r
4611         \r
4612         /**\r
4613          * Admin::action_settingsupdate()\r
4614          * Update $CONFIG and redirect\r
4615          * \r
4616          * @param       void\r
4617          * @return      void\r
4618          */\r
4619         static private function action_settingsupdate()\r
4620         {\r
4621                 global $member, $CONF;\r
4622                 \r
4623                 $member->isAdmin() or self::disallow();\r
4624                 \r
4625                 // check if email address for admin is valid\r
4626                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4627                 {\r
4628                         self::error(_ERROR_BADMAILADDRESS);\r
4629                 }\r
4630                 \r
4631                 // save settings\r
4632                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4633                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4634                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4635                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4636                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4637                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4638                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4639                 self::updateConfig('Locale',                    postVar('Locale'));\r
4640                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4641                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4642                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4643                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4644                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4645                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4646                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4647                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4648                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4649                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4650                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4651                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4652                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4653                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4654                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4655                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4656                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4657                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4658                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4659                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4660                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4661                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4662                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4663                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4664                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4665                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4666                 \r
4667                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4668                 // note that when changing cookie settings, this redirect might cause the user\r
4669                 // to have to log in again.\r
4670                 getConfig();\r
4671                 redirect($CONF['AdminURL'] . '?action=manage');\r
4672                 return;\r
4673         }\r
4674         \r
4675         /**\r
4676          * Admin::action_systemoverview()\r
4677          * Output system overview\r
4678          * \r
4679          * @param       void\r
4680          * @return      void\r
4681          */\r
4682         static private function action_systemoverview()\r
4683         {\r
4684                 self::pagehead();\r
4685                 self::$skin->parse('systemoverview');\r
4686                 self::pagefoot();\r
4687                 return;\r
4688         }\r
4689         \r
4690         /**\r
4691          * Admin::updateConfig()\r
4692          * \r
4693          * @param       string  $name   \r
4694          * @param       string  $val    \r
4695          * @return      integer return the ID in which the latest query posted\r
4696          */\r
4697         static private function updateConfig($name, $val)\r
4698         {\r
4699                 $name = sql_real_escape_string($name);\r
4700                 $val = trim(sql_real_escape_string($val));\r
4701                 \r
4702                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4703                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4704                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4705                 return sql_insert_id();\r
4706         }\r
4707         \r
4708         /**\r
4709          * Admin::error()\r
4710          * Error message\r
4711          * \r
4712          * @param       string  $msg    message that will be shown\r
4713          * @return      void\r
4714          */\r
4715         static private function error($msg)\r
4716         {\r
4717                 self::pagehead();\r
4718                 self::$skin->parse('adminerrorpage');\r
4719                 self::pagefoot();\r
4720                 return;\r
4721         }\r
4722         \r
4723         /**\r
4724          * Admin::disallow()\r
4725          * add error log and show error page \r
4726          * \r
4727          * @param       void\r
4728          * @return      void\r
4729          */\r
4730         static private function disallow()\r
4731         {\r
4732                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4733                 self::error(_ERROR_DISALLOWED);\r
4734                 return;\r
4735         }\r
4736         \r
4737         /**\r
4738          * Admin::PluninAdminPagehead()\r
4739          * Output pluginadmin page head\r
4740          *\r
4741          * @param       string  $extrahead\r
4742          * @return      void\r
4743          */\r
4744         static public function PluninAdminPagehead($extrahead = '')\r
4745         {\r
4746                 self::pagehead();\r
4747                 return;\r
4748         }\r
4749         \r
4750         /**\r
4751          * Admin::PluninAdminPagefoot()\r
4752          * Output pluginadmin page foot\r
4753          *\r
4754          * @param       void\r
4755          * @return      void\r
4756          */\r
4757         static public function PluninAdminPagefoot()\r
4758         {\r
4759                 self::pagefoot();\r
4760                 return;\r
4761         }\r
4762         \r
4763         /**\r
4764          * Admin::pagehead()\r
4765          * Output admin page head\r
4766          * \r
4767          * @param       string  PluninAdminPagehead\r
4768          * @return      void\r
4769          */\r
4770         static private function pagehead($extrahead = '')\r
4771         {\r
4772                 global $member, $nucleus, $CONF, $manager;\r
4773 \r
4774                 if ( self::existsSkinContents('pagehead') )\r
4775                 {\r
4776                         if ( isset($extrahead) && !empty($extrahead) )\r
4777                         {\r
4778                         self::$extrahead = $extrahead;\r
4779                         }\r
4780                         self::$skin->parse('pagehead');\r
4781                 }\r
4782                 else\r
4783                 {\r
4784                         $data = array(\r
4785                                 'extrahead'     => &$extrahead,\r
4786                                 'action'        => self::$action\r
4787                         );\r
4788                         \r
4789                         $manager->notify('AdminPrePageHead', $data);\r
4790                         \r
4791                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4792                         \r
4793                         /*\r
4794                          * TODO: obsoleted\r
4795                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4796                         {\r
4797                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4798                                 $CONF['AdminCSS'] = 'original';\r
4799                         }\r
4800                         */\r
4801                         \r
4802                         /* HTTP 1.1 application for no caching */\r
4803                         header("Cache-Control: no-cache, must-revalidate");\r
4804                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4805                         \r
4806                         $root_element = 'html';\r
4807                         $charset = i18n::get_current_charset();\r
4808                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4809                         $xml_version_info = self::$xml_version_info;\r
4810                         $formal_public_identifier = self::$formal_public_identifier;\r
4811                         $system_identifier = self::$system_identifier;\r
4812                         $xhtml_namespace = self::$xhtml_namespace;\r
4813                         \r
4814                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4815                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4816                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4817                         echo "<head>\n";\r
4818                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4819                         /*\r
4820                          * TODO: obsoleted\r
4821                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4822                         */\r
4823                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4824                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4825                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4826                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4827                         echo "{$extrahead}\n";\r
4828                         echo "</head>\n\n";\r
4829                         echo "<body>\n";\r
4830                         echo "<div id=\"adminwrapper\">\n";\r
4831                         echo "<div class=\"header\">\n";\r
4832                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4833                         echo "</div>\n";\r
4834                         echo "<div id=\"container\">\n";\r
4835                         echo "<div id=\"content\">\n";\r
4836                         echo "<div class=\"loginname\">\n";\r
4837                         if ( $member->isLoggedIn() )\r
4838                         {\r
4839                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4840                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4841                         }\r
4842                         else\r
4843                         {\r
4844                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4845                         }\r
4846                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4847                         echo '(';\r
4848                         \r
4849                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4850                         {\r
4851                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4852                         }\r
4853                         else\r
4854                         {\r
4855                                 $codenamestring = '';\r
4856                         }\r
4857                         \r
4858                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4859                         {\r
4860                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4861                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4862                                 \r
4863                                 $newestVersion = getLatestVersion();\r
4864                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4865                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4866                                 \r
4867                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4868                                 {\r
4869                                         echo "<br />\n";\r
4870                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4871                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4872                                         echo "</a>";\r
4873                                 }\r
4874                         }\r
4875                         else\r
4876                         {\r
4877                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4878                         }\r
4879                         echo ')';\r
4880                         echo '</div>';\r
4881                 }\r
4882                 return;\r
4883         }\r
4884         \r
4885         /**\r
4886          * Admin::pagefoot()\r
4887          * Output admin page foot include quickmenu\r
4888          * \r
4889          * @param       void\r
4890          * @return      void\r
4891          */\r
4892         static private function pagefoot()\r
4893         {\r
4894                 global $action, $member, $manager;\r
4895                 \r
4896                 if ( self::existsSkinContents('pagefoot') )\r
4897                 {\r
4898                         self::$skin->parse('pagefoot');\r
4899                         exit;\r
4900                 }\r
4901                 else\r
4902                 {\r
4903                         $data = array(\r
4904                                 'action' => self::$action\r
4905                         );\r
4906                         \r
4907                         $manager->notify('AdminPrePageFoot', $data);\r
4908                         \r
4909                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4910                         {\r
4911                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4912                                 echo "<ul>\n";\r
4913                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4914                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4915                                 echo "</ul>\n";\r
4916                         }\r
4917                         \r
4918                         echo "<div class=\"foot\">\n";\r
4919                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4920                         echo '-';\r
4921                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4922                         echo "</div>\n";\r
4923                         \r
4924                         echo "<div id=\"quickmenu\">\n";\r
4925                         \r
4926                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4927                         {\r
4928                                 echo "<ul>\n";\r
4929                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4930                                 echo "</ul>\n";\r
4931                                 \r
4932                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4933                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4934                                 echo "<p>\n";\r
4935                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4936                                 \r
4937                                 $showAll = requestVar('showall');\r
4938                                 \r
4939                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4940                                 {\r
4941                                         // Super-Admins have access to all blogs! (no add item support though)\r
4942                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4943                                         $query = sprintf($query, sql_table('blog'));\r
4944                                 }\r
4945                                 else\r
4946                                 {\r
4947                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4948                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4949                                 }\r
4950                                 $template['name']               = 'blogid';\r
4951                                 $template['tabindex']   = 15000;\r
4952                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4953                                 $template['selected']   = -1;\r
4954                                 $template['shorten']    = 10;\r
4955                                 $template['shortenel']  = '';\r
4956                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4957                                 showlist($query, 'select', $template);\r
4958                                 \r
4959                                 echo "</p>\n";\r
4960                                 echo "</form>\n";\r
4961                                 \r
4962                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4963                                 echo "<ul>\n";\r
4964                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4965                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4966                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4967                                 echo "</ul>\n";\r
4968                                 \r
4969                                 if ( $member->isAdmin() )\r
4970                                 {\r
4971                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4972                                         echo "<ul>\n";\r
4973                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4974                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4975                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4976                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4977                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4978                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4979                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4980                                         echo "</ul>\n";\r
4981                                         \r
4982                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4983                                         echo "<ul>\n";\r
4984                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4985                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4986                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4987                                         echo "</ul>\n";\r
4988                                 }\r
4989                                 \r
4990                                 $data = array('options' => array());\r
4991                                 \r
4992                                 $manager->notify('QuickMenu', $data);\r
4993                                 \r
4994                                 if ( count($data['options']) > 0 )\r
4995                                 {\r
4996                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4997                                         echo "<ul>\n";\r
4998                                         foreach ( $data['options'] as $option )\r
4999                                         {\r
5000                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
5001                                         }\r
5002                                         echo "</ul>\n";\r
5003                                 }\r
5004                         }\r
5005                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
5006                         {\r
5007                         \r
5008                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
5009                         }\r
5010                         else\r
5011                         {\r
5012                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
5013                         }\r
5014                         \r
5015                         echo "<!-- quickmenu -->\n";\r
5016                         echo "</div>\n";\r
5017                         \r
5018                         echo "<!-- content -->\n";\r
5019                         echo "</div>\n";\r
5020                         \r
5021                         echo "<!-- container -->\n";\r
5022                         echo "</div>\n";\r
5023                         \r
5024                         echo "<!-- adminwrapper -->\n";\r
5025                         echo "</div>\n";\r
5026                         \r
5027                         echo "</body>\n";\r
5028                         echo "</html>\n";\r
5029                 }\r
5030                 return;\r
5031         }\r
5032         \r
5033         /**\r
5034          * Admin::action_bookmarklet()\r
5035          * \r
5036          * @param       void\r
5037          * @return      void\r
5038          */\r
5039         static private function action_bookmarklet()\r
5040         {\r
5041                 global $member, $manager;\r
5042                 \r
5043                 $member->teamRights($blogid) or self::disallow();\r
5044                 \r
5045                 $blogid = intRequestVar('blogid');\r
5046                 \r
5047                 self::pagehead();\r
5048                 self::$skin->parse('bookmarklet');\r
5049                 self::pagefoot();\r
5050                 return;\r
5051         }\r
5052         \r
5053         /**\r
5054          * Admin::action_actionlog()\r
5055          * \r
5056          * @param       void\r
5057          * @return      void\r
5058          */\r
5059         static private function action_actionlog()\r
5060         {\r
5061                 global $member, $manager;\r
5062                 \r
5063                 $member->isAdmin() or self::disallow();\r
5064                 \r
5065                 self::pagehead();\r
5066                 self::$skin->parse('actionlog');\r
5067                 self::pagefoot();\r
5068                 return;\r
5069         }\r
5070         \r
5071         /**\r
5072          * Admin::action_banlist()\r
5073          * \r
5074          * @param       void\r
5075          * @return      void\r
5076          */\r
5077         static private function action_banlist()\r
5078         {\r
5079                 global $member, $manager;\r
5080                 \r
5081                 $member->blogAdminRights($blogid) or self::disallow();\r
5082                 \r
5083                 $blogid = intRequestVar('blogid');\r
5084                 \r
5085                 self::pagehead();\r
5086                 self::$skin->parse('banlist');\r
5087                 self::pagefoot();\r
5088                 return;\r
5089         }\r
5090         \r
5091         /**\r
5092          * Admin::action_banlistdelete()\r
5093          * \r
5094          * @param       void\r
5095          * @return      void\r
5096          */\r
5097         static private function action_banlistdelete()\r
5098         {\r
5099                 global $member, $manager;\r
5100                 \r
5101                 $blogid = intRequestVar('blogid');\r
5102                 $member->blogAdminRights($blogid) or self::disallow();\r
5103                 \r
5104                 self::pagehead();\r
5105                 self::$skin->parse('banlistdelete');\r
5106                 self::pagefoot();\r
5107                 return;\r
5108         }\r
5109         \r
5110         /**\r
5111          * Admin::action_banlistdeleteconfirm()\r
5112          * \r
5113          * @param       void\r
5114          * @return      void\r
5115          */\r
5116         static private function action_banlistdeleteconfirm()\r
5117         {\r
5118                 global $member, $manager;\r
5119                 \r
5120                 $member->blogAdminRights($blogid) or self::disallow();\r
5121                 \r
5122                 $blogid         = intPostVar('blogid');\r
5123                 $allblogs       = postVar('allblogs');\r
5124                 $iprange        = postVar('iprange');\r
5125                 \r
5126                 $deleted = array();\r
5127                 \r
5128                 if ( !$allblogs )\r
5129                 {\r
5130                         if ( Ban::removeBan($blogid, $iprange) )\r
5131                         {\r
5132                                 array_push($deleted, $blogid);\r
5133                         }\r
5134                 }\r
5135                 else\r
5136                 {\r
5137                         // get blogs fot which member has admin rights\r
5138                         $adminblogs = $member->getAdminBlogs();\r
5139                         foreach ($adminblogs as $blogje)\r
5140                         {\r
5141                                 if ( Ban::removeBan($blogje, $iprange) )\r
5142                                 {\r
5143                                         array_push($deleted, $blogje);\r
5144                                 }\r
5145                         }\r
5146                 }\r
5147                 \r
5148                 if ( sizeof($deleted) == 0 )\r
5149                 {\r
5150                         self::error(_ERROR_DELETEBAN);\r
5151                 }\r
5152                 \r
5153                 self::pagehead();\r
5154                 self::$skin->parse('banlistdeleteconfirm');\r
5155                 self::pagefoot();\r
5156                 return;\r
5157         }\r
5158         \r
5159         /**\r
5160          * Admin::action_banlistnewfromitem()\r
5161          * \r
5162          * @param       void\r
5163          * @return      void\r
5164          */\r
5165         static private function action_banlistnewfromitem()\r
5166         {\r
5167                 self::$action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5168                 return;\r
5169         }\r
5170         \r
5171         /**\r
5172          * Admin::action_banlistnew()\r
5173          * \r
5174          * @param       integer $blogid ID for weblog\r
5175          * @return      void\r
5176          */\r
5177         static private function action_banlistnew($blogid = '')\r
5178         {\r
5179                 global $member, $manager;\r
5180                 \r
5181                 if ( $blogid == '' )\r
5182                 {\r
5183                         $blogid = intRequestVar('blogid');\r
5184                 }\r
5185                 \r
5186                 $ip = requestVar('ip');\r
5187                 \r
5188                 $member->blogAdminRights($blogid) or self::disallow();\r
5189                 \r
5190                 /* TODO: we should consider to use the other way instead of this */\r
5191                 $_REQUEST['blogid'] = $blogid;          \r
5192                 \r
5193                 self::pagehead();\r
5194                 self::$skin->parse('banlistnew');\r
5195                 self::pagefoot();\r
5196                 \r
5197                 return;\r
5198         }\r
5199 \r
5200         /**\r
5201          * Admin::action_banlistadd()\r
5202          * \r
5203          * @param       void\r
5204          * @return      void\r
5205          */\r
5206         static private function action_banlistadd()\r
5207         {\r
5208                 global $member;\r
5209                 \r
5210                 $blogid         = intPostVar('blogid');\r
5211                 $allblogs       = postVar('allblogs');\r
5212                 $iprange        = postVar('iprange');\r
5213                 \r
5214                 if ( $iprange == "custom" )\r
5215                 {\r
5216                         $iprange = postVar('customiprange');\r
5217                 }\r
5218                 $reason   = postVar('reason');\r
5219                 \r
5220                 $member->blogAdminRights($blogid) or self::disallow();\r
5221                 \r
5222                 // TODO: check IP range validity\r
5223                 \r
5224                 if ( !$allblogs )\r
5225                 {\r
5226                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5227                         {\r
5228                                 self::error(_ERROR_ADDBAN);\r
5229                         }\r
5230                 }\r
5231                 else\r
5232                 {\r
5233                         // get blogs fot which member has admin rights\r
5234                         $adminblogs = $member->getAdminBlogs();\r
5235                         $failed = 0;\r
5236                         foreach ($adminblogs as $blogje)\r
5237                         {\r
5238                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5239                                 {\r
5240                                         $failed = 1;\r
5241                                 }\r
5242                         }\r
5243                         if ( $failed )\r
5244                         {\r
5245                                 self::error(_ERROR_ADDBAN);\r
5246                         }\r
5247                 }\r
5248                 self::$action_banlist();\r
5249                 return;\r
5250         }\r
5251         \r
5252         /**\r
5253          * Admin::action_clearactionlog()\r
5254          * \r
5255          * @param       void\r
5256          * @return      void\r
5257          */\r
5258         static private function action_clearactionlog()\r
5259         {\r
5260                 global $member;\r
5261                 \r
5262                 $member->isAdmin() or self::disallow();\r
5263                 \r
5264                 ActionLog::clear();\r
5265                 \r
5266                 self::$action_manage(_MSG_ACTIONLOGCLEARED);\r
5267                 return;\r
5268         }\r
5269         \r
5270         /**\r
5271          * Admin::action_backupoverview()\r
5272          * \r
5273          * @param       void\r
5274          * @return      void\r
5275          */\r
5276         static private function action_backupoverview()\r
5277         {\r
5278                 global $member, $manager;\r
5279                 \r
5280                 $member->isAdmin() or self::disallow();\r
5281                 \r
5282                 self::pagehead();\r
5283                 self::$skin->parse('backupoverview');\r
5284                 self::pagefoot();\r
5285                 return;\r
5286         }\r
5287 \r
5288         /**\r
5289          * Admin::action_backupcreate()\r
5290          * create file for backup\r
5291          * \r
5292          * @param               void\r
5293          * @return      void\r
5294          * \r
5295          */\r
5296         static private function action_backupcreate()\r
5297         {\r
5298                 global $member, $DIR_LIBS;\r
5299                 \r
5300                 $member->isAdmin() or self::disallow();\r
5301                 \r
5302                 // use compression ?\r
5303                 $useGzip = (integer) postVar('gzip');\r
5304                 \r
5305                 include($DIR_LIBS . 'backup.php');\r
5306                 \r
5307                 // try to extend time limit\r
5308                 // (creating/restoring dumps might take a while)\r
5309                 @set_time_limit(1200);\r
5310                 \r
5311                 Backup::do_backup($useGzip);\r
5312                 exit;\r
5313         }\r
5314         \r
5315         /**\r
5316          * Admin::action_backuprestore()\r
5317          * restoring from uploaded file\r
5318          * \r
5319          * @param               void\r
5320          * @return      void\r
5321          */\r
5322         static private function action_backuprestore()\r
5323         {\r
5324                 global $member, $DIR_LIBS;\r
5325                 \r
5326                 $member->isAdmin() or self::disallow();\r
5327                 \r
5328                 if ( intPostVar('letsgo') != 1 )\r
5329                 {\r
5330                         self::error(_ERROR_BACKUP_NOTSURE);\r
5331                 }\r
5332                 \r
5333                 include($DIR_LIBS . 'backup.php');\r
5334                 \r
5335                 // try to extend time limit\r
5336                 // (creating/restoring dumps might take a while)\r
5337                 @set_time_limit(1200);\r
5338                 \r
5339                 $message = Backup::do_restore();\r
5340                 if ( $message != '' )\r
5341                 {\r
5342                         self::error($message);\r
5343                 }\r
5344                 self::pagehead();\r
5345                 self::$skin->parse('backuprestore');\r
5346                 self::pagefoot();\r
5347                 return;\r
5348         }\r
5349         \r
5350         /**\r
5351          * Admin::action_pluginlist()\r
5352          * output the list of installed plugins\r
5353          * \r
5354          * @param       void\r
5355          * @return      void\r
5356          * \r
5357          */\r
5358         static private function action_pluginlist()\r
5359         {\r
5360                 global $DIR_PLUGINS, $member, $manager;\r
5361                 \r
5362                 // check if allowed\r
5363                 $member->isAdmin() or self::disallow();\r
5364                 \r
5365                 self::pagehead();\r
5366                 self::$skin->parse('pluginlist');\r
5367                 self::pagefoot();\r
5368                 return;\r
5369         }\r
5370         \r
5371         /**\r
5372          * Admin::action_pluginhelp()\r
5373          * \r
5374          * @param       void\r
5375          * @return      void\r
5376          */\r
5377         static private function action_pluginhelp()\r
5378         {\r
5379                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5380                 \r
5381                 // check if allowed\r
5382                 $member->isAdmin() or self::disallow();\r
5383                 \r
5384                 $plugid = intGetVar('plugid');\r
5385                 \r
5386                 if ( !$manager->pidInstalled($plugid) )\r
5387                 {\r
5388                         self::error(_ERROR_NOSUCHPLUGIN);\r
5389                 }\r
5390                 \r
5391                 self::pagehead();\r
5392                 self::$skin->parse('pluginhelp');\r
5393                 self::pagefoot();\r
5394                 return;\r
5395         }\r
5396         \r
5397         /**\r
5398          * Admin::action_pluginadd()\r
5399          * \r
5400          * @param       Void\r
5401          * @return      Void\r
5402          * \r
5403          */\r
5404         static private function action_pluginadd()\r
5405         {\r
5406                 global $member, $manager, $DIR_PLUGINS;\r
5407                 \r
5408                 // check if allowed\r
5409                 $member->isAdmin() or self::disallow();\r
5410                 \r
5411                 $name = postVar('filename');\r
5412                 \r
5413                 if ( $manager->pluginInstalled($name) )\r
5414                 {\r
5415                         self::error(_ERROR_DUPPLUGIN);\r
5416                 }\r
5417                 \r
5418                 if ( !checkPlugin($name) )\r
5419                 {\r
5420                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5421                 }\r
5422                 \r
5423                 // get number of currently installed plugins\r
5424                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5425                 $numCurrent = sql_num_rows($res);\r
5426                 \r
5427                 // plugin will be added as last one in the list\r
5428                 $newOrder = $numCurrent + 1;\r
5429                 \r
5430                 $data = array('file' => &$name);\r
5431                 $manager->notify('PreAddPlugin', $data);\r
5432                 \r
5433                 // do this before calling getPlugin (in case the plugin id is used there)\r
5434                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5435                 $query = sprintf(sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5436                 sql_query($query);\r
5437                 $iPid = sql_insert_id();\r
5438                 \r
5439                 $manager->clearCachedInfo('installedPlugins');\r
5440                 \r
5441                 // Load the plugin for condition checking and instalation\r
5442                 $plugin =& $manager->getPlugin($name);\r
5443                 \r
5444                 // check if it got loaded (could have failed)\r
5445                 if ( !$plugin )\r
5446                 {\r
5447                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5448                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5449                         \r
5450                         sql_query($query);\r
5451                         \r
5452                         $manager->clearCachedInfo('installedPlugins');\r
5453                         self::error(_ERROR_PLUGIN_LOAD);\r
5454                 }\r
5455                 \r
5456                 // check if plugin needs a newer Nucleus version\r
5457                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5458                 {\r
5459                         // uninstall plugin again...\r
5460                         self::deleteOnePlugin($plugin->getID());\r
5461                         \r
5462                         // ...and show error\r
5463                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5464                 }\r
5465                 \r
5466                 // check if plugin needs a newer Nucleus version\r
5467                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5468                 {\r
5469                         // uninstall plugin again...\r
5470                         self::deleteOnePlugin($plugin->getID());\r
5471                         \r
5472                         // ...and show error\r
5473                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5474                 }\r
5475                 \r
5476                 $pluginList = $plugin->getPluginDep();\r
5477                 foreach ( $pluginList as $pluginName )\r
5478                 {\r
5479                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5480                         if (sql_num_rows($res) == 0)\r
5481                         {\r
5482                                 // uninstall plugin again...\r
5483                                 self::deleteOnePlugin($plugin->getID());\r
5484                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5485                         }\r
5486                 }\r
5487                 \r
5488                 // call the install method of the plugin\r
5489                 $plugin->install();\r
5490                 \r
5491                 $data = array('plugin' => &$plugin);\r
5492                 $manager->notify('PostAddPlugin', $data);\r
5493                 \r
5494                 // update all events\r
5495                 self::$action_pluginupdate();\r
5496                 return;\r
5497         }\r
5498         \r
5499         /**\r
5500          * ADMIN:action_pluginupdate():\r
5501          * \r
5502          * @param       Void\r
5503          * @return      Void\r
5504          * \r
5505          */\r
5506         static private function action_pluginupdate()\r
5507         {\r
5508                 global $member, $manager, $CONF;\r
5509                 \r
5510                 // check if allowed\r
5511                 $member->isAdmin() or self::disallow();\r
5512                 \r
5513                 // delete everything from plugin_events\r
5514                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5515                 \r
5516                 // loop over all installed plugins\r
5517                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5518                 while ( $o = sql_fetch_object($res) )\r
5519                 {\r
5520                         $pid  =  $o->pid;\r
5521                         $plug =& $manager->getPlugin($o->pfile);\r
5522                         if ( $plug )\r
5523                         {\r
5524                                 $eventList = $plug->getEventList();\r
5525                                 foreach ( $eventList as $eventName )\r
5526                                 {\r
5527                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5528                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5529                                         sql_query($query);\r
5530                                 }\r
5531                         }\r
5532                 }\r
5533                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5534                 return;\r
5535         }\r
5536         \r
5537         /**\r
5538          * Admin::action_plugindelete()\r
5539          * \r
5540          * @param       void\r
5541          * @return      void\r
5542          */\r
5543         static private function action_plugindelete()\r
5544         {\r
5545                 global $member, $manager;\r
5546                 \r
5547                 // check if allowed\r
5548                 $member->isAdmin() or self::disallow();\r
5549                 \r
5550                 $pid = intGetVar('plugid');\r
5551                 \r
5552                 if ( !$manager->pidInstalled($pid) )\r
5553                 {\r
5554                         self::error(_ERROR_NOSUCHPLUGIN);\r
5555                 }\r
5556                 \r
5557                 self::pagehead();\r
5558                 self::$skin->parse('plugindelete');\r
5559                 self::pagefoot();\r
5560                 return;\r
5561         }\r
5562 \r
5563         /**\r
5564          * Admin::action_plugindeleteconfirm()\r
5565          * \r
5566          * @param       void\r
5567          * @return      void\r
5568          */\r
5569         static private function action_plugindeleteconfirm()\r
5570         {\r
5571                 global $member, $manager, $CONF;\r
5572                 \r
5573                 // check if allowed\r
5574                 $member->isAdmin() or self::disallow();\r
5575                 \r
5576                 $pid = intPostVar('plugid');\r
5577                 \r
5578                 $error = self::deleteOnePlugin($pid, 1);\r
5579                 if ( $error )\r
5580                 {\r
5581                         self::error($error);\r
5582                 }\r
5583                 \r
5584                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5585                 return;\r
5586         }\r
5587         \r
5588         /**\r
5589          * Admin::\r
5590          * \r
5591          * @param       void\r
5592          * @return      void\r
5593          */\r
5594         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5595         {\r
5596                 global $manager;\r
5597                 \r
5598                 $pid = intval($pid);\r
5599                 \r
5600                 if ( !$manager->pidInstalled($pid) )\r
5601                 {\r
5602                         return _ERROR_NOSUCHPLUGIN;\r
5603                 }\r
5604                 \r
5605                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5606                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5607                 $name = quickQuery($query);\r
5608                 \r
5609                 // check dependency before delete\r
5610                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5611                 while ($o = sql_fetch_object($res))\r
5612                 {\r
5613                         $plug =& $manager->getPlugin($o->pfile);\r
5614                         if ( $plug )\r
5615                         {\r
5616                                 $depList = $plug->getPluginDep();\r
5617                                 foreach ( $depList as $depName )\r
5618                                 {\r
5619                                         if ( $name == $depName )\r
5620                                         {\r
5621                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5622                                         }\r
5623                                 }\r
5624                         }\r
5625                 }\r
5626                 \r
5627                 $data = array('plugid' => $pid);\r
5628                 $manager->notify('PreDeletePlugin', $data);\r
5629                 \r
5630                 // call the unInstall method of the plugin\r
5631                 if ( $callUninstall )\r
5632                 {\r
5633                         $plugin =& $manager->getPlugin($name);\r
5634                         if ( $plugin )\r
5635                         {\r
5636                                 $plugin->unInstall();\r
5637                         }\r
5638                 }\r
5639                 \r
5640                 // delete all subscriptions\r
5641                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5642                 \r
5643                 // delete all options\r
5644                 // get OIDs from plugin_option_desc\r
5645                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5646                 $aOIDs = array();\r
5647                 while ($o = sql_fetch_object($res))\r
5648                 {\r
5649                         array_push($aOIDs, $o->oid);\r
5650                 }\r
5651                 \r
5652                 // delete from plugin_option and plugin_option_desc\r
5653                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5654                 if (count($aOIDs) > 0)\r
5655                 {\r
5656                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5657                 }\r
5658                 \r
5659                 // update order numbers\r
5660                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5661                 $o = sql_fetch_object($res);\r
5662                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5663                 \r
5664                 // delete row\r
5665                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5666                 \r
5667                 $manager->clearCachedInfo('installedPlugins');\r
5668                 $data = array('plugid' => $pid);\r
5669                 $manager->notify('PostDeletePlugin', $data);\r
5670                 \r
5671                 return '';\r
5672         }\r
5673         \r
5674         /**\r
5675          * Admin::action_pluginup()\r
5676          * \r
5677          * @param       void\r
5678          * @return      void\r
5679          */\r
5680         static private function action_pluginup()\r
5681         {\r
5682                 global $member, $manager, $CONF;\r
5683                 \r
5684                 // check if allowed\r
5685                 $member->isAdmin() or self::disallow();\r
5686                 \r
5687                 $plugid = intGetVar('plugid');\r
5688                 \r
5689                 if ( !$manager->pidInstalled($plugid) )\r
5690                 {\r
5691                         self::error(_ERROR_NOSUCHPLUGIN);\r
5692                 }\r
5693                 \r
5694                 // 1. get old order number\r
5695                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5696                 $o = sql_fetch_object($res);\r
5697                 $oldOrder = $o->porder;\r
5698                 \r
5699                 // 2. calculate new order number\r
5700                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5701                 \r
5702                 // 3. update plug numbers\r
5703                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5704                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5705                 \r
5706                 //self::$action_pluginlist();\r
5707                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5708                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5709                 return;\r
5710         }\r
5711         \r
5712         /**\r
5713          * Admin::action_plugindown()\r
5714          * \r
5715          * @param       void\r
5716          * @return      void\r
5717          */\r
5718         static private function action_plugindown()\r
5719         {\r
5720                 global $member, $manager, $CONF;\r
5721                 \r
5722                 // check if allowed\r
5723                 $member->isAdmin() or self::disallow();\r
5724                 \r
5725                 $plugid = intGetVar('plugid');\r
5726                 if ( !$manager->pidInstalled($plugid) )\r
5727                 {\r
5728                         self::error(_ERROR_NOSUCHPLUGIN);\r
5729                 }\r
5730                 \r
5731                 // 1. get old order number\r
5732                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5733                 $o = sql_fetch_object($res);\r
5734                 $oldOrder = $o->porder;\r
5735                 \r
5736                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5737                 $maxOrder = sql_num_rows($res);\r
5738                 \r
5739                 // 2. calculate new order number\r
5740                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5741                 \r
5742                 // 3. update plug numbers\r
5743                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5744                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5745                 \r
5746                 //self::$action_pluginlist();\r
5747                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5748                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5749                 return;\r
5750         }\r
5751         \r
5752         /**\r
5753          * Admin::action_pluginoptions()\r
5754          * \r
5755          * Output Plugin option page\r
5756          * \r
5757          * @access      public\r
5758          * @param       string $message message when fallbacked\r
5759          * @return      void\r
5760          * \r
5761          */\r
5762         static private function action_pluginoptions($message = '')\r
5763         {\r
5764                 global $member, $manager;\r
5765                 \r
5766                 // check if allowed\r
5767                 $member->isAdmin() or self::disallow();\r
5768                 \r
5769                 $pid = intRequestVar('plugid');\r
5770                 if ( !$manager->pidInstalled($pid) )\r
5771                 {\r
5772                         self::error(_ERROR_NOSUCHPLUGIN);\r
5773                 }\r
5774                 \r
5775                 if ( isset($message) )\r
5776                 {\r
5777                         self::$headMess = $message;\r
5778                 }\r
5779                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5780                 self::pagehead($extrahead);\r
5781                 self::$skin->parse('pluginoptions');\r
5782                 self::pagefoot();\r
5783                 return;\r
5784         }\r
5785         \r
5786         /**\r
5787          * Admin::action_pluginoptionsupdate()\r
5788          * \r
5789          * Update plugin options and fallback to plugin option page\r
5790          * \r
5791          * @access      public\r
5792          * @param       void\r
5793          * @return      void\r
5794          */\r
5795         static private function action_pluginoptionsupdate()\r
5796         {\r
5797                 global $member, $manager;\r
5798                 \r
5799                 // check if allowed\r
5800                 $member->isAdmin() or self::disallow();\r
5801                 \r
5802                 $pid = intRequestVar('plugid');\r
5803                 \r
5804                 if ( !$manager->pidInstalled($pid) )\r
5805                 {\r
5806                         self::error(_ERROR_NOSUCHPLUGIN);\r
5807                 }\r
5808                 \r
5809                 $aOptions = requestArray('plugoption');\r
5810                 NucleusPlugin::apply_plugin_options($aOptions);\r
5811                 \r
5812                 $data = array(\r
5813                         'context'       => 'global',\r
5814                         'plugid'        => $pid\r
5815                 );\r
5816                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5817                 \r
5818                 self::$action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5819                 return;\r
5820         }\r
5821         \r
5822         /**\r
5823          * Admin::insertPluginOptions()\r
5824          * \r
5825          * Output plugin option field\r
5826          * \r
5827          * @access      public\r
5828          * @param string        $context        plugin option context\r
5829          * @param integer       $contextid      plugin option context id\r
5830          * @return      void\r
5831          */\r
5832         static public function insertPluginOptions($context, $contextid = 0)\r
5833         {\r
5834                 global $manager;\r
5835                 \r
5836                 // get all current values for this contextid\r
5837                 // (note: this might contain doubles for overlapping contextids)\r
5838                 $aIdToValue = array();\r
5839                 \r
5840                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5841                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5842                 \r
5843                 $res = sql_query($query);\r
5844                 while ( $object = sql_fetch_object($res) )\r
5845                 {\r
5846                         $aIdToValue[$object->oid] = $object->ovalue;\r
5847                 }\r
5848                 \r
5849                 // get list of oids per pid\r
5850                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5851                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5852                 $res    = sql_query($query);\r
5853                 \r
5854                 $aOptions = array();\r
5855                 while ( $object = sql_fetch_object($res) )\r
5856                 {\r
5857                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5858                         {\r
5859                                 $value = $object->odef;\r
5860                         }\r
5861                         else\r
5862                         {\r
5863                                 $value = $aIdToValue[$object->oid];\r
5864                         }\r
5865                         \r
5866                         array_push(\r
5867                                 $aOptions,\r
5868                                 array(\r
5869                                         'pid'                   => $object->pid,\r
5870                                         'pfile'                 => $object->pfile,\r
5871                                         'oid'                   => $object->oid,\r
5872                                         'value'                 => $value,\r
5873                                         'name'                  => $object->oname,\r
5874                                         'description'   => $object->odesc,\r
5875                                         'type'                  => $object->otype,\r
5876                                         'typeinfo'              => $object->oextra,\r
5877                                         'contextid'             => $contextid,\r
5878                                         'extra'                 => ''\r
5879                                 )\r
5880                         );\r
5881                 }\r
5882                 \r
5883                 $data = array(\r
5884                         'context'       =>  $context,\r
5885                         'contextid'     =>  $contextid,\r
5886                         'options'       =>& $aOptions\r
5887                 );\r
5888                 $manager->notify('PrePluginOptionsEdit', $data);\r
5889                 \r
5890                 self::$aOptions = $aOptions;\r
5891                 self::$skin->parse('insertpluginoptions');\r
5892                 return;\r
5893         }\r
5894         \r
5895         /**\r
5896          * Admin::action_parseSpecialskin()\r
5897          * \r
5898          * @param       void\r
5899          * @return      void\r
5900          */\r
5901         static private function action_parseSpecialskin()\r
5902         {\r
5903                 self::pagehead();\r
5904                 self::$skin->parse(self::$action);\r
5905                 self::pagefoot();\r
5906                 return;\r
5907         }\r
5908         \r
5909         /**\r
5910          * Admin::getAdminskinIDFromName()\r
5911          * \r
5912          * @param       string  $skinname       name of skin\r
5913          * @return      integer ID for skin\r
5914          */\r
5915         static private function getAdminskinIDFromName($skinname)\r
5916         {\r
5917                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5918                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5919                 $admnSknID      = quickQuery($query);\r
5920                 return (integer) $adminSkinID;\r
5921         }\r
5922         \r
5923         /**\r
5924          * Admin::getAdminskinNameFromID()\r
5925          * \r
5926          * @param       integer $skinid ID for skin\r
5927          * @return      integer ID for skin\r
5928          */\r
5929         static private function getAdminskinNameFromID($skinid)\r
5930         {\r
5931                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5932                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5933                 $admnSknID      = quickQuery($query);\r
5934                 return (integer) $adminSkinID;\r
5935         }\r
5936         \r
5937         /**\r
5938          * Admin::getAdminextrahead()\r
5939          */\r
5940         static function getAdminextrahead()\r
5941         {\r
5942                 return self::$extrahead;\r
5943         }\r
5944         \r
5945         /**\r
5946          * Admin::getAdminpassvar()\r
5947          */\r
5948         static function getAdminpassvar()\r
5949         {\r
5950                 return self::$passvar;\r
5951         }\r
5952         \r
5953         /**\r
5954          * Admin::getAdminAction()\r
5955          */\r
5956         static function getAdminAction()\r
5957         {\r
5958                 return self::$action;\r
5959         }\r
5960         \r
5961         /**\r
5962          * Admin::getAdminaOption()\r
5963          */\r
5964         static function getAdminaOption()\r
5965         {\r
5966                 return self::$aOptions;\r
5967         }\r
5968         \r
5969         /**\r
5970          * Admin::action_importAdmin()\r
5971          * \r
5972          * @param       void\r
5973          * @return      void\r
5974          */\r
5975         static private function action_importAdmin()\r
5976         {\r
5977                 global $DIR_ADMINSKINS, $action;\r
5978                 if ( $action == 'adminskinieimport' )\r
5979                 {\r
5980                         self::doAdminskinimport();\r
5981                 }\r
5982                 $skn = array();\r
5983                 if ( $action == 'showlogin' )\r
5984                 {\r
5985                         $skinName = 'showlogin';\r
5986                         $actnName = 'showlogin';\r
5987                 }\r
5988                 else\r
5989                 {\r
5990                         $skinName = 'defaultimporter';\r
5991                         $actnName = 'importAdmin';\r
5992                 }\r
5993                 \r
5994                 /* TODO: why??? */\r
5995                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5996                 $skn['id']                              = 0;\r
5997                 $skn['description']             = $skinName;\r
5998                 $skn['contentType']             = 'importAdmin';\r
5999                 $skn['includeMode']             = 'normal';\r
6000                 $skn['includePrefix']   = '';\r
6001                 $skn['name']                    = 'defaultinporter';\r
6002                 \r
6003                 self::$skin                             = (object) $skn;\r
6004                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6005                 $handler->setSkin(self::$skin);\r
6006                 \r
6007                 $parser = new PARSER($handler);\r
6008                 $parser->parse($contents);\r
6009                 \r
6010                 return;\r
6011         }\r
6012         \r
6013         /**\r
6014          * Admin::doAdminskinimport()\r
6015          * \r
6016          * @param       void\r
6017          * @return      void\r
6018          */\r
6019         static private function doAdminskinimport()\r
6020         {\r
6021                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6022                 \r
6023                 $member->isAdmin() or self::disallow();\r
6024                 \r
6025                 include_once($DIR_LIBS . 'Skinie.php');\r
6026                 $skinFileRaw    = postVar('skinfile');\r
6027                 $mode                   = postVar('mode');\r
6028                 $allowOverwrite = intPostVar('overwrite');\r
6029                 \r
6030                 if ( $mode == 'file' )\r
6031                 {\r
6032                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6033                 }\r
6034                 else\r
6035                 {\r
6036                         $skinFile = $skinFileRaw;\r
6037                 }\r
6038                 \r
6039                 $importer       = new SKINIMPORT();\r
6040                 $error          = $importer->readFile($skinFile);\r
6041                 if ( $error )\r
6042                 {\r
6043                         self::error($error);\r
6044                 }\r
6045                 $error = $importer->writeToDatabase($allowOverwrite);\r
6046                 if ( $error )\r
6047                 {\r
6048                         self::error($error);\r
6049                 }\r
6050                 \r
6051                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6052                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6053                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6054                 \r
6055                 header('Location: ' . $CONF['AdminURL']);\r
6056                 exit;\r
6057         }\r
6058 }\r