utf8/nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2007 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2007 The Nucleus Group
  17  * @version $Id: ADMIN.php,v 1.15 2007-02-09 02:47:47 kimitake Exp $
  18  * @version $NucleusJP: ADMIN.php,v 1.14 2007/02/04 06:28:46 kimitake Exp $
  19  */
  20
  21 require_once "showlist.php";
  22
  23 /**
  24  * Builds the admin area and executes admin actions
  25  */
  26 class ADMIN {
  27
  28         /**
  29          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  30          */
  31         var $action;
  32
  33         /**
  34          * Class constructor
  35          */
  36         function ADMIN() {
  37
  38         }
  39
  40         /**
  41          * Executes an action
  42          *
  43          * @param string $action action to be performed
  44          */
  45         function action($action) {
  46                 global $CONF, $manager;
  47
  48                 // list of action aliases
  49                 $alias = array(
  50                         'login' => 'overview',
  51                         '' => 'overview'
  52                 );
  53
  54                 if (isset($alias[$action]))
  55                         $action = $alias[$action];
  56
  57                 $methodName = 'action_' . $action;
  58
  59                 $this->action = strtolower($action);
  60
  61                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  62                 // is an action that requires user interaction before something is actually done)
  63                 // all safe actions are in this array:
  64                 $aActionsNotToCheck = array('showlogin', 'login', 'overview', 'itemlist', 'blogcommentlist', 'bookmarklet', 'blogsettings', 'banlist', 'deleteblog', 'editmembersettings', 'browseownitems', 'browseowncomments', 'createitem', 'itemedit', 'itemmove', 'categoryedit', 'categorydelete', 'manage', 'actionlog', 'settingsedit', 'backupoverview', 'pluginlist', 'createnewlog', 'usermanagement', 'skinoverview', 'templateoverview', 'skinieoverview', 'itemcommentlist', 'commentedit', 'commentdelete', 'banlistnewfromitem', 'banlistdelete', 'itemdelete', 'manageteam', 'teamdelete', 'banlistnew', 'memberedit', 'memberdelete', 'pluginhelp', 'pluginoptions', 'plugindelete', 'skinedittype', 'skinremovetype', 'skindelete', 'skinedit', 'templateedit', 'templatedelete', 'activate');
  65 /*
  66                 // the rest of the actions needs to be checked
  67                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');
  68 */
  69                 if (!in_array($this->action, $aActionsNotToCheck))
  70                 {
  71                         if (!$manager->checkTicket())
  72                                 $this->error(_ERROR_BADTICKET);
  73                 }
  74
  75                 if (method_exists($this, $methodName))
  76                         call_user_func(array(&$this, $methodName));
  77                 else
  78                         $this->error(_BADACTION . " ($action)");
  79
  80         }
  81
  82         /**
  83          * @todo document this
  84          */
  85         function action_showlogin() {
  86                 global $error;
  87                 $this->action_login($error);
  88         }
  89
  90         /**
  91          * @todo document this
  92          */
  93         function action_login($msg = '', $passvars = 1) {
  94                 global $member;
  95
  96                 // skip to overview when allowed
  97                 if ($member->isLoggedIn() && $member->canLogin()) {
  98                         $this->action_overview();
  99                         exit;
 100                 }
 101
 102                 $this->pagehead();
 103
 104                 echo '<h2>', _LOGIN ,'</h2>';
 105                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);
 106                 ?>
 107
 108                 <form action="index.php" method="post"><p>
 109                 <?php echo _LOGIN_NAME?>: <br /><input name="login"  tabindex="10" />
 110                 <br />
 111                 <?php echo _LOGIN_PASSWORD?>: <br /><input name="password"  tabindex="20" type="password" />
 112                 <br />
 113                 <input name="action" value="login" type="hidden" />
 114                 <br />
 115                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 116                 <br />
 117                 <small>
 118                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 119                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 120                 </small>
 121                 <?php                   // pass through vars
 122
 123                         $oldaction = postVar('oldaction');
 124                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 125                                 passRequestVars();
 126                         }
 127
 128
 129                 ?>
 130                 </p></form>
 131                 <?php           $this->pagefoot();
 132         }
 133
 134
 135         /**
 136          * provides a screen with the overview of the actions available
 137          * @todo document parameter
 138          */
 139         function action_overview($msg = '') {
 140                 global $member;
 141
 142                 $this->pagehead();
 143
 144                 if ($msg)
 145                         echo _MESSAGE , ': ', $msg;
 146
 147                 /* ---- add items ---- */
 148                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 149
 150                 $showAll = requestVar('showall');
 151
 152                 if (($member->isAdmin()) && ($showAll == 'yes')) {
 153                         // Super-Admins have access to all blogs! (no add item support though)
 154                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 155                                    . ' FROM ' . sql_table('blog')
 156                                    . ' ORDER BY bname';
 157                 } else {
 158                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 159                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 160                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 161                                    . ' ORDER BY bname';
 162                 }
 163                 $template['content'] = 'bloglist';
 164                 $template['superadmin'] = $member->isAdmin();
 165                 $amount = showlist($query,'table',$template);
 166
 167                 if (($showAll != 'yes') && ($member->isAdmin())) {
 168                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 169                         if ($total > $amount)
 170                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">Show all blogs</a></p>';
 171                 }
 172
 173                 if ($amount == 0)
 174                         echo _OVERVIEW_NOBLOGS;
 175
 176                 if ($amount != 0) {
 177                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 178                         $query =  'SELECT ititle, inumber, bshortname'
 179                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 180                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 181                         $template['content'] = 'draftlist';
 182                         $amountdrafts = showlist($query, 'table', $template);
 183                         if ($amountdrafts == 0)
 184                                 echo _OVERVIEW_NODRAFTS;
 185                 }
 186
 187                 /* ---- user settings ---- */
 188                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 189                 echo '<ul>';
 190                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 191                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 192                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 193                 echo '</ul>';
 194
 195                 /* ---- general settings ---- */
 196                 if ($member->isAdmin()) {
 197                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 198                         echo '<ul>';
 199                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 200                         echo '</ul>';
 201                 }
 202
 203
 204                 $this->pagefoot();
 205         }
 206
 207         /**
 208          * Returns a link to a weblog
 209          * @param object BLOG
 210          */
 211         function bloglink(&$blog) {
 212                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'.$blog->getName() .'</a>';
 213         }
 214
 215         /**
 216          * @todo document this
 217          */
 218         function action_manage($msg = '') {
 219                 global $member;
 220
 221                 $member->isAdmin() or $this->disallow();
 222
 223                 $this->pagehead();
 224
 225                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 226
 227                 if ($msg)
 228                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 229
 230
 231                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 232
 233                 echo '<ul>';
 234                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 235                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 236                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 237                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 238                 echo '</ul>';
 239
 240                 echo '<h2>' . _MANAGE_SKINS . '</h2>';
 241                 echo '<ul>';
 242                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 243                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 244                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 245                 echo '</ul>';
 246
 247                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 248                 echo '<ul>';
 249                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 250                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 251                 echo '</ul>';
 252
 253                 $this->pagefoot();
 254         }
 255
 256         /**
 257          * @todo document this
 258          */
 259         function action_itemlist($blogid = '') {
 260                 global $member, $manager;
 261
 262                 if ($blogid == '')
 263                         $blogid = intRequestVar('blogid');
 264
 265                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 266
 267                 $this->pagehead();
 268                 $blog =& $manager->getBlog($blogid);
 269
 270                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 271                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 272
 273                 // start index
 274                 if (postVar('start'))
 275                         $start = intPostVar('start');
 276                 else
 277                         $start = 0;
 278
 279                 if ($start == 0)
 280                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 281
 282                 // amount of items to show
 283                 if (postVar('amount'))
 284                         $amount = intPostVar('amount');
 285                 else
 286                         $amount = 10;
 287
 288                 $search = postVar('search');    // search through items
 289
 290                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 291                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 292                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 293
 294                 if ($search)
 295                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 296
 297                 // non-blog-admins can only edit/delete their own items
 298                 if (!$member->blogAdminRights($blogid))
 299                         $query .= ' and iauthor=' . $member->getID();
 300
 301
 302                 $query .= ' ORDER BY itime DESC'
 303                                 . " LIMIT $start,$amount";
 304
 305                 $template['content'] = 'itemlist';
 306                 $template['now'] = $blog->getCorrectTime(time());
 307
 308                 $manager->loadClass("ENCAPSULATE");
 309                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 310                 $navList->showBatchList('item',$query,'table',$template);
 311
 312
 313                 $this->pagefoot();
 314         }
 315
 316         /**
 317          * @todo document this
 318          */
 319         function action_batchitem() {
 320                 global $member, $manager;
 321
 322                 // check if logged in
 323                 $member->isLoggedIn() or $this->disallow();
 324
 325                 // more precise check will be done for each performed operation
 326
 327                 // get array of itemids from request
 328                 $selected = requestIntArray('batch');
 329                 $action = requestVar('batchaction');
 330
 331                 // Show error when no items were selected
 332                 if (!is_array($selected) || sizeof($selected) == 0)
 333                         $this->error(_BATCH_NOSELECTION);
 334
 335                 // On move: when no destination blog/category chosen, show choice now
 336                 $destCatid = intRequestVar('destcatid');
 337                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 338                         $this->batchMoveSelectDestination('item',$selected);
 339
 340                 // On delete: check if confirmation has been given
 341                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 342                         $this->batchAskDeleteConfirmation('item',$selected);
 343
 344                 $this->pagehead();
 345
 346                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 347                 echo '<h2>',_BATCH_ITEMS,'</h2>';
 348                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 349                 echo '<ul>';
 350
 351
 352                 // walk over all itemids and perform action
 353                 foreach ($selected as $itemid) {
 354                         $itemid = intval($itemid);
 355                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 356
 357                         // perform action, display errors if needed
 358                         switch($action) {
 359                                 case 'delete':
 360                                         $error = $this->deleteOneItem($itemid);
 361                                         break;
 362                                 case 'move':
 363                                         $error = $this->moveOneItem($itemid, $destCatid);
 364                                         break;
 365                                 default:
 366                                         $error = _BATCH_UNKNOWN . $action;
 367                         }
 368
 369                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 370                         echo '</li>';
 371                 }
 372
 373                 echo '</ul>';
 374                 echo '<b>',_BATCH_DONE,'</b>';
 375
 376                 $this->pagefoot();
 377
 378
 379         }
 380
 381         /**
 382          * @todo document this
 383          */
 384         function action_batchcomment() {
 385                 global $member;
 386
 387                 // check if logged in
 388                 $member->isLoggedIn() or $this->disallow();
 389
 390                 // more precise check will be done for each performed operation
 391
 392                 // get array of itemids from request
 393                 $selected = requestIntArray('batch');
 394                 $action = requestVar('batchaction');
 395
 396                 // Show error when no items were selected
 397                 if (!is_array($selected) || sizeof($selected) == 0)
 398                         $this->error(_BATCH_NOSELECTION);
 399
 400                 // On delete: check if confirmation has been given
 401                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 402                         $this->batchAskDeleteConfirmation('comment',$selected);
 403
 404                 $this->pagehead();
 405
 406                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 407                 echo '<h2>',_BATCH_COMMENTS,'</h2>';
 408                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 409                 echo '<ul>';
 410
 411                 // walk over all itemids and perform action
 412                 foreach ($selected as $commentid) {
 413                         $commentid = intval($commentid);
 414                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 415
 416                         // perform action, display errors if needed
 417                         switch($action) {
 418                                 case 'delete':
 419                                         $error = $this->deleteOneComment($commentid);
 420                                         break;
 421                                 default:
 422                                         $error = _BATCH_UNKNOWN . $action;
 423                         }
 424
 425                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 426                         echo '</li>';
 427                 }
 428
 429                 echo '</ul>';
 430                 echo '<b>',_BATCH_DONE,'</b>';
 431
 432                 $this->pagefoot();
 433
 434
 435         }
 436
 437         /**
 438          * @todo document this
 439          */
 440         function action_batchmember() {
 441                 global $member;
 442
 443                 // check if logged in and admin
 444                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 445
 446                 // get array of itemids from request
 447                 $selected = requestIntArray('batch');
 448                 $action = requestVar('batchaction');
 449
 450                 // Show error when no members selected
 451                 if (!is_array($selected) || sizeof($selected) == 0)
 452                         $this->error(_BATCH_NOSELECTION);
 453
 454                 // On delete: check if confirmation has been given
 455                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 456                         $this->batchAskDeleteConfirmation('member',$selected);
 457
 458                 $this->pagehead();
 459
 460                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 461                 echo '<h2>',_BATCH_MEMBERS,'</h2>';
 462                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 463                 echo '<ul>';
 464
 465                 // walk over all itemids and perform action
 466                 foreach ($selected as $memberid) {
 467                         $memberid = intval($memberid);
 468                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 469
 470                         // perform action, display errors if needed
 471                         switch($action) {
 472                                 case 'delete':
 473                                         $error = $this->deleteOneMember($memberid);
 474                                         break;
 475                                 case 'setadmin':
 476                                         // always succeeds
 477                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 478                                         $error = '';
 479                                         break;
 480                                 case 'unsetadmin':
 481                                         // there should always remain at least one super-admin
 482                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 483                                         if (mysql_num_rows($r) < 2)
 484                                                 $error = _ERROR_ATLEASTONEADMIN;
 485                                         else
 486                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 487                                         break;
 488                                 default:
 489                                         $error = _BATCH_UNKNOWN . $action;
 490                         }
 491
 492                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 493                         echo '</li>';
 494                 }
 495
 496                 echo '</ul>';
 497                 echo '<b>',_BATCH_DONE,'</b>';
 498
 499                 $this->pagefoot();
 500
 501
 502         }
 503
 504         /**
 505          * @todo document this
 506          */
 507         function action_batchteam() {
 508                 global $member;
 509
 510                 $blogid = intRequestVar('blogid');
 511
 512                 // check if logged in and admin
 513                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 514
 515                 // get array of itemids from request
 516                 $selected = requestIntArray('batch');
 517                 $action = requestVar('batchaction');
 518
 519                 // Show error when no members selected
 520                 if (!is_array($selected) || sizeof($selected) == 0)
 521                         $this->error(_BATCH_NOSELECTION);
 522
 523                 // On delete: check if confirmation has been given
 524                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 525                         $this->batchAskDeleteConfirmation('team',$selected);
 526
 527                 $this->pagehead();
 528
 529                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 530
 531                 echo '<h2>',_BATCH_TEAM,'</h2>';
 532                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 533                 echo '<ul>';
 534
 535                 // walk over all itemids and perform action
 536                 foreach ($selected as $memberid) {
 537                         $memberid = intval($memberid);
 538                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 539
 540                         // perform action, display errors if needed
 541                         switch($action) {
 542                                 case 'delete':
 543                                         $error = $this->deleteOneTeamMember($blogid, $memberid);
 544                                         break;
 545                                 case 'setadmin':
 546                                         // always succeeds
 547                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 548                                         $error = '';
 549                                         break;
 550                                 case 'unsetadmin':
 551                                         // there should always remain at least one admin
 552                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 553                                         if (mysql_num_rows($r) < 2)
 554                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;
 555                                         else
 556                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 557                                         break;
 558                                 default:
 559                                         $error = _BATCH_UNKNOWN . $action;
 560                         }
 561
 562                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 563                         echo '</li>';
 564                 }
 565
 566                 echo '</ul>';
 567                 echo '<b>',_BATCH_DONE,'</b>';
 568
 569                 $this->pagefoot();
 570
 571
 572         }
 573
 574         /**
 575          * @todo document this
 576          */
 577         function action_batchcategory() {
 578                 global $member, $manager;
 579
 580                 // check if logged in
 581                 $member->isLoggedIn() or $this->disallow();
 582
 583                 // more precise check will be done for each performed operation
 584
 585                 // get array of itemids from request
 586                 $selected = requestIntArray('batch');
 587                 $action = requestVar('batchaction');
 588
 589                 // Show error when no items were selected
 590                 if (!is_array($selected) || sizeof($selected) == 0)
 591                         $this->error(_BATCH_NOSELECTION);
 592
 593                 // On move: when no destination blog chosen, show choice now
 594                 $destBlogId = intRequestVar('destblogid');
 595                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 596                         $this->batchMoveCategorySelectDestination('category',$selected);
 597
 598                 // On delete: check if confirmation has been given
 599                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 600                         $this->batchAskDeleteConfirmation('category',$selected);
 601
 602                 $this->pagehead();
 603
 604                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 605                 echo '<h2>',BATCH_CATEGORIES,'</h2>';
 606                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 607                 echo '<ul>';
 608
 609                 // walk over all itemids and perform action
 610                 foreach ($selected as $catid) {
 611                         $catid = intval($catid);
 612                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 613
 614                         // perform action, display errors if needed
 615                         switch($action) {
 616                                 case 'delete':
 617                                         $error = $this->deleteOneCategory($catid);
 618                                         break;
 619                                 case 'move':
 620                                         $error = $this->moveOneCategory($catid, $destBlogId);
 621                                         break;
 622                                 default:
 623                                         $error = _BATCH_UNKNOWN . $action;
 624                         }
 625
 626                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';
 627                         echo '</li>';
 628                 }
 629
 630                 echo '</ul>';
 631                 echo '<b>',_BATCH_DONE,'</b>';
 632
 633                 $this->pagefoot();
 634
 635         }
 636
 637         /**
 638          * @todo document this
 639          */
 640         function batchMoveSelectDestination($type, $ids) {
 641                 global $manager;
 642                 $this->pagehead();
 643                 ?>
 644                 <h2><?php echo _MOVE_TITLE?></h2>
 645                 <form method="post" action="index.php"><div>
 646
 647                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 648                         <input type="hidden" name="batchaction" value="move" />
 649                         <?php
 650                                 $manager->addTicketHidden();
 651
 652                                 // insert selected item numbers
 653                                 $idx = 0;
 654                                 foreach ($ids as $id)
 655                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 656
 657                                 // show blog/category selection list
 658                                 $this->selectBlogCategory('destcatid');
 659
 660                         ?>
 661
 662
 663                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 664
 665                 </div></form>
 666                 <?php           $this->pagefoot();
 667                 exit;
 668         }
 669
 670         /**
 671          * @todo document this
 672          */
 673         function batchMoveCategorySelectDestination($type, $ids) {
 674                 global $manager;
 675                 $this->pagehead();
 676                 ?>
 677                 <h2><?php echo _MOVECAT_TITLE?></h2>
 678                 <form method="post" action="index.php"><div>
 679
 680                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 681                         <input type="hidden" name="batchaction" value="move" />
 682                         <?php
 683                                 $manager->addTicketHidden();
 684
 685                                 // insert selected item numbers
 686                                 $idx = 0;
 687                                 foreach ($ids as $id)
 688                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 689
 690                                 // show blog/category selection list
 691                                 $this->selectBlog('destblogid');
 692
 693                         ?>
 694
 695
 696                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 697
 698                 </div></form>
 699                 <?php           $this->pagefoot();
 700                 exit;
 701         }
 702
 703         /**
 704          * @todo document this
 705          */
 706         function batchAskDeleteConfirmation($type, $ids) {
 707                 global $manager;
 708
 709                 $this->pagehead();
 710                 ?>
 711                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 712                 <form method="post" action="index.php"><div>
 713
 714                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 715                         <?php $manager->addTicketHidden() ?>
 716                         <input type="hidden" name="batchaction" value="delete" />
 717                         <input type="hidden" name="confirmation" value="yes" />
 718                         <?php                           // insert selected item numbers
 719                                 $idx = 0;
 720                                 foreach ($ids as $id)
 721                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 722
 723                                 // add hidden vars for team & comment
 724                                 if ($type == 'team')
 725                                 {
 726                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 727                                 }
 728                                 if ($type == 'comment')
 729                                 {
 730                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 731                                 }
 732
 733                         ?>
 734
 735                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 736
 737                 </div></form>
 738                 <?php           $this->pagefoot();
 739                 exit;
 740         }
 741
 742
 743         /**
 744          * Inserts a HTML select element with choices for all categories to which the current
 745          * member has access
 746          * @see function selectBlog
 747          */
 748         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 749                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 750         }
 751
 752         /**
 753          * Inserts a HTML select element with choices for all blogs to which the user has access
 754          *              mode = 'blog' => shows blognames and values are blogids
 755          *              mode = 'category' => show category names and values are catids
 756          *
 757          * @param $iForcedBlogInclude
 758          *              ID of a blog that always needs to be included, without checking if the
 759          *              member is on the blog team (-1 = none)
 760          * @todo document parameters
 761          */
 762         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 763                 global $member, $CONF;
 764
 765                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 766                 $aBlogIds = array();
 767                 if ($iForcedBlogInclude != -1)
 768                         $aBlogIds[] = intval($iForcedBlogInclude);
 769
 770                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 771                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 772                 else
 773                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 774                 $rblogids = sql_query($queryBlogs);
 775                 while ($o = mysql_fetch_object($rblogids))
 776                         if ($o->bnumber != $iForcedBlogInclude)
 777                                 $aBlogIds[] = intval($o->bnumber);
 778
 779                 if (count($aBlogIds) == 0)
 780                         return;
 781
 782                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 783
 784                 // 1. select blogs (we'll create optiongroups)
 785                 // (only select those blogs that have the user on the team)
 786                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 787                 $blogs = sql_query($queryBlogs);
 788                 if ($mode == 'category') {
 789                         if (mysql_num_rows($blogs) > 1)
 790                                 $multipleBlogs = 1;
 791
 792                         while ($oBlog = mysql_fetch_object($blogs)) {
 793                                 if ($multipleBlogs)
 794                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';
 795
 796                                 // show selection to create new category when allowed/wanted
 797                                 if ($showNewCat) {
 798                                         // check if allowed to do so
 799                                         if ($member->blogAdminRights($oBlog->bnumber))
 800                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 801                                 }
 802
 803                                 // 2. for each category in that blog
 804                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 805                                 while ($oCat = mysql_fetch_object($categories)) {
 806                                         if ($oCat->catid == $selected)
 807                                                 $selectText = ' selected="selected" ';
 808                                         else
 809                                                 $selectText = '';
 810                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';
 811                                 }
 812
 813                                 if ($multipleBlogs)
 814                                         echo '</optgroup>';
 815                         }
 816                 } else {
 817                         // blog mode
 818                         while ($oBlog = mysql_fetch_object($blogs)) {
 819                                 echo '<option value="',$oBlog->bnumber,'"';
 820                                 if ($oBlog->bnumber == $selected)
 821                                         echo ' selected="selected"';
 822                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';
 823                         }
 824                 }
 825                 echo '</select>';
 826
 827         }
 828
 829         /**
 830          * @todo document this
 831          */
 832         function action_browseownitems() {
 833                 global $member, $manager;
 834
 835                 $this->pagehead();
 836
 837                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 838                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 839
 840                 // start index
 841                 if (postVar('start'))
 842                         $start = postVar('start');
 843                 else
 844                         $start = 0;
 845
 846                 // amount of items to show
 847                 if (postVar('amount'))
 848                         $amount = postVar('amount');
 849                 else
 850                         $amount = 10;
 851
 852                 $search = postVar('search');    // search through items
 853
 854                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 855                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 856                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 857
 858                 if ($search)
 859                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 860
 861                 $query .= ' ORDER BY itime DESC'
 862                                 . " LIMIT $start,$amount";
 863
 864                 $template['content'] = 'itemlist';
 865                 $template['now'] = time();
 866
 867                 $manager->loadClass("ENCAPSULATE");
 868                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 869                 $navList->showBatchList('item',$query,'table',$template);
 870
 871                 $this->pagefoot();
 872
 873         }
 874
 875         /**
 876          * Show all the comments for a given item
 877          * @param int $itemid
 878          */
 879         function action_itemcommentlist($itemid = '') {
 880                 global $member, $manager;
 881
 882                 if ($itemid == '')
 883                         $itemid = intRequestVar('itemid');
 884
 885                 // only allow if user is allowed to alter item
 886                 $member->canAlterItem($itemid) or $this->disallow();
 887
 888                 $blogid = getBlogIdFromItemId($itemid);
 889
 890                 $this->pagehead();
 891
 892                 // start index
 893                 if (postVar('start'))
 894                         $start = postVar('start');
 895                 else
 896                         $start = 0;
 897
 898                 // amount of items to show
 899                 if (postVar('amount'))
 900                         $amount = postVar('amount');
 901                 else
 902                         $amount = 10;
 903
 904                 $search = postVar('search');
 905
 906                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 907                 echo '<h2>',_COMMENTS,'</h2>';
 908
 909                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE citem=' . $itemid;
 910
 911                 if ($search)
 912                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 913
 914                 $query .= ' ORDER BY ctime ASC'
 915                                 . " LIMIT $start,$amount";
 916
 917                 $template['content'] = 'commentlist';
 918                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
 919
 920                 $manager->loadClass("ENCAPSULATE");
 921                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
 922                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
 923
 924                 $this->pagefoot();
 925         }
 926
 927         /**
 928          * Browse own comments
 929          */
 930         function action_browseowncomments() {
 931                 global $member, $manager;
 932
 933                 // start index
 934                 if (postVar('start'))
 935                         $start = postVar('start');
 936                 else
 937                         $start = 0;
 938
 939                 // amount of items to show
 940                 if (postVar('amount'))
 941                         $amount = postVar('amount');
 942                 else
 943                         $amount = 10;
 944
 945                 $search = postVar('search');
 946
 947
 948                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 949
 950                 if ($search)
 951                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 952
 953                 $query .= ' ORDER BY ctime DESC'
 954                                 . " LIMIT $start,$amount";
 955
 956                 $this->pagehead();
 957
 958                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 959                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';
 960
 961                 $template['content'] = 'commentlist';
 962                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself
 963
 964                 $manager->loadClass("ENCAPSULATE");
 965                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
 966                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
 967
 968                 $this->pagefoot();
 969         }
 970
 971         /**
 972          * Browse all comments for a weblog
 973          * @param int $blogid
 974          */
 975         function action_blogcommentlist($blogid = '')
 976         {
 977                 global $member, $manager;
 978
 979                 if ($blogid == '')
 980                         $blogid = intRequestVar('blogid');
 981                 else
 982                         $blogid = intval($blogid);
 983
 984                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 985
 986                 // start index
 987                 if (postVar('start'))
 988                         $start = postVar('start');
 989                 else
 990                         $start = 0;
 991
 992                 // amount of items to show
 993                 if (postVar('amount'))
 994                         $amount = postVar('amount');
 995                 else
 996                         $amount = 10;
 997
 998                 $search = postVar('search');            // search through comments
 999
1000
1001                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1002
1003                 if ($search != '')
1004                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
1005
1006
1007                 $query .= ' ORDER BY ctime DESC'
1008                                 . " LIMIT $start,$amount";
1009
1010
1011                 $blog =& $manager->getBlog($blogid);
1012
1013                 $this->pagehead();
1014
1015                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1016                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1017
1018                 $template['content'] = 'commentlist';
1019                 $template['canAddBan'] = $member->blogAdminRights($blogid);
1020
1021                 $manager->loadClass("ENCAPSULATE");
1022                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1023                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1024
1025                 $this->pagefoot();
1026         }
1027
1028         /**
1029          * Provide a page to item a new item to the given blog
1030          */
1031         function action_createitem() {
1032                 global $member, $manager;
1033
1034                 $blogid = intRequestVar('blogid');
1035
1036                 // check if allowed
1037                 $member->teamRights($blogid) or $this->disallow();
1038
1039                 $memberid = $member->getID();
1040
1041                 $blog =& $manager->getBlog($blogid);
1042
1043                 $this->pagehead();
1044
1045                 // generate the add-item form
1046                 $formfactory =& new PAGEFACTORY($blogid);
1047                 $formfactory->createAddForm('admin');
1048
1049                 $this->pagefoot();
1050         }
1051
1052         /**
1053          * @todo document this
1054          */
1055         function action_itemedit() {
1056                 global $member, $manager;
1057
1058                 $itemid = intRequestVar('itemid');
1059
1060                 // only allow if user is allowed to alter item
1061                 $member->canAlterItem($itemid) or $this->disallow();
1062
1063                 $item =& $manager->getItem($itemid,1,1);
1064                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1065
1066                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1067
1068                 if ($blog->convertBreaks()) {
1069                         $item['body'] = removeBreaks($item['body']);
1070                         $item['more'] = removeBreaks($item['more']);
1071                 }
1072
1073                 // form to edit blog items
1074                 $this->pagehead();
1075                 $formfactory =& new PAGEFACTORY($blog->getID());
1076                 $formfactory->createEditForm('admin',$item);
1077                 $this->pagefoot();
1078         }
1079
1080         /**
1081          * @todo document this
1082          */
1083         function action_itemupdate() {
1084                 global $member, $manager, $CONF;
1085
1086                 $itemid = intRequestVar('itemid');
1087                 $catid = postVar('catid');
1088
1089                 // only allow if user is allowed to alter item
1090                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1091
1092                 $actiontype = postVar('actiontype');
1093
1094                 // delete actions are handled by itemdelete (which has confirmation)
1095                 if ($actiontype == 'delete') {
1096                         $this->action_itemdelete();
1097                         return;
1098                 }
1099
1100                 $body   = postVar('body');
1101                 $title  = postVar('title');
1102                 $more   = postVar('more');
1103                 $closed = intPostVar('closed');
1104                 $draftid = intPostVar('draftid');
1105
1106                 // default action = add now
1107                 if (!$actiontype)
1108                         $actiontype='addnow';
1109
1110                 // create new category if needed
1111                 if (strstr($catid,'newcat')) {
1112                         // get blogid
1113                         list($blogid) = sscanf($catid,"newcat-%d");
1114
1115                         // create
1116                         $blog =& $manager->getBlog($blogid);
1117                         $catid = $blog->createNewCategory();
1118
1119                         // show error when sth goes wrong
1120                         if (!$catid)
1121                                 $this->doError(_ERROR_CATCREATEFAIL);
1122                 }
1123
1124                 /*
1125                         set some variables based on actiontype
1126
1127                         actiontypes:
1128                                 draft items -> addnow, addfuture, adddraft, delete
1129                                 non-draft items -> edit, changedate, delete
1130
1131                         variables set:
1132                                 $timestamp: set to a nonzero value for future dates or date changes
1133                                 $wasdraft: set to 1 when the item used to be a draft item
1134                                 $publish: set to 1 when the edited item is not a draft
1135                 */
1136                 switch ($actiontype) {
1137                         case 'adddraft':
1138                                 $publish = 0;
1139                                 $wasdraft = 1;
1140                                 $timestamp = 0;
1141                                 break;
1142                         case 'addfuture':
1143                                 $wasdraft = 1;
1144                                 $publish = 1;
1145                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1146                                 break;
1147                         case 'addnow':
1148                                 $wasdraft = 1;
1149                                 $publish = 1;
1150                                 $timestamp = 0;
1151                                 break;
1152                         case 'changedate':
1153                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1154                                 $publish = 1;
1155                                 $wasdraft = 0;
1156                                 break;
1157                         case 'edit':
1158                         default:
1159                                 $publish = 1;
1160                                 $wasdraft = 0;
1161                                 $timestamp = 0;
1162                 }
1163
1164                 // edit the item for real
1165                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1166
1167                 if ($draftid > 0) {
1168                         ITEM::delete($draftid);
1169                 }
1170
1171                 $blogid = getBlogIDFromItemID($itemid);
1172                 $blog =& $manager->getBlog($blogid);
1173                 if (!$closed && $publish && $wasdraft && $blog->pingUserland()) {
1174                         $this->action_sendping($blogid);
1175                         return;
1176                 }
1177
1178                 // show category edit window when we created a new category
1179                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1180                 if ($catid != intPostVar('catid')) {
1181                         $this->action_categoryedit(
1182                                 $catid,
1183                                 $blog->getID(),
1184                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1185                         );
1186                 } else {
1187                         // TODO: set start item correctly for itemlist
1188                         $this->action_itemlist(getBlogIDFromItemID($itemid));
1189                 }
1190         }
1191
1192         /**
1193          * @todo document this
1194          */
1195         function action_itemdelete() {
1196                 global $member, $manager;
1197
1198                 $itemid = intRequestVar('itemid');
1199
1200                 // only allow if user is allowed to alter item
1201                 $member->canAlterItem($itemid) or $this->disallow();
1202
1203                 if (!$manager->existsItem($itemid,1,1))
1204                         $this->error(_ERROR_NOSUCHITEM);
1205
1206                 $item =& $manager->getItem($itemid,1,1);
1207                 $title = htmlspecialchars(strip_tags($item['title']));
1208                 $body = strip_tags($item['body']);
1209                 $body = htmlspecialchars(shorten($body,300,'...'));
1210
1211                 $this->pagehead();
1212                 ?>
1213                         <h2><?php echo _DELETE_CONFIRM?></h2>
1214
1215                         <p><?php echo _CONFIRMTXT_ITEM?></p>
1216
1217                         <div class="note">
1218                                 <b>"<?php echo  $title ?>"</b>
1219                                 <br />
1220                                 <?php echo $body?>
1221                         </div>
1222
1223                         <form method="post" action="index.php"><div>
1224                                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1225                                 <?php $manager->addTicketHidden() ?>
1226                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1227                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1228                         </div></form>
1229                 <?php
1230                 $this->pagefoot();
1231         }
1232
1233         /**
1234          * @todo document this
1235          */
1236         function action_itemdeleteconfirm() {
1237                 global $member;
1238
1239                 $itemid = intRequestVar('itemid');
1240
1241                 // only allow if user is allowed to alter item
1242                 $member->canAlterItem($itemid) or $this->disallow();
1243
1244                 // get blogid first
1245                 $blogid = getBlogIdFromItemId($itemid);
1246
1247                 // delete item (note: some checks will be performed twice)
1248                 $this->deleteOneItem($itemid);
1249
1250                 $this->action_itemlist($blogid);
1251         }
1252
1253         /**
1254          * Deletes one item and returns error if something goes wrong
1255          * @param int $itemid
1256          */
1257         function deleteOneItem($itemid) {
1258                 global $member, $manager;
1259
1260                 // only allow if user is allowed to alter item (also checks if itemid exists)
1261                 if (!$member->canAlterItem($itemid))
1262                         return _ERROR_DISALLOWED;
1263
1264                 $manager->loadClass('ITEM');
1265                 ITEM::delete($itemid);
1266         }
1267
1268         /**
1269          * @todo document this
1270          */
1271         function action_itemmove() {
1272                 global $member, $manager;
1273
1274                 $itemid = intRequestVar('itemid');
1275
1276                 // only allow if user is allowed to alter item
1277                 $member->canAlterItem($itemid) or $this->disallow();
1278
1279                 $item =& $manager->getItem($itemid,1,1);
1280
1281                 $this->pagehead();
1282                 ?>
1283                         <h2><?php echo _MOVE_TITLE?></h2>
1284                         <form method="post" action="index.php"><div>
1285                                 <input type="hidden" name="action" value="itemmoveto" />
1286                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1287
1288                                 <?php
1289
1290                                         $manager->addTicketHidden();
1291                                         $this->selectBlogCategory('catid',$item['catid'],10,1);
1292                                 ?>
1293
1294                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1295                         </div></form>
1296                 <?php
1297                 $this->pagefoot();
1298         }
1299
1300         /**
1301          * @todo document this
1302          */
1303         function action_itemmoveto() {
1304                 global $member, $manager;
1305
1306                 $itemid = intRequestVar('itemid');
1307                 $catid = requestVar('catid');
1308
1309                 // create new category if needed
1310                 if (strstr($catid,'newcat')) {
1311                         // get blogid
1312                         list($blogid) = sscanf($catid,'newcat-%d');
1313
1314                         // create
1315                         $blog =& $manager->getBlog($blogid);
1316                         $catid = $blog->createNewCategory();
1317
1318                         // show error when sth goes wrong
1319                         if (!$catid)
1320                                 $this->doError(_ERROR_CATCREATEFAIL);
1321                 }
1322
1323                 // only allow if user is allowed to alter item
1324                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1325
1326                 ITEM::move($itemid, $catid);
1327
1328                 if ($catid != intRequestVar('catid'))
1329                         $this->action_categoryedit($catid, $blog->getID());
1330                 else
1331                         $this->action_itemlist(getBlogIDFromCatID($catid));
1332         }
1333
1334         /**
1335          * Moves one item to a given category (category existance should be checked by caller)
1336          * errors are returned
1337          * @param int $itemid
1338          * @param int $destCatid category ID to which the item will be moved
1339          */
1340         function moveOneItem($itemid, $destCatid) {
1341                 global $member;
1342
1343                 // only allow if user is allowed to move item
1344                 if (!$member->canUpdateItem($itemid, $destCatid))
1345                         return _ERROR_DISALLOWED;
1346
1347                 ITEM::move($itemid, $destCatid);
1348         }
1349
1350         /**
1351          * Adds a item to the chosen blog
1352          */
1353         function action_additem() {
1354                 global $member, $manager, $CONF;
1355
1356                 $manager->loadClass('ITEM');
1357
1358                 $result = ITEM::createFromRequest();
1359
1360                 if ($result['status'] == 'error')
1361                         $this->error($result['message']);
1362
1363                 $blogid = getBlogIDFromItemID($result['itemid']);
1364                 $blog =& $manager->getBlog($blogid);
1365
1366                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));
1367
1368                 if ($result['status'] == 'newcategory')
1369                         $this->action_categoryedit(
1370                                 $result['catid'],
1371                                 $blogid,
1372                                 $blog->pingUserland() ? $pingUrl : ''
1373                         );
1374                 elseif ((postVar('actiontype') == 'addnow') && $blog->pingUserland())
1375                         $this->action_sendping($blogid);
1376                 else
1377                         $this->action_itemlist($blogid);
1378         }
1379
1380         /**
1381          * Shows a window that says we're about to ping weblogs.com.
1382          * immediately refresh to the real pinging page, which will
1383          * show an error, or redirect to the blog.
1384          *
1385          * @param int $blogid ID of blog for which ping needs to be sent out
1386          */
1387         function action_sendping($blogid = -1) {
1388                 global $member, $manager;
1389
1390                 if ($blogid == -1)
1391                         $blogid = intRequestVar('blogid');
1392
1393                 $member->isLoggedIn() or $this->disallow();
1394
1395                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));
1396
1397                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');
1398                 ?>
1399                 <h2>Site Updated, Now pinging weblogs.com</h2>
1400
1401                 <p>
1402                         Pinging weblogs.com! This can a while...
1403                         <br />
1404                         When the ping is complete (and successfull), your weblog will show up in the weblogs.com updates list.
1405                 </p>
1406
1407                 <p>
1408                         If you aren't automatically passed through, <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>">try again</a>
1409                 </p>
1410                 <?php           $this->pagefoot();
1411         }
1412
1413         /**
1414          * Ping to Weblogs.com
1415          * Sends the real ping (can take up to 10 seconds!)
1416          */
1417         function action_rawping() {
1418                 global $manager;
1419                 // TODO: checks?
1420
1421                 $blogid = intRequestVar('blogid');
1422                 $blog =& $manager->getBlog($blogid);
1423
1424                 $result = $blog->sendUserlandPing();
1425
1426                 $this->pagehead();
1427
1428                 ?>
1429
1430                 <h2>Ping Results</h2>
1431
1432                 <p>The following message was returned by weblogs.com:</p>
1433
1434                 <div class='note'><?php echo  $result ?></div>
1435
1436                 <ul>
1437                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>">View list of recent items for <?php echo htmlspecialchars($blog->getName())?></a></li>
1438                         <li><a href="<?php echo $blog->getURL()?>">Visit your own site</a></li>
1439                 </ul>
1440
1441                 <?php           $this->pagefoot();
1442         }
1443
1444         /**
1445          * Allows to edit previously made comments
1446          */
1447         function action_commentedit() {
1448                 global $member, $manager;
1449
1450                 $commentid = intRequestVar('commentid');
1451
1452                 $member->canAlterComment($commentid) or $this->disallow();
1453
1454                 $comment = COMMENT::getComment($commentid);
1455
1456                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
1457
1458                 // change <br /> to \n
1459                 $comment['body'] = str_replace('<br />','',$comment['body']);
1460
1461                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
1462
1463                 $this->pagehead();
1464
1465                 ?>
1466                 <h2><?php echo _EDITC_TITLE?></h2>
1467
1468                 <form action="index.php" method="post"><div>
1469
1470                 <input type="hidden" name="action" value="commentupdate" />
1471                 <?php $manager->addTicketHidden(); ?>
1472                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1473                 <table><tr>
1474                         <th colspan="2"><?php echo _EDITC_TITLE?></th>
1475                 </tr><tr>
1476                         <td><?php echo _EDITC_WHO?></td>
1477                         <td>
1478                         <?php                           if ($comment['member'])
1479                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1480                                 else
1481                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1482                         ?>
1483                         </td>
1484                 </tr><tr>
1485                         <td><?php echo _EDITC_WHEN?></td>
1486                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1487                 </tr><tr>
1488                         <td><?php echo _EDITC_HOST?></td>
1489                         <td><?php echo  $comment['host']; ?></td>
1490                 </tr><tr>
1491                         <td><?php echo _EDITC_TEXT?></td>
1492                         <td>
1493                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)
1494                                         echo $comment['body'];
1495                                 ?></textarea>
1496                         </td>
1497                 </tr><tr>
1498                         <td><?php echo _EDITC_EDIT?></td>
1499                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1500                 </tr></table>
1501
1502                 </div></form>
1503                 <?php
1504                 $this->pagefoot();
1505         }
1506
1507         /**
1508          * @todo document this
1509          */
1510         function action_commentupdate() {
1511                 global $member, $manager;
1512
1513                 $commentid = intRequestVar('commentid');
1514
1515                 $member->canAlterComment($commentid) or $this->disallow();
1516
1517                 $body = postVar('body');
1518
1519                 // intercept words that are too long
1520                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
1521                         $this->error(_ERROR_COMMENT_LONGWORD);
1522
1523                 // check length
1524                 if (strlen($body)<3)
1525                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1526                 if (strlen($body)>5000)
1527                         $this->error(_ERROR_COMMENT_TOOLONG);
1528
1529
1530                 // prepare body
1531                 $body = COMMENT::prepareBody($body);
1532
1533                 // call plugins
1534                 $manager->notify('PreUpdateComment',array('body' => &$body));
1535
1536                 $query =  'UPDATE '.sql_table('comment')
1537                            . " SET cbody='" .addslashes($body). "'"
1538                            . " WHERE cnumber=" . $commentid;
1539                 sql_query($query);
1540
1541                 // get itemid
1542                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1543                 $o = mysql_fetch_object($res);
1544                 $itemid = $o->citem;
1545
1546                 if ($member->canAlterItem($itemid))
1547                         $this->action_itemcommentlist($itemid);
1548                 else
1549                         $this->action_browseowncomments();
1550
1551         }
1552
1553         /**
1554          * @todo document this
1555          */
1556         function action_commentdelete() {
1557                 global $member, $manager;
1558
1559                 $commentid = intRequestVar('commentid');
1560
1561                 $member->canAlterComment($commentid) or $this->disallow();
1562
1563                 $comment = COMMENT::getComment($commentid);
1564
1565                 $body = strip_tags($comment['body']);
1566                 $body = htmlspecialchars(shorten($body, 300, '...'));
1567
1568                 if ($comment['member'])
1569                         $author = $comment['member'];
1570                 else
1571                         $author = $comment['user'];
1572
1573                 $this->pagehead();
1574                 ?>
1575
1576                         <h2><?php echo _DELETE_CONFIRM?></h2>
1577
1578                         <p><?php echo _CONFIRMTXT_COMMENT?></p>
1579
1580                         <div class="note">
1581                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1582                         <br />
1583                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1584                         </div>
1585
1586                         <form method="post" action="index.php"><div>
1587                                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1588                                 <?php $manager->addTicketHidden() ?>
1589                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1590                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1591                         </div></form>
1592                 <?php
1593                 $this->pagefoot();
1594         }
1595
1596         /**
1597          * @todo document this
1598          */
1599         function action_commentdeleteconfirm() {
1600                 global $member;
1601
1602                 $commentid = intRequestVar('commentid');
1603
1604                 // get item id first
1605                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1606                 $o = mysql_fetch_object($res);
1607                 $itemid = $o->citem;
1608
1609                 $error = $this->deleteOneComment($commentid);
1610                 if ($error)
1611                         $this->doError($error);
1612
1613                 if ($member->canAlterItem($itemid))
1614                         $this->action_itemcommentlist($itemid);
1615                 else
1616                         $this->action_browseowncomments();
1617         }
1618
1619         /**
1620          * @todo document this
1621          */
1622         function deleteOneComment($commentid) {
1623                 global $member, $manager;
1624
1625                 $commentid = intval($commentid);
1626
1627                 if (!$member->canAlterComment($commentid))
1628                         return _ERROR_DISALLOWED;
1629
1630                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1631
1632                 // delete the comments associated with the item
1633                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1634                 sql_query($query);
1635
1636                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1637
1638                 return '';
1639         }
1640
1641         /**
1642          * Usermanagement main
1643          */
1644         function action_usermanagement() {
1645                 global $member, $manager;
1646
1647                 // check if allowed
1648                 $member->isAdmin() or $this->disallow();
1649
1650                 $this->pagehead();
1651
1652                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1653
1654                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1655
1656                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1657
1658                 // show list of members with actions
1659                 $query =  'SELECT *'
1660                            . ' FROM '.sql_table('member');
1661                 $template['content'] = 'memberlist';
1662                 $template['tabindex'] = 10;
1663
1664                 $manager->loadClass("ENCAPSULATE");
1665                 $batch =& new BATCH('member');
1666                 $batch->showlist($query,'table',$template);
1667
1668                 echo '<h3>' . _MEMBERS_NEW .'</h3>';
1669                 ?>
1670                         <form method="post" action="index.php" name="memberedit"><div>
1671
1672                         <input type="hidden" name="action" value="memberadd" />
1673                         <?php $manager->addTicketHidden() ?>
1674
1675                         <table>
1676                         <tr>
1677                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1678                         </tr><tr>
1679                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1680                                         <br /><small>(This is the name used to logon)</small>
1681                                 </td>
1682                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>
1683                         </tr><tr>
1684                                 <td><?php echo _MEMBERS_REALNAME?></td>
1685                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1686                         </tr><tr>
1687                                 <td><?php echo _MEMBERS_PWD?></td>
1688                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1689                         </tr><tr>
1690                                 <td><?php echo _MEMBERS_REPPWD?></td>
1691                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1692                         </tr><tr>
1693                                 <td><?php echo _MEMBERS_EMAIL?></td>
1694                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1695                         </tr><tr>
1696                                 <td><?php echo _MEMBERS_URL?></td>
1697                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1698                         </tr><tr>
1699                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1700                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1701                         </tr><tr>
1702                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1703                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1704                         </tr><tr>
1705                                 <td><?php echo _MEMBERS_NOTES?></td>
1706                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1707                         </tr><tr>
1708                                 <td><?php echo _MEMBERS_NEW?></td>
1709                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1710                         </tr></table>
1711
1712                         </div></form>
1713                 <?php
1714                 $this->pagefoot();
1715         }
1716
1717         /**
1718          * Edit member settings
1719          */
1720         function action_memberedit() {
1721                 $this->action_editmembersettings(intRequestVar('memberid'));
1722         }
1723
1724         /**
1725          * @todo document this
1726          */
1727         function action_editmembersettings($memberid = '') {
1728                 global $member, $manager, $CONF;
1729
1730                 if ($memberid == '')
1731                         $memberid = $member->getID();
1732
1733                 // check if allowed
1734                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1735
1736                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1737                 $this->pagehead($extrahead);
1738
1739                 // show message to go back to member overview (only for admins)
1740                 if ($member->isAdmin())
1741                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1742                 else
1743                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1744
1745                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1746
1747                 $mem = MEMBER::createFromID($memberid);
1748
1749                 ?>
1750                 <form method="post" action="index.php" name="memberedit"><div>
1751
1752                 <input type="hidden" name="action" value="changemembersettings" />
1753                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1754                 <?php $manager->addTicketHidden() ?>
1755
1756                 <table><tr>
1757                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1758                 </tr><tr>
1759                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1760                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1761                         </td>
1762                         <td>
1763                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1764                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />
1765                         <?php } else {
1766                                 echo htmlspecialchars($member->getDisplayName());
1767                            }
1768                         ?>
1769                         </td>
1770                 </tr><tr>
1771                         <td><?php echo _MEMBERS_REALNAME?></td>
1772                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>
1773                 </tr><tr>
1774                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1775                         <td><?php echo _MEMBERS_PWD?></td>
1776                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1777                 </tr><tr>
1778                         <td><?php echo _MEMBERS_REPPWD?></td>
1779                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1780                 <?php } ?>
1781                 </tr><tr>
1782                         <td><?php echo _MEMBERS_EMAIL?>
1783                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1784                         </td>
1785                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>
1786                 </tr><tr>
1787                         <td><?php echo _MEMBERS_URL?></td>
1788                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>
1789                 <?php // only allow to change this by super-admins
1790                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1791                    if ($member->isAdmin()) {
1792                 ?>
1793                         </tr><tr>
1794                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1795                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1796                         </tr><tr>
1797                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1798                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1799                 <?php } ?>
1800                 </tr><tr>
1801                         <td><?php echo _MEMBERS_NOTES?></td>
1802                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>
1803                 </tr><tr>
1804                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1805                         </td>
1806                         <td>
1807
1808                                 <select name="deflang" tabindex="85">
1809                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>
1810                                 <?php                           // show a dropdown list of all available languages
1811                                 global $DIR_LANG;
1812                                 $dirhandle = opendir($DIR_LANG);
1813                                 while ($filename = readdir($dirhandle)) {
1814                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
1815                                                 $name = $matches[1];
1816                                                 echo "<option value='$name'";
1817                                                 if ($name == $mem->getLanguage())
1818                                                         echo " selected='selected'";
1819                                                 echo ">$name</option>";
1820                                         }
1821                                 }
1822                                 closedir($dirhandle);
1823
1824                                 ?>
1825                                 </select>
1826
1827                         </td>
1828                 </tr>
1829                 <?php
1830                         // plugin options
1831                         $this->_insertPluginOptions('member',$memberid);
1832                 ?>
1833                 <tr>
1834                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1835                 </tr><tr>
1836                         <td><?php echo _MEMBERS_EDIT?></td>
1837                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1838                 </tr></table>
1839
1840                 </div></form>
1841
1842                 <?php
1843                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1844
1845                         $manager->notify(
1846                                 'MemberSettingsFormExtras',
1847                                 array(
1848                                         'member' => &$mem
1849                                 )
1850                         );
1851
1852                 $this->pagefoot();
1853         }
1854
1855         /**
1856          * @todo document this
1857          */
1858         function action_changemembersettings() {
1859                 global $member, $CONF, $manager;
1860
1861                 $memberid = intRequestVar('memberid');
1862
1863                 // check if allowed
1864                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1865
1866                 $name                   = trim(strip_tags(postVar('name')));
1867                 $realname               = trim(strip_tags(postVar('realname')));
1868                 $password               = postVar('password');
1869                 $repeatpassword = postVar('repeatpassword');
1870                 $email                  = strip_tags(postVar('email'));
1871                 $url                    = strip_tags(postVar('url'));
1872
1873                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
1874                 if (!eregi("^https?://", $url))
1875                         $url = "http://".$url;
1876
1877                 $admin                  = postVar('admin');
1878                 $canlogin               = postVar('canlogin');
1879                 $notes                  = strip_tags(postVar('notes'));
1880                 $deflang                = postVar('deflang');
1881
1882                 $mem = MEMBER::createFromID($memberid);
1883
1884                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1885
1886                         if (!isValidDisplayName($name))
1887                                 $this->error(_ERROR_BADNAME);
1888
1889                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1890                                 $this->error(_ERROR_NICKNAMEINUSE);
1891
1892                         if ($password != $repeatpassword)
1893                                 $this->error(_ERROR_PASSWORDMISMATCH);
1894
1895                         if ($password && (strlen($password) < 6))
1896                                 $this->error(_ERROR_PASSWORDTOOSHORT);
1897                 }
1898
1899                 if (!isValidMailAddress($email))
1900                         $this->error(_ERROR_BADMAILADDRESS);
1901
1902
1903                 if (!$realname)
1904                         $this->error(_ERROR_REALNAMEMISSING);
1905
1906                 if (($deflang != '') && (!checkLanguage($deflang)))
1907                         $this->error(_ERROR_NOSUCHLANGUAGE);
1908
1909                 // check if there will remain at least one site member with both the logon and admin rights
1910                 // (check occurs when taking away one of these rights from such a member)
1911                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1912                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1913                    )
1914                 {
1915                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1916                         if (mysql_num_rows($r) < 2)
1917                                 $this->error(_ERROR_ATLEASTONEADMIN);
1918                 }
1919
1920                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1921                         $mem->setDisplayName($name);
1922                         if ($password)
1923                                 $mem->setPassword($password);
1924                 }
1925
1926                 $oldEmail = $mem->getEmail();
1927
1928                 $mem->setRealName($realname);
1929                 $mem->setEmail($email);
1930                 $mem->setURL($url);
1931                 $mem->setNotes($notes);
1932                 $mem->setLanguage($deflang);
1933
1934
1935                 // only allow super-admins to make changes to the admin status
1936                 if ($member->isAdmin()) {
1937                         $mem->setAdmin($admin);
1938                         $mem->setCanLogin($canlogin);
1939                 }
1940
1941
1942                 $mem->write();
1943
1944                 // store plugin options
1945                 $aOptions = requestArray('plugoption');
1946                 NucleusPlugin::_applyPluginOptions($aOptions);
1947                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
1948
1949                 // if email changed, generate new password
1950                 if ($oldEmail != $mem->getEmail())
1951                 {
1952                         $mem->sendActivationLink('addresschange', $oldEmail);
1953                         // logout member
1954                         $mem->newCookieKey();
1955
1956                         // only log out if the member being edited is the current member.
1957                         if ($member->getID() == $memberid)
1958                                 $member->logout();
1959                         $this->action_login(_MSG_ACTIVATION_SENT, 0);
1960                         return;
1961                 }
1962
1963
1964                 if (  ( $mem->getID() == $member->getID() )
1965                    && ( $mem->getDisplayName() != $member->getDisplayName() )
1966                    ) {
1967                         $mem->newCookieKey();
1968                         $member->logout();
1969                         $this->action_login(_MSG_LOGINAGAIN, 0);
1970                 } else {
1971                         $this->action_overview(_MSG_SETTINGSCHANGED);
1972                 }
1973         }
1974
1975         /**
1976          * @todo document this
1977          */
1978         function action_memberadd() {
1979                 global $member, $manager;
1980
1981                 // check if allowed
1982                 $member->isAdmin() or $this->disallow();
1983
1984                 if (postVar('password') != postVar('repeatpassword'))
1985                         $this->error(_ERROR_PASSWORDMISMATCH);
1986                 if (strlen(postVar('password')) < 6)
1987                         $this->error(_ERROR_PASSWORDTOOSHORT);
1988
1989                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
1990                 if ($res != 1)
1991                         $this->error($res);
1992
1993                 // fire PostRegister event
1994                 $newmem = new MEMBER();
1995                 $newmem->readFromName(postVar('name'));
1996                 $manager->notify('PostRegister',array('member' => &$newmem));
1997
1998                 $this->action_usermanagement();
1999         }
2000
2001         /**
2002          * Account activation
2003          *
2004          * @author dekarma
2005          */
2006         function action_activate() {
2007
2008                 $key = getVar('key');
2009                 $this->_showActivationPage($key);
2010         }
2011
2012         /**
2013          * @todo document this
2014          */
2015         function _showActivationPage($key, $message = '')
2016         {
2017                 global $manager;
2018
2019                 // clean up old activation keys
2020                 MEMBER::cleanupActivationTable();
2021
2022                 // get activation info
2023                 $info = MEMBER::getActivationInfo($key);
2024
2025                 if (!$info)
2026                         $this->error(_ERROR_ACTIVATE);
2027
2028                 $mem = MEMBER::createFromId($info->vmember);
2029
2030                 if (!$mem)
2031                         $this->error(_ERROR_ACTIVATE);
2032
2033                 $text = '';
2034                 $title = '';
2035                 $bNeedsPasswordChange = true;
2036
2037                 switch ($info->vtype)
2038                 {
2039                         case 'forgot':
2040                                 $title = _ACTIVATE_FORGOT_TITLE;
2041                                 $text = _ACTIVATE_FORGOT_TEXT;
2042                                 break;
2043                         case 'register':
2044                                 $title = _ACTIVATE_REGISTER_TITLE;
2045                                 $text = _ACTIVATE_REGISTER_TEXT;
2046                                 break;
2047                         case 'addresschange':
2048                                 $title = _ACTIVATE_CHANGE_TITLE;
2049                                 $text = _ACTIVATE_CHANGE_TEXT;
2050                                 $bNeedsPasswordChange = false;
2051                                 MEMBER::activate($key);
2052                                 break;
2053                 }
2054
2055                 $aVars = array(
2056                         'memberName' => htmlspecialchars($mem->getDisplayName())
2057                 );
2058                 $title = TEMPLATE::fill($title, $aVars);
2059                 $text = TEMPLATE::fill($text, $aVars);
2060
2061                 $this->pagehead();
2062
2063                         echo '<h2>' , $title, '</h2>';
2064                         echo '<p>' , $text, '</p>';
2065
2066                         if ($message != '')
2067                         {
2068                                 echo '<p class="error">',$message,'</p>';
2069                         }
2070
2071                         if ($bNeedsPasswordChange)
2072                         {
2073                                 ?>
2074                                         <div><form action="index.php" method="post">
2075
2076                                                 <input type="hidden" name="action" value="activatesetpwd" />
2077                                                 <?php $manager->addTicketHidden() ?>
2078                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />
2079
2080                                                 <table><tr>
2081                                                         <td><?php echo _MEMBERS_PWD?></td>
2082                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>
2083                                                 </tr><tr>
2084                                                         <td><?php echo _MEMBERS_REPPWD?></td>
2085                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2086                                                 <?php
2087
2088                                                         global $manager;
2089                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2090
2091                                                 ?>
2092                                                 </tr><tr>
2093                                                         <td><?php echo _MEMBERS_SETPWD ?></td>
2094                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2095                                                 </tr></table>
2096
2097
2098                                         </form></div>
2099
2100                                 <?php
2101
2102                         }
2103
2104                 $this->pagefoot();
2105
2106         }
2107
2108         /**
2109          * Account activation - set password part
2110          *
2111          * @author dekarma
2112          */
2113         function action_activatesetpwd() {
2114
2115                 $key = postVar('key');
2116
2117                 // clean up old activation keys
2118                 MEMBER::cleanupActivationTable();
2119
2120                 // get activation info
2121                 $info = MEMBER::getActivationInfo($key);
2122
2123                 if (!$info || ($info->type == 'addresschange'))
2124                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2125
2126                 $mem = MEMBER::createFromId($info->vmember);
2127
2128                 if (!$mem)
2129                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2130
2131                 $password               = postVar('password');
2132                 $repeatpassword = postVar('repeatpassword');
2133
2134                 if ($password != $repeatpassword)
2135                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2136
2137                 if ($password && (strlen($password) < 6))
2138                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2139
2140                 $error = '';
2141                 global $manager;
2142                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2143                 if ($error != '')
2144                         return $this->_showActivationPage($key, $error);
2145
2146
2147                 // set password
2148                 $mem->setPassword($password);
2149                 $mem->write();
2150
2151                 // do the activation
2152                 MEMBER::activate($key);
2153
2154                 $this->pagehead();
2155                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2156                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2157                 $this->pagefoot();
2158         }
2159
2160         /**
2161          * Manage team
2162          */
2163         function action_manageteam() {
2164                 global $member, $manager;
2165
2166                 $blogid = intRequestVar('blogid');
2167
2168                 // check if allowed
2169                 $member->blogAdminRights($blogid) or $this->disallow();
2170
2171                 $this->pagehead();
2172
2173                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2174
2175                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2176
2177                 echo '<h3>' . _TEAM_CURRENT . '</h3>';
2178
2179
2180
2181                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2182                            . ' FROM '.sql_table('member').', '.sql_table('team')
2183                            . ' WHERE tmember=mnumber and tblog=' . $blogid;
2184
2185                 $template['content'] = 'teamlist';
2186                 $template['tabindex'] = 10;
2187
2188                 $manager->loadClass("ENCAPSULATE");
2189                 $batch =& new BATCH('team');
2190                 $batch->showlist($query, 'table', $template);
2191
2192                 ?>
2193                         <h3><?php echo _TEAM_ADDNEW?></h3>
2194
2195                         <form method='post' action='index.php'><div>
2196
2197                         <input type='hidden' name='action' value='teamaddmember' />
2198                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2199                         <?php $manager->addTicketHidden() ?>
2200
2201                         <table><tr>
2202                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2203                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed
2204                                         $query =  'SELECT mname as text, mnumber as value'
2205                                                    . ' FROM '.sql_table('member');
2206
2207                                         $template['name'] = 'memberid';
2208                                         $template['tabindex'] = 10000;
2209                                         showlist($query,'select',$template);
2210                                 ?></td>
2211                         </tr><tr>
2212                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2213                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2214                         </tr><tr>
2215                                 <td><?php echo _TEAM_ADD?></td>
2216                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2217                         </tr></table>
2218
2219                         </div></form>
2220                 <?php
2221                 $this->pagefoot();
2222         }
2223
2224         /**
2225          * Add member to team
2226          */
2227         function action_teamaddmember() {
2228                 global $member, $manager;
2229
2230                 $memberid = intPostVar('memberid');
2231                 $blogid = intPostVar('blogid');
2232                 $admin = intPostVar('admin');
2233
2234                 // check if allowed
2235                 $member->blogAdminRights($blogid) or $this->disallow();
2236
2237                 $blog =& $manager->getBlog($blogid);
2238                 if (!$blog->addTeamMember($memberid, $admin))
2239                         $this->error(_ERROR_ALREADYONTEAM);
2240
2241                 $this->action_manageteam();
2242
2243         }
2244
2245         /**
2246          * @todo document this
2247          */
2248         function action_teamdelete() {
2249                 global $member, $manager;
2250
2251                 $memberid = intRequestVar('memberid');
2252                 $blogid = intRequestVar('blogid');
2253
2254                 // check if allowed
2255                 $member->blogAdminRights($blogid) or $this->disallow();
2256
2257                 $teammem = MEMBER::createFromID($memberid);
2258                 $blog =& $manager->getBlog($blogid);
2259
2260                 $this->pagehead();
2261                 ?>
2262                         <h2><?php echo _DELETE_CONFIRM?></h2>
2263
2264                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  $teammem->getDisplayName() ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>
2265                         </p>
2266
2267
2268                         <form method="post" action="index.php"><div>
2269                         <input type="hidden" name="action" value="teamdeleteconfirm" />
2270                         <?php $manager->addTicketHidden() ?>
2271                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2272                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2273                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2274                         </div></form>
2275                 <?php
2276                 $this->pagefoot();
2277         }
2278
2279         /**
2280          * @todo document this
2281          */
2282         function action_teamdeleteconfirm() {
2283                 global $member;
2284
2285                 $memberid = intRequestVar('memberid');
2286                 $blogid = intRequestVar('blogid');
2287
2288                 $error = $this->deleteOneTeamMember($blogid, $memberid);
2289                 if ($error)
2290                         $this->error($error);
2291
2292
2293                 $this->action_manageteam();
2294         }
2295
2296         /**
2297          * @todo document this
2298          */
2299         function deleteOneTeamMember($blogid, $memberid) {
2300                 global $member, $manager;
2301
2302                 $blogid = intval($blogid);
2303                 $memberid = intval($memberid);
2304
2305                 // check if allowed
2306                 if (!$member->blogAdminRights($blogid))
2307                         return _ERROR_DISALLOWED;
2308
2309                 // check if: - there remains at least one blog admin
2310                 //           - (there remains at least one team member)
2311                 $tmem = MEMBER::createFromID($memberid);
2312
2313                 $manager->notify('PreDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2314
2315                 if ($tmem->isBlogAdmin($blogid)) {
2316                         // check if there are more blog members left and at least one admin
2317                         // (check for at least two admins before deletion)
2318                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2319                         $r = sql_query($query);
2320                         if (mysql_num_rows($r) < 2)
2321                                 return _ERROR_ATLEASTONEBLOGADMIN;
2322                 }
2323
2324                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2325                 sql_query($query);
2326
2327                 $manager->notify('PostDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2328
2329                 return '';
2330         }
2331
2332         /**
2333          * @todo document this
2334          */
2335         function action_teamchangeadmin() {
2336                 global $member;
2337
2338                 $blogid = intRequestVar('blogid');
2339                 $memberid = intRequestVar('memberid');
2340
2341                 // check if allowed
2342                 $member->blogAdminRights($blogid) or $this->disallow();
2343
2344                 $mem = MEMBER::createFromID($memberid);
2345
2346                 // don't allow when there is only one admin at this moment
2347                 if ($mem->isBlogAdmin($blogid)) {
2348                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2349                         if (mysql_num_rows($r) == 1)
2350                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2351                 }
2352
2353                 if ($mem->isBlogAdmin($blogid))
2354                         $newval = 0;
2355                 else
2356                         $newval = 1;
2357
2358                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2359                 sql_query($query);
2360
2361                 // only show manageteam if member did not change its own admin privileges
2362                 if ($member->isBlogAdmin($blogid))
2363                         $this->action_manageteam();
2364                 else
2365                         $this->action_overview(_MSG_ADMINCHANGED);
2366         }
2367
2368         /**
2369          * @todo document this
2370          */
2371         function action_blogsettings() {
2372                 global $member, $manager;
2373
2374                 $blogid = intRequestVar('blogid');
2375
2376                 // check if allowed
2377                 $member->blogAdminRights($blogid) or $this->disallow();
2378
2379                 $blog =& $manager->getBlog($blogid);
2380
2381                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2382                 $this->pagehead($extrahead);
2383
2384                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2385                 ?>
2386                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2387
2388                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2389
2390                 <p>Members currently on your team:
2391                 <?php
2392                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2393                         $aMemberNames = array();
2394                         while ($o = mysql_fetch_object($res))
2395                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');
2396                         echo implode(',', $aMemberNames);
2397                 ?>
2398                 </p>
2399
2400
2401
2402                 <p>
2403                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2404                 </p>
2405
2406                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2407
2408                 <form method="post" action="index.php"><div>
2409
2410                 <input type="hidden" name="action" value="blogsettingsupdate" />
2411                 <?php $manager->addTicketHidden() ?>
2412                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2413                 <table><tr>
2414                         <td><?php echo _EBLOG_NAME?></td>
2415                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>
2416                 </tr><tr>
2417                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2418                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2419                         </td>
2420                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>
2421                 </tr><tr>
2422                         <td><?php echo _EBLOG_DESC?></td>
2423                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>
2424                 </tr><tr>
2425                         <td><?php echo _EBLOG_URL?></td>
2426                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>
2427                 </tr><tr>
2428                         <td><?php echo _EBLOG_DEFSKIN?>
2429                                 <?php help('blogdefaultskin'); ?>
2430                         </td>
2431                         <td>
2432                                 <?php
2433                                         $query =  'SELECT sdname as text, sdnumber as value'
2434                                                    . ' FROM '.sql_table('skin_desc');
2435                                         $template['name'] = 'defskin';
2436                                         $template['selected'] = $blog->getDefaultSkin();
2437                                         $template['tabindex'] = 50;
2438                                         showlist($query,'select',$template);
2439                                 ?>
2440
2441                         </td>
2442                 </tr><tr>
2443                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2444                         </td>
2445                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2446                 </tr><tr>
2447                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2448                         </td>
2449                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2450                 </tr><tr>
2451                         <td><?php echo _EBLOG_DISABLECOMMENTS?>
2452                         </td>
2453                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2454                 </tr><tr>
2455                         <td><?php echo _EBLOG_ANONYMOUS?>
2456                         </td>
2457                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2458                 </tr><tr>
2459         <td><?php echo _EBLOG_REQUIREDEMAIL?>
2460                  </td>
2461                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2462           </tr><tr>
2463                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2464                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
2465                 </tr><tr>
2466                         <td><?php echo _EBLOG_NOTIFY_ON?></td>
2467                         <td>
2468                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2469                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2470                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2471                                 <br />
2472                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2473                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2474                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2475                                 <br />
2476                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2477                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2478                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2479                         </td>
2480                 </tr><tr>
2481                         <td><?php echo _EBLOG_PING?> <?php help('pinguserland'); ?></td>
2482                         <td><?php $this->input_yesno('pinguserland',$blog->pingUserland(),85); ?></td>
2483                 </tr><tr>
2484                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2485                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>
2486                 </tr><tr>
2487                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2488                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>
2489                 </tr><tr>
2490                         <td><?php echo _EBLOG_DEFCAT?></td>
2491                         <td>
2492                                 <?php
2493                                         $query =  'SELECT cname as text, catid as value'
2494                                                    . ' FROM '.sql_table('category')
2495                                                    . ' WHERE cblog=' . $blog->getID();
2496                                         $template['name'] = 'defcat';
2497                                         $template['selected'] = $blog->getDefaultCategory();
2498                                         $template['tabindex'] = 110;
2499                                         showlist($query,'select',$template);
2500                                 ?>
2501                         </td>
2502                 </tr><tr>
2503                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2504                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
2505                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2506                                 </td>
2507                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>
2508                 </tr><tr>
2509                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2510                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2511                 </tr>
2512                 <?php
2513                         // plugin options
2514                         $this->_insertPluginOptions('blog',$blogid);
2515                 ?>
2516                 <tr>
2517                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2518                 </tr><tr>
2519                         <td><?php echo _EBLOG_CHANGE?></td>
2520                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2521                 </tr></table>
2522
2523                 </div></form>
2524
2525                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2526
2527
2528                 <?php
2529                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2530                 $template['content'] = 'categorylist';
2531                 $template['tabindex'] = 200;
2532
2533                 $manager->loadClass("ENCAPSULATE");
2534                 $batch =& new BATCH('category');
2535                 $batch->showlist($query,'table',$template);
2536
2537                 ?>
2538
2539
2540                 <form action="index.php" method="post"><div>
2541                 <input name="action" value="categorynew" type="hidden" />
2542                 <?php $manager->addTicketHidden() ?>
2543                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2544
2545                 <table><tr>
2546                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2547                 </tr><tr>
2548                         <td><?php echo _EBLOG_CAT_NAME?></td>
2549                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2550                 </tr><tr>
2551                         <td><?php echo _EBLOG_CAT_DESC?></td>
2552                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2553                 </tr><tr>
2554                         <td><?php echo _EBLOG_CAT_CREATE?></td>
2555                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2556                 </tr></table>
2557
2558                 </div></form>
2559
2560                 <?php
2561
2562                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2563
2564                         $manager->notify(
2565                                 'BlogSettingsFormExtras',
2566                                 array(
2567                                         'blog' => &$blog
2568                                 )
2569                         );
2570
2571                 $this->pagefoot();
2572         }
2573
2574         /**
2575          * @todo document this
2576          */
2577         function action_categorynew() {
2578                 global $member, $manager;
2579
2580                 $blogid = intRequestVar('blogid');
2581
2582                 $member->blogAdminRights($blogid) or $this->disallow();
2583
2584                 $cname = postVar('cname');
2585                 $cdesc = postVar('cdesc');
2586
2587                 if (!isValidCategoryName($cname))
2588                         $this->error(_ERROR_BADCATEGORYNAME);
2589
2590                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
2591                 $res = sql_query($query);
2592                 if (mysql_num_rows($res) > 0)
2593                         $this->error(_ERROR_DUPCATEGORYNAME);
2594
2595                 $blog           =& $manager->getBlog($blogid);
2596                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2597
2598                 $this->action_blogsettings();
2599         }
2600
2601         /**
2602          * @todo document this
2603          */
2604         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2605                 global $member, $manager;
2606
2607                 if ($blogid == '')
2608                         $blogid = intGetVar('blogid');
2609                 else
2610                         $blogid = intval($blogid);
2611                 if ($catid == '')
2612                         $catid = intGetVar('catid');
2613                 else
2614                         $catid = intval($catid);
2615
2616                 $member->blogAdminRights($blogid) or $this->disallow();
2617
2618                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2619                 $obj = mysql_fetch_object($res);
2620
2621                 $cname = $obj->cname;
2622                 $cdesc = $obj->cdesc;
2623
2624                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2625                 $this->pagehead($extrahead);
2626
2627                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2628
2629                 ?>
2630                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>
2631                 <form method='post' action='index.php'><div>
2632                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2633                 <input name="catid" type="hidden" value="<?php echo $catid?>" />
2634                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />
2635                 <input name="action" type="hidden" value="categoryupdate" />
2636                 <?php $manager->addTicketHidden(); ?>
2637
2638                 <table><tr>
2639                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2640                 </tr><tr>
2641                         <td><?php echo _EBLOG_CAT_NAME?></td>
2642                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>
2643                 </tr><tr>
2644                         <td><?php echo _EBLOG_CAT_DESC?></td>
2645                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>
2646                 </tr>
2647                 <?php
2648                         // insert plugin options
2649                         $this->_insertPluginOptions('category',$catid);
2650                 ?>
2651                 <tr>
2652                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2653                 </tr><tr>
2654                         <td><?php echo _EBLOG_CAT_UPDATE?></td>
2655                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2656                 </tr></table>
2657
2658                 </div></form>
2659                 <?php
2660                 $this->pagefoot();
2661         }
2662
2663         /**
2664          * @todo document this
2665          */
2666         function action_categoryupdate() {
2667                 global $member, $manager;
2668
2669                 $blogid = intPostVar('blogid');
2670                 $catid = intPostVar('catid');
2671                 $cname = postVar('cname');
2672                 $cdesc = postVar('cdesc');
2673                 $desturl = postVar('desturl');
2674
2675                 $member->blogAdminRights($blogid) or $this->disallow();
2676
2677                 if (!isValidCategoryName($cname))
2678                         $this->error(_ERROR_BADCATEGORYNAME);
2679
2680                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2681                 $res = sql_query($query);
2682                 if (mysql_num_rows($res) > 0)
2683                         $this->error(_ERROR_DUPCATEGORYNAME);
2684
2685                 $query =  'UPDATE '.sql_table('category').' SET'
2686                            . " cname='" . addslashes($cname) . "',"
2687                            . " cdesc='" . addslashes($cdesc) . "'"
2688                            . " WHERE catid=" . $catid;
2689
2690                 sql_query($query);
2691
2692                 // store plugin options
2693                 $aOptions = requestArray('plugoption');
2694                 NucleusPlugin::_applyPluginOptions($aOptions);
2695                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2696
2697
2698                 if ($desturl) {
2699                         redirect($desturl);
2700                         exit;
2701                 } else {
2702                         $this->action_blogsettings();
2703                 }
2704         }
2705
2706         /**
2707          * @todo document this
2708          */
2709         function action_categorydelete() {
2710                 global $member, $manager;
2711
2712                 $blogid = intRequestVar('blogid');
2713                 $catid = intRequestVar('catid');
2714
2715                 $member->blogAdminRights($blogid) or $this->disallow();
2716
2717                 $blog =& $manager->getBlog($blogid);
2718
2719                 // check if the category is valid
2720                 if (!$blog->isValidCategory($catid))
2721                         $this->error(_ERROR_NOSUCHCATEGORY);
2722
2723                 // don't allow deletion of default category
2724                 if ($blog->getDefaultCategory() == $catid)
2725                         $this->error(_ERROR_DELETEDEFCATEGORY);
2726
2727                 // check if catid is the only category left for blogid
2728                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2729                 $res = sql_query($query);
2730                 if (mysql_num_rows($res) == 1)
2731                         $this->error(_ERROR_DELETELASTCATEGORY);
2732
2733
2734                 $this->pagehead();
2735                 ?>
2736                         <h2><?php echo _DELETE_CONFIRM?></h2>
2737
2738                         <div>
2739                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  $blog->getCategoryName($catid)?></b>
2740                         </div>
2741
2742                         <form method="post" action="index.php"><div>
2743                         <input type="hidden" name="action" value="categorydeleteconfirm" />
2744                         <?php $manager->addTicketHidden() ?>
2745                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2746                         <input type="hidden" name="catid" value="<?php echo $catid?>" />
2747                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2748                         </div></form>
2749                 <?php
2750                 $this->pagefoot();
2751         }
2752
2753         /**
2754          * @todo document this
2755          */
2756         function action_categorydeleteconfirm() {
2757                 global $member, $manager;
2758
2759                 $blogid = intRequestVar('blogid');
2760                 $catid = intRequestVar('catid');
2761
2762                 $member->blogAdminRights($blogid) or $this->disallow();
2763
2764                 $error = $this->deleteOneCategory($catid);
2765                 if ($error)
2766                         $this->error($error);
2767
2768                 $this->action_blogsettings();
2769         }
2770
2771         /**
2772          * @todo document this
2773          */
2774         function deleteOneCategory($catid) {
2775                 global $manager, $member;
2776
2777                 $catid = intval($catid);
2778
2779                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2780
2781                 $blogid = getBlogIDFromCatID($catid);
2782
2783                 if (!$member->blogAdminRights($blogid))
2784                         return ERROR_DISALLOWED;
2785
2786                 // get blog
2787                 $blog =& $manager->getBlog($blogid);
2788
2789                 // check if the category is valid
2790                 if (!$blog || !$blog->isValidCategory($catid))
2791                         return _ERROR_NOSUCHCATEGORY;
2792
2793                 $destcatid = $blog->getDefaultCategory();
2794
2795                 // don't allow deletion of default category
2796                 if ($blog->getDefaultCategory() == $catid)
2797                         return _ERROR_DELETEDEFCATEGORY;
2798
2799                 // check if catid is the only category left for blogid
2800                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2801                 $res = sql_query($query);
2802                 if (mysql_num_rows($res) == 1)
2803                         return _ERROR_DELETELASTCATEGORY;
2804
2805                 // change category for all items to the default category
2806                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2807                 sql_query($query);
2808
2809                 // delete all associated plugin options
2810                 NucleusPlugin::_deleteOptionValues('category', $catid);
2811
2812                 // delete category
2813                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2814                 sql_query($query);
2815
2816                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2817
2818         }
2819
2820         /**
2821          * @todo document this
2822          */
2823         function moveOneCategory($catid, $destblogid) {
2824                 global $manager, $member;
2825
2826                 $catid = intval($catid);
2827                 $destblogid = intval($destblogid);
2828
2829                 $blogid = getBlogIDFromCatID($catid);
2830
2831                 // mover should have admin rights on both blogs
2832                 if (!$member->blogAdminRights($blogid))
2833                         return _ERROR_DISALLOWED;
2834                 if (!$member->blogAdminRights($destblogid))
2835                         return _ERROR_DISALLOWED;
2836
2837                 // cannot move to self
2838                 if ($blogid == $destblogid)
2839                         return _ERROR_MOVETOSELF;
2840
2841                 // get blogs
2842                 $blog =& $manager->getBlog($blogid);
2843                 $destblog =& $manager->getBlog($destblogid);
2844
2845                 // check if the category is valid
2846                 if (!$blog || !$blog->isValidCategory($catid))
2847                         return _ERROR_NOSUCHCATEGORY;
2848
2849                 // don't allow default category to be moved
2850                 if ($blog->getDefaultCategory() == $catid)
2851                         return _ERROR_MOVEDEFCATEGORY;
2852
2853                 $manager->notify(
2854                         'PreMoveCategory',
2855                         array(
2856                                 'catid' => &$catid,
2857                                 'sourceblog' => &$blog,
2858                                 'destblog' => &$destblog
2859                         )
2860                 );
2861
2862                 // update comments table (cblog)
2863                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2864                 $items = sql_query($query);
2865                 while ($oItem = mysql_fetch_object($items)) {
2866                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2867                 }
2868
2869                 // update items (iblog)
2870                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2871                 sql_query($query);
2872
2873                 // move category
2874                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2875                 sql_query($query);
2876
2877                 $manager->notify(
2878                         'PostMoveCategory',
2879                         array(
2880                                 'catid' => &$catid,
2881                                 'sourceblog' => &$blog,
2882                                 'destblog' => $destblog
2883                         )
2884                 );
2885
2886         }
2887
2888         /**
2889          * @todo document this
2890          */
2891         function action_blogsettingsupdate() {
2892                 global $member, $manager;
2893
2894                 $blogid = intRequestVar('blogid');
2895
2896                 $member->blogAdminRights($blogid) or $this->disallow();
2897
2898                 $blog =& $manager->getBlog($blogid);
2899
2900                 $notify                 = trim(postVar('notify'));
2901                 $shortname              = trim(postVar('shortname'));
2902                 $updatefile             = trim(postVar('update'));
2903
2904                 $notifyComment  = intPostVar('notifyComment');
2905                 $notifyVote             = intPostVar('notifyVote');
2906                 $notifyNewItem  = intPostVar('notifyNewItem');
2907
2908                 if ($notifyComment == 0)        $notifyComment = 1;
2909                 if ($notifyVote == 0)           $notifyVote = 1;
2910                 if ($notifyNewItem == 0)        $notifyNewItem = 1;
2911
2912                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2913
2914
2915                 if ($notify) {
2916                         $not =& new NOTIFICATION($notify);
2917                         if (!$not->validAddresses())
2918                                 $this->error(_ERROR_BADNOTIFY);
2919
2920                 }
2921
2922                 if (!isValidShortName($shortname))
2923                         $this->error(_ERROR_BADSHORTBLOGNAME);
2924
2925                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
2926                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2927
2928                 // check if update file is writable
2929                 if ($updatefile && !is_writeable($updatefile))
2930                         $this->error(_ERROR_UPDATEFILE);
2931
2932                 $blog->setName(trim(postVar('name')));
2933                 $blog->setShortName($shortname);
2934                 $blog->setNotifyAddress($notify);
2935                 $blog->setNotifyType($notifyType);
2936                 $blog->setMaxComments(postVar('maxcomments'));
2937                 $blog->setCommentsEnabled(postVar('comments'));
2938                 $blog->setTimeOffset(postVar('timeoffset'));
2939                 $blog->setUpdateFile($updatefile);
2940                 $blog->setURL(trim(postVar('url')));
2941                 $blog->setDefaultSkin(intPostVar('defskin'));
2942                 $blog->setDescription(trim(postVar('desc')));
2943                 $blog->setPublic(postVar('public'));
2944                 $blog->setPingUserland(postVar('pinguserland'));
2945                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2946                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2947                 $blog->setDefaultCategory(intPostVar('defcat'));
2948                 $blog->setSearchable(intPostVar('searchable'));
2949                 $blog->setEmailRequired(intPostVar('reqemail'));
2950
2951                 $blog->writeSettings();
2952
2953                 // store plugin options
2954                 $aOptions = requestArray('plugoption');
2955                 NucleusPlugin::_applyPluginOptions($aOptions);
2956                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
2957
2958
2959                 $this->action_overview(_MSG_SETTINGSCHANGED);
2960         }
2961
2962         /**
2963          * @todo document this
2964          */
2965         function action_deleteblog() {
2966                 global $member, $CONF, $manager;
2967
2968                 $blogid = intRequestVar('blogid');
2969
2970                 $member->blogAdminRights($blogid) or $this->disallow();
2971
2972                 // check if blog is default blog
2973                 if ($CONF['DefaultBlog'] == $blogid)
2974                         $this->error(_ERROR_DELDEFBLOG);
2975
2976                 $blog =& $manager->getBlog($blogid);
2977
2978                 $this->pagehead();
2979                 ?>
2980                         <h2><?php echo _DELETE_CONFIRM?></h2>
2981
2982                         <p><?php echo _WARNINGTXT_BLOGDEL?>
2983                         </p>
2984
2985                         <div>
2986                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>
2987                         </div>
2988
2989                         <form method="post" action="index.php"><div>
2990                         <input type="hidden" name="action" value="deleteblogconfirm" />
2991                         <?php $manager->addTicketHidden() ?>
2992                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2993                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2994                         </div></form>
2995                 <?php
2996                 $this->pagefoot();
2997         }
2998
2999         /**
3000          * @todo document this
3001          */
3002         function action_deleteblogconfirm() {
3003                 global $member, $CONF, $manager;
3004
3005                 $blogid = intRequestVar('blogid');
3006
3007                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3008
3009                 $member->blogAdminRights($blogid) or $this->disallow();
3010
3011                 // check if blog is default blog
3012                 if ($CONF['DefaultBlog'] == $blogid)
3013                         $this->error(_ERROR_DELDEFBLOG);
3014
3015                 // delete all comments
3016                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3017                 sql_query($query);
3018
3019                 // delete all items
3020                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3021                 sql_query($query);
3022
3023                 // delete all team members
3024                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3025                 sql_query($query);
3026
3027                 // delete all bans
3028                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3029                 sql_query($query);
3030
3031                 // delete all categories
3032                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3033                 sql_query($query);
3034
3035                 // delete all associated plugin options
3036                 NucleusPlugin::_deleteOptionValues('blog', $blogid);
3037
3038                 // delete the blog itself
3039                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3040                 sql_query($query);
3041
3042                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3043
3044                 $this->action_overview(_DELETED_BLOG);
3045         }
3046
3047         /**
3048          * @todo document this
3049          */
3050         function action_memberdelete() {
3051                 global $member, $manager;
3052
3053                 $memberid = intRequestVar('memberid');
3054
3055                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3056
3057                 $mem = MEMBER::createFromID($memberid);
3058
3059                 $this->pagehead();
3060                 ?>
3061                         <h2><?php echo _DELETE_CONFIRM?></h2>
3062
3063                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo  $mem->getDisplayName() ?></b>
3064                         </p>
3065
3066                         <p>
3067                         Please note that media files will <b>NOT</b> be deleted. (At least not in this Nucleus version)
3068                         </p>
3069
3070                         <form method="post" action="index.php"><div>
3071                         <input type="hidden" name="action" value="memberdeleteconfirm" />
3072                         <?php $manager->addTicketHidden() ?>
3073                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3074                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3075                         </div></form>
3076                 <?php
3077                 $this->pagefoot();
3078         }
3079
3080         /**
3081          * @todo document this
3082          */
3083         function action_memberdeleteconfirm() {
3084                 global $member;
3085
3086                 $memberid = intRequestVar('memberid');
3087
3088                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3089
3090                 $error = $this->deleteOneMember($memberid);
3091                 if ($error)
3092                         $this->error($error);
3093
3094                 if ($member->isAdmin())
3095                         $this->action_usermanagement();
3096                 else
3097                         $this->action_overview(_DELETED_MEMBER);
3098         }
3099
3100         /**
3101          * @static
3102          * @todo document this
3103          */
3104         function deleteOneMember($memberid) {
3105                 global $manager;
3106
3107                 $memberid = intval($memberid);
3108                 $mem = MEMBER::createFromID($memberid);
3109
3110                 if (!$mem->canBeDeleted())
3111                         return _ERROR_DELETEMEMBER;
3112
3113                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3114
3115                 /* unlink comments from memberid */
3116                 $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
3117                                         .'" WHERE cmember='.$memberid;
3118                 sql_query($query);
3119
3120                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3121                 sql_query($query);
3122
3123                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3124                 sql_query($query);
3125
3126                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3127                 sql_query($query);
3128
3129                 // delete all associated plugin options
3130                 NucleusPlugin::_deleteOptionValues('member', $memberid);
3131
3132                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3133
3134                 return '';
3135         }
3136
3137         /**
3138          * @todo document this
3139          */
3140         function action_createnewlog() {
3141                 global $member, $CONF, $manager;
3142
3143                 // Only Super-Admins can do this
3144                 $member->isAdmin() or $this->disallow();
3145
3146                 $this->pagehead();
3147
3148                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3149                 ?>
3150                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3151
3152                 <h3>注意事項</h3>
3153
3154                 <p>作成にあたって、下記の<strong>注意事項</strong> をまずお読み下さい</p>
3155
3156                 <p>新しいweblogを作成した後に、このblogにアクセスするための方法を紹介しておきます。方法は2つあります:</p>
3157
3158                 <ol>
3159                         <li><strong>簡単な方法:</strong> <code>index.php</code>の複製を作り、新しいblogを表示するように変更を加えます。 この変更の詳細は、作成後に表示されます。</li>
3160                         <li><strong>高度な方法:</strong> 現在のblogで使用しているスキンに<code>otherblog</code>というコードを使った記述を加えます。この方法では、同じページ内で複数のblogを展開することが可能となります。</li>
3161                 </ol>
3162
3163                 <h3>Weblogの作成</h3>
3164
3165                 <p>
3166                 <?php echo _EBLOG_CREATE_TEXT?>
3167                 </p>
3168
3169                 <form method="post" action="index.php"><div>
3170
3171                 <input type="hidden" name="action" value="addnewlog" />
3172                 <?php $manager->addTicketHidden() ?>
3173
3174
3175                 <table><tr>
3176                         <td><?php echo _EBLOG_NAME?></td>
3177                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3178                 </tr><tr>
3179                         <td><?php echo _EBLOG_SHORTNAME?>
3180                                 <?php help('shortblogname'); ?>
3181                         </td>
3182                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3183                 </tr><tr>
3184                         <td><?php echo _EBLOG_DESC?></td>
3185                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3186                 </tr><tr>
3187                         <td><?php echo _EBLOG_DEFSKIN?>
3188                                 <?php help('blogdefaultskin'); ?>
3189                         </td>
3190                         <td>
3191                                 <?php
3192                                         $query =  'SELECT sdname as text, sdnumber as value'
3193                                                    . ' FROM '.sql_table('skin_desc');
3194                                         $template['name'] = 'defskin';
3195                                         $template['tabindex'] = 50;
3196                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin
3197                                         showlist($query,'select',$template);
3198                                 ?>
3199                         </td>
3200                 </tr><tr>
3201                         <td><?php echo _EBLOG_OFFSET?>
3202                                 <?php help('blogtimeoffset'); ?>
3203                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
3204                         </td>
3205                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3206                 </tr><tr>
3207                         <td><?php echo _EBLOG_ADMIN?>
3208                                 <?php help('blogadmin'); ?>
3209                         </td>
3210                         <td><?php echo _EBLOG_ADMIN_MSG?></td>
3211                 </tr><tr>
3212                         <td><?php echo _EBLOG_CREATE?></td>
3213                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3214                 </tr></table>
3215
3216                 </div></form>
3217                 <?php
3218                 $this->pagefoot();
3219         }
3220
3221         /**
3222          * @todo document this
3223          */
3224         function action_addnewlog() {
3225                 global $member, $manager, $CONF;
3226
3227                 // Only Super-Admins can do this
3228                 $member->isAdmin() or $this->disallow();
3229
3230                 $bname                  = trim(postVar('name'));
3231                 $bshortname             = trim(postVar('shortname'));
3232                 $btimeoffset    = postVar('timeoffset');
3233                 $bdesc                  = trim(postVar('desc'));
3234                 $bdefskin               = postVar('defskin');
3235
3236                 if (!isValidShortName($bshortname))
3237                         $this->error(_ERROR_BADSHORTBLOGNAME);
3238
3239                 if ($manager->existsBlog($bshortname))
3240                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3241
3242                 $manager->notify(
3243                         'PreAddBlog',
3244                         array(
3245                                 'name' => &$bname,
3246                                 'shortname' => &$bshortname,
3247                                 'timeoffset' => &$btimeoffset,
3248                                 'description' => &$bdescription,
3249                                 'defaultskin' => &$bdefskin
3250                         )
3251                 );
3252
3253
3254                 // add slashes for sql queries
3255                 $bname =                addslashes($bname);
3256                 $bshortname =   addslashes($bshortname);
3257                 $btimeoffset =  addslashes($btimeoffset);
3258                 $bdesc =                addslashes($bdesc);
3259                 $bdefskin =     addslashes($bdefskin);
3260
3261                 // create blog
3262                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3263                 sql_query($query);
3264                 $blogid = mysql_insert_id();
3265                 $blog   =& $manager->getBlog($blogid);
3266
3267                 // create new category
3268                 sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, 'General','Items that do not fit in other categories')");
3269                 $catid = mysql_insert_id();
3270
3271                 // set as default category
3272                 $blog->setDefaultCategory($catid);
3273                 $blog->writeSettings();
3274
3275                 // create team member
3276                 $memberid = $member->getID();
3277                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3278                 sql_query($query);
3279
3280
3281                 $blog->additem($blog->getDefaultCategory(),'First Item','これはあなたのweblogにおける最初のアイテムです。自由に削除していただいてかまいません。','',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3282
3283                 $manager->notify(
3284                         'PostAddBlog',
3285                         array(
3286                                 'blog' => &$blog
3287                         )
3288                 );
3289
3290                 $manager->notify(
3291                         'PostAddCategory',
3292                         array(
3293                                 'blog' => &$blog,
3294                                 'name' => 'General',
3295                                 'description' => 'Items that do not fit in other categories',
3296                                 'catid' => $catid
3297                         )
3298                 );
3299
3300                 $this->pagehead();
3301                 ?>
3302                 <h2>新しいweblogが作成されました</h2>
3303
3304                 <p>新しいweblog 「<?php echo htmlspecialchars($bname)?>」が作成されました。続けて、これにアクセスするために以下のどちらかの手順に進んでください。</p>
3305
3306                 <ol>
3307                         <li><a href="#index_php">簡単な方法: 下のコードを貼付けた <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成する</a></li>
3308                         <li><a href="#skins">高度な方法: 現在使用しているスキンに新しいweblogを展開させるための記述を加える</a></li>
3309                 </ol>
3310
3311                 <h3><a id="index_php">方法 1: <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成</a></h3>
3312
3313                 <p><code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成して、中身に以下のコードを貼り付ける:</p>
3314 <pre><code>&lt;?php
3315
3316 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';
3317
3318 include('<i>./config.php</i>');
3319
3320 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');
3321 selector();
3322
3323 ?&gt;</code></pre>
3324
3325                 <p>すでにある<code>index.php</code>と同じディレクトリにアップロードします。</p>
3326
3327                 <p>新しいweblogの作成を完了するためには、下にこのファイルのURLを入力してください。 (すでに用意した値で合っているとは思いますが保証はしません):</p>
3328
3329                 <form action="index.php" method="post"><div>
3330                         <input type="hidden" name="action" value="addnewlog2" />
3331                         <?php $manager->addTicketHidden() ?>
3332                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3333                         <table><tr>
3334                                 <td><?php echo _EBLOG_URL?></td>
3335                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3336                         </tr><tr>
3337                                 <td><?php echo _EBLOG_CREATE?></td>
3338                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3339                         </tr></table>
3340                 </div></form>
3341
3342                 <h3><a id="skins">方法 2: 現在使用しているスキンに新しいweblogを展開する記述を加える</a></h3>
3343
3344                 <p>新しいweblogの作成を完了するためには、下にURLを入力してください。 (大抵は既存blogと同じURL)</p>
3345
3346                 <form action="index.php" method="post"><div>
3347                         <input type="hidden" name="action" value="addnewlog2" />
3348                         <?php $manager->addTicketHidden() ?>
3349                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3350                         <table><tr>
3351                                 <td><?php echo _EBLOG_URL?></td>
3352                                 <td><input name="url" maxlength="100" size="40" /></td>
3353                         </tr><tr>
3354                                 <td><?php echo _EBLOG_CREATE?></td>
3355                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3356                         </tr></table>
3357                 </div></form>
3358
3359                 <?php           $this->pagefoot();
3360
3361         }
3362
3363         /**
3364          * @todo document this
3365          */
3366         function action_addnewlog2() {
3367                 global $member, $manager;
3368
3369                 $member->blogAdminRights($blogid) or $this->disallow();
3370
3371                 $burl   = requestVar('url');
3372                 $blogid = intRequestVar('blogid');
3373
3374                 $blog =& $manager->getBlog($blogid);
3375                 $blog->setURL(trim($burl));
3376                 $blog->writeSettings();
3377
3378                 $this->action_overview(_MSG_NEWBLOG);
3379         }
3380
3381         /**
3382          * @todo document this
3383          */
3384         function action_skinieoverview() {
3385                 global $member, $DIR_LIBS, $manager;
3386
3387                 $member->isAdmin() or $this->disallow();
3388
3389                 // load skinie class
3390                 include_once($DIR_LIBS . 'skinie.php');
3391
3392                 $this->pagehead();
3393
3394                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3395
3396         ?>
3397                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3398
3399                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3400                                 <?php                                   global $DIR_SKINS;
3401
3402                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3403
3404                                         if (sizeof($candidates) > 0) {
3405                                                 ?>
3406                                                         <form method="post" action="index.php"><div>
3407                                                                 <input type="hidden" name="action" value="skinieimport" />
3408                                                                 <?php $manager->addTicketHidden() ?>
3409                                                                 <input type="hidden" name="mode" value="file" />
3410                                                                 <select name="skinfile" id="skinie_import_local">
3411                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {
3412                                                                                 $html = htmlspecialchars($skinfile);
3413                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';
3414                                                                         }
3415                                                                 ?>
3416                                                                 </select>
3417                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3418                                                         </div></form>
3419                                                 <?php                                   } else {
3420                                                 echo _SKINIE_NOCANDIDATES;
3421                                         }
3422                                 ?>
3423                                 </p>
3424
3425                                 <p><em><?php echo _OR?></em></p>
3426
3427                                 <form method="post" action="index.php"><p>
3428                                         <?php $manager->addTicketHidden() ?>
3429                                         <input type="hidden" name="action" value="skinieimport" />
3430                                         <input type="hidden" name="mode" value="url" />
3431                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3432                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3433                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3434                                 </p></form>
3435
3436
3437                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3438                 <form method="post" action="index.php"><div>
3439                         <input type="hidden" name="action" value="skinieexport" />
3440                         <?php $manager->addTicketHidden() ?>
3441
3442                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3443
3444                         <table><tr>
3445                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3446                         </tr><tr>
3447         <?php           // show list of skins
3448                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3449                 while ($skinObj = mysql_fetch_object($res)) {
3450                         $id = 'skinexp' . $skinObj->sdnumber;
3451                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3452                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';
3453                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';
3454                         echo '</tr><tr>';
3455                 }
3456
3457                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3458
3459                 // show list of templates
3460                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3461                 while ($templateObj = mysql_fetch_object($res)) {
3462                         $id = 'templateexp' . $templateObj->tdnumber;
3463                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3464                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';
3465                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';
3466                         echo '</tr><tr>';
3467                 }
3468
3469         ?>
3470                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3471                         </tr><tr>
3472                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3473                         </tr><tr>
3474                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3475                         </tr><tr>
3476                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3477                         </tr></table>
3478                 </div></form>
3479
3480         <?php
3481                 $this->pagefoot();
3482
3483         }
3484
3485         /**
3486          * @todo document this
3487          */
3488         function action_skinieimport() {
3489                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3490
3491                 $member->isAdmin() or $this->disallow();
3492
3493                 // load skinie class
3494                 include_once($DIR_LIBS . 'skinie.php');
3495
3496                 $skinFileRaw= postVar('skinfile');
3497                 $mode           = postVar('mode');
3498
3499                 $importer =& new SKINIMPORT();
3500
3501                 // get full filename
3502                 if ($mode == 'file')
3503                 {
3504                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3505
3506                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3507                         if (!file_exists($skinFile))
3508                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3509                 } else {
3510                         $skinFile = $skinFileRaw;
3511                 }
3512
3513                 // read only metadata
3514                 $error = $importer->readFile($skinFile, 1);
3515
3516                 // clashes
3517                 $skinNameClashes = $importer->checkSkinNameClashes();
3518                 $templateNameClashes = $importer->checkTemplateNameClashes();
3519                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3520
3521                 if ($error) $this->error($error);
3522
3523                 $this->pagehead();
3524
3525                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3526                 ?>
3527                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3528
3529                 <ul>
3530                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3531                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3532                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3533                         <?php
3534                                 if ($hasNameClashes)
3535                                 {
3536                         ?>
3537                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3538                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3539                         <?php
3540                                 } // if (hasNameClashes)
3541                         ?>
3542                 </ul>
3543
3544                 <form method="post" action="index.php"><div>
3545                         <input type="hidden" name="action" value="skiniedoimport" />
3546                         <?php $manager->addTicketHidden() ?>
3547                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />
3548                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />
3549                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3550                         <?php
3551                                 if ($hasNameClashes)
3552                                 {
3553                         ?>
3554                         <br />
3555                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3556                         <?php
3557                                 } // if (hasNameClashes)
3558                         ?>
3559                 </div></form>
3560
3561
3562                 <?php
3563                 $this->pagefoot();
3564         }
3565
3566         /**
3567          * @todo document this
3568          */
3569         function action_skiniedoimport() {
3570                 global $member, $DIR_LIBS, $DIR_SKINS;
3571
3572                 $member->isAdmin() or $this->disallow();
3573
3574                 // load skinie class
3575                 include_once($DIR_LIBS . 'skinie.php');
3576
3577                 $skinFileRaw= postVar('skinfile');
3578                 $mode           = postVar('mode');
3579
3580                 $allowOverwrite = intPostVar('overwrite');
3581
3582                 // get full filename
3583                 if ($mode == 'file')
3584                 {
3585                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3586
3587                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3588                         if (!file_exists($skinFile))
3589                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3590
3591                 } else {
3592                         $skinFile = $skinFileRaw;
3593                 }
3594
3595                 $importer =& new SKINIMPORT();
3596
3597                 $error = $importer->readFile($skinFile);
3598
3599                 if ($error)
3600                         $this->error($error);
3601
3602                 $error = $importer->writeToDatabase($allowOverwrite);
3603
3604                 if ($error)
3605                         $this->error($error);
3606
3607                 $this->pagehead();
3608
3609                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3610         ?>
3611                 <h2><?php echo _SKINIE_DONE?></h2>
3612
3613                 <ul>
3614                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3615                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3616                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3617                 </ul>
3618
3619         <?php           $this->pagefoot();
3620
3621         }
3622
3623         /**
3624          * @todo document this
3625          */
3626         function action_skinieexport() {
3627                 global $member, $DIR_LIBS;
3628
3629                 $member->isAdmin() or $this->disallow();
3630
3631                 // load skinie class
3632                 include_once($DIR_LIBS . 'skinie.php');
3633
3634                 $aSkins = requestIntArray('skin');
3635                 $aTemplates = requestIntArray('template');
3636
3637                 if (!is_array($aTemplates)) $aTemplates = array();
3638                 if (!is_array($aSkins)) $aSkins = array();
3639
3640                 $skinList = array_keys($aSkins);
3641                 $templateList = array_keys($aTemplates);
3642
3643                 $info = postVar('info');
3644
3645                 $exporter =& new SKINEXPORT();
3646                 foreach ($skinList as $skinId) {
3647                         $exporter->addSkin($skinId);
3648                 }
3649                 foreach ($templateList as $templateId) {
3650                         $exporter->addTemplate($templateId);
3651                 }
3652                 $exporter->setInfo($info);
3653
3654                 $exporter->export();
3655         }
3656
3657         /**
3658          * @todo document this
3659          */
3660         function action_templateoverview() {
3661                 global $member, $manager;
3662
3663                 $member->isAdmin() or $this->disallow();
3664
3665                 $this->pagehead();
3666
3667                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3668
3669                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3670                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3671
3672                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3673                 $template['content'] = 'templatelist';
3674                 $template['tabindex'] = 10;
3675                 showlist($query,'table',$template);
3676
3677                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3678
3679                 ?>
3680                 <form method="post" action="index.php"><div>
3681
3682                 <input name="action" value="templatenew" type="hidden" />
3683                 <?php $manager->addTicketHidden() ?>
3684                 <table><tr>
3685                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3686                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3687                 </tr><tr>
3688                         <td><?php echo _TEMPLATE_DESC?></td>
3689                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3690                 </tr><tr>
3691                         <td><?php echo _TEMPLATE_CREATE?></td>
3692                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3693                 </tr></table>
3694
3695                 </div></form>
3696
3697                 <?php
3698                 $this->pagefoot();
3699         }
3700
3701         /**
3702          * @todo document this
3703          */
3704         function action_templateedit($msg = '') {
3705                 global $member, $manager;
3706
3707                 $templateid = intRequestVar('templateid');
3708
3709                 $member->isAdmin() or $this->disallow();
3710
3711                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3712                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
3713
3714                 $this->pagehead($extrahead);
3715
3716                 $templatename = TEMPLATE::getNameFromId($templateid);
3717                 $templatedescription = TEMPLATE::getDesc($templateid);
3718                 $template =& $manager->getTemplate($templatename);
3719
3720                 ?>
3721                 <p>
3722                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3723                 </p>
3724
3725                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  $templatename; ?>'</h2>
3726
3727                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3728                 ?>
3729
3730                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3731
3732                 <form method="post" action="index.php">
3733                 <div>
3734
3735                 <input type="hidden" name="action" value="templateupdate" />
3736                 <?php $manager->addTicketHidden() ?>
3737                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3738
3739                 <table><tr>
3740                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3741                 </tr><tr>
3742                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3743                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>
3744                 </tr><tr>
3745                         <td><?php echo _TEMPLATE_DESC?></td>
3746                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>
3747                 </tr><tr>
3748                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3749                 </tr><tr>
3750                         <td><?php echo _TEMPLATE_UPDATE?></td>
3751                         <td>
3752                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3753                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3754                         </td>
3755                 </tr><tr>
3756                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3757 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3758         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3759         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3760         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3761         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3762         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3763 ?>
3764                 </tr><tr>
3765                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3766 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3767         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3768         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3769         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3770         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3771         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3772         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3773 ?>
3774                 </tr><tr>
3775                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3776 <?php
3777         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3778 ?>
3779                 </tr><tr>
3780                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3781 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3782 ?>
3783                 </tr><tr>
3784                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3785 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3786         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3787         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3788 ?>
3789                 </tr><tr>
3790                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3791 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 160);
3792         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 170);
3793         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 180);
3794 ?>
3795                 </tr><tr>
3796                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3797 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 190);
3798         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 200);
3799         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 210);
3800         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 220);
3801         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 230);
3802 ?>
3803                 </tr><tr>
3804                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3805 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 240);
3806         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 250);
3807         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 260);
3808 ?>
3809                 </tr><tr>
3810                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3811 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',270);
3812         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',280);
3813 ?>
3814                 </tr><tr>
3815                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3816                 </tr><tr>
3817                         <td><?php echo _TEMPLATE_UPDATE?></td>
3818                         <td>
3819                                 <input type="submit" tabindex="290" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3820                                 <input type="reset" tabindex="300" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3821                         </td>
3822                 </tr></table>
3823
3824                 </div>
3825                 </form>
3826                 <?php
3827                 $this->pagefoot();
3828         }
3829
3830         /**
3831          * @todo document this
3832          */
3833         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3834                 static $count = 1;
3835         ?>
3836                 </tr><tr>
3837                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3838                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>
3839         <?php           $count++;
3840         }
3841
3842         /**
3843          * @todo document this
3844          */
3845         function action_templateupdate() {
3846                 global $member;
3847
3848                 $templateid = intRequestVar('templateid');
3849
3850                 $member->isAdmin() or $this->disallow();
3851
3852                 $name = postVar('tname');
3853                 $desc = postVar('tdesc');
3854
3855                 if (!isValidTemplateName($name))
3856                         $this->error(_ERROR_BADTEMPLATENAME);
3857
3858                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3859                         $this->error(_ERROR_DUPTEMPLATENAME);
3860
3861
3862                 $name = addslashes($name);
3863                 $desc = addslashes($desc);
3864
3865                 // 1. Remove all template parts
3866                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3867                 sql_query($query);
3868
3869                 // 2. Update description
3870                 $query =  'UPDATE '.sql_table('template_desc').' SET'
3871                            . " tdname='" . $name . "',"
3872                            . " tddesc='" . $desc . "'"
3873                            . " WHERE tdnumber=" . $templateid;
3874                 sql_query($query);
3875
3876                 // 3. Add non-empty template parts
3877                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3878                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3879                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3880                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3881                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3882                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3883                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3884                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3885                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3886                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3887                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
3888                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
3889                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
3890                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
3891                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
3892                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
3893                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3894                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
3895                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
3896                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
3897                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
3898                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
3899                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
3900                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
3901                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
3902                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
3903                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
3904                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3905                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
3906                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
3907                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
3908
3909
3910                 // jump back to template edit
3911                 $this->action_templateedit(_TEMPLATE_UPDATED);
3912
3913         }
3914
3915         /**
3916          * @todo document this
3917          */
3918         function addToTemplate($id, $partname, $content) {
3919                 $partname = addslashes($partname);
3920                 $content = addslashes($content);
3921
3922                 $id = intval($id);
3923
3924                 // don't add empty parts:
3925                 if (!trim($content)) return -1;
3926
3927                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
3928                            . "VALUES ($id, '$partname', '$content')";
3929                 sql_query($query) or die("Query error: " . mysql_error());
3930                 return mysql_insert_id();
3931         }
3932
3933         /**
3934          * @todo document this
3935          */
3936         function action_templatedelete() {
3937                 global $member, $manager;
3938
3939                 $member->isAdmin() or $this->disallow();
3940
3941                 $templateid = intRequestVar('templateid');
3942                 // TODO: check if template can be deleted
3943
3944                 $this->pagehead();
3945
3946                 $name = TEMPLATE::getNameFromId($templateid);
3947                 $desc = TEMPLATE::getDesc($templateid);
3948
3949                 ?>
3950                         <h2><?php echo _DELETE_CONFIRM?></h2>
3951
3952                         <p>
3953                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo $name?></b> (<?php echo  htmlspecialchars($desc) ?>)
3954                         </p>
3955
3956                         <form method="post" action="index.php"><div>
3957                                 <input type="hidden" name="action" value="templatedeleteconfirm" />
3958                                 <?php $manager->addTicketHidden() ?>
3959                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
3960                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3961                         </div></form>
3962                 <?php
3963                 $this->pagefoot();
3964         }
3965
3966         /**
3967          * @todo document this
3968          */
3969         function action_templatedeleteconfirm() {
3970                 global $member, $manager;
3971
3972                 $templateid = intRequestVar('templateid');
3973
3974                 $member->isAdmin() or $this->disallow();
3975
3976                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
3977
3978                 // 1. delete description
3979                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
3980
3981                 // 2. delete parts
3982                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
3983
3984                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
3985
3986                 $this->action_templateoverview();
3987         }
3988
3989         /**
3990          * @todo document this
3991          */
3992         function action_templatenew() {
3993                 global $member;
3994
3995                 $member->isAdmin() or $this->disallow();
3996
3997                 $name = postVar('name');
3998                 $desc = postVar('desc');
3999
4000                 if (!isValidTemplateName($name))
4001                         $this->error(_ERROR_BADTEMPLATENAME);
4002
4003                 if (TEMPLATE::exists($name))
4004                         $this->error(_ERROR_DUPTEMPLATENAME);
4005
4006                 $newTemplateId = TEMPLATE::createNew($name, $desc);
4007
4008                 $this->action_templateoverview();
4009         }
4010
4011         /**
4012          * @todo document this
4013          */
4014         function action_templateclone() {
4015                 global $member;
4016
4017                 $templateid = intRequestVar('templateid');
4018
4019                 $member->isAdmin() or $this->disallow();
4020
4021                 // 1. read old template
4022                 $name = TEMPLATE::getNameFromId($templateid);
4023                 $desc = TEMPLATE::getDesc($templateid);
4024
4025                 // 2. create desc thing
4026                 $name = "cloned" . $name;
4027
4028                 // if a template with that name already exists:
4029                 if (TEMPLATE::exists($name)) {
4030                         $i = 1;
4031                         while (TEMPLATE::exists($name . $i))
4032                                 $i++;
4033                         $name .= $i;
4034                 }
4035
4036                 $newid = TEMPLATE::createNew($name, $desc);
4037
4038                 // 3. create clone
4039                 // go through parts of old template and add them to the new one
4040                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4041                 while ($o = mysql_fetch_object($res)) {
4042                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4043                 }
4044
4045                 $this->action_templateoverview();
4046         }
4047
4048         /**
4049          * @todo document this
4050          */
4051         function action_skinoverview() {
4052                 global $member, $manager;
4053
4054                 $member->isAdmin() or $this->disallow();
4055
4056                 $this->pagehead();
4057
4058                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4059
4060                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4061
4062                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4063
4064                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4065                 $template['content'] = 'skinlist';
4066                 $template['tabindex'] = 10;
4067                 showlist($query,'table',$template);
4068
4069                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4070
4071                 ?>
4072                 <form method="post" action="index.php">
4073                 <div>
4074
4075                 <input name="action" value="skinnew" type="hidden" />
4076                 <?php $manager->addTicketHidden() ?>
4077                 <table><tr>
4078                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4079                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4080                 </tr><tr>
4081                         <td><?php echo _SKIN_DESC?></td>
4082                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4083                 </tr><tr>
4084                         <td><?php echo _SKIN_CREATE?></td>
4085                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4086                 </tr></table>
4087
4088                 </div>
4089                 </form>
4090
4091                 <?php
4092                 $this->pagefoot();
4093         }
4094
4095         /**
4096          * @todo document this
4097          */
4098         function action_skinnew() {
4099                 global $member;
4100
4101                 $member->isAdmin() or $this->disallow();
4102
4103                 $name = trim(postVar('name'));
4104                 $desc = trim(postVar('desc'));
4105
4106                 if (!isValidSkinName($name))
4107                         $this->error(_ERROR_BADSKINNAME);
4108
4109                 if (SKIN::exists($name))
4110                         $this->error(_ERROR_DUPSKINNAME);
4111
4112                 $newId = SKIN::createNew($name, $desc);
4113
4114                 $this->action_skinoverview();
4115         }
4116
4117         /**
4118          * @todo document this
4119          */
4120         function action_skinedit() {
4121                 global $member, $manager;
4122
4123                 $skinid = intRequestVar('skinid');
4124
4125                 $member->isAdmin() or $this->disallow();
4126
4127                 $skin =& new SKIN($skinid);
4128
4129                 $this->pagehead();
4130                 ?>
4131                 <p>
4132                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4133                 </p>
4134                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4135
4136                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4137                 <?php echo _SKIN_PARTS_MSG?>
4138                 <ul>
4139                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4140                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4141                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4142                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4143                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4144                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4145                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4146                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4147                 </ul>
4148
4149                 <?php
4150
4151                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4152                 $res = sql_query($query);
4153
4154                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4155                 echo '<form method="get" action="index.php">' . "\r\n";
4156                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4157                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4158                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4159                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4160                 echo '</form>' . "\r\n";
4161
4162                 if ($res && mysql_num_rows($res) > 0) {
4163                         echo '<ul>';
4164                         $tabstart = 75;
4165
4166                         while ($row = mysql_fetch_assoc($res)) {
4167                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">' . ucfirst($row['stype']) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">remove</a>)</li>';
4168                         }
4169
4170                         echo '</ul>';
4171                 }
4172
4173                 ?>
4174
4175                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4176                 <form method="post" action="index.php">
4177                 <div>
4178
4179                 <input type="hidden" name="action" value="skineditgeneral" />
4180                 <?php $manager->addTicketHidden() ?>
4181                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4182                 <table><tr>
4183                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4184                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>
4185                 </tr><tr>
4186                         <td><?php echo _SKIN_DESC?></td>
4187                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4188                 </tr><tr>
4189                         <td><?php echo _SKIN_TYPE?></td>
4190                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4191                 </tr><tr>
4192                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4193                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4194                 </tr><tr>
4195                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4196                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4197                 </tr><tr>
4198                         <td><?php echo _SKIN_CHANGE?></td>
4199                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4200                 </tr></table>
4201
4202                 </div>
4203                 </form>
4204
4205
4206                 <?php           $this->pagefoot();
4207         }
4208
4209         /**
4210          * @todo document this
4211          */
4212         function action_skineditgeneral() {
4213                 global $member;
4214
4215                 $skinid = intRequestVar('skinid');
4216
4217                 $member->isAdmin() or $this->disallow();
4218
4219                 $name = postVar('name');
4220                 $desc = postVar('desc');
4221                 $type = postVar('type');
4222                 $inc_mode = postVar('inc_mode');
4223                 $inc_prefix = postVar('inc_prefix');
4224
4225                 $skin =& new SKIN($skinid);
4226
4227                 // 1. Some checks
4228                 if (!isValidSkinName($name))
4229                         $this->error(_ERROR_BADSKINNAME);
4230
4231                 if (($skin->getName() != $name) && SKIN::exists($name))
4232                         $this->error(_ERROR_DUPSKINNAME);
4233
4234                 if (!$type) $type = 'text/html';
4235                 if (!$inc_mode) $inc_mode = 'normal';
4236
4237                 // 2. Update description
4238                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4239
4240                 $this->action_skinedit();
4241
4242         }
4243
4244         /**
4245          * @todo document this
4246          */
4247         function action_skinedittype($msg = '') {
4248                 global $member, $manager;
4249
4250                 $skinid = intRequestVar('skinid');
4251                 $type = requestVar('type');
4252
4253                 $member->isAdmin() or $this->disallow();
4254
4255                 $type = trim($type);
4256                 $type = strtolower($type);
4257
4258                 if (!isValidShortName($type)) {
4259                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4260                 }
4261
4262                 $skin =& new SKIN($skinid);
4263
4264                 $friendlyNames = SKIN::getFriendlyNames();
4265
4266                 $this->pagehead();
4267                 ?>
4268                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4269
4270                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo  $skin->getName() ?>': <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4271
4272                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4273                 ?>
4274
4275
4276                 <form method="post" action="index.php">
4277                 <div>
4278
4279                 <input type="hidden" name="action" value="skinupdate" />
4280                 <?php $manager->addTicketHidden() ?>
4281                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4282                 <input type="hidden" name="type" value="<?php echo  $type ?>" />
4283
4284                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4285                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4286                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4287                 <?php help('skinpart' . $type);?>
4288                 <br />
4289
4290                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>
4291
4292                 <br />
4293                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4294                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4295                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4296
4297                 <br /><br />
4298                 <?php echo _SKIN_ALLOWEDVARS?>
4299                 <?php                   $actions = SKIN::getAllowedActionsForType($type);
4300
4301                         sort($actions);
4302
4303                         while ($current = array_shift($actions)) {
4304                                 // skip deprecated vars
4305                                 if ($current == 'ifcat') continue;
4306                                 if ($current == 'imagetext') continue;
4307                                 if ($current == 'vars') continue;
4308
4309                                 echo helplink('skinvar-' . $current) . "$current</a>";
4310                                 if (count($actions) != 0) echo ", ";
4311                         }
4312                 ?>
4313                 <br /><br />
4314                 Short blog names:
4315                 <?php                   $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4316                         showlist($query,'table',array('content'=>'shortblognames'));
4317                 ?>
4318
4319                 <br />
4320                 Template names:
4321                 <?php                   $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4322                         showlist($query,'table',array('content'=>'shortnames'));
4323                 ?>
4324
4325
4326                 </div>
4327                 </form>
4328
4329
4330                 <?php           $this->pagefoot();
4331         }
4332
4333         /**
4334          * @todo document this
4335          */
4336         function action_skinupdate() {
4337                 global $member;
4338
4339                 $skinid = intRequestVar('skinid');
4340                 $content = trim(postVar('content'));
4341                 $type = postVar('type');
4342
4343                 $member->isAdmin() or $this->disallow();
4344
4345                 $skin =& new SKIN($skinid);
4346                 $skin->update($type, $content);
4347
4348                 $this->action_skinedittype(_SKIN_UPDATED);
4349         }
4350
4351         /**
4352          * @todo document this
4353          */
4354         function action_skindelete() {
4355                 global $member, $manager, $CONF;
4356
4357                 $skinid = intRequestVar('skinid');
4358
4359                 $member->isAdmin() or $this->disallow();
4360
4361                 // don't allow default skin to be deleted
4362                 if ($skinid == $CONF['BaseSkin'])
4363                         $this->error(_ERROR_DEFAULTSKIN);
4364
4365                 // don't allow deletion of default skins for blogs
4366                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4367                 $r = sql_query($query);
4368                 if ($o = mysql_fetch_object($r))
4369                         $this->error(_ERROR_SKINDEFDELETE . $o->bname);
4370
4371                 $this->pagehead();
4372
4373                 $skin =& new SKIN($skinid);
4374                 $name = $skin->getName();
4375                 $desc = $skin->getDescription();
4376
4377                 ?>
4378                         <h2><?php echo _DELETE_CONFIRM?></h2>
4379
4380                         <p>
4381                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo  $name ?></b> (<?php echo  htmlspecialchars($desc)?>)
4382                         </p>
4383
4384                         <form method="post" action="index.php"><div>
4385                                 <input type="hidden" name="action" value="skindeleteconfirm" />
4386                                 <?php $manager->addTicketHidden() ?>
4387                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4388                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4389                         </div></form>
4390                 <?php
4391                 $this->pagefoot();
4392         }
4393
4394         /**
4395          * @todo document this
4396          */
4397         function action_skindeleteconfirm() {
4398                 global $member, $CONF, $manager;
4399
4400                 $skinid = intRequestVar('skinid');
4401
4402                 $member->isAdmin() or $this->disallow();
4403
4404                 // don't allow default skin to be deleted
4405                 if ($skinid == $CONF['BaseSkin'])
4406                         $this->error(_ERROR_DEFAULTSKIN);
4407
4408                 // don't allow deletion of default skins for blogs
4409                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4410                 $r = sql_query($query);
4411                 if ($o = mysql_fetch_object($r))
4412                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4413
4414                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4415
4416                 // 1. delete description
4417                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4418
4419                 // 2. delete parts
4420                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4421
4422                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4423
4424                 $this->action_skinoverview();
4425         }
4426
4427         /**
4428          * @todo document this
4429          */
4430         function action_skinremovetype() {
4431                 global $member, $manager, $CONF;
4432
4433                 $skinid = intRequestVar('skinid');
4434                 $skintype = requestVar('type');
4435
4436                 if (!isValidShortName($skintype)) {
4437                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4438                 }
4439
4440                 $member->isAdmin() or $this->disallow();
4441
4442                 // don't allow default skinparts to be deleted
4443                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4444                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4445                 }
4446
4447                 $this->pagehead();
4448
4449                 $skin =& new SKIN($skinid);
4450                 $name = $skin->getName();
4451                 $desc = $skin->getDescription();
4452
4453                 ?>
4454                         <h2><?php echo _DELETE_CONFIRM?></h2>
4455
4456                         <p>
4457                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo $skintype; ?> (<?php echo $name; ?>)</b> (<?php echo  htmlspecialchars($desc)?>)
4458                         </p>
4459
4460                         <form method="post" action="index.php"><div>
4461                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4462                                 <?php $manager->addTicketHidden() ?>
4463                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4464                                 <input type="hidden" name="type" value="<?php echo $skintype; ?>" />
4465                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4466                         </div></form>
4467                 <?php
4468                 $this->pagefoot();
4469         }
4470
4471         /**
4472          * @todo document this
4473          */
4474         function action_skinremovetypeconfirm() {
4475                 global $member, $CONF, $manager;
4476
4477                 $skinid = intRequestVar('skinid');
4478                 $skintype = requestVar('type');
4479
4480                 if (!isValidShortName($skintype)) {
4481                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4482                 }
4483
4484                 $member->isAdmin() or $this->disallow();
4485
4486                 // don't allow default skinparts to be deleted
4487                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4488                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4489                 }
4490
4491                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4492
4493                 // delete part
4494                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4495
4496                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4497
4498                 $this->action_skinedit();
4499         }
4500
4501         /**
4502          * @todo document this
4503          */
4504         function action_skinclone() {
4505                 global $member;
4506
4507                 $skinid = intRequestVar('skinid');
4508
4509                 $member->isAdmin() or $this->disallow();
4510
4511                 // 1. read skin to clone
4512                 $skin =& new SKIN($skinid);
4513
4514                 $name = "clone_" . $skin->getName();
4515
4516                 // if a skin with that name already exists:
4517                 if (SKIN::exists($name)) {
4518                         $i = 1;
4519                         while (SKIN::exists($name . $i))
4520                                 $i++;
4521                         $name .= $i;
4522                 }
4523
4524                 // 2. create skin desc
4525                 $newid = SKIN::createNew(
4526                         $name,
4527                         $skin->getDescription(),
4528                         $skin->getContentType(),
4529                         $skin->getIncludeMode(),
4530                         $skin->getIncludePrefix()
4531                 );
4532
4533
4534                 // 3. clone
4535                 /*
4536                 $this->skinclonetype($skin, $newid, 'index');
4537                 $this->skinclonetype($skin, $newid, 'item');
4538                 $this->skinclonetype($skin, $newid, 'archivelist');
4539                 $this->skinclonetype($skin, $newid, 'archive');
4540                 $this->skinclonetype($skin, $newid, 'search');
4541                 $this->skinclonetype($skin, $newid, 'error');
4542                 $this->skinclonetype($skin, $newid, 'member');
4543                 $this->skinclonetype($skin, $newid, 'imagepopup');
4544                 */
4545
4546                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4547                 $res = sql_query($query);
4548                 while ($row = mysql_fetch_assoc($res)) {
4549                         $this->skinclonetype($skin, $newid, $row['stype']);
4550                 }
4551
4552                 $this->action_skinoverview();
4553
4554         }
4555
4556         /**
4557          * @todo document this
4558          */
4559         function skinclonetype($skin, $newid, $type) {
4560                 $newid = intval($newid);
4561                 $content = $skin->getContent($type);
4562                 if ($content) {
4563                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
4564                         sql_query($query);
4565                 }
4566         }
4567
4568         /**
4569          * @todo document this
4570          */
4571         function action_settingsedit() {
4572                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4573
4574                 $member->isAdmin() or $this->disallow();
4575
4576                 $this->pagehead();
4577
4578                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4579                 ?>
4580
4581                 <h2><?php echo _SETTINGS_TITLE?></h2>
4582
4583                 <form action="index.php" method="post">
4584                 <div>
4585
4586                 <input type="hidden" name="action" value="settingsupdate" />
4587                 <?php $manager->addTicketHidden() ?>
4588
4589                 <table><tr>
4590                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4591                 </tr><tr>
4592                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4593                         <td>
4594                                 <?php
4595                                         $query =  'SELECT bname as text, bnumber as value'
4596                                                    . ' FROM '.sql_table('blog');
4597                                         $template['name'] = 'DefaultBlog';
4598                                         $template['selected'] = $CONF['DefaultBlog'];
4599                                         $template['tabindex'] = 10;
4600                                         showlist($query,'select',$template);
4601                                 ?>
4602                         </td>
4603                 </tr><tr>
4604                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4605                         <td>
4606                                 <?php
4607                                         $query =  'SELECT sdname as text, sdnumber as value'
4608                                                    . ' FROM '.sql_table('skin_desc');
4609                                         $template['name'] = 'BaseSkin';
4610                                         $template['selected'] = $CONF['BaseSkin'];
4611                                         $template['tabindex'] = 1;
4612                                         showlist($query,'select',$template);
4613                                 ?>
4614                         </td>
4615                 </tr><tr>
4616                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4617                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>
4618                 </tr><tr>
4619                         <td><?php echo _SETTINGS_SITENAME?></td>
4620                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>
4621                 </tr><tr>
4622                         <td><?php echo _SETTINGS_SITEURL?></td>
4623                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>
4624                 </tr><tr>
4625                         <td><?php echo _SETTINGS_ADMINURL?></td>
4626                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>
4627                 </tr><tr>
4628                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4629                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>
4630                 </tr><tr>
4631                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4632                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>
4633                 </tr><tr>
4634                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4635                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>
4636                 </tr><tr>
4637                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4638                         </td>
4639                         <td>
4640
4641                                 <select name="Language" tabindex="10050">
4642                                 <?php                           // show a dropdown list of all available languages
4643                                 global $DIR_LANG;
4644                                 $dirhandle = opendir($DIR_LANG);
4645                                 while ($filename = readdir($dirhandle)) {
4646                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
4647                                                 $name = $matches[1];
4648                                                 echo "<option value='$name'";
4649                                                 if ($name == $CONF['Language'])
4650                                                         echo " selected='selected'";
4651                                                 echo ">$name</option>";
4652                                         }
4653                                 }
4654                                 closedir($dirhandle);
4655
4656                                 ?>
4657                                 </select>
4658
4659                         </td>
4660                 </tr><tr>
4661                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4662                         </td>
4663                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4664                                         <br />
4665                                 URL: <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />
4666                         </td>
4667                 </tr><tr>
4668                         <td><?php echo _SETTINGS_DIRS?></td>
4669                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>
4670                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4671                 </tr><tr>
4672                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4673                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4674                 </tr><tr>
4675                         <td>
4676                         <?php
4677                                 echo _SETTINGS_JSTOOLBAR
4678                                 /* =_SETTINGS_DISABLEJS
4679
4680                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4681                                         way to select the javascript version to use
4682
4683                                         now, its:
4684                                                 0 : IE
4685                                                 1 : all javascript disabled
4686                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4687                                 */
4688                            ?>
4689                         </td>
4690                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4691                                 <select name="DisableJsTools" tabindex="10075">
4692                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4693                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4694                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4695                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4696                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4697                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4698                         ?>
4699                                 </select>
4700                         </td>
4701                 </tr><tr>
4702                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4703                                            <td><?php
4704
4705                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4706                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4707
4708                                            echo ' ', _SETTINGS_URLMODE_HELP;
4709
4710                                                          ?>
4711
4712                                            </td>
4713                 </tr><tr>
4714                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4715                 </tr><tr>
4716                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4717                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>
4718                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4719                                 <?php                           if (!is_dir($DIR_MEDIA))
4720                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4721                                         if (!is_readable($DIR_MEDIA))
4722                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4723                                         if (!is_writeable($DIR_MEDIA))
4724                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4725                                 ?>
4726                         </td>
4727                 </tr><tr>
4728                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4729                         <td>
4730                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />
4731                         </td>
4732                 </tr><tr>
4733                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4734                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4735                 </tr><tr>
4736                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4737                         <td>
4738                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />
4739                         </td>
4740                 </tr><tr>
4741                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4742                         <td>
4743                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />
4744                         </td>
4745                 </tr><tr>
4746                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4747                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4748
4749                 </tr><tr>
4750                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4751                 </tr><tr>
4752                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4753                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4754                 </tr><tr>
4755                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4756                                 <?php help('allowaccountcreation'); ?>
4757                         </td>
4758                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4759                         </td>
4760                 </tr><tr>
4761                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4762                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4763                         </td>
4764                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4765                         </td>
4766                 </tr><tr>
4767                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4768                                 <?php help('messageservice'); ?>
4769                         </td>
4770                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4771                         </td>
4772                 </tr><tr>
4773                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4774                                 <?php help('messageservice'); ?>
4775                         </td>
4776                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4777                         </td>
4778                 </tr><tr>
4779                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4780                                 <?php help('protectmemnames'); ?>
4781                         </td>
4782                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4783                         </td>
4784
4785
4786
4787                 </tr><tr>
4788                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4789                 </tr><tr>
4790                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4791                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>
4792                 </tr><tr>
4793                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4794                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>
4795                 </tr><tr>
4796                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
4797                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>
4798                 </tr><tr>
4799                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
4800                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4801                 </tr><tr>
4802                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
4803                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4804                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4805                         </td>
4806                 </tr><tr>
4807                         <td><?php echo _SETTINGS_LASTVISIT?></td>
4808                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4809
4810
4811
4812                 </tr><tr>
4813                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
4814                 </tr><tr>
4815                         <td><?php echo _SETTINGS_UPDATE?></td>
4816                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
4817                 </tr></table>
4818
4819                 </div>
4820                 </form>
4821
4822                 <?php
4823                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
4824
4825                         $manager->notify(
4826                                 'GeneralSettingsFormExtras',
4827                                 array()
4828                         );
4829
4830                 $this->pagefoot();
4831         }
4832
4833         /**
4834          * @todo document this
4835          */
4836         function action_settingsupdate() {
4837                 global $member, $CONF;
4838
4839                 $member->isAdmin() or $this->disallow();
4840
4841                 // check if email address for admin is valid
4842                 if (!isValidMailAddress(postVar('AdminEmail')))
4843                         $this->error(_ERROR_BADMAILADDRESS);
4844
4845
4846                 // save settings
4847                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));
4848                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));
4849                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));
4850                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));
4851                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
4852                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));
4853                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
4854                 $this->updateConfig('Language',                 postVar('Language'));
4855                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));
4856                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
4857                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
4858                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
4859                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
4860                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
4861                 $this->updateConfig('SiteName',                 postVar('SiteName'));
4862                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
4863                 $this->updateConfig('DisableSite',              postVar('DisableSite'));
4864                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
4865                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
4866                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));
4867                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));
4868                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));
4869                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
4870                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));
4871                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
4872                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
4873                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));
4874                 $this->updateConfig('CookiePath',               postVar('CookiePath'));
4875                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));
4876                 $this->updateConfig('URLMode',                  postVar('URLMode'));
4877                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));
4878
4879                 // load new config and redirect (this way, the new language will be used is necessary)
4880                 // note that when changing cookie settings, this redirect might cause the user
4881                 // to have to log in again.
4882                 getConfig();
4883                 redirect($CONF['AdminURL'] . '?action=manage');
4884                 exit;
4885
4886         }
4887
4888         /**
4889          * @todo document this
4890          */
4891         function updateConfig($name, $val) {
4892                 $name = addslashes($name);
4893                 $val = trim(addslashes($val));
4894
4895                 $query = 'UPDATE '.sql_table('config')
4896                            . " SET value='$val'"
4897                            . " WHERE name='$name'";
4898
4899                 sql_query($query) or die("Query error: " . mysql_error());
4900                 return mysql_insert_id();
4901         }
4902
4903         /**
4904          * Error message
4905          * @param string $msg message that will be shown
4906          */
4907         function error($msg) {
4908                 $this->pagehead();
4909                 ?>
4910                 <h2>Error!</h2>
4911                 <?php           echo $msg;
4912                 echo "<br />";
4913                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
4914                 $this->pagefoot();
4915                 exit;
4916         }
4917
4918         /**
4919          * @todo document this
4920          */
4921         function disallow() {
4922                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4923
4924                 $this->error(_ERROR_DISALLOWED);
4925         }
4926
4927         /**
4928          * @todo document this
4929          */
4930         function pagehead($extrahead = '') {
4931                 global $member, $nucleus, $CONF, $manager;
4932
4933                 $manager->notify(
4934                         'AdminPrePageHead',
4935                         array(
4936                                 'extrahead' => &$extrahead,
4937                                 'action' => $this->action
4938                         )
4939                 );
4940
4941                 $baseUrl = htmlspecialchars($CONF['AdminURL']);
4942
4943                 ?>
4944                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4945                 <html xmlns="http://www.w3.org/1999/xhtml">
4946                 <head>
4947                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />
4948                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>
4949                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />
4950                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
4951                         href="<?php echo $baseUrl?>styles/addedit.css" />
4952
4953                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
4954                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
4955                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
4956
4957           <meta http-equiv='Pragma' content='no-cache' />
4958           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
4959           <meta http-equiv='Expires' content='-1' />
4960
4961                         <?php echo $extrahead?>
4962                 </head>
4963                 <body>
4964                 <div class="header">
4965                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>
4966                 </div>
4967                 <div id="container">
4968                 <div id="content">
4969                 <div class="loginname">
4970                 <?php                   if ($member->isLoggedIn())
4971                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
4972                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
4973                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
4974                         else
4975                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
4976
4977                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
4978
4979                         echo '<br />(';
4980
4981                         // Note(JP): disabled code name description
4982 /*
4983                         if ($member->isLoggedIn() && $member->isAdmin())
4984                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;</a>';
4985                         else
4986                                 echo 'Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;';
4987 */
4988                         if ($member->isLoggedIn() && $member->isAdmin())
4989                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' </a>';
4990                         else
4991                                 echo 'Nucleus CMS ', $nucleus['version'];
4992                         echo ')';
4993                 echo '</div>';
4994         }
4995
4996         /**
4997          * @todo document this
4998          */
4999         function pagefoot() {
5000                 global $action, $member, $manager;
5001
5002                 $manager->notify(
5003                         'AdminPrePageFoot',
5004                         array(
5005                                 'action' => $this->action
5006                         )
5007                 );
5008
5009                 if ($member->isLoggedIn() && ($action != 'showlogin')) {
5010                         ?>
5011                         <h2><?php echo  _LOGOUT ?></h2>
5012                         <ul>
5013                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5014                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5015                         </ul>
5016                         <?php           }
5017                 ?>
5018                         <div class="foot">
5019                                 <a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-<?php echo date('Y'); ?> The Nucleus Group
5020                                 -
5021                                 <a href="http://nucleuscms.org/donate.php">Donate!</a>
5022                         </div>
5023
5024                         </div><!-- content -->
5025
5026                         <div id="quickmenu">
5027
5028                                 <?php                           // ---- user settings ----
5029                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5030                                         echo '<ul>';
5031                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5032                                         echo '</ul>';
5033
5034                                         echo '<h2>',_QMENU_ADD,'</h2>';
5035                                         echo '<form method="get" action="index.php"><div>';
5036                                         echo '<input type="hidden" name="action" value="createitem" />';
5037
5038                                                 $showAll = requestVar('showall');
5039                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {
5040                                                         // Super-Admins have access to all blogs! (no add item support though)
5041                                                         $query =  'SELECT bnumber as value, bname as text'
5042                                                                    . ' FROM ' . sql_table('blog')
5043                                                                    . ' ORDER BY bname';
5044                                                 } else {
5045                                                         $query =  'SELECT bnumber as value, bname as text'
5046                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5047                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5048                                                                    . ' ORDER BY bname';
5049                                                 }
5050                                                 $template['name'] = 'blogid';
5051                                                 $template['tabindex'] = 15000;
5052                                                 $template['extra'] = _QMENU_ADD_SELECT;
5053                                                 $template['selected'] = -1;
5054                                                 $template['shorten'] = 10;
5055                                                 $template['shortenel'] = '';
5056                                                 $template['javascript'] = 'onchange="return form.submit()"';
5057                                                 showlist($query,'select',$template);
5058
5059                                         echo '</div></form>';
5060
5061                                         echo '<h2>' . $member->getDisplayName(). '</h2>';
5062                                         echo '<ul>';
5063                                         echo '<li><a href="index.php?action=editmembersettings">',_QMENU_USER_SETTINGS,'</a></li>';
5064                                         echo '<li><a href="index.php?action=browseownitems">',_QMENU_USER_ITEMS,'</a></li>';
5065                                         echo '<li><a href="index.php?action=browseowncomments">',_QMENU_USER_COMMENTS,'</a></li>';
5066                                         echo '</ul>';
5067
5068
5069
5070
5071                                         // ---- general settings ----
5072                                         if ($member->isAdmin()) {
5073
5074                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';
5075
5076                                                 echo '<ul>';
5077                                                 echo '<li><a href="index.php?action=actionlog">',_QMENU_MANAGE_LOG,'</a></li>';
5078                                                 echo '<li><a href="index.php?action=settingsedit">',_QMENU_MANAGE_SETTINGS,'</a></li>';
5079                                                 echo '<li><a href="index.php?action=usermanagement">',_QMENU_MANAGE_MEMBERS,'</a></li>';
5080                                                 echo '<li><a href="index.php?action=createnewlog">',_QMENU_MANAGE_NEWBLOG,'</a></li>';
5081                                                 echo '<li><a href="index.php?action=backupoverview">',_QMENU_MANAGE_BACKUPS,'</a></li>';
5082                                                 echo '<li><a href="index.php?action=pluginlist">',_QMENU_MANAGE_PLUGINS,'</a></li>';
5083                                                 echo '</ul>';
5084
5085                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';
5086                                                 echo '<ul>';
5087                                                 echo '<li><a href="index.php?action=skinoverview">',_QMENU_LAYOUT_SKINS,'</a></li>';
5088                                                 echo '<li><a href="index.php?action=templateoverview">',_QMENU_LAYOUT_TEMPL,'</a></li>';
5089                                                 echo '<li><a href="index.php?action=skinieoverview">',_QMENU_LAYOUT_IEXPORT,'</a></li>';
5090                                                 echo '</ul>';
5091
5092                                         }
5093
5094                                         $aPluginExtras = array();
5095                                         $manager->notify(
5096                                                 'QuickMenu',
5097                                                 array(
5098                                                         'options' => &$aPluginExtras
5099                                                 )
5100                                         );
5101                                         if (count($aPluginExtras) > 0)
5102                                         {
5103                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';
5104                                                 echo '<ul>';
5105                                                 foreach ($aPluginExtras as $aInfo)
5106                                                 {
5107                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';
5108                                                 }
5109                                                 echo '</ul>';
5110                                         }
5111
5112                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5113
5114                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5115                                 } else {
5116                                         // introduction text on login screen
5117                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5118                                 }
5119                                 ?>
5120                         </div>
5121
5122                         <!-- content / quickmenu container -->
5123                         </div>
5124
5125
5126                         </body>
5127                         </html>
5128                 <?php   }
5129
5130         /**
5131          * @todo document this
5132          */
5133         function action_regfile() {
5134                 global $member, $CONF;
5135
5136                 $blogid = intRequestVar('blogid');
5137
5138                 $member->teamRights($blogid) or $this->disallow();
5139
5140                 // header-code stolen from phpMyAdmin
5141                 // REGEDIT and bookmarklet code stolen from GreyMatter
5142
5143                 $sjisBlogName = getBlogNameFromID($blogid);
5144                 $sjisBlogName = mb_convert_encoding($sjisBlogName, "SJIS", "auto");
5145
5146                 header('Content-Type: application/octetstream');
5147                 header('Content-Disposition: filename="nucleus.reg"');
5148                 header('Pragma: no-cache');
5149                 header('Expires: 0');
5150
5151                 echo "REGEDIT4\n";
5152                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\Post To &Nucleus (".$sjisBlogName.")]\n";
5153                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5154                 echo '"contexts"=hex:31';
5155         }
5156
5157         /**
5158          * @todo document this
5159          */
5160         function action_bookmarklet() {
5161                 global $member, $manager;
5162
5163                 $blogid = intRequestVar('blogid');
5164
5165                 $member->teamRights($blogid) or $this->disallow();
5166
5167                 $blog =& $manager->getBlog($blogid);
5168                 $bm = getBookmarklet($blogid);
5169
5170                 $this->pagehead();
5171
5172                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5173
5174                 ?>
5175
5176                 <h2>Bookmarklet<!-- and Right Click Menu --></h2>
5177
5178                 <p>
5179                 Bookmarklet とは、クリック1回で記事の投稿ができるシステムです。 この Bookmarklet をインストールすると、ブラウザのツールバーの'add to weblog'ボタンが利用可能となり、Nucleusの新規アイテムの追加ウィンドウがポップアップします。任意のWebページを開いた状態でこのボタンを押せば、そのWebページのタイトルと、そのページへのリンクタグがすでに埋め込まれた状態でアイテム追加ウィンドウが開き、さらに、そのページ内に引用したい文を選択した状態であればその引用文も自動的に引用します。
5180                 </p>
5181
5182                 <h3>Bookmarklet</h3>
5183                 <p>
5184                         下のリンク部分を「お気に入り」もしくはツールバーにドラッグできます。<small>(その前にテストしてみたい場合は単純に下のリンクをクリックしてみてください)</small>
5185                         <br />
5186                         <br />
5187                         <a href="<?php echo htmlspecialchars($bm)?>">Add to <?php echo $blog->getShortName()?></a> (ほとんどのブラウザで動作します)
5188                 </p>
5189
5190                 <h3>右クリックメニューにインストール (WindowsでIE使用時)</h3>
5191                 <p>
5192                         <?php
5193                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5194                                 $url = $manager->addTicketToUrl($url);
5195                         ?>
5196                         あるいは<a href="<?php echo htmlspecialchars($url) ?>">右クリックメニュー</a>にインストールすることもできます (「開く」を選択すれば直接レジストリに登録します)
5197                 </p>
5198
5199                 <p>
5200                         このインストールした右クリックメニューを表示するためにはIEの再起動が必要です。
5201                 </p>
5202
5203                 <h3>アンインストール</h3>
5204                 <p>
5205                         「お気に入り」もしくはツールバーから消すには、単に削除するだけです。
5206                 </p>
5207
5208                 <p>
5209                         右クリックメニューから消したい時は、以下の手順を踏んでください:
5210                 </p>
5211
5212                 <ol>
5213                         <li>スタートメニューから「ファイルを指定して実行...」を選択</li>
5214                         <li>"regedit" と入力</li>
5215                         <li>"OK" ボタンを押す</li>
5216                         <li>"\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt" をツリーの中から検索</li>
5217                         <li>"add to weblog" エントリを削除</li>
5218                 </ol>
5219
5220                 <?php
5221                 $this->pagefoot();
5222
5223         }
5224
5225         /**
5226          * @todo document this
5227          */
5228         function action_actionlog() {
5229                 global $member, $manager;
5230
5231                 $member->isAdmin() or $this->disallow();
5232
5233                 $this->pagehead();
5234
5235                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5236
5237                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5238
5239                 ?>
5240                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5241                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5242                 <?php
5243                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5244
5245                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5246                 $template['content'] = 'actionlist';
5247                 $amount = showlist($query,'table',$template);
5248
5249                 $this->pagefoot();
5250
5251         }
5252
5253         /**
5254          * @todo document this
5255          */
5256         function action_banlist() {
5257                 global $member, $manager;
5258
5259                 $blogid = intRequestVar('blogid');
5260
5261                 $member->blogAdminRights($blogid) or $this->disallow();
5262
5263                 $blog =& $manager->getBlog($blogid);
5264
5265                 $this->pagehead();
5266
5267                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5268
5269                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5270
5271                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5272                 $template['content'] = 'banlist';
5273                 $amount = showlist($query,'table',$template);
5274
5275                 if ($amount == 0)
5276                         echo _BAN_NONE;
5277
5278                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5279                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5280
5281
5282                 $this->pagefoot();
5283
5284         }
5285
5286         /**
5287          * @todo document this
5288          */
5289         function action_banlistdelete() {
5290                 global $member, $manager;
5291
5292                 $blogid = intRequestVar('blogid');
5293                 $iprange = requestVar('iprange');
5294
5295                 $member->blogAdminRights($blogid) or $this->disallow();
5296
5297                 $blog =& $manager->getBlog($blogid);
5298
5299                 $this->pagehead();
5300                 ?>
5301                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5302
5303                         <form method="post" action="index.php">
5304
5305                         <h3><?php echo _BAN_IPRANGE?></h3>
5306
5307                         <p>
5308                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>
5309                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />
5310                         </p>
5311
5312                         <h3><?php echo _BAN_BLOGS?></h3>
5313
5314                         <div>
5315                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5316                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">Only blog '<?php echo htmlspecialchars($blog->getName())?>'</label>
5317                                 <br />
5318                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5319                         </div>
5320
5321                         <h3><?php echo _BAN_DELETE_TITLE?></h3>
5322
5323                         <div>
5324                                 <?php $manager->addTicketHidden() ?>
5325                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5326                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5327                         </div>
5328
5329                         </form>
5330                 <?php
5331                 $this->pagefoot();
5332         }
5333
5334         /**
5335          * @todo document this
5336          */
5337         function action_banlistdeleteconfirm() {
5338                 global $member, $manager;
5339
5340                 $blogid = intPostVar('blogid');
5341                 $allblogs = postVar('allblogs');
5342                 $iprange = postVar('iprange');
5343
5344                 $member->blogAdminRights($blogid) or $this->disallow();
5345
5346                 $deleted = array();
5347
5348                 if (!$allblogs) {
5349                         if (BAN::removeBan($blogid, $iprange))
5350                                 array_push($deleted, $blogid);
5351                 } else {
5352                         // get blogs fot which member has admin rights
5353                         $adminblogs = $member->getAdminBlogs();
5354                         foreach ($adminblogs as $blogje) {
5355                                 if (BAN::removeBan($blogje, $iprange))
5356                                         array_push($deleted, $blogje);
5357                         }
5358                 }
5359
5360                 if (sizeof($deleted) == 0)
5361                         $this->error(_ERROR_DELETEBAN);
5362
5363                 $this->pagehead();
5364
5365                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5366                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5367                 echo "<p>"._BAN_REMOVED_TEXT."</p>";
5368
5369                 echo "<ul>";
5370                 foreach ($deleted as $delblog) {
5371                         $b =& $manager->getBlog($delblog);
5372                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";
5373                 }
5374                 echo "</ul>";
5375
5376                 $this->pagefoot();
5377
5378         }
5379
5380         /**
5381          * @todo document this
5382          */
5383         function action_banlistnewfromitem() {
5384                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5385         }
5386
5387         /**
5388          * @todo document this
5389          */
5390         function action_banlistnew($blogid = '') {
5391                 global $member, $manager;
5392
5393                 if ($blogid == '')
5394                         $blogid = intRequestVar('blogid');
5395
5396                 $ip = requestVar('ip');
5397
5398                 $member->blogAdminRights($blogid) or $this->disallow();
5399
5400                 $blog =& $manager->getBlog($blogid);
5401
5402                 $this->pagehead();
5403                 ?>
5404                 <h2><?php echo _BAN_ADD_TITLE?></h2>
5405
5406
5407                 <form method="post" action="index.php">
5408
5409                 <h3><?php echo _BAN_IPRANGE?></h3>
5410
5411                 <p><?php echo _BAN_IPRANGE_TEXT?></p>
5412
5413                 <div class="note">
5414                 <b>An example</b>: "134.58.253.193" will only block one computer, while "134.58.253" will block 256 IP addresses, including the one from the first example.
5415                 </div>
5416
5417                 <div>
5418                 <?php                   if ($ip) {
5419                 ?>
5420                         <input name="iprange" type="radio" value="<?php echo htmlspecialchars($ip)?>" checked="checked" id="ip_fixed" /><label for="ip_fixed"><?php echo htmlspecialchars($ip)?></label>
5421                         <br />
5422                         <input name="iprange" type="radio" value="custom" id="ip_custom" /><label for="ip_custom">Custom: </label><input name='customiprange' value='<?php echo htmlspecialchars($ip)?>' maxlength='15' size='15' />
5423                 <?php   } else {
5424                                 echo "<input name='iprange' value='custom' type='hidden' />";
5425                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5426                         }
5427                 ?>
5428                 </div>
5429
5430                 <h3><?php echo _BAN_BLOGS?></h3>
5431
5432                 <p><?php echo _BAN_BLOGS_TEXT?></p>
5433
5434                 <div>
5435                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5436                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>
5437                         <br />
5438                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5439                 </div>
5440
5441                 <h3><?php echo _BAN_REASON_TITLE?></h3>
5442
5443                 <p><?php echo _BAN_REASON_TEXT?></p>
5444
5445                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5446
5447                 <h3><?php echo _BAN_ADD_TITLE?></h3>
5448
5449                 <div>
5450                         <input name="action" type="hidden" value="banlistadd" />
5451                         <?php $manager->addTicketHidden() ?>
5452                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5453                 </div>
5454
5455                 </form>
5456
5457                 <?php           $this->pagefoot();
5458         }
5459
5460         /**
5461          * @todo document this
5462          */
5463         function action_banlistadd() {
5464                 global $member;
5465
5466                 $blogid =               intPostVar('blogid');
5467                 $allblogs =     postVar('allblogs');
5468                 $iprange =              postVar('iprange');
5469                 if ($iprange == "custom")
5470                         $iprange = postVar('customiprange');
5471                 $reason =               postVar('reason');
5472
5473                 $member->blogAdminRights($blogid) or $this->disallow();
5474
5475                 // TODO: check IP range validity
5476
5477                 if (!$allblogs) {
5478                         if (!BAN::addBan($blogid, $iprange, $reason))
5479                                 $this->error(_ERROR_ADDBAN);
5480                 } else {
5481                         // get blogs fot which member has admin rights
5482                         $adminblogs = $member->getAdminBlogs();
5483                         $failed = 0;
5484                         foreach ($adminblogs as $blogje) {
5485                                 if (!BAN::addBan($blogje, $iprange, $reason))
5486                                         $failed = 1;
5487                         }
5488                         if ($failed)
5489                                 $this->error(_ERROR_ADDBAN);
5490                 }
5491
5492                 $this->action_banlist();
5493
5494         }
5495
5496         /**
5497          * @todo document this
5498          */
5499         function action_clearactionlog() {
5500                 global $member;
5501
5502                 $member->isAdmin() or $this->disallow();
5503
5504                 ACTIONLOG::clear();
5505
5506                 $this->action_manage(_MSG_ACTIONLOGCLEARED);
5507         }
5508
5509         /**
5510          * @todo document this
5511          */
5512         function action_backupoverview() {
5513                 global $member, $manager;
5514
5515                 $member->isAdmin() or $this->disallow();
5516
5517                 $this->pagehead();
5518
5519                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5520                 ?>
5521                 <h2><?php echo _BACKUPS_TITLE?></h2>
5522
5523                 <h3><?php echo _BACKUP_TITLE?></h3>
5524
5525                 <p><?php echo _BACKUP_INTRO?></p>
5526
5527                 <form method="post" action="index.php"><p>
5528                 <input type="hidden" name="action" value="backupcreate" />
5529                 <?php $manager->addTicketHidden() ?>
5530
5531                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5532                 <br />
5533                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5534                 <br /><br />
5535                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5536
5537                 </p></form>
5538
5539                 <div class="note"><?php echo _BACKUP_NOTE?></div>
5540
5541
5542                 <h3><?php echo _RESTORE_TITLE?></h3>
5543
5544                 <div class="note"><?php echo _RESTORE_NOTE?></div>
5545
5546                 <p><?php echo _RESTORE_INTRO?></p>
5547
5548                 <form method="post" action="index.php" enctype="multipart/form-data"><p>
5549                         <input type="hidden" name="action" value="backuprestore" />
5550                         <?php $manager->addTicketHidden() ?>
5551                         <input name="backup_file" type="file" tabindex="30" />
5552                         <br /><br />
5553                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5554                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5555                         <br /><?php echo _RESTORE_WARNING?>
5556                 </p></form>
5557
5558                 <?php           $this->pagefoot();
5559         }
5560
5561         /**
5562          * @todo document this
5563          */
5564         function action_backupcreate() {
5565                 global $member, $DIR_LIBS;
5566
5567                 $member->isAdmin() or $this->disallow();
5568
5569                 // use compression ?
5570                 $useGzip = intval(postVar('gzip'));
5571
5572                 include($DIR_LIBS . 'backup.php');
5573
5574                 // try to extend time limit
5575                 // (creating/restoring dumps might take a while)
5576                 @set_time_limit(1200);
5577
5578                 do_backup($useGzip);
5579                 exit;
5580         }
5581
5582         /**
5583          * @todo document this
5584          */
5585         function action_backuprestore() {
5586                 global $member, $DIR_LIBS;
5587
5588                 $member->isAdmin() or $this->disallow();
5589
5590                 if (intPostVar('letsgo') != 1)
5591                         $this->error(_ERROR_BACKUP_NOTSURE);
5592
5593                 include($DIR_LIBS . 'backup.php');
5594
5595                 // try to extend time limit
5596                 // (creating/restoring dumps might take a while)
5597                 @set_time_limit(1200);
5598
5599                 $message = do_restore();
5600                 if ($message != '')
5601                         $this->error($message);
5602
5603                 $this->pagehead();
5604                 ?>
5605                 <h2><?php echo _RESTORE_COMPLETE?></h2>
5606                 <?php           $this->pagefoot();
5607
5608         }
5609
5610         /**
5611          * @todo document this
5612          */
5613         function action_pluginlist() {
5614                 global $member, $manager;
5615
5616                 // check if allowed
5617                 $member->isAdmin() or $this->disallow();
5618
5619                 $this->pagehead();
5620
5621                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5622
5623                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
5624
5625                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';
5626
5627
5628                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
5629
5630                 $template['content'] = 'pluginlist';
5631                 $template['tabindex'] = 10;
5632                 showlist($query, 'table', $template);
5633
5634                 ?>
5635                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
5636
5637                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
5638
5639                         <form method="post" action="index.php"><div>
5640                                 <input type="hidden" name="action" value="pluginupdate" />
5641                                 <?php $manager->addTicketHidden() ?>
5642                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
5643                         </div></form>
5644
5645                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
5646
5647                         <?php                           // find a list of possibly non-installed plugins
5648                                 $candidates = array();
5649                                 global $DIR_PLUGINS;
5650                                 $dirhandle = opendir($DIR_PLUGINS);
5651                                 while ($filename = readdir($dirhandle)) {
5652                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
5653                                                 $name = $matches[1];
5654                                                 // only show in list when not yet installed
5655                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
5656                                                 if (mysql_num_rows($res) == 0)
5657                                                         array_push($candidates,$name);
5658                                         }
5659                                 }
5660                                 closedir($dirhandle);
5661
5662                                 if (sizeof($candidates) > 0) {
5663                         ?>
5664
5665                         <p><?php echo _PLUGS_ADD_TEXT?></p>
5666
5667
5668                         <form method='post' action='index.php'><div>
5669                                 <input type='hidden' name='action' value='pluginadd' />
5670                                 <?php $manager->addTicketHidden() ?>
5671                                 <select name="filename" tabindex="30">
5672                                 <?php                                   foreach($candidates as $name)
5673                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
5674                                 ?>
5675                                 </select>
5676                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
5677                         </div></form>
5678
5679                 <?php                   } else {        // sizeof(candidates) == 0
5680                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
5681                         }
5682
5683                 $this->pagefoot();
5684         }
5685
5686         /**
5687          * @todo document this
5688          */
5689         function action_pluginhelp() {
5690                 global $member, $manager, $DIR_PLUGINS, $CONF;
5691
5692                 // check if allowed
5693                 $member->isAdmin() or $this->disallow();
5694
5695                 $plugid = intGetVar('plugid');
5696
5697                 if (!$manager->pidInstalled($plugid))
5698                         $this->error(_ERROR_NOSUCHPLUGIN);
5699
5700                 $plugName = getPluginNameFromPid($plugid);
5701
5702                 $this->pagehead();
5703
5704                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
5705
5706                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';
5707
5708                 $plug =& $manager->getPlugin($plugName);
5709                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
5710
5711                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
5712                         @readfile($helpFile);
5713                 } else {
5714                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
5715                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
5716                 }
5717
5718
5719                 $this->pagefoot();
5720         }
5721
5722         /**
5723          * @todo document this
5724          */
5725         function action_pluginadd() {
5726                 global $member, $manager, $DIR_PLUGINS;
5727
5728                 // check if allowed
5729                 $member->isAdmin() or $this->disallow();
5730
5731                 $name = postVar('filename');
5732
5733                 if ($manager->pluginInstalled($name))
5734                         $this->error(_ERROR_DUPPLUGIN);
5735                 if (!checkPlugin($name))
5736                         $this->error(_ERROR_PLUGFILEERROR . ' (' . $name . ')');
5737
5738                 // get number of currently installed plugins
5739                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
5740                 $numCurrent = mysql_num_rows($res);
5741
5742                 // plugin will be added as last one in the list
5743                 $newOrder = $numCurrent + 1;
5744
5745                 $manager->notify(
5746                         'PreAddPlugin',
5747                         array(
5748                                 'file' => &$name
5749                         )
5750                 );
5751
5752                 // do this before calling getPlugin (in case the plugin id is used there)
5753                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
5754                 sql_query($query);
5755                 $iPid = mysql_insert_id();
5756
5757                 $manager->clearCachedInfo('installedPlugins');
5758
5759                 // Load the plugin for condition checking and instalation
5760                 $plugin =& $manager->getPlugin($name);
5761
5762                 // check if it got loaded (could have failed)
5763                 if (!$plugin)
5764                 {
5765                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
5766                         $manager->clearCachedInfo('installedPlugins');
5767                         $this->error(_ERROR_PLUGIN_LOAD);
5768                 }
5769
5770                 // check if plugin needs a newer Nucleus version
5771                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())
5772                 {
5773                         // uninstall plugin again...
5774                         $this->deleteOnePlugin($plugin->getID());
5775
5776                         // ...and show error
5777                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion());
5778                 }
5779
5780                 // check if plugin needs a newer Nucleus version
5781                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
5782                 {
5783                         // uninstall plugin again...
5784                         $this->deleteOnePlugin($plugin->getID());
5785
5786                         // ...and show error
5787                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel());
5788                 }
5789
5790                 $pluginList = $plugin->getPluginDep();
5791                 foreach ($pluginList as $pluginName)
5792                 {
5793
5794                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
5795                         if (mysql_num_rows($res) == 0)
5796                         {
5797                                 // uninstall plugin again...
5798                                 $this->deleteOnePlugin($plugin->getID());
5799
5800                                 $this->error(_ERROR_INSREQPLUGIN . $pluginName);
5801                         }
5802                 }
5803
5804                 // call the install method of the plugin
5805                 $plugin->install();
5806
5807                 $manager->notify(
5808                         'PostAddPlugin',
5809                         array(
5810                                 'plugin' => &$plugin
5811                         )
5812                 );
5813
5814                 // update all events
5815                 $this->action_pluginupdate();
5816         }
5817
5818         /**
5819          * @todo document this
5820          */
5821         function action_pluginupdate() {
5822                 global $member, $manager;
5823
5824                 // check if allowed
5825                 $member->isAdmin() or $this->disallow();
5826
5827                 // delete everything from plugin_events
5828                 sql_query('DELETE FROM '.sql_table('plugin_event'));
5829
5830                 // loop over all installed plugins
5831                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
5832                 while($o = mysql_fetch_object($res)) {
5833                         $pid = $o->pid;
5834                         $plug =& $manager->getPlugin($o->pfile);
5835                         if ($plug)
5836                         {
5837                                 $eventList = $plug->getEventList();
5838                                 foreach ($eventList as $eventName)
5839                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
5840                         }
5841                 }
5842
5843                 $this->action_pluginlist();
5844         }
5845
5846         /**
5847          * @todo document this
5848          */
5849         function action_plugindelete() {
5850                 global $member, $manager;
5851
5852                 // check if allowed
5853                 $member->isAdmin() or $this->disallow();
5854
5855                 $pid = intGetVar('plugid');
5856
5857                 if (!$manager->pidInstalled($pid))
5858                         $this->error(_ERROR_NOSUCHPLUGIN);
5859
5860                 $this->pagehead();
5861                 ?>
5862                         <h2><?php echo _DELETE_CONFIRM?></h2>
5863
5864                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
5865
5866                         <form method="post" action="index.php"><div>
5867                         <?php $manager->addTicketHidden() ?>
5868                         <input type="hidden" name="action" value="plugindeleteconfirm" />
5869                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
5870                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5871                         </div></form>
5872                 <?php           $this->pagefoot();
5873         }
5874
5875         /**
5876          * @todo document this
5877          */
5878         function action_plugindeleteconfirm() {
5879                 global $member, $manager;
5880
5881                 // check if allowed
5882                 $member->isAdmin() or $this->disallow();
5883
5884                 $pid = intPostVar('plugid');
5885
5886                 $error = $this->deleteOnePlugin($pid, 1);
5887                 if ($error) {
5888                         $this->error($error);
5889                 }
5890
5891                 $this->action_pluginlist();
5892         }
5893
5894         /**
5895          * @todo document this
5896          */
5897         function deleteOnePlugin($pid, $callUninstall = 0) {
5898                 global $manager;
5899
5900                 $pid = intval($pid);
5901
5902                 if (!$manager->pidInstalled($pid))
5903                         return _ERROR_NOSUCHPLUGIN;
5904
5905                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
5906
5907                 // call the unInstall method of the plugin
5908                 if ($callUninstall) {
5909                         $plugin =& $manager->getPlugin($name);
5910                         if ($plugin) $plugin->unInstall();
5911                 }
5912
5913                 // check dependency before delete
5914                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
5915                 while($o = mysql_fetch_object($res)) {
5916                         $plug =& $manager->getPlugin($o->pfile);
5917                         if ($plug)
5918                         {
5919                                 $depList = $plug->getPluginDep();
5920                                 foreach ($depList as $depName)
5921                                 {
5922                                         if ($name == $depName)
5923                                         {
5924                                                 return _ERROR_DELREQPLUGIN . $o->pfile;
5925                                         }
5926                                 }
5927                         }
5928                 }
5929
5930                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));
5931
5932                 // delete all subscriptions
5933                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
5934
5935                 // delete all options
5936                 // get OIDs from plugin_option_desc
5937                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5938                 $aOIDs = array();
5939                 while ($o = mysql_fetch_object($res)) {
5940                         array_push($aOIDs, $o->oid);
5941                 }
5942
5943                 // delete from plugin_option and plugin_option_desc
5944                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
5945                 if (count($aOIDs) > 0)
5946                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
5947
5948                 // update order numbers
5949                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
5950                 $o = mysql_fetch_object($res);
5951                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
5952
5953                 // delete row
5954                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
5955
5956                 $manager->clearCachedInfo('installedPlugins');
5957                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));
5958
5959                 return '';
5960         }
5961
5962         /**
5963          * @todo document this
5964          */
5965         function action_pluginup() {
5966                 global $member, $manager;
5967
5968                 // check if allowed
5969                 $member->isAdmin() or $this->disallow();
5970
5971                 $plugid = intGetVar('plugid');
5972
5973                 if (!$manager->pidInstalled($plugid))
5974                         $this->error(_ERROR_NOSUCHPLUGIN);
5975
5976                 // 1. get old order number
5977                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
5978                 $o = mysql_fetch_object($res);
5979                 $oldOrder = $o->porder;
5980
5981                 // 2. calculate new order number
5982                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5983
5984                 // 3. update plug numbers
5985                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
5986                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
5987
5988                 $this->action_pluginlist();
5989         }
5990
5991         /**
5992          * @todo document this
5993          */
5994         function action_plugindown() {
5995                 global $member, $manager;
5996
5997                 // check if allowed
5998                 $member->isAdmin() or $this->disallow();
5999
6000                 $plugid = intGetVar('plugid');
6001                 if (!$manager->pidInstalled($plugid))
6002                         $this->error(_ERROR_NOSUCHPLUGIN);
6003
6004                 // 1. get old order number
6005                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6006                 $o = mysql_fetch_object($res);
6007                 $oldOrder = $o->porder;
6008
6009                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6010                 $maxOrder = mysql_num_rows($res);
6011
6012                 // 2. calculate new order number
6013                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6014
6015                 // 3. update plug numbers
6016                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6017                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6018
6019                 $this->action_pluginlist();
6020         }
6021
6022         /**
6023          * @todo document this
6024          */
6025         function action_pluginoptions($message = '') {
6026                 global $member, $manager;
6027
6028                 // check if allowed
6029                 $member->isAdmin() or $this->disallow();
6030
6031                 $pid = intRequestVar('plugid');
6032                 if (!$manager->pidInstalled($pid))
6033                         $this->error(_ERROR_NOSUCHPLUGIN);
6034
6035                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6036                 $this->pagehead($extrahead);
6037
6038                 ?>
6039                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6040
6041                         <h2>Options for <?php echo htmlspecialchars(getPluginNameFromPid($pid))?></h2>
6042
6043                         <?php if  ($message) echo $message?>
6044
6045                         <form action="index.php" method="post">
6046                         <div>
6047                                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6048                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6049
6050                 <?php
6051
6052                 $manager->addTicketHidden();
6053
6054                 $aOptions = array();
6055                 $aOIDs = array();
6056                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6057                 $r = sql_query($query);
6058                 while ($o = mysql_fetch_object($r)) {
6059                         array_push($aOIDs, $o->oid);
6060                         $aOptions[$o->oid] = array(
6061                                                 'oid' => $o->oid,
6062                                                 'value' => $o->odef,
6063                                                 'name' => $o->oname,
6064                                                 'description' => $o->odesc,
6065                                                 'type' => $o->otype,
6066                                                 'typeinfo' => $o->oextra,
6067                                                 'contextid' => 0
6068                         );
6069                 }
6070                 // fill out actual values
6071                 if (count($aOIDs) > 0) {
6072                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6073                         while ($o = mysql_fetch_object($r))
6074                                 $aOptions[$o->oid]['value'] = $o->ovalue;
6075                 }
6076
6077                 // call plugins
6078                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6079
6080                 $template['content'] = 'plugoptionlist';
6081                 $amount = showlist($aOptions,'table',$template);
6082                 if ($amount == 0)
6083                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6084
6085                 ?>
6086                         </div>
6087                         </form>
6088                 <?php           $this->pagefoot();
6089
6090
6091
6092         }
6093
6094         /**
6095          * @todo document this
6096          */
6097         function action_pluginoptionsupdate() {
6098                 global $member, $manager;
6099
6100                 // check if allowed
6101                 $member->isAdmin() or $this->disallow();
6102
6103                 $pid = intRequestVar('plugid');
6104                 if (!$manager->pidInstalled($pid))
6105                         $this->error(_ERROR_NOSUCHPLUGIN);
6106
6107                 $aOptions = requestArray('plugoption');
6108                 NucleusPlugin::_applyPluginOptions($aOptions);
6109
6110                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6111
6112                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6113         }
6114
6115         /**
6116          * @static
6117          * @todo document this
6118          */
6119         function _insertPluginOptions($context, $contextid = 0) {
6120                 // get all current values for this contextid
6121                 // (note: this might contain doubles for overlapping contextids)
6122                 $aIdToValue = array();
6123                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6124                 while ($o = mysql_fetch_object($res)) {
6125                         $aIdToValue[$o->oid] = $o->ovalue;
6126                 }
6127
6128                 // get list of oids per pid
6129                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6130                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
6131                 $res = sql_query($query);
6132                 $aOptions = array();
6133                 while ($o = mysql_fetch_object($res)) {
6134                         if (in_array($o->oid, array_keys($aIdToValue)))
6135                                 $value = $aIdToValue[$o->oid];
6136                         else
6137                                 $value = $o->odef;
6138
6139                         array_push($aOptions, array(
6140                                 'pid' => $o->pid,
6141                                 'pfile' => $o->pfile,
6142                                 'oid' => $o->oid,
6143                                 'value' => $value,
6144                                 'name' => $o->oname,
6145                                 'description' => $o->odesc,
6146                                 'type' => $o->otype,
6147                                 'typeinfo' => $o->oextra,
6148                                 'contextid' => $contextid,
6149                                 'extra' => ''
6150                         ));
6151                 }
6152
6153                 global $manager;
6154                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6155
6156
6157                 $iPrevPid = -1;
6158                 foreach ($aOptions as $aOption) {
6159
6160                         // new plugin?
6161                         if ($iPrevPid != $aOption['pid']) {
6162                                 $iPrevPid = $aOption['pid'];
6163
6164                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';
6165                         }
6166
6167                         echo '<tr>';
6168                         listplug_plugOptionRow($aOption);
6169                         echo '</tr>';
6170
6171                 }
6172
6173
6174         }
6175
6176         /**
6177          * Helper functions to create option forms etc.
6178          * @todo document parameters
6179          */
6180         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO, $isAdmin = 0) {
6181                 $id = htmlspecialchars($name);
6182                 $id = str_replace('[','-',$id);
6183                 $id = str_replace(']','-',$id);
6184                 $id1 = $id . htmlspecialchars($value1);
6185                 $id2 = $id . htmlspecialchars($value2);
6186
6187                 if ($name=="admin") {
6188                         echo '<input onclick="selectCanLogin(true);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6189                 } else {
6190                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6191                 }
6192
6193                         if ($checkedval == $value1)
6194                                 echo "tabindex='$tabindex' checked='checked'";
6195                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6196                 echo ' ';
6197                 if ($name=="admin") {
6198                         echo '<input onclick="selectCanLogin(false);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6199                 } else {
6200                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6201                 }
6202                         if ($checkedval != $value1)
6203                                 echo "tabindex='$tabindex' checked='checked'";
6204                         if ($isAdmin && $name=="canlogin")
6205                                 echo " disabled='true'";
6206                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6207         }
6208
6209 } // class ADMIN
6210
6211 ?>