nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                         );\r
 212                 }\r
 213                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 214                 {\r
 215                         $action = $alias[$action];\r
 216                 }\r
 217                 $methodName = "action_{$action}";\r
 218                 self::$action = strtolower($action);\r
 219                 \r
 220                 /* 2. check the action */\r
 221                 $synonimActions = array(\r
 222                         'banlistnewfromitem',\r
 223                         'memberedit',\r
 224                         'login',\r
 225                 );\r
 226                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 227                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 228                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 229                 {\r
 230                         if (!$manager->checkTicket())\r
 231                         {\r
 232                                 self::error(_ERROR_BADTICKET);\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                 }\r
 251                 elseif ( $id != $CONF['AdminSkin'] )\r
 252                 {\r
 253                         self::$skin = new Skin($CONF['AdminSkin'], 'AdminActions');\r
 254                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 255                         {\r
 256                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 257                         }\r
 258                 }\r
 259                 else\r
 260                 {\r
 261                         self::error(_BADACTION . ENTITY::hsc($action));\r
 262                 }\r
 263                 exit;\r
 264         }\r
 265         \r
 266         /**\r
 267          * Action::existsSkinContents()\r
 268          * Check skin contents\r
 269          *\r
 270          * @param       string  $action action type\r
 271          * @return      boolean\r
 272          */\r
 273         static private function existsSkinContents($action)\r
 274         {\r
 275                 $in_array  = in_array($action, self::$skinless_actions);\r
 276                 \r
 277                 if ( $in_array )\r
 278                 {\r
 279                         return $in_array;\r
 280                 }\r
 281                 else\r
 282                 {\r
 283                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 284                         /* TODO: skinid should be a default */\r
 285                         if ( !is_object(self::$skin) )\r
 286                         {\r
 287                                 global $CONF;\r
 288                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 289                         }\r
 290                         else\r
 291                         {\r
 292                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 293                         }\r
 294                 }\r
 295                 return;\r
 296         }\r
 297         \r
 298         /**\r
 299          * Action::specialActionsAllow()\r
 300          * Check exists specialskinparts\r
 301          *\r
 302          * @param       string  $action action type\r
 303          * @return boolean\r
 304          */\r
 305         static private function specialActionsAllow($action)\r
 306         {\r
 307                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 308                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 309                 return DB::getValue($query);\r
 310         }\r
 311         \r
 312         /**\r
 313          * Action::action_showlogin()\r
 314          * \r
 315          * @param       void\r
 316          * @return      void\r
 317          */\r
 318         static private function action_showlogin()\r
 319         {\r
 320                 global $error;\r
 321                 self::action_login($error);\r
 322                 return;\r
 323         }\r
 324         \r
 325         /**\r
 326          * Action::action_login()\r
 327          * \r
 328          * @param       string  $msg            message for pageheader\r
 329          * @param       integer $passvars       ???\r
 330          */\r
 331         static private function action_login($msg = '', $passvars = 1)\r
 332         {\r
 333                 global $member;\r
 334                 \r
 335                 // skip to overview when allowed\r
 336                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 337                 {\r
 338                         self::action_overview();\r
 339                         exit;\r
 340                 }\r
 341                 \r
 342                 /* TODO: needless variable??? */\r
 343                 self::$passvar = $passvars;\r
 344                 if ( $msg )\r
 345                 {\r
 346                         self::$headMess = $msg;\r
 347                 }\r
 348                 \r
 349                 self::$skin->parse('showlogin');\r
 350         }\r
 351         \r
 352         /**\r
 353          * Action::action_overview()\r
 354          * provides a screen with the overview of the actions available\r
 355          * \r
 356          * @param       string  $msg    message for pageheader\r
 357          * @return      void\r
 358          */\r
 359         static private function action_overview($msg = '')\r
 360         {\r
 361                 if ( $msg )\r
 362                 {\r
 363                         self::$headMess = $msg;\r
 364                 }\r
 365                 \r
 366                 self::$skin->parse('overview');\r
 367                 return;\r
 368         }\r
 369         \r
 370         /**\r
 371          * Admin::action_manage()\r
 372          * \r
 373          * @param       string  $msg    message for pageheader\r
 374          * @retrn       void\r
 375          */\r
 376         static private function action_manage($msg = '')\r
 377         {\r
 378                 global $member;\r
 379                 \r
 380                 if ( $msg )\r
 381                 {\r
 382                         self::$headMess = $msg;\r
 383                 }\r
 384                 $member->isAdmin() or self::disallow();\r
 385                 \r
 386                 self::$skin->parse('manage');\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::$skin->parse('itemlist');\r
 408                 return;\r
 409         }\r
 410         \r
 411         /**\r
 412          * Action::action_batchitem()\r
 413          * \r
 414          * @param       void\r
 415          * @return      void\r
 416          */\r
 417         static private function action_batchitem()\r
 418         {\r
 419                 global $member, $manager;\r
 420                 \r
 421                 $member->isLoggedIn() or self::disallow();\r
 422                 \r
 423                 $selected       = requestIntArray('batch');\r
 424                 $action         = requestVar('batchaction');\r
 425                 \r
 426                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 427                 {\r
 428                         self::error(_BATCH_NOSELECTION);\r
 429                 }\r
 430                 \r
 431                 // On move: when no destination blog/category chosen, show choice now\r
 432                 $destCatid = intRequestVar('destcatid');\r
 433                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 434                 {\r
 435                         self::batchMoveSelectDestination('item', $selected);\r
 436                 }\r
 437                 \r
 438                 // On delete: check if confirmation has been given\r
 439                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 440                 {\r
 441                         self::batchAskDeleteConfirmation('item', $selected);\r
 442                 }\r
 443                 \r
 444                 self::$skin->parse('batchitem');\r
 445                 return;\r
 446         }\r
 447         \r
 448         /**\r
 449          * Action::action_batchcomment()\r
 450          * \r
 451          * @param       void\r
 452          * @return      void\r
 453          */\r
 454         static private function action_batchcomment()\r
 455         {\r
 456                 global $member;\r
 457                 \r
 458                 $member->isLoggedIn() or self::disallow();\r
 459                 \r
 460                 $selected       = requestIntArray('batch');\r
 461                 $action         = requestVar('batchaction');\r
 462                 \r
 463                 // Show error when no items were selected\r
 464                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 465                 {\r
 466                         self::error(_BATCH_NOSELECTION);\r
 467                 }\r
 468                 \r
 469                 // On delete: check if confirmation has been given\r
 470                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 471                 {\r
 472                         self::batchAskDeleteConfirmation('comment', $selected);\r
 473                 }\r
 474                 \r
 475                 self::$skin->parse('batchcomment');\r
 476                 return;\r
 477         }\r
 478         \r
 479         /**\r
 480          * Admin::setAdminAction()\r
 481          *\r
 482          * @param       string  $action\r
 483          * @return      void\r
 484          */\r
 485         static public function setAdminAction($action)\r
 486         {\r
 487                 self::$action = $action;\r
 488                 return;\r
 489         }\r
 490         \r
 491         /**\r
 492          * Admin::action_batchmember()\r
 493          * \r
 494          * @param       void\r
 495          * @return      void\r
 496          */\r
 497         static private function action_batchmember()\r
 498         {\r
 499                 global $member;\r
 500                 \r
 501                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 502                 \r
 503                 $selected       = requestIntArray('batch');\r
 504                 $action         = requestVar('batchaction');\r
 505                 \r
 506                 // Show error when no members selected\r
 507                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 508                 {\r
 509                         self::error(_BATCH_NOSELECTION);\r
 510                 }\r
 511                 \r
 512                 // On delete: check if confirmation has been given\r
 513                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 514                 {\r
 515                         self::batchAskDeleteConfirmation('member',$selected);\r
 516                 }\r
 517                 \r
 518                 self::$skin->parse('batchmember');\r
 519                 return;\r
 520         }\r
 521         \r
 522         /**\r
 523          * Admin::action_batchteam()\r
 524          * \r
 525          * @param       void\r
 526          * @return      void\r
 527          */\r
 528         static private function action_batchteam()\r
 529         {\r
 530                 global $member;\r
 531                 \r
 532                 $blogid = intRequestVar('blogid');\r
 533                 \r
 534                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 535                 \r
 536                 $selected       = requestIntArray('batch');\r
 537                 $action         = requestVar('batchaction');\r
 538                 \r
 539                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 540                 {\r
 541                         self::error(_BATCH_NOSELECTION);\r
 542                 }\r
 543                 \r
 544                 // On delete: check if confirmation has been given\r
 545                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 546                 {\r
 547                         self::batchAskDeleteConfirmation('team',$selected);\r
 548                 }\r
 549                 \r
 550                 self::$skin->parse('batchteam');\r
 551                 return;\r
 552         }\r
 553         \r
 554         /**\r
 555          * Admin::action_batchcategory()\r
 556          * \r
 557          * @param       void\r
 558          * @return      void\r
 559          */\r
 560         static private function action_batchcategory()\r
 561         {\r
 562                 global $member, $manager;\r
 563                 \r
 564                 $member->isLoggedIn() or self::disallow();\r
 565                 \r
 566                 $selected       = requestIntArray('batch');\r
 567                 $action         = requestVar('batchaction');\r
 568                 \r
 569                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 570                 {\r
 571                         self::error(_BATCH_NOSELECTION);\r
 572                 }\r
 573                 \r
 574                 // On move: when no destination blog chosen, show choice now\r
 575                 $destBlogId = intRequestVar('destblogid');\r
 576                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 577                 {\r
 578                         self::batchMoveCategorySelectDestination('category', $selected);\r
 579                 }\r
 580                 \r
 581                 // On delete: check if confirmation has been given\r
 582                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 583                 {\r
 584                         self::batchAskDeleteConfirmation('category', $selected);\r
 585                 }\r
 586                 \r
 587                 self::$skin->parse('batchcategory');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::$skin->parse('batchmove');\r
 604                 return;\r
 605         }\r
 606         \r
 607         /**\r
 608          * Admin::batchMoveCategorySelectDestination()\r
 609          * \r
 610          * @param       string  $type   type of batch action\r
 611          * @param       integer $ids    needless???\r
 612          * @return      void\r
 613          * \r
 614          * TODO: remove needless argument\r
 615          */\r
 616         static private function batchMoveCategorySelectDestination($type, $ids)\r
 617         {\r
 618                 $_POST['batchmove'] = $type;\r
 619                 global $manager;\r
 620                 self::$skin->parse('batchmovecat');\r
 621                 return;\r
 622         }\r
 623         \r
 624         /**\r
 625          * Admin::batchAskDeleteConfirmation()\r
 626          * \r
 627          * @param       string  $type   type of batch action\r
 628          * @param       integer $ids    needless???\r
 629          * @return      void\r
 630          * \r
 631          * TODO: remove needless argument\r
 632          */\r
 633         static private function batchAskDeleteConfirmation($type, $ids)\r
 634         {\r
 635                 self::$skin->parse('batchdelete');\r
 636                 return;\r
 637         }\r
 638         \r
 639         /**\r
 640          * Admin::action_browseownitems()\r
 641          * \r
 642          * @param       void\r
 643          * @return      void\r
 644          */\r
 645         static private function action_browseownitems()\r
 646         {\r
 647                 global $member, $manager, $CONF;\r
 648                 \r
 649                 self::$skin->parse('browseownitems');\r
 650                 return;\r
 651         }\r
 652         \r
 653         /**\r
 654          * Admin::action_itemcommentlist()\r
 655          * Show all the comments for a given item\r
 656          * \r
 657          * @param       integer $itemid ID for item\r
 658          * @return      void\r
 659          */\r
 660         static private function action_itemcommentlist($itemid = '')\r
 661         {\r
 662                 global $member, $manager, $CONF;\r
 663                 \r
 664                 if ( $itemid == '' )\r
 665                 {\r
 666                         $itemid = intRequestVar('itemid');\r
 667                 }\r
 668                 \r
 669                 // only allow if user is allowed to alter item\r
 670                 $member->canAlterItem($itemid) or self::disallow();\r
 671                 \r
 672                 $item =& $manager->getItem($itemid, 1, 1);\r
 673                 $_REQUEST['itemid'] = $item['itemid'];\r
 674                 $_REQUEST['blogid'] = $item['blogid'];\r
 675                 \r
 676                 self::$skin->parse('itemcommentlist');\r
 677                 return;\r
 678         }\r
 679         \r
 680         /**\r
 681          * Admin::action_browseowncomments()\r
 682          * Browse own comments\r
 683          * \r
 684          * @param       void\r
 685          * @return      void\r
 686          */\r
 687         static private function action_browseowncomments()\r
 688         {\r
 689                 self::$skin->parse('browseowncomments');\r
 690                 return;\r
 691         }\r
 692         \r
 693         /**\r
 694          * Admin::action_blogcommentlist()\r
 695          * Browse all comments for a weblog\r
 696          * \r
 697          * @param       integer $blogid ID for weblog\r
 698          * @return      void\r
 699          */\r
 700         static private function action_blogcommentlist($blogid = '')\r
 701         {\r
 702                 global $member, $manager, $CONF;\r
 703                 \r
 704                 if ( $blogid == '' )\r
 705                 {\r
 706                         $blogid = intRequestVar('blogid');\r
 707                 }\r
 708                 else\r
 709                 {\r
 710                         $blogid = intval($blogid);\r
 711                 }\r
 712                 \r
 713                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 714                 \r
 715                 /* TODO: we consider to use the other way insterad of this */\r
 716                 $_REQUEST['blogid'] = $blogid;\r
 717                 \r
 718                 self::$skin->parse('blogcommentlist');\r
 719                 return;\r
 720         }\r
 721         \r
 722         /**\r
 723          * Admin::action_createaccount()\r
 724          * \r
 725          * @param       void\r
 726          * @return      void\r
 727          */\r
 728         static private function action_createaccount()\r
 729         {\r
 730                 global $CONF;\r
 731                 \r
 732                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 733                 {\r
 734                         self::$skin->parse('createaccountdisable');\r
 735                         return;\r
 736                 }\r
 737                 \r
 738                 $name = '';\r
 739                 $realname ='';\r
 740                 $email = '';\r
 741                 $url = '';\r
 742                 \r
 743                 $contents = array(\r
 744                         'name'          => '',\r
 745                         'realname'      => '',\r
 746                         'email'         => '',\r
 747                         'url'           => ''\r
 748                 );\r
 749                 \r
 750                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 751                 {\r
 752                         $action = new Action();\r
 753                         $message = $action->createAccount();\r
 754                         if ( $message === 1 )\r
 755                         {\r
 756                                 self::$headMess = $message;\r
 757                                 self::$skin->parse('createaccountsuccess');\r
 758                                 return;\r
 759                         }\r
 760                         \r
 761                         /* TODO: validation */\r
 762                         if ( array_key_exists('name', $_POST) )\r
 763                         {\r
 764                                 $contents['name'] = $_POST['name'];\r
 765                         }\r
 766                         if ( array_key_exists('realname', $_POST) )\r
 767                         {\r
 768                                 $contents['realname'] = $_POST['realname'];\r
 769                         }\r
 770                         if ( array_key_exists('email', $_POST) )\r
 771                         {\r
 772                                 $contents['email'] = $_POST['email'];\r
 773                         }\r
 774                         if ( array_key_exists('url', $_POST) )\r
 775                         {\r
 776                                 $contents['url'] = $_POST['url'];\r
 777                         }\r
 778                         \r
 779                         self::$contents = $contents;\r
 780                         \r
 781                 }\r
 782                 \r
 783                 self::$skin->parse('createaccountinput');\r
 784                 return;\r
 785         }\r
 786         \r
 787         /**\r
 788          * Admin::action_createitem()\r
 789          * Provide a page to item a new item to the given blog\r
 790          * \r
 791          * @param       void\r
 792          * @return      void\r
 793          */\r
 794         static private function action_createitem()\r
 795         {\r
 796                 global $member, $manager;\r
 797                 \r
 798                 $blogid = intRequestVar('blogid');\r
 799                 \r
 800                 // check if allowed\r
 801                 $member->teamRights($blogid) or self::disallow();\r
 802                 \r
 803                 $blog =& $manager->getBlog($blogid);\r
 804                 $contents = array();\r
 805                 \r
 806                 $data = array(\r
 807                         'blog'          => &$blog,\r
 808                         'contents'      => &$contents\r
 809                 );\r
 810                 $manager->notify('PreAddItemForm', $data);\r
 811                 \r
 812                 if ( $blog->convertBreaks() )\r
 813                 {\r
 814                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 815                         {\r
 816                                 $contents['body'] = removeBreaks($contents['body']);\r
 817                         }\r
 818                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 819                         {\r
 820                                 $contents['more'] = removeBreaks($contents['more']);\r
 821                         }\r
 822                 }\r
 823                 \r
 824                 self::$blog = &$blog;\r
 825                 self::$contents = &$contents;\r
 826                 \r
 827                 self::$skin->parse('createitem');\r
 828                 return;\r
 829         }\r
 830         \r
 831         /**\r
 832          * Admin::action_itemedit()\r
 833          * \r
 834          * @param       void\r
 835          * @return      void\r
 836          */\r
 837         static private function action_itemedit()\r
 838         {\r
 839                 global $member, $manager;\r
 840                 \r
 841                 $itemid = intRequestVar('itemid');\r
 842                 \r
 843                 // only allow if user is allowed to alter item\r
 844                 $member->canAlterItem($itemid) or self::disallow();\r
 845                 \r
 846                 $item =& $manager->getItem($itemid, 1, 1);\r
 847                 $blog =& $manager->getBlog($item['blogid']);\r
 848                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 849                 \r
 850                 if ( $blog->convertBreaks() )\r
 851                 {\r
 852                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 853                         {\r
 854                                 $item['body'] = removeBreaks($item['body']);\r
 855                         }\r
 856                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 857                         {\r
 858                                 $item['more'] = removeBreaks($item['more']);\r
 859                         }\r
 860                 }\r
 861                 \r
 862                 self::$blog = &$blog;\r
 863                 self::$contents = &$item;\r
 864                 \r
 865                 self::$skin->parse('itemedit');\r
 866                 return;\r
 867         }\r
 868         \r
 869         /**\r
 870          * Admin::action_itemupdate()\r
 871          * \r
 872          * @param       void\r
 873          * @return      void\r
 874          */\r
 875         static private function action_itemupdate()\r
 876         {\r
 877                 global $member, $manager, $CONF;\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $catid  = postVar('catid');\r
 881                 \r
 882                 // only allow if user is allowed to alter item\r
 883                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 884                 \r
 885                 $actiontype = postVar('actiontype');\r
 886                 \r
 887                 // delete actions are handled by itemdelete (which has confirmation)\r
 888                 if ( $actiontype == 'delete' )\r
 889                 {\r
 890                         self::action_itemdelete();\r
 891                         return;\r
 892                 }\r
 893                 \r
 894                 $body           = postVar('body');\r
 895                 $title          = postVar('title');\r
 896                 $more           = postVar('more');\r
 897                 $closed         = intPostVar('closed');\r
 898                 $draftid        = intPostVar('draftid');\r
 899                 \r
 900                 // default action = add now\r
 901                 if ( !$actiontype )\r
 902                 {\r
 903                         $actiontype='addnow';\r
 904                 }\r
 905                 \r
 906                 // create new category if needed\r
 907                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 908                 {\r
 909                         // get blogid\r
 910                         list($blogid) = sscanf($catid,"newcat-%d");\r
 911                         \r
 912                         // create\r
 913                         $blog =& $manager->getBlog($blogid);\r
 914                         $catid = $blog->createNewCategory();\r
 915                         \r
 916                         // show error when sth goes wrong\r
 917                         if ( !$catid )\r
 918                         {\r
 919                                 self::doError(_ERROR_CATCREATEFAIL);\r
 920                         }\r
 921                 }\r
 922                 \r
 923                 /**\r
 924                  * set some variables based on actiontype\r
 925                  * \r
 926                  * actiontypes:\r
 927                  *      draft items -> addnow, addfuture, adddraft, delete\r
 928                  *      non-draft items -> edit, changedate, delete\r
 929                  * \r
 930                  * variables set:\r
 931                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 932                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 933                  *      $publish: set to 1 when the edited item is not a draft\r
 934                  */\r
 935                 $blogid =  getBlogIDFromItemID($itemid);\r
 936                 $blog =& $manager->getBlog($blogid);\r
 937                 \r
 938                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 939                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 940                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 941                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 942                 {\r
 943                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 944                 }\r
 945                 else\r
 946                 {\r
 947                         $timestamp =0;\r
 948                 }\r
 949                 \r
 950                 // edit the item for real\r
 951                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 952                 \r
 953                 self::updateFuturePosted($blogid);\r
 954                 \r
 955                 if ( $draftid > 0 )\r
 956                 {\r
 957                         // delete permission is checked inside Item::delete()\r
 958                         Item::delete($draftid);\r
 959                 }\r
 960                 \r
 961                 if ( $catid != intPostVar('catid') )\r
 962                 {\r
 963                         self::action_categoryedit(\r
 964                                 $catid,\r
 965                                 $blog->getID(),\r
 966                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 967                         );\r
 968                 }\r
 969                 else\r
 970                 {\r
 971                         // TODO: set start item correctly for itemlist\r
 972                         $item =& $manager->getitem($itemid, 1, 1);\r
 973                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 974                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 975                         $cnt  = DB::getValue($query);\r
 976                         $_REQUEST['start'] = $cnt + 1;\r
 977                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 978                 }\r
 979                 return;\r
 980         }\r
 981         \r
 982         /**\r
 983          * Admin::action_itemdelete()\r
 984          * Delete item\r
 985          * \r
 986          * @param       Void\r
 987          * @return      Void\r
 988          */\r
 989         static private function action_itemdelete()\r
 990         {\r
 991                 global $member, $manager;\r
 992                 \r
 993                 $itemid = intRequestVar('itemid');\r
 994                 \r
 995                 // only allow if user is allowed to alter item\r
 996                 $member->canAlterItem($itemid) or self::disallow();\r
 997                 \r
 998                 if ( !$manager->existsItem($itemid,1,1) )\r
 999                 {\r
1000                         self::error(_ERROR_NOSUCHITEM);\r
1001                 }\r
1002                 \r
1003                 self::$skin->parse('itemdelete');\r
1004                 return;\r
1005         }\r
1006         \r
1007         /**\r
1008          * Admin::action_itemdeleteconfirm()\r
1009          * \r
1010          * @param       void\r
1011          * @return      void\r
1012          */\r
1013         static private function action_itemdeleteconfirm()\r
1014         {\r
1015                 global $member, $manager;\r
1016                 \r
1017                 $itemid = intRequestVar('itemid');\r
1018                 \r
1019                 // only allow if user is allowed to alter item\r
1020                 $member->canAlterItem($itemid) or self::disallow();\r
1021                 \r
1022                 // get item first\r
1023                 $item =& $manager->getItem($itemid, 1, 1);\r
1024                 \r
1025                 // delete item (note: some checks will be performed twice)\r
1026                 self::deleteOneItem($item['itemid']);\r
1027                 \r
1028                 self::action_itemlist($item['blogid']);\r
1029                 return;\r
1030         }\r
1031         \r
1032         /**\r
1033          * Admin::deleteOneItem()\r
1034          * Deletes one item and returns error if something goes wrong\r
1035          * \r
1036          * @param       integer $itemid ID for item\r
1037          * @return      void\r
1038          */\r
1039         static public function deleteOneItem($itemid)\r
1040         {\r
1041                 global $member, $manager;\r
1042                 \r
1043                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1044                 if ( !$member->canAlterItem($itemid) )\r
1045                 {\r
1046                         return _ERROR_DISALLOWED;\r
1047                 }\r
1048                 \r
1049                 // need to get blogid before the item is deleted\r
1050                 $item =& $manager->getItem($itemid, 1, 1);\r
1051                 \r
1052                 $manager->loadClass('ITEM');\r
1053                 Item::delete($item['itemid']);\r
1054                 \r
1055                 // update blog's futureposted\r
1056                 self::updateFuturePosted($item['itemid']);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::updateFuturePosted()\r
1062          * Update a blog's future posted flag\r
1063          * \r
1064          * @param integer $blogid\r
1065          * @return      void\r
1066          */\r
1067         static private function updateFuturePosted($blogid)\r
1068         {\r
1069                 global $manager;\r
1070                 \r
1071                 $blogid                 =  intval($blogid);\r
1072                 $blog                   =& $manager->getBlog($blogid);\r
1073                 $currenttime    =  $blog->getCorrectTime(time());\r
1074                 \r
1075                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1076                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1077                 $result = DB::getResult($query);\r
1078                 \r
1079                 if ( $result->rowCount() > 0 )\r
1080                 {\r
1081                                 $blog->setFuturePost();\r
1082                 }\r
1083                 else\r
1084                 {\r
1085                                 $blog->clearFuturePost();\r
1086                 }\r
1087                 return;\r
1088         }\r
1089 \r
1090         /**\r
1091          * Admin::action_itemmove()\r
1092          * \r
1093          * @param       void\r
1094          * @return      void\r
1095          */\r
1096         static private function action_itemmove()\r
1097         {\r
1098                 global $member, $manager;\r
1099                 \r
1100                 $itemid = intRequestVar('itemid');\r
1101                 \r
1102                 $member->canAlterItem($itemid) or self::disallow();\r
1103                 \r
1104                 self::$skin->parse('itemmove');\r
1105                 return;\r
1106         }\r
1107         \r
1108         /**\r
1109          * Admin::action_itemmoveto()\r
1110          * \r
1111          * @param       void\r
1112          * @return      void\r
1113          */\r
1114         static private function action_itemmoveto()\r
1115         {\r
1116                 global $member, $manager;\r
1117                 \r
1118                 $itemid = intRequestVar('itemid');\r
1119                 $catid = requestVar('catid');\r
1120                 \r
1121                 // create new category if needed\r
1122                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1123                 {\r
1124                         // get blogid\r
1125                         list($blogid) = sscanf($catid,'newcat-%d');\r
1126                         \r
1127                         // create\r
1128                         $blog =& $manager->getBlog($blogid);\r
1129                         $catid = $blog->createNewCategory();\r
1130                         \r
1131                         // show error when sth goes wrong\r
1132                         if ( !$catid )\r
1133                         {\r
1134                                 self::doError(_ERROR_CATCREATEFAIL);\r
1135                         }\r
1136                 }\r
1137                 \r
1138                 // only allow if user is allowed to alter item\r
1139                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1140                 \r
1141                 $old_blogid = getBlogIDFromItemId($itemid);\r
1142                 \r
1143                 Item::move($itemid, $catid);\r
1144                 \r
1145                 // set the futurePosted flag on the blog\r
1146                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1147                 \r
1148                 // reset the futurePosted in case the item is moved from one blog to another\r
1149                 self::updateFuturePosted($old_blogid);\r
1150                 \r
1151                 if ( $catid != intRequestVar('catid') )\r
1152                 {\r
1153                         self::action_categoryedit($catid, $blog->getID());\r
1154                 }\r
1155                 else\r
1156                 {\r
1157                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1158                 }\r
1159                 return;\r
1160         }\r
1161         \r
1162         /**\r
1163          * Admin::moveOneItem()\r
1164          * Moves one item to a given category (category existance should be checked by caller)\r
1165          * errors are returned\r
1166          * \r
1167          * @param       integer $itemid         ID for item\r
1168          * @param       integer $destCatid      ID for category to which the item will be moved\r
1169          * @return      void\r
1170          */\r
1171         static public function moveOneItem($itemid, $destCatid)\r
1172         {\r
1173                 global $member;\r
1174                 \r
1175                 // only allow if user is allowed to move item\r
1176                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1177                 {\r
1178                         return _ERROR_DISALLOWED;\r
1179                 }\r
1180                 \r
1181                 Item::move($itemid, $destCatid);\r
1182                 return;\r
1183         }\r
1184         \r
1185         /**\r
1186          * Admin::action_additem()\r
1187          * Adds a item to the chosen blog\r
1188          * \r
1189          * @param       void\r
1190          * @return      void\r
1191          */\r
1192         static private function action_additem()\r
1193         {\r
1194                 global $manager, $CONF;\r
1195                 \r
1196                 $manager->loadClass('ITEM');\r
1197                 \r
1198                 $result = Item::createFromRequest();\r
1199                 \r
1200                 if ( $result['status'] == 'error' )\r
1201                 {\r
1202                         self::error($result['message']);\r
1203                 }\r
1204                 \r
1205                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1206                 \r
1207                 if ( $result['status'] == 'newcategory' )\r
1208                 {\r
1209                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1210                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1211                 }\r
1212                 else\r
1213                 {\r
1214                         $methodName = 'action_itemlist';\r
1215                         self::action_itemlist($item['blogid']);\r
1216                 }\r
1217                 return;\r
1218         }\r
1219         \r
1220         /**\r
1221          * Admin::action_commentedit()\r
1222          * Allows to edit previously made comments\r
1223          * \r
1224          * @param       void\r
1225          * @return      void\r
1226          */\r
1227         static private function action_commentedit()\r
1228         {\r
1229                 global $member, $manager;\r
1230                 \r
1231                 $commentid = intRequestVar('commentid');\r
1232                 \r
1233                 $member->canAlterComment($commentid) or self::disallow();\r
1234                 \r
1235                 self::$skin->parse('commentedit');\r
1236                 return;\r
1237         }\r
1238         \r
1239         /**\r
1240          * Admin::action_commentupdate()\r
1241          * \r
1242          * @param       void\r
1243          * @return      void\r
1244          */\r
1245         static private function action_commentupdate()\r
1246         {\r
1247                 global $member, $manager;\r
1248                 \r
1249                 $commentid = intRequestVar('commentid');\r
1250                 \r
1251                 $member->canAlterComment($commentid) or self::disallow();\r
1252                 \r
1253                 $url    = postVar('url');\r
1254                 $email  = postVar('email');\r
1255                 $body   = postVar('body');\r
1256                 \r
1257                 // intercept words that are too long\r
1258                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1259                 {\r
1260                         self::error(_ERROR_COMMENT_LONGWORD);\r
1261                 }\r
1262                 \r
1263                 // check length\r
1264                 if ( i18n::strlen($body) < 3 )\r
1265                 {\r
1266                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1267                 }\r
1268                 \r
1269                 if ( i18n::strlen($body) > 5000 )\r
1270                 {\r
1271                         self::error(_ERROR_COMMENT_TOOLONG);\r
1272                 }\r
1273                 \r
1274                 // prepare body\r
1275                 $body = Comment::prepareBody($body);\r
1276                 \r
1277                 // call plugins\r
1278                 $data = array(\r
1279                         'body' => &$body\r
1280                 );\r
1281                 $manager->notify('PreUpdateComment', $data);\r
1282                 \r
1283                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1284                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1285                 DB::execute($query);\r
1286                 \r
1287                 // get itemid\r
1288                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1289                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1290                 \r
1291                 $itemid = DB::getValue($query);\r
1292                 \r
1293                 if ( $member->canAlterItem($itemid) )\r
1294                 {\r
1295                         self::action_itemcommentlist($itemid);\r
1296                 }\r
1297                 else\r
1298                 {\r
1299                         self::action_browseowncomments();\r
1300                 }\r
1301                 return;\r
1302         }\r
1303         \r
1304         /**\r
1305          * Admin::action_commentdelete()\r
1306          * Update comment\r
1307          * \r
1308          * @param       void\r
1309          * @return      void\r
1310          */\r
1311         static private function action_commentdelete()\r
1312         {\r
1313                 global $member, $manager;\r
1314                 \r
1315                 $commentid = intRequestVar('commentid');\r
1316                 $member->canAlterComment($commentid) or self::disallow();\r
1317                 \r
1318                 self::$skin->parse('commentdelete');\r
1319                 return;\r
1320         }\r
1321         \r
1322         /**\r
1323          * Admin::action_commentdeleteconfirm()\r
1324          * \r
1325          * @param       void\r
1326          * @return      void\r
1327          */\r
1328         static private function action_commentdeleteconfirm()\r
1329         {\r
1330                 global $member;\r
1331                 \r
1332                 $commentid = intRequestVar('commentid');\r
1333                 \r
1334                 // get item id first\r
1335                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1336                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1337                 \r
1338                 $itemid = DB::getValue($query);\r
1339                 \r
1340                 $error = self::deleteOneComment($commentid);\r
1341                 if ( $error )\r
1342                 {\r
1343                         self::doError($error);\r
1344                 }\r
1345                 \r
1346                 if ( $member->canAlterItem($itemid) )\r
1347                 {\r
1348                         self::action_itemcommentlist($itemid);\r
1349                 }\r
1350                 else\r
1351                 {\r
1352                         self::action_browseowncomments();\r
1353                 }\r
1354                 return;\r
1355         }\r
1356         \r
1357         /**\r
1358          * Admin::deleteOneComment()\r
1359          * \r
1360          * @param       integer $commentid      ID for comment\r
1361          * @return      void\r
1362          */\r
1363         static public function deleteOneComment($commentid)\r
1364         {\r
1365                 global $member, $manager;\r
1366                 \r
1367                 $commentid = (integer) $commentid;\r
1368                 \r
1369                 if ( !$member->canAlterComment($commentid) )\r
1370                 {\r
1371                         return _ERROR_DISALLOWED;\r
1372                 }\r
1373                 \r
1374                 $data = array(\r
1375                         'commentid' => $commentid\r
1376                 );\r
1377                 \r
1378                 $manager->notify('PreDeleteComment', $data);\r
1379                 \r
1380                 // delete the comments associated with the item\r
1381                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1382                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1383                 DB::execute($query);\r
1384                 \r
1385                 $data = array(\r
1386                         'commentid' => $commentid\r
1387                 );\r
1388                 \r
1389                 $manager->notify('PostDeleteComment', $data);\r
1390                 \r
1391                 return '';\r
1392         }\r
1393         \r
1394         /**\r
1395          * Admin::action_usermanagement()\r
1396          * Usermanagement main\r
1397          * \r
1398          * @param       void\r
1399          * @return      void\r
1400          */\r
1401         static private function action_usermanagement()\r
1402         {\r
1403                 global $member, $manager;\r
1404                 \r
1405                 // check if allowed\r
1406                 $member->isAdmin() or self::disallow();\r
1407                 \r
1408                 self::$skin->parse('usermanagement');\r
1409                 return;\r
1410         }\r
1411         \r
1412         /**\r
1413          * Admin::action_memberedit()\r
1414          * Edit member settings\r
1415          * \r
1416          * @param       void\r
1417          * @return      void\r
1418          */\r
1419         static private function action_memberedit()\r
1420         {\r
1421                 self::action_editmembersettings(intRequestVar('memberid'));\r
1422                 return;\r
1423         }\r
1424         \r
1425         /**\r
1426          * Admin::action_editmembersettings()\r
1427          * \r
1428          * @param       integer $memberid       ID for member\r
1429          * @return      void\r
1430          * \r
1431          */\r
1432         static private function action_editmembersettings($memberid = '')\r
1433         {\r
1434                 global $member, $manager, $CONF;\r
1435                 \r
1436                 if ( $memberid == '' )\r
1437                 {\r
1438                         $memberid = $member->getID();\r
1439                 }\r
1440                 \r
1441                 /* TODO: we should consider to use the other way insterad of this */\r
1442                 $_REQUEST['memberid'] = $memberid;\r
1443                 \r
1444                 // check if allowed\r
1445                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1446                 \r
1447                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1448                 \r
1449                 self::$skin->parse('editmembersettings');\r
1450                 return;\r
1451         }\r
1452         \r
1453         /**\r
1454          * Admin::action_changemembersettings()\r
1455          * \r
1456          * @param       void\r
1457          * @return      void\r
1458          */\r
1459         static private function action_changemembersettings()\r
1460         {\r
1461                 global $member, $CONF, $manager;\r
1462                 \r
1463                 $memberid = intRequestVar('memberid');\r
1464                 \r
1465                 // check if allowed\r
1466                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1467                 \r
1468                 $name                   = trim(strip_tags(postVar('name')));\r
1469                 $realname               = trim(strip_tags(postVar('realname')));\r
1470                 $password               = postVar('password');\r
1471                 $repeatpassword = postVar('repeatpassword');\r
1472                 $email                  = strip_tags(postVar('email'));\r
1473                 $url                    = strip_tags(postVar('url'));\r
1474                 $adminskin              = intPostVar('adminskin');\r
1475                 \r
1476                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1477                 if ( !preg_match('#^https?://#', $url) )\r
1478                 {\r
1479                         $url = 'http://' . $url;\r
1480                 }\r
1481                 \r
1482                 $admin          = postVar('admin');\r
1483                 $canlogin       = postVar('canlogin');\r
1484                 $notes          = strip_tags(postVar('notes'));\r
1485                 $locale         = postVar('locale');\r
1486                 \r
1487                 $mem =& $manager->getMember($memberid);\r
1488                 \r
1489                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1490                 {\r
1491                         if ( !isValidDisplayName($name) )\r
1492                         {\r
1493                                 self::error(_ERROR_BADNAME);\r
1494                         }\r
1495                         \r
1496                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1497                         {\r
1498                                 self::error(_ERROR_NICKNAMEINUSE);\r
1499                         }\r
1500                         \r
1501                         if ( $password != $repeatpassword )\r
1502                         {\r
1503                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1504                         }\r
1505                         \r
1506                         if ( $password && (i18n::strlen($password) < 6) )\r
1507                         {\r
1508                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1509                         }\r
1510                                 \r
1511                         if ( $password )\r
1512                         {\r
1513                                 $pwdvalid = true;\r
1514                                 $pwderror = '';\r
1515                                 \r
1516                                 $data = array(\r
1517                                         'password'     => $password,\r
1518                                         'errormessage' => &$pwderror,\r
1519                                         'valid'        => &$pwdvalid\r
1520                                 );\r
1521                                 $manager->notify('PrePasswordSet', $data);\r
1522                                 \r
1523                                 if ( !$pwdvalid )\r
1524                                 {\r
1525                                         self::error($pwderror);\r
1526                                 }\r
1527                         }\r
1528                 }\r
1529                 \r
1530                 if ( !NOTIFICATION::address_validation($email) )\r
1531                 {\r
1532                         self::error(_ERROR_BADMAILADDRESS);\r
1533                 }\r
1534                 if ( !$realname )\r
1535                 {\r
1536                         self::error(_ERROR_REALNAMEMISSING);\r
1537                 }\r
1538                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1539                 {\r
1540                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1541                 }\r
1542                 \r
1543                 // check if there will remain at least one site member with both the logon and admin rights\r
1544                 // (check occurs when taking away one of these rights from such a member)\r
1545                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1546                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1547                         )\r
1548                 {\r
1549                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1550                         if ( $r->rowCount() < 2 )\r
1551                         {\r
1552                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1553                         }\r
1554                 }\r
1555                 \r
1556                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1557                 {\r
1558                         $mem->setDisplayName($name);\r
1559                         if ( $password )\r
1560                         {\r
1561                                 $mem->setPassword($password);\r
1562                         }\r
1563                 }\r
1564                 \r
1565                 $oldEmail = $mem->getEmail();\r
1566                 \r
1567                 $mem->setRealName($realname);\r
1568                 $mem->setEmail($email);\r
1569                 $mem->setURL($url);\r
1570                 $mem->setNotes($notes);\r
1571                 $mem->setLocale($locale);\r
1572                 \r
1573                 // only allow super-admins to make changes to the admin status\r
1574                 if ( $member->isAdmin() )\r
1575                 {\r
1576                         $mem->setAdmin($admin);\r
1577                         $mem->setCanLogin($canlogin);\r
1578                 }\r
1579                 \r
1580                 $autosave = postVar('autosave');\r
1581                 $mem->setAutosave($autosave);\r
1582                 \r
1583                 $mem->write();\r
1584                 \r
1585                 // store plugin options\r
1586                 $aOptions = requestArray('plugoption');\r
1587                 NucleusPlugin::apply_plugin_options($aOptions);\r
1588                 $data = array(\r
1589                         'context'  => 'member',\r
1590                         'memberid' => $memberid,\r
1591                         'member'   => &$mem\r
1592                 );\r
1593                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1594                 \r
1595                 // if email changed, generate new password\r
1596                 if ( $oldEmail != $mem->getEmail() )\r
1597                 {\r
1598                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1599                         // logout member\r
1600                         $mem->newCookieKey();\r
1601                         \r
1602                         // only log out if the member being edited is the current member.\r
1603                         if ( $member->getID() == $memberid )\r
1604                         {\r
1605                                 $member->logout();\r
1606                         }\r
1607                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1608                         return;\r
1609                 }\r
1610                 \r
1611                 if ( ($mem->getID() == $member->getID())\r
1612                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1613                 {\r
1614                         $mem->newCookieKey();\r
1615                         $member->logout();\r
1616                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1617                 }\r
1618                 else\r
1619                 {\r
1620                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1621                 }\r
1622                 return;\r
1623         }\r
1624 \r
1625         /**\r
1626          * Admin::action_memberadd()\r
1627          * \r
1628          * @param       void\r
1629          * @return      void\r
1630          * \r
1631          */\r
1632         static private function action_memberadd()\r
1633         {\r
1634                 global $member, $manager;\r
1635                 \r
1636                 // check if allowed\r
1637                 $member->isAdmin() or self::disallow();\r
1638                 \r
1639                 if ( postVar('password') != postVar('repeatpassword') )\r
1640                 {\r
1641                         self::error(_ERROR_PASSWORDMISMATCH);\r
1642                 }\r
1643                 \r
1644                 if ( i18n::strlen(postVar('password')) < 6 )\r
1645                 {\r
1646                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1647                 }\r
1648                 \r
1649                 $res = Member::create(\r
1650                         postVar('name'),\r
1651                         postVar('realname'),\r
1652                         postVar('password'),\r
1653                         postVar('email'),\r
1654                         postVar('url'),\r
1655                         postVar('admin'),\r
1656                         postVar('canlogin'),\r
1657                         postVar('notes')\r
1658                 );\r
1659                 \r
1660                 if ( $res != 1 )\r
1661                 {\r
1662                         self::error($res);\r
1663                 }\r
1664                 \r
1665                 // fire PostRegister event\r
1666                 $newmem = new Member();\r
1667                 $newmem->readFromName(postVar('name'));\r
1668                 $data = array(\r
1669                         'member' => &$newmem\r
1670                 );\r
1671                 $manager->notify('PostRegister', $data);\r
1672                 \r
1673                 self::action_usermanagement();\r
1674                 return;\r
1675         }\r
1676         \r
1677         /**\r
1678          * Admin::action_forgotpassword()\r
1679          * \r
1680          * @param       void\r
1681          * @return      void\r
1682          */\r
1683         static private function action_forgotpassword()\r
1684         {\r
1685                 self::$skin->parse('forgotpassword');\r
1686                 return;\r
1687         }\r
1688         \r
1689         /**\r
1690          * Admin::action_activate()\r
1691          * Account activation\r
1692          * \r
1693          * @param       void\r
1694          * @return      void\r
1695          */\r
1696         static private function action_activate()\r
1697         {\r
1698                 $key = getVar('key');\r
1699                 self::showActivationPage($key);\r
1700                 return;\r
1701         }\r
1702         \r
1703         /**\r
1704          * Admin::showActivationPage()\r
1705          * \r
1706          * @param       void\r
1707          * @return      void\r
1708          */\r
1709         static private function showActivationPage($key, $message = '')\r
1710         {\r
1711                 global $manager;\r
1712                 \r
1713                 // clean up old activation keys\r
1714                 Member::cleanupActivationTable();\r
1715                 \r
1716                 // get activation info\r
1717                 $info = Member::getActivationInfo($key);\r
1718                 \r
1719                 if ( !$info )\r
1720                 {\r
1721                         self::error(_ERROR_ACTIVATE);\r
1722                 }\r
1723                 \r
1724                 $mem =& $manager->getMember($info->vmember);\r
1725                 \r
1726                 if ( !$mem )\r
1727                 {\r
1728                         self::error(_ERROR_ACTIVATE);\r
1729                 }\r
1730                 \r
1731                 /* TODO: we should consider to use the other way insterad of this */\r
1732                 $_POST['ackey']                                 = $key;\r
1733                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1734                 \r
1735                 self::$headMess = $message;\r
1736                 self::$skin->parse('activate');\r
1737                 return;\r
1738         }\r
1739         \r
1740         /**\r
1741          * Admin::action_activatesetpwd()\r
1742          * Account activation - set password part\r
1743          * \r
1744          * @param       void\r
1745          * @return      void\r
1746          */\r
1747         static private function action_activatesetpwd()\r
1748         {\r
1749                 global $manager;\r
1750                 $key = postVar('key');\r
1751                 \r
1752                 // clean up old activation keys\r
1753                 Member::cleanupActivationTable();\r
1754                 \r
1755                 // get activation info\r
1756                 $info = Member::getActivationInfo($key);\r
1757                 \r
1758                 if ( !$info || ($info->type == 'addresschange') )\r
1759                 {\r
1760                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1761                 }\r
1762                 \r
1763                 $mem =& $manager->getMember($info->vmember);\r
1764                 \r
1765                 if ( !$mem )\r
1766                 {\r
1767                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1768                 }\r
1769                 \r
1770                 $password               = postVar('password');\r
1771                 $repeatpassword = postVar('repeatpassword');\r
1772                 \r
1773                 if ( $password != $repeatpassword )\r
1774                 {\r
1775                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1776                 }\r
1777                 \r
1778                 if ( $password && (i18n::strlen($password) < 6) )\r
1779                 {\r
1780                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1781                 }\r
1782                         \r
1783                 if ( $password )\r
1784                 {\r
1785                         $pwdvalid = true;\r
1786                         $pwderror = '';\r
1787                         \r
1788                         $data = array(\r
1789                                 'password'              => $password,\r
1790                                 'errormessage'  => &$pwderror,\r
1791                                 'valid'                 => &$pwdvalid\r
1792                         );\r
1793                         $manager->notify('PrePasswordSet', $data);\r
1794                         if ( !$pwdvalid )\r
1795                         {\r
1796                                 return self::showActivationPage($key,$pwderror);\r
1797                         }\r
1798                 }\r
1799                 \r
1800                 $error = '';\r
1801                 \r
1802                 $data = array(\r
1803                         'type'   => 'activation',\r
1804                         'member' => $mem,\r
1805                         'error'  => &$error\r
1806                 );\r
1807                 $manager->notify('ValidateForm', $data);\r
1808                 if ( $error != '' )\r
1809                 {\r
1810                         return self::showActivationPage($key, $error);\r
1811                 }\r
1812                 \r
1813                 // set password\r
1814                 $mem->setPassword($password);\r
1815                 $mem->write();\r
1816                 \r
1817                 // do the activation\r
1818                 Member::activate($key);\r
1819                 \r
1820                 self::$skin->parse('activatesetpwd');\r
1821                 return;\r
1822         }\r
1823         \r
1824         /**\r
1825          * Admin::action_manageteam()\r
1826          * Manage team\r
1827          * \r
1828          * @param       void\r
1829          * @return      void\r
1830          */\r
1831         static private function action_manageteam()\r
1832         {\r
1833                 global $member, $manager;\r
1834                 \r
1835                 $blogid = intRequestVar('blogid');\r
1836                 \r
1837                 // check if allowed\r
1838                 $member->blogAdminRights($blogid) or self::disallow();\r
1839                 \r
1840                 self::$skin->parse('manageteam');\r
1841                 return;\r
1842         }\r
1843         \r
1844         /**\r
1845          * Admin::action_teamaddmember()\r
1846          * Add member to team\r
1847          * \r
1848          * @param       void\r
1849          * @return      void\r
1850          */\r
1851         static private function action_teamaddmember()\r
1852         {\r
1853                 global $member, $manager;\r
1854                 \r
1855                 $memberid       = intPostVar('memberid');\r
1856                 $blogid         = intPostVar('blogid');\r
1857                 $admin          = intPostVar('admin');\r
1858                 \r
1859                 // check if allowed\r
1860                 $member->blogAdminRights($blogid) or self::disallow();\r
1861                 \r
1862                 $blog =& $manager->getBlog($blogid);\r
1863                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1864                 {\r
1865                         self::error(_ERROR_ALREADYONTEAM);\r
1866                 }\r
1867                 \r
1868                 self::action_manageteam();\r
1869                 return;\r
1870         }\r
1871         \r
1872         /**\r
1873          * Admin::action_teamdelete()\r
1874          * \r
1875          * @param       void\r
1876          * @return      void\r
1877          */\r
1878         static private function action_teamdelete()\r
1879         {\r
1880                 global $member, $manager;\r
1881                 \r
1882                 $memberid       = intRequestVar('memberid');\r
1883                 $blogid         = intRequestVar('blogid');\r
1884                 \r
1885                 // check if allowed\r
1886                 $member->blogAdminRights($blogid) or self::disallow();\r
1887                 \r
1888                 $teammem =& $manager->getMember($memberid);\r
1889                 $blog =& $manager->getBlog($blogid);\r
1890                 \r
1891                 self::$skin->parse('teamdelete');\r
1892                 return;\r
1893         }\r
1894         \r
1895         /**\r
1896          * Admin::action_teamdeleteconfirm()\r
1897          * \r
1898          * @param       void\r
1899          * @return      void\r
1900          */\r
1901         static private function action_teamdeleteconfirm()\r
1902         {\r
1903                 global $member;\r
1904                 \r
1905                 $memberid = intRequestVar('memberid');\r
1906                 $blogid = intRequestVar('blogid');\r
1907                 \r
1908                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1909                 if ( $error )\r
1910                 {\r
1911                         self::error($error);\r
1912                 }\r
1913                 self::action_manageteam();\r
1914                 return;\r
1915         }\r
1916         \r
1917         /**\r
1918          * Admin::deleteOneTeamMember()\r
1919          * \r
1920          * @param       void\r
1921          * @return      void\r
1922          */\r
1923         static public function deleteOneTeamMember($blogid, $memberid)\r
1924         {\r
1925                 global $member, $manager;\r
1926                 \r
1927                 $blogid   = intval($blogid);\r
1928                 $memberid = intval($memberid);\r
1929                 \r
1930                 // check if allowed\r
1931                 if ( !$member->blogAdminRights($blogid) )\r
1932                 {\r
1933                         return _ERROR_DISALLOWED;\r
1934                 }\r
1935                 \r
1936                 // check if: - there remains at least one blog admin\r
1937                 //           - (there remains at least one team member)\r
1938                 $tmem =& $manager->getMember($memberid);\r
1939                 \r
1940                 \r
1941                 $data = array(\r
1942                         'member' => &$tmem,\r
1943                         'blogid' => $blogid\r
1944                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1945                 \r
1946                 if ( $tmem->isBlogAdmin($blogid) )\r
1947                 {\r
1948                         /* TODO: why we did double check? */\r
1949                         // check if there are more blog members left and at least one admin\r
1950                         // (check for at least two admins before deletion)\r
1951                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1952                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1953                         $r     = DB::getResult($query);\r
1954                         if ( $r->rowCount() < 2 )\r
1955                         {\r
1956                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1957                         }\r
1958                 }\r
1959                 \r
1960                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1961                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1962                 DB::execute($query);\r
1963                 \r
1964                 $data = array(\r
1965                         'member' => &$tmem,\r
1966                         'blogid' => $blogid\r
1967                 );\r
1968                 $manager->notify('PostDeleteTeamMember', $data);\r
1969                 \r
1970                 return '';\r
1971         }\r
1972         \r
1973         /**\r
1974          * Admin::action_teamchangeadmin()\r
1975          * \r
1976          * @param       void\r
1977          * @return      void\r
1978          */\r
1979         static private function action_teamchangeadmin()\r
1980         {\r
1981                 global $manager, $member;\r
1982                 \r
1983                 $blogid         = intRequestVar('blogid');\r
1984                 $memberid       = intRequestVar('memberid');\r
1985                 \r
1986                 // check if allowed\r
1987                 $member->blogAdminRights($blogid) or self::disallow();\r
1988                 \r
1989                 $mem =& $manager->getMember($memberid);\r
1990                 \r
1991                 // don't allow when there is only one admin at this moment\r
1992                 if ( $mem->isBlogAdmin($blogid) )\r
1993                 {\r
1994                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1995                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1996                         $r = DB::getResult($query);\r
1997                         if ( $r->rowCount() == 1 )\r
1998                         {\r
1999                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2000                         }\r
2001                 }\r
2002                 \r
2003                 if ( $mem->isBlogAdmin($blogid) )\r
2004                 {\r
2005                         $newval = 0;\r
2006                 }\r
2007                 else\r
2008                 {\r
2009                         $newval = 1;\r
2010                 }\r
2011                 \r
2012                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2013                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2014                 DB::execute($query);\r
2015                 \r
2016                 // only show manageteam if member did not change its own admin privileges\r
2017                 if ( $member->isBlogAdmin($blogid) )\r
2018                 {\r
2019                         self::action_manageteam();\r
2020                 }\r
2021                 else\r
2022                 {\r
2023                         self::action_overview(_MSG_ADMINCHANGED);\r
2024                 }\r
2025                 return;\r
2026         }\r
2027         \r
2028         /**\r
2029          * Admin::action_blogsettings()\r
2030          * \r
2031          * @param       void\r
2032          * @return      void\r
2033          */\r
2034         static private function action_blogsettings()\r
2035         {\r
2036                 global $member, $manager;\r
2037                 \r
2038                 $blogid = intRequestVar('blogid');\r
2039                 \r
2040                 // check if allowed\r
2041                 $member->blogAdminRights($blogid) or self::disallow();\r
2042                 \r
2043                 $blog =& $manager->getBlog($blogid);\r
2044                 \r
2045                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2046                 \r
2047                 self::$skin->parse('blogsettings');\r
2048                 return;\r
2049         }\r
2050         \r
2051         /**\r
2052          * Admin::action_categorynew()\r
2053          * \r
2054          * @param       void\r
2055          * @return      void\r
2056          */\r
2057         static private function action_categorynew()\r
2058         {\r
2059                 global $member, $manager;\r
2060                 \r
2061                 $blogid = intRequestVar('blogid');\r
2062                 \r
2063                 $member->blogAdminRights($blogid) or self::disallow();\r
2064                 \r
2065                 $cname = postVar('cname');\r
2066                 $cdesc = postVar('cdesc');\r
2067                 \r
2068                 if ( !isValidCategoryName($cname) )\r
2069                 {\r
2070                         self::error(_ERROR_BADCATEGORYNAME);\r
2071                 }\r
2072                 \r
2073                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2074                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2075                 $res = DB::getResult($query);\r
2076                 if ( $res->rowCount() > 0 )\r
2077                 {\r
2078                         self::error(_ERROR_DUPCATEGORYNAME);\r
2079                 }\r
2080                 \r
2081                 $blog           =& $manager->getBlog($blogid);\r
2082                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2083                 \r
2084                 self::action_blogsettings();\r
2085                 return;\r
2086         }\r
2087         \r
2088         /**\r
2089          * Admin::action_categoryedit()\r
2090          * \r
2091          * @param       void\r
2092          * @return      void\r
2093          */\r
2094         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2095         {\r
2096                 global $member, $manager;\r
2097                 \r
2098                 if ( $blogid == '' )\r
2099                 {\r
2100                         $blogid = intGetVar('blogid');\r
2101                 }\r
2102                 else\r
2103                 {\r
2104                         $blogid = intval($blogid);\r
2105                 }\r
2106                 if ( $catid == '' )\r
2107                 {\r
2108                         $catid = intGetVar('catid');\r
2109                 }\r
2110                 else\r
2111                 {\r
2112                         $catid = intval($catid);\r
2113                 }\r
2114                 \r
2115                 /* TODO: we should consider to use the other way insterad of this */\r
2116                 $_REQUEST['blogid']             = $blogid;\r
2117                 $_REQUEST['catid']              = $catid;\r
2118                 $_REQUEST['desturl']    = $desturl;\r
2119                 $member->blogAdminRights($blogid) or self::disallow();\r
2120                 \r
2121                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2122                 \r
2123                 self::$skin->parse('categoryedit');\r
2124                 return;\r
2125         }\r
2126         \r
2127         /**\r
2128          * Admin::action_categoryupdate()\r
2129          * \r
2130          * @param       void\r
2131          * @return      void\r
2132          */\r
2133         static private function action_categoryupdate()\r
2134         {\r
2135                 global $member, $manager;\r
2136                 \r
2137                 $blogid         = intPostVar('blogid');\r
2138                 $catid          = intPostVar('catid');\r
2139                 $cname          = postVar('cname');\r
2140                 $cdesc          = postVar('cdesc');\r
2141                 $desturl        = postVar('desturl');\r
2142                 \r
2143                 $member->blogAdminRights($blogid) or self::disallow();\r
2144                 \r
2145                 if ( !isValidCategoryName($cname) )\r
2146                 {\r
2147                         self::error(_ERROR_BADCATEGORYNAME);\r
2148                 }\r
2149                 \r
2150                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2151                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2152                 $res    = DB::getResult($query);\r
2153                 if ( $res->rowCount() > 0 )\r
2154                 {\r
2155                         self::error(_ERROR_DUPCATEGORYNAME);\r
2156                 }\r
2157                 \r
2158                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2159                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2160                 DB::execute($query);\r
2161                 \r
2162                 // store plugin options\r
2163                 $aOptions = requestArray('plugoption');\r
2164                 NucleusPlugin::apply_plugin_options($aOptions);\r
2165                 $data = array(\r
2166                         'context'       => 'category',\r
2167                         'catid'         => $catid\r
2168                 );\r
2169                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2170                 \r
2171                 if ( $desturl )\r
2172                 {\r
2173                         redirect($desturl);\r
2174                         exit;\r
2175                 }\r
2176                 else\r
2177                 {\r
2178                         self::action_blogsettings();\r
2179                 }\r
2180                 return;\r
2181         }\r
2182         \r
2183         /**\r
2184          * Admin::action_categorydelete()\r
2185          * \r
2186          * @param       void\r
2187          * @return      void\r
2188          */\r
2189         static private function action_categorydelete()\r
2190         {\r
2191                 global $member, $manager;\r
2192                 \r
2193                 $blogid = intRequestVar('blogid');\r
2194                 $catid  = intRequestVar('catid');\r
2195                 \r
2196                 $member->blogAdminRights($blogid) or self::disallow();\r
2197                 \r
2198                 $blog =& $manager->getBlog($blogid);\r
2199                 \r
2200                 // check if the category is valid\r
2201                 if ( !$blog->isValidCategory($catid) )\r
2202                 {\r
2203                         self::error(_ERROR_NOSUCHCATEGORY);\r
2204                 }\r
2205                 \r
2206                 // don't allow deletion of default category\r
2207                 if ( $blog->getDefaultCategory() == $catid )\r
2208                 {\r
2209                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2210                 }\r
2211                 \r
2212                 // check if catid is the only category left for blogid\r
2213                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2214                 $query = sprintf($query, sql_table('category'), $blogid);\r
2215                 $res = DB::getResult($query);\r
2216                 if ( $res->rowCount() == 1 )\r
2217                 {\r
2218                         self::error(_ERROR_DELETELASTCATEGORY);\r
2219                 }\r
2220                 \r
2221                 self::$skin->parse('categorydelete');\r
2222                 return;\r
2223         }\r
2224         \r
2225         /**\r
2226          * Admin::action_categorydeleteconfirm()\r
2227          * \r
2228          * @param       void\r
2229          * @return      void\r
2230          */\r
2231         static private function action_categorydeleteconfirm()\r
2232         {\r
2233                 global $member, $manager;\r
2234                 \r
2235                 $blogid = intRequestVar('blogid');\r
2236                 $catid  = intRequestVar('catid');\r
2237                 \r
2238                 $member->blogAdminRights($blogid) or self::disallow();\r
2239                 \r
2240                 $error = self::deleteOneCategory($catid);\r
2241                 if ( $error )\r
2242                 {\r
2243                         self::error($error);\r
2244                 }\r
2245                 \r
2246                 self::action_blogsettings();\r
2247                 return;\r
2248         }\r
2249         \r
2250         /**\r
2251          * Admin::deleteOneCategory()\r
2252          * Delete a category by its id\r
2253          * \r
2254          * @param       String  $catid  category id for deleting\r
2255          * @return      Void\r
2256          */\r
2257         static public function deleteOneCategory($catid)\r
2258         {\r
2259                 global $manager, $member;\r
2260                 \r
2261                 $catid  = intval($catid);\r
2262                 $blogid = getBlogIDFromCatID($catid);\r
2263                 \r
2264                 if ( !$member->blogAdminRights($blogid) )\r
2265                 {\r
2266                         return ERROR_DISALLOWED;\r
2267                 }\r
2268                 \r
2269                 // get blog\r
2270                 $blog =& $manager->getBlog($blogid);\r
2271                 \r
2272                 // check if the category is valid\r
2273                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2274                 {\r
2275                         return _ERROR_NOSUCHCATEGORY;\r
2276                 }\r
2277                 \r
2278                 $destcatid = $blog->getDefaultCategory();\r
2279                 \r
2280                 // don't allow deletion of default category\r
2281                 if ( $blog->getDefaultCategory() == $catid )\r
2282                 {\r
2283                         return _ERROR_DELETEDEFCATEGORY;\r
2284                 }\r
2285                 \r
2286                 // check if catid is the only category left for blogid\r
2287                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2288                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2289                 \r
2290                 $res = DB::getResult($query);\r
2291                 if ( $res->rowCount() == 1 )\r
2292                 {\r
2293                         return _ERROR_DELETELASTCATEGORY;\r
2294                 }\r
2295                 \r
2296                 $data = array('catid' => $catid);\r
2297                 $manager->notify('PreDeleteCategory', $data);\r
2298                 \r
2299                 // change category for all items to the default category\r
2300                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2301                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2302                 DB::execute($query);\r
2303                 \r
2304                 // delete all associated plugin options\r
2305                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2306                 \r
2307                 // delete category\r
2308                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2309                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2310                 DB::execute($query);\r
2311                 \r
2312                 $data = array('catid' => $catid);\r
2313                 $manager->notify('PostDeleteCategory', $data);\r
2314                 return;\r
2315         }\r
2316         \r
2317         /**\r
2318          * Admin::moveOneCategory()\r
2319          * Delete a category by its id\r
2320          * \r
2321          * @param       int     $catid          category id for move\r
2322          * @param       int     $destblogid     blog id for destination\r
2323          * @return      void\r
2324          */\r
2325         static public function moveOneCategory($catid, $destblogid)\r
2326         {\r
2327                 global $manager, $member;\r
2328                 $catid      = intval($catid);\r
2329                 $destblogid = intval($destblogid);\r
2330                 $blogid     = getBlogIDFromCatID($catid);\r
2331                 // mover should have admin rights on both blogs\r
2332                 if (!$member->blogAdminRights($blogid)) {\r
2333                         return _ERROR_DISALLOWED;\r
2334                 }\r
2335                 if (!$member->blogAdminRights($destblogid)) {\r
2336                         return _ERROR_DISALLOWED;\r
2337                 }\r
2338                 // cannot move to self\r
2339                 if ($blogid == $destblogid) {\r
2340                         return _ERROR_MOVETOSELF;\r
2341                 }\r
2342                 // get blogs\r
2343                 $blog     =& $manager->getBlog($blogid);\r
2344                 $destblog =& $manager->getBlog($destblogid);\r
2345                 // check if the category is valid\r
2346                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2347                         return _ERROR_NOSUCHCATEGORY;\r
2348                 }\r
2349                 // don't allow default category to be moved\r
2350                 if ($blog->getDefaultCategory() == $catid) {\r
2351                         return _ERROR_MOVEDEFCATEGORY;\r
2352                 }\r
2353                 $manager->notify(\r
2354                                 'PreMoveCategory',\r
2355                                 array(\r
2356                                                 'catid'      => &$catid,\r
2357                                                 'sourceblog' => &$blog,\r
2358                                                 'destblog'   => &$destblog\r
2359                                 )\r
2360                 );\r
2361                 // update comments table (cblog)\r
2362                 $query = 'SELECT '\r
2363                 . '    inumber '\r
2364                 . 'FROM '\r
2365                 .      sql_table('item') . ' '\r
2366                 . 'WHERE '\r
2367                 . '    icat = %d';\r
2368                 $items = sql_query(sprintf($query, $catid));\r
2369                 while ($oItem = sql_fetch_object($items)) {\r
2370                         $query = 'UPDATE '\r
2371                         .      sql_table('comment') . ' '\r
2372                         . 'SET '\r
2373                         . '    cblog = %d' . ' '\r
2374                         . 'WHERE '\r
2375                         . '    citem = %d';\r
2376                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2377                 }\r
2378         \r
2379                 // update items (iblog)\r
2380                 $query = 'UPDATE '\r
2381                 .      sql_table('item') . ' '\r
2382                 . 'SET '\r
2383                 . '    iblog = %d '\r
2384                 . 'WHERE '\r
2385                 . '    icat = %d';\r
2386                 sql_query(sprintf($query, $destblogid, $catid));\r
2387         \r
2388                 // move category\r
2389                 $query = 'UPDATE '\r
2390                 .      sql_table('category') . ' '\r
2391                 . 'SET '\r
2392                 . '    cblog = %d' . ' '\r
2393                 . 'WHERE '\r
2394                 . '    catid = %d';\r
2395                 sql_query(sprintf($query, $destblogid, $catid));\r
2396                 $manager->notify(\r
2397                                 'PostMoveCategory',\r
2398                                 array(\r
2399                                                 'catid'      => &$catid,\r
2400                                                 'sourceblog' => &$blog,\r
2401                                                 'destblog'   => $destblog\r
2402                                 )\r
2403                 );\r
2404                 return;\r
2405         }\r
2406 \r
2407         /**\r
2408          * Admin::action_blogsettingsupdate\r
2409          * Updating blog settings\r
2410          * \r
2411          * @param       Void\r
2412          * @return      Void\r
2413          */\r
2414         static private function action_blogsettingsupdate()\r
2415         {\r
2416                 global $member, $manager;\r
2417                 \r
2418                 $blogid = intRequestVar('blogid');\r
2419                 \r
2420                 $member->blogAdminRights($blogid) or self::disallow();\r
2421                 \r
2422                 $blog =& $manager->getBlog($blogid);\r
2423                 \r
2424                 $notify_address = trim(postVar('notify'));\r
2425                 $shortname              = trim(postVar('shortname'));\r
2426                 $updatefile             = trim(postVar('update'));\r
2427                 \r
2428                 $notifyComment  = intPostVar('notifyComment');\r
2429                 $notifyVote             = intPostVar('notifyVote');\r
2430                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2431                 \r
2432                 if ( $notifyComment == 0 )\r
2433                 {\r
2434                         $notifyComment = 1;\r
2435                 }\r
2436                 if ( $notifyVote == 0 )\r
2437                 {\r
2438                         $notifyVote = 1;\r
2439                 }\r
2440                 if ( $notifyNewItem == 0 )\r
2441                 {\r
2442                         $notifyNewItem = 1;\r
2443                 }\r
2444                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2445                 \r
2446                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2447                 {\r
2448                         self::error(_ERROR_BADNOTIFY);\r
2449                 }\r
2450                 \r
2451                 if ( !isValidShortName($shortname) )\r
2452                 {\r
2453                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2454                 }\r
2455                 \r
2456                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2457                 {\r
2458                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2459                 }\r
2460                 // check if update file is writable\r
2461                 if ( $updatefile && !is_writeable($updatefile) )\r
2462                 {\r
2463                         self::error(_ERROR_UPDATEFILE);\r
2464                 }\r
2465                 \r
2466                 $blog->setName(trim(postVar('name')));\r
2467                 $blog->setShortName($shortname);\r
2468                 $blog->setNotifyAddress($notify_address);\r
2469                 $blog->setNotifyType($notifyType);\r
2470                 $blog->setMaxComments(postVar('maxcomments'));\r
2471                 $blog->setCommentsEnabled(postVar('comments'));\r
2472                 $blog->setTimeOffset(postVar('timeoffset'));\r
2473                 $blog->setUpdateFile($updatefile);\r
2474                 $blog->setURL(trim(postVar('url')));\r
2475                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2476                 $blog->setDescription(trim(postVar('desc')));\r
2477                 $blog->setPublic(postVar('public'));\r
2478                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2479                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2480                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2481                 $blog->setSearchable(intPostVar('searchable'));\r
2482                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2483                 $blog->writeSettings();\r
2484                 \r
2485                 // store plugin options\r
2486                 $aOptions = requestArray('plugoption');\r
2487                 NucleusPlugin::apply_plugin_options($aOptions);\r
2488                 \r
2489                 $data = array(\r
2490                         'context' => 'blog',\r
2491                         'blogid'  => $blogid,\r
2492                         'blog'    => &$blog\r
2493                 );\r
2494                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2495                 \r
2496                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2497                 return;\r
2498         }\r
2499         \r
2500         /**\r
2501          * Admin::action_deleteblog()\r
2502          * \r
2503          * @param       void\r
2504          * @return      void\r
2505          */\r
2506         static private function action_deleteblog()\r
2507         {\r
2508                 global $member, $CONF, $manager;\r
2509                 \r
2510                 $blogid = intRequestVar('blogid');\r
2511                 \r
2512                 $member->blogAdminRights($blogid) or self::disallow();\r
2513                 \r
2514                 // check if blog is default blog\r
2515                 if ( $CONF['DefaultBlog'] == $blogid )\r
2516                 {\r
2517                         self::error(_ERROR_DELDEFBLOG);\r
2518                 }\r
2519                 \r
2520                 $blog =& $manager->getBlog($blogid);\r
2521                 \r
2522                 self::$skin->parse('deleteblog');\r
2523                 return;\r
2524         }\r
2525         \r
2526         /**\r
2527          * Admin::action_deleteblogconfirm()\r
2528          * Delete Blog\r
2529          * \r
2530          * @param       Void\r
2531          * @return      Void\r
2532          */\r
2533         static private function action_deleteblogconfirm()\r
2534         {\r
2535                 global $member, $CONF, $manager;\r
2536                 \r
2537                 $blogid = intRequestVar('blogid');\r
2538                 \r
2539                 $data = array('blogid' => $blogid);\r
2540                 $manager->notify('PreDeleteBlog', $data);\r
2541                 \r
2542                 $member->blogAdminRights($blogid) or self::disallow();\r
2543                 \r
2544                 // check if blog is default blog\r
2545                 if ( $CONF['DefaultBlog'] == $blogid )\r
2546                 {\r
2547                         self::error(_ERROR_DELDEFBLOG);\r
2548                 }\r
2549                 \r
2550                 // delete all comments\r
2551                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2552                 DB::execute($query);\r
2553                 \r
2554                 // delete all items\r
2555                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2556                 DB::execute($query);\r
2557                 \r
2558                 // delete all team members\r
2559                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2560                 DB::execute($query);\r
2561                 \r
2562                 // delete all bans\r
2563                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2564                 DB::execute($query);\r
2565                 \r
2566                 // delete all categories\r
2567                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2568                 DB::execute($query);\r
2569                 \r
2570                 // delete all associated plugin options\r
2571                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2572                 \r
2573                 // delete the blog itself\r
2574                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2575                 DB::execute($query);\r
2576                 \r
2577                 $data = array('blogid' => $blogid);\r
2578                 $manager->notify('PostDeleteBlog', $data);\r
2579                 \r
2580                 self::action_overview(_DELETED_BLOG);\r
2581                 return;\r
2582         }\r
2583         \r
2584         /**\r
2585          * Admin::action_memberdelete()\r
2586          * \r
2587          * @param       void\r
2588          * @return      void\r
2589          */\r
2590         static private function action_memberdelete()\r
2591         {\r
2592                 global $member, $manager;\r
2593                 \r
2594                 $memberid = intRequestVar('memberid');\r
2595                 \r
2596                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2597                 \r
2598                 $mem =& $manager->getMember($memberid);\r
2599                 \r
2600                 self::$skin->parse('memberdelete');\r
2601                 return;\r
2602         }\r
2603         \r
2604         /**\r
2605          * Admin::action_memberdeleteconfirm()\r
2606          * \r
2607          * @param       void\r
2608          * @return      void\r
2609          */\r
2610         static private function action_memberdeleteconfirm()\r
2611         {\r
2612                 global $member;\r
2613                 \r
2614                 $memberid = intRequestVar('memberid');\r
2615                 \r
2616                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2617                 \r
2618                 $error = self::deleteOneMember($memberid);\r
2619                 if ( $error )\r
2620                 {\r
2621                         self::error($error);\r
2622                 }\r
2623                 \r
2624                 if ( $member->isAdmin() )\r
2625                 {\r
2626                         self::action_usermanagement();\r
2627                 }\r
2628                 else\r
2629                 {\r
2630                         self::action_overview(_DELETED_MEMBER);\r
2631                 }\r
2632                 return;\r
2633         }\r
2634         \r
2635         /**\r
2636          * Admin::deleteOneMember()\r
2637          * Delete a member by id\r
2638          * \r
2639          * @static\r
2640          * @params      Integer $memberid       member id\r
2641          * @return      String  null string or error messages\r
2642          */\r
2643         static public function deleteOneMember($memberid)\r
2644         {\r
2645                 global $manager;\r
2646                 \r
2647                 $memberid = intval($memberid);\r
2648                 $mem =& $manager->getMember($memberid);\r
2649                 \r
2650                 if ( !$mem->canBeDeleted() )\r
2651                 {\r
2652                         return _ERROR_DELETEMEMBER;\r
2653                 }\r
2654                 \r
2655                 $data = array('member' => &$mem);\r
2656                 $manager->notify('PreDeleteMember', $data);\r
2657                 \r
2658                 /* unlink comments from memberid */\r
2659                 if ( $memberid )\r
2660                 {\r
2661                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2662                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2663                         DB::execute($query);\r
2664                 }\r
2665                 \r
2666                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2667                 DB::execute($query);\r
2668                 \r
2669                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2670                 DB::execute($query);\r
2671                 \r
2672                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2673                 DB::execute($query);\r
2674                 \r
2675                 // delete all associated plugin options\r
2676                 NucleusPlugin::delete_option_values('member', $memberid);\r
2677                 \r
2678                 $data = array('member' => &$mem);\r
2679                 $manager->notify('PostDeleteMember', $data);\r
2680                 \r
2681                 return '';\r
2682         }\r
2683         \r
2684         /**\r
2685          * Admin::action_createnewlog()\r
2686          * \r
2687          * @param       void\r
2688          * @return      void\r
2689          */\r
2690         static private function action_createnewlog()\r
2691         {\r
2692                 global $member, $CONF, $manager;\r
2693                 \r
2694                 // Only Super-Admins can do this\r
2695                 $member->isAdmin() or self::disallow();\r
2696                 \r
2697                 self::$skin->parse('createnewlog');\r
2698                 return;\r
2699         }\r
2700         \r
2701         /**\r
2702          * Admin::action_addnewlog()\r
2703          * \r
2704          * @param       void\r
2705          * @return      void\r
2706          */\r
2707         static private function action_addnewlog()\r
2708         {\r
2709                 global $member, $manager, $CONF;\r
2710                 \r
2711                 // Only Super-Admins can do this\r
2712                 $member->isAdmin() or self::disallow();\r
2713                 \r
2714                 $bname                  = trim(postVar('name'));\r
2715                 $bshortname             = trim(postVar('shortname'));\r
2716                 $btimeoffset    = postVar('timeoffset');\r
2717                 $bdesc                  = trim(postVar('desc'));\r
2718                 $bdefskin               = postVar('defskin');\r
2719                 \r
2720                 if ( !isValidShortName($bshortname) )\r
2721                 {\r
2722                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2723                 }\r
2724                 \r
2725                 if ( $manager->existsBlog($bshortname) )\r
2726                 {\r
2727                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2728                 }\r
2729                 \r
2730                 $data = array(\r
2731                         'name'        => &$bname,\r
2732                         'shortname'   => &$bshortname,\r
2733                         'timeoffset'  => &$btimeoffset,\r
2734                         'description' => &$bdesc,\r
2735                         'defaultskin' => &$bdefskin\r
2736                 );\r
2737                 $manager->notify('PreAddBlog', $data);\r
2738                 \r
2739                 // add slashes for sql queries\r
2740                 $bname                  = DB::quoteValue($bname);\r
2741                 $bshortname             = DB::quoteValue($bshortname);\r
2742                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2743                 $bdesc                  = DB::quoteValue($bdesc);\r
2744                 $bdefskin               = DB::quoteValue($bdefskin);\r
2745                 \r
2746                 // create blog\r
2747                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2748                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2749                 DB::execute($query);\r
2750                 \r
2751                 $blogid = DB::getInsertId();\r
2752                 $blog   =& $manager->getBlog($blogid);\r
2753                 \r
2754                 // create new category\r
2755                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2756                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2757                 \r
2758                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2759                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2760                 $catid = DB::getInsertId();\r
2761                 \r
2762                 // set as default category\r
2763                 $blog->setDefaultCategory($catid);\r
2764                 $blog->writeSettings();\r
2765                 \r
2766                 // create team member\r
2767                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2768                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2769                 DB::execute($query);\r
2770                 \r
2771                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2772                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2773                 \r
2774                 $blog->additem(\r
2775                         $blog->getDefaultCategory(),\r
2776                         $itemdeftitle,$itemdefbody,\r
2777                         '',\r
2778                         $blogid,\r
2779                         $member->getID(),\r
2780                         $blog->getCorrectTime(),\r
2781                         0,\r
2782                         0,\r
2783                         0\r
2784                 );\r
2785                 \r
2786                 $data = array('blog' => &$blog);\r
2787                 $manager->notify('PostAddBlog', $data);\r
2788                 \r
2789                 $data = array(\r
2790                         'blog'                  => &$blog,\r
2791                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2792                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2793                         'catid'                 => $catid\r
2794                 );\r
2795                 $manager->notify('PostAddCategory', $data);\r
2796                 \r
2797                 /* TODO: we should consider to use the other way insterad of this */\r
2798                 $_REQUEST['blogid'] = $blogid;\r
2799                 $_REQUEST['catid']  = $catid;\r
2800                 self::$skin->parse('addnewlog');\r
2801                 return;\r
2802         }\r
2803         \r
2804         /**\r
2805          * Admin::action_addnewlog2()\r
2806          * \r
2807          * @param       void\r
2808          * @return      void\r
2809          */\r
2810         static private function action_addnewlog2()\r
2811         {\r
2812                 global $member, $manager;\r
2813                 $blogid = intRequestVar('blogid');\r
2814                 \r
2815                 $member->blogAdminRights($blogid) or self::disallow();\r
2816                 \r
2817                 $burl = requestVar('url');\r
2818                 \r
2819                 $blog =& $manager->getBlog($blogid);\r
2820                 $blog->setURL(trim($burl));\r
2821                 $blog->writeSettings();\r
2822                 \r
2823                 self::action_overview(_MSG_NEWBLOG);\r
2824                 return;\r
2825         }\r
2826         \r
2827         /**\r
2828          * Admin::action_skinieoverview()\r
2829          * \r
2830          * @param       void\r
2831          * @return      void\r
2832          */\r
2833         static private function action_skinieoverview()\r
2834         {\r
2835                 global $member, $DIR_LIBS, $manager;\r
2836                 \r
2837                 $member->isAdmin() or self::disallow();\r
2838                 \r
2839                 include_once($DIR_LIBS . 'skinie.php');\r
2840                 \r
2841                 self::$skin->parse('skinieoverview');\r
2842                 return;\r
2843         }\r
2844         \r
2845         /**\r
2846          * Admin::action_skinieimport()\r
2847          * \r
2848          * @param       void\r
2849          * @return      void\r
2850          */\r
2851         static private function action_skinieimport()\r
2852         {\r
2853                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2854                 \r
2855                 $member->isAdmin() or self::disallow();\r
2856                 \r
2857                 // load skinie class\r
2858                 include_once($DIR_LIBS . 'skinie.php');\r
2859                 \r
2860                 $skinFileRaw    = postVar('skinfile');\r
2861                 $mode                   = postVar('mode');\r
2862                 \r
2863                 $importer = new SkinImport();\r
2864                 \r
2865                 // get full filename\r
2866                 if ( $mode == 'file' )\r
2867                 {\r
2868                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2869                         \r
2870                         /* TODO: remove this\r
2871                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2872                         if ( !file_exists($skinFile) )\r
2873                         {\r
2874                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2875                         }\r
2876                          */\r
2877                 }\r
2878                 else\r
2879                 {\r
2880                         $skinFile = $skinFileRaw;\r
2881                 }\r
2882                 \r
2883                 // read only metadata\r
2884                 $error = $importer->readFile($skinFile, 1);\r
2885                 \r
2886                 /* TODO: we should consider to use the other way insterad of this */\r
2887                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2888                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2889                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2890                 \r
2891                 // clashes\r
2892                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2893                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2894                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2895                 \r
2896                 /* TODO: we should consider to use the other way insterad of this */\r
2897                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2898                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2899                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2900                 \r
2901                 if ( $error )\r
2902                 {\r
2903                         self::error($error);\r
2904                 }\r
2905                 \r
2906                 self::$skin->parse('skinieimport');\r
2907                 return;\r
2908         }\r
2909         \r
2910         /**\r
2911          * Admin::action_skiniedoimport()\r
2912          * \r
2913          * @param       void\r
2914          * @return      void\r
2915          */\r
2916         static private function action_skiniedoimport()\r
2917         {\r
2918                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2919                 \r
2920                 $member->isAdmin() or self::disallow();\r
2921                 \r
2922                 // load skinie class\r
2923                 include_once($DIR_LIBS . 'skinie.php');\r
2924                 \r
2925                 $skinFileRaw    = postVar('skinfile');\r
2926                 $mode                   = postVar('mode');\r
2927                 \r
2928                 $allowOverwrite = intPostVar('overwrite');\r
2929                 \r
2930                 // get full filename\r
2931                 if ( $mode == 'file' )\r
2932                 {\r
2933                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2934                         \r
2935                         /* TODO: remove this\r
2936                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2937                         if ( !file_exists($skinFile) )\r
2938                         {\r
2939                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2940                         }\r
2941                         */\r
2942                 }\r
2943                 else\r
2944                 {\r
2945                         $skinFile = $skinFileRaw;\r
2946                 }\r
2947                 \r
2948                 $importer = new SkinImport();\r
2949                 \r
2950                 $error = $importer->readFile($skinFile);\r
2951                 \r
2952                 if ( $error )\r
2953                 {\r
2954                         self::error($error);\r
2955                 }\r
2956                 \r
2957                 $error = $importer->writeToDatabase($allowOverwrite);\r
2958                 \r
2959                 if ( $error )\r
2960                 {\r
2961                         self::error($error);\r
2962                 }\r
2963                 \r
2964                 /* TODO: we should consider to use the other way insterad of this */\r
2965                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2966                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2967                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2968                 \r
2969                 self::$skin->parse('skiniedoimport');\r
2970                 return;\r
2971         }\r
2972 \r
2973         /**\r
2974          * Admin::action_skinieexport()\r
2975          * \r
2976          * @param       void\r
2977          * @return      void\r
2978          */\r
2979         static private function action_skinieexport()\r
2980         {\r
2981                 global $member, $DIR_LIBS;\r
2982                 \r
2983                 $member->isAdmin() or self::disallow();\r
2984                 \r
2985                 // load skinie class\r
2986                 include_once($DIR_LIBS . 'skinie.php');\r
2987                 \r
2988                 $aSkins         = requestIntArray('skin');\r
2989                 $aTemplates     = requestIntArray('template');\r
2990                 \r
2991                 if ( !is_array($aTemplates) )\r
2992                 {\r
2993                         $aTemplates = array();\r
2994                 }\r
2995                 if ( !is_array($aSkins) )\r
2996                 {\r
2997                         $aSkins = array();\r
2998                 }\r
2999                 \r
3000                 $skinList               = array_keys($aSkins);\r
3001                 $templateList   = array_keys($aTemplates);\r
3002                 \r
3003                 $info = postVar('info');\r
3004                 \r
3005                 $exporter = new SkinExport();\r
3006                 foreach ( $skinList as $skinId )\r
3007                 {\r
3008                         $exporter->addSkin($skinId);\r
3009                 }\r
3010                 foreach ($templateList as $templateId)\r
3011                 {\r
3012                         $exporter->addTemplate($templateId);\r
3013                 }\r
3014                 $exporter->setInfo($info);\r
3015                 \r
3016                 $exporter->export();\r
3017                 return;\r
3018         }\r
3019         \r
3020         /**\r
3021          * Admin::action_templateoverview()\r
3022          * \r
3023          * @param       void\r
3024          * @return      void\r
3025          */\r
3026         static private function action_templateoverview()\r
3027         {\r
3028                 global $member, $manager;\r
3029                 \r
3030                 $member->isAdmin() or self::disallow();\r
3031                 \r
3032                 self::$skin->parse('templateoverview');\r
3033                 return;\r
3034         }\r
3035         \r
3036         /**\r
3037          * Admin::action_templateedit()\r
3038          * \r
3039          * @param       string  $msg    message for pageheader\r
3040          * @return      void\r
3041          */\r
3042         static private function action_templateedit($msg = '')\r
3043         {\r
3044                 global $member, $manager;\r
3045                 if ( $msg )\r
3046                 {\r
3047                         self::$headMess = $msg;\r
3048                 }\r
3049                 \r
3050                 $templateid = intRequestVar('templateid');\r
3051                 \r
3052                 $member->isAdmin() or self::disallow();\r
3053                 \r
3054                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3055                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3056                 \r
3057                 self::$skin->parse('templateedit');\r
3058                 return;\r
3059         }\r
3060         \r
3061         /**\r
3062          * Admin::action_templateupdate()\r
3063          * \r
3064          * @param       void\r
3065          * @return      void\r
3066          */\r
3067         static private function action_templateupdate()\r
3068         {\r
3069                 global $member,$manager;\r
3070                 \r
3071                 $templateid = intRequestVar('templateid');\r
3072                 \r
3073                 $member->isAdmin() or self::disallow();\r
3074                 \r
3075                 $name = postVar('tname');\r
3076                 $desc = postVar('tdesc');\r
3077                 \r
3078                 if ( !isValidTemplateName($name) )\r
3079                 {\r
3080                         self::error(_ERROR_BADTEMPLATENAME);\r
3081                 }\r
3082                 \r
3083                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3084                 {\r
3085                         self::error(_ERROR_DUPTEMPLATENAME);\r
3086                 }\r
3087                 \r
3088                 // 1. Remove all template parts\r
3089                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3090                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3091                 DB::execute($query);\r
3092                 \r
3093                 // 2. Update description\r
3094                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3095                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3096                 DB::execute($query);\r
3097                 \r
3098                 // 3. Add non-empty template parts\r
3099                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3100                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3101                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3102                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3103                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3104                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3105                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3106                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3107                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3108                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3109                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3110                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3111                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3114                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3115                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3116                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3117                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3118                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3119                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3120                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3121                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3122                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3123                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3124                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3125                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3126                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3127                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3128                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3129                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3130                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3131                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3132                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3133                 \r
3134                 $data = array('fields' => array());\r
3135                 $manager->notify('TemplateExtraFields', $data);\r
3136                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3137                 {\r
3138                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3139                         {\r
3140                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3141                         }\r
3142                 }\r
3143                 \r
3144                 // jump back to template edit\r
3145                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3146                 return;\r
3147         }\r
3148         \r
3149         /**\r
3150          * Admin::addToTemplate()\r
3151          * \r
3152          * @param       Integer $id     ID for template\r
3153          * @param       String  $partname       parts name\r
3154          * @param       String  $content        template contents\r
3155          * @return      Integer record index\r
3156          * \r
3157          */\r
3158         static private function addToTemplate($id, $partname, $content)\r
3159         {\r
3160                 // don't add empty parts:\r
3161                 if ( !trim($content) )\r
3162                 {\r
3163                         return -1;\r
3164                 }\r
3165                 \r
3166                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3167                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3168                 if ( DB::execute($query) === FALSE )\r
3169                 {\r
3170                         $err = DB::getError();\r
3171                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3172                 }\r
3173                 return DB::getInsertId();\r
3174         }\r
3175         \r
3176         /**\r
3177          * Admin::action_templatedelete()\r
3178          * \r
3179          * @param       void\r
3180          * @return      void\r
3181          */\r
3182         static private function action_templatedelete()\r
3183         {\r
3184                 global $member, $manager;\r
3185                 \r
3186                 $member->isAdmin() or self::disallow();\r
3187                 \r
3188                 $templateid = intRequestVar('templateid');\r
3189                 // TODO: check if template can be deleted\r
3190                 \r
3191                 self::$skin->parse('templatedelete');\r
3192                 return;\r
3193         }\r
3194         \r
3195         /**\r
3196          * Admin::action_templatedeleteconfirm()\r
3197          * \r
3198          * @param       void\r
3199          * @return      void\r
3200          */\r
3201         static private function action_templatedeleteconfirm()\r
3202         {\r
3203                 global $member, $manager;\r
3204                 \r
3205                 $templateid = intRequestVar('templateid');\r
3206                 \r
3207                 $member->isAdmin() or self::disallow();\r
3208                 \r
3209                 $data = array('templateid' => $templateid);\r
3210                 $manager->notify('PreDeleteTemplate', $data);\r
3211                 \r
3212                 // 1. delete description\r
3213                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3214                 \r
3215                 // 2. delete parts\r
3216                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3217                 \r
3218                 \r
3219                 $data = array('templateid' => $templateid);\r
3220                 $manager->notify('PostDeleteTemplate', $data);\r
3221                 \r
3222                 self::action_templateoverview();\r
3223                 return;\r
3224         }\r
3225         \r
3226         /**\r
3227          * Admin::action_templatenew()\r
3228          * \r
3229          * @param       void\r
3230          * @return      void\r
3231          */\r
3232         static private function action_templatenew()\r
3233         {\r
3234                 global $member;\r
3235                 \r
3236                 $member->isAdmin() or self::disallow();\r
3237                 \r
3238                 $name = postVar('name');\r
3239                 $desc = postVar('desc');\r
3240                 \r
3241                 if ( !isValidTemplateName($name) )\r
3242                 {\r
3243                         self::error(_ERROR_BADTEMPLATENAME);\r
3244                 }\r
3245                 \r
3246                 if ( Template::exists($name) )\r
3247                 {\r
3248                         self::error(_ERROR_DUPTEMPLATENAME);\r
3249                 }\r
3250                 \r
3251                 $newTemplateId = Template::createNew($name, $desc);\r
3252                 \r
3253                 self::action_templateoverview();\r
3254                 return;\r
3255         }\r
3256         \r
3257         /**\r
3258          * Admin::action_templateclone()\r
3259          * \r
3260          * @param       void\r
3261          * @return      void\r
3262          */\r
3263         static private function action_templateclone()\r
3264         {\r
3265                 global $member;\r
3266                 \r
3267                 $templateid = intRequestVar('templateid');\r
3268                 \r
3269                 $member->isAdmin() or self::disallow();\r
3270                 \r
3271                 // 1. read old template\r
3272                 $name = Template::getNameFromId($templateid);\r
3273                 $desc = Template::getDesc($templateid);\r
3274                 \r
3275                 // 2. create desc thing\r
3276                 $name = "cloned" . $name;\r
3277                 \r
3278                 // if a template with that name already exists:\r
3279                 if ( Template::exists($name) )\r
3280                 {\r
3281                         $i = 1;\r
3282                         while (Template::exists($name . $i))\r
3283                         {\r
3284                                 $i++;\r
3285                         }\r
3286                         $name .= $i;\r
3287                 }\r
3288                 \r
3289                 $newid = Template::createNew($name, $desc);\r
3290                 \r
3291                 // 3. create clone\r
3292                 // go through parts of old template and add them to the new one\r
3293                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3294                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3295                 \r
3296                 $res = DB::getResult($query);\r
3297                 foreach ( $res as $row)\r
3298                 {\r
3299                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3300                 }\r
3301                 \r
3302                 self::action_templateoverview();\r
3303                 return;\r
3304         }\r
3305         \r
3306         /**\r
3307          * Admin::action_admintemplateoverview()\r
3308          * \r
3309          * @param       void\r
3310          * @return      void\r
3311          */\r
3312         static private function action_admintemplateoverview()\r
3313         {\r
3314                 global $member;\r
3315                 $member->isAdmin() or self::disallow();\r
3316                 self::$skin->parse('admntemplateoverview');\r
3317                 return;\r
3318         }\r
3319         \r
3320         /**\r
3321          * Admin::action_admintemplateedit()\r
3322          * \r
3323          * @param       string  $msg    message for pageheader\r
3324          * @return      void\r
3325          */\r
3326         static private function action_admintemplateedit($msg = '')\r
3327         {\r
3328                 global $member, $manager;\r
3329                 if ( $msg )\r
3330                 {\r
3331                         self::$headMess = $msg;\r
3332                 }\r
3333                 $member->isAdmin() or self::disallow();\r
3334                 \r
3335                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3336                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3337                 \r
3338                 self::$skin->parse('admintemplateedit');\r
3339                 return;\r
3340         }\r
3341         \r
3342         /**\r
3343          * Admin::action_admintemplateupdate()\r
3344          * \r
3345          * @param       void\r
3346          * @return      void\r
3347          */\r
3348         static private function action_admintemplateupdate()\r
3349         {\r
3350                 global $member, $manager;\r
3351                 $templateid = intRequestVar('templateid');\r
3352                 $member->isAdmin() or self::disallow();\r
3353                 $name = postVar('tname');\r
3354                 $desc = postVar('tdesc');\r
3355                 \r
3356                 if ( !isValidTemplateName($name) )\r
3357                 {\r
3358                         self::error(_ERROR_BADTEMPLATENAME);\r
3359                 }\r
3360                 \r
3361                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3362                 {\r
3363                         self::error(_ERROR_DUPTEMPLATENAME);\r
3364                 }\r
3365                 \r
3366                 // 1. Remove all template parts\r
3367                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3368                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3369                 DB::execute($query);\r
3370                 \r
3371                 // 2. Update description\r
3372                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3373                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3374                 DB::execute($query);\r
3375                 \r
3376                 // 3. Add non-empty template parts\r
3377                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3378                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3379                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3380                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3381                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3382                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3383                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3384                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3385                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3386                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3387                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3388                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3389                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3390                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3391                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3392                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3393                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3394                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3395                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3396                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3397                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3398                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3399                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3400                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3401                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3402                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3403                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3404                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3405                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3478                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3479                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3480                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3481                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3482                 \r
3483                 $data = array('fields' => array());\r
3484                 $manager->notify('AdminTemplateExtraFields', $data);\r
3485                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3486                 {\r
3487                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3488                         {\r
3489                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3490                         }\r
3491                 }\r
3492                 \r
3493                 // jump back to template edit\r
3494                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3495                 return;\r
3496         }\r
3497         \r
3498         /**\r
3499          * Admin::addToAdminTemplate()\r
3500          * \r
3501          * @param       integer $id                     ID for template\r
3502          * @param       string  $partname       name of part for template\r
3503          * @param       void    $contents       content for part of template\r
3504          * @return      integer ID for newly inserted Template\r
3505          */\r
3506         static private function addToAdminTemplate($id, $partname, $content)\r
3507         {\r
3508                 // don't add empty parts:\r
3509                 if ( !trim($content) )\r
3510                 {\r
3511                         return -1;\r
3512                 }\r
3513                 \r
3514                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3515                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3516                 if ( DB::execute($query) === FALSE )\r
3517                 {\r
3518                         $err = DB::getError();\r
3519                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3520                 }\r
3521                 return DB::getInsertId();\r
3522         }\r
3523         \r
3524         /**\r
3525          * Admin::action_admintemplatedelete()\r
3526          * \r
3527          * @param       void\r
3528          * @return      void\r
3529          */\r
3530         static private function action_admintemplatedelete()\r
3531         {\r
3532                 global $member, $manager;\r
3533                 $member->isAdmin() or self::disallow();\r
3534                 \r
3535                 // TODO: check if template can be deleted\r
3536                 self::$skin->parse('admintemplatedelete');\r
3537                 return;\r
3538         }\r
3539         \r
3540         /**\r
3541          * Admin::action_admintemplatedeleteconfirm()\r
3542          * \r
3543          * @param       void\r
3544          * @return      void\r
3545          */\r
3546         static private function action_admintemplatedeleteconfirm()\r
3547         {\r
3548                 global $member, $manager;\r
3549                 \r
3550                 $templateid = intRequestVar('templateid');\r
3551                 $member->isAdmin() or self::disallow();\r
3552                 \r
3553                 $data = array('templateid' => $templateid);\r
3554                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3555                 \r
3556                 // 1. delete description\r
3557                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3558                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3559                 DB::execute($query);\r
3560                 \r
3561                 // 2. delete parts\r
3562                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3563                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3564                 DB::execute($query);\r
3565                 \r
3566                 $data = array('templateid' => $templateid);\r
3567                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3568                 \r
3569                 self::action_admintemplateoverview();\r
3570                 return;\r
3571         }\r
3572         \r
3573         /**\r
3574          * Admin::action_admintemplatenew()\r
3575          * \r
3576          * @param       void\r
3577          * @return      void\r
3578          */\r
3579         static private function action_admintemplatenew()\r
3580         {\r
3581                 global $member;\r
3582                 $member->isAdmin() or self::disallow();\r
3583                 $name = postVar('name');\r
3584                 $desc = postVar('desc');\r
3585                 \r
3586                 if ( !isValidTemplateName($name) )\r
3587                 {\r
3588                         self::error(_ERROR_BADTEMPLATENAME);\r
3589                 }\r
3590                 else if ( !preg_match('#^admin/#', $name) )\r
3591                 {\r
3592                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3593                 }\r
3594                 else if ( Template::exists($name) )\r
3595                 {\r
3596                         self::error(_ERROR_DUPTEMPLATENAME);\r
3597                 }\r
3598                 \r
3599                 $newTemplateId = Template::createNew($name, $desc);\r
3600                 self::action_admintemplateoverview();\r
3601                 return;\r
3602         }\r
3603         \r
3604         /**\r
3605          * Admin::action_admintemplateclone()\r
3606          * \r
3607          * @param       void\r
3608          * @return      void\r
3609          */\r
3610         static private function action_admintemplateclone()\r
3611         {\r
3612                 global $member;\r
3613                 $templateid = intRequestVar('templateid');\r
3614                 $member->isAdmin() or self::disallow();\r
3615                 \r
3616                 // 1. read old template\r
3617                 $name = Template::getNameFromId($templateid);\r
3618                 $desc = Template::getDesc($templateid);\r
3619                 \r
3620                 // 2. create desc thing\r
3621                 $name = $name . "cloned";\r
3622                 \r
3623                 // if a template with that name already exists:\r
3624                 if ( Template::exists($name) )\r
3625                 {\r
3626                         $i = 1;\r
3627                         while ( Template::exists($name . $i) )\r
3628                         {\r
3629                                 $i++;\r
3630                         }\r
3631                         $name .= $i;\r
3632                 }\r
3633                 \r
3634                 $newid = Template::createNew($name, $desc);\r
3635                 \r
3636                 // 3. create clone\r
3637                 // go through parts of old template and add them to the new one\r
3638                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3639                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3640                 \r
3641                 $res = DB::getResult($query);\r
3642                 foreach ( $res as $row )\r
3643                 {\r
3644                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3645                 }\r
3646                 \r
3647                 self::action_admintemplateoverview();\r
3648                 return;\r
3649         }\r
3650 \r
3651         /**\r
3652          * Admin::action_skinoverview()\r
3653          * \r
3654          * @param       void\r
3655          * @return      void\r
3656          */\r
3657         static private function action_skinoverview()\r
3658         {\r
3659                 global $member, $manager;\r
3660                 \r
3661                 $member->isAdmin() or self::disallow();\r
3662                 \r
3663                 self::$skin->parse('skinoverview');\r
3664                 return;\r
3665         }\r
3666         \r
3667         /**\r
3668          * Admin::action_skinnew()\r
3669          * \r
3670          * @param       void\r
3671          * @return      void\r
3672          */\r
3673         static private function action_skinnew()\r
3674         {\r
3675                 global $member;\r
3676                 \r
3677                 $member->isAdmin() or self::disallow();\r
3678                 \r
3679                 $name = trim(postVar('name'));\r
3680                 $desc = trim(postVar('desc'));\r
3681                 \r
3682                 if ( !isValidSkinName($name) )\r
3683                 {\r
3684                         self::error(_ERROR_BADSKINNAME);\r
3685                 }\r
3686                 \r
3687                 if ( SKIN::exists($name) )\r
3688                 {\r
3689                         self::error(_ERROR_DUPSKINNAME);\r
3690                 }\r
3691                 \r
3692                 $newId = SKIN::createNew($name, $desc);\r
3693                 \r
3694                 self::action_skinoverview();\r
3695                 return;\r
3696         }\r
3697         \r
3698         /**\r
3699          * Admin::action_skinedit()\r
3700          * \r
3701          * @param       void\r
3702          * @return      void\r
3703          */\r
3704         static private function action_skinedit()\r
3705         {\r
3706                 global $member, $manager;\r
3707                 \r
3708                 $member->isAdmin() or self::disallow();\r
3709                 \r
3710                 self::$skin->parse('skinedit');\r
3711                 return;\r
3712         }\r
3713         \r
3714         /**\r
3715          * Admin::action_skineditgeneral()\r
3716          * \r
3717          * @param       void\r
3718          * @return      void\r
3719          */\r
3720         static private function action_skineditgeneral()\r
3721         {\r
3722                 global $member;\r
3723                 \r
3724                 $skinid = intRequestVar('skinid');\r
3725                 \r
3726                 $member->isAdmin() or self::disallow();\r
3727                 \r
3728                 $name           = postVar('name');\r
3729                 $desc           = postVar('desc');\r
3730                 $type           = postVar('type');\r
3731                 $inc_mode       = postVar('inc_mode');\r
3732                 $inc_prefix     = postVar('inc_prefix');\r
3733                 \r
3734                 $skin = new Skin($skinid);\r
3735                 \r
3736                 // 1. Some checks\r
3737                 if ( !isValidSkinName($name) )\r
3738                 {\r
3739                         self::error(_ERROR_BADSKINNAME);\r
3740                 }\r
3741                 \r
3742                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3743                 {\r
3744                         self::error(_ERROR_DUPSKINNAME);\r
3745                 }\r
3746                 \r
3747                 if ( !$type )\r
3748                 {\r
3749                         $type = 'text/html';\r
3750                 }\r
3751                 if ( !$inc_mode )\r
3752                 {\r
3753                         $inc_mode = 'normal';\r
3754                 }\r
3755                 \r
3756                 // 2. Update description\r
3757                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3758                 \r
3759                 self::action_skinedit();\r
3760                 return;\r
3761         }\r
3762         \r
3763         static private function action_skinedittype($msg = '')\r
3764         {\r
3765                 global $member, $manager;\r
3766                 \r
3767                 $member->isAdmin() or self::disallow();\r
3768                 \r
3769                 if ( $msg )\r
3770                 {\r
3771                         self::$headMess = $msg;\r
3772                 }\r
3773                 \r
3774                 $skinid = intRequestVar('skinid');\r
3775                 $type   = requestVar('type');\r
3776                 $type   = trim($type);\r
3777                 $type   = strtolower($type);\r
3778                 \r
3779                 if ( !isValidShortName($type) )\r
3780                 {\r
3781                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3782                 }\r
3783                 \r
3784                 self::$skin->parse('skinedittype');\r
3785                 return;\r
3786         }\r
3787         \r
3788         /**\r
3789          * Admin::action_skinupdate()\r
3790          * \r
3791          * @param       void\r
3792          * @return      void\r
3793          */\r
3794         static private function action_skinupdate()\r
3795         {\r
3796                 global $member;\r
3797                 \r
3798                 $skinid = intRequestVar('skinid');\r
3799                 $content = trim(postVar('content'));\r
3800                 $type = postVar('type');\r
3801                 \r
3802                 $member->isAdmin() or self::disallow();\r
3803                 \r
3804                 $skin = new SKIN($skinid);\r
3805                 $skin->update($type, $content);\r
3806                 \r
3807                 self::action_skinedittype(_SKIN_UPDATED);\r
3808                 return;\r
3809         }\r
3810         \r
3811         /**\r
3812          * Admin::action_skindelete()\r
3813          * \r
3814          * @param       void\r
3815          * @return      void\r
3816          */\r
3817         static private function action_skindelete()\r
3818         {\r
3819                 global $member, $manager, $CONF;\r
3820                 \r
3821                 $skinid = intRequestVar('skinid');\r
3822                 \r
3823                 $member->isAdmin() or self::disallow();\r
3824                 \r
3825                 // don't allow default skin to be deleted\r
3826                 if ( $skinid == $CONF['BaseSkin'] )\r
3827                 {\r
3828                         self::error(_ERROR_DEFAULTSKIN);\r
3829                 }\r
3830                 \r
3831                 // don't allow deletion of default skins for blogs\r
3832                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3833                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3834                 \r
3835                 $name = DB::getValue($query);\r
3836                 if ( $name )\r
3837                 {\r
3838                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3839                 }\r
3840                 \r
3841                 self::$skin->parse('skindelete');\r
3842                 return;\r
3843         }\r
3844         \r
3845         /**\r
3846          * Admin::action_skindeleteconfirm()\r
3847          * \r
3848          * @param       void\r
3849          * @return      void\r
3850          */\r
3851         static private function action_skindeleteconfirm()\r
3852         {\r
3853                 global $member, $CONF, $manager;\r
3854                 \r
3855                 $skinid = intRequestVar('skinid');\r
3856                 \r
3857                 $member->isAdmin() or self::disallow();\r
3858                 \r
3859                 // don't allow default skin to be deleted\r
3860                 if ( $skinid == $CONF['BaseSkin'] )\r
3861                 {\r
3862                         self::error(_ERROR_DEFAULTSKIN);\r
3863                 }\r
3864                 \r
3865                 // don't allow deletion of default skins for blogs\r
3866                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3867                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3868                 \r
3869                 $name = DB::getValue($query);\r
3870                 if ( $name )\r
3871                                 {\r
3872                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3873                 }\r
3874                 \r
3875                 $data = array('skinid' => $skinid);\r
3876                 $manager->notify('PreDeleteSkin', $data);\r
3877                 \r
3878                 // 1. delete description\r
3879                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3880                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3881                 DB::execute($query);\r
3882                 \r
3883                 // 2. delete parts\r
3884                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3885                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3886                 DB::execute($query);\r
3887                 \r
3888                 $data = array('skinid' => $skinid);\r
3889                 $manager->notify('PostDeleteSkin', $data);\r
3890                 \r
3891                 self::action_skinoverview();\r
3892                 return;\r
3893         }\r
3894         \r
3895         /**\r
3896          * Admin::action_skinremovetype()\r
3897          * \r
3898          * @param       void\r
3899          * @return      void\r
3900          */\r
3901         static private function action_skinremovetype()\r
3902         {\r
3903                 global $member, $manager, $CONF;\r
3904                 \r
3905                 $member->isAdmin() or self::disallow();\r
3906                 \r
3907                 $skinid = intRequestVar('skinid');\r
3908                 $skintype = requestVar('type');\r
3909                 \r
3910                 if ( !isValidShortName($skintype) )\r
3911                 {\r
3912                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3913                 }\r
3914                 \r
3915                 // don't allow default skinparts to be deleted\r
3916                 /* TODO: this array should be retrieved from Action class */\r
3917                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3918                 {\r
3919                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3920                 }\r
3921                 \r
3922                 self::$skin->parse('skinremovetype');\r
3923                 return;\r
3924         }\r
3925         \r
3926         /**\r
3927          * Admin::action_skinremovetypeconfirm()\r
3928          * \r
3929          * @param       void\r
3930          * @return      void\r
3931          */\r
3932         static private function action_skinremovetypeconfirm()\r
3933         {\r
3934                 global $member, $CONF, $manager;\r
3935                 \r
3936                 $member->isAdmin() or self::disallow();\r
3937                 \r
3938                 $skinid = intRequestVar('skinid');\r
3939                 $skintype = requestVar('type');\r
3940                 \r
3941                 if ( !isValidShortName($skintype) )\r
3942                 {\r
3943                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3944                 }\r
3945                 \r
3946                 // don't allow default skinparts to be deleted\r
3947                 /* TODO: this array should be retrieved from Action class */\r
3948                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3949                 {\r
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3951                 }\r
3952                 \r
3953                 $data = array(\r
3954                         'skinid'   => $skinid,\r
3955                         'skintype' => $skintype\r
3956                 );\r
3957                 $manager->notify('PreDeleteSkinPart', $data);\r
3958                 // delete part\r
3959                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3960                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3961                 DB::execute($query);\r
3962                 \r
3963                 $data = array(\r
3964                         'skinid'   => $skinid,\r
3965                         'skintype' => $skintype\r
3966                 );\r
3967                 $manager->notify('PostDeleteSkinPart', $data);\r
3968                 \r
3969                 self::action_skinedit();\r
3970                 return;\r
3971         }\r
3972 \r
3973         /**\r
3974          * Admin::action_skinclone()\r
3975          * \r
3976          * @param       void\r
3977          * @return      void\r
3978          */\r
3979         static private function action_skinclone()\r
3980         {\r
3981                 global $member;\r
3982                 \r
3983                 $member->isAdmin() or self::disallow();\r
3984                 \r
3985                 $skinid = intRequestVar('skinid');\r
3986                 \r
3987                 // 1. read skin to clone\r
3988                 $skin = new Skin($skinid);\r
3989                 \r
3990                 $name = "{$skin->getName()}_clone";\r
3991                 \r
3992                 // if a skin with that name already exists:\r
3993                 if ( Skin::exists($name) )\r
3994                 {\r
3995                         $i = 1;\r
3996                         while ( Skin::exists($name . $i) )\r
3997                         {\r
3998                                 $i++;\r
3999                         }\r
4000                         $name .= $i;\r
4001                 }\r
4002                 \r
4003                 // 2. create skin desc\r
4004                 $newid = Skin::createNew(\r
4005                         $name,\r
4006                         $skin->getDescription(),\r
4007                         $skin->getContentType(),\r
4008                         $skin->getIncludeMode(),\r
4009                         $skin->getIncludePrefix()\r
4010                 );\r
4011                 \r
4012                 // 3. clone\r
4013                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4014                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4015                 \r
4016                 $res = DB::getResult($query);\r
4017                 foreach ( $res as $row )\r
4018                 {\r
4019                         self::skinclonetype($skin, $newid, $row['stype']);\r
4020                 }\r
4021                 \r
4022                 self::action_skinoverview();\r
4023                 return;\r
4024         }\r
4025         \r
4026         /**\r
4027          * Admin::skinclonetype()\r
4028          * \r
4029          * @param       String  $skin   Skin object\r
4030          * @param       Integer $newid  ID for this clone\r
4031          * @param       String  $type   type of skin\r
4032          * @return      Void\r
4033          */\r
4034         static private function skinclonetype($skin, $newid, $type)\r
4035         {\r
4036                 $newid = intval($newid);\r
4037                 $content = $skin->getContentFromDB($type);\r
4038                 \r
4039                 if ( $content )\r
4040                 {\r
4041                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4042                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4043                         DB::execute($query);\r
4044                 }\r
4045                 return;\r
4046         }\r
4047         \r
4048         /**\r
4049          * Admin::action_adminskinoverview()\r
4050          * \r
4051          * @param       void\r
4052          * @return      void\r
4053          */\r
4054         static private function action_adminskinoverview()\r
4055         {\r
4056                 global $member, $manager;\r
4057                 \r
4058                 $member->isAdmin() or self::disallow();\r
4059                 \r
4060                 self::$skin->parse('adminskinoverview');\r
4061                 return;\r
4062         }\r
4063         \r
4064         /**\r
4065          * Admin::action_adminskinnew()\r
4066          * \r
4067          * @param       void\r
4068          * @return      void\r
4069          */\r
4070         static private function action_adminskinnew()\r
4071         {\r
4072                 global $member;\r
4073                 $member->isAdmin() or self::disallow();\r
4074                 $name = trim(postVar('name'));\r
4075                 $desc = trim(postVar('desc'));\r
4076                 \r
4077                 if ( !isValidSkinName($name) )\r
4078                 {\r
4079                         self::error(_ERROR_BADSKINNAME);\r
4080                 }\r
4081                 else if ( !preg_match('#^admin/#', $name) )\r
4082                 {\r
4083                         self::error(_ERROR_BADADMINSKINNAME);\r
4084                 }\r
4085                 else if ( Skin::exists($name) )\r
4086                 {\r
4087                         self::error(_ERROR_DUPSKINNAME);\r
4088                 }\r
4089                 /* TODO: $newId is not reused... */\r
4090                 $newId = Skin::createNew($name, $desc);\r
4091                 self::action_adminskinoverview();\r
4092                 return;\r
4093         }\r
4094         \r
4095         /**\r
4096          * Admin::action_adminskinedit()\r
4097          * \r
4098          * @param       void\r
4099          * @return      void\r
4100          */\r
4101         static private function action_adminskinedit()\r
4102         {\r
4103                 global $member, $manager;\r
4104                 \r
4105                 $member->isAdmin() or self::disallow();\r
4106                 self::$skin->parse('adminskinedit');\r
4107                 return;\r
4108         }\r
4109         \r
4110         /**\r
4111          * Admin::action_adminskineditgeneral()\r
4112          * \r
4113          * @param       void\r
4114          * @return      void\r
4115          */\r
4116         static private function action_adminskineditgeneral()\r
4117         {\r
4118                 global $member;\r
4119                 \r
4120                 $skinid = intRequestVar('skinid');\r
4121                 \r
4122                 $member->isAdmin() or self::disallow();\r
4123                 \r
4124                 $name           = postVar('name');\r
4125                 $desc           = postVar('desc');\r
4126                 $type           = postVar('type');\r
4127                 $inc_mode       = postVar('inc_mode');\r
4128                 $inc_prefix     = postVar('inc_prefix');\r
4129                 \r
4130                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4131                 \r
4132                 // 1. Some checks\r
4133                 if ( !isValidSkinName($name) )\r
4134                 {\r
4135                         self::error(_ERROR_BADSKINNAME);\r
4136                 }\r
4137                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4138                 {\r
4139                         self::error(_ERROR_DUPSKINNAME);\r
4140                 }\r
4141                 if ( !$type )\r
4142                 {\r
4143                         $type = 'text/html';\r
4144                 }\r
4145                 if ( !$inc_mode )\r
4146                 {\r
4147                         $inc_mode = 'normal';\r
4148                 }\r
4149                 // 2. Update description\r
4150                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4151                 self::action_adminskinedit();\r
4152                 return;\r
4153         }\r
4154         \r
4155         /**\r
4156          * Admin::action_adminskinedittype()\r
4157          * \r
4158          * @param       string  $msg    message for pageheader\r
4159          * @return      void\r
4160          */\r
4161         static private function action_adminskinedittype($msg = '')\r
4162         {\r
4163                 global $member, $manager;\r
4164                 \r
4165                 $member->isAdmin() or self::disallow();\r
4166                 \r
4167                 if ( $msg )\r
4168                 {\r
4169                         self::$headMess = $msg;\r
4170                 }\r
4171                 $type = requestVar('type');\r
4172                 $type = trim($type);\r
4173                 $type = strtolower($type);\r
4174                 \r
4175                 if ( !isValidShortName($type) )\r
4176                 {\r
4177                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4178                 }\r
4179                 \r
4180                 self::$skin->parse('adminskinedittype');\r
4181                 return;\r
4182         }\r
4183         \r
4184         /**\r
4185          * Admin::action_adminskinupdate()\r
4186          * \r
4187          * @param       void\r
4188          * @return      void\r
4189          */\r
4190         static private function action_adminskinupdate()\r
4191         {\r
4192                 global $member;\r
4193                 $skinid         = intRequestVar('skinid');\r
4194                 $content        = trim(postVar('content'));\r
4195                 $type           = postVar('type');\r
4196                 \r
4197                 $member->isAdmin() or self::disallow();\r
4198                 \r
4199                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4200                 $skin->update($type, $content);\r
4201                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4202                 return;\r
4203         }\r
4204         \r
4205         /**\r
4206          * Admin::action_adminskindelete()\r
4207          * \r
4208          * @param       void\r
4209          * @return      void\r
4210          */\r
4211         static private function action_adminskindelete()\r
4212         {\r
4213                 global $member, $manager, $CONF;\r
4214                 $member->isAdmin() or self::disallow();\r
4215                 \r
4216                 /* TODO: needless variable $skinid... */\r
4217                 $skinid = intRequestVar('skinid');\r
4218                 self::$skin->parse('adminskindelete');\r
4219                 return;\r
4220         }\r
4221 \r
4222         /**\r
4223          * Admin::action_adminskindeleteconfirm()\r
4224          * \r
4225          * @param       void\r
4226          * @return      void\r
4227          */\r
4228         static private function action_adminskindeleteconfirm()\r
4229         {\r
4230                 global $member, $CONF, $manager;\r
4231                 \r
4232                 $member->isAdmin() or self::disallow();\r
4233                 $skinid = intRequestVar('skinid');\r
4234                 \r
4235                 // don't allow default skin to be deleted\r
4236                 if ( $skinid == $CONF['AdminSkin'] )\r
4237                 {\r
4238                         self::error(_ERROR_DEFAULTSKIN);\r
4239                 }\r
4240                 \r
4241                 /*\r
4242                  * TODO: NOT Implemented\r
4243                  *  don't allow deletion of default skins for members\r
4244                 $memberDefaults =  $member->getAdminSkin();\r
4245                 foreach ( $memberDefaults as $memID => $adminskin )\r
4246                 {\r
4247                         if ( $skinid == $adminskin )\r
4248                         {\r
4249                                 $mem =& $manager->getMember($memID);\r
4250                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4251                         }\r
4252                 }\r
4253                 */\r
4254                 \r
4255                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4256                 \r
4257                 // 1. delete description\r
4258                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4259                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4260                 DB::execute($query);\r
4261                 \r
4262                 // 2. delete parts\r
4263                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4264                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4265                 \r
4266                 DB::execute($query);\r
4267                 \r
4268                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4269                 self::action_adminskinoverview();\r
4270                 return;\r
4271         }\r
4272         \r
4273         /**\r
4274          * Admin::action_adminskinremovetype()\r
4275          * \r
4276          * @param       void\r
4277          * @return      void\r
4278          */\r
4279         static private function action_adminskinremovetype()\r
4280         {\r
4281                 global $member, $manager, $CONF;\r
4282 \r
4283                 $member->isAdmin() or self::disallow();\r
4284                 \r
4285                 $skinid         = intRequestVar('skinid');\r
4286                 $skintype       = requestVar('type');\r
4287                 \r
4288                 if ( !isValidShortName($skintype) )\r
4289                 {\r
4290                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4291                 }\r
4292                 \r
4293                 self::$skin->parse('adminskinremovetype');\r
4294                 return;\r
4295         }\r
4296         \r
4297         /**\r
4298          * Admin::action_adminskinremovetypeconfirm()\r
4299          * \r
4300          * @param       void\r
4301          * @return      void\r
4302          */\r
4303         static private function action_adminskinremovetypeconfirm()\r
4304         {\r
4305                 global $member, $CONF, $manager;\r
4306                 \r
4307                 $member->isAdmin() or self::disallow();\r
4308                 \r
4309                 $skinid         = intRequestVar('skinid');\r
4310                 $skintype       = requestVar('type');\r
4311                 \r
4312                 if ( !isValidShortName($skintype) )\r
4313                 {\r
4314                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4315                 }\r
4316                 \r
4317                 $data =array(\r
4318                         'skinid'        => $skinid,\r
4319                         'skintype'      => $skintype\r
4320                 );\r
4321                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4322 \r
4323                 // delete part\r
4324                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4325                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4326                 DB::execute($query);\r
4327                 \r
4328                 $data = array(\r
4329                         'skinid'        => $skinid,\r
4330                         'skintype'      => $skintype\r
4331                 );\r
4332                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4333                 \r
4334                 self::action_adminskinedit();\r
4335                 return;\r
4336         }\r
4337 \r
4338         /**\r
4339          * Admin::action_adminskinclone()\r
4340          * \r
4341          * @param       void\r
4342          * @return      void\r
4343          */\r
4344         static private function action_adminskinclone()\r
4345         {\r
4346                 global $member;\r
4347                 \r
4348                 $member->isAdmin() or self::disallow();\r
4349                 \r
4350                 $skinid = intRequestVar('skinid');\r
4351                 \r
4352                 // 1. read skin to clone\r
4353                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4354                 $name = "{$skin->getName()}_clone";\r
4355                 \r
4356                 // if a skin with that name already exists:\r
4357                 if ( Skin::exists($name) )\r
4358                 {\r
4359                         $i = 1;\r
4360                         while ( Skin::exists($name . $i) )\r
4361                         {\r
4362                                 $i++;\r
4363                         }\r
4364                         $name .= $i;\r
4365                 }\r
4366                 \r
4367                 // 2. create skin desc\r
4368                 $newid = Skin::createNew(\r
4369                         $name,\r
4370                         $skin->getDescription(),\r
4371                         $skin->getContentType(),\r
4372                         $skin->getIncludeMode(),\r
4373                         $skin->getIncludePrefix()\r
4374                 );\r
4375                 \r
4376                 // 3. clone\r
4377                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4378                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4379                 \r
4380                 $res = DB::getResult($query);\r
4381                 foreach ( $res as $row )\r
4382                 {\r
4383                         self::skinclonetype($skin, $newid, $row['stype']);\r
4384                 }\r
4385                 self::action_adminskinoverview();\r
4386                 return;\r
4387         }\r
4388         \r
4389         /**\r
4390          * Admin::adminskinclonetype()\r
4391          * \r
4392          * @param       string  $skin   an instance of Skin class\r
4393          * @param       integer $newid  ID for new skin\r
4394          * @param       string  $type   skin type\r
4395          * @return      void\r
4396          */\r
4397         static private function adminskinclonetype($skin, $newid, $type)\r
4398         {\r
4399                 $content = $skin->getContentFromDB($type);\r
4400                 \r
4401                 if ( $content )\r
4402                 {\r
4403                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4404                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4405                         DB::execute($query);\r
4406                 }\r
4407                 return;\r
4408         }\r
4409         \r
4410         /**\r
4411          * Admin::action_adminskinieoverview()\r
4412          * \r
4413          * @param       void\r
4414          * @return      void\r
4415          */\r
4416         static private function action_adminskinieoverview()\r
4417         {\r
4418                 global $member, $DIR_LIBS, $manager;\r
4419                 \r
4420                 $member->isAdmin() or self::disallow();\r
4421                 \r
4422                 // load skinie class\r
4423                 include_once($DIR_LIBS . 'skinie.php');\r
4424                 \r
4425                 self::$skin->parse('adminskinieoverview');\r
4426                 return;\r
4427         }\r
4428 \r
4429         /**\r
4430          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4431          * Admin::action_adminskinieimport()\r
4432          * \r
4433          * @param       void\r
4434          * @return      void\r
4435          */\r
4436         static private function action_adminskinieimport()\r
4437         {\r
4438                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4439                 \r
4440                 $member->isAdmin() or self::disallow();\r
4441                 \r
4442                 // load skinie class\r
4443                 include_once($DIR_LIBS . 'skinie.php');\r
4444                 \r
4445                 $skinFileRaw    = postVar('skinfile');\r
4446                 $mode                   = postVar('mode');\r
4447                 \r
4448                 $importer = new SKINIMPORT();\r
4449                 \r
4450                 // get full filename\r
4451                 if ( $mode == 'file' )\r
4452                 {\r
4453                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4454                         \r
4455                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4456                         if ( !file_exists($skinFile) )\r
4457                         {\r
4458                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4459                         }\r
4460                 }\r
4461                 else\r
4462                 {\r
4463                         $skinFile = $skinFileRaw;\r
4464                 }\r
4465                 \r
4466                 // read only metadata\r
4467                 $error = $importer->readFile($skinFile, 1);\r
4468                 if ( $error )\r
4469                 {\r
4470                         self::error($error);\r
4471                 }\r
4472                 \r
4473                 /* TODO: we should consider to use the other way instead of this */\r
4474                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4475                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4476                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4477                 \r
4478                 // clashes\r
4479                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4480                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4481                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4482                 /* TODO: we should consider to use the other way instead of this */\r
4483                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4484                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4485                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4486 \r
4487                 if ( !is_object(self::$skin) )\r
4488                 {\r
4489                         self::action_adminskiniedoimport();\r
4490                 }\r
4491                 else\r
4492                 {\r
4493                         self::$skin->parse('adminskinieimport');\r
4494                 }\r
4495                 return;\r
4496         }\r
4497         \r
4498         /**\r
4499          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4500          * Admin::action_adminskiniedoimport()\r
4501          * \r
4502          * @param       void\r
4503          * @return      void\r
4504          */\r
4505         static private function action_adminskiniedoimport()\r
4506         {\r
4507                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4508                 \r
4509                 $member->isAdmin() or self::disallow();\r
4510                 \r
4511                 // load skinie class\r
4512                 include_once($DIR_LIBS . 'skinie.php');\r
4513                 \r
4514                 $skinFileRaw    = postVar('skinfile');\r
4515                 $mode                   = postVar('mode');\r
4516                 $allowOverwrite = intPostVar('overwrite');\r
4517                 \r
4518                 // get full filename\r
4519                 if ( $mode == 'file' )\r
4520                 {\r
4521                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4522                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4523                         if ( !file_exists($skinFile) )\r
4524                         {\r
4525                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4526                         }\r
4527                 }\r
4528                 else\r
4529                 {\r
4530                         $skinFile = $skinFileRaw;\r
4531                 }\r
4532                 \r
4533                 $importer = new SKINIMPORT();\r
4534                 \r
4535                 $error = $importer->readFile($skinFile);\r
4536                 if ( $error )\r
4537                 {\r
4538                         self::error($error);\r
4539                 }\r
4540                 \r
4541                 $error = $importer->writeToDatabase($allowOverwrite);\r
4542                 if ( $error )\r
4543                 {\r
4544                         self::error($error);\r
4545                 }\r
4546                 \r
4547                 /* TODO: we should consider to use the other way instead of this */\r
4548                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4549                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4550                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4551                 \r
4552                 if ( !is_object(self::$skin) )\r
4553                 {\r
4554                         global $DIR_SKINS;\r
4555                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4556                         $query  = sprintf($query, sql_table('skin_desc'));\r
4557                         $res    = intval(DB::getValue($query));\r
4558                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4559                         $query  = sprintf($query, sql_table('config'), $res);\r
4560                         DB::execute($query);\r
4561                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');\r
4562                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4563                 }\r
4564                 else\r
4565                 {\r
4566                         self::$skin->parse('adminskiniedoimport');\r
4567                 }\r
4568                 return;\r
4569         }\r
4570 \r
4571         /**\r
4572          * Admin::action_adminskinieexport()\r
4573          * \r
4574          * @param       void\r
4575          * @return      void\r
4576          */\r
4577         static private function action_adminskinieexport()\r
4578         {\r
4579                 global $member, $DIR_PLUGINS;\r
4580                 \r
4581                 $member->isAdmin() or self::disallow();\r
4582                 \r
4583                 // load skinie class\r
4584                 $aSkins = requestIntArray('skin');\r
4585                 if (!is_array($aSkins)) {\r
4586                         $aSkins = array();\r
4587                 }\r
4588                 $skinList = array_keys($aSkins);\r
4589                 \r
4590                 $aTemplates = requestIntArray('template');\r
4591                 if (!is_array($aTemplates))\r
4592                 {\r
4593                         $aTemplates = array();\r
4594                 }\r
4595                 $templateList = array_keys($aTemplates);\r
4596                 \r
4597                 $info = postVar('info');\r
4598                 \r
4599                 include_libs('skinie.php');\r
4600                 $exporter = new SkinExport();\r
4601                 foreach ( $skinList as $skinId )\r
4602                 {\r
4603                         $exporter->addSkin($skinId);\r
4604                 }\r
4605                 foreach ( $templateList as $templateId )\r
4606                 {\r
4607                         $exporter->addTemplate($templateId);\r
4608                 }\r
4609                 $exporter->setInfo($info);\r
4610                 $exporter->export();\r
4611                 return;\r
4612         }\r
4613         \r
4614         /**\r
4615          * Admin::action_settingsedit()\r
4616          * \r
4617          * @param       Void\r
4618          * @return      Void\r
4619          */\r
4620         static private function action_settingsedit()\r
4621         {\r
4622                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4623                 \r
4624                 $member->isAdmin() or self::disallow();\r
4625                 \r
4626                 self::$skin->parse('settingsedit');\r
4627                 return;\r
4628         }\r
4629         \r
4630         /**\r
4631          * Admin::action_settingsupdate()\r
4632          * Update $CONFIG and redirect\r
4633          * \r
4634          * @param       void\r
4635          * @return      void\r
4636          */\r
4637         static private function action_settingsupdate()\r
4638         {\r
4639                 global $member, $CONF;\r
4640                 \r
4641                 $member->isAdmin() or self::disallow();\r
4642                 \r
4643                 // check if email address for admin is valid\r
4644                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4645                 {\r
4646                         self::error(_ERROR_BADMAILADDRESS);\r
4647                 }\r
4648                 \r
4649                 // save settings\r
4650                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4651                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4652                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4653                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4654                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4655                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4656                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4657                 self::updateConfig('Locale',                    postVar('Locale'));\r
4658                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4659                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4660                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4661                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4662                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4663                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4664                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4665                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4666                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4667                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4668                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4669                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4670                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4671                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4672                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4673                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4674                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4675                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4676                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4677                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4678                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4679                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4680                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4681                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4682                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4683                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4684                 \r
4685                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4686                 // note that when changing cookie settings, this redirect might cause the user\r
4687                 // to have to log in again.\r
4688                 getConfig();\r
4689                 redirect($CONF['AdminURL'] . '?action=manage');\r
4690                 return;\r
4691         }\r
4692         \r
4693         /**\r
4694          * Admin::action_systemoverview()\r
4695          * Output system overview\r
4696          * \r
4697          * @param       void\r
4698          * @return      void\r
4699          */\r
4700         static private function action_systemoverview()\r
4701         {\r
4702                 self::$skin->parse('systemoverview');\r
4703                 return;\r
4704         }\r
4705         \r
4706         /**\r
4707          * Admin::updateConfig()\r
4708          * \r
4709          * @param       string  $name   \r
4710          * @param       string  $val    \r
4711          * @return      integer return the ID in which the latest query posted\r
4712          */\r
4713         static private function updateConfig($name, $val)\r
4714         {\r
4715                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4716                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4717                 if ( DB::execute($query) === FALSE )\r
4718                 {\r
4719                         $err = DB::getError();\r
4720                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4721                 }\r
4722                 return DB::getInsertId();\r
4723         }\r
4724         \r
4725         /**\r
4726          * Admin::error()\r
4727          * Error message\r
4728          * \r
4729          * @param       string  $msg    message that will be shown\r
4730          * @return      void\r
4731          */\r
4732         static public function error($msg)\r
4733         {\r
4734                 self::$headMess = $msg;\r
4735                 self::$skin->parse('adminerrorpage');\r
4736                 return;\r
4737         }\r
4738         \r
4739         /**\r
4740          * Admin::disallow()\r
4741          * add error log and show error page \r
4742          * \r
4743          * @param       void\r
4744          * @return      void\r
4745          */\r
4746         static public function disallow()\r
4747         {\r
4748                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4749                 self::error(_ERROR_DISALLOWED);\r
4750                 return;\r
4751         }\r
4752 \r
4753         /**\r
4754          * Admin::action_PluginAdmin()\r
4755          * Output pluginadmin\r
4756          *\r
4757          * @param       string  $skinContents\r
4758          * @param       string  $extrahead\r
4759          * @return      void\r
4760          */\r
4761         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4762         {\r
4763                 self::$extrahead .= $extrahead;\r
4764                 self::$skin->parse('pluginadmin', $skinContents);\r
4765                 return;\r
4766         }\r
4767         \r
4768         /**\r
4769          * Admin::action_bookmarklet()\r
4770          * \r
4771          * @param       void\r
4772          * @return      void\r
4773          */\r
4774         static private function action_bookmarklet()\r
4775         {\r
4776                 global $member, $manager;\r
4777                 \r
4778                 $blogid = intRequestVar('blogid');\r
4779                 $member->teamRights($blogid) or self::disallow();\r
4780                 \r
4781                 self::$skin->parse('bookmarklet');\r
4782                 return;\r
4783         }\r
4784         \r
4785         /**\r
4786          * Admin::action_actionlog()\r
4787          * \r
4788          * @param       void\r
4789          * @return      void\r
4790          */\r
4791         static private function action_actionlog()\r
4792         {\r
4793                 global $member, $manager;\r
4794                 \r
4795                 $member->isAdmin() or self::disallow();\r
4796                 \r
4797                 self::$skin->parse('actionlog');\r
4798                 return;\r
4799         }\r
4800         \r
4801         /**\r
4802          * Admin::action_banlist()\r
4803          * \r
4804          * @param       void\r
4805          * @return      void\r
4806          */\r
4807         static private function action_banlist()\r
4808         {\r
4809                 global $member, $manager;\r
4810                 \r
4811                 $blogid = intRequestVar('blogid');\r
4812                 $member->blogAdminRights($blogid) or self::disallow();\r
4813                 \r
4814                 self::$skin->parse('banlist');\r
4815                 return;\r
4816         }\r
4817         \r
4818         /**\r
4819          * Admin::action_banlistdelete()\r
4820          * \r
4821          * @param       void\r
4822          * @return      void\r
4823          */\r
4824         static private function action_banlistdelete()\r
4825         {\r
4826                 global $member, $manager;\r
4827                 \r
4828                 $blogid = intRequestVar('blogid');\r
4829                 $member->blogAdminRights($blogid) or self::disallow();\r
4830                 \r
4831                 self::$skin->parse('banlistdelete');\r
4832                 return;\r
4833         }\r
4834         \r
4835         /**\r
4836          * Admin::action_banlistdeleteconfirm()\r
4837          * \r
4838          * @param       void\r
4839          * @return      void\r
4840          */\r
4841         static private function action_banlistdeleteconfirm()\r
4842         {\r
4843                 global $member, $manager;\r
4844                 \r
4845                 $blogid         = intPostVar('blogid');\r
4846                 $allblogs       = postVar('allblogs');\r
4847                 $iprange        = postVar('iprange');\r
4848                 \r
4849                 $member->blogAdminRights($blogid) or self::disallow();\r
4850                 \r
4851                 $deleted = array();\r
4852                 \r
4853                 if ( !$allblogs )\r
4854                 {\r
4855                         if ( Ban::removeBan($blogid, $iprange) )\r
4856                         {\r
4857                                 $deleted[] = $blogid;\r
4858                         }\r
4859                 }\r
4860                 else\r
4861                 {\r
4862                         // get blogs fot which member has admin rights\r
4863                         $adminblogs = $member->getAdminBlogs();\r
4864                         foreach ($adminblogs as $blogje)\r
4865                         {\r
4866                                 if ( Ban::removeBan($blogje, $iprange) )\r
4867                                 {\r
4868                                         $deleted[] = $blogje;\r
4869                                 }\r
4870                         }\r
4871                 }\r
4872                 \r
4873                 if ( sizeof($deleted) == 0 )\r
4874                 {\r
4875                         self::error(_ERROR_DELETEBAN);\r
4876                 }\r
4877                 \r
4878                 /* TODO: we should use other ways */\r
4879                 $_REQUEST['delblogs'] = $deleted;\r
4880                 \r
4881                 self::$skin->parse('banlistdeleteconfirm');\r
4882                 return;\r
4883         }\r
4884         \r
4885         /**\r
4886          * Admin::action_banlistnewfromitem()\r
4887          * \r
4888          * @param       void\r
4889          * @return      void\r
4890          */\r
4891         static private function action_banlistnewfromitem()\r
4892         {\r
4893                 global $manager;\r
4894                 \r
4895                 $itemid = intRequestVar('itemid');\r
4896                 $item =& $manager->getItem($itemid, 1, 1);\r
4897                 self::action_banlistnew($item['blogid']);\r
4898                 return;\r
4899         }\r
4900         \r
4901         /**\r
4902          * Admin::action_banlistnew()\r
4903          * \r
4904          * @param       integer $blogid ID for weblog\r
4905          * @return      void\r
4906          */\r
4907         static private function action_banlistnew($blogid = '')\r
4908         {\r
4909                 global $member, $manager;\r
4910                 \r
4911                 if ( $blogid == '' )\r
4912                 {\r
4913                         $blogid = intRequestVar('blogid');\r
4914                 }\r
4915                 \r
4916                 $ip = requestVar('ip');\r
4917                 \r
4918                 $member->blogAdminRights($blogid) or self::disallow();\r
4919                 \r
4920                 /* TODO: we should consider to use the other way instead of this */\r
4921                 $_REQUEST['blogid'] = $blogid;          \r
4922                 \r
4923                 self::$skin->parse('banlistnew');\r
4924                 \r
4925                 return;\r
4926         }\r
4927 \r
4928         /**\r
4929          * Admin::action_banlistadd()\r
4930          * \r
4931          * @param       void\r
4932          * @return      void\r
4933          */\r
4934         static private function action_banlistadd()\r
4935         {\r
4936                 global $member;\r
4937                 \r
4938                 $blogid         = intPostVar('blogid');\r
4939                 $allblogs       = postVar('allblogs');\r
4940                 $iprange        = postVar('iprange');\r
4941                 \r
4942                 if ( $iprange == "custom" )\r
4943                 {\r
4944                         $iprange = postVar('customiprange');\r
4945                 }\r
4946                 $reason   = postVar('reason');\r
4947                 \r
4948                 $member->blogAdminRights($blogid) or self::disallow();\r
4949                 \r
4950                 // TODO: check IP range validity\r
4951                 \r
4952                 if ( !$allblogs )\r
4953                 {\r
4954                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4955                         {\r
4956                                 self::error(_ERROR_ADDBAN);\r
4957                         }\r
4958                 }\r
4959                 else\r
4960                 {\r
4961                         // get blogs fot which member has admin rights\r
4962                         $adminblogs = $member->getAdminBlogs();\r
4963                         $failed = 0;\r
4964                         foreach ($adminblogs as $blogje)\r
4965                         {\r
4966                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4967                                 {\r
4968                                         $failed = 1;\r
4969                                 }\r
4970                         }\r
4971                         if ( $failed )\r
4972                         {\r
4973                                 self::error(_ERROR_ADDBAN);\r
4974                         }\r
4975                 }\r
4976                 self::action_banlist();\r
4977                 return;\r
4978         }\r
4979         \r
4980         /**\r
4981          * Admin::action_clearactionlog()\r
4982          * \r
4983          * @param       void\r
4984          * @return      void\r
4985          */\r
4986         static private function action_clearactionlog()\r
4987         {\r
4988                 global $member;\r
4989                 \r
4990                 $member->isAdmin() or self::disallow();\r
4991                 \r
4992                 ActionLog::clear();\r
4993                 \r
4994                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4995                 return;\r
4996         }\r
4997         \r
4998         /**\r
4999          * Admin::action_backupoverview()\r
5000          * \r
5001          * @param       void\r
5002          * @return      void\r
5003          */\r
5004         static private function action_backupoverview()\r
5005         {\r
5006                 global $member, $manager;\r
5007                 \r
5008                 $member->isAdmin() or self::disallow();\r
5009                 \r
5010                 self::$skin->parse('backupoverview');\r
5011                 return;\r
5012         }\r
5013 \r
5014         /**\r
5015          * Admin::action_backupcreate()\r
5016          * create file for backup\r
5017          * \r
5018          * @param               void\r
5019          * @return      void\r
5020          * \r
5021          */\r
5022         static private function action_backupcreate()\r
5023         {\r
5024                 global $member, $DIR_LIBS;\r
5025                 \r
5026                 $member->isAdmin() or self::disallow();\r
5027                 \r
5028                 // use compression ?\r
5029                 $useGzip = (integer) postVar('gzip');\r
5030                 \r
5031                 include($DIR_LIBS . 'backup.php');\r
5032                 \r
5033                 // try to extend time limit\r
5034                 // (creating/restoring dumps might take a while)\r
5035                 @set_time_limit(1200);\r
5036                 \r
5037                 Backup::do_backup($useGzip);\r
5038                 exit;\r
5039         }\r
5040         \r
5041         /**\r
5042          * Admin::action_backuprestore()\r
5043          * restoring from uploaded file\r
5044          * \r
5045          * @param               void\r
5046          * @return      void\r
5047          */\r
5048         static private function action_backuprestore()\r
5049         {\r
5050                 global $member, $DIR_LIBS;\r
5051                 \r
5052                 $member->isAdmin() or self::disallow();\r
5053                 \r
5054                 if ( intPostVar('letsgo') != 1 )\r
5055                 {\r
5056                         self::error(_ERROR_BACKUP_NOTSURE);\r
5057                 }\r
5058                 \r
5059                 include($DIR_LIBS . 'backup.php');\r
5060                 \r
5061                 // try to extend time limit\r
5062                 // (creating/restoring dumps might take a while)\r
5063                 @set_time_limit(1200);\r
5064                 \r
5065                 $message = Backup::do_restore();\r
5066                 if ( $message != '' )\r
5067                 {\r
5068                         self::error($message);\r
5069                 }\r
5070                 self::$skin->parse('backuprestore');\r
5071                 return;\r
5072         }\r
5073         \r
5074         /**\r
5075          * Admin::action_pluginlist()\r
5076          * output the list of installed plugins\r
5077          * \r
5078          * @param       void\r
5079          * @return      void\r
5080          * \r
5081          */\r
5082         static private function action_pluginlist()\r
5083         {\r
5084                 global $DIR_PLUGINS, $member, $manager;\r
5085                 \r
5086                 // check if allowed\r
5087                 $member->isAdmin() or self::disallow();\r
5088                 \r
5089                 self::$skin->parse('pluginlist');\r
5090                 return;\r
5091         }\r
5092         \r
5093         /**\r
5094          * Admin::action_pluginhelp()\r
5095          * \r
5096          * @param       void\r
5097          * @return      void\r
5098          */\r
5099         static private function action_pluginhelp()\r
5100         {\r
5101                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5102                 \r
5103                 // check if allowed\r
5104                 $member->isAdmin() or self::disallow();\r
5105                 \r
5106                 $plugid = intGetVar('plugid');\r
5107                 \r
5108                 if ( !$manager->pidInstalled($plugid) )\r
5109                 {\r
5110                         self::error(_ERROR_NOSUCHPLUGIN);\r
5111                 }\r
5112                 \r
5113                 self::$skin->parse('pluginhelp');\r
5114                 return;\r
5115         }\r
5116         \r
5117         /**\r
5118          * Admin::action_pluginadd()\r
5119          * \r
5120          * @param       Void\r
5121          * @return      Void\r
5122          * \r
5123          */\r
5124         static private function action_pluginadd()\r
5125         {\r
5126                 global $member, $manager, $DIR_PLUGINS;\r
5127                 \r
5128                 // check if allowed\r
5129                 $member->isAdmin() or self::disallow();\r
5130                 \r
5131                 $name = postVar('filename');\r
5132                 \r
5133                 if ( $manager->pluginInstalled($name) )\r
5134                 {\r
5135                         self::error(_ERROR_DUPPLUGIN);\r
5136                 }\r
5137                 \r
5138                 if ( !checkPlugin($name) )\r
5139                 {\r
5140                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5141                 }\r
5142                 \r
5143                 // get number of currently installed plugins\r
5144                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5145                 $numCurrent = $res->rowCount();\r
5146                 \r
5147                 // plugin will be added as last one in the list\r
5148                 $newOrder = $numCurrent + 1;\r
5149                 \r
5150                 $data = array('file' => &$name);\r
5151                 $manager->notify('PreAddPlugin', $data);\r
5152                 \r
5153                 // do this before calling getPlugin (in case the plugin id is used there)\r
5154                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5155                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5156                 DB::execute($query);\r
5157                 $iPid = DB::getInsertId();\r
5158                 \r
5159                 $manager->clearCachedInfo('installedPlugins');\r
5160                 \r
5161                 // Load the plugin for condition checking and instalation\r
5162                 $plugin =& $manager->getPlugin($name);\r
5163                 \r
5164                 // check if it got loaded (could have failed)\r
5165                 if ( !$plugin )\r
5166                 {\r
5167                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5168                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5169                         \r
5170                         DB::execute($query);\r
5171                         \r
5172                         $manager->clearCachedInfo('installedPlugins');\r
5173                         self::error(_ERROR_PLUGIN_LOAD);\r
5174                 }\r
5175                 \r
5176                 // check if plugin needs a newer Nucleus version\r
5177                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5178                 {\r
5179                         // uninstall plugin again...\r
5180                         self::deleteOnePlugin($plugin->getID());\r
5181                         \r
5182                         // ...and show error\r
5183                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5184                 }\r
5185                 \r
5186                 // check if plugin needs a newer Nucleus version\r
5187                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5188                 {\r
5189                         // uninstall plugin again...\r
5190                         self::deleteOnePlugin($plugin->getID());\r
5191                         \r
5192                         // ...and show error\r
5193                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5194                 }\r
5195                 \r
5196                 $pluginList = $plugin->getPluginDep();\r
5197                 foreach ( $pluginList as $pluginName )\r
5198                 {\r
5199                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5200                         if ($res->rowCount() == 0)\r
5201                         {\r
5202                                 // uninstall plugin again...\r
5203                                 self::deleteOnePlugin($plugin->getID());\r
5204                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5205                         }\r
5206                 }\r
5207                 \r
5208                 // call the install method of the plugin\r
5209                 $plugin->install();\r
5210                 \r
5211                 $data = array('plugin' => &$plugin);\r
5212                 $manager->notify('PostAddPlugin', $data);\r
5213                 \r
5214                 // update all events\r
5215                 self::action_pluginupdate();\r
5216                 return;\r
5217         }\r
5218         \r
5219         /**\r
5220          * ADMIN:action_pluginupdate():\r
5221          * \r
5222          * @param       Void\r
5223          * @return      Void\r
5224          * \r
5225          */\r
5226         static private function action_pluginupdate()\r
5227         {\r
5228                 global $member, $manager, $CONF;\r
5229                 \r
5230                 // check if allowed\r
5231                 $member->isAdmin() or self::disallow();\r
5232                 \r
5233                 // delete everything from plugin_events\r
5234                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5235                 \r
5236                 // loop over all installed plugins\r
5237                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5238                 foreach ( $res as $row )\r
5239                 {\r
5240                         $pid  =  $row['pid'];\r
5241                         $plug =& $manager->getPlugin($row['pfile']);\r
5242                         if ( $plug )\r
5243                         {\r
5244                                 $eventList = $plug->getEventList();\r
5245                                 foreach ( $eventList as $eventName )\r
5246                                 {\r
5247                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5248                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5249                                         DB::execute($query);\r
5250                                 }\r
5251                         }\r
5252                 }\r
5253                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5254                 return;\r
5255         }\r
5256         \r
5257         /**\r
5258          * Admin::action_plugindelete()\r
5259          * \r
5260          * @param       void\r
5261          * @return      void\r
5262          */\r
5263         static private function action_plugindelete()\r
5264         {\r
5265                 global $member, $manager;\r
5266                 \r
5267                 // check if allowed\r
5268                 $member->isAdmin() or self::disallow();\r
5269                 \r
5270                 $pid = intGetVar('plugid');\r
5271                 \r
5272                 if ( !$manager->pidInstalled($pid) )\r
5273                 {\r
5274                         self::error(_ERROR_NOSUCHPLUGIN);\r
5275                 }\r
5276                 \r
5277                 self::$skin->parse('plugindelete');\r
5278                 return;\r
5279         }\r
5280 \r
5281         /**\r
5282          * Admin::action_plugindeleteconfirm()\r
5283          * \r
5284          * @param       void\r
5285          * @return      void\r
5286          */\r
5287         static private function action_plugindeleteconfirm()\r
5288         {\r
5289                 global $member, $manager, $CONF;\r
5290                 \r
5291                 // check if allowed\r
5292                 $member->isAdmin() or self::disallow();\r
5293                 \r
5294                 $pid = intPostVar('plugid');\r
5295                 \r
5296                 $error = self::deleteOnePlugin($pid, 1);\r
5297                 if ( $error )\r
5298                 {\r
5299                         self::error($error);\r
5300                 }\r
5301                 \r
5302                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5303                 return;\r
5304         }\r
5305         \r
5306         /**\r
5307          * Admin::\r
5308          * \r
5309          * @param       void\r
5310          * @return      void\r
5311          */\r
5312         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5313         {\r
5314                 global $manager;\r
5315                 \r
5316                 $pid = intval($pid);\r
5317                 \r
5318                 if ( !$manager->pidInstalled($pid) )\r
5319                 {\r
5320                         return _ERROR_NOSUCHPLUGIN;\r
5321                 }\r
5322                 \r
5323                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5324                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5325                 $name = DB::getValue($query);\r
5326                 \r
5327                 // check dependency before delete\r
5328                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5329                 foreach ( $res as $row )\r
5330                 {\r
5331                         $plug =& $manager->getPlugin($row['pfile']);\r
5332                         if ( $plug )\r
5333                         {\r
5334                                 $depList = $plug->getPluginDep();\r
5335                                 foreach ( $depList as $depName )\r
5336                                 {\r
5337                                         if ( $name == $depName )\r
5338                                         {\r
5339                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5340                                         }\r
5341                                 }\r
5342                         }\r
5343                 }\r
5344                 \r
5345                 $data = array('plugid' => $pid);\r
5346                 $manager->notify('PreDeletePlugin', $data);\r
5347                 \r
5348                 // call the unInstall method of the plugin\r
5349                 if ( $callUninstall )\r
5350                 {\r
5351                         $plugin =& $manager->getPlugin($name);\r
5352                         if ( $plugin )\r
5353                         {\r
5354                                 $plugin->unInstall();\r
5355                         }\r
5356                 }\r
5357                 \r
5358                 // delete all subscriptions\r
5359                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5360                 \r
5361                 // delete all options\r
5362                 // get OIDs from plugin_option_desc\r
5363                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5364                 $aOIDs = array();\r
5365                 foreach ( $res as $row )\r
5366                 {\r
5367                         array_push($aOIDs, $row['oid']);\r
5368                 }\r
5369                 \r
5370                 // delete from plugin_option and plugin_option_desc\r
5371                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5372                 if (count($aOIDs) > 0)\r
5373                 {\r
5374                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5375                 }\r
5376                 \r
5377                 // update order numbers\r
5378                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5379                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5380                 \r
5381                 // delete row\r
5382                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5383                 \r
5384                 $manager->clearCachedInfo('installedPlugins');\r
5385                 $data = array('plugid' => $pid);\r
5386                 $manager->notify('PostDeletePlugin', $data);\r
5387                 \r
5388                 return '';\r
5389         }\r
5390         \r
5391         /**\r
5392          * Admin::action_pluginup()\r
5393          * \r
5394          * @param       void\r
5395          * @return      void\r
5396          */\r
5397         static private function action_pluginup()\r
5398         {\r
5399                 global $member, $manager, $CONF;\r
5400                 \r
5401                 // check if allowed\r
5402                 $member->isAdmin() or self::disallow();\r
5403                 \r
5404                 $plugid = intGetVar('plugid');\r
5405                 \r
5406                 if ( !$manager->pidInstalled($plugid) )\r
5407                 {\r
5408                         self::error(_ERROR_NOSUCHPLUGIN);\r
5409                 }\r
5410                 \r
5411                 // 1. get old order number\r
5412                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5413                 \r
5414                 // 2. calculate new order number\r
5415                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5416                 \r
5417                 // 3. update plug numbers\r
5418                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5419                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5420                 \r
5421                 //self::action_pluginlist();\r
5422                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5423                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5424                 return;\r
5425         }\r
5426         \r
5427         /**\r
5428          * Admin::action_plugindown()\r
5429          * \r
5430          * @param       void\r
5431          * @return      void\r
5432          */\r
5433         static private function action_plugindown()\r
5434         {\r
5435                 global $member, $manager, $CONF;\r
5436                 \r
5437                 // check if allowed\r
5438                 $member->isAdmin() or self::disallow();\r
5439                 \r
5440                 $plugid = intGetVar('plugid');\r
5441                 if ( !$manager->pidInstalled($plugid) )\r
5442                 {\r
5443                         self::error(_ERROR_NOSUCHPLUGIN);\r
5444                 }\r
5445                 \r
5446                 // 1. get old order number\r
5447                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5448                 \r
5449                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5450                 $maxOrder = $res->rowCount();\r
5451                 \r
5452                 // 2. calculate new order number\r
5453                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5454                 \r
5455                 // 3. update plug numbers\r
5456                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5457                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5458                 \r
5459                 //self::action_pluginlist();\r
5460                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5461                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5462                 return;\r
5463         }\r
5464         \r
5465         /**\r
5466          * Admin::action_pluginoptions()\r
5467          * \r
5468          * Output Plugin option page\r
5469          * \r
5470          * @access      public\r
5471          * @param       string $message message when fallbacked\r
5472          * @return      void\r
5473          * \r
5474          */\r
5475         static private function action_pluginoptions($message = '')\r
5476         {\r
5477                 global $member, $manager;\r
5478                 \r
5479                 // check if allowed\r
5480                 $member->isAdmin() or self::disallow();\r
5481                 \r
5482                 $pid = intRequestVar('plugid');\r
5483                 if ( !$manager->pidInstalled($pid) )\r
5484                 {\r
5485                         self::error(_ERROR_NOSUCHPLUGIN);\r
5486                 }\r
5487                 \r
5488                 if ( isset($message) )\r
5489                 {\r
5490                         self::$headMess = $message;\r
5491                 }\r
5492                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5493                 $plugin         = $manager->getPlugin($plugname);\r
5494                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5495                 \r
5496                 self::$skin->parse('pluginoptions');\r
5497                 return;\r
5498         }\r
5499         \r
5500         /**\r
5501          * Admin::action_pluginoptionsupdate()\r
5502          * \r
5503          * Update plugin options and fallback to plugin option page\r
5504          * \r
5505          * @access      public\r
5506          * @param       void\r
5507          * @return      void\r
5508          */\r
5509         static private function action_pluginoptionsupdate()\r
5510         {\r
5511                 global $member, $manager;\r
5512                 \r
5513                 // check if allowed\r
5514                 $member->isAdmin() or self::disallow();\r
5515                 \r
5516                 $pid = intRequestVar('plugid');\r
5517                 \r
5518                 if ( !$manager->pidInstalled($pid) )\r
5519                 {\r
5520                         self::error(_ERROR_NOSUCHPLUGIN);\r
5521                 }\r
5522                 \r
5523                 $aOptions = requestArray('plugoption');\r
5524                 NucleusPlugin::apply_plugin_options($aOptions);\r
5525                 \r
5526                 $data = array(\r
5527                         'context'       => 'global',\r
5528                         'plugid'        => $pid\r
5529                 );\r
5530                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5531                 \r
5532                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5533                 return;\r
5534         }\r
5535         \r
5536         /**\r
5537          * Admin::action_parseSpecialskin()\r
5538          * \r
5539          * @param       void\r
5540          * @return      void\r
5541          */\r
5542         static private function action_parseSpecialskin()\r
5543         {\r
5544                 self::$skin->parse(self::$action);\r
5545                 return;\r
5546         }\r
5547         \r
5548         /**\r
5549          * Admin::getAdminskinIDFromName()\r
5550          * \r
5551          * @param       string  $skinname       name of skin\r
5552          * @return      integer ID for skin\r
5553          */\r
5554         static private function getAdminskinIDFromName($skinname)\r
5555         {\r
5556                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5557                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5558                 $admnSknID      = DB::getValue($query);\r
5559                 return (integer) $adminSkinID;\r
5560         }\r
5561         \r
5562         /**\r
5563          * Admin::getAdminskinNameFromID()\r
5564          * \r
5565          * @param       integer $skinid ID for skin\r
5566          * @return      integer ID for skin\r
5567          */\r
5568         static private function getAdminskinNameFromID($skinid)\r
5569         {\r
5570                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5571                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5572                 $admnSknID      = DB::getValue($query);\r
5573                 return (integer) $adminSkinID;\r
5574         }\r
5575         \r
5576         /**\r
5577          * Admin::getAdminextrahead()\r
5578          */\r
5579         static public function getAdminextrahead()\r
5580         {\r
5581                 return self::$extrahead;\r
5582         }\r
5583         \r
5584         /**\r
5585          * Admin::getAdminpassvar()\r
5586          */\r
5587         static public function getAdminpassvar()\r
5588         {\r
5589                 return self::$passvar;\r
5590         }\r
5591         \r
5592         /**\r
5593          * Admin::getAdminAction()\r
5594          */\r
5595         static public function getAdminAction()\r
5596         {\r
5597                 return self::$action;\r
5598         }\r
5599         \r
5600         /**\r
5601          * Admin::getAdminaOption()\r
5602          */\r
5603         static public function getAdminaOption()\r
5604         {\r
5605                 return self::$aOptions;\r
5606         }\r
5607         \r
5608         /**\r
5609          * Admin::action_importAdmin()\r
5610          * \r
5611          * @param       void\r
5612          * @return      void\r
5613          */\r
5614         static private function action_importAdmin()\r
5615         {\r
5616                 global $DIR_ADMINSKINS, $action;\r
5617                 if ( $action == 'adminskinieimport' )\r
5618                 {\r
5619                         self::doAdminskinimport();\r
5620                 }\r
5621                 $skn = array();\r
5622                 if ( $action == 'showlogin' )\r
5623                 {\r
5624                         $skinName = 'showlogin';\r
5625                         $actnName = 'showlogin';\r
5626                 }\r
5627                 else\r
5628                 {\r
5629                         $skinName = 'defaultimporter';\r
5630                         $actnName = 'importAdmin';\r
5631                 }\r
5632                 \r
5633                 /* TODO: why??? */\r
5634                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5635                 $skn['id']                              = 0;\r
5636                 $skn['description']             = $skinName;\r
5637                 $skn['contentType']             = 'importAdmin';\r
5638                 $skn['includeMode']             = 'normal';\r
5639                 $skn['includePrefix']   = '';\r
5640                 $skn['name']                    = 'defaultinporter';\r
5641                 \r
5642                 self::$skin                             = (object) $skn;\r
5643                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5644                 \r
5645                 $parser = new PARSER($handler);\r
5646                 $parser->setSkin(self::$skin);\r
5647                 $parser->parse($contents);\r
5648                 \r
5649                 return;\r
5650         }\r
5651         \r
5652         /**\r
5653          * Admin::doAdminskinimport()\r
5654          * \r
5655          * @param       void\r
5656          * @return      void\r
5657          */\r
5658         static private function doAdminskinimport()\r
5659         {\r
5660                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5661                 \r
5662                 $member->isAdmin() or self::disallow();\r
5663                 \r
5664                 include_once($DIR_LIBS . 'Skinie.php');\r
5665                 $skinFileRaw    = postVar('skinfile');\r
5666                 $mode                   = postVar('mode');\r
5667                 $allowOverwrite = intPostVar('overwrite');\r
5668                 \r
5669                 if ( $mode == 'file' )\r
5670                 {\r
5671                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5672                 }\r
5673                 else\r
5674                 {\r
5675                         $skinFile = $skinFileRaw;\r
5676                 }\r
5677                 \r
5678                 $importer       = new SKINIMPORT();\r
5679                 $error          = $importer->readFile($skinFile);\r
5680                 if ( $error )\r
5681                 {\r
5682                         self::error($error);\r
5683                 }\r
5684                 $error = $importer->writeToDatabase($allowOverwrite);\r
5685                 if ( $error )\r
5686                 {\r
5687                         self::error($error);\r
5688                 }\r
5689                 \r
5690                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5691                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5692                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5693                 \r
5694                 header('Location: ' . $CONF['AdminURL']);\r
5695                 exit;\r
5696         }\r
5697 }\r