nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS, $manager;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                         );\r
 212                 }\r
 213                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 214                 {\r
 215                         $action = $alias[$action];\r
 216                 }\r
 217                 $methodName = "action_{$action}";\r
 218                 self::$action = strtolower($action);\r
 219                 \r
 220                 /* 2. check the action */\r
 221                 $synonimActions = array(\r
 222                         'banlistnewfromitem',\r
 223                         'memberedit',\r
 224                         'login',\r
 225                 );\r
 226                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 227                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 228                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 229                 {\r
 230                         if (!$manager->checkTicket())\r
 231                         {\r
 232                                 self::error(_ERROR_BADTICKET);\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                 }\r
 251                 elseif ( $id != $CONF['AdminSkin'] )\r
 252                 {\r
 253                         self::$skin =& $manager->getSkin($CONF['AdminSkin'], 'AdminActions');\r
 254                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 255                         {\r
 256                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 257                         }\r
 258                 }\r
 259                 else\r
 260                 {\r
 261                         self::error(_BADACTION . ENTITY::hsc($action));\r
 262                 }\r
 263                 exit;\r
 264         }\r
 265         \r
 266         /**\r
 267          * Action::existsSkinContents()\r
 268          * Check skin contents\r
 269          *\r
 270          * @param       string  $action action type\r
 271          * @return      boolean\r
 272          */\r
 273         static private function existsSkinContents($action)\r
 274         {\r
 275                 $in_array  = in_array($action, self::$skinless_actions);\r
 276                 \r
 277                 if ( $in_array )\r
 278                 {\r
 279                         return $in_array;\r
 280                 }\r
 281                 else\r
 282                 {\r
 283                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 284                         /* TODO: skinid should be a default */\r
 285                         if ( !is_object(self::$skin) )\r
 286                         {\r
 287                                 global $CONF;\r
 288                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 289                         }\r
 290                         else\r
 291                         {\r
 292                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 293                         }\r
 294                 }\r
 295                 return;\r
 296         }\r
 297         \r
 298         /**\r
 299          * Action::specialActionsAllow()\r
 300          * Check exists specialskinparts\r
 301          *\r
 302          * @param       string  $action action type\r
 303          * @return boolean\r
 304          */\r
 305         static private function specialActionsAllow($action)\r
 306         {\r
 307                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 308                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 309                 return DB::getValue($query);\r
 310         }\r
 311         \r
 312         /**\r
 313          * Action::action_showlogin()\r
 314          * \r
 315          * @param       void\r
 316          * @return      void\r
 317          */\r
 318         static private function action_showlogin()\r
 319         {\r
 320                 global $error;\r
 321                 self::action_login($error);\r
 322                 return;\r
 323         }\r
 324         \r
 325         /**\r
 326          * Action::action_login()\r
 327          * \r
 328          * @param       string  $msg            message for pageheader\r
 329          * @param       integer $passvars       ???\r
 330          */\r
 331         static private function action_login($msg = '', $passvars = 1)\r
 332         {\r
 333                 global $member;\r
 334                 \r
 335                 // skip to overview when allowed\r
 336                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 337                 {\r
 338                         self::action_overview();\r
 339                         exit;\r
 340                 }\r
 341                 \r
 342                 /* TODO: needless variable??? */\r
 343                 self::$passvar = $passvars;\r
 344                 if ( $msg )\r
 345                 {\r
 346                         self::$headMess = $msg;\r
 347                 }\r
 348                 \r
 349                 self::$skin->parse('showlogin');\r
 350         }\r
 351         \r
 352         /**\r
 353          * Action::action_overview()\r
 354          * provides a screen with the overview of the actions available\r
 355          * \r
 356          * @param       string  $msg    message for pageheader\r
 357          * @return      void\r
 358          */\r
 359         static private function action_overview($msg = '')\r
 360         {\r
 361                 if ( $msg )\r
 362                 {\r
 363                         self::$headMess = $msg;\r
 364                 }\r
 365                 \r
 366                 self::$skin->parse('overview');\r
 367                 return;\r
 368         }\r
 369         \r
 370         /**\r
 371          * Admin::action_manage()\r
 372          * \r
 373          * @param       string  $msg    message for pageheader\r
 374          * @retrn       void\r
 375          */\r
 376         static private function action_manage($msg = '')\r
 377         {\r
 378                 global $member;\r
 379                 \r
 380                 if ( $msg )\r
 381                 {\r
 382                         self::$headMess = $msg;\r
 383                 }\r
 384                 $member->isAdmin() or self::disallow();\r
 385                 \r
 386                 self::$skin->parse('manage');\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::$skin->parse('itemlist');\r
 408                 return;\r
 409         }\r
 410         \r
 411         /**\r
 412          * Action::action_batchitem()\r
 413          * \r
 414          * @param       void\r
 415          * @return      void\r
 416          */\r
 417         static private function action_batchitem()\r
 418         {\r
 419                 global $member, $manager;\r
 420                 \r
 421                 $member->isLoggedIn() or self::disallow();\r
 422                 \r
 423                 $selected       = requestIntArray('batch');\r
 424                 $action         = requestVar('batchaction');\r
 425                 \r
 426                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 427                 {\r
 428                         self::error(_BATCH_NOSELECTION);\r
 429                 }\r
 430                 \r
 431                 // On move: when no destination blog/category chosen, show choice now\r
 432                 $destCatid = intRequestVar('destcatid');\r
 433                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 434                 {\r
 435                         self::batchMoveSelectDestination('item', $selected);\r
 436                 }\r
 437                 \r
 438                 // On delete: check if confirmation has been given\r
 439                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 440                 {\r
 441                         self::batchAskDeleteConfirmation('item', $selected);\r
 442                 }\r
 443                 \r
 444                 self::$skin->parse('batchitem');\r
 445                 return;\r
 446         }\r
 447         \r
 448         /**\r
 449          * Action::action_batchcomment()\r
 450          * \r
 451          * @param       void\r
 452          * @return      void\r
 453          */\r
 454         static private function action_batchcomment()\r
 455         {\r
 456                 global $member;\r
 457                 \r
 458                 $member->isLoggedIn() or self::disallow();\r
 459                 \r
 460                 $selected       = requestIntArray('batch');\r
 461                 $action         = requestVar('batchaction');\r
 462                 \r
 463                 // Show error when no items were selected\r
 464                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 465                 {\r
 466                         self::error(_BATCH_NOSELECTION);\r
 467                 }\r
 468                 \r
 469                 // On delete: check if confirmation has been given\r
 470                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 471                 {\r
 472                         self::batchAskDeleteConfirmation('comment', $selected);\r
 473                 }\r
 474                 \r
 475                 self::$skin->parse('batchcomment');\r
 476                 return;\r
 477         }\r
 478         \r
 479         /**\r
 480          * Admin::setAdminAction()\r
 481          *\r
 482          * @param       string  $action\r
 483          * @return      void\r
 484          */\r
 485         static public function setAdminAction($action)\r
 486         {\r
 487                 self::$action = $action;\r
 488                 return;\r
 489         }\r
 490         \r
 491         /**\r
 492          * Admin::action_batchmember()\r
 493          * \r
 494          * @param       void\r
 495          * @return      void\r
 496          */\r
 497         static private function action_batchmember()\r
 498         {\r
 499                 global $member;\r
 500                 \r
 501                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 502                 \r
 503                 $selected       = requestIntArray('batch');\r
 504                 $action         = requestVar('batchaction');\r
 505                 \r
 506                 // Show error when no members selected\r
 507                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 508                 {\r
 509                         self::error(_BATCH_NOSELECTION);\r
 510                 }\r
 511                 \r
 512                 // On delete: check if confirmation has been given\r
 513                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 514                 {\r
 515                         self::batchAskDeleteConfirmation('member',$selected);\r
 516                 }\r
 517                 \r
 518                 self::$skin->parse('batchmember');\r
 519                 return;\r
 520         }\r
 521         \r
 522         /**\r
 523          * Admin::action_batchteam()\r
 524          * \r
 525          * @param       void\r
 526          * @return      void\r
 527          */\r
 528         static private function action_batchteam()\r
 529         {\r
 530                 global $member;\r
 531                 \r
 532                 $blogid = intRequestVar('blogid');\r
 533                 \r
 534                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 535                 \r
 536                 $selected       = requestIntArray('batch');\r
 537                 $action         = requestVar('batchaction');\r
 538                 \r
 539                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 540                 {\r
 541                         self::error(_BATCH_NOSELECTION);\r
 542                 }\r
 543                 \r
 544                 // On delete: check if confirmation has been given\r
 545                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 546                 {\r
 547                         self::batchAskDeleteConfirmation('team',$selected);\r
 548                 }\r
 549                 \r
 550                 self::$skin->parse('batchteam');\r
 551                 return;\r
 552         }\r
 553         \r
 554         /**\r
 555          * Admin::action_batchcategory()\r
 556          * \r
 557          * @param       void\r
 558          * @return      void\r
 559          */\r
 560         static private function action_batchcategory()\r
 561         {\r
 562                 global $member, $manager;\r
 563                 \r
 564                 $member->isLoggedIn() or self::disallow();\r
 565                 \r
 566                 $selected       = requestIntArray('batch');\r
 567                 $action         = requestVar('batchaction');\r
 568                 \r
 569                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 570                 {\r
 571                         self::error(_BATCH_NOSELECTION);\r
 572                 }\r
 573                 \r
 574                 // On move: when no destination blog chosen, show choice now\r
 575                 $destBlogId = intRequestVar('destblogid');\r
 576                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 577                 {\r
 578                         self::batchMoveCategorySelectDestination('category', $selected);\r
 579                 }\r
 580                 \r
 581                 // On delete: check if confirmation has been given\r
 582                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 583                 {\r
 584                         self::batchAskDeleteConfirmation('category', $selected);\r
 585                 }\r
 586                 \r
 587                 self::$skin->parse('batchcategory');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::$skin->parse('batchmove');\r
 604                 return;\r
 605         }\r
 606         \r
 607         /**\r
 608          * Admin::batchMoveCategorySelectDestination()\r
 609          * \r
 610          * @param       string  $type   type of batch action\r
 611          * @param       integer $ids    needless???\r
 612          * @return      void\r
 613          * \r
 614          * TODO: remove needless argument\r
 615          */\r
 616         static private function batchMoveCategorySelectDestination($type, $ids)\r
 617         {\r
 618                 $_POST['batchmove'] = $type;\r
 619                 global $manager;\r
 620                 self::$skin->parse('batchmovecat');\r
 621                 return;\r
 622         }\r
 623         \r
 624         /**\r
 625          * Admin::batchAskDeleteConfirmation()\r
 626          * \r
 627          * @param       string  $type   type of batch action\r
 628          * @param       integer $ids    needless???\r
 629          * @return      void\r
 630          * \r
 631          * TODO: remove needless argument\r
 632          */\r
 633         static private function batchAskDeleteConfirmation($type, $ids)\r
 634         {\r
 635                 self::$skin->parse('batchdelete');\r
 636                 return;\r
 637         }\r
 638         \r
 639         /**\r
 640          * Admin::action_browseownitems()\r
 641          * \r
 642          * @param       void\r
 643          * @return      void\r
 644          */\r
 645         static private function action_browseownitems()\r
 646         {\r
 647                 global $member, $manager, $CONF;\r
 648                 \r
 649                 self::$skin->parse('browseownitems');\r
 650                 return;\r
 651         }\r
 652         \r
 653         /**\r
 654          * Admin::action_itemcommentlist()\r
 655          * Show all the comments for a given item\r
 656          * \r
 657          * @param       integer $itemid ID for item\r
 658          * @return      void\r
 659          */\r
 660         static private function action_itemcommentlist($itemid = '')\r
 661         {\r
 662                 global $member, $manager, $CONF;\r
 663                 \r
 664                 if ( $itemid == '' )\r
 665                 {\r
 666                         $itemid = intRequestVar('itemid');\r
 667                 }\r
 668                 \r
 669                 // only allow if user is allowed to alter item\r
 670                 $member->canAlterItem($itemid) or self::disallow();\r
 671                 \r
 672                 $item =& $manager->getItem($itemid, 1, 1);\r
 673                 $_REQUEST['itemid'] = $item['itemid'];\r
 674                 $_REQUEST['blogid'] = $item['blogid'];\r
 675                 \r
 676                 self::$skin->parse('itemcommentlist');\r
 677                 return;\r
 678         }\r
 679         \r
 680         /**\r
 681          * Admin::action_browseowncomments()\r
 682          * Browse own comments\r
 683          * \r
 684          * @param       void\r
 685          * @return      void\r
 686          */\r
 687         static private function action_browseowncomments()\r
 688         {\r
 689                 self::$skin->parse('browseowncomments');\r
 690                 return;\r
 691         }\r
 692         \r
 693         /**\r
 694          * Admin::action_blogcommentlist()\r
 695          * Browse all comments for a weblog\r
 696          * \r
 697          * @param       integer $blogid ID for weblog\r
 698          * @return      void\r
 699          */\r
 700         static private function action_blogcommentlist($blogid = '')\r
 701         {\r
 702                 global $member, $manager, $CONF;\r
 703                 \r
 704                 if ( $blogid == '' )\r
 705                 {\r
 706                         $blogid = intRequestVar('blogid');\r
 707                 }\r
 708                 else\r
 709                 {\r
 710                         $blogid = intval($blogid);\r
 711                 }\r
 712                 \r
 713                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 714                 \r
 715                 /* TODO: we consider to use the other way insterad of this */\r
 716                 $_REQUEST['blogid'] = $blogid;\r
 717                 \r
 718                 self::$skin->parse('blogcommentlist');\r
 719                 return;\r
 720         }\r
 721         \r
 722         /**\r
 723          * Admin::action_createaccount()\r
 724          * \r
 725          * @param       void\r
 726          * @return      void\r
 727          */\r
 728         static private function action_createaccount()\r
 729         {\r
 730                 global $CONF;\r
 731                 \r
 732                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 733                 {\r
 734                         self::$skin->parse('createaccountdisable');\r
 735                         return;\r
 736                 }\r
 737                 \r
 738                 $name = '';\r
 739                 $realname ='';\r
 740                 $email = '';\r
 741                 $url = '';\r
 742                 \r
 743                 $contents = array(\r
 744                         'name'          => '',\r
 745                         'realname'      => '',\r
 746                         'email'         => '',\r
 747                         'url'           => ''\r
 748                 );\r
 749                 \r
 750                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 751                 {\r
 752                         $action = new Action();\r
 753                         $message = $action->createAccount();\r
 754                         if ( $message === 1 )\r
 755                         {\r
 756                                 self::$headMess = $message;\r
 757                                 self::$skin->parse('createaccountsuccess');\r
 758                                 return;\r
 759                         }\r
 760                         \r
 761                         /* TODO: validation */\r
 762                         if ( array_key_exists('name', $_POST) )\r
 763                         {\r
 764                                 $contents['name'] = $_POST['name'];\r
 765                         }\r
 766                         if ( array_key_exists('realname', $_POST) )\r
 767                         {\r
 768                                 $contents['realname'] = $_POST['realname'];\r
 769                         }\r
 770                         if ( array_key_exists('email', $_POST) )\r
 771                         {\r
 772                                 $contents['email'] = $_POST['email'];\r
 773                         }\r
 774                         if ( array_key_exists('url', $_POST) )\r
 775                         {\r
 776                                 $contents['url'] = $_POST['url'];\r
 777                         }\r
 778                         \r
 779                         self::$contents = $contents;\r
 780                         \r
 781                 }\r
 782                 \r
 783                 self::$skin->parse('createaccountinput');\r
 784                 return;\r
 785         }\r
 786         \r
 787         /**\r
 788          * Admin::action_createitem()\r
 789          * Provide a page to item a new item to the given blog\r
 790          * \r
 791          * @param       void\r
 792          * @return      void\r
 793          */\r
 794         static private function action_createitem()\r
 795         {\r
 796                 global $member, $manager;\r
 797                 \r
 798                 $blogid = intRequestVar('blogid');\r
 799                 \r
 800                 // check if allowed\r
 801                 $member->teamRights($blogid) or self::disallow();\r
 802                 \r
 803                 $blog =& $manager->getBlog($blogid);\r
 804                 $contents = array();\r
 805                 \r
 806                 $data = array(\r
 807                         'blog'          => &$blog,\r
 808                         'contents'      => &$contents\r
 809                 );\r
 810                 $manager->notify('PreAddItemForm', $data);\r
 811                 \r
 812                 if ( $blog->convertBreaks() )\r
 813                 {\r
 814                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 815                         {\r
 816                                 $contents['body'] = removeBreaks($contents['body']);\r
 817                         }\r
 818                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 819                         {\r
 820                                 $contents['more'] = removeBreaks($contents['more']);\r
 821                         }\r
 822                 }\r
 823                 \r
 824                 self::$blog = &$blog;\r
 825                 self::$contents = &$contents;\r
 826                 \r
 827                 self::$skin->parse('createitem');\r
 828                 return;\r
 829         }\r
 830         \r
 831         /**\r
 832          * Admin::action_itemedit()\r
 833          * \r
 834          * @param       void\r
 835          * @return      void\r
 836          */\r
 837         static private function action_itemedit()\r
 838         {\r
 839                 global $member, $manager;\r
 840                 \r
 841                 $itemid = intRequestVar('itemid');\r
 842                 \r
 843                 // only allow if user is allowed to alter item\r
 844                 $member->canAlterItem($itemid) or self::disallow();\r
 845                 \r
 846                 $item =& $manager->getItem($itemid, 1, 1);\r
 847                 $blog =& $manager->getBlog($item['blogid']);\r
 848                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 849                 \r
 850                 if ( $blog->convertBreaks() )\r
 851                 {\r
 852                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 853                         {\r
 854                                 $item['body'] = removeBreaks($item['body']);\r
 855                         }\r
 856                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 857                         {\r
 858                                 $item['more'] = removeBreaks($item['more']);\r
 859                         }\r
 860                 }\r
 861                 \r
 862                 self::$blog = &$blog;\r
 863                 self::$contents = &$item;\r
 864                 \r
 865                 self::$skin->parse('itemedit');\r
 866                 return;\r
 867         }\r
 868         \r
 869         /**\r
 870          * Admin::action_itemupdate()\r
 871          * \r
 872          * @param       void\r
 873          * @return      void\r
 874          */\r
 875         static private function action_itemupdate()\r
 876         {\r
 877                 global $member, $manager, $CONF;\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $catid  = postVar('catid');\r
 881                 \r
 882                 // only allow if user is allowed to alter item\r
 883                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 884                 \r
 885                 $actiontype = postVar('actiontype');\r
 886                 \r
 887                 // delete actions are handled by itemdelete (which has confirmation)\r
 888                 if ( $actiontype == 'delete' )\r
 889                 {\r
 890                         self::action_itemdelete();\r
 891                         return;\r
 892                 }\r
 893                 \r
 894                 $body           = postVar('body');\r
 895                 $title          = postVar('title');\r
 896                 $more           = postVar('more');\r
 897                 $closed         = intPostVar('closed');\r
 898                 $draftid        = intPostVar('draftid');\r
 899                 \r
 900                 // default action = add now\r
 901                 if ( !$actiontype )\r
 902                 {\r
 903                         $actiontype='addnow';\r
 904                 }\r
 905                 \r
 906                 // create new category if needed\r
 907                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 908                 {\r
 909                         // get blogid\r
 910                         list($blogid) = sscanf($catid,"newcat-%d");\r
 911                         \r
 912                         // create\r
 913                         $blog =& $manager->getBlog($blogid);\r
 914                         $catid = $blog->createNewCategory();\r
 915                         \r
 916                         // show error when sth goes wrong\r
 917                         if ( !$catid )\r
 918                         {\r
 919                                 self::doError(_ERROR_CATCREATEFAIL);\r
 920                         }\r
 921                 }\r
 922                 \r
 923                 /**\r
 924                  * set some variables based on actiontype\r
 925                  * \r
 926                  * actiontypes:\r
 927                  *      draft items -> addnow, addfuture, adddraft, delete\r
 928                  *      non-draft items -> edit, changedate, delete\r
 929                  * \r
 930                  * variables set:\r
 931                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 932                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 933                  *      $publish: set to 1 when the edited item is not a draft\r
 934                  */\r
 935                 $blogid =  getBlogIDFromItemID($itemid);\r
 936                 $blog =& $manager->getBlog($blogid);\r
 937                 \r
 938                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 939                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 940                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 941                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 942                 {\r
 943                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 944                 }\r
 945                 else\r
 946                 {\r
 947                         $timestamp =0;\r
 948                 }\r
 949                 \r
 950                 // edit the item for real\r
 951                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 952                 \r
 953                 self::updateFuturePosted($blogid);\r
 954                 \r
 955                 if ( $draftid > 0 )\r
 956                 {\r
 957                         // delete permission is checked inside Item::delete()\r
 958                         Item::delete($draftid);\r
 959                 }\r
 960                 \r
 961                 if ( $catid != intPostVar('catid') )\r
 962                 {\r
 963                         self::action_categoryedit(\r
 964                                 $catid,\r
 965                                 $blog->getID(),\r
 966                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 967                         );\r
 968                 }\r
 969                 else\r
 970                 {\r
 971                         // TODO: set start item correctly for itemlist\r
 972                         $item =& $manager->getitem($itemid, 1, 1);\r
 973                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 974                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 975                         $cnt  = DB::getValue($query);\r
 976                         $_REQUEST['start'] = $cnt + 1;\r
 977                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 978                 }\r
 979                 return;\r
 980         }\r
 981         \r
 982         /**\r
 983          * Admin::action_itemdelete()\r
 984          * Delete item\r
 985          * \r
 986          * @param       Void\r
 987          * @return      Void\r
 988          */\r
 989         static private function action_itemdelete()\r
 990         {\r
 991                 global $member, $manager;\r
 992                 \r
 993                 $itemid = intRequestVar('itemid');\r
 994                 \r
 995                 // only allow if user is allowed to alter item\r
 996                 $member->canAlterItem($itemid) or self::disallow();\r
 997                 \r
 998                 if ( !$manager->existsItem($itemid,1,1) )\r
 999                 {\r
1000                         self::error(_ERROR_NOSUCHITEM);\r
1001                 }\r
1002                 \r
1003                 self::$skin->parse('itemdelete');\r
1004                 return;\r
1005         }\r
1006         \r
1007         /**\r
1008          * Admin::action_itemdeleteconfirm()\r
1009          * \r
1010          * @param       void\r
1011          * @return      void\r
1012          */\r
1013         static private function action_itemdeleteconfirm()\r
1014         {\r
1015                 global $member, $manager;\r
1016                 \r
1017                 $itemid = intRequestVar('itemid');\r
1018                 \r
1019                 // only allow if user is allowed to alter item\r
1020                 $member->canAlterItem($itemid) or self::disallow();\r
1021                 \r
1022                 // get item first\r
1023                 $item =& $manager->getItem($itemid, 1, 1);\r
1024                 \r
1025                 // delete item (note: some checks will be performed twice)\r
1026                 self::deleteOneItem($item['itemid']);\r
1027                 \r
1028                 self::action_itemlist($item['blogid']);\r
1029                 return;\r
1030         }\r
1031         \r
1032         /**\r
1033          * Admin::deleteOneItem()\r
1034          * Deletes one item and returns error if something goes wrong\r
1035          * \r
1036          * @param       integer $itemid ID for item\r
1037          * @return      void\r
1038          */\r
1039         static public function deleteOneItem($itemid)\r
1040         {\r
1041                 global $member, $manager;\r
1042                 \r
1043                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1044                 if ( !$member->canAlterItem($itemid) )\r
1045                 {\r
1046                         return _ERROR_DISALLOWED;\r
1047                 }\r
1048                 \r
1049                 // need to get blogid before the item is deleted\r
1050                 $item =& $manager->getItem($itemid, 1, 1);\r
1051                 \r
1052                 $manager->loadClass('ITEM');\r
1053                 Item::delete($item['itemid']);\r
1054                 \r
1055                 // update blog's futureposted\r
1056                 self::updateFuturePosted($item['itemid']);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::updateFuturePosted()\r
1062          * Update a blog's future posted flag\r
1063          * \r
1064          * @param integer $blogid\r
1065          * @return      void\r
1066          */\r
1067         static private function updateFuturePosted($blogid)\r
1068         {\r
1069                 global $manager;\r
1070                 \r
1071                 $blogid                 =  intval($blogid);\r
1072                 $blog                   =& $manager->getBlog($blogid);\r
1073                 $currenttime    =  $blog->getCorrectTime(time());\r
1074                 \r
1075                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1076                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1077                 $result = DB::getResult($query);\r
1078                 \r
1079                 if ( $result->rowCount() > 0 )\r
1080                 {\r
1081                                 $blog->setFuturePost();\r
1082                 }\r
1083                 else\r
1084                 {\r
1085                                 $blog->clearFuturePost();\r
1086                 }\r
1087                 return;\r
1088         }\r
1089 \r
1090         /**\r
1091          * Admin::action_itemmove()\r
1092          * \r
1093          * @param       void\r
1094          * @return      void\r
1095          */\r
1096         static private function action_itemmove()\r
1097         {\r
1098                 global $member, $manager;\r
1099                 \r
1100                 $itemid = intRequestVar('itemid');\r
1101                 \r
1102                 $member->canAlterItem($itemid) or self::disallow();\r
1103                 \r
1104                 self::$skin->parse('itemmove');\r
1105                 return;\r
1106         }\r
1107         \r
1108         /**\r
1109          * Admin::action_itemmoveto()\r
1110          * \r
1111          * @param       void\r
1112          * @return      void\r
1113          */\r
1114         static private function action_itemmoveto()\r
1115         {\r
1116                 global $member, $manager;\r
1117                 \r
1118                 $itemid = intRequestVar('itemid');\r
1119                 $catid = requestVar('catid');\r
1120                 \r
1121                 // create new category if needed\r
1122                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1123                 {\r
1124                         // get blogid\r
1125                         list($blogid) = sscanf($catid,'newcat-%d');\r
1126                         \r
1127                         // create\r
1128                         $blog =& $manager->getBlog($blogid);\r
1129                         $catid = $blog->createNewCategory();\r
1130                         \r
1131                         // show error when sth goes wrong\r
1132                         if ( !$catid )\r
1133                         {\r
1134                                 self::doError(_ERROR_CATCREATEFAIL);\r
1135                         }\r
1136                 }\r
1137                 \r
1138                 // only allow if user is allowed to alter item\r
1139                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1140                 \r
1141                 $old_blogid = getBlogIDFromItemId($itemid);\r
1142                 \r
1143                 Item::move($itemid, $catid);\r
1144                 \r
1145                 // set the futurePosted flag on the blog\r
1146                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1147                 \r
1148                 // reset the futurePosted in case the item is moved from one blog to another\r
1149                 self::updateFuturePosted($old_blogid);\r
1150                 \r
1151                 if ( $catid != intRequestVar('catid') )\r
1152                 {\r
1153                         self::action_categoryedit($catid, $blog->getID());\r
1154                 }\r
1155                 else\r
1156                 {\r
1157                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1158                 }\r
1159                 return;\r
1160         }\r
1161         \r
1162         /**\r
1163          * Admin::moveOneItem()\r
1164          * Moves one item to a given category (category existance should be checked by caller)\r
1165          * errors are returned\r
1166          * \r
1167          * @param       integer $itemid         ID for item\r
1168          * @param       integer $destCatid      ID for category to which the item will be moved\r
1169          * @return      void\r
1170          */\r
1171         static public function moveOneItem($itemid, $destCatid)\r
1172         {\r
1173                 global $member;\r
1174                 \r
1175                 // only allow if user is allowed to move item\r
1176                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1177                 {\r
1178                         return _ERROR_DISALLOWED;\r
1179                 }\r
1180                 \r
1181                 Item::move($itemid, $destCatid);\r
1182                 return;\r
1183         }\r
1184         \r
1185         /**\r
1186          * Admin::action_additem()\r
1187          * Adds a item to the chosen blog\r
1188          * \r
1189          * @param       void\r
1190          * @return      void\r
1191          */\r
1192         static private function action_additem()\r
1193         {\r
1194                 global $manager, $CONF;\r
1195                 \r
1196                 $manager->loadClass('ITEM');\r
1197                 \r
1198                 $result = Item::createFromRequest();\r
1199                 \r
1200                 if ( $result['status'] == 'error' )\r
1201                 {\r
1202                         self::error($result['message']);\r
1203                 }\r
1204                 \r
1205                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1206                 \r
1207                 if ( $result['status'] == 'newcategory' )\r
1208                 {\r
1209                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1210                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1211                 }\r
1212                 else\r
1213                 {\r
1214                         $methodName = 'action_itemlist';\r
1215                         self::action_itemlist($item['blogid']);\r
1216                 }\r
1217                 return;\r
1218         }\r
1219         \r
1220         /**\r
1221          * Admin::action_commentedit()\r
1222          * Allows to edit previously made comments\r
1223          * \r
1224          * @param       void\r
1225          * @return      void\r
1226          */\r
1227         static private function action_commentedit()\r
1228         {\r
1229                 global $member, $manager;\r
1230                 \r
1231                 $commentid = intRequestVar('commentid');\r
1232                 \r
1233                 $member->canAlterComment($commentid) or self::disallow();\r
1234                 \r
1235                 $comment = COMMENT::getComment($commentid);\r
1236                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));\r
1237                 \r
1238                 Admin::$contents = $comment;\r
1239                 self::$skin->parse('commentedit');\r
1240                 return;\r
1241         }\r
1242         \r
1243         /**\r
1244          * Admin::action_commentupdate()\r
1245          * \r
1246          * @param       void\r
1247          * @return      void\r
1248          */\r
1249         static private function action_commentupdate()\r
1250         {\r
1251                 global $member, $manager;\r
1252                 \r
1253                 $commentid = intRequestVar('commentid');\r
1254                 \r
1255                 $member->canAlterComment($commentid) or self::disallow();\r
1256                 \r
1257                 $url    = postVar('url');\r
1258                 $email  = postVar('email');\r
1259                 $body   = postVar('body');\r
1260                 \r
1261                 // intercept words that are too long\r
1262                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1263                 {\r
1264                         self::error(_ERROR_COMMENT_LONGWORD);\r
1265                 }\r
1266                 \r
1267                 // check length\r
1268                 if ( i18n::strlen($body) < 3 )\r
1269                 {\r
1270                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1271                 }\r
1272                 \r
1273                 if ( i18n::strlen($body) > 5000 )\r
1274                 {\r
1275                         self::error(_ERROR_COMMENT_TOOLONG);\r
1276                 }\r
1277                 \r
1278                 // prepare body\r
1279                 $body = Comment::prepareBody($body);\r
1280                 \r
1281                 // call plugins\r
1282                 $data = array(\r
1283                         'body' => &$body\r
1284                 );\r
1285                 $manager->notify('PreUpdateComment', $data);\r
1286                 \r
1287                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1288                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1289                 DB::execute($query);\r
1290                 \r
1291                 // get itemid\r
1292                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1293                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1294                 \r
1295                 $itemid = DB::getValue($query);\r
1296                 \r
1297                 if ( $member->canAlterItem($itemid) )\r
1298                 {\r
1299                         self::action_itemcommentlist($itemid);\r
1300                 }\r
1301                 else\r
1302                 {\r
1303                         self::action_browseowncomments();\r
1304                 }\r
1305                 return;\r
1306         }\r
1307         \r
1308         /**\r
1309          * Admin::action_commentdelete()\r
1310          * Update comment\r
1311          * \r
1312          * @param       void\r
1313          * @return      void\r
1314          */\r
1315         static private function action_commentdelete()\r
1316         {\r
1317                 global $member, $manager;\r
1318                 \r
1319                 $commentid = intRequestVar('commentid');\r
1320                 $member->canAlterComment($commentid) or self::disallow();\r
1321                 \r
1322                 self::$skin->parse('commentdelete');\r
1323                 return;\r
1324         }\r
1325         \r
1326         /**\r
1327          * Admin::action_commentdeleteconfirm()\r
1328          * \r
1329          * @param       void\r
1330          * @return      void\r
1331          */\r
1332         static private function action_commentdeleteconfirm()\r
1333         {\r
1334                 global $member;\r
1335                 \r
1336                 $commentid = intRequestVar('commentid');\r
1337                 \r
1338                 // get item id first\r
1339                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1340                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1341                 \r
1342                 $itemid = DB::getValue($query);\r
1343                 \r
1344                 $error = self::deleteOneComment($commentid);\r
1345                 if ( $error )\r
1346                 {\r
1347                         self::doError($error);\r
1348                 }\r
1349                 \r
1350                 if ( $member->canAlterItem($itemid) )\r
1351                 {\r
1352                         self::action_itemcommentlist($itemid);\r
1353                 }\r
1354                 else\r
1355                 {\r
1356                         self::action_browseowncomments();\r
1357                 }\r
1358                 return;\r
1359         }\r
1360         \r
1361         /**\r
1362          * Admin::deleteOneComment()\r
1363          * \r
1364          * @param       integer $commentid      ID for comment\r
1365          * @return      void\r
1366          */\r
1367         static public function deleteOneComment($commentid)\r
1368         {\r
1369                 global $member, $manager;\r
1370                 \r
1371                 $commentid = (integer) $commentid;\r
1372                 \r
1373                 if ( !$member->canAlterComment($commentid) )\r
1374                 {\r
1375                         return _ERROR_DISALLOWED;\r
1376                 }\r
1377                 \r
1378                 $data = array(\r
1379                         'commentid' => $commentid\r
1380                 );\r
1381                 \r
1382                 $manager->notify('PreDeleteComment', $data);\r
1383                 \r
1384                 // delete the comments associated with the item\r
1385                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1386                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1387                 DB::execute($query);\r
1388                 \r
1389                 $data = array(\r
1390                         'commentid' => $commentid\r
1391                 );\r
1392                 \r
1393                 $manager->notify('PostDeleteComment', $data);\r
1394                 \r
1395                 return '';\r
1396         }\r
1397         \r
1398         /**\r
1399          * Admin::action_usermanagement()\r
1400          * Usermanagement main\r
1401          * \r
1402          * @param       void\r
1403          * @return      void\r
1404          */\r
1405         static private function action_usermanagement()\r
1406         {\r
1407                 global $member, $manager;\r
1408                 \r
1409                 // check if allowed\r
1410                 $member->isAdmin() or self::disallow();\r
1411                 \r
1412                 self::$skin->parse('usermanagement');\r
1413                 return;\r
1414         }\r
1415         \r
1416         /**\r
1417          * Admin::action_memberedit()\r
1418          * Edit member settings\r
1419          * \r
1420          * @param       void\r
1421          * @return      void\r
1422          */\r
1423         static private function action_memberedit()\r
1424         {\r
1425                 self::action_editmembersettings(intRequestVar('memberid'));\r
1426                 return;\r
1427         }\r
1428         \r
1429         /**\r
1430          * Admin::action_editmembersettings()\r
1431          * \r
1432          * @param       integer $memberid       ID for member\r
1433          * @return      void\r
1434          * \r
1435          */\r
1436         static private function action_editmembersettings($memberid = '')\r
1437         {\r
1438                 global $member, $manager, $CONF;\r
1439                 \r
1440                 if ( $memberid == '' )\r
1441                 {\r
1442                         $memberid = $member->getID();\r
1443                 }\r
1444                 \r
1445                 /* TODO: we should consider to use the other way insterad of this */\r
1446                 $_REQUEST['memberid'] = $memberid;\r
1447                 \r
1448                 // check if allowed\r
1449                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1450                 \r
1451                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
1452                 \r
1453                 self::$skin->parse('editmembersettings');\r
1454                 return;\r
1455         }\r
1456         \r
1457         /**\r
1458          * Admin::action_changemembersettings()\r
1459          * \r
1460          * @param       void\r
1461          * @return      void\r
1462          */\r
1463         static private function action_changemembersettings()\r
1464         {\r
1465                 global $member, $CONF, $manager;\r
1466                 \r
1467                 $memberid = intRequestVar('memberid');\r
1468                 \r
1469                 // check if allowed\r
1470                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1471                 \r
1472                 $name                   = trim(strip_tags(postVar('name')));\r
1473                 $realname               = trim(strip_tags(postVar('realname')));\r
1474                 $password               = postVar('password');\r
1475                 $repeatpassword = postVar('repeatpassword');\r
1476                 $email                  = strip_tags(postVar('email'));\r
1477                 $url                    = strip_tags(postVar('url'));\r
1478                 $adminskin              = intPostVar('adminskin');\r
1479                 $bookmarklet    = intPostVar('bookmarklet');\r
1480                 \r
1481                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1482                 if ( !preg_match('#^https?://#', $url) )\r
1483                 {\r
1484                         $url = 'http://' . $url;\r
1485                 }\r
1486                 \r
1487                 $admin          = postVar('admin');\r
1488                 $canlogin       = postVar('canlogin');\r
1489                 $notes          = strip_tags(postVar('notes'));\r
1490                 $locale         = postVar('locale');\r
1491                 \r
1492                 $mem =& $manager->getMember($memberid);\r
1493                 \r
1494                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1495                 {\r
1496                         if ( !isValidDisplayName($name) )\r
1497                         {\r
1498                                 self::error(_ERROR_BADNAME);\r
1499                         }\r
1500                         \r
1501                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1502                         {\r
1503                                 self::error(_ERROR_NICKNAMEINUSE);\r
1504                         }\r
1505                         \r
1506                         if ( $password != $repeatpassword )\r
1507                         {\r
1508                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1509                         }\r
1510                         \r
1511                         if ( $password && (i18n::strlen($password) < 6) )\r
1512                         {\r
1513                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1514                         }\r
1515                                 \r
1516                         if ( $password )\r
1517                         {\r
1518                                 $pwdvalid = true;\r
1519                                 $pwderror = '';\r
1520                                 \r
1521                                 $data = array(\r
1522                                         'password'     => $password,\r
1523                                         'errormessage' => &$pwderror,\r
1524                                         'valid'        => &$pwdvalid\r
1525                                 );\r
1526                                 $manager->notify('PrePasswordSet', $data);\r
1527                                 \r
1528                                 if ( !$pwdvalid )\r
1529                                 {\r
1530                                         self::error($pwderror);\r
1531                                 }\r
1532                         }\r
1533                 }\r
1534                 \r
1535                 if ( !NOTIFICATION::address_validation($email) )\r
1536                 {\r
1537                         self::error(_ERROR_BADMAILADDRESS);\r
1538                 }\r
1539                 if ( !$realname )\r
1540                 {\r
1541                         self::error(_ERROR_REALNAMEMISSING);\r
1542                 }\r
1543                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1544                 {\r
1545                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1546                 }\r
1547                 \r
1548                 // check if there will remain at least one site member with both the logon and admin rights\r
1549                 // (check occurs when taking away one of these rights from such a member)\r
1550                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1551                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1552                         )\r
1553                 {\r
1554                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1555                         if ( $r->rowCount() < 2 )\r
1556                         {\r
1557                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1558                         }\r
1559                 }\r
1560                 \r
1561                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1562                 {\r
1563                         $mem->setDisplayName($name);\r
1564                         if ( $password )\r
1565                         {\r
1566                                 $mem->setPassword($password);\r
1567                         }\r
1568                 }\r
1569                 \r
1570                 $oldEmail = $mem->getEmail();\r
1571                 \r
1572                 $mem->setRealName($realname);\r
1573                 $mem->setEmail($email);\r
1574                 $mem->setURL($url);\r
1575                 $mem->setNotes($notes);\r
1576                 $mem->setLocale($locale);\r
1577                 $mem->setAdminSkin($adminskin);\r
1578                 $mem->setBookmarklet($bookmarklet);\r
1579 \r
1580                 // only allow super-admins to make changes to the admin status\r
1581                 if ( $member->isAdmin() )\r
1582                 {\r
1583                         $mem->setAdmin($admin);\r
1584                         $mem->setCanLogin($canlogin);\r
1585                 }\r
1586                 \r
1587                 $autosave = postVar('autosave');\r
1588                 $mem->setAutosave($autosave);\r
1589                 \r
1590                 $mem->write();\r
1591                 \r
1592                 // store plugin options\r
1593                 $aOptions = requestArray('plugoption');\r
1594                 NucleusPlugin::apply_plugin_options($aOptions);\r
1595                 $data = array(\r
1596                         'context'  => 'member',\r
1597                         'memberid' => $memberid,\r
1598                         'member'   => &$mem\r
1599                 );\r
1600                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1601                 \r
1602                 // if email changed, generate new password\r
1603                 if ( $oldEmail != $mem->getEmail() )\r
1604                 {\r
1605                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1606                         // logout member\r
1607                         $mem->newCookieKey();\r
1608                         \r
1609                         // only log out if the member being edited is the current member.\r
1610                         if ( $member->getID() == $memberid )\r
1611                         {\r
1612                                 $member->logout();\r
1613                         }\r
1614                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1615                         return;\r
1616                 }\r
1617                 \r
1618                 if ( ($mem->getID() == $member->getID())\r
1619                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1620                 {\r
1621                         $mem->newCookieKey();\r
1622                         $member->logout();\r
1623                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1624                 }\r
1625                 else\r
1626                 {\r
1627                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1628                 }\r
1629                 return;\r
1630         }\r
1631 \r
1632         /**\r
1633          * Admin::action_memberadd()\r
1634          * \r
1635          * @param       void\r
1636          * @return      void\r
1637          * \r
1638          */\r
1639         static private function action_memberadd()\r
1640         {\r
1641                 global $member, $manager;\r
1642                 \r
1643                 // check if allowed\r
1644                 $member->isAdmin() or self::disallow();\r
1645                 \r
1646                 if ( postVar('password') != postVar('repeatpassword') )\r
1647                 {\r
1648                         self::error(_ERROR_PASSWORDMISMATCH);\r
1649                 }\r
1650                 \r
1651                 if ( i18n::strlen(postVar('password')) < 6 )\r
1652                 {\r
1653                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1654                 }\r
1655                 \r
1656                 $res = Member::create(\r
1657                         postVar('name'),\r
1658                         postVar('realname'),\r
1659                         postVar('password'),\r
1660                         postVar('email'),\r
1661                         postVar('url'),\r
1662                         postVar('admin'),\r
1663                         postVar('canlogin'),\r
1664                         postVar('notes')\r
1665                 );\r
1666                 \r
1667                 if ( $res != 1 )\r
1668                 {\r
1669                         self::error($res);\r
1670                 }\r
1671                 \r
1672                 // fire PostRegister event\r
1673                 $newmem = new Member();\r
1674                 $newmem->readFromName(postVar('name'));\r
1675                 $data = array(\r
1676                         'member' => &$newmem\r
1677                 );\r
1678                 $manager->notify('PostRegister', $data);\r
1679                 \r
1680                 self::action_usermanagement();\r
1681                 return;\r
1682         }\r
1683         \r
1684         /**\r
1685          * Admin::action_forgotpassword()\r
1686          * \r
1687          * @param       void\r
1688          * @return      void\r
1689          */\r
1690         static private function action_forgotpassword()\r
1691         {\r
1692                 self::$skin->parse('forgotpassword');\r
1693                 return;\r
1694         }\r
1695         \r
1696         /**\r
1697          * Admin::action_activate()\r
1698          * Account activation\r
1699          * \r
1700          * @param       void\r
1701          * @return      void\r
1702          */\r
1703         static private function action_activate()\r
1704         {\r
1705                 $key = getVar('key');\r
1706                 self::showActivationPage($key);\r
1707                 return;\r
1708         }\r
1709         \r
1710         /**\r
1711          * Admin::showActivationPage()\r
1712          * \r
1713          * @param       void\r
1714          * @return      void\r
1715          */\r
1716         static private function showActivationPage($key, $message = '')\r
1717         {\r
1718                 global $manager;\r
1719                 \r
1720                 // clean up old activation keys\r
1721                 Member::cleanupActivationTable();\r
1722                 \r
1723                 // get activation info\r
1724                 $info = Member::getActivationInfo($key);\r
1725                 \r
1726                 if ( !$info )\r
1727                 {\r
1728                         self::error(_ERROR_ACTIVATE);\r
1729                 }\r
1730                 \r
1731                 $mem =& $manager->getMember($info->vmember);\r
1732                 \r
1733                 if ( !$mem )\r
1734                 {\r
1735                         self::error(_ERROR_ACTIVATE);\r
1736                 }\r
1737                 \r
1738                 /* TODO: we should consider to use the other way insterad of this */\r
1739                 $_POST['ackey']                                 = $key;\r
1740                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1741                 \r
1742                 self::$headMess = $message;\r
1743                 self::$skin->parse('activate');\r
1744                 return;\r
1745         }\r
1746         \r
1747         /**\r
1748          * Admin::action_activatesetpwd()\r
1749          * Account activation - set password part\r
1750          * \r
1751          * @param       void\r
1752          * @return      void\r
1753          */\r
1754         static private function action_activatesetpwd()\r
1755         {\r
1756                 global $manager;\r
1757                 $key = postVar('key');\r
1758                 \r
1759                 // clean up old activation keys\r
1760                 Member::cleanupActivationTable();\r
1761                 \r
1762                 // get activation info\r
1763                 $info = Member::getActivationInfo($key);\r
1764                 \r
1765                 if ( !$info || ($info->type == 'addresschange') )\r
1766                 {\r
1767                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1768                 }\r
1769                 \r
1770                 $mem =& $manager->getMember($info->vmember);\r
1771                 \r
1772                 if ( !$mem )\r
1773                 {\r
1774                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1775                 }\r
1776                 \r
1777                 $password               = postVar('password');\r
1778                 $repeatpassword = postVar('repeatpassword');\r
1779                 \r
1780                 if ( $password != $repeatpassword )\r
1781                 {\r
1782                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1783                 }\r
1784                 \r
1785                 if ( $password && (i18n::strlen($password) < 6) )\r
1786                 {\r
1787                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1788                 }\r
1789                         \r
1790                 if ( $password )\r
1791                 {\r
1792                         $pwdvalid = true;\r
1793                         $pwderror = '';\r
1794                         \r
1795                         $data = array(\r
1796                                 'password'              => $password,\r
1797                                 'errormessage'  => &$pwderror,\r
1798                                 'valid'                 => &$pwdvalid\r
1799                         );\r
1800                         $manager->notify('PrePasswordSet', $data);\r
1801                         if ( !$pwdvalid )\r
1802                         {\r
1803                                 return self::showActivationPage($key,$pwderror);\r
1804                         }\r
1805                 }\r
1806                 \r
1807                 $error = '';\r
1808                 \r
1809                 $data = array(\r
1810                         'type'   => 'activation',\r
1811                         'member' => $mem,\r
1812                         'error'  => &$error\r
1813                 );\r
1814                 $manager->notify('ValidateForm', $data);\r
1815                 if ( $error != '' )\r
1816                 {\r
1817                         return self::showActivationPage($key, $error);\r
1818                 }\r
1819                 \r
1820                 // set password\r
1821                 $mem->setPassword($password);\r
1822                 $mem->write();\r
1823                 \r
1824                 // do the activation\r
1825                 Member::activate($key);\r
1826                 \r
1827                 self::$skin->parse('activatesetpwd');\r
1828                 return;\r
1829         }\r
1830         \r
1831         /**\r
1832          * Admin::action_manageteam()\r
1833          * Manage team\r
1834          * \r
1835          * @param       void\r
1836          * @return      void\r
1837          */\r
1838         static private function action_manageteam()\r
1839         {\r
1840                 global $member, $manager;\r
1841                 \r
1842                 $blogid = intRequestVar('blogid');\r
1843                 \r
1844                 // check if allowed\r
1845                 $member->blogAdminRights($blogid) or self::disallow();\r
1846                 \r
1847                 self::$skin->parse('manageteam');\r
1848                 return;\r
1849         }\r
1850         \r
1851         /**\r
1852          * Admin::action_teamaddmember()\r
1853          * Add member to team\r
1854          * \r
1855          * @param       void\r
1856          * @return      void\r
1857          */\r
1858         static private function action_teamaddmember()\r
1859         {\r
1860                 global $member, $manager;\r
1861                 \r
1862                 $memberid       = intPostVar('memberid');\r
1863                 $blogid         = intPostVar('blogid');\r
1864                 $admin          = intPostVar('admin');\r
1865                 \r
1866                 // check if allowed\r
1867                 $member->blogAdminRights($blogid) or self::disallow();\r
1868                 \r
1869                 $blog =& $manager->getBlog($blogid);\r
1870                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1871                 {\r
1872                         self::error(_ERROR_ALREADYONTEAM);\r
1873                 }\r
1874                 \r
1875                 self::action_manageteam();\r
1876                 return;\r
1877         }\r
1878         \r
1879         /**\r
1880          * Admin::action_teamdelete()\r
1881          * \r
1882          * @param       void\r
1883          * @return      void\r
1884          */\r
1885         static private function action_teamdelete()\r
1886         {\r
1887                 global $member, $manager;\r
1888                 \r
1889                 $memberid       = intRequestVar('memberid');\r
1890                 $blogid         = intRequestVar('blogid');\r
1891                 \r
1892                 // check if allowed\r
1893                 $member->blogAdminRights($blogid) or self::disallow();\r
1894                 \r
1895                 $teammem =& $manager->getMember($memberid);\r
1896                 $blog =& $manager->getBlog($blogid);\r
1897                 \r
1898                 self::$skin->parse('teamdelete');\r
1899                 return;\r
1900         }\r
1901         \r
1902         /**\r
1903          * Admin::action_teamdeleteconfirm()\r
1904          * \r
1905          * @param       void\r
1906          * @return      void\r
1907          */\r
1908         static private function action_teamdeleteconfirm()\r
1909         {\r
1910                 global $member;\r
1911                 \r
1912                 $memberid = intRequestVar('memberid');\r
1913                 $blogid = intRequestVar('blogid');\r
1914                 \r
1915                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1916                 if ( $error )\r
1917                 {\r
1918                         self::error($error);\r
1919                 }\r
1920                 self::action_manageteam();\r
1921                 return;\r
1922         }\r
1923         \r
1924         /**\r
1925          * Admin::deleteOneTeamMember()\r
1926          * \r
1927          * @param       void\r
1928          * @return      void\r
1929          */\r
1930         static public function deleteOneTeamMember($blogid, $memberid)\r
1931         {\r
1932                 global $member, $manager;\r
1933                 \r
1934                 $blogid   = intval($blogid);\r
1935                 $memberid = intval($memberid);\r
1936                 \r
1937                 // check if allowed\r
1938                 if ( !$member->blogAdminRights($blogid) )\r
1939                 {\r
1940                         return _ERROR_DISALLOWED;\r
1941                 }\r
1942                 \r
1943                 // check if: - there remains at least one blog admin\r
1944                 //           - (there remains at least one team member)\r
1945                 $tmem =& $manager->getMember($memberid);\r
1946                 \r
1947                 \r
1948                 $data = array(\r
1949                         'member' => &$tmem,\r
1950                         'blogid' => $blogid\r
1951                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1952                 \r
1953                 if ( $tmem->isBlogAdmin($blogid) )\r
1954                 {\r
1955                         /* TODO: why we did double check? */\r
1956                         // check if there are more blog members left and at least one admin\r
1957                         // (check for at least two admins before deletion)\r
1958                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1959                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1960                         $r     = DB::getResult($query);\r
1961                         if ( $r->rowCount() < 2 )\r
1962                         {\r
1963                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1964                         }\r
1965                 }\r
1966                 \r
1967                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1968                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1969                 DB::execute($query);\r
1970                 \r
1971                 $data = array(\r
1972                         'member' => &$tmem,\r
1973                         'blogid' => $blogid\r
1974                 );\r
1975                 $manager->notify('PostDeleteTeamMember', $data);\r
1976                 \r
1977                 return '';\r
1978         }\r
1979         \r
1980         /**\r
1981          * Admin::action_teamchangeadmin()\r
1982          * \r
1983          * @param       void\r
1984          * @return      void\r
1985          */\r
1986         static private function action_teamchangeadmin()\r
1987         {\r
1988                 global $manager, $member;\r
1989                 \r
1990                 $blogid         = intRequestVar('blogid');\r
1991                 $memberid       = intRequestVar('memberid');\r
1992                 \r
1993                 // check if allowed\r
1994                 $member->blogAdminRights($blogid) or self::disallow();\r
1995                 \r
1996                 $mem =& $manager->getMember($memberid);\r
1997                 \r
1998                 // don't allow when there is only one admin at this moment\r
1999                 if ( $mem->isBlogAdmin($blogid) )\r
2000                 {\r
2001                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2002                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2003                         $r = DB::getResult($query);\r
2004                         if ( $r->rowCount() == 1 )\r
2005                         {\r
2006                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2007                         }\r
2008                 }\r
2009                 \r
2010                 if ( $mem->isBlogAdmin($blogid) )\r
2011                 {\r
2012                         $newval = 0;\r
2013                 }\r
2014                 else\r
2015                 {\r
2016                         $newval = 1;\r
2017                 }\r
2018                 \r
2019                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2020                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2021                 DB::execute($query);\r
2022                 \r
2023                 // only show manageteam if member did not change its own admin privileges\r
2024                 if ( $member->isBlogAdmin($blogid) )\r
2025                 {\r
2026                         self::action_manageteam();\r
2027                 }\r
2028                 else\r
2029                 {\r
2030                         self::action_overview(_MSG_ADMINCHANGED);\r
2031                 }\r
2032                 return;\r
2033         }\r
2034         \r
2035         /**\r
2036          * Admin::action_blogsettings()\r
2037          * \r
2038          * @param       void\r
2039          * @return      void\r
2040          */\r
2041         static private function action_blogsettings()\r
2042         {\r
2043                 global $member, $manager;\r
2044                 \r
2045                 $blogid = intRequestVar('blogid');\r
2046                 \r
2047                 // check if allowed\r
2048                 $member->blogAdminRights($blogid) or self::disallow();\r
2049                 \r
2050                 $blog =& $manager->getBlog($blogid);\r
2051                 \r
2052                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2053                 \r
2054                 self::$skin->parse('blogsettings');\r
2055                 return;\r
2056         }\r
2057         \r
2058         /**\r
2059          * Admin::action_categorynew()\r
2060          * \r
2061          * @param       void\r
2062          * @return      void\r
2063          */\r
2064         static private function action_categorynew()\r
2065         {\r
2066                 global $member, $manager;\r
2067                 \r
2068                 $blogid = intRequestVar('blogid');\r
2069                 \r
2070                 $member->blogAdminRights($blogid) or self::disallow();\r
2071                 \r
2072                 $cname = postVar('cname');\r
2073                 $cdesc = postVar('cdesc');\r
2074                 \r
2075                 if ( !isValidCategoryName($cname) )\r
2076                 {\r
2077                         self::error(_ERROR_BADCATEGORYNAME);\r
2078                 }\r
2079                 \r
2080                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2081                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2082                 $res = DB::getResult($query);\r
2083                 if ( $res->rowCount() > 0 )\r
2084                 {\r
2085                         self::error(_ERROR_DUPCATEGORYNAME);\r
2086                 }\r
2087                 \r
2088                 $blog           =& $manager->getBlog($blogid);\r
2089                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2090                 \r
2091                 self::action_blogsettings();\r
2092                 return;\r
2093         }\r
2094         \r
2095         /**\r
2096          * Admin::action_categoryedit()\r
2097          * \r
2098          * @param       void\r
2099          * @return      void\r
2100          */\r
2101         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2102         {\r
2103                 global $member, $manager;\r
2104                 \r
2105                 if ( $blogid == '' )\r
2106                 {\r
2107                         $blogid = intGetVar('blogid');\r
2108                 }\r
2109                 else\r
2110                 {\r
2111                         $blogid = intval($blogid);\r
2112                 }\r
2113                 if ( $catid == '' )\r
2114                 {\r
2115                         $catid = intGetVar('catid');\r
2116                 }\r
2117                 else\r
2118                 {\r
2119                         $catid = intval($catid);\r
2120                 }\r
2121                 \r
2122                 /* TODO: we should consider to use the other way insterad of this */\r
2123                 $_REQUEST['blogid']             = $blogid;\r
2124                 $_REQUEST['catid']              = $catid;\r
2125                 $_REQUEST['desturl']    = $desturl;\r
2126                 $member->blogAdminRights($blogid) or self::disallow();\r
2127                 \r
2128                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2129                 \r
2130                 self::$skin->parse('categoryedit');\r
2131                 return;\r
2132         }\r
2133         \r
2134         /**\r
2135          * Admin::action_categoryupdate()\r
2136          * \r
2137          * @param       void\r
2138          * @return      void\r
2139          */\r
2140         static private function action_categoryupdate()\r
2141         {\r
2142                 global $member, $manager;\r
2143                 \r
2144                 $blogid         = intPostVar('blogid');\r
2145                 $catid          = intPostVar('catid');\r
2146                 $cname          = postVar('cname');\r
2147                 $cdesc          = postVar('cdesc');\r
2148                 $desturl        = postVar('desturl');\r
2149                 \r
2150                 $member->blogAdminRights($blogid) or self::disallow();\r
2151                 \r
2152                 if ( !isValidCategoryName($cname) )\r
2153                 {\r
2154                         self::error(_ERROR_BADCATEGORYNAME);\r
2155                 }\r
2156                 \r
2157                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2158                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2159                 $res    = DB::getResult($query);\r
2160                 if ( $res->rowCount() > 0 )\r
2161                 {\r
2162                         self::error(_ERROR_DUPCATEGORYNAME);\r
2163                 }\r
2164                 \r
2165                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2166                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2167                 DB::execute($query);\r
2168                 \r
2169                 // store plugin options\r
2170                 $aOptions = requestArray('plugoption');\r
2171                 NucleusPlugin::apply_plugin_options($aOptions);\r
2172                 $data = array(\r
2173                         'context'       => 'category',\r
2174                         'catid'         => $catid\r
2175                 );\r
2176                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2177                 \r
2178                 if ( $desturl )\r
2179                 {\r
2180                         redirect($desturl);\r
2181                         exit;\r
2182                 }\r
2183                 else\r
2184                 {\r
2185                         self::action_blogsettings();\r
2186                 }\r
2187                 return;\r
2188         }\r
2189         \r
2190         /**\r
2191          * Admin::action_categorydelete()\r
2192          * \r
2193          * @param       void\r
2194          * @return      void\r
2195          */\r
2196         static private function action_categorydelete()\r
2197         {\r
2198                 global $member, $manager;\r
2199                 \r
2200                 $blogid = intRequestVar('blogid');\r
2201                 $catid  = intRequestVar('catid');\r
2202                 \r
2203                 $member->blogAdminRights($blogid) or self::disallow();\r
2204                 \r
2205                 $blog =& $manager->getBlog($blogid);\r
2206                 \r
2207                 // check if the category is valid\r
2208                 if ( !$blog->isValidCategory($catid) )\r
2209                 {\r
2210                         self::error(_ERROR_NOSUCHCATEGORY);\r
2211                 }\r
2212                 \r
2213                 // don't allow deletion of default category\r
2214                 if ( $blog->getDefaultCategory() == $catid )\r
2215                 {\r
2216                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2217                 }\r
2218                 \r
2219                 // check if catid is the only category left for blogid\r
2220                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2221                 $query = sprintf($query, sql_table('category'), $blogid);\r
2222                 $res = DB::getResult($query);\r
2223                 if ( $res->rowCount() == 1 )\r
2224                 {\r
2225                         self::error(_ERROR_DELETELASTCATEGORY);\r
2226                 }\r
2227                 \r
2228                 self::$skin->parse('categorydelete');\r
2229                 return;\r
2230         }\r
2231         \r
2232         /**\r
2233          * Admin::action_categorydeleteconfirm()\r
2234          * \r
2235          * @param       void\r
2236          * @return      void\r
2237          */\r
2238         static private function action_categorydeleteconfirm()\r
2239         {\r
2240                 global $member, $manager;\r
2241                 \r
2242                 $blogid = intRequestVar('blogid');\r
2243                 $catid  = intRequestVar('catid');\r
2244                 \r
2245                 $member->blogAdminRights($blogid) or self::disallow();\r
2246                 \r
2247                 $error = self::deleteOneCategory($catid);\r
2248                 if ( $error )\r
2249                 {\r
2250                         self::error($error);\r
2251                 }\r
2252                 \r
2253                 self::action_blogsettings();\r
2254                 return;\r
2255         }\r
2256         \r
2257         /**\r
2258          * Admin::deleteOneCategory()\r
2259          * Delete a category by its id\r
2260          * \r
2261          * @param       String  $catid  category id for deleting\r
2262          * @return      Void\r
2263          */\r
2264         static public function deleteOneCategory($catid)\r
2265         {\r
2266                 global $manager, $member;\r
2267                 \r
2268                 $catid  = intval($catid);\r
2269                 $blogid = getBlogIDFromCatID($catid);\r
2270                 \r
2271                 if ( !$member->blogAdminRights($blogid) )\r
2272                 {\r
2273                         return ERROR_DISALLOWED;\r
2274                 }\r
2275                 \r
2276                 // get blog\r
2277                 $blog =& $manager->getBlog($blogid);\r
2278                 \r
2279                 // check if the category is valid\r
2280                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2281                 {\r
2282                         return _ERROR_NOSUCHCATEGORY;\r
2283                 }\r
2284                 \r
2285                 $destcatid = $blog->getDefaultCategory();\r
2286                 \r
2287                 // don't allow deletion of default category\r
2288                 if ( $blog->getDefaultCategory() == $catid )\r
2289                 {\r
2290                         return _ERROR_DELETEDEFCATEGORY;\r
2291                 }\r
2292                 \r
2293                 // check if catid is the only category left for blogid\r
2294                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2295                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2296                 \r
2297                 $res = DB::getResult($query);\r
2298                 if ( $res->rowCount() == 1 )\r
2299                 {\r
2300                         return _ERROR_DELETELASTCATEGORY;\r
2301                 }\r
2302                 \r
2303                 $data = array('catid' => $catid);\r
2304                 $manager->notify('PreDeleteCategory', $data);\r
2305                 \r
2306                 // change category for all items to the default category\r
2307                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2308                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2309                 DB::execute($query);\r
2310                 \r
2311                 // delete all associated plugin options\r
2312                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2313                 \r
2314                 // delete category\r
2315                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2316                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2317                 DB::execute($query);\r
2318                 \r
2319                 $data = array('catid' => $catid);\r
2320                 $manager->notify('PostDeleteCategory', $data);\r
2321                 return;\r
2322         }\r
2323         \r
2324         /**\r
2325          * Admin::moveOneCategory()\r
2326          * Delete a category by its id\r
2327          * \r
2328          * @param       int     $catid          category id for move\r
2329          * @param       int     $destblogid     blog id for destination\r
2330          * @return      void\r
2331          */\r
2332         static public function moveOneCategory($catid, $destblogid)\r
2333         {\r
2334                 global $manager, $member;\r
2335                 $catid      = intval($catid);\r
2336                 $destblogid = intval($destblogid);\r
2337                 $blogid     = getBlogIDFromCatID($catid);\r
2338                 // mover should have admin rights on both blogs\r
2339                 if (!$member->blogAdminRights($blogid)) {\r
2340                         return _ERROR_DISALLOWED;\r
2341                 }\r
2342                 if (!$member->blogAdminRights($destblogid)) {\r
2343                         return _ERROR_DISALLOWED;\r
2344                 }\r
2345                 // cannot move to self\r
2346                 if ($blogid == $destblogid) {\r
2347                         return _ERROR_MOVETOSELF;\r
2348                 }\r
2349                 // get blogs\r
2350                 $blog     =& $manager->getBlog($blogid);\r
2351                 $destblog =& $manager->getBlog($destblogid);\r
2352                 // check if the category is valid\r
2353                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2354                         return _ERROR_NOSUCHCATEGORY;\r
2355                 }\r
2356                 // don't allow default category to be moved\r
2357                 if ($blog->getDefaultCategory() == $catid) {\r
2358                         return _ERROR_MOVEDEFCATEGORY;\r
2359                 }\r
2360                 $manager->notify(\r
2361                                 'PreMoveCategory',\r
2362                                 array(\r
2363                                                 'catid'      => &$catid,\r
2364                                                 'sourceblog' => &$blog,\r
2365                                                 'destblog'   => &$destblog\r
2366                                 )\r
2367                 );\r
2368                 // update comments table (cblog)\r
2369                 $query = 'SELECT '\r
2370                 . '    inumber '\r
2371                 . 'FROM '\r
2372                 .      sql_table('item') . ' '\r
2373                 . 'WHERE '\r
2374                 . '    icat = %d';\r
2375                 $items = sql_query(sprintf($query, $catid));\r
2376                 while ($oItem = sql_fetch_object($items)) {\r
2377                         $query = 'UPDATE '\r
2378                         .      sql_table('comment') . ' '\r
2379                         . 'SET '\r
2380                         . '    cblog = %d' . ' '\r
2381                         . 'WHERE '\r
2382                         . '    citem = %d';\r
2383                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2384                 }\r
2385         \r
2386                 // update items (iblog)\r
2387                 $query = 'UPDATE '\r
2388                 .      sql_table('item') . ' '\r
2389                 . 'SET '\r
2390                 . '    iblog = %d '\r
2391                 . 'WHERE '\r
2392                 . '    icat = %d';\r
2393                 sql_query(sprintf($query, $destblogid, $catid));\r
2394         \r
2395                 // move category\r
2396                 $query = 'UPDATE '\r
2397                 .      sql_table('category') . ' '\r
2398                 . 'SET '\r
2399                 . '    cblog = %d' . ' '\r
2400                 . 'WHERE '\r
2401                 . '    catid = %d';\r
2402                 sql_query(sprintf($query, $destblogid, $catid));\r
2403                 $manager->notify(\r
2404                                 'PostMoveCategory',\r
2405                                 array(\r
2406                                                 'catid'      => &$catid,\r
2407                                                 'sourceblog' => &$blog,\r
2408                                                 'destblog'   => $destblog\r
2409                                 )\r
2410                 );\r
2411                 return;\r
2412         }\r
2413 \r
2414         /**\r
2415          * Admin::action_blogsettingsupdate\r
2416          * Updating blog settings\r
2417          * \r
2418          * @param       Void\r
2419          * @return      Void\r
2420          */\r
2421         static private function action_blogsettingsupdate()\r
2422         {\r
2423                 global $member, $manager;\r
2424                 \r
2425                 $blogid = intRequestVar('blogid');\r
2426                 \r
2427                 $member->blogAdminRights($blogid) or self::disallow();\r
2428                 \r
2429                 $blog =& $manager->getBlog($blogid);\r
2430                 \r
2431                 $notify_address = trim(postVar('notify'));\r
2432                 $shortname              = trim(postVar('shortname'));\r
2433                 $updatefile             = trim(postVar('update'));\r
2434                 \r
2435                 $notifyComment  = intPostVar('notifyComment');\r
2436                 $notifyVote             = intPostVar('notifyVote');\r
2437                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2438                 \r
2439                 if ( $notifyComment == 0 )\r
2440                 {\r
2441                         $notifyComment = 1;\r
2442                 }\r
2443                 if ( $notifyVote == 0 )\r
2444                 {\r
2445                         $notifyVote = 1;\r
2446                 }\r
2447                 if ( $notifyNewItem == 0 )\r
2448                 {\r
2449                         $notifyNewItem = 1;\r
2450                 }\r
2451                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2452                 \r
2453                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2454                 {\r
2455                         self::error(_ERROR_BADNOTIFY);\r
2456                 }\r
2457                 \r
2458                 if ( !isValidShortName($shortname) )\r
2459                 {\r
2460                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2461                 }\r
2462                 \r
2463                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2464                 {\r
2465                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2466                 }\r
2467                 // check if update file is writable\r
2468                 if ( $updatefile && !is_writeable($updatefile) )\r
2469                 {\r
2470                         self::error(_ERROR_UPDATEFILE);\r
2471                 }\r
2472                 \r
2473                 $blog->setName(trim(postVar('name')));\r
2474                 $blog->setShortName($shortname);\r
2475                 $blog->setNotifyAddress($notify_address);\r
2476                 $blog->setNotifyType($notifyType);\r
2477                 $blog->setMaxComments(postVar('maxcomments'));\r
2478                 $blog->setCommentsEnabled(postVar('comments'));\r
2479                 $blog->setTimeOffset(postVar('timeoffset'));\r
2480                 $blog->setUpdateFile($updatefile);\r
2481                 $blog->setURL(trim(postVar('url')));\r
2482                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2483                 $blog->setDescription(trim(postVar('desc')));\r
2484                 $blog->setPublic(postVar('public'));\r
2485                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2486                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2487                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2488                 $blog->setSearchable(intPostVar('searchable'));\r
2489                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2490                 $blog->writeSettings();\r
2491                 \r
2492                 // store plugin options\r
2493                 $aOptions = requestArray('plugoption');\r
2494                 NucleusPlugin::apply_plugin_options($aOptions);\r
2495                 \r
2496                 $data = array(\r
2497                         'context' => 'blog',\r
2498                         'blogid'  => $blogid,\r
2499                         'blog'    => &$blog\r
2500                 );\r
2501                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2502                 \r
2503                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2504                 return;\r
2505         }\r
2506         \r
2507         /**\r
2508          * Admin::action_deleteblog()\r
2509          * \r
2510          * @param       void\r
2511          * @return      void\r
2512          */\r
2513         static private function action_deleteblog()\r
2514         {\r
2515                 global $member, $CONF, $manager;\r
2516                 \r
2517                 $blogid = intRequestVar('blogid');\r
2518                 \r
2519                 $member->blogAdminRights($blogid) or self::disallow();\r
2520                 \r
2521                 // check if blog is default blog\r
2522                 if ( $CONF['DefaultBlog'] == $blogid )\r
2523                 {\r
2524                         self::error(_ERROR_DELDEFBLOG);\r
2525                 }\r
2526                 \r
2527                 $blog =& $manager->getBlog($blogid);\r
2528                 \r
2529                 self::$skin->parse('deleteblog');\r
2530                 return;\r
2531         }\r
2532         \r
2533         /**\r
2534          * Admin::action_deleteblogconfirm()\r
2535          * Delete Blog\r
2536          * \r
2537          * @param       Void\r
2538          * @return      Void\r
2539          */\r
2540         static private function action_deleteblogconfirm()\r
2541         {\r
2542                 global $member, $CONF, $manager;\r
2543                 \r
2544                 $blogid = intRequestVar('blogid');\r
2545                 \r
2546                 $data = array('blogid' => $blogid);\r
2547                 $manager->notify('PreDeleteBlog', $data);\r
2548                 \r
2549                 $member->blogAdminRights($blogid) or self::disallow();\r
2550                 \r
2551                 // check if blog is default blog\r
2552                 if ( $CONF['DefaultBlog'] == $blogid )\r
2553                 {\r
2554                         self::error(_ERROR_DELDEFBLOG);\r
2555                 }\r
2556                 \r
2557                 // delete all comments\r
2558                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2559                 DB::execute($query);\r
2560                 \r
2561                 // delete all items\r
2562                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2563                 DB::execute($query);\r
2564                 \r
2565                 // delete all team members\r
2566                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2567                 DB::execute($query);\r
2568                 \r
2569                 // delete all bans\r
2570                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2571                 DB::execute($query);\r
2572                 \r
2573                 // delete all categories\r
2574                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2575                 DB::execute($query);\r
2576                 \r
2577                 // delete all associated plugin options\r
2578                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2579                 \r
2580                 // delete the blog itself\r
2581                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2582                 DB::execute($query);\r
2583                 \r
2584                 $data = array('blogid' => $blogid);\r
2585                 $manager->notify('PostDeleteBlog', $data);\r
2586                 \r
2587                 self::action_overview(_DELETED_BLOG);\r
2588                 return;\r
2589         }\r
2590         \r
2591         /**\r
2592          * Admin::action_memberdelete()\r
2593          * \r
2594          * @param       void\r
2595          * @return      void\r
2596          */\r
2597         static private function action_memberdelete()\r
2598         {\r
2599                 global $member, $manager;\r
2600                 \r
2601                 $memberid = intRequestVar('memberid');\r
2602                 \r
2603                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2604                 \r
2605                 $mem =& $manager->getMember($memberid);\r
2606                 \r
2607                 self::$skin->parse('memberdelete');\r
2608                 return;\r
2609         }\r
2610         \r
2611         /**\r
2612          * Admin::action_memberdeleteconfirm()\r
2613          * \r
2614          * @param       void\r
2615          * @return      void\r
2616          */\r
2617         static private function action_memberdeleteconfirm()\r
2618         {\r
2619                 global $member;\r
2620                 \r
2621                 $memberid = intRequestVar('memberid');\r
2622                 \r
2623                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2624                 \r
2625                 $error = self::deleteOneMember($memberid);\r
2626                 if ( $error )\r
2627                 {\r
2628                         self::error($error);\r
2629                 }\r
2630                 \r
2631                 if ( $member->isAdmin() )\r
2632                 {\r
2633                         self::action_usermanagement();\r
2634                 }\r
2635                 else\r
2636                 {\r
2637                         self::action_overview(_DELETED_MEMBER);\r
2638                 }\r
2639                 return;\r
2640         }\r
2641         \r
2642         /**\r
2643          * Admin::deleteOneMember()\r
2644          * Delete a member by id\r
2645          * \r
2646          * @static\r
2647          * @params      Integer $memberid       member id\r
2648          * @return      String  null string or error messages\r
2649          */\r
2650         static public function deleteOneMember($memberid)\r
2651         {\r
2652                 global $manager;\r
2653                 \r
2654                 $memberid = intval($memberid);\r
2655                 $mem =& $manager->getMember($memberid);\r
2656                 \r
2657                 if ( !$mem->canBeDeleted() )\r
2658                 {\r
2659                         return _ERROR_DELETEMEMBER;\r
2660                 }\r
2661                 \r
2662                 $data = array('member' => &$mem);\r
2663                 $manager->notify('PreDeleteMember', $data);\r
2664                 \r
2665                 /* unlink comments from memberid */\r
2666                 if ( $memberid )\r
2667                 {\r
2668                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2669                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2670                         DB::execute($query);\r
2671                 }\r
2672                 \r
2673                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2674                 DB::execute($query);\r
2675                 \r
2676                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2677                 DB::execute($query);\r
2678                 \r
2679                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2680                 DB::execute($query);\r
2681                 \r
2682                 // delete all associated plugin options\r
2683                 NucleusPlugin::delete_option_values('member', $memberid);\r
2684                 \r
2685                 $data = array('member' => &$mem);\r
2686                 $manager->notify('PostDeleteMember', $data);\r
2687                 \r
2688                 return '';\r
2689         }\r
2690         \r
2691         /**\r
2692          * Admin::action_createnewlog()\r
2693          * \r
2694          * @param       void\r
2695          * @return      void\r
2696          */\r
2697         static private function action_createnewlog()\r
2698         {\r
2699                 global $member, $CONF, $manager;\r
2700                 \r
2701                 // Only Super-Admins can do this\r
2702                 $member->isAdmin() or self::disallow();\r
2703                 \r
2704                 self::$skin->parse('createnewlog');\r
2705                 return;\r
2706         }\r
2707         \r
2708         /**\r
2709          * Admin::action_addnewlog()\r
2710          * \r
2711          * @param       void\r
2712          * @return      void\r
2713          */\r
2714         static private function action_addnewlog()\r
2715         {\r
2716                 global $member, $manager, $CONF;\r
2717                 \r
2718                 // Only Super-Admins can do this\r
2719                 $member->isAdmin() or self::disallow();\r
2720                 \r
2721                 $bname                  = trim(postVar('name'));\r
2722                 $bshortname             = trim(postVar('shortname'));\r
2723                 $btimeoffset    = postVar('timeoffset');\r
2724                 $bdesc                  = trim(postVar('desc'));\r
2725                 $bdefskin               = postVar('defskin');\r
2726                 \r
2727                 if ( !isValidShortName($bshortname) )\r
2728                 {\r
2729                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2730                 }\r
2731                 \r
2732                 if ( $manager->existsBlog($bshortname) )\r
2733                 {\r
2734                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2735                 }\r
2736                 \r
2737                 $data = array(\r
2738                         'name'        => &$bname,\r
2739                         'shortname'   => &$bshortname,\r
2740                         'timeoffset'  => &$btimeoffset,\r
2741                         'description' => &$bdesc,\r
2742                         'defaultskin' => &$bdefskin\r
2743                 );\r
2744                 $manager->notify('PreAddBlog', $data);\r
2745                 \r
2746                 // add slashes for sql queries\r
2747                 $bname                  = DB::quoteValue($bname);\r
2748                 $bshortname             = DB::quoteValue($bshortname);\r
2749                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2750                 $bdesc                  = DB::quoteValue($bdesc);\r
2751                 $bdefskin               = DB::quoteValue($bdefskin);\r
2752                 \r
2753                 // create blog\r
2754                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2755                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2756                 DB::execute($query);\r
2757                 \r
2758                 $blogid = DB::getInsertId();\r
2759                 $blog   =& $manager->getBlog($blogid);\r
2760                 \r
2761                 // create new category\r
2762                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2763                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2764                 \r
2765                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2766                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2767                 $catid = DB::getInsertId();\r
2768                 \r
2769                 // set as default category\r
2770                 $blog->setDefaultCategory($catid);\r
2771                 $blog->writeSettings();\r
2772                 \r
2773                 // create team member\r
2774                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2775                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2776                 DB::execute($query);\r
2777                 \r
2778                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2779                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2780                 \r
2781                 $blog->additem(\r
2782                         $blog->getDefaultCategory(),\r
2783                         $itemdeftitle,$itemdefbody,\r
2784                         '',\r
2785                         $blogid,\r
2786                         $member->getID(),\r
2787                         $blog->getCorrectTime(),\r
2788                         0,\r
2789                         0,\r
2790                         0\r
2791                 );\r
2792                 \r
2793                 $data = array('blog' => &$blog);\r
2794                 $manager->notify('PostAddBlog', $data);\r
2795                 \r
2796                 $data = array(\r
2797                         'blog'                  => &$blog,\r
2798                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2799                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2800                         'catid'                 => $catid\r
2801                 );\r
2802                 $manager->notify('PostAddCategory', $data);\r
2803                 \r
2804                 /* TODO: we should consider to use the other way insterad of this */\r
2805                 $_REQUEST['blogid'] = $blogid;\r
2806                 $_REQUEST['catid']  = $catid;\r
2807                 self::$skin->parse('addnewlog');\r
2808                 return;\r
2809         }\r
2810         \r
2811         /**\r
2812          * Admin::action_addnewlog2()\r
2813          * \r
2814          * @param       void\r
2815          * @return      void\r
2816          */\r
2817         static private function action_addnewlog2()\r
2818         {\r
2819                 global $member, $manager;\r
2820                 $blogid = intRequestVar('blogid');\r
2821                 \r
2822                 $member->blogAdminRights($blogid) or self::disallow();\r
2823                 \r
2824                 $burl = requestVar('url');\r
2825                 \r
2826                 $blog =& $manager->getBlog($blogid);\r
2827                 $blog->setURL(trim($burl));\r
2828                 $blog->writeSettings();\r
2829                 \r
2830                 self::action_overview(_MSG_NEWBLOG);\r
2831                 return;\r
2832         }\r
2833         \r
2834         /**\r
2835          * Admin::action_skinieoverview()\r
2836          * \r
2837          * @param       void\r
2838          * @return      void\r
2839          */\r
2840         static private function action_skinieoverview()\r
2841         {\r
2842                 global $member, $DIR_LIBS, $manager;\r
2843                 \r
2844                 $member->isAdmin() or self::disallow();\r
2845                 \r
2846                 include_once($DIR_LIBS . 'skinie.php');\r
2847                 \r
2848                 self::$skin->parse('skinieoverview');\r
2849                 return;\r
2850         }\r
2851         \r
2852         /**\r
2853          * Admin::action_skinieimport()\r
2854          * \r
2855          * @param       void\r
2856          * @return      void\r
2857          */\r
2858         static private function action_skinieimport()\r
2859         {\r
2860                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2861                 \r
2862                 $member->isAdmin() or self::disallow();\r
2863                 \r
2864                 // load skinie class\r
2865                 include_once($DIR_LIBS . 'skinie.php');\r
2866                 \r
2867                 $skinFileRaw    = postVar('skinfile');\r
2868                 $mode                   = postVar('mode');\r
2869                 \r
2870                 $importer = new SkinImport();\r
2871                 \r
2872                 // get full filename\r
2873                 if ( $mode == 'file' )\r
2874                 {\r
2875                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2876                         \r
2877                         /* TODO: remove this\r
2878                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2879                         if ( !file_exists($skinFile) )\r
2880                         {\r
2881                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2882                         }\r
2883                          */\r
2884                 }\r
2885                 else\r
2886                 {\r
2887                         $skinFile = $skinFileRaw;\r
2888                 }\r
2889                 \r
2890                 // read only metadata\r
2891                 $error = $importer->readFile($skinFile, 1);\r
2892                 \r
2893                 /* TODO: we should consider to use the other way insterad of this */\r
2894                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2895                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2896                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2897                 \r
2898                 // clashes\r
2899                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2900                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2901                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2902                 \r
2903                 /* TODO: we should consider to use the other way insterad of this */\r
2904                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2905                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2906                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2907                 \r
2908                 if ( $error )\r
2909                 {\r
2910                         self::error($error);\r
2911                 }\r
2912                 \r
2913                 self::$skin->parse('skinieimport');\r
2914                 return;\r
2915         }\r
2916         \r
2917         /**\r
2918          * Admin::action_skiniedoimport()\r
2919          * \r
2920          * @param       void\r
2921          * @return      void\r
2922          */\r
2923         static private function action_skiniedoimport()\r
2924         {\r
2925                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2926                 \r
2927                 $member->isAdmin() or self::disallow();\r
2928                 \r
2929                 // load skinie class\r
2930                 include_once($DIR_LIBS . 'skinie.php');\r
2931                 \r
2932                 $skinFileRaw    = postVar('skinfile');\r
2933                 $mode                   = postVar('mode');\r
2934                 \r
2935                 $allowOverwrite = intPostVar('overwrite');\r
2936                 \r
2937                 // get full filename\r
2938                 if ( $mode == 'file' )\r
2939                 {\r
2940                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2941                         \r
2942                         /* TODO: remove this\r
2943                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2944                         if ( !file_exists($skinFile) )\r
2945                         {\r
2946                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2947                         }\r
2948                         */\r
2949                 }\r
2950                 else\r
2951                 {\r
2952                         $skinFile = $skinFileRaw;\r
2953                 }\r
2954                 \r
2955                 $importer = new SkinImport();\r
2956                 \r
2957                 $error = $importer->readFile($skinFile);\r
2958                 \r
2959                 if ( $error )\r
2960                 {\r
2961                         self::error($error);\r
2962                 }\r
2963                 \r
2964                 $error = $importer->writeToDatabase($allowOverwrite);\r
2965                 \r
2966                 if ( $error )\r
2967                 {\r
2968                         self::error($error);\r
2969                 }\r
2970                 \r
2971                 /* TODO: we should consider to use the other way insterad of this */\r
2972                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2973                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2974                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2975                 \r
2976                 self::$skin->parse('skiniedoimport');\r
2977                 return;\r
2978         }\r
2979 \r
2980         /**\r
2981          * Admin::action_skinieexport()\r
2982          * \r
2983          * @param       void\r
2984          * @return      void\r
2985          */\r
2986         static private function action_skinieexport()\r
2987         {\r
2988                 global $member, $DIR_LIBS;\r
2989                 \r
2990                 $member->isAdmin() or self::disallow();\r
2991                 \r
2992                 // load skinie class\r
2993                 include_once($DIR_LIBS . 'skinie.php');\r
2994                 \r
2995                 $aSkins         = requestIntArray('skin');\r
2996                 $aTemplates     = requestIntArray('template');\r
2997                 \r
2998                 if ( !is_array($aTemplates) )\r
2999                 {\r
3000                         $aTemplates = array();\r
3001                 }\r
3002                 if ( !is_array($aSkins) )\r
3003                 {\r
3004                         $aSkins = array();\r
3005                 }\r
3006                 \r
3007                 $skinList               = array_keys($aSkins);\r
3008                 $templateList   = array_keys($aTemplates);\r
3009                 \r
3010                 $info = postVar('info');\r
3011                 \r
3012                 $exporter = new SkinExport();\r
3013                 foreach ( $skinList as $skinId )\r
3014                 {\r
3015                         $exporter->addSkin($skinId);\r
3016                 }\r
3017                 foreach ($templateList as $templateId)\r
3018                 {\r
3019                         $exporter->addTemplate($templateId);\r
3020                 }\r
3021                 $exporter->setInfo($info);\r
3022                 \r
3023                 $exporter->export();\r
3024                 return;\r
3025         }\r
3026         \r
3027         /**\r
3028          * Admin::action_templateoverview()\r
3029          * \r
3030          * @param       void\r
3031          * @return      void\r
3032          */\r
3033         static private function action_templateoverview()\r
3034         {\r
3035                 global $member, $manager;\r
3036                 \r
3037                 $member->isAdmin() or self::disallow();\r
3038                 \r
3039                 self::$skin->parse('templateoverview');\r
3040                 return;\r
3041         }\r
3042         \r
3043         /**\r
3044          * Admin::action_templateedit()\r
3045          * \r
3046          * @param       string  $msg    message for pageheader\r
3047          * @return      void\r
3048          */\r
3049         static private function action_templateedit($msg = '')\r
3050         {\r
3051                 global $member, $manager;\r
3052                 if ( $msg )\r
3053                 {\r
3054                         self::$headMess = $msg;\r
3055                 }\r
3056                 \r
3057                 $templateid = intRequestVar('templateid');\r
3058                 \r
3059                 $member->isAdmin() or self::disallow();\r
3060                 \r
3061                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3062                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3063                 \r
3064                 self::$skin->parse('templateedit');\r
3065                 return;\r
3066         }\r
3067         \r
3068         /**\r
3069          * Admin::action_templateupdate()\r
3070          * \r
3071          * @param       void\r
3072          * @return      void\r
3073          */\r
3074         static private function action_templateupdate()\r
3075         {\r
3076                 global $member,$manager;\r
3077                 \r
3078                 $templateid = intRequestVar('templateid');\r
3079                 \r
3080                 $member->isAdmin() or self::disallow();\r
3081                 \r
3082                 $name = postVar('tname');\r
3083                 $desc = postVar('tdesc');\r
3084                 \r
3085                 if ( !isValidTemplateName($name) )\r
3086                 {\r
3087                         self::error(_ERROR_BADTEMPLATENAME);\r
3088                 }\r
3089                 \r
3090                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3091                 {\r
3092                         self::error(_ERROR_DUPTEMPLATENAME);\r
3093                 }\r
3094                 \r
3095                 // 1. Remove all template parts\r
3096                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3097                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3098                 DB::execute($query);\r
3099                 \r
3100                 // 2. Update description\r
3101                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3102                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3103                 DB::execute($query);\r
3104                 \r
3105                 // 3. Add non-empty template parts\r
3106                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3107                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3108                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3109                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3110                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3111                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3114                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3115                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3116                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3117                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3118                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3119                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3120                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3121                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3122                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3123                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3124                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3125                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3126                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3127                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3128                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3129                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3130                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3131                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3132                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3133                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3134                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3135                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3136                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3137                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3138                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3139                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3140                 \r
3141                 $data = array('fields' => array());\r
3142                 $manager->notify('TemplateExtraFields', $data);\r
3143                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3144                 {\r
3145                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3146                         {\r
3147                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3148                         }\r
3149                 }\r
3150                 \r
3151                 // jump back to template edit\r
3152                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3153                 return;\r
3154         }\r
3155         \r
3156         /**\r
3157          * Admin::addToTemplate()\r
3158          * \r
3159          * @param       Integer $id     ID for template\r
3160          * @param       String  $partname       parts name\r
3161          * @param       String  $content        template contents\r
3162          * @return      Integer record index\r
3163          * \r
3164          */\r
3165         static private function addToTemplate($id, $partname, $content)\r
3166         {\r
3167                 // don't add empty parts:\r
3168                 if ( !trim($content) )\r
3169                 {\r
3170                         return -1;\r
3171                 }\r
3172                 \r
3173                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3174                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3175                 if ( DB::execute($query) === FALSE )\r
3176                 {\r
3177                         $err = DB::getError();\r
3178                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3179                 }\r
3180                 return DB::getInsertId();\r
3181         }\r
3182         \r
3183         /**\r
3184          * Admin::action_templatedelete()\r
3185          * \r
3186          * @param       void\r
3187          * @return      void\r
3188          */\r
3189         static private function action_templatedelete()\r
3190         {\r
3191                 global $member, $manager;\r
3192                 \r
3193                 $member->isAdmin() or self::disallow();\r
3194                 \r
3195                 $templateid = intRequestVar('templateid');\r
3196                 // TODO: check if template can be deleted\r
3197                 \r
3198                 self::$skin->parse('templatedelete');\r
3199                 return;\r
3200         }\r
3201         \r
3202         /**\r
3203          * Admin::action_templatedeleteconfirm()\r
3204          * \r
3205          * @param       void\r
3206          * @return      void\r
3207          */\r
3208         static private function action_templatedeleteconfirm()\r
3209         {\r
3210                 global $member, $manager;\r
3211                 \r
3212                 $templateid = intRequestVar('templateid');\r
3213                 \r
3214                 $member->isAdmin() or self::disallow();\r
3215                 \r
3216                 $data = array('templateid' => $templateid);\r
3217                 $manager->notify('PreDeleteTemplate', $data);\r
3218                 \r
3219                 // 1. delete description\r
3220                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3221                 \r
3222                 // 2. delete parts\r
3223                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3224                 \r
3225                 \r
3226                 $data = array('templateid' => $templateid);\r
3227                 $manager->notify('PostDeleteTemplate', $data);\r
3228                 \r
3229                 self::action_templateoverview();\r
3230                 return;\r
3231         }\r
3232         \r
3233         /**\r
3234          * Admin::action_templatenew()\r
3235          * \r
3236          * @param       void\r
3237          * @return      void\r
3238          */\r
3239         static private function action_templatenew()\r
3240         {\r
3241                 global $member;\r
3242                 \r
3243                 $member->isAdmin() or self::disallow();\r
3244                 \r
3245                 $name = postVar('name');\r
3246                 $desc = postVar('desc');\r
3247                 \r
3248                 if ( !isValidTemplateName($name) )\r
3249                 {\r
3250                         self::error(_ERROR_BADTEMPLATENAME);\r
3251                 }\r
3252                 \r
3253                 if ( Template::exists($name) )\r
3254                 {\r
3255                         self::error(_ERROR_DUPTEMPLATENAME);\r
3256                 }\r
3257                 \r
3258                 $newTemplateId = Template::createNew($name, $desc);\r
3259                 \r
3260                 self::action_templateoverview();\r
3261                 return;\r
3262         }\r
3263         \r
3264         /**\r
3265          * Admin::action_templateclone()\r
3266          * \r
3267          * @param       void\r
3268          * @return      void\r
3269          */\r
3270         static private function action_templateclone()\r
3271         {\r
3272                 global $member;\r
3273                 \r
3274                 $templateid = intRequestVar('templateid');\r
3275                 \r
3276                 $member->isAdmin() or self::disallow();\r
3277                 \r
3278                 // 1. read old template\r
3279                 $name = Template::getNameFromId($templateid);\r
3280                 $desc = Template::getDesc($templateid);\r
3281                 \r
3282                 // 2. create desc thing\r
3283                 $name = "cloned" . $name;\r
3284                 \r
3285                 // if a template with that name already exists:\r
3286                 if ( Template::exists($name) )\r
3287                 {\r
3288                         $i = 1;\r
3289                         while (Template::exists($name . $i))\r
3290                         {\r
3291                                 $i++;\r
3292                         }\r
3293                         $name .= $i;\r
3294                 }\r
3295                 \r
3296                 $newid = Template::createNew($name, $desc);\r
3297                 \r
3298                 // 3. create clone\r
3299                 // go through parts of old template and add them to the new one\r
3300                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3301                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3302                 \r
3303                 $res = DB::getResult($query);\r
3304                 foreach ( $res as $row)\r
3305                 {\r
3306                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3307                 }\r
3308                 \r
3309                 self::action_templateoverview();\r
3310                 return;\r
3311         }\r
3312         \r
3313         /**\r
3314          * Admin::action_admintemplateoverview()\r
3315          * \r
3316          * @param       void\r
3317          * @return      void\r
3318          */\r
3319         static private function action_admintemplateoverview()\r
3320         {\r
3321                 global $member;\r
3322                 $member->isAdmin() or self::disallow();\r
3323                 self::$skin->parse('admntemplateoverview');\r
3324                 return;\r
3325         }\r
3326         \r
3327         /**\r
3328          * Admin::action_admintemplateedit()\r
3329          * \r
3330          * @param       string  $msg    message for pageheader\r
3331          * @return      void\r
3332          */\r
3333         static private function action_admintemplateedit($msg = '')\r
3334         {\r
3335                 global $member, $manager;\r
3336                 if ( $msg )\r
3337                 {\r
3338                         self::$headMess = $msg;\r
3339                 }\r
3340                 $member->isAdmin() or self::disallow();\r
3341                 \r
3342                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3343                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3344                 \r
3345                 self::$skin->parse('admintemplateedit');\r
3346                 return;\r
3347         }\r
3348         \r
3349         /**\r
3350          * Admin::action_admintemplateupdate()\r
3351          * \r
3352          * @param       void\r
3353          * @return      void\r
3354          */\r
3355         static private function action_admintemplateupdate()\r
3356         {\r
3357                 global $member, $manager;\r
3358                 $templateid = intRequestVar('templateid');\r
3359                 $member->isAdmin() or self::disallow();\r
3360                 $name = postVar('tname');\r
3361                 $desc = postVar('tdesc');\r
3362                 \r
3363                 if ( !isValidTemplateName($name) )\r
3364                 {\r
3365                         self::error(_ERROR_BADTEMPLATENAME);\r
3366                 }\r
3367                 \r
3368                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3369                 {\r
3370                         self::error(_ERROR_DUPTEMPLATENAME);\r
3371                 }\r
3372                 \r
3373                 // 1. Remove all template parts\r
3374                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3375                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3376                 DB::execute($query);\r
3377                 \r
3378                 // 2. Update description\r
3379                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3380                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3381                 DB::execute($query);\r
3382                 \r
3383                 // 3. Add non-empty template parts\r
3384                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3385                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3386                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3387                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3388                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3389                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3390                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3391                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3392                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3393                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3394                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3395                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3396                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3397                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3398                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3399                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3400                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3401                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3402                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3403                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3404                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3405                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3406                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3407                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3408                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3409                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3484                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3485                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3486                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3487                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3488                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3489                 \r
3490                 $data = array('fields' => array());\r
3491                 $manager->notify('AdminTemplateExtraFields', $data);\r
3492                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3493                 {\r
3494                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3495                         {\r
3496                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3497                         }\r
3498                 }\r
3499                 \r
3500                 // jump back to template edit\r
3501                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3502                 return;\r
3503         }\r
3504         \r
3505         /**\r
3506          * Admin::addToAdminTemplate()\r
3507          * \r
3508          * @param       integer $id                     ID for template\r
3509          * @param       string  $partname       name of part for template\r
3510          * @param       void    $contents       content for part of template\r
3511          * @return      integer ID for newly inserted Template\r
3512          */\r
3513         static private function addToAdminTemplate($id, $partname, $content)\r
3514         {\r
3515                 // don't add empty parts:\r
3516                 if ( !trim($content) )\r
3517                 {\r
3518                         return -1;\r
3519                 }\r
3520                 \r
3521                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3522                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3523                 if ( DB::execute($query) === FALSE )\r
3524                 {\r
3525                         $err = DB::getError();\r
3526                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3527                 }\r
3528                 return DB::getInsertId();\r
3529         }\r
3530         \r
3531         /**\r
3532          * Admin::action_admintemplatedelete()\r
3533          * \r
3534          * @param       void\r
3535          * @return      void\r
3536          */\r
3537         static private function action_admintemplatedelete()\r
3538         {\r
3539                 global $member, $manager;\r
3540                 $member->isAdmin() or self::disallow();\r
3541                 \r
3542                 // TODO: check if template can be deleted\r
3543                 self::$skin->parse('admintemplatedelete');\r
3544                 return;\r
3545         }\r
3546         \r
3547         /**\r
3548          * Admin::action_admintemplatedeleteconfirm()\r
3549          * \r
3550          * @param       void\r
3551          * @return      void\r
3552          */\r
3553         static private function action_admintemplatedeleteconfirm()\r
3554         {\r
3555                 global $member, $manager;\r
3556                 \r
3557                 $templateid = intRequestVar('templateid');\r
3558                 $member->isAdmin() or self::disallow();\r
3559                 \r
3560                 $data = array('templateid' => $templateid);\r
3561                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3562                 \r
3563                 // 1. delete description\r
3564                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3565                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3566                 DB::execute($query);\r
3567                 \r
3568                 // 2. delete parts\r
3569                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3570                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3571                 DB::execute($query);\r
3572                 \r
3573                 $data = array('templateid' => $templateid);\r
3574                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3575                 \r
3576                 self::action_admintemplateoverview();\r
3577                 return;\r
3578         }\r
3579         \r
3580         /**\r
3581          * Admin::action_admintemplatenew()\r
3582          * \r
3583          * @param       void\r
3584          * @return      void\r
3585          */\r
3586         static private function action_admintemplatenew()\r
3587         {\r
3588                 global $member;\r
3589                 $member->isAdmin() or self::disallow();\r
3590                 $name = postVar('name');\r
3591                 $desc = postVar('desc');\r
3592                 \r
3593                 if ( !isValidTemplateName($name) )\r
3594                 {\r
3595                         self::error(_ERROR_BADTEMPLATENAME);\r
3596                 }\r
3597                 else if ( !preg_match('#^admin/#', $name) )\r
3598                 {\r
3599                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3600                 }\r
3601                 else if ( Template::exists($name) )\r
3602                 {\r
3603                         self::error(_ERROR_DUPTEMPLATENAME);\r
3604                 }\r
3605                 \r
3606                 $newTemplateId = Template::createNew($name, $desc);\r
3607                 self::action_admintemplateoverview();\r
3608                 return;\r
3609         }\r
3610         \r
3611         /**\r
3612          * Admin::action_admintemplateclone()\r
3613          * \r
3614          * @param       void\r
3615          * @return      void\r
3616          */\r
3617         static private function action_admintemplateclone()\r
3618         {\r
3619                 global $member;\r
3620                 $templateid = intRequestVar('templateid');\r
3621                 $member->isAdmin() or self::disallow();\r
3622                 \r
3623                 // 1. read old template\r
3624                 $name = Template::getNameFromId($templateid);\r
3625                 $desc = Template::getDesc($templateid);\r
3626                 \r
3627                 // 2. create desc thing\r
3628                 $name = $name . "cloned";\r
3629                 \r
3630                 // if a template with that name already exists:\r
3631                 if ( Template::exists($name) )\r
3632                 {\r
3633                         $i = 1;\r
3634                         while ( Template::exists($name . $i) )\r
3635                         {\r
3636                                 $i++;\r
3637                         }\r
3638                         $name .= $i;\r
3639                 }\r
3640                 \r
3641                 $newid = Template::createNew($name, $desc);\r
3642                 \r
3643                 // 3. create clone\r
3644                 // go through parts of old template and add them to the new one\r
3645                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3646                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3647                 \r
3648                 $res = DB::getResult($query);\r
3649                 foreach ( $res as $row )\r
3650                 {\r
3651                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3652                 }\r
3653                 \r
3654                 self::action_admintemplateoverview();\r
3655                 return;\r
3656         }\r
3657 \r
3658         /**\r
3659          * Admin::action_skinoverview()\r
3660          * \r
3661          * @param       void\r
3662          * @return      void\r
3663          */\r
3664         static private function action_skinoverview()\r
3665         {\r
3666                 global $member, $manager;\r
3667                 \r
3668                 $member->isAdmin() or self::disallow();\r
3669                 \r
3670                 self::$skin->parse('skinoverview');\r
3671                 return;\r
3672         }\r
3673         \r
3674         /**\r
3675          * Admin::action_skinnew()\r
3676          * \r
3677          * @param       void\r
3678          * @return      void\r
3679          */\r
3680         static private function action_skinnew()\r
3681         {\r
3682                 global $member;\r
3683                 \r
3684                 $member->isAdmin() or self::disallow();\r
3685                 \r
3686                 $name = trim(postVar('name'));\r
3687                 $desc = trim(postVar('desc'));\r
3688                 \r
3689                 if ( !isValidSkinName($name) )\r
3690                 {\r
3691                         self::error(_ERROR_BADSKINNAME);\r
3692                 }\r
3693                 \r
3694                 if ( SKIN::exists($name) )\r
3695                 {\r
3696                         self::error(_ERROR_DUPSKINNAME);\r
3697                 }\r
3698                 \r
3699                 $newId = SKIN::createNew($name, $desc);\r
3700                 \r
3701                 self::action_skinoverview();\r
3702                 return;\r
3703         }\r
3704         \r
3705         /**\r
3706          * Admin::action_skinedit()\r
3707          * \r
3708          * @param       void\r
3709          * @return      void\r
3710          */\r
3711         static private function action_skinedit()\r
3712         {\r
3713                 global $member, $manager;\r
3714                 \r
3715                 $member->isAdmin() or self::disallow();\r
3716                 \r
3717                 self::$skin->parse('skinedit');\r
3718                 return;\r
3719         }\r
3720         \r
3721         /**\r
3722          * Admin::action_skineditgeneral()\r
3723          * \r
3724          * @param       void\r
3725          * @return      void\r
3726          */\r
3727         static private function action_skineditgeneral()\r
3728         {\r
3729                 global $manager, $member;\r
3730                 \r
3731                 $skinid = intRequestVar('skinid');\r
3732                 \r
3733                 $member->isAdmin() or self::disallow();\r
3734                 \r
3735                 $name           = postVar('name');\r
3736                 $desc           = postVar('desc');\r
3737                 $type           = postVar('type');\r
3738                 $inc_mode       = postVar('inc_mode');\r
3739                 $inc_prefix     = postVar('inc_prefix');\r
3740                 \r
3741                 $skin =& $manager->getSkin($skinid);\r
3742                 \r
3743                 // 1. Some checks\r
3744                 if ( !isValidSkinName($name) )\r
3745                 {\r
3746                         self::error(_ERROR_BADSKINNAME);\r
3747                 }\r
3748                 \r
3749                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3750                 {\r
3751                         self::error(_ERROR_DUPSKINNAME);\r
3752                 }\r
3753                 \r
3754                 if ( !$type )\r
3755                 {\r
3756                         $type = 'text/html';\r
3757                 }\r
3758                 if ( !$inc_mode )\r
3759                 {\r
3760                         $inc_mode = 'normal';\r
3761                 }\r
3762                 \r
3763                 // 2. Update description\r
3764                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3765                 \r
3766                 self::action_skinedit();\r
3767                 return;\r
3768         }\r
3769         \r
3770         static private function action_skinedittype($msg = '')\r
3771         {\r
3772                 global $member, $manager;\r
3773                 \r
3774                 $member->isAdmin() or self::disallow();\r
3775                 \r
3776                 if ( $msg )\r
3777                 {\r
3778                         self::$headMess = $msg;\r
3779                 }\r
3780                 \r
3781                 $skinid = intRequestVar('skinid');\r
3782                 $type   = requestVar('type');\r
3783                 $type   = trim($type);\r
3784                 $type   = strtolower($type);\r
3785                 \r
3786                 if ( !isValidShortName($type) )\r
3787                 {\r
3788                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3789                 }\r
3790                 \r
3791                 self::$skin->parse('skinedittype');\r
3792                 return;\r
3793         }\r
3794         \r
3795         /**\r
3796          * Admin::action_skinupdate()\r
3797          * \r
3798          * @param       void\r
3799          * @return      void\r
3800          */\r
3801         static private function action_skinupdate()\r
3802         {\r
3803                 global $manager, $member;\r
3804                 \r
3805                 $skinid = intRequestVar('skinid');\r
3806                 $content = trim(postVar('content'));\r
3807                 $type = postVar('type');\r
3808                 \r
3809                 $member->isAdmin() or self::disallow();\r
3810                 \r
3811                 $skin =& $manager->getSKIN($skinid);\r
3812                 $skin->update($type, $content);\r
3813                 \r
3814                 self::action_skinedittype(_SKIN_UPDATED);\r
3815                 return;\r
3816         }\r
3817         \r
3818         /**\r
3819          * Admin::action_skindelete()\r
3820          * \r
3821          * @param       void\r
3822          * @return      void\r
3823          */\r
3824         static private function action_skindelete()\r
3825         {\r
3826                 global $manager, $member, $CONF;\r
3827                 \r
3828                 $skinid = intRequestVar('skinid');\r
3829                 \r
3830                 $member->isAdmin() or self::disallow();\r
3831                 \r
3832                 // don't allow default skin to be deleted\r
3833                 if ( $skinid == $CONF['BaseSkin'] )\r
3834                 {\r
3835                         self::error(_ERROR_DEFAULTSKIN);\r
3836                 }\r
3837                 \r
3838                 // don't allow deletion of default skins for blogs\r
3839                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3840                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3841                 \r
3842                 $name = DB::getValue($query);\r
3843                 if ( $name )\r
3844                 {\r
3845                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3846                 }\r
3847                 \r
3848                 self::$skin->parse('skindelete');\r
3849                 return;\r
3850         }\r
3851         \r
3852         /**\r
3853          * Admin::action_skindeleteconfirm()\r
3854          * \r
3855          * @param       void\r
3856          * @return      void\r
3857          */\r
3858         static private function action_skindeleteconfirm()\r
3859         {\r
3860                 global $member, $CONF, $manager;\r
3861                 \r
3862                 $skinid = intRequestVar('skinid');\r
3863                 \r
3864                 $member->isAdmin() or self::disallow();\r
3865                 \r
3866                 // don't allow default skin to be deleted\r
3867                 if ( $skinid == $CONF['BaseSkin'] )\r
3868                 {\r
3869                         self::error(_ERROR_DEFAULTSKIN);\r
3870                 }\r
3871                 \r
3872                 // don't allow deletion of default skins for blogs\r
3873                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3874                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3875                 \r
3876                 $name = DB::getValue($query);\r
3877                 if ( $name )\r
3878                                 {\r
3879                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3880                 }\r
3881                 \r
3882                 $data = array('skinid' => $skinid);\r
3883                 $manager->notify('PreDeleteSkin', $data);\r
3884                 \r
3885                 // 1. delete description\r
3886                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3887                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3888                 DB::execute($query);\r
3889                 \r
3890                 // 2. delete parts\r
3891                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3892                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3893                 DB::execute($query);\r
3894                 \r
3895                 $data = array('skinid' => $skinid);\r
3896                 $manager->notify('PostDeleteSkin', $data);\r
3897                 \r
3898                 self::action_skinoverview();\r
3899                 return;\r
3900         }\r
3901         \r
3902         /**\r
3903          * Admin::action_skinremovetype()\r
3904          * \r
3905          * @param       void\r
3906          * @return      void\r
3907          */\r
3908         static private function action_skinremovetype()\r
3909         {\r
3910                 global $member, $manager, $CONF;\r
3911                 \r
3912                 $member->isAdmin() or self::disallow();\r
3913                 \r
3914                 $skinid = intRequestVar('skinid');\r
3915                 $skintype = requestVar('type');\r
3916                 \r
3917                 if ( !isValidShortName($skintype) )\r
3918                 {\r
3919                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3920                 }\r
3921                 \r
3922                 // don't allow default skinparts to be deleted\r
3923                 /* TODO: this array should be retrieved from Action class */\r
3924                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3925                 {\r
3926                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3927                 }\r
3928                 \r
3929                 self::$skin->parse('skinremovetype');\r
3930                 return;\r
3931         }\r
3932         \r
3933         /**\r
3934          * Admin::action_skinremovetypeconfirm()\r
3935          * \r
3936          * @param       void\r
3937          * @return      void\r
3938          */\r
3939         static private function action_skinremovetypeconfirm()\r
3940         {\r
3941                 global $member, $CONF, $manager;\r
3942                 \r
3943                 $member->isAdmin() or self::disallow();\r
3944                 \r
3945                 $skinid = intRequestVar('skinid');\r
3946                 $skintype = requestVar('type');\r
3947                 \r
3948                 if ( !isValidShortName($skintype) )\r
3949                 {\r
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3951                 }\r
3952                 \r
3953                 // don't allow default skinparts to be deleted\r
3954                 /* TODO: this array should be retrieved from Action class */\r
3955                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3956                 {\r
3957                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3958                 }\r
3959                 \r
3960                 $data = array(\r
3961                         'skinid'   => $skinid,\r
3962                         'skintype' => $skintype\r
3963                 );\r
3964                 $manager->notify('PreDeleteSkinPart', $data);\r
3965                 // delete part\r
3966                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3967                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3968                 DB::execute($query);\r
3969                 \r
3970                 $data = array(\r
3971                         'skinid'   => $skinid,\r
3972                         'skintype' => $skintype\r
3973                 );\r
3974                 $manager->notify('PostDeleteSkinPart', $data);\r
3975                 \r
3976                 self::action_skinedit();\r
3977                 return;\r
3978         }\r
3979 \r
3980         /**\r
3981          * Admin::action_skinclone()\r
3982          * \r
3983          * @param       void\r
3984          * @return      void\r
3985          */\r
3986         static private function action_skinclone()\r
3987         {\r
3988                 global $manager, $member;\r
3989                 \r
3990                 $member->isAdmin() or self::disallow();\r
3991                 \r
3992                 $skinid = intRequestVar('skinid');\r
3993                 \r
3994                 // 1. read skin to clone\r
3995                 $skin =& $manager->getSkin($skinid);\r
3996                 \r
3997                 $name = "{$skin->getName()}_clone";\r
3998                 \r
3999                 // if a skin with that name already exists:\r
4000                 if ( Skin::exists($name) )\r
4001                 {\r
4002                         $i = 1;\r
4003                         while ( Skin::exists($name . $i) )\r
4004                         {\r
4005                                 $i++;\r
4006                         }\r
4007                         $name .= $i;\r
4008                 }\r
4009                 \r
4010                 // 2. create skin desc\r
4011                 $newid = Skin::createNew(\r
4012                         $name,\r
4013                         $skin->getDescription(),\r
4014                         $skin->getContentType(),\r
4015                         $skin->getIncludeMode(),\r
4016                         $skin->getIncludePrefix()\r
4017                 );\r
4018                 \r
4019                 // 3. clone\r
4020                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4021                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4022                 \r
4023                 $res = DB::getResult($query);\r
4024                 foreach ( $res as $row )\r
4025                 {\r
4026                         self::skinclonetype($skin, $newid, $row['stype']);\r
4027                 }\r
4028                 \r
4029                 self::action_skinoverview();\r
4030                 return;\r
4031         }\r
4032         \r
4033         /**\r
4034          * Admin::skinclonetype()\r
4035          * \r
4036          * @param       String  $skin   Skin object\r
4037          * @param       Integer $newid  ID for this clone\r
4038          * @param       String  $type   type of skin\r
4039          * @return      Void\r
4040          */\r
4041         static private function skinclonetype($skin, $newid, $type)\r
4042         {\r
4043                 $newid = intval($newid);\r
4044                 $content = $skin->getContentFromDB($type);\r
4045                 \r
4046                 if ( $content )\r
4047                 {\r
4048                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4049                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4050                         DB::execute($query);\r
4051                 }\r
4052                 return;\r
4053         }\r
4054         \r
4055         /**\r
4056          * Admin::action_adminskinoverview()\r
4057          * \r
4058          * @param       void\r
4059          * @return      void\r
4060          */\r
4061         static private function action_adminskinoverview()\r
4062         {\r
4063                 global $member, $manager;\r
4064                 \r
4065                 $member->isAdmin() or self::disallow();\r
4066                 \r
4067                 self::$skin->parse('adminskinoverview');\r
4068                 return;\r
4069         }\r
4070         \r
4071         /**\r
4072          * Admin::action_adminskinnew()\r
4073          * \r
4074          * @param       void\r
4075          * @return      void\r
4076          */\r
4077         static private function action_adminskinnew()\r
4078         {\r
4079                 global $member;\r
4080                 $member->isAdmin() or self::disallow();\r
4081                 $name = trim(postVar('name'));\r
4082                 $desc = trim(postVar('desc'));\r
4083                 \r
4084                 if ( !isValidSkinName($name) )\r
4085                 {\r
4086                         self::error(_ERROR_BADSKINNAME);\r
4087                 }\r
4088                 else if ( !preg_match('#^admin/#', $name) )\r
4089                 {\r
4090                         self::error(_ERROR_BADADMINSKINNAME);\r
4091                 }\r
4092                 else if ( Skin::exists($name) )\r
4093                 {\r
4094                         self::error(_ERROR_DUPSKINNAME);\r
4095                 }\r
4096                 /* TODO: $newId is not reused... */\r
4097                 $newId = Skin::createNew($name, $desc);\r
4098                 self::action_adminskinoverview();\r
4099                 return;\r
4100         }\r
4101         \r
4102         /**\r
4103          * Admin::action_adminskinedit()\r
4104          * \r
4105          * @param       void\r
4106          * @return      void\r
4107          */\r
4108         static private function action_adminskinedit()\r
4109         {\r
4110                 global $member, $manager;\r
4111                 \r
4112                 $member->isAdmin() or self::disallow();\r
4113                 self::$skin->parse('adminskinedit');\r
4114                 return;\r
4115         }\r
4116         \r
4117         /**\r
4118          * Admin::action_adminskineditgeneral()\r
4119          * \r
4120          * @param       void\r
4121          * @return      void\r
4122          */\r
4123         static private function action_adminskineditgeneral()\r
4124         {\r
4125                 global $manager, $member;\r
4126                 \r
4127                 $skinid = intRequestVar('skinid');\r
4128                 \r
4129                 $member->isAdmin() or self::disallow();\r
4130                 \r
4131                 $name           = postVar('name');\r
4132                 $desc           = postVar('desc');\r
4133                 $type           = postVar('type');\r
4134                 $inc_mode       = postVar('inc_mode');\r
4135                 $inc_prefix     = postVar('inc_prefix');\r
4136                 \r
4137                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4138                 \r
4139                 // 1. Some checks\r
4140                 if ( !isValidSkinName($name) )\r
4141                 {\r
4142                         self::error(_ERROR_BADSKINNAME);\r
4143                 }\r
4144                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4145                 {\r
4146                         self::error(_ERROR_DUPSKINNAME);\r
4147                 }\r
4148                 if ( !$type )\r
4149                 {\r
4150                         $type = 'text/html';\r
4151                 }\r
4152                 if ( !$inc_mode )\r
4153                 {\r
4154                         $inc_mode = 'normal';\r
4155                 }\r
4156                 // 2. Update description\r
4157                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4158                 self::action_adminskinedit();\r
4159                 return;\r
4160         }\r
4161         \r
4162         /**\r
4163          * Admin::action_adminskinedittype()\r
4164          * \r
4165          * @param       string  $msg    message for pageheader\r
4166          * @return      void\r
4167          */\r
4168         static private function action_adminskinedittype($msg = '')\r
4169         {\r
4170                 global $member, $manager;\r
4171                 \r
4172                 $member->isAdmin() or self::disallow();\r
4173                 \r
4174                 if ( $msg )\r
4175                 {\r
4176                         self::$headMess = $msg;\r
4177                 }\r
4178                 $type = requestVar('type');\r
4179                 $type = trim($type);\r
4180                 $type = strtolower($type);\r
4181                 \r
4182                 if ( !isValidShortName($type) )\r
4183                 {\r
4184                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4185                 }\r
4186                 \r
4187                 self::$skin->parse('adminskinedittype');\r
4188                 return;\r
4189         }\r
4190         \r
4191         /**\r
4192          * Admin::action_adminskinupdate()\r
4193          * \r
4194          * @param       void\r
4195          * @return      void\r
4196          */\r
4197         static private function action_adminskinupdate()\r
4198         {\r
4199                 global $manager, $member;\r
4200                 \r
4201                 $skinid = intRequestVar('skinid');\r
4202                 $content = trim(postVar('content'));\r
4203                 $type = postVar('type');\r
4204                 \r
4205                 $member->isAdmin() or self::disallow();\r
4206                 \r
4207                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4208                 $skin->update($type, $content);\r
4209                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4210                 return;\r
4211         }\r
4212         \r
4213         /**\r
4214          * Admin::action_adminskindelete()\r
4215          * \r
4216          * @param       void\r
4217          * @return      void\r
4218          */\r
4219         static private function action_adminskindelete()\r
4220         {\r
4221                 global $member, $manager, $CONF;\r
4222                 $member->isAdmin() or self::disallow();\r
4223                 \r
4224                 /* TODO: needless variable $skinid... */\r
4225                 $skinid = intRequestVar('skinid');\r
4226                 self::$skin->parse('adminskindelete');\r
4227                 return;\r
4228         }\r
4229 \r
4230         /**\r
4231          * Admin::action_adminskindeleteconfirm()\r
4232          * \r
4233          * @param       void\r
4234          * @return      void\r
4235          */\r
4236         static private function action_adminskindeleteconfirm()\r
4237         {\r
4238                 global $member, $CONF, $manager;\r
4239                 \r
4240                 $member->isAdmin() or self::disallow();\r
4241                 $skinid = intRequestVar('skinid');\r
4242                 \r
4243                 // don't allow default skin to be deleted\r
4244                 if ( $skinid == $CONF['AdminSkin'] )\r
4245                 {\r
4246                         self::error(_ERROR_DEFAULTSKIN);\r
4247                 }\r
4248                 \r
4249                 /*\r
4250                  * TODO: NOT Implemented\r
4251                  *  don't allow deletion of default skins for members\r
4252                 $memberDefaults =  $member->getAdminSkin();\r
4253                 foreach ( $memberDefaults as $memID => $adminskin )\r
4254                 {\r
4255                         if ( $skinid == $adminskin )\r
4256                         {\r
4257                                 $mem =& $manager->getMember($memID);\r
4258                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4259                         }\r
4260                 }\r
4261                 */\r
4262                 \r
4263                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4264                 \r
4265                 // 1. delete description\r
4266                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4267                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4268                 DB::execute($query);\r
4269                 \r
4270                 // 2. delete parts\r
4271                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4272                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4273                 \r
4274                 DB::execute($query);\r
4275                 \r
4276                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4277                 self::action_adminskinoverview();\r
4278                 return;\r
4279         }\r
4280         \r
4281         /**\r
4282          * Admin::action_adminskinremovetype()\r
4283          * \r
4284          * @param       void\r
4285          * @return      void\r
4286          */\r
4287         static private function action_adminskinremovetype()\r
4288         {\r
4289                 global $member, $manager, $CONF;\r
4290 \r
4291                 $member->isAdmin() or self::disallow();\r
4292                 \r
4293                 $skinid         = intRequestVar('skinid');\r
4294                 $skintype       = requestVar('type');\r
4295                 \r
4296                 if ( !isValidShortName($skintype) )\r
4297                 {\r
4298                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4299                 }\r
4300                 \r
4301                 self::$skin->parse('adminskinremovetype');\r
4302                 return;\r
4303         }\r
4304         \r
4305         /**\r
4306          * Admin::action_adminskinremovetypeconfirm()\r
4307          * \r
4308          * @param       void\r
4309          * @return      void\r
4310          */\r
4311         static private function action_adminskinremovetypeconfirm()\r
4312         {\r
4313                 global $member, $CONF, $manager;\r
4314                 \r
4315                 $member->isAdmin() or self::disallow();\r
4316                 \r
4317                 $skinid         = intRequestVar('skinid');\r
4318                 $skintype       = requestVar('type');\r
4319                 \r
4320                 if ( !isValidShortName($skintype) )\r
4321                 {\r
4322                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4323                 }\r
4324                 \r
4325                 $data =array(\r
4326                         'skinid'        => $skinid,\r
4327                         'skintype'      => $skintype\r
4328                 );\r
4329                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4330 \r
4331                 // delete part\r
4332                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4333                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4334                 DB::execute($query);\r
4335                 \r
4336                 $data = array(\r
4337                         'skinid'        => $skinid,\r
4338                         'skintype'      => $skintype\r
4339                 );\r
4340                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4341                 \r
4342                 self::action_adminskinedit();\r
4343                 return;\r
4344         }\r
4345 \r
4346         /**\r
4347          * Admin::action_adminskinclone()\r
4348          * \r
4349          * @param       void\r
4350          * @return      void\r
4351          */\r
4352         static private function action_adminskinclone()\r
4353         {\r
4354                 global $manager, $member;\r
4355                 \r
4356                 $member->isAdmin() or self::disallow();\r
4357                 \r
4358                 $skinid = intRequestVar('skinid');\r
4359                 \r
4360                 // 1. read skin to clone\r
4361                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4362                 $name = "{$skin->getName()}_clone";\r
4363                 \r
4364                 // if a skin with that name already exists:\r
4365                 if ( Skin::exists($name) )\r
4366                 {\r
4367                         $i = 1;\r
4368                         while ( Skin::exists($name . $i) )\r
4369                         {\r
4370                                 $i++;\r
4371                         }\r
4372                         $name .= $i;\r
4373                 }\r
4374                 \r
4375                 // 2. create skin desc\r
4376                 $newid = Skin::createNew(\r
4377                         $name,\r
4378                         $skin->getDescription(),\r
4379                         $skin->getContentType(),\r
4380                         $skin->getIncludeMode(),\r
4381                         $skin->getIncludePrefix()\r
4382                 );\r
4383                 \r
4384                 // 3. clone\r
4385                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4386                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4387                 \r
4388                 $res = DB::getResult($query);\r
4389                 foreach ( $res as $row )\r
4390                 {\r
4391                         self::skinclonetype($skin, $newid, $row['stype']);\r
4392                 }\r
4393                 self::action_adminskinoverview();\r
4394                 return;\r
4395         }\r
4396         \r
4397         /**\r
4398          * Admin::adminskinclonetype()\r
4399          * \r
4400          * @param       string  $skin   an instance of Skin class\r
4401          * @param       integer $newid  ID for new skin\r
4402          * @param       string  $type   skin type\r
4403          * @return      void\r
4404          */\r
4405         static private function adminskinclonetype($skin, $newid, $type)\r
4406         {\r
4407                 $content = $skin->getContentFromDB($type);\r
4408                 \r
4409                 if ( $content )\r
4410                 {\r
4411                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4412                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4413                         DB::execute($query);\r
4414                 }\r
4415                 return;\r
4416         }\r
4417         \r
4418         /**\r
4419          * Admin::action_adminskinieoverview()\r
4420          * \r
4421          * @param       void\r
4422          * @return      void\r
4423          */\r
4424         static private function action_adminskinieoverview()\r
4425         {\r
4426                 global $member, $DIR_LIBS, $manager;\r
4427                 \r
4428                 $member->isAdmin() or self::disallow();\r
4429                 \r
4430                 // load skinie class\r
4431                 include_once($DIR_LIBS . 'skinie.php');\r
4432                 \r
4433                 self::$skin->parse('adminskinieoverview');\r
4434                 return;\r
4435         }\r
4436 \r
4437         /**\r
4438          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4439          * Admin::action_adminskinieimport()\r
4440          * \r
4441          * @param       void\r
4442          * @return      void\r
4443          */\r
4444         static private function action_adminskinieimport()\r
4445         {\r
4446                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4447                 \r
4448                 $member->isAdmin() or self::disallow();\r
4449                 \r
4450                 // load skinie class\r
4451                 include_once($DIR_LIBS . 'skinie.php');\r
4452                 \r
4453                 $skinFileRaw    = postVar('skinfile');\r
4454                 $mode                   = postVar('mode');\r
4455                 \r
4456                 $importer = new SKINIMPORT();\r
4457                 \r
4458                 // get full filename\r
4459                 if ( $mode == 'file' )\r
4460                 {\r
4461                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4462                         \r
4463                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4464                         if ( !file_exists($skinFile) )\r
4465                         {\r
4466                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4467                         }\r
4468                 }\r
4469                 else\r
4470                 {\r
4471                         $skinFile = $skinFileRaw;\r
4472                 }\r
4473                 \r
4474                 // read only metadata\r
4475                 $error = $importer->readFile($skinFile, 1);\r
4476                 if ( $error )\r
4477                 {\r
4478                         self::error($error);\r
4479                 }\r
4480                 \r
4481                 /* TODO: we should consider to use the other way instead of this */\r
4482                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4483                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4484                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4485                 \r
4486                 // clashes\r
4487                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4488                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4489                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4490                 /* TODO: we should consider to use the other way instead of this */\r
4491                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4492                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4493                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4494 \r
4495                 if ( !is_object(self::$skin) )\r
4496                 {\r
4497                         self::action_adminskiniedoimport();\r
4498                 }\r
4499                 else\r
4500                 {\r
4501                         self::$skin->parse('adminskinieimport');\r
4502                 }\r
4503                 return;\r
4504         }\r
4505         \r
4506         /**\r
4507          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4508          * Admin::action_adminskiniedoimport()\r
4509          * \r
4510          * @param       void\r
4511          * @return      void\r
4512          */\r
4513         static private function action_adminskiniedoimport()\r
4514         {\r
4515                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4516                 \r
4517                 $member->isAdmin() or self::disallow();\r
4518                 \r
4519                 // load skinie class\r
4520                 include_once($DIR_LIBS . 'skinie.php');\r
4521                 \r
4522                 $skinFileRaw    = postVar('skinfile');\r
4523                 $mode                   = postVar('mode');\r
4524                 $allowOverwrite = intPostVar('overwrite');\r
4525                 \r
4526                 // get full filename\r
4527                 if ( $mode == 'file' )\r
4528                 {\r
4529                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4530                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4531                         if ( !file_exists($skinFile) )\r
4532                         {\r
4533                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4534                         }\r
4535                 }\r
4536                 else\r
4537                 {\r
4538                         $skinFile = $skinFileRaw;\r
4539                 }\r
4540                 \r
4541                 $importer = new SKINIMPORT();\r
4542                 \r
4543                 $error = $importer->readFile($skinFile);\r
4544                 if ( $error )\r
4545                 {\r
4546                         self::error($error);\r
4547                 }\r
4548                 \r
4549                 $error = $importer->writeToDatabase($allowOverwrite);\r
4550                 if ( $error )\r
4551                 {\r
4552                         self::error($error);\r
4553                 }\r
4554                 \r
4555                 /* TODO: we should consider to use the other way instead of this */\r
4556                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4557                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4558                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4559                 \r
4560                 if ( !is_object(self::$skin) )\r
4561                 {\r
4562                         global $DIR_SKINS;\r
4563                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4564                         $query  = sprintf($query, sql_table('skin_desc'));\r
4565                         $res    = intval(DB::getValue($query));\r
4566                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4567                         $query  = sprintf($query, sql_table('config'), $res);\r
4568                         DB::execute($query);\r
4569                         $skin   =& $manager->Skin(0, 'AdminActions', 'AdminSkin');\r
4570                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4571                 }\r
4572                 else\r
4573                 {\r
4574                         self::$skin->parse('adminskiniedoimport');\r
4575                 }\r
4576                 return;\r
4577         }\r
4578 \r
4579         /**\r
4580          * Admin::action_adminskinieexport()\r
4581          * \r
4582          * @param       void\r
4583          * @return      void\r
4584          */\r
4585         static private function action_adminskinieexport()\r
4586         {\r
4587                 global $member, $DIR_PLUGINS;\r
4588                 \r
4589                 $member->isAdmin() or self::disallow();\r
4590                 \r
4591                 // load skinie class\r
4592                 $aSkins = requestIntArray('skin');\r
4593                 if (!is_array($aSkins)) {\r
4594                         $aSkins = array();\r
4595                 }\r
4596                 $skinList = array_keys($aSkins);\r
4597                 \r
4598                 $aTemplates = requestIntArray('template');\r
4599                 if (!is_array($aTemplates))\r
4600                 {\r
4601                         $aTemplates = array();\r
4602                 }\r
4603                 $templateList = array_keys($aTemplates);\r
4604                 \r
4605                 $info = postVar('info');\r
4606                 \r
4607                 include_libs('skinie.php');\r
4608                 $exporter = new SkinExport();\r
4609                 foreach ( $skinList as $skinId )\r
4610                 {\r
4611                         $exporter->addSkin($skinId);\r
4612                 }\r
4613                 foreach ( $templateList as $templateId )\r
4614                 {\r
4615                         $exporter->addTemplate($templateId);\r
4616                 }\r
4617                 $exporter->setInfo($info);\r
4618                 $exporter->export();\r
4619                 return;\r
4620         }\r
4621         \r
4622         /**\r
4623          * Admin::action_settingsedit()\r
4624          * \r
4625          * @param       Void\r
4626          * @return      Void\r
4627          */\r
4628         static private function action_settingsedit()\r
4629         {\r
4630                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4631                 \r
4632                 $member->isAdmin() or self::disallow();\r
4633                 \r
4634                 self::$skin->parse('settingsedit');\r
4635                 return;\r
4636         }\r
4637         \r
4638         /**\r
4639          * Admin::action_settingsupdate()\r
4640          * Update $CONFIG and redirect\r
4641          * \r
4642          * @param       void\r
4643          * @return      void\r
4644          */\r
4645         static private function action_settingsupdate()\r
4646         {\r
4647                 global $member, $CONF;\r
4648                 \r
4649                 $member->isAdmin() or self::disallow();\r
4650                 \r
4651                 // check if email address for admin is valid\r
4652                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4653                 {\r
4654                         self::error(_ERROR_BADMAILADDRESS);\r
4655                 }\r
4656                 \r
4657                 // save settings\r
4658                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4659                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4660                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4661                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4662                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4663                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4664                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4665                 self::updateConfig('Locale',                    postVar('Locale'));\r
4666                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4667                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4668                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4669                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4670                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4671                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4672                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4673                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4674                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4675                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4676                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4677                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4678                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4679                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4680                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4681                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4682                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4683                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4684                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4685                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4686                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4687                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4688                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4689                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4690                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4691                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4692                 self::updateConfig('AdminSkin',                 postVar('adminskin'));\r
4693                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));\r
4694 \r
4695                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4696                 // note that when changing cookie settings, this redirect might cause the user\r
4697                 // to have to log in again.\r
4698                 getConfig();\r
4699                 redirect($CONF['AdminURL'] . '?action=manage');\r
4700                 return;\r
4701         }\r
4702         \r
4703         /**\r
4704          * Admin::action_systemoverview()\r
4705          * Output system overview\r
4706          * \r
4707          * @param       void\r
4708          * @return      void\r
4709          */\r
4710         static private function action_systemoverview()\r
4711         {\r
4712                 self::$skin->parse('systemoverview');\r
4713                 return;\r
4714         }\r
4715         \r
4716         /**\r
4717          * Admin::updateConfig()\r
4718          * \r
4719          * @param       string  $name   \r
4720          * @param       string  $val    \r
4721          * @return      integer return the ID in which the latest query posted\r
4722          */\r
4723         static private function updateConfig($name, $val)\r
4724         {\r
4725                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4726                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4727                 if ( DB::execute($query) === FALSE )\r
4728                 {\r
4729                         $err = DB::getError();\r
4730                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4731                 }\r
4732                 return DB::getInsertId();\r
4733         }\r
4734         \r
4735         /**\r
4736          * Admin::error()\r
4737          * Error message\r
4738          * \r
4739          * @param       string  $msg    message that will be shown\r
4740          * @return      void\r
4741          */\r
4742         static public function error($msg)\r
4743         {\r
4744                 self::$headMess = $msg;\r
4745                 self::$skin->parse('adminerrorpage');\r
4746                 return;\r
4747         }\r
4748         \r
4749         /**\r
4750          * Admin::disallow()\r
4751          * add error log and show error page \r
4752          * \r
4753          * @param       void\r
4754          * @return      void\r
4755          */\r
4756         static public function disallow()\r
4757         {\r
4758                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4759                 self::error(_ERROR_DISALLOWED);\r
4760                 return;\r
4761         }\r
4762 \r
4763         /**\r
4764          * Admin::action_PluginAdmin()\r
4765          * Output pluginadmin\r
4766          *\r
4767          * @param       string  $skinContents\r
4768          * @param       string  $extrahead\r
4769          * @return      void\r
4770          */\r
4771         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4772         {\r
4773                 self::$extrahead .= $extrahead;\r
4774                 self::$skin->parse('pluginadmin', $skinContents);\r
4775                 return;\r
4776         }\r
4777         \r
4778         /**\r
4779          * Admin::action_bookmarklet()\r
4780          * \r
4781          * @param       void\r
4782          * @return      void\r
4783          */\r
4784         static private function action_bookmarklet()\r
4785         {\r
4786                 global $member, $manager;\r
4787                 \r
4788                 $blogid = intRequestVar('blogid');\r
4789                 $member->teamRights($blogid) or self::disallow();\r
4790                 \r
4791                 self::$skin->parse('bookmarklet');\r
4792                 return;\r
4793         }\r
4794         \r
4795         /**\r
4796          * Admin::action_actionlog()\r
4797          * \r
4798          * @param       void\r
4799          * @return      void\r
4800          */\r
4801         static private function action_actionlog()\r
4802         {\r
4803                 global $member, $manager;\r
4804                 \r
4805                 $member->isAdmin() or self::disallow();\r
4806                 \r
4807                 self::$skin->parse('actionlog');\r
4808                 return;\r
4809         }\r
4810         \r
4811         /**\r
4812          * Admin::action_banlist()\r
4813          * \r
4814          * @param       void\r
4815          * @return      void\r
4816          */\r
4817         static private function action_banlist()\r
4818         {\r
4819                 global $member, $manager;\r
4820                 \r
4821                 $blogid = intRequestVar('blogid');\r
4822                 $member->blogAdminRights($blogid) or self::disallow();\r
4823                 \r
4824                 self::$skin->parse('banlist');\r
4825                 return;\r
4826         }\r
4827         \r
4828         /**\r
4829          * Admin::action_banlistdelete()\r
4830          * \r
4831          * @param       void\r
4832          * @return      void\r
4833          */\r
4834         static private function action_banlistdelete()\r
4835         {\r
4836                 global $member, $manager;\r
4837                 \r
4838                 $blogid = intRequestVar('blogid');\r
4839                 $member->blogAdminRights($blogid) or self::disallow();\r
4840                 \r
4841                 self::$skin->parse('banlistdelete');\r
4842                 return;\r
4843         }\r
4844         \r
4845         /**\r
4846          * Admin::action_banlistdeleteconfirm()\r
4847          * \r
4848          * @param       void\r
4849          * @return      void\r
4850          */\r
4851         static private function action_banlistdeleteconfirm()\r
4852         {\r
4853                 global $member, $manager;\r
4854                 \r
4855                 $blogid         = intPostVar('blogid');\r
4856                 $allblogs       = postVar('allblogs');\r
4857                 $iprange        = postVar('iprange');\r
4858                 \r
4859                 $member->blogAdminRights($blogid) or self::disallow();\r
4860                 \r
4861                 $deleted = array();\r
4862                 \r
4863                 if ( !$allblogs )\r
4864                 {\r
4865                         if ( Ban::removeBan($blogid, $iprange) )\r
4866                         {\r
4867                                 $deleted[] = $blogid;\r
4868                         }\r
4869                 }\r
4870                 else\r
4871                 {\r
4872                         // get blogs fot which member has admin rights\r
4873                         $adminblogs = $member->getAdminBlogs();\r
4874                         foreach ($adminblogs as $blogje)\r
4875                         {\r
4876                                 if ( Ban::removeBan($blogje, $iprange) )\r
4877                                 {\r
4878                                         $deleted[] = $blogje;\r
4879                                 }\r
4880                         }\r
4881                 }\r
4882                 \r
4883                 if ( sizeof($deleted) == 0 )\r
4884                 {\r
4885                         self::error(_ERROR_DELETEBAN);\r
4886                 }\r
4887                 \r
4888                 /* TODO: we should use other ways */\r
4889                 $_REQUEST['delblogs'] = $deleted;\r
4890                 \r
4891                 self::$skin->parse('banlistdeleteconfirm');\r
4892                 return;\r
4893         }\r
4894         \r
4895         /**\r
4896          * Admin::action_banlistnewfromitem()\r
4897          * \r
4898          * @param       void\r
4899          * @return      void\r
4900          */\r
4901         static private function action_banlistnewfromitem()\r
4902         {\r
4903                 global $manager;\r
4904                 \r
4905                 $itemid = intRequestVar('itemid');\r
4906                 $item =& $manager->getItem($itemid, 1, 1);\r
4907                 self::action_banlistnew($item['blogid']);\r
4908                 return;\r
4909         }\r
4910         \r
4911         /**\r
4912          * Admin::action_banlistnew()\r
4913          * \r
4914          * @param       integer $blogid ID for weblog\r
4915          * @return      void\r
4916          */\r
4917         static private function action_banlistnew($blogid = '')\r
4918         {\r
4919                 global $member, $manager;\r
4920                 \r
4921                 if ( $blogid == '' )\r
4922                 {\r
4923                         $blogid = intRequestVar('blogid');\r
4924                 }\r
4925                 \r
4926                 $ip = requestVar('ip');\r
4927                 \r
4928                 $member->blogAdminRights($blogid) or self::disallow();\r
4929                 \r
4930                 /* TODO: we should consider to use the other way instead of this */\r
4931                 $_REQUEST['blogid'] = $blogid;          \r
4932                 \r
4933                 self::$skin->parse('banlistnew');\r
4934                 \r
4935                 return;\r
4936         }\r
4937 \r
4938         /**\r
4939          * Admin::action_banlistadd()\r
4940          * \r
4941          * @param       void\r
4942          * @return      void\r
4943          */\r
4944         static private function action_banlistadd()\r
4945         {\r
4946                 global $member;\r
4947                 \r
4948                 $blogid         = intPostVar('blogid');\r
4949                 $allblogs       = postVar('allblogs');\r
4950                 $iprange        = postVar('iprange');\r
4951                 \r
4952                 if ( $iprange == "custom" )\r
4953                 {\r
4954                         $iprange = postVar('customiprange');\r
4955                 }\r
4956                 $reason   = postVar('reason');\r
4957                 \r
4958                 $member->blogAdminRights($blogid) or self::disallow();\r
4959                 \r
4960                 // TODO: check IP range validity\r
4961                 \r
4962                 if ( !$allblogs )\r
4963                 {\r
4964                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4965                         {\r
4966                                 self::error(_ERROR_ADDBAN);\r
4967                         }\r
4968                 }\r
4969                 else\r
4970                 {\r
4971                         // get blogs fot which member has admin rights\r
4972                         $adminblogs = $member->getAdminBlogs();\r
4973                         $failed = 0;\r
4974                         foreach ($adminblogs as $blogje)\r
4975                         {\r
4976                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4977                                 {\r
4978                                         $failed = 1;\r
4979                                 }\r
4980                         }\r
4981                         if ( $failed )\r
4982                         {\r
4983                                 self::error(_ERROR_ADDBAN);\r
4984                         }\r
4985                 }\r
4986                 self::action_banlist();\r
4987                 return;\r
4988         }\r
4989         \r
4990         /**\r
4991          * Admin::action_clearactionlog()\r
4992          * \r
4993          * @param       void\r
4994          * @return      void\r
4995          */\r
4996         static private function action_clearactionlog()\r
4997         {\r
4998                 global $member;\r
4999                 \r
5000                 $member->isAdmin() or self::disallow();\r
5001                 \r
5002                 ActionLog::clear();\r
5003                 \r
5004                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5005                 return;\r
5006         }\r
5007         \r
5008         /**\r
5009          * Admin::action_backupoverview()\r
5010          * \r
5011          * @param       void\r
5012          * @return      void\r
5013          */\r
5014         static private function action_backupoverview()\r
5015         {\r
5016                 global $member, $manager;\r
5017                 \r
5018                 $member->isAdmin() or self::disallow();\r
5019                 \r
5020                 self::$skin->parse('backupoverview');\r
5021                 return;\r
5022         }\r
5023 \r
5024         /**\r
5025          * Admin::action_backupcreate()\r
5026          * create file for backup\r
5027          * \r
5028          * @param               void\r
5029          * @return      void\r
5030          * \r
5031          */\r
5032         static private function action_backupcreate()\r
5033         {\r
5034                 global $member, $DIR_LIBS;\r
5035                 \r
5036                 $member->isAdmin() or self::disallow();\r
5037                 \r
5038                 // use compression ?\r
5039                 $useGzip = (integer) postVar('gzip');\r
5040                 \r
5041                 include($DIR_LIBS . 'backup.php');\r
5042                 \r
5043                 // try to extend time limit\r
5044                 // (creating/restoring dumps might take a while)\r
5045                 @set_time_limit(1200);\r
5046                 \r
5047                 Backup::do_backup($useGzip);\r
5048                 exit;\r
5049         }\r
5050         \r
5051         /**\r
5052          * Admin::action_backuprestore()\r
5053          * restoring from uploaded file\r
5054          * \r
5055          * @param               void\r
5056          * @return      void\r
5057          */\r
5058         static private function action_backuprestore()\r
5059         {\r
5060                 global $member, $DIR_LIBS;\r
5061                 \r
5062                 $member->isAdmin() or self::disallow();\r
5063                 \r
5064                 if ( intPostVar('letsgo') != 1 )\r
5065                 {\r
5066                         self::error(_ERROR_BACKUP_NOTSURE);\r
5067                 }\r
5068                 \r
5069                 include($DIR_LIBS . 'backup.php');\r
5070                 \r
5071                 // try to extend time limit\r
5072                 // (creating/restoring dumps might take a while)\r
5073                 @set_time_limit(1200);\r
5074                 \r
5075                 $message = Backup::do_restore();\r
5076                 if ( $message != '' )\r
5077                 {\r
5078                         self::error($message);\r
5079                 }\r
5080                 self::$skin->parse('backuprestore');\r
5081                 return;\r
5082         }\r
5083         \r
5084         /**\r
5085          * Admin::action_pluginlist()\r
5086          * output the list of installed plugins\r
5087          * \r
5088          * @param       void\r
5089          * @return      void\r
5090          * \r
5091          */\r
5092         static private function action_pluginlist()\r
5093         {\r
5094                 global $DIR_PLUGINS, $member, $manager;\r
5095                 \r
5096                 // check if allowed\r
5097                 $member->isAdmin() or self::disallow();\r
5098                 \r
5099                 self::$skin->parse('pluginlist');\r
5100                 return;\r
5101         }\r
5102         \r
5103         /**\r
5104          * Admin::action_pluginhelp()\r
5105          * \r
5106          * @param       void\r
5107          * @return      void\r
5108          */\r
5109         static private function action_pluginhelp()\r
5110         {\r
5111                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5112                 \r
5113                 // check if allowed\r
5114                 $member->isAdmin() or self::disallow();\r
5115                 \r
5116                 $plugid = intGetVar('plugid');\r
5117                 \r
5118                 if ( !$manager->pidInstalled($plugid) )\r
5119                 {\r
5120                         self::error(_ERROR_NOSUCHPLUGIN);\r
5121                 }\r
5122                 \r
5123                 self::$skin->parse('pluginhelp');\r
5124                 return;\r
5125         }\r
5126         \r
5127         /**\r
5128          * Admin::action_pluginadd()\r
5129          * \r
5130          * @param       Void\r
5131          * @return      Void\r
5132          * \r
5133          */\r
5134         static private function action_pluginadd()\r
5135         {\r
5136                 global $member, $manager, $DIR_PLUGINS;\r
5137                 \r
5138                 // check if allowed\r
5139                 $member->isAdmin() or self::disallow();\r
5140                 \r
5141                 $name = postVar('filename');\r
5142                 \r
5143                 if ( $manager->pluginInstalled($name) )\r
5144                 {\r
5145                         self::error(_ERROR_DUPPLUGIN);\r
5146                 }\r
5147                 \r
5148                 if ( !checkPlugin($name) )\r
5149                 {\r
5150                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5151                 }\r
5152                 \r
5153                 // get number of currently installed plugins\r
5154                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5155                 $numCurrent = $res->rowCount();\r
5156                 \r
5157                 // plugin will be added as last one in the list\r
5158                 $newOrder = $numCurrent + 1;\r
5159                 \r
5160                 $data = array('file' => &$name);\r
5161                 $manager->notify('PreAddPlugin', $data);\r
5162                 \r
5163                 // do this before calling getPlugin (in case the plugin id is used there)\r
5164                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5165                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5166                 DB::execute($query);\r
5167                 $iPid = DB::getInsertId();\r
5168                 \r
5169                 $manager->clearCachedInfo('installedPlugins');\r
5170                 \r
5171                 // Load the plugin for condition checking and instalation\r
5172                 $plugin =& $manager->getPlugin($name);\r
5173                 \r
5174                 // check if it got loaded (could have failed)\r
5175                 if ( !$plugin )\r
5176                 {\r
5177                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5178                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5179                         \r
5180                         DB::execute($query);\r
5181                         \r
5182                         $manager->clearCachedInfo('installedPlugins');\r
5183                         self::error(_ERROR_PLUGIN_LOAD);\r
5184                 }\r
5185                 \r
5186                 // check if plugin needs a newer Nucleus version\r
5187                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5188                 {\r
5189                         // uninstall plugin again...\r
5190                         self::deleteOnePlugin($plugin->getID());\r
5191                         \r
5192                         // ...and show error\r
5193                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5194                 }\r
5195                 \r
5196                 // check if plugin needs a newer Nucleus version\r
5197                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5198                 {\r
5199                         // uninstall plugin again...\r
5200                         self::deleteOnePlugin($plugin->getID());\r
5201                         \r
5202                         // ...and show error\r
5203                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5204                 }\r
5205                 \r
5206                 $pluginList = $plugin->getPluginDep();\r
5207                 foreach ( $pluginList as $pluginName )\r
5208                 {\r
5209                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5210                         if ($res->rowCount() == 0)\r
5211                         {\r
5212                                 // uninstall plugin again...\r
5213                                 self::deleteOnePlugin($plugin->getID());\r
5214                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5215                         }\r
5216                 }\r
5217                 \r
5218                 // call the install method of the plugin\r
5219                 $plugin->install();\r
5220                 \r
5221                 $data = array('plugin' => &$plugin);\r
5222                 $manager->notify('PostAddPlugin', $data);\r
5223                 \r
5224                 // update all events\r
5225                 self::action_pluginupdate();\r
5226                 return;\r
5227         }\r
5228         \r
5229         /**\r
5230          * ADMIN:action_pluginupdate():\r
5231          * \r
5232          * @param       Void\r
5233          * @return      Void\r
5234          * \r
5235          */\r
5236         static private function action_pluginupdate()\r
5237         {\r
5238                 global $member, $manager, $CONF;\r
5239                 \r
5240                 // check if allowed\r
5241                 $member->isAdmin() or self::disallow();\r
5242                 \r
5243                 // delete everything from plugin_events\r
5244                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5245                 \r
5246                 // loop over all installed plugins\r
5247                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5248                 foreach ( $res as $row )\r
5249                 {\r
5250                         $pid  =  $row['pid'];\r
5251                         $plug =& $manager->getPlugin($row['pfile']);\r
5252                         if ( $plug )\r
5253                         {\r
5254                                 $eventList = $plug->getEventList();\r
5255                                 foreach ( $eventList as $eventName )\r
5256                                 {\r
5257                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5258                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5259                                         DB::execute($query);\r
5260                                 }\r
5261                         }\r
5262                 }\r
5263                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5264                 return;\r
5265         }\r
5266         \r
5267         /**\r
5268          * Admin::action_plugindelete()\r
5269          * \r
5270          * @param       void\r
5271          * @return      void\r
5272          */\r
5273         static private function action_plugindelete()\r
5274         {\r
5275                 global $member, $manager;\r
5276                 \r
5277                 // check if allowed\r
5278                 $member->isAdmin() or self::disallow();\r
5279                 \r
5280                 $pid = intGetVar('plugid');\r
5281                 \r
5282                 if ( !$manager->pidInstalled($pid) )\r
5283                 {\r
5284                         self::error(_ERROR_NOSUCHPLUGIN);\r
5285                 }\r
5286                 \r
5287                 self::$skin->parse('plugindelete');\r
5288                 return;\r
5289         }\r
5290 \r
5291         /**\r
5292          * Admin::action_plugindeleteconfirm()\r
5293          * \r
5294          * @param       void\r
5295          * @return      void\r
5296          */\r
5297         static private function action_plugindeleteconfirm()\r
5298         {\r
5299                 global $member, $manager, $CONF;\r
5300                 \r
5301                 // check if allowed\r
5302                 $member->isAdmin() or self::disallow();\r
5303                 \r
5304                 $pid = intPostVar('plugid');\r
5305                 \r
5306                 $error = self::deleteOnePlugin($pid, 1);\r
5307                 if ( $error )\r
5308                 {\r
5309                         self::error($error);\r
5310                 }\r
5311                 \r
5312                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5313                 return;\r
5314         }\r
5315         \r
5316         /**\r
5317          * Admin::\r
5318          * \r
5319          * @param       void\r
5320          * @return      void\r
5321          */\r
5322         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5323         {\r
5324                 global $manager;\r
5325                 \r
5326                 $pid = intval($pid);\r
5327                 \r
5328                 if ( !$manager->pidInstalled($pid) )\r
5329                 {\r
5330                         return _ERROR_NOSUCHPLUGIN;\r
5331                 }\r
5332                 \r
5333                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5334                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5335                 $name = DB::getValue($query);\r
5336                 \r
5337                 // check dependency before delete\r
5338                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5339                 foreach ( $res as $row )\r
5340                 {\r
5341                         $plug =& $manager->getPlugin($row['pfile']);\r
5342                         if ( $plug )\r
5343                         {\r
5344                                 $depList = $plug->getPluginDep();\r
5345                                 foreach ( $depList as $depName )\r
5346                                 {\r
5347                                         if ( $name == $depName )\r
5348                                         {\r
5349                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5350                                         }\r
5351                                 }\r
5352                         }\r
5353                 }\r
5354                 \r
5355                 $data = array('plugid' => $pid);\r
5356                 $manager->notify('PreDeletePlugin', $data);\r
5357                 \r
5358                 // call the unInstall method of the plugin\r
5359                 if ( $callUninstall )\r
5360                 {\r
5361                         $plugin =& $manager->getPlugin($name);\r
5362                         if ( $plugin )\r
5363                         {\r
5364                                 $plugin->unInstall();\r
5365                         }\r
5366                 }\r
5367                 \r
5368                 // delete all subscriptions\r
5369                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5370                 \r
5371                 // delete all options\r
5372                 // get OIDs from plugin_option_desc\r
5373                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5374                 $aOIDs = array();\r
5375                 foreach ( $res as $row )\r
5376                 {\r
5377                         array_push($aOIDs, $row['oid']);\r
5378                 }\r
5379                 \r
5380                 // delete from plugin_option and plugin_option_desc\r
5381                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5382                 if (count($aOIDs) > 0)\r
5383                 {\r
5384                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5385                 }\r
5386                 \r
5387                 // update order numbers\r
5388                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5389                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5390                 \r
5391                 // delete row\r
5392                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5393                 \r
5394                 $manager->clearCachedInfo('installedPlugins');\r
5395                 $data = array('plugid' => $pid);\r
5396                 $manager->notify('PostDeletePlugin', $data);\r
5397                 \r
5398                 return '';\r
5399         }\r
5400         \r
5401         /**\r
5402          * Admin::action_pluginup()\r
5403          * \r
5404          * @param       void\r
5405          * @return      void\r
5406          */\r
5407         static private function action_pluginup()\r
5408         {\r
5409                 global $member, $manager, $CONF;\r
5410                 \r
5411                 // check if allowed\r
5412                 $member->isAdmin() or self::disallow();\r
5413                 \r
5414                 $plugid = intGetVar('plugid');\r
5415                 \r
5416                 if ( !$manager->pidInstalled($plugid) )\r
5417                 {\r
5418                         self::error(_ERROR_NOSUCHPLUGIN);\r
5419                 }\r
5420                 \r
5421                 // 1. get old order number\r
5422                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5423                 \r
5424                 // 2. calculate new order number\r
5425                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5426                 \r
5427                 // 3. update plug numbers\r
5428                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5429                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5430                 \r
5431                 //self::action_pluginlist();\r
5432                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5433                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5434                 return;\r
5435         }\r
5436         \r
5437         /**\r
5438          * Admin::action_plugindown()\r
5439          * \r
5440          * @param       void\r
5441          * @return      void\r
5442          */\r
5443         static private function action_plugindown()\r
5444         {\r
5445                 global $member, $manager, $CONF;\r
5446                 \r
5447                 // check if allowed\r
5448                 $member->isAdmin() or self::disallow();\r
5449                 \r
5450                 $plugid = intGetVar('plugid');\r
5451                 if ( !$manager->pidInstalled($plugid) )\r
5452                 {\r
5453                         self::error(_ERROR_NOSUCHPLUGIN);\r
5454                 }\r
5455                 \r
5456                 // 1. get old order number\r
5457                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5458                 \r
5459                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5460                 $maxOrder = $res->rowCount();\r
5461                 \r
5462                 // 2. calculate new order number\r
5463                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5464                 \r
5465                 // 3. update plug numbers\r
5466                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5467                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5468                 \r
5469                 //self::action_pluginlist();\r
5470                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5471                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5472                 return;\r
5473         }\r
5474         \r
5475         /**\r
5476          * Admin::action_pluginoptions()\r
5477          * \r
5478          * Output Plugin option page\r
5479          * \r
5480          * @access      public\r
5481          * @param       string $message message when fallbacked\r
5482          * @return      void\r
5483          * \r
5484          */\r
5485         static private function action_pluginoptions($message = '')\r
5486         {\r
5487                 global $member, $manager;\r
5488                 \r
5489                 // check if allowed\r
5490                 $member->isAdmin() or self::disallow();\r
5491                 \r
5492                 $pid = intRequestVar('plugid');\r
5493                 if ( !$manager->pidInstalled($pid) )\r
5494                 {\r
5495                         self::error(_ERROR_NOSUCHPLUGIN);\r
5496                 }\r
5497                 \r
5498                 if ( isset($message) )\r
5499                 {\r
5500                         self::$headMess = $message;\r
5501                 }\r
5502                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5503                 $plugin         = $manager->getPlugin($plugname);\r
5504                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
5505                 \r
5506                 self::$skin->parse('pluginoptions');\r
5507                 return;\r
5508         }\r
5509         \r
5510         /**\r
5511          * Admin::action_pluginoptionsupdate()\r
5512          * \r
5513          * Update plugin options and fallback to plugin option page\r
5514          * \r
5515          * @access      public\r
5516          * @param       void\r
5517          * @return      void\r
5518          */\r
5519         static private function action_pluginoptionsupdate()\r
5520         {\r
5521                 global $member, $manager;\r
5522                 \r
5523                 // check if allowed\r
5524                 $member->isAdmin() or self::disallow();\r
5525                 \r
5526                 $pid = intRequestVar('plugid');\r
5527                 \r
5528                 if ( !$manager->pidInstalled($pid) )\r
5529                 {\r
5530                         self::error(_ERROR_NOSUCHPLUGIN);\r
5531                 }\r
5532                 \r
5533                 $aOptions = requestArray('plugoption');\r
5534                 NucleusPlugin::apply_plugin_options($aOptions);\r
5535                 \r
5536                 $data = array(\r
5537                         'context'       => 'global',\r
5538                         'plugid'        => $pid\r
5539                 );\r
5540                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5541                 \r
5542                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5543                 return;\r
5544         }\r
5545         \r
5546         /**\r
5547          * Admin::action_parseSpecialskin()\r
5548          * \r
5549          * @param       void\r
5550          * @return      void\r
5551          */\r
5552         static private function action_parseSpecialskin()\r
5553         {\r
5554                 self::$skin->parse(self::$action);\r
5555                 return;\r
5556         }\r
5557         \r
5558         /**\r
5559          * Admin::getAdminskinIDFromName()\r
5560          * \r
5561          * @param       string  $skinname       name of skin\r
5562          * @return      integer ID for skin\r
5563          */\r
5564         static private function getAdminskinIDFromName($skinname)\r
5565         {\r
5566                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5567                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5568                 $admnSknID      = DB::getValue($query);\r
5569                 return (integer) $adminSkinID;\r
5570         }\r
5571         \r
5572         /**\r
5573          * Admin::getAdminskinNameFromID()\r
5574          * \r
5575          * @param       integer $skinid ID for skin\r
5576          * @return      integer ID for skin\r
5577          */\r
5578         static private function getAdminskinNameFromID($skinid)\r
5579         {\r
5580                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5581                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5582                 $admnSknID      = DB::getValue($query);\r
5583                 return (integer) $adminSkinID;\r
5584         }\r
5585         \r
5586         /**\r
5587          * Admin::getAdminextrahead()\r
5588          */\r
5589         static public function getAdminextrahead()\r
5590         {\r
5591                 return self::$extrahead;\r
5592         }\r
5593         \r
5594         /**\r
5595          * Admin::getAdminpassvar()\r
5596          */\r
5597         static public function getAdminpassvar()\r
5598         {\r
5599                 return self::$passvar;\r
5600         }\r
5601         \r
5602         /**\r
5603          * Admin::getAdminAction()\r
5604          */\r
5605         static public function getAdminAction()\r
5606         {\r
5607                 return self::$action;\r
5608         }\r
5609         \r
5610         /**\r
5611          * Admin::getAdminaOption()\r
5612          */\r
5613         static public function getAdminaOption()\r
5614         {\r
5615                 return self::$aOptions;\r
5616         }\r
5617         \r
5618         /**\r
5619          * Admin::action_importAdmin()\r
5620          * \r
5621          * @param       void\r
5622          * @return      void\r
5623          */\r
5624         static private function action_importAdmin()\r
5625         {\r
5626                 global $DIR_ADMINSKINS, $action;\r
5627                 if ( $action == 'adminskinieimport' )\r
5628                 {\r
5629                         self::doAdminskinimport();\r
5630                 }\r
5631                 $skn = array();\r
5632                 if ( $action == 'showlogin' )\r
5633                 {\r
5634                         $skinName = 'showlogin';\r
5635                         $actnName = 'showlogin';\r
5636                 }\r
5637                 else\r
5638                 {\r
5639                         $skinName = 'defaultimporter';\r
5640                         $actnName = 'importAdmin';\r
5641                 }\r
5642                 \r
5643                 /* TODO: why??? */\r
5644                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5645                 $skn['id']                              = 0;\r
5646                 $skn['description']             = $skinName;\r
5647                 $skn['contentType']             = 'importAdmin';\r
5648                 $skn['includeMode']             = 'normal';\r
5649                 $skn['includePrefix']   = '';\r
5650                 $skn['name']                    = 'defaultinporter';\r
5651                 \r
5652                 self::$skin                             = (object) $skn;\r
5653                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5654                 \r
5655                 $parser = new PARSER($handler);\r
5656                 $parser->setSkin(self::$skin);\r
5657                 $parser->parse($contents);\r
5658                 \r
5659                 return;\r
5660         }\r
5661         \r
5662         /**\r
5663          * Admin::doAdminskinimport()\r
5664          * \r
5665          * @param       void\r
5666          * @return      void\r
5667          */\r
5668         static private function doAdminskinimport()\r
5669         {\r
5670                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5671                 \r
5672                 $member->isAdmin() or self::disallow();\r
5673                 \r
5674                 include_once($DIR_LIBS . 'Skinie.php');\r
5675                 $skinFileRaw    = postVar('skinfile');\r
5676                 $mode                   = postVar('mode');\r
5677                 $allowOverwrite = intPostVar('overwrite');\r
5678                 \r
5679                 if ( $mode == 'file' )\r
5680                 {\r
5681                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5682                 }\r
5683                 else\r
5684                 {\r
5685                         $skinFile = $skinFileRaw;\r
5686                 }\r
5687                 \r
5688                 $importer       = new SKINIMPORT();\r
5689                 $error          = $importer->readFile($skinFile);\r
5690                 if ( $error )\r
5691                 {\r
5692                         self::error($error);\r
5693                 }\r
5694                 $error = $importer->writeToDatabase($allowOverwrite);\r
5695                 if ( $error )\r
5696                 {\r
5697                         self::error($error);\r
5698                 }\r
5699                 \r
5700                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5701                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5702                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5703                 \r
5704                 header('Location: ' . $CONF['AdminURL']);\r
5705                 exit;\r
5706         }\r
5707 }\r