nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static public $headMess;\r
  31         \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $extrahead;\r
  35         static private $passvar;\r
  36         static private $aOptions;\r
  37         \r
  38         /**\r
  39          * Admin::$edit_actions\r
  40          */\r
  41         static private $edit_actions = array(\r
  42                 'adminskinoverview',\r
  43                 'adminskinieoverview',\r
  44                 'adminskinedittype',\r
  45                 'adminskinremovetype',\r
  46                 'adminskindelete',\r
  47                 'adminskinedit',\r
  48                 'adminskinieimport',\r
  49                 'adminskiniedoimport',\r
  50                 'admintemplateedit',\r
  51                 'admintemplateoverview',\r
  52                 'admintemplatedelete'\r
  53         );\r
  54         \r
  55         /**\r
  56          * Admin::$skinless_actions\r
  57          */\r
  58         static private $skinless_actions = array(\r
  59                 'plugindeleteconfirm',\r
  60                 'pluginoptionsupdate',\r
  61                 'skinremovetypeconfirm',\r
  62                 'skinclone',\r
  63                 'skindeleteconfirm',\r
  64                 'skinnew',\r
  65                 'skineditgeneral',\r
  66                 'skinieexport',\r
  67                 'skinupdate',\r
  68                 'templateupdate',\r
  69                 'templatedeleteconfirm',\r
  70                 'templatenew',\r
  71                 'templateclone',\r
  72                 'adminskinremovetypeconfirm',\r
  73                 'adminskinclone',\r
  74                 'adminskindeleteconfirm',\r
  75                 'adminskinnew',\r
  76                 'adminskineditgeneral',\r
  77                 'adminskinieexport',\r
  78                 'adminskinupdate',\r
  79                 'admintemplateupdate',\r
  80                 'admintemplatedeleteconfirm',\r
  81                 'admintemplatenew',\r
  82                 'admintemplateclone',\r
  83                 'blogsettingsupdate',\r
  84                 'settingsupdate',\r
  85                 'addnewlog2',\r
  86                 'additem',\r
  87                 'itemdeleteconfirm',\r
  88                 'itemupdate',\r
  89                 'changemembersettings',\r
  90                 'clearactionlog',\r
  91                 'memberedit'\r
  92         );\r
  93         \r
  94         static private $actions_needless_to_check = array(\r
  95                 'showlogin',\r
  96                 'login',\r
  97                 'overview',\r
  98                 'itemlist',\r
  99                 'blogcommentlist',\r
 100                 'bookmarklet',\r
 101                 'blogsettings',\r
 102                 'banlist',\r
 103                 'deleteblog',\r
 104                 'editmembersettings',\r
 105                 'browseownitems',\r
 106                 'browseowncomments',\r
 107                 'createitem',\r
 108                 'itemedit',\r
 109                 'itemmove',\r
 110                 'categoryedit',\r
 111                 'categorydelete',\r
 112                 'manage',\r
 113                 'actionlog',\r
 114                 'settingsedit',\r
 115                 'backupoverview',\r
 116                 'pluginlist',\r
 117                 'createnewlog',\r
 118                 'usermanagement',\r
 119                 'skinoverview',\r
 120                 'templateoverview',\r
 121                 'skinieoverview',\r
 122                 'itemcommentlist',\r
 123                 'commentedit',\r
 124                 'commentdelete',\r
 125                 'banlistnewfromitem',\r
 126                 'banlistdelete',\r
 127                 'itemdelete',\r
 128                 'manageteam',\r
 129                 'teamdelete',\r
 130                 'banlistnew',\r
 131                 'memberedit',\r
 132                 'memberdelete',\r
 133                 'pluginhelp',\r
 134                 'pluginoptions',\r
 135                 'plugindelete',\r
 136                 'skinedittype',\r
 137                 'skinremovetype',\r
 138                 'skindelete',\r
 139                 'skinedit',\r
 140                 'templateedit',\r
 141                 'templatedelete',\r
 142                 'activate',\r
 143                 'systemoverview',\r
 144                 'activatesetpwd',\r
 145         );\r
 146         \r
 147         static public function initialize()\r
 148         {\r
 149                 global $CONF, $DIR_LIBS;\r
 150                 \r
 151                 /* NOTE: 1. decide which skinid to use */\r
 152                 $skinid = $CONF['DefaultAdminSkin'];\r
 153                 /*\r
 154                  * NOTE: this is temporary escaped because not implemented yet\r
 155                 if (isset($member) && $member->isLoggedIn())\r
 156                 {\r
 157                         $memskin = $member->getAdminSkin();\r
 158                         if ( $memskin )\r
 159                         {\r
 160                                 $skinid = $memskin;\r
 161                         }\r
 162                 }\r
 163                 */\r
 164                 \r
 165                 /* NOTE: 2. make an instance of skin object */\r
 166                 if ( !Skin::existsID($skinid) )\r
 167                 {\r
 168                         return FALSE;\r
 169                 }\r
 170                 \r
 171                 /* NOTE: 3. initializing each members */\r
 172                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 173                 self::$action           = '';\r
 174                 self::$extrahead        = '';\r
 175                 self::$passvar          = '';\r
 176                 self::$headMess         = '';\r
 177                 self::$aOptions         = '';\r
 178                 return TRUE;\r
 179         }\r
 180         \r
 181         /**\r
 182          * Admin::action()\r
 183          * Executes an action\r
 184          *\r
 185          * @param       string  $action action to be performed\r
 186          * @return      void\r
 187          */\r
 188         static public function action($action)\r
 189         {\r
 190                 global $CONF, $DIR_LIBS, $manager, $member;\r
 191                 \r
 192                 /* 1. decide action name */\r
 193                 $customAction = postvar('customaction');\r
 194                 if ( !empty($customAction) )\r
 195                 {\r
 196                         $alias = array(\r
 197                                 'login' => $customAction,\r
 198                                 ''              => $customAction\r
 199                         );\r
 200                 }\r
 201                 else\r
 202                 {\r
 203                         $alias = array(\r
 204                                 'login' => 'overview',\r
 205                                 ''              => 'overview'\r
 206                         );\r
 207                 }\r
 208                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 209                 {\r
 210                         $action = $alias[$action];\r
 211                 }\r
 212                 $methodName = "action_{$action}";\r
 213                 self::$action = strtolower($action);\r
 214                 \r
 215                 /* 2. check the action */\r
 216                 $synonimActions = array(\r
 217                         'banlistnewfromitem',\r
 218                         'memberedit',\r
 219                         'login',\r
 220                 );\r
 221                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 222                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 223                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 224                 {\r
 225                         if (!$manager->checkTicket())\r
 226                         {\r
 227                                 self::error(_ERROR_BADTICKET);\r
 228                         }\r
 229                 }\r
 230 \r
 231                 /* 3. parse according to the action */\r
 232                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 233                 {\r
 234                         /* TODO: what is this?\r
 235                         self::action_parseSpecialskin();\r
 236                         */\r
 237                 }\r
 238                 elseif ( method_exists('Admin', $methodName) )\r
 239                 {\r
 240                         call_user_func(array(__CLASS__, $methodName));\r
 241                 }\r
 242                 else if ( self::existsSkinContents('adminerrorpage') )\r
 243                 {\r
 244                         self::error(_BADACTION . ENTITY::hsc($action));\r
 245                 }\r
 246                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 247                 {\r
 248                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 249                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 250                         {\r
 251                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 252                         }\r
 253                 }\r
 254                 else\r
 255                 {\r
 256                         self::error(_BADACTION . ENTITY::hsc($action));\r
 257                 }\r
 258                 exit;\r
 259         }\r
 260         \r
 261         /**\r
 262          * Action::existsSkinContents()\r
 263          * Check skin contents\r
 264          *\r
 265          * @param       string  $action action type\r
 266          * @return      boolean\r
 267          */\r
 268         static private function existsSkinContents($action)\r
 269         {\r
 270                 $in_array  = in_array($action, self::$skinless_actions);\r
 271                 \r
 272                 if ( $in_array )\r
 273                 {\r
 274                         return $in_array;\r
 275                 }\r
 276                 else\r
 277                 {\r
 278                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 279                         /* TODO: skinid should be a default */\r
 280                         if ( !is_object(self::$skin) )\r
 281                         {\r
 282                                 global $CONF;\r
 283                                 return quickQuery(sprintf($query, sql_table('skin'), $CONF['DefaultAdminSkin'], sql_real_escape_string($action)));\r
 284                         }\r
 285                         else\r
 286                         {\r
 287                                 return quickQuery(sprintf($query, sql_table('skin'), self::$skin->getID(), sql_real_escape_string($action)));\r
 288                         }\r
 289                 }\r
 290                 return;\r
 291         }\r
 292         \r
 293         /**\r
 294          * Action::specialActionsAllow()\r
 295          * Check exists specialskinparts\r
 296          *\r
 297          * @param       string  $action action type\r
 298          * @return boolean\r
 299          */\r
 300         static private function specialActionsAllow($action)\r
 301         {\r
 302                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 303                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 304                 return quickQuery($query);\r
 305         }\r
 306         \r
 307         /**\r
 308          * Action::action_showlogin()\r
 309          * \r
 310          * @param       void\r
 311          * @return      void\r
 312          */\r
 313         static private function action_showlogin()\r
 314         {\r
 315                 global $error;\r
 316                 self::action_login($error);\r
 317                 return;\r
 318         }\r
 319         \r
 320         /**\r
 321          * Action::action_login()\r
 322          * \r
 323          * @param       string  $msg            message for pageheader\r
 324          * @param       integer $passvars       ???\r
 325          */\r
 326         static private function action_login($msg = '', $passvars = 1)\r
 327         {\r
 328                 global $member;\r
 329                 \r
 330                 // skip to overview when allowed\r
 331                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 332                 {\r
 333                         self::action_overview();\r
 334                         exit;\r
 335                 }\r
 336                 \r
 337                 /* TODO: needless variable??? */\r
 338                 self::$passvar = $passvars;\r
 339                 if ( $msg )\r
 340                 {\r
 341                         self::$headMess = $msg;\r
 342                 }\r
 343                 \r
 344                 self::pagehead();\r
 345                 self::$skin->parse('showlogin');\r
 346                 self::pagefoot();\r
 347         }\r
 348         \r
 349         /**\r
 350          * Action::action_overview()\r
 351          * provides a screen with the overview of the actions available\r
 352          * \r
 353          * @param       string  $msg    message for pageheader\r
 354          * @return      void\r
 355          */\r
 356         static private function action_overview($msg = '')\r
 357         {\r
 358                 if ( $msg )\r
 359                 {\r
 360                         self::$headMess = $msg;\r
 361                 }\r
 362                 \r
 363                 self::pagehead();\r
 364                 self::$skin->parse('overview');\r
 365                 self::pagefoot();\r
 366                 return;\r
 367         }\r
 368         \r
 369         /**\r
 370          * Admin::action_manage()\r
 371          * \r
 372          * @param       string  $msg    message for pageheader\r
 373          * @retrn       void\r
 374          */\r
 375         static private function action_manage($msg = '')\r
 376         {\r
 377                 global $member;\r
 378                 \r
 379                 if ( $msg )\r
 380                 {\r
 381                         self::$headMess = $msg;\r
 382                 }\r
 383                 $member->isAdmin() or self::disallow();\r
 384                 \r
 385                 self::pagehead();\r
 386                 self::$skin->parse('manage');\r
 387                 self::pagefoot();\r
 388                 return;\r
 389         }\r
 390         \r
 391         /**\r
 392          * Action::action_itemlist()\r
 393          * \r
 394          * @param       integer id for weblod\r
 395          * @return      void\r
 396          */\r
 397         static private function action_itemlist($blogid = '')\r
 398         {\r
 399                 global $member, $manager, $CONF;\r
 400                 \r
 401                 if ( $blogid == '' )\r
 402                 {\r
 403                         $blogid = intRequestVar('blogid');\r
 404                 }\r
 405                 \r
 406                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 407                 \r
 408                 self::pagehead();\r
 409                 self::$skin->parse('itemlist');\r
 410                 self::pagefoot();\r
 411                 return;\r
 412         }\r
 413         \r
 414         /**\r
 415          * Action::action_batchitem()\r
 416          * \r
 417          * @param       void\r
 418          * @return      void\r
 419          */\r
 420         static private function action_batchitem()\r
 421         {\r
 422                 global $member, $manager;\r
 423                 \r
 424                 $member->isLoggedIn() or self::disallow();\r
 425                 \r
 426                 $selected       = requestIntArray('batch');\r
 427                 $action         = requestVar('batchaction');\r
 428                 \r
 429                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 430                 {\r
 431                         self::error(_BATCH_NOSELECTION);\r
 432                 }\r
 433                 \r
 434                 // On move: when no destination blog/category chosen, show choice now\r
 435                 $destCatid = intRequestVar('destcatid');\r
 436                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 437                 {\r
 438                         self::batchMoveSelectDestination('item', $selected);\r
 439                 }\r
 440                 \r
 441                 // On delete: check if confirmation has been given\r
 442                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 443                 {\r
 444                         self::batchAskDeleteConfirmation('item', $selected);\r
 445                 }\r
 446                 \r
 447                 self::pagehead();\r
 448                 self::$skin->parse('batchitem');\r
 449                 self::pagefoot();\r
 450                 return;\r
 451         }\r
 452         \r
 453         /**\r
 454          * Action::action_batchcomment()\r
 455          * \r
 456          * @param       void\r
 457          * @return      void\r
 458          */\r
 459         static private function action_batchcomment()\r
 460         {\r
 461                 global $member;\r
 462                 \r
 463                 $member->isLoggedIn() or self::disallow();\r
 464                 \r
 465                 $selected       = requestIntArray('batch');\r
 466                 $action         = requestVar('batchaction');\r
 467                 \r
 468                 // Show error when no items were selected\r
 469                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 470                 {\r
 471                         self::error(_BATCH_NOSELECTION);\r
 472                 }\r
 473                 \r
 474                 // On delete: check if confirmation has been given\r
 475                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 476                 {\r
 477                         self::batchAskDeleteConfirmation('comment',$selected);\r
 478                 }\r
 479                 \r
 480                 self::pagehead();\r
 481                 self::$skin->parse('batchcomment');\r
 482                 self::pagefoot();\r
 483                 return;\r
 484         }\r
 485         \r
 486         /**\r
 487          * Admin::setAdminAction()\r
 488          *\r
 489          * @param       string  $action\r
 490          * @return      void\r
 491          */\r
 492         static public function setAdminAction($action)\r
 493         {\r
 494                 self::$action = $action;\r
 495                 return;\r
 496         }\r
 497         \r
 498         /**\r
 499          * Admin::action_batchmember()\r
 500          * \r
 501          * @param       void\r
 502          * @return      void\r
 503          */\r
 504         static private function action_batchmember()\r
 505         {\r
 506                 global $member;\r
 507                 \r
 508                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 509                 \r
 510                 $selected       = requestIntArray('batch');\r
 511                 $action         = requestVar('batchaction');\r
 512                 \r
 513                 // Show error when no members selected\r
 514                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 515                 {\r
 516                         self::error(_BATCH_NOSELECTION);\r
 517                 }\r
 518                 \r
 519                 // On delete: check if confirmation has been given\r
 520                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 521                 {\r
 522                         self::batchAskDeleteConfirmation('member',$selected);\r
 523                 }\r
 524                 \r
 525                 self::pagehead();\r
 526                 self::$skin->parse('batchmember');\r
 527                 self::pagefoot();\r
 528                 return;\r
 529         }\r
 530         \r
 531         /**\r
 532          * Admin::action_batchteam()\r
 533          * \r
 534          * @param       void\r
 535          * @return      void\r
 536          */\r
 537         static private function action_batchteam()\r
 538         {\r
 539                 global $member;\r
 540                 \r
 541                 $blogid = intRequestVar('blogid');\r
 542                 \r
 543                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 544                 \r
 545                 $selected       = requestIntArray('batch');\r
 546                 $action         = requestVar('batchaction');\r
 547                 \r
 548                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 549                 {\r
 550                         self::error(_BATCH_NOSELECTION);\r
 551                 }\r
 552                 \r
 553                 // On delete: check if confirmation has been given\r
 554                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 555                 {\r
 556                         self::batchAskDeleteConfirmation('team',$selected);\r
 557                 }\r
 558                 \r
 559                 self::pagehead();\r
 560                 self::$skin->parse('batchteam');\r
 561                 self::pagefoot();\r
 562                 return;\r
 563         }\r
 564         \r
 565         /**\r
 566          * Admin::action_batchcategory()\r
 567          * \r
 568          * @param       void\r
 569          * @return      void\r
 570          */\r
 571         static private function action_batchcategory()\r
 572         {\r
 573                 global $member, $manager;\r
 574                 \r
 575                 $member->isLoggedIn() or self::disallow();\r
 576                 \r
 577                 $selected       = requestIntArray('batch');\r
 578                 $action         = requestVar('batchaction');\r
 579                 \r
 580                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 581                 {\r
 582                         self::error(_BATCH_NOSELECTION);\r
 583                 }\r
 584                 \r
 585                 // On move: when no destination blog chosen, show choice now\r
 586                 $destBlogId = intRequestVar('destblogid');\r
 587                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 588                 {\r
 589                         self::batchMoveCategorySelectDestination('category', $selected);\r
 590                 }\r
 591                 \r
 592                 // On delete: check if confirmation has been given\r
 593                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 594                 {\r
 595                         self::batchAskDeleteConfirmation('category', $selected);\r
 596                 }\r
 597                 \r
 598                 self::pagehead();\r
 599                 self::$skin->parse('batchcategory');\r
 600                 self::pagefoot();\r
 601                 return;\r
 602         }\r
 603         \r
 604         /**\r
 605          * Admin::batchMoveSelectDestination()\r
 606          * \r
 607          * @param       string  $type   type of batch action\r
 608          * @param       integer $ids    needless???\r
 609          * @return      void\r
 610          * \r
 611          * TODO: remove needless argument\r
 612          */\r
 613         static private function batchMoveSelectDestination($type, $ids)\r
 614         {\r
 615                 $_POST['batchmove'] = $type;\r
 616                 self::pagehead();\r
 617                 self::$skin->parse('batchmove');\r
 618                 self::pagefoot();\r
 619                 return;\r
 620         }\r
 621         \r
 622         /**\r
 623          * Admin::batchMoveCategorySelectDestination()\r
 624          * \r
 625          * @param       string  $type   type of batch action\r
 626          * @param       integer $ids    needless???\r
 627          * @return      void\r
 628          * \r
 629          * TODO: remove needless argument\r
 630          */\r
 631         static private function batchMoveCategorySelectDestination($type, $ids)\r
 632         {\r
 633                 $_POST['batchmove'] = $type;\r
 634                 global $manager;\r
 635                 self::pagehead();\r
 636                 self::$skin->parse('batchmovecat');\r
 637                 self::pagefoot();\r
 638                 return;\r
 639         }\r
 640         \r
 641         /**\r
 642          * Admin::batchAskDeleteConfirmation()\r
 643          * \r
 644          * @param       string  $type   type of batch action\r
 645          * @param       integer $ids    needless???\r
 646          * @return      void\r
 647          * \r
 648          * TODO: remove needless argument\r
 649          */\r
 650         static private function batchAskDeleteConfirmation($type, $ids)\r
 651         {\r
 652                 self::pagehead();\r
 653                 self::$skin->parse('batchdelete');\r
 654                 self::pagefoot();\r
 655                 return;\r
 656         }\r
 657         \r
 658         /**\r
 659          * Admin::selectBlogCategory()\r
 660          * Inserts a HTML select element with choices for all categories to which the current\r
 661          * member has access\r
 662          *\r
 663          * @see function selectBlog\r
 664          * @param       string  $name                           name of weblod\r
 665          * @param       integer $selected                       \r
 666          * @param       integer $tabindex                       \r
 667          * @param       integer $showNewCat                     \r
 668          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 669          * @return      void\r
 670          *\r
 671          * NOTE: callback from AdminAction\r
 672          */\r
 673         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 674         {\r
 675                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 676                 return;\r
 677         }\r
 678         \r
 679         /**\r
 680          * Admin::selectBlog()\r
 681          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 682          *      mode = 'blog' => shows blognames and values are blogids\r
 683          *      mode = 'category' => show category names and values are catids\r
 684          *\r
 685          * @param       string  $name                           name of weblod\r
 686          * @param       string  $mode                           \r
 687          * @param       integer $selected                       \r
 688          * @param       integer $tabindex                       \r
 689          * @param       integer $showNewCat                     \r
 690          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 691          * @param $iForcedBlogInclude\r
 692          *      ID of a blog that always needs to be included, without checking if the\r
 693          *      member is on the blog team (-1 = none)\r
 694          * @return      void\r
 695          */\r
 696         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 697         {\r
 698                 global $member, $CONF;\r
 699                 \r
 700                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 701                 $aBlogIds = array();\r
 702                 if ( $iForcedBlogInclude != -1 )\r
 703                 {\r
 704                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 705                 }\r
 706                 \r
 707                 if ( $member->isAdmin() && array_key_exists('ShowAllBlogs', $CONF) && $CONF['ShowAllBlogs'] )\r
 708                 {\r
 709                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 710                         $query = sprintf($query, sql_table('blog'));\r
 711                 }\r
 712                 else\r
 713                 {\r
 714                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 715                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 716                 }\r
 717                 \r
 718                 $rblogids = sql_query($query);\r
 719                 while ($o = sql_fetch_object($rblogids))\r
 720                 {\r
 721                         if ( $o->bnumber != $iForcedBlogInclude )\r
 722                         {\r
 723                                 $aBlogIds[] = intval($o->bnumber);\r
 724                         }\r
 725                 }\r
 726                 \r
 727                 if ( count($aBlogIds) == 0 )\r
 728                 {\r
 729                         return;\r
 730                 }\r
 731                 \r
 732                 /* TODO: we should consider to use the other way instead of this */\r
 733                 $_REQUEST['selectData'] = array(\r
 734                         'name'                  => $name,\r
 735                         'tabindex'              => $tabindex,\r
 736                         'mode'                  => $mode,\r
 737                         'selected'              => $selected,\r
 738                         'showNewCat'    => $showNewCat,\r
 739                         'aBlogIds'              => $aBlogIds,\r
 740                 );\r
 741                 self::$skin->parse('blogselectbox');\r
 742                 return;\r
 743         }\r
 744         \r
 745         /**\r
 746          * Admin::action_browseownitems()\r
 747          * \r
 748          * @param       void\r
 749          * @return      void\r
 750          */\r
 751         static private function action_browseownitems()\r
 752         {\r
 753                 global $member, $manager, $CONF;\r
 754                 \r
 755                 self::pagehead();\r
 756                 self::$skin->parse('browseownitems');\r
 757                 self::pagefoot();\r
 758                 return;\r
 759         }\r
 760         \r
 761         /**\r
 762          * Admin::action_itemcommentlist()\r
 763          * Show all the comments for a given item\r
 764          * \r
 765          * @param       integer $itemid ID for item\r
 766          * @return      void\r
 767          */\r
 768         static private function action_itemcommentlist($itemid = '')\r
 769         {\r
 770                 global $member, $manager, $CONF;\r
 771                 \r
 772                 if ( $itemid == '' )\r
 773                 {\r
 774                         $itemid = intRequestVar('itemid');\r
 775                 }\r
 776                 \r
 777                 /* TODO: we consider to use the other way insterad of this */\r
 778                 $_REQUEST['itemid'] = $itemid;\r
 779                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 780                 \r
 781                 // only allow if user is allowed to alter item\r
 782                 $member->canAlterItem($itemid) or self::disallow();\r
 783                 \r
 784                 $blogid = getBlogIdFromItemId($itemid);\r
 785                 \r
 786                 self::pagehead();\r
 787                 self::$skin->parse('itemcommentlist');\r
 788                 self::pagefoot();\r
 789                 return;\r
 790         }\r
 791         \r
 792         /**\r
 793          * Admin::action_browseowncomments()\r
 794          * Browse own comments\r
 795          * \r
 796          * @param       void\r
 797          * @return      void\r
 798          */\r
 799         static private function action_browseowncomments()\r
 800         {\r
 801                 self::pagehead();\r
 802                 self::$skin->parse('browseowncomments');\r
 803                 self::pagefoot();\r
 804                 return;\r
 805         }\r
 806         \r
 807         /**\r
 808          * Admin::action_blogcommentlist()\r
 809          * Browse all comments for a weblog\r
 810          * \r
 811          * @param       integer $blogid ID for weblog\r
 812          * @return      void\r
 813          */\r
 814         static private function action_blogcommentlist($blogid = '')\r
 815         {\r
 816                 global $member, $manager, $CONF;\r
 817                 \r
 818                 if ( $blogid == '' )\r
 819                 {\r
 820                         $blogid = intRequestVar('blogid');\r
 821                 }\r
 822                 else\r
 823                 {\r
 824                         $blogid = intval($blogid);\r
 825                 }\r
 826                 \r
 827                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 828                 \r
 829                 /* TODO: we consider to use the other way insterad of this */\r
 830                 $_REQUEST['blogid'] = $blogid;\r
 831                 \r
 832                 self::pagehead();\r
 833                 self::$skin->parse('blogcommentlist');\r
 834                 self::pagefoot();\r
 835                 return;\r
 836         }\r
 837         \r
 838         /**\r
 839          * Admin::action_createitem()\r
 840          * Provide a page to item a new item to the given blog\r
 841          * \r
 842          * @param       void\r
 843          * @return      void\r
 844          */\r
 845         static private function action_createitem()\r
 846         {\r
 847                 global $member, $manager;\r
 848                 \r
 849                 $blogid = intRequestVar('blogid');\r
 850                 \r
 851                 // check if allowed\r
 852                 $member->teamRights($blogid) or self::disallow();\r
 853                 \r
 854                 $memberid = $member->getID();\r
 855                 \r
 856                 $blog =& $manager->getBlog($blogid);\r
 857                 \r
 858                 self::pagehead();\r
 859                 self::$skin->parse('createitem');\r
 860                 self::pagefoot();\r
 861                 return;\r
 862         }\r
 863         \r
 864         /**\r
 865          * Admin::action_itemedit()\r
 866          * \r
 867          * @param       void\r
 868          * @return      void\r
 869          */\r
 870         static private function action_itemedit()\r
 871         {\r
 872                 global $member, $manager;\r
 873                 \r
 874                 $itemid = intRequestVar('itemid');\r
 875                 \r
 876                 // only allow if user is allowed to alter item\r
 877                 $member->canAlterItem($itemid) or self::disallow();\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $blogid = getBlogIDFromItemID($itemid);\r
 881                 $item   =& $manager->getItem($itemid, 1, 1);\r
 882                 $manager->notify(\r
 883                                 'PrepareItemForEdit',\r
 884                                 array(\r
 885                                                 'item' => &$item\r
 886                                 )\r
 887                 );\r
 888                 \r
 889                 self::pagehead();\r
 890                 self::$skin->parse('itemedit');\r
 891                 self::pagefoot();\r
 892                 return;\r
 893         }\r
 894         \r
 895         /**\r
 896          * Admin::action_itemupdate()\r
 897          * \r
 898          * @param       void\r
 899          * @return      void\r
 900          */\r
 901         static private function action_itemupdate()\r
 902         {\r
 903                 global $member, $manager, $CONF;\r
 904                 \r
 905                 $itemid = intRequestVar('itemid');\r
 906                 $catid  = postVar('catid');\r
 907                 \r
 908                 // only allow if user is allowed to alter item\r
 909                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 910                 \r
 911                 $actiontype = postVar('actiontype');\r
 912                 \r
 913                 // delete actions are handled by itemdelete (which has confirmation)\r
 914                 if ( $actiontype == 'delete' )\r
 915                 {\r
 916                         self::action_itemdelete();\r
 917                         return;\r
 918                 }\r
 919                 \r
 920                 $body           = postVar('body');\r
 921                 $title          = postVar('title');\r
 922                 $more           = postVar('more');\r
 923                 $closed         = intPostVar('closed');\r
 924                 $draftid        = intPostVar('draftid');\r
 925                 \r
 926                 // default action = add now\r
 927                 if ( !$actiontype )\r
 928                 {\r
 929                         $actiontype='addnow';\r
 930                 }\r
 931                 \r
 932                 // create new category if needed\r
 933                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 934                 {\r
 935                         // get blogid\r
 936                         list($blogid) = sscanf($catid,"newcat-%d");\r
 937                         \r
 938                         // create\r
 939                         $blog =& $manager->getBlog($blogid);\r
 940                         $catid = $blog->createNewCategory();\r
 941                         \r
 942                         // show error when sth goes wrong\r
 943                         if ( !$catid )\r
 944                         {\r
 945                                 self::doError(_ERROR_CATCREATEFAIL);\r
 946                         }\r
 947                 }\r
 948                 \r
 949                 /*\r
 950                         set some variables based on actiontype\r
 951 \r
 952                         actiontypes:\r
 953                                 draft items -> addnow, addfuture, adddraft, delete\r
 954                                 non-draft items -> edit, changedate, delete\r
 955 \r
 956                         variables set:\r
 957                                 $timestamp: set to a nonzero value for future dates or date changes\r
 958                                 $wasdraft: set to 1 when the item used to be a draft item\r
 959                                 $publish: set to 1 when the edited item is not a draft\r
 960          */\r
 961                 $blogid =  getBlogIDFromItemID($itemid);\r
 962                 $blog   =& $manager->getBlog($blogid);\r
 963                 \r
 964                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 965                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 966                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 967                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 968                 {\r
 969                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 970                 }\r
 971                 else\r
 972                 {\r
 973                         $timestamp =0;\r
 974                 }\r
 975                 \r
 976                 // edit the item for real\r
 977                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 978                 \r
 979                 self::updateFuturePosted($blogid);\r
 980                 \r
 981                 if ( $draftid > 0 )\r
 982                 {\r
 983                         // delete permission is checked inside Item::delete()\r
 984                         Item::delete($draftid);\r
 985                 }\r
 986                 \r
 987                 if ( $catid != intPostVar('catid') )\r
 988                 {\r
 989                         self::action_categoryedit(\r
 990                                 $catid,\r
 991                                 $blog->getID(),\r
 992                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 993                         );\r
 994                 }\r
 995                 else\r
 996                 {\r
 997                         // TODO: set start item correctly for itemlist\r
 998                         $item = Item::getItem($itemid, 0, 0);\r
 999                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
1000                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
1001                         $cnt  = quickQuery($query);\r
1002                         $_REQUEST['start'] = $cnt + 1;\r
1003                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
1004                 }\r
1005                 return;\r
1006         }\r
1007         \r
1008         /**\r
1009          * Admin::action_itemdelete()\r
1010          * Delete item\r
1011          * \r
1012          * @param       Void\r
1013          * @return      Void\r
1014          */\r
1015         static private function action_itemdelete()\r
1016         {\r
1017                 global $member, $manager;\r
1018                 \r
1019                 $itemid = intRequestVar('itemid');\r
1020                 \r
1021                 // only allow if user is allowed to alter item\r
1022                 $member->canAlterItem($itemid) or self::disallow();\r
1023                 \r
1024                 if ( !$manager->existsItem($itemid,1,1) )\r
1025                 {\r
1026                         self::error(_ERROR_NOSUCHITEM);\r
1027                 }\r
1028                 \r
1029                 self::pagehead();\r
1030                 self::$skin->parse('itemdelete');\r
1031                 self::pagefoot();\r
1032                 return;\r
1033         }\r
1034         \r
1035         /**\r
1036          * Admin::action_itemdeleteconfirm()\r
1037          * \r
1038          * @param       void\r
1039          * @return      void\r
1040          */\r
1041         static private function action_itemdeleteconfirm()\r
1042         {\r
1043                 global $member;\r
1044                 \r
1045                 $itemid = intRequestVar('itemid');\r
1046                 \r
1047                 // only allow if user is allowed to alter item\r
1048                 $member->canAlterItem($itemid) or self::disallow();\r
1049                 \r
1050                 // get blogid first\r
1051                 $blogid = getBlogIdFromItemId($itemid);\r
1052                 \r
1053                 // delete item (note: some checks will be performed twice)\r
1054                 self::deleteOneItem($itemid);\r
1055                 \r
1056                 self::action_itemlist($blogid);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::deleteOneItem()\r
1062          * Deletes one item and returns error if something goes wrong\r
1063          * \r
1064          * @param       integer $itemid ID for item\r
1065          * @return      void\r
1066          */\r
1067         static private function deleteOneItem($itemid)\r
1068         {\r
1069                 global $member, $manager;\r
1070                 \r
1071                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1072                 if ( !$member->canAlterItem($itemid) )\r
1073                 {\r
1074                         return _ERROR_DISALLOWED;\r
1075                 }\r
1076                 \r
1077                 // need to get blogid before the item is deleted\r
1078                 $blogid = getBlogIDFromItemId($itemid);\r
1079                 \r
1080                 $manager->loadClass('ITEM');\r
1081                 Item::delete($itemid);\r
1082                 \r
1083                 // update blog's futureposted\r
1084                 self::updateFuturePosted($blogid);\r
1085                 return;\r
1086         }\r
1087         \r
1088         /**\r
1089          * Admin::updateFuturePosted()\r
1090          * Update a blog's future posted flag\r
1091          * \r
1092          * @param integer $blogid\r
1093          * @return      void\r
1094          */\r
1095         static private function updateFuturePosted($blogid)\r
1096         {\r
1097                 global $manager;\r
1098                 \r
1099                 $blogid                 =  intval($blogid);\r
1100                 $blog                   =& $manager->getBlog($blogid);\r
1101                 $currenttime    =  $blog->getCorrectTime(time());\r
1102                 \r
1103                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1104                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1105                 $result = sql_query($query);\r
1106                 \r
1107                 if ( sql_num_rows($result) > 0 )\r
1108                 {\r
1109                                 $blog->setFuturePost();\r
1110                 }\r
1111                 else\r
1112                 {\r
1113                                 $blog->clearFuturePost();\r
1114                 }\r
1115                 return;\r
1116         }\r
1117 \r
1118         /**\r
1119          * Admin::action_itemmove()\r
1120          * \r
1121          * @param       void\r
1122          * @return      void\r
1123          */\r
1124         static private function action_itemmove()\r
1125         {\r
1126                 global $member, $manager;\r
1127                 \r
1128                 $itemid = intRequestVar('itemid');\r
1129                 \r
1130                 $member->canAlterItem($itemid) or self::disallow();\r
1131                 \r
1132                 self::pagehead();\r
1133                 self::$skin->parse('itemmove');\r
1134                 self::pagefoot();\r
1135                 return;\r
1136         }\r
1137         \r
1138         /**\r
1139          * Admin::action_itemmoveto()\r
1140          * \r
1141          * @param       void\r
1142          * @return      void\r
1143          */\r
1144         static private function action_itemmoveto()\r
1145         {\r
1146                 global $member, $manager;\r
1147                 \r
1148                 $itemid = intRequestVar('itemid');\r
1149                 $catid = requestVar('catid');\r
1150                 \r
1151                 // create new category if needed\r
1152                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1153                 {\r
1154                         // get blogid\r
1155                         list($blogid) = sscanf($catid,'newcat-%d');\r
1156                         \r
1157                         // create\r
1158                         $blog =& $manager->getBlog($blogid);\r
1159                         $catid = $blog->createNewCategory();\r
1160                         \r
1161                         // show error when sth goes wrong\r
1162                         if ( !$catid )\r
1163                         {\r
1164                                 self::doError(_ERROR_CATCREATEFAIL);\r
1165                         }\r
1166                 }\r
1167                 \r
1168                 // only allow if user is allowed to alter item\r
1169                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1170                 \r
1171                 $old_blogid = getBlogIDFromItemId($itemid);\r
1172                 \r
1173                 Item::move($itemid, $catid);\r
1174                 \r
1175                 // set the futurePosted flag on the blog\r
1176                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1177                 \r
1178                 // reset the futurePosted in case the item is moved from one blog to another\r
1179                 self::updateFuturePosted($old_blogid);\r
1180                 \r
1181                 if ( $catid != intRequestVar('catid') )\r
1182                 {\r
1183                         self::action_categoryedit($catid, $blog->getID());\r
1184                 }\r
1185                 else\r
1186                 {\r
1187                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1188                 }\r
1189                 return;\r
1190         }\r
1191         \r
1192         /**\r
1193          * Admin::moveOneItem()\r
1194          * Moves one item to a given category (category existance should be checked by caller)\r
1195          * errors are returned\r
1196          * \r
1197          * @param       integer $itemid         ID for item\r
1198          * @param       integer $destCatid      ID for category to which the item will be moved\r
1199          * @return      void\r
1200          */\r
1201         static private function moveOneItem($itemid, $destCatid)\r
1202         {\r
1203                 global $member;\r
1204                 \r
1205                 // only allow if user is allowed to move item\r
1206                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1207                 {\r
1208                         return _ERROR_DISALLOWED;\r
1209                 }\r
1210                 \r
1211                 Item::move($itemid, $destCatid);\r
1212                 return;\r
1213         }\r
1214         \r
1215         /**\r
1216          * Admin::action_additem()\r
1217          * Adds a item to the chosen blog\r
1218          * \r
1219          * @param       void\r
1220          * @return      void\r
1221          */\r
1222         static private function action_additem()\r
1223         {\r
1224                 global $manager, $CONF;\r
1225                 \r
1226                 $manager->loadClass('ITEM');\r
1227                 \r
1228                 $result = Item::createFromRequest();\r
1229                 \r
1230                 if ( $result['status'] == 'error' )\r
1231                 {\r
1232                         self::error($result['message']);\r
1233                 }\r
1234                 \r
1235                 $itemid = (integer) $result['itemid'];\r
1236                 \r
1237                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1238                 \r
1239                 if ( $result['status'] == 'newcategory' )\r
1240                 {\r
1241                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1242                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1243                 }\r
1244                 else\r
1245                 {\r
1246                         $methodName = 'action_itemlist';\r
1247                         self::action_itemlist($blogid);\r
1248                 }\r
1249                 return;\r
1250         }\r
1251         \r
1252         /**\r
1253          * Admin::action_commentedit()\r
1254          * Allows to edit previously made comments\r
1255          * \r
1256          * @param       void\r
1257          * @return      void\r
1258          */\r
1259         static private function action_commentedit()\r
1260         {\r
1261                 global $member, $manager;\r
1262                 \r
1263                 $commentid = intRequestVar('commentid');\r
1264                 \r
1265                 $member->canAlterComment($commentid) or self::disallow();\r
1266                 \r
1267                 self::pagehead();\r
1268                 self::$skin->parse('commentedit');\r
1269                 self::pagefoot();\r
1270                 return;\r
1271         }\r
1272         \r
1273         /**\r
1274          * Admin::action_commentupdate()\r
1275          * \r
1276          * @param       void\r
1277          * @return      void\r
1278          */\r
1279         static private function action_commentupdate()\r
1280         {\r
1281                 global $member, $manager;\r
1282                 \r
1283                 $commentid = intRequestVar('commentid');\r
1284                 \r
1285                 $member->canAlterComment($commentid) or self::disallow();\r
1286                 \r
1287                 $url    = postVar('url');\r
1288                 $email  = postVar('email');\r
1289                 $body   = postVar('body');\r
1290                 \r
1291                 // intercept words that are too long\r
1292                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1293                 {\r
1294                         self::error(_ERROR_COMMENT_LONGWORD);\r
1295                 }\r
1296                 \r
1297                 // check length\r
1298                 if ( i18n::strlen($body) < 3 )\r
1299                 {\r
1300                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1301                 }\r
1302                 \r
1303                 if ( i18n::strlen($body) > 5000 )\r
1304                 {\r
1305                         self::error(_ERROR_COMMENT_TOOLONG);\r
1306                 }\r
1307                 \r
1308                 // prepare body\r
1309                 $body = Comment::prepareBody($body);\r
1310                 \r
1311                 // call plugins\r
1312                 $data = array(\r
1313                         'body' => &$body\r
1314                 );\r
1315                 $manager->notify('PreUpdateComment', $data);\r
1316                 \r
1317                 $query = "UPDATE %s SET cmail='%s', cemail='%s', cbody='%s' WHERE cnumber=%d;";\r
1318                 $query = sprintf($query, sql_table('comment'), sql_real_escape_string($url), sql_real_escape_string($email), sql_real_escape_string($body), (integer) $commentid);\r
1319                 sql_query($query);\r
1320                 \r
1321                 // get itemid\r
1322                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1323                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1324                 \r
1325                 $res    = sql_query($query);\r
1326                 $o              = sql_fetch_object($res);\r
1327                 $itemid = $o->citem;\r
1328                 \r
1329                 if ( $member->canAlterItem($itemid) )\r
1330                 {\r
1331                         self::action_itemcommentlist($itemid);\r
1332                 }\r
1333                 else\r
1334                 {\r
1335                         self::action_browseowncomments();\r
1336                 }\r
1337                 return;\r
1338         }\r
1339         \r
1340         /**\r
1341          * Admin::action_commentdelete()\r
1342          * Update comment\r
1343          * \r
1344          * @param       void\r
1345          * @return      void\r
1346          */\r
1347         static private function action_commentdelete()\r
1348         {\r
1349                 global $member, $manager;\r
1350                 \r
1351                 $commentid = intRequestVar('commentid');\r
1352                 $member->canAlterComment($commentid) or self::disallow();\r
1353                 \r
1354                 self::pagehead();\r
1355                 self::$skin->parse('commentdelete');\r
1356                 self::pagefoot();\r
1357                 return;\r
1358         }\r
1359         \r
1360         /**\r
1361          * Admin::action_commentdeleteconfirm()\r
1362          * \r
1363          * @param       void\r
1364          * @return      void\r
1365          */\r
1366         static private function action_commentdeleteconfirm()\r
1367         {\r
1368                 global $member;\r
1369                 \r
1370                 $commentid = intRequestVar('commentid');\r
1371                 \r
1372                 // get item id first\r
1373                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1374                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1375                 \r
1376                 $res = sql_query($query);\r
1377                 $o = sql_fetch_object($res);\r
1378                 $itemid = $o->citem;\r
1379                 \r
1380                 $error = self::deleteOneComment($commentid);\r
1381                 if ( $error )\r
1382                 {\r
1383                         self::doError($error);\r
1384                 }\r
1385                 \r
1386                 if ( $member->canAlterItem($itemid) )\r
1387                 {\r
1388                         self::action_itemcommentlist($itemid);\r
1389                 }\r
1390                 else\r
1391                 {\r
1392                         self::action_browseowncomments();\r
1393                 }\r
1394                 return;\r
1395         }\r
1396         \r
1397         /**\r
1398          * Admin::deleteOneComment()\r
1399          * \r
1400          * @param       integer $commentid      ID for comment\r
1401          * @return      void\r
1402          */\r
1403         static private function deleteOneComment($commentid)\r
1404         {\r
1405                 global $member, $manager;\r
1406                 \r
1407                 $commentid = (integer) $commentid;\r
1408                 \r
1409                 if ( !$member->canAlterComment($commentid) )\r
1410                 {\r
1411                         return _ERROR_DISALLOWED;\r
1412                 }\r
1413                 \r
1414                 $data = array(\r
1415                         'commentid' => $commentid\r
1416                 );\r
1417                 \r
1418                 $manager->notify('PreDeleteComment', $data);\r
1419                 \r
1420                 // delete the comments associated with the item\r
1421                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1422                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1423                 sql_query($query);\r
1424                 \r
1425                 $data = array(\r
1426                         'commentid' => $commentid\r
1427                 );\r
1428                 \r
1429                 $manager->notify('PostDeleteComment', $data);\r
1430                 \r
1431                 return '';\r
1432         }\r
1433         \r
1434         /**\r
1435          * Admin::action_usermanagement()\r
1436          * Usermanagement main\r
1437          * \r
1438          * @param       void\r
1439          * @return      void\r
1440          */\r
1441         static private function action_usermanagement()\r
1442         {\r
1443                 global $member, $manager;\r
1444                 \r
1445                 // check if allowed\r
1446                 $member->isAdmin() or self::disallow();\r
1447                 \r
1448                 self::pagehead();\r
1449                 self::$skin->parse('usermanagement');\r
1450                 self::pagefoot();\r
1451                 return;\r
1452         }\r
1453         \r
1454         /**\r
1455          * Admin::action_memberedit()\r
1456          * Edit member settings\r
1457          * \r
1458          * @param       void\r
1459          * @return      void\r
1460          */\r
1461         static private function action_memberedit()\r
1462         {\r
1463                 self::action_editmembersettings(intRequestVar('memberid'));\r
1464                 return;\r
1465         }\r
1466         \r
1467         /**\r
1468          * Admin::action_editmembersettings()\r
1469          * \r
1470          * @param       integer $memberid       ID for member\r
1471          * @return      void\r
1472          * \r
1473          */\r
1474         static private function action_editmembersettings($memberid = '')\r
1475         {\r
1476                 global $member, $manager, $CONF;\r
1477                 \r
1478                 if ( $memberid == '' )\r
1479                 {\r
1480                         $memberid = $member->getID();\r
1481                 }\r
1482                 \r
1483                 /* TODO: we should consider to use the other way insterad of this */\r
1484                 $_REQUEST['memberid'] = $memberid;\r
1485                 \r
1486                 // check if allowed\r
1487                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1488                 \r
1489                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1490                 self::pagehead($extrahead);\r
1491                 self::$skin->parse('editmembersettings');\r
1492                 self::pagefoot();\r
1493                 return;\r
1494         }\r
1495         \r
1496         /**\r
1497          * Admin::action_changemembersettings()\r
1498          * \r
1499          * @param       void\r
1500          * @return      void\r
1501          */\r
1502         static private function action_changemembersettings()\r
1503         {\r
1504                 global $member, $CONF, $manager;\r
1505                 \r
1506                 $memberid = intRequestVar('memberid');\r
1507                 \r
1508                 // check if allowed\r
1509                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1510                 \r
1511                 $name                   = trim(strip_tags(postVar('name')));\r
1512                 $realname               = trim(strip_tags(postVar('realname')));\r
1513                 $password               = postVar('password');\r
1514                 $repeatpassword = postVar('repeatpassword');\r
1515                 $email                  = strip_tags(postVar('email'));\r
1516                 $url                    = strip_tags(postVar('url'));\r
1517                 $adminskin              = intPostVar('adminskin');\r
1518                 \r
1519                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1520                 if ( !preg_match('#^https?://#', $url) )\r
1521                 {\r
1522                         $url = 'http://' . $url;\r
1523                 }\r
1524                 \r
1525                 $admin          = postVar('admin');\r
1526                 $canlogin       = postVar('canlogin');\r
1527                 $notes          = strip_tags(postVar('notes'));\r
1528                 $locale         = postVar('locale');\r
1529                 \r
1530                 $mem = Member::createFromID($memberid);\r
1531                 \r
1532                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1533                 {\r
1534                         if ( !isValidDisplayName($name) )\r
1535                         {\r
1536                                 self::error(_ERROR_BADNAME);\r
1537                         }\r
1538                         \r
1539                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1540                         {\r
1541                                 self::error(_ERROR_NICKNAMEINUSE);\r
1542                         }\r
1543                         \r
1544                         if ( $password != $repeatpassword )\r
1545                         {\r
1546                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1547                         }\r
1548                         \r
1549                         if ( $password && (i18n::strlen($password) < 6) )\r
1550                         {\r
1551                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1552                         }\r
1553                                 \r
1554                         if ( $password )\r
1555                         {\r
1556                                 $pwdvalid = true;\r
1557                                 $pwderror = '';\r
1558                                 \r
1559                                 $data = array(\r
1560                                         'password'     => $password,\r
1561                                         'errormessage' => &$pwderror,\r
1562                                         'valid'        => &$pwdvalid\r
1563                                 );\r
1564                                 $manager->notify('PrePasswordSet', $data);\r
1565                                 \r
1566                                 if ( !$pwdvalid )\r
1567                                 {\r
1568                                         self::error($pwderror);\r
1569                                 }\r
1570                         }\r
1571                 }\r
1572                 \r
1573                 if ( !NOTIFICATION::address_validation($email) )\r
1574                 {\r
1575                         self::error(_ERROR_BADMAILADDRESS);\r
1576                 }\r
1577                 if ( !$realname )\r
1578                 {\r
1579                         self::error(_ERROR_REALNAMEMISSING);\r
1580                 }\r
1581                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1582                 {\r
1583                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1584                 }\r
1585                 \r
1586                 // check if there will remain at least one site member with both the logon and admin rights\r
1587                 // (check occurs when taking away one of these rights from such a member)\r
1588                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1589                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1590                         )\r
1591                 {\r
1592                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1593                         if ( sql_num_rows($r) < 2 )\r
1594                         {\r
1595                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1596                         }\r
1597                 }\r
1598                 \r
1599                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1600                 {\r
1601                         $mem->setDisplayName($name);\r
1602                         if ( $password )\r
1603                         {\r
1604                                 $mem->setPassword($password);\r
1605                         }\r
1606                 }\r
1607                 \r
1608                 $oldEmail = $mem->getEmail();\r
1609                 \r
1610                 $mem->setRealName($realname);\r
1611                 $mem->setEmail($email);\r
1612                 $mem->setURL($url);\r
1613                 $mem->setNotes($notes);\r
1614                 $mem->setLocale($locale);\r
1615                 \r
1616                 // only allow super-admins to make changes to the admin status\r
1617                 if ( $member->isAdmin() )\r
1618                 {\r
1619                         $mem->setAdmin($admin);\r
1620                         $mem->setCanLogin($canlogin);\r
1621                 }\r
1622                 \r
1623                 $autosave = postVar('autosave');\r
1624                 $mem->setAutosave($autosave);\r
1625                 \r
1626                 $mem->write();\r
1627                 \r
1628                 // store plugin options\r
1629                 $aOptions = requestArray('plugoption');\r
1630                 NucleusPlugin::apply_plugin_options($aOptions);\r
1631                 $data = array(\r
1632                         'context'  => 'member',\r
1633                         'memberid' => $memberid,\r
1634                         'member'   => &$mem\r
1635                 );\r
1636                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1637                 \r
1638                 // if email changed, generate new password\r
1639                 if ( $oldEmail != $mem->getEmail() )\r
1640                 {\r
1641                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1642                         // logout member\r
1643                         $mem->newCookieKey();\r
1644                         \r
1645                         // only log out if the member being edited is the current member.\r
1646                         if ( $member->getID() == $memberid )\r
1647                         {\r
1648                                 $member->logout();\r
1649                         }\r
1650                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1651                         return;\r
1652                 }\r
1653                 \r
1654                 if ( ($mem->getID() == $member->getID())\r
1655                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1656                 {\r
1657                         $mem->newCookieKey();\r
1658                         $member->logout();\r
1659                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1660                 }\r
1661                 else\r
1662                 {\r
1663                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1664                 }\r
1665                 return;\r
1666         }\r
1667 \r
1668         /**\r
1669          * Admin::action_memberadd()\r
1670          * \r
1671          * @param       void\r
1672          * @return      void\r
1673          * \r
1674          */\r
1675         static private function action_memberadd()\r
1676         {\r
1677                 global $member, $manager;\r
1678                 \r
1679                 // check if allowed\r
1680                 $member->isAdmin() or self::disallow();\r
1681                 \r
1682                 if ( postVar('password') != postVar('repeatpassword') )\r
1683                 {\r
1684                         self::error(_ERROR_PASSWORDMISMATCH);\r
1685                 }\r
1686                 \r
1687                 if ( i18n::strlen(postVar('password')) < 6 )\r
1688                 {\r
1689                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1690                 }\r
1691                 \r
1692                 $res = Member::create(\r
1693                         postVar('name'),\r
1694                         postVar('realname'),\r
1695                         postVar('password'),\r
1696                         postVar('email'),\r
1697                         postVar('url'),\r
1698                         postVar('admin'),\r
1699                         postVar('canlogin'),\r
1700                         postVar('notes')\r
1701                 );\r
1702                 \r
1703                 if ( $res != 1 )\r
1704                 {\r
1705                         self::error($res);\r
1706                 }\r
1707                 \r
1708                 // fire PostRegister event\r
1709                 $newmem = new Member();\r
1710                 $newmem->readFromName(postVar('name'));\r
1711                 $data = array(\r
1712                         'member' => &$newmem\r
1713                 );\r
1714                 $manager->notify('PostRegister', $data);\r
1715                 \r
1716                 self::action_usermanagement();\r
1717                 return;\r
1718         }\r
1719         \r
1720         /**\r
1721          * Admin::action_activate()\r
1722          * Account activation\r
1723          * \r
1724          * @param       void\r
1725          * @return      void\r
1726          */\r
1727         static private function action_activate()\r
1728         {\r
1729                 $key = getVar('key');\r
1730                 self::showActivationPage($key);\r
1731                 return;\r
1732         }\r
1733         \r
1734         /**\r
1735          * Admin::showActivationPage()\r
1736          * \r
1737          * @param       void\r
1738          * @return      void\r
1739          */\r
1740         static private function showActivationPage($key, $message = '')\r
1741         {\r
1742                 global $manager;\r
1743                 \r
1744                 // clean up old activation keys\r
1745                 Member::cleanupActivationTable();\r
1746                 \r
1747                 // get activation info\r
1748                 $info = Member::getActivationInfo($key);\r
1749                 \r
1750                 if ( !$info )\r
1751                 {\r
1752                         self::error(_ERROR_ACTIVATE);\r
1753                 }\r
1754                 \r
1755                 $mem = Member::createFromId($info->vmember);\r
1756                 \r
1757                 if ( !$mem )\r
1758                 {\r
1759                         self::error(_ERROR_ACTIVATE);\r
1760                 }\r
1761                 \r
1762                 /* TODO: we should consider to use the other way insterad of this */\r
1763                 $_POST['ackey']                                 = $key;\r
1764                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1765                 \r
1766                 self::$headMess = $message;\r
1767                 self::pagehead();\r
1768                 self::$skin->parse('activate');\r
1769                 self::pagefoot();\r
1770                 return;\r
1771         }\r
1772         \r
1773         /**\r
1774          * Admin::action_activatesetpwd()\r
1775          * Account activation - set password part\r
1776          * \r
1777          * @param       void\r
1778          * @return      void\r
1779          */\r
1780         static private function action_activatesetpwd()\r
1781         {\r
1782                 global $manager;\r
1783                 $key = postVar('key');\r
1784                 \r
1785                 // clean up old activation keys\r
1786                 Member::cleanupActivationTable();\r
1787                 \r
1788                 // get activation info\r
1789                 $info = Member::getActivationInfo($key);\r
1790                 \r
1791                 if ( !$info || ($info->type == 'addresschange') )\r
1792                 {\r
1793                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1794                 }\r
1795                 \r
1796                 $mem = Member::createFromId($info->vmember);\r
1797                 \r
1798                 if ( !$mem )\r
1799                 {\r
1800                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1801                 }\r
1802                 \r
1803                 $password               = postVar('password');\r
1804                 $repeatpassword = postVar('repeatpassword');\r
1805                 \r
1806                 if ( $password != $repeatpassword )\r
1807                 {\r
1808                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1809                 }\r
1810                 \r
1811                 if ( $password && (i18n::strlen($password) < 6) )\r
1812                 {\r
1813                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1814                 }\r
1815                         \r
1816                 if ( $password )\r
1817                 {\r
1818                         $pwdvalid = true;\r
1819                         $pwderror = '';\r
1820                         \r
1821                         $data = array(\r
1822                                 'password'              => $password,\r
1823                                 'errormessage'  => &$pwderror,\r
1824                                 'valid'                 => &$pwdvalid\r
1825                         );\r
1826                         $manager->notify('PrePasswordSet', $data);\r
1827                         if ( !$pwdvalid )\r
1828                         {\r
1829                                 return self::showActivationPage($key,$pwderror);\r
1830                         }\r
1831                 }\r
1832                 \r
1833                 $error = '';\r
1834                 \r
1835                 $data = array(\r
1836                         'type'   => 'activation',\r
1837                         'member' => $mem,\r
1838                         'error'  => &$error\r
1839                 );\r
1840                 $manager->notify('ValidateForm', $data);\r
1841                 if ( $error != '' )\r
1842                 {\r
1843                         return self::showActivationPage($key, $error);\r
1844                 }\r
1845                 \r
1846                 // set password\r
1847                 $mem->setPassword($password);\r
1848                 $mem->write();\r
1849                 \r
1850                 // do the activation\r
1851                 Member::activate($key);\r
1852                 \r
1853                 self::pagehead();\r
1854                 self::$skin->parse('activatesetpwd');\r
1855                 self::pagefoot();\r
1856                 return;\r
1857         }\r
1858         \r
1859         /**\r
1860          * Admin::action_manageteam()\r
1861          * Manage team\r
1862          * \r
1863          * @param       void\r
1864          * @return      void\r
1865          */\r
1866         static private function action_manageteam()\r
1867         {\r
1868                 global $member, $manager;\r
1869                 \r
1870                 $blogid = intRequestVar('blogid');\r
1871                 \r
1872                 // check if allowed\r
1873                 $member->blogAdminRights($blogid) or self::disallow();\r
1874                 \r
1875                 self::pagehead();\r
1876                 self::$skin->parse('manageteam');\r
1877                 self::pagefoot();\r
1878                 return;\r
1879         }\r
1880         \r
1881         /**\r
1882          * Admin::action_teamaddmember()\r
1883          * Add member to team\r
1884          * \r
1885          * @param       void\r
1886          * @return      void\r
1887          */\r
1888         static private function action_teamaddmember()\r
1889         {\r
1890                 global $member, $manager;\r
1891                 \r
1892                 $memberid       = intPostVar('memberid');\r
1893                 $blogid         = intPostVar('blogid');\r
1894                 $admin          = intPostVar('admin');\r
1895                 \r
1896                 // check if allowed\r
1897                 $member->blogAdminRights($blogid) or self::disallow();\r
1898                 \r
1899                 $blog =& $manager->getBlog($blogid);\r
1900                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1901                 {\r
1902                         self::error(_ERROR_ALREADYONTEAM);\r
1903                 }\r
1904                 \r
1905                 self::action_manageteam();\r
1906                 return;\r
1907         }\r
1908         \r
1909         /**\r
1910          * Admin::action_teamdelete()\r
1911          * \r
1912          * @param       void\r
1913          * @return      void\r
1914          */\r
1915         static private function action_teamdelete()\r
1916         {\r
1917                 global $member, $manager;\r
1918                 \r
1919                 $memberid       = intRequestVar('memberid');\r
1920                 $blogid         = intRequestVar('blogid');\r
1921                 \r
1922                 // check if allowed\r
1923                 $member->blogAdminRights($blogid) or self::disallow();\r
1924                 \r
1925                 $teammem =  Member::createFromID($memberid);\r
1926                 $blog =& $manager->getBlog($blogid);\r
1927                 \r
1928                 self::pagehead();\r
1929                 self::$skin->parse('teamdelete');\r
1930                 self::pagefoot();\r
1931                 return;\r
1932         }\r
1933         \r
1934         /**\r
1935          * Admin::action_teamdeleteconfirm()\r
1936          * \r
1937          * @param       void\r
1938          * @return      void\r
1939          */\r
1940         static private function action_teamdeleteconfirm()\r
1941         {\r
1942                 global $member;\r
1943                 \r
1944                 $memberid = intRequestVar('memberid');\r
1945                 $blogid = intRequestVar('blogid');\r
1946                 \r
1947                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1948                 if ( $error )\r
1949                 {\r
1950                         self::error($error);\r
1951                 }\r
1952                 self::action_manageteam();\r
1953                 return;\r
1954         }\r
1955         \r
1956         /**\r
1957          * Admin::deleteOneTeamMember()\r
1958          * \r
1959          * @param       void\r
1960          * @return      void\r
1961          */\r
1962         static private function deleteOneTeamMember($blogid, $memberid)\r
1963         {\r
1964                 global $member, $manager;\r
1965                 \r
1966                 $blogid   = intval($blogid);\r
1967                 $memberid = intval($memberid);\r
1968                 \r
1969                 // check if allowed\r
1970                 if ( !$member->blogAdminRights($blogid) )\r
1971                 {\r
1972                         return _ERROR_DISALLOWED;\r
1973                 }\r
1974                 \r
1975                 // check if: - there remains at least one blog admin\r
1976                 //           - (there remains at least one team member)\r
1977                 $tmem = Member::createFromID($memberid);\r
1978                 \r
1979                 \r
1980                 $data = array(\r
1981                         'member' => &$tmem,\r
1982                         'blogid' => $blogid\r
1983                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1984                 \r
1985                 if ( $tmem->isBlogAdmin($blogid) )\r
1986                 {\r
1987                         /* TODO: why we did double check? */\r
1988                         // check if there are more blog members left and at least one admin\r
1989                         // (check for at least two admins before deletion)\r
1990                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1991                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1992                         $r     = sql_query($query);\r
1993                         if ( sql_num_rows($r) < 2 )\r
1994                         {\r
1995                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1996                         }\r
1997                 }\r
1998                 \r
1999                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
2000                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
2001                 sql_query($query);\r
2002                 \r
2003                 $data = array(\r
2004                         'member' => &$tmem,\r
2005                         'blogid' => $blogid\r
2006                 );\r
2007                 $manager->notify('PostDeleteTeamMember', $data);\r
2008                 \r
2009                 return '';\r
2010         }\r
2011         \r
2012         /**\r
2013          * Admin::action_teamchangeadmin()\r
2014          * \r
2015          * @param       void\r
2016          * @return      void\r
2017          */\r
2018         static private function action_teamchangeadmin()\r
2019         {\r
2020                 global $member;\r
2021                 \r
2022                 $blogid         = intRequestVar('blogid');\r
2023                 $memberid       = intRequestVar('memberid');\r
2024                 \r
2025                 // check if allowed\r
2026                 $member->blogAdminRights($blogid) or self::disallow();\r
2027                 \r
2028                 $mem = Member::createFromID($memberid);\r
2029                 \r
2030                 // don't allow when there is only one admin at this moment\r
2031                 if ( $mem->isBlogAdmin($blogid) )\r
2032                 {\r
2033                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2034                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2035                         $r = sql_query($query);\r
2036                         if ( sql_num_rows($r) == 1 )\r
2037                         {\r
2038                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2039                         }\r
2040                 }\r
2041                 \r
2042                 if ( $mem->isBlogAdmin($blogid) )\r
2043                 {\r
2044                         $newval = 0;\r
2045                 }\r
2046                 else\r
2047                 {\r
2048                         $newval = 1;\r
2049                 }\r
2050                 \r
2051                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2052                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2053                 sql_query($query);\r
2054                 \r
2055                 // only show manageteam if member did not change its own admin privileges\r
2056                 if ( $member->isBlogAdmin($blogid) )\r
2057                 {\r
2058                         self::action_manageteam();\r
2059                 }\r
2060                 else\r
2061                 {\r
2062                         self::action_overview(_MSG_ADMINCHANGED);\r
2063                 }\r
2064                 return;\r
2065         }\r
2066         \r
2067         /**\r
2068          * Admin::action_blogsettings()\r
2069          * \r
2070          * @param       void\r
2071          * @return      void\r
2072          */\r
2073         static private function action_blogsettings()\r
2074         {\r
2075                 global $member, $manager;\r
2076                 \r
2077                 $blogid = intRequestVar('blogid');\r
2078                 \r
2079                 // check if allowed\r
2080                 $member->blogAdminRights($blogid) or self::disallow();\r
2081                 \r
2082                 $blog =& $manager->getBlog($blogid);\r
2083                 \r
2084                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2085                 self::pagehead($extrahead);\r
2086                 self::$skin->parse('blogsettings');\r
2087                 self::pagefoot();\r
2088                 return;\r
2089         }\r
2090         \r
2091         /**\r
2092          * Admin::action_categorynew()\r
2093          * \r
2094          * @param       void\r
2095          * @return      void\r
2096          */\r
2097         static private function action_categorynew()\r
2098         {\r
2099                 global $member, $manager;\r
2100                 \r
2101                 $blogid = intRequestVar('blogid');\r
2102                 \r
2103                 $member->blogAdminRights($blogid) or self::disallow();\r
2104                 \r
2105                 $cname = postVar('cname');\r
2106                 $cdesc = postVar('cdesc');\r
2107                 \r
2108                 if ( !isValidCategoryName($cname) )\r
2109                 {\r
2110                         self::error(_ERROR_BADCATEGORYNAME);\r
2111                 }\r
2112                 \r
2113                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2114                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2115                 $res = sql_query($query);\r
2116                 if ( sql_num_rows($res) > 0 )\r
2117                 {\r
2118                         self::error(_ERROR_DUPCATEGORYNAME);\r
2119                 }\r
2120                 \r
2121                 $blog           =& $manager->getBlog($blogid);\r
2122                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2123                 \r
2124                 self::action_blogsettings();\r
2125                 return;\r
2126         }\r
2127         \r
2128         /**\r
2129          * Admin::action_categoryedit()\r
2130          * \r
2131          * @param       void\r
2132          * @return      void\r
2133          */\r
2134         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2135         {\r
2136                 global $member, $manager;\r
2137                 \r
2138                 if ( $blogid == '' )\r
2139                 {\r
2140                         $blogid = intGetVar('blogid');\r
2141                 }\r
2142                 else\r
2143                 {\r
2144                         $blogid = intval($blogid);\r
2145                 }\r
2146                 if ( $catid == '' )\r
2147                 {\r
2148                         $catid = intGetVar('catid');\r
2149                 }\r
2150                 else\r
2151                 {\r
2152                         $catid = intval($catid);\r
2153                 }\r
2154                 \r
2155                 /* TODO: we should consider to use the other way insterad of this */\r
2156                 $_REQUEST['blogid']             = $blogid;\r
2157                 $_REQUEST['catid']              = $catid;\r
2158                 $_REQUEST['desturl']    = $desturl;\r
2159                 $member->blogAdminRights($blogid) or self::disallow();\r
2160                 \r
2161                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2162                 self::pagehead($extrahead);\r
2163                 self::$skin->parse('categoryedit');\r
2164                 self::pagefoot();\r
2165                 return;\r
2166         }\r
2167         \r
2168         /**\r
2169          * Admin::action_categoryupdate()\r
2170          * \r
2171          * @param       void\r
2172          * @return      void\r
2173          */\r
2174         static private function action_categoryupdate()\r
2175         {\r
2176                 global $member, $manager;\r
2177                 \r
2178                 $blogid         = intPostVar('blogid');\r
2179                 $catid          = intPostVar('catid');\r
2180                 $cname          = postVar('cname');\r
2181                 $cdesc          = postVar('cdesc');\r
2182                 $desturl        = postVar('desturl');\r
2183                 \r
2184                 $member->blogAdminRights($blogid) or self::disallow();\r
2185                 \r
2186                 if ( !isValidCategoryName($cname) )\r
2187                 {\r
2188                         self::error(_ERROR_BADCATEGORYNAME);\r
2189                 }\r
2190                 \r
2191                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2192                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2193                 $res    = sql_query($query);\r
2194                 if ( sql_num_rows($res) > 0 )\r
2195                 {\r
2196                         self::error(_ERROR_DUPCATEGORYNAME);\r
2197                 }\r
2198                 \r
2199                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2200                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2201                 sql_query($query);\r
2202                 \r
2203                 // store plugin options\r
2204                 $aOptions = requestArray('plugoption');\r
2205                 NucleusPlugin::apply_plugin_options($aOptions);\r
2206                 $data = array(\r
2207                         'context'       => 'category',\r
2208                         'catid'         => $catid\r
2209                 );\r
2210                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2211                 \r
2212                 if ( $desturl )\r
2213                 {\r
2214                         redirect($desturl);\r
2215                         exit;\r
2216                 }\r
2217                 else\r
2218                 {\r
2219                         self::action_blogsettings();\r
2220                 }\r
2221                 return;\r
2222         }\r
2223         \r
2224         /**\r
2225          * Admin::action_categorydelete()\r
2226          * \r
2227          * @param       void\r
2228          * @return      void\r
2229          */\r
2230         static private function action_categorydelete()\r
2231         {\r
2232                 global $member, $manager;\r
2233                 \r
2234                 $blogid = intRequestVar('blogid');\r
2235                 $catid  = intRequestVar('catid');\r
2236                 \r
2237                 $member->blogAdminRights($blogid) or self::disallow();\r
2238                 \r
2239                 $blog =& $manager->getBlog($blogid);\r
2240                 \r
2241                 // check if the category is valid\r
2242                 if ( !$blog->isValidCategory($catid) )\r
2243                 {\r
2244                         self::error(_ERROR_NOSUCHCATEGORY);\r
2245                 }\r
2246                 \r
2247                 // don't allow deletion of default category\r
2248                 if ( $blog->getDefaultCategory() == $catid )\r
2249                 {\r
2250                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2251                 }\r
2252                 \r
2253                 // check if catid is the only category left for blogid\r
2254                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2255                 $query = sprintf($query, sql_table('category'), $blogid);\r
2256                 $res = sql_query($query);\r
2257                 if ( sql_num_rows($res) == 1 )\r
2258                 {\r
2259                         self::error(_ERROR_DELETELASTCATEGORY);\r
2260                 }\r
2261                 \r
2262                 self::pagehead();\r
2263                 self::$skin->parse('categorydelete');\r
2264                 self::pagefoot();\r
2265                 return;\r
2266         }\r
2267         \r
2268         /**\r
2269          * Admin::action_categorydeleteconfirm()\r
2270          * \r
2271          * @param       void\r
2272          * @return      void\r
2273          */\r
2274         static private function action_categorydeleteconfirm()\r
2275         {\r
2276                 global $member, $manager;\r
2277                 \r
2278                 $blogid = intRequestVar('blogid');\r
2279                 $catid  = intRequestVar('catid');\r
2280                 \r
2281                 $member->blogAdminRights($blogid) or self::disallow();\r
2282                 \r
2283                 $error = self::deleteOneCategory($catid);\r
2284                 if ( $error )\r
2285                 {\r
2286                         self::error($error);\r
2287                 }\r
2288                 \r
2289                 self::action_blogsettings();\r
2290                 return;\r
2291         }\r
2292         \r
2293         /**\r
2294          * Admin::deleteOneCategory()\r
2295          * Delete a category by its id\r
2296          * \r
2297          * @param       String  $catid  category id for deleting\r
2298          * @return      Void\r
2299          */\r
2300         static private function deleteOneCategory($catid)\r
2301         {\r
2302                 global $manager, $member;\r
2303                 \r
2304                 $catid  = intval($catid);\r
2305                 $blogid = getBlogIDFromCatID($catid);\r
2306                 \r
2307                 if ( !$member->blogAdminRights($blogid) )\r
2308                 {\r
2309                         return ERROR_DISALLOWED;\r
2310                 }\r
2311                 \r
2312                 // get blog\r
2313                 $blog =& $manager->getBlog($blogid);\r
2314                 \r
2315                 // check if the category is valid\r
2316                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2317                 {\r
2318                         return _ERROR_NOSUCHCATEGORY;\r
2319                 }\r
2320                 \r
2321                 $destcatid = $blog->getDefaultCategory();\r
2322                 \r
2323                 // don't allow deletion of default category\r
2324                 if ( $blog->getDefaultCategory() == $catid )\r
2325                 {\r
2326                         return _ERROR_DELETEDEFCATEGORY;\r
2327                 }\r
2328                 \r
2329                 // check if catid is the only category left for blogid\r
2330                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2331                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2332                 \r
2333                 $res = sql_query($query);\r
2334                 if ( sql_num_rows($res) == 1 )\r
2335                 {\r
2336                         return _ERROR_DELETELASTCATEGORY;\r
2337                 }\r
2338                 \r
2339                 $data = array('catid' => $catid);\r
2340                 $manager->notify('PreDeleteCategory', $data);\r
2341                 \r
2342                 // change category for all items to the default category\r
2343                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2344                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2345                 sql_query($query);\r
2346                 \r
2347                 // delete all associated plugin options\r
2348                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2349                 \r
2350                 // delete category\r
2351                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2352                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2353                 sql_query($query);\r
2354                 \r
2355                 $data = array('catid' => $catid);\r
2356                 $manager->notify('PostDeleteCategory', $data);\r
2357                 return;\r
2358         }\r
2359         \r
2360         /**\r
2361          * Admin::action_blogsettingsupdate\r
2362          * Updating blog settings\r
2363          * \r
2364          * @param       Void\r
2365          * @return      Void\r
2366          */\r
2367         static private function action_blogsettingsupdate()\r
2368         {\r
2369                 global $member, $manager;\r
2370                 \r
2371                 $blogid = intRequestVar('blogid');\r
2372                 \r
2373                 $member->blogAdminRights($blogid) or self::disallow();\r
2374                 \r
2375                 $blog =& $manager->getBlog($blogid);\r
2376                 \r
2377                 $notify_address = trim(postVar('notify'));\r
2378                 $shortname              = trim(postVar('shortname'));\r
2379                 $updatefile             = trim(postVar('update'));\r
2380                 \r
2381                 $notifyComment  = intPostVar('notifyComment');\r
2382                 $notifyVote             = intPostVar('notifyVote');\r
2383                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2384                 \r
2385                 if ( $notifyComment == 0 )\r
2386                 {\r
2387                         $notifyComment = 1;\r
2388                 }\r
2389                 if ( $notifyVote == 0 )\r
2390                 {\r
2391                         $notifyVote = 1;\r
2392                 }\r
2393                 if ( $notifyNewItem == 0 )\r
2394                 {\r
2395                         $notifyNewItem = 1;\r
2396                 }\r
2397                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2398                 \r
2399                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2400                 {\r
2401                         self::error(_ERROR_BADNOTIFY);\r
2402                 }\r
2403                 \r
2404                 if ( !isValidShortName($shortname) )\r
2405                 {\r
2406                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2407                 }\r
2408                 \r
2409                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2410                 {\r
2411                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2412                 }\r
2413                 // check if update file is writable\r
2414                 if ( $updatefile && !is_writeable($updatefile) )\r
2415                 {\r
2416                         self::error(_ERROR_UPDATEFILE);\r
2417                 }\r
2418                 \r
2419                 $blog->setName(trim(postVar('name')));\r
2420                 $blog->setShortName($shortname);\r
2421                 $blog->setNotifyAddress($notify_address);\r
2422                 $blog->setNotifyType($notifyType);\r
2423                 $blog->setMaxComments(postVar('maxcomments'));\r
2424                 $blog->setCommentsEnabled(postVar('comments'));\r
2425                 $blog->setTimeOffset(postVar('timeoffset'));\r
2426                 $blog->setUpdateFile($updatefile);\r
2427                 $blog->setURL(trim(postVar('url')));\r
2428                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2429                 $blog->setDescription(trim(postVar('desc')));\r
2430                 $blog->setPublic(postVar('public'));\r
2431                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2432                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2433                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2434                 $blog->setSearchable(intPostVar('searchable'));\r
2435                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2436                 $blog->writeSettings();\r
2437                 \r
2438                 // store plugin options\r
2439                 $aOptions = requestArray('plugoption');\r
2440                 NucleusPlugin::apply_plugin_options($aOptions);\r
2441                 \r
2442                 $data = array(\r
2443                         'context' => 'blog',\r
2444                         'blogid'  => $blogid,\r
2445                         'blog'    => &$blog\r
2446                 );\r
2447                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2448                 \r
2449                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2450                 return;\r
2451         }\r
2452         \r
2453         /**\r
2454          * Admin::action_deleteblog()\r
2455          * \r
2456          * @param       void\r
2457          * @return      void\r
2458          */\r
2459         static private function action_deleteblog()\r
2460         {\r
2461                 global $member, $CONF, $manager;\r
2462                 \r
2463                 $blogid = intRequestVar('blogid');\r
2464                 \r
2465                 $member->blogAdminRights($blogid) or self::disallow();\r
2466                 \r
2467                 // check if blog is default blog\r
2468                 if ( $CONF['DefaultBlog'] == $blogid )\r
2469                 {\r
2470                         self::error(_ERROR_DELDEFBLOG);\r
2471                 }\r
2472                 \r
2473                 $blog =& $manager->getBlog($blogid);\r
2474                 \r
2475                 self::pagehead();\r
2476                 self::$skin->parse('deleteblog');\r
2477                 self::pagefoot();\r
2478                 return;\r
2479         }\r
2480         \r
2481         /**\r
2482          * Admin::action_deleteblogconfirm()\r
2483          * Delete Blog\r
2484          * \r
2485          * @param       Void\r
2486          * @return      Void\r
2487          */\r
2488         static private function action_deleteblogconfirm()\r
2489         {\r
2490                 global $member, $CONF, $manager;\r
2491                 \r
2492                 $blogid = intRequestVar('blogid');\r
2493                 \r
2494                 $data = array('blogid' => $blogid);\r
2495                 $manager->notify('PreDeleteBlog', $data);\r
2496                 \r
2497                 $member->blogAdminRights($blogid) or self::disallow();\r
2498                 \r
2499                 // check if blog is default blog\r
2500                 if ( $CONF['DefaultBlog'] == $blogid )\r
2501                 {\r
2502                         self::error(_ERROR_DELDEFBLOG);\r
2503                 }\r
2504                 \r
2505                 // delete all comments\r
2506                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2507                 sql_query($query);\r
2508                 \r
2509                 // delete all items\r
2510                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2511                 sql_query($query);\r
2512                 \r
2513                 // delete all team members\r
2514                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2515                 sql_query($query);\r
2516                 \r
2517                 // delete all bans\r
2518                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2519                 sql_query($query);\r
2520                 \r
2521                 // delete all categories\r
2522                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2523                 sql_query($query);\r
2524                 \r
2525                 // delete all associated plugin options\r
2526                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2527                 \r
2528                 // delete the blog itself\r
2529                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2530                 sql_query($query);\r
2531                 \r
2532                 $data = array('blogid' => $blogid);\r
2533                 $manager->notify('PostDeleteBlog', $data);\r
2534                 \r
2535                 self::action_overview(_DELETED_BLOG);\r
2536                 return;\r
2537         }\r
2538         \r
2539         /**\r
2540          * Admin::action_memberdelete()\r
2541          * \r
2542          * @param       void\r
2543          * @return      void\r
2544          */\r
2545         static private function action_memberdelete()\r
2546         {\r
2547                 global $member, $manager;\r
2548                 \r
2549                 $memberid = intRequestVar('memberid');\r
2550                 \r
2551                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2552                 \r
2553                 $mem = Member::createFromID($memberid);\r
2554                 \r
2555                 self::pagehead();\r
2556                 self::$skin->parse('memberdelete');\r
2557                 self::pagefoot();\r
2558                 return;\r
2559         }\r
2560         \r
2561         /**\r
2562          * Admin::action_memberdeleteconfirm()\r
2563          * \r
2564          * @param       void\r
2565          * @return      void\r
2566          */\r
2567         static private function action_memberdeleteconfirm()\r
2568         {\r
2569                 global $member;\r
2570                 \r
2571                 $memberid = intRequestVar('memberid');\r
2572                 \r
2573                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2574                 \r
2575                 $error = self::deleteOneMember($memberid);\r
2576                 if ( $error )\r
2577                 {\r
2578                         self::error($error);\r
2579                 }\r
2580                 \r
2581                 if ( $member->isAdmin() )\r
2582                 {\r
2583                         self::action_usermanagement();\r
2584                 }\r
2585                 else\r
2586                 {\r
2587                         self::action_overview(_DELETED_MEMBER);\r
2588                 }\r
2589                 return;\r
2590         }\r
2591         \r
2592         /**\r
2593          * Admin::deleteOneMember()\r
2594          * Delete a member by id\r
2595          * \r
2596          * @static\r
2597          * @params      Integer $memberid       member id\r
2598          * @return      String  null string or error messages\r
2599          */\r
2600         static private function deleteOneMember($memberid)\r
2601         {\r
2602                 global $manager;\r
2603                 \r
2604                 $memberid = intval($memberid);\r
2605                 $mem = Member::createFromID($memberid);\r
2606                 \r
2607                 if ( !$mem->canBeDeleted() )\r
2608                 {\r
2609                         return _ERROR_DELETEMEMBER;\r
2610                 }\r
2611                 \r
2612                 $data = array('member' => &$mem);\r
2613                 $manager->notify('PreDeleteMember', $data);\r
2614                 \r
2615                 /* unlink comments from memberid */\r
2616                 if ( $memberid )\r
2617                 {\r
2618                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2619                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2620                         sql_query($query);\r
2621                 }\r
2622                 \r
2623                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2624                 sql_query($query);\r
2625                 \r
2626                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2627                 sql_query($query);\r
2628                 \r
2629                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2630                 sql_query($query);\r
2631                 \r
2632                 // delete all associated plugin options\r
2633                 NucleusPlugin::delete_option_values('member', $memberid);\r
2634                 \r
2635                 $data = array('member' => &$mem);\r
2636                 $manager->notify('PostDeleteMember', $data);\r
2637                 \r
2638                 return '';\r
2639         }\r
2640         \r
2641         /**\r
2642          * Admin::action_createnewlog()\r
2643          * \r
2644          * @param       void\r
2645          * @return      void\r
2646          */\r
2647         static private function action_createnewlog()\r
2648         {\r
2649                 global $member, $CONF, $manager;\r
2650                 \r
2651                 // Only Super-Admins can do this\r
2652                 $member->isAdmin() or self::disallow();\r
2653                 \r
2654                 self::pagehead();\r
2655                 self::$skin->parse('createnewlog');\r
2656                 self::pagefoot();\r
2657                 return;\r
2658         }\r
2659         \r
2660         /**\r
2661          * Admin::action_addnewlog()\r
2662          * \r
2663          * @param       void\r
2664          * @return      void\r
2665          */\r
2666         static private function action_addnewlog()\r
2667         {\r
2668                 global $member, $manager, $CONF;\r
2669                 \r
2670                 // Only Super-Admins can do this\r
2671                 $member->isAdmin() or self::disallow();\r
2672                 \r
2673                 $bname                  = trim(postVar('name'));\r
2674                 $bshortname             = trim(postVar('shortname'));\r
2675                 $btimeoffset    = postVar('timeoffset');\r
2676                 $bdesc                  = trim(postVar('desc'));\r
2677                 $bdefskin               = postVar('defskin');\r
2678                 \r
2679                 if ( !isValidShortName($bshortname) )\r
2680                 {\r
2681                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2682                 }\r
2683                 \r
2684                 if ( $manager->existsBlog($bshortname) )\r
2685                 {\r
2686                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2687                 }\r
2688                 \r
2689                 $data = array(\r
2690                         'name'        => &$bname,\r
2691                         'shortname'   => &$bshortname,\r
2692                         'timeoffset'  => &$btimeoffset,\r
2693                         'description' => &$bdesc,\r
2694                         'defaultskin' => &$bdefskin\r
2695                 );\r
2696                 $manager->notify('PreAddBlog', $data);\r
2697                 \r
2698                 // add slashes for sql queries\r
2699                 $bname                  = sql_real_escape_string($bname);\r
2700                 $bshortname             = sql_real_escape_string($bshortname);\r
2701                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2702                 $bdesc                  = sql_real_escape_string($bdesc);\r
2703                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2704                 \r
2705                 // create blog\r
2706                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2707                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2708                 sql_query($query);\r
2709                 \r
2710                 $blogid =  sql_insert_id();\r
2711                 $blog   =& $manager->getBlog($blogid);\r
2712                 \r
2713                 // create new category\r
2714                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2715                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2716                 \r
2717                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2718                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2719                 $catid = sql_insert_id();\r
2720                 \r
2721                 // set as default category\r
2722                 $blog->setDefaultCategory($catid);\r
2723                 $blog->writeSettings();\r
2724                 \r
2725                 // create team member\r
2726                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2727                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2728                 sql_query($query);\r
2729                 \r
2730                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2731                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2732                 \r
2733                 $blog->additem(\r
2734                         $blog->getDefaultCategory(),\r
2735                         $itemdeftitle,$itemdefbody,\r
2736                         '',\r
2737                         $blogid,\r
2738                         $member->getID(),\r
2739                         $blog->getCorrectTime(),\r
2740                         0,\r
2741                         0,\r
2742                         0\r
2743                 );\r
2744                 \r
2745                 $data = array('blog' => &$blog);\r
2746                 $manager->notify('PostAddBlog', $data);\r
2747                 \r
2748                 $data = array(\r
2749                         'blog'                  => &$blog,\r
2750                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2751                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2752                         'catid'                 => $catid\r
2753                 );\r
2754                 $manager->notify('PostAddCategory', $data);\r
2755                 \r
2756                 /* TODO: we should consider to use the other way insterad of this */\r
2757                 $_REQUEST['blogid'] = $blogid;\r
2758                 $_REQUEST['catid']  = $catid;\r
2759                 self::pagehead();\r
2760                 self::$skin->parse('addnewlog');\r
2761                 self::pagefoot();\r
2762                 return;\r
2763         }\r
2764         \r
2765         /**\r
2766          * Admin::action_addnewlog2()\r
2767          * \r
2768          * @param       void\r
2769          * @return      void\r
2770          */\r
2771         static private function action_addnewlog2()\r
2772         {\r
2773                 global $member, $manager;\r
2774                 $blogid = intRequestVar('blogid');\r
2775                 \r
2776                 $member->blogAdminRights($blogid) or self::disallow();\r
2777                 \r
2778                 $burl = requestVar('url');\r
2779                 \r
2780                 $blog =& $manager->getBlog($blogid);\r
2781                 $blog->setURL(trim($burl));\r
2782                 $blog->writeSettings();\r
2783                 \r
2784                 self::action_overview(_MSG_NEWBLOG);\r
2785                 return;\r
2786         }\r
2787         \r
2788         /**\r
2789          * Admin::action_skinieoverview()\r
2790          * \r
2791          * @param       void\r
2792          * @return      void\r
2793          */\r
2794         static private function action_skinieoverview()\r
2795         {\r
2796                 global $member, $DIR_LIBS, $manager;\r
2797                 \r
2798                 $member->isAdmin() or self::disallow();\r
2799                 \r
2800                 include_once($DIR_LIBS . 'skinie.php');\r
2801                 \r
2802                 self::pagehead();\r
2803                 self::$skin->parse('skinieoverview');\r
2804                 self::pagefoot();\r
2805                 return;\r
2806         }\r
2807         \r
2808         /**\r
2809          * Admin::action_skinieimport()\r
2810          * \r
2811          * @param       void\r
2812          * @return      void\r
2813          */\r
2814         static private function action_skinieimport()\r
2815         {\r
2816                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2817                 \r
2818                 $member->isAdmin() or self::disallow();\r
2819                 \r
2820                 // load skinie class\r
2821                 include_once($DIR_LIBS . 'skinie.php');\r
2822                 \r
2823                 $skinFileRaw    = postVar('skinfile');\r
2824                 $mode                   = postVar('mode');\r
2825                 \r
2826                 $importer = new SkinImport();\r
2827                 \r
2828                 // get full filename\r
2829                 if ( $mode == 'file' )\r
2830                 {\r
2831                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2832                         \r
2833                         /* TODO: remove this\r
2834                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2835                         if ( !file_exists($skinFile) )\r
2836                         {\r
2837                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2838                         }\r
2839                          */\r
2840                 }\r
2841                 else\r
2842                 {\r
2843                         $skinFile = $skinFileRaw;\r
2844                 }\r
2845                 \r
2846                 // read only metadata\r
2847                 $error = $importer->readFile($skinFile, 1);\r
2848                 \r
2849                 /* TODO: we should consider to use the other way insterad of this */\r
2850                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2851                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2852                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2853                 \r
2854                 // clashes\r
2855                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2856                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2857                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2858                 \r
2859                 /* TODO: we should consider to use the other way insterad of this */\r
2860                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2861                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2862                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2863                 \r
2864                 if ( $error )\r
2865                 {\r
2866                         self::error($error);\r
2867                 }\r
2868                 \r
2869                 self::pagehead();\r
2870                 self::$skin->parse('skinieimport');\r
2871                 self::pagefoot();\r
2872                 return;\r
2873         }\r
2874         \r
2875         /**\r
2876          * Admin::action_skiniedoimport()\r
2877          * \r
2878          * @param       void\r
2879          * @return      void\r
2880          */\r
2881         static private function action_skiniedoimport()\r
2882         {\r
2883                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2884                 \r
2885                 $member->isAdmin() or self::disallow();\r
2886                 \r
2887                 // load skinie class\r
2888                 include_once($DIR_LIBS . 'skinie.php');\r
2889                 \r
2890                 $skinFileRaw    = postVar('skinfile');\r
2891                 $mode                   = postVar('mode');\r
2892                 \r
2893                 $allowOverwrite = intPostVar('overwrite');\r
2894                 \r
2895                 // get full filename\r
2896                 if ( $mode == 'file' )\r
2897                 {\r
2898                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2899                         \r
2900                         /* TODO: remove this\r
2901                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2902                         if ( !file_exists($skinFile) )\r
2903                         {\r
2904                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2905                         }\r
2906                         */\r
2907                 }\r
2908                 else\r
2909                 {\r
2910                         $skinFile = $skinFileRaw;\r
2911                 }\r
2912                 \r
2913                 $importer = new SkinImport();\r
2914                 \r
2915                 $error = $importer->readFile($skinFile);\r
2916                 \r
2917                 if ( $error )\r
2918                 {\r
2919                         self::error($error);\r
2920                 }\r
2921                 \r
2922                 $error = $importer->writeToDatabase($allowOverwrite);\r
2923                 \r
2924                 if ( $error )\r
2925                 {\r
2926                         self::error($error);\r
2927                 }\r
2928                 \r
2929                 /* TODO: we should consider to use the other way insterad of this */\r
2930                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2931                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2932                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2933                 \r
2934                 self::pagehead();\r
2935                 self::$skin->parse('skiniedoimport');\r
2936                 self::pagefoot();\r
2937                 return;\r
2938         }\r
2939 \r
2940         /**\r
2941          * Admin::action_skinieexport()\r
2942          * \r
2943          * @param       void\r
2944          * @return      void\r
2945          */\r
2946         static private function action_skinieexport()\r
2947         {\r
2948                 global $member, $DIR_LIBS;\r
2949                 \r
2950                 $member->isAdmin() or self::disallow();\r
2951                 \r
2952                 // load skinie class\r
2953                 include_once($DIR_LIBS . 'skinie.php');\r
2954                 \r
2955                 $aSkins         = requestIntArray('skin');\r
2956                 $aTemplates     = requestIntArray('template');\r
2957                 \r
2958                 if ( !is_array($aTemplates) )\r
2959                 {\r
2960                         $aTemplates = array();\r
2961                 }\r
2962                 if ( !is_array($aSkins) )\r
2963                 {\r
2964                         $aSkins = array();\r
2965                 }\r
2966                 \r
2967                 $skinList               = array_keys($aSkins);\r
2968                 $templateList   = array_keys($aTemplates);\r
2969                 \r
2970                 $info = postVar('info');\r
2971                 \r
2972                 $exporter = new SkinExport();\r
2973                 foreach ( $skinList as $skinId )\r
2974                 {\r
2975                         $exporter->addSkin($skinId);\r
2976                 }\r
2977                 foreach ($templateList as $templateId)\r
2978                 {\r
2979                         $exporter->addTemplate($templateId);\r
2980                 }\r
2981                 $exporter->setInfo($info);\r
2982                 \r
2983                 $exporter->export();\r
2984                 return;\r
2985         }\r
2986         \r
2987         /**\r
2988          * Admin::action_templateoverview()\r
2989          * \r
2990          * @param       void\r
2991          * @return      void\r
2992          */\r
2993         static private function action_templateoverview()\r
2994         {\r
2995                 global $member, $manager;\r
2996                 \r
2997                 $member->isAdmin() or self::disallow();\r
2998                 \r
2999                 self::pagehead();\r
3000                 self::$skin->parse('templateoverview');\r
3001                 self::pagefoot();\r
3002                 return;\r
3003         }\r
3004         \r
3005         /**\r
3006          * Admin::action_templateedit()\r
3007          * \r
3008          * @param       string  $msg    message for pageheader\r
3009          * @return      void\r
3010          */\r
3011         static private function action_templateedit($msg = '')\r
3012         {\r
3013                 global $member, $manager;\r
3014                 if ( $msg )\r
3015                 {\r
3016                         self::$headMess = $msg;\r
3017                 }\r
3018                 \r
3019                 $templateid = intRequestVar('templateid');\r
3020                 \r
3021                 $member->isAdmin() or self::disallow();\r
3022                 \r
3023                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3024                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3025                 \r
3026                 self::pagehead($extrahead);\r
3027                 self::$skin->parse('templateedit');\r
3028                 self::pagefoot();\r
3029                 return;\r
3030         }\r
3031         \r
3032         /**\r
3033          * TODO: remove this\r
3034          *\r
3035         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3036                 static $count = 1;\r
3037                 if (!isset($template[$name])) $template[$name] = '';\r
3038         ?>\r
3039                 </tr><tr>\r
3040                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3041                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3042         <?php       $count++;\r
3043         }\r
3044         */\r
3045         \r
3046         /**\r
3047          * Admin::action_templateupdate()\r
3048          * \r
3049          * @param       void\r
3050          * @return      void\r
3051          */\r
3052         static private function action_templateupdate()\r
3053         {\r
3054                 global $member,$manager;\r
3055                 \r
3056                 $templateid = intRequestVar('templateid');\r
3057                 \r
3058                 $member->isAdmin() or self::disallow();\r
3059                 \r
3060                 $name = postVar('tname');\r
3061                 $desc = postVar('tdesc');\r
3062                 \r
3063                 if ( !isValidTemplateName($name) )\r
3064                 {\r
3065                         self::error(_ERROR_BADTEMPLATENAME);\r
3066                 }\r
3067                 \r
3068                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3069                 {\r
3070                         self::error(_ERROR_DUPTEMPLATENAME);\r
3071                 }\r
3072                 \r
3073                 $name = sql_real_escape_string($name);\r
3074                 $desc = sql_real_escape_string($desc);\r
3075                 \r
3076                 // 1. Remove all template parts\r
3077                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3078                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3079                 sql_query($query);\r
3080                 \r
3081                 // 2. Update description\r
3082                 $query = "UPDATE %s SET tdname='%s', tddesc='%s' WHERE tdnumber=%d;";\r
3083                 $query = sprintf($query, sql_table('template_desc'), sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3084                 sql_query($query);\r
3085                 \r
3086                 // 3. Add non-empty template parts\r
3087                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3088                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3089                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3090                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3091                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3092                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3093                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3094                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3095                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3096                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3097                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3098                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3099                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3100                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3101                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3102                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3103                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3104                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3105                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3106                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3107                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3108                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3109                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3110                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3111                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3112                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3113                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3114                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3115                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3116                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3117                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3118                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3119                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3120                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3121                 \r
3122                 $data = array('fields' => array());\r
3123                 $manager->notify('TemplateExtraFields', $data);\r
3124                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3125                 {\r
3126                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3127                         {\r
3128                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3129                         }\r
3130                 }\r
3131                 \r
3132                 // jump back to template edit\r
3133                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3134                 return;\r
3135         }\r
3136         \r
3137         /**\r
3138          * Admin::addToTemplate()\r
3139          * \r
3140          * @param       Integer $id     ID for template\r
3141          * @param       String  $partname       parts name\r
3142          * @param       String  $content        template contents\r
3143          * @return      Integer record index\r
3144          * \r
3145          */\r
3146         static private function addToTemplate($id, $partname, $content)\r
3147         {\r
3148                 // don't add empty parts:\r
3149                 if ( !trim($content) )\r
3150                 {\r
3151                         return -1;\r
3152                 }\r
3153                 \r
3154                 $partname = sql_real_escape_string($partname);\r
3155                 $content  = sql_real_escape_string($content);\r
3156                 \r
3157                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3158                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3159                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3160                 return sql_insert_id();\r
3161         }\r
3162         \r
3163         /**\r
3164          * Admin::action_templatedelete()\r
3165          * \r
3166          * @param       void\r
3167          * @return      void\r
3168          */\r
3169         static private function action_templatedelete()\r
3170         {\r
3171                 global $member, $manager;\r
3172                 \r
3173                 $member->isAdmin() or self::disallow();\r
3174                 \r
3175                 $templateid = intRequestVar('templateid');\r
3176                 // TODO: check if template can be deleted\r
3177                 \r
3178                 self::pagehead();\r
3179                 self::$skin->parse('templatedelete');\r
3180                 self::pagefoot();\r
3181                 return;\r
3182         }\r
3183         \r
3184         /**\r
3185          * Admin::action_templatedeleteconfirm()\r
3186          * \r
3187          * @param       void\r
3188          * @return      void\r
3189          */\r
3190         static private function action_templatedeleteconfirm()\r
3191         {\r
3192                 global $member, $manager;\r
3193                 \r
3194                 $templateid = intRequestVar('templateid');\r
3195                 \r
3196                 $member->isAdmin() or self::disallow();\r
3197                 \r
3198                 $data = array('templateid' => $templateid);\r
3199                 $manager->notify('PreDeleteTemplate', $data);\r
3200                 \r
3201                 // 1. delete description\r
3202                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3203                 \r
3204                 // 2. delete parts\r
3205                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3206                 \r
3207                 \r
3208                 $data = array('templateid' => $templateid);\r
3209                 $manager->notify('PostDeleteTemplate', $data);\r
3210                 \r
3211                 self::action_templateoverview();\r
3212                 return;\r
3213         }\r
3214         \r
3215         /**\r
3216          * Admin::action_templatenew()\r
3217          * \r
3218          * @param       void\r
3219          * @return      void\r
3220          */\r
3221         static private function action_templatenew()\r
3222         {\r
3223                 global $member;\r
3224                 \r
3225                 $member->isAdmin() or self::disallow();\r
3226                 \r
3227                 $name = postVar('name');\r
3228                 $desc = postVar('desc');\r
3229                 \r
3230                 if ( !isValidTemplateName($name) )\r
3231                 {\r
3232                         self::error(_ERROR_BADTEMPLATENAME);\r
3233                 }\r
3234                 \r
3235                 if ( Template::exists($name) )\r
3236                 {\r
3237                         self::error(_ERROR_DUPTEMPLATENAME);\r
3238                 }\r
3239                 \r
3240                 $newTemplateId = Template::createNew($name, $desc);\r
3241                 \r
3242                 self::action_templateoverview();\r
3243                 return;\r
3244         }\r
3245         \r
3246         /**\r
3247          * Admin::action_templateclone()\r
3248          * \r
3249          * @param       void\r
3250          * @return      void\r
3251          */\r
3252         static private function action_templateclone()\r
3253         {\r
3254                 global $member;\r
3255                 \r
3256                 $templateid = intRequestVar('templateid');\r
3257                 \r
3258                 $member->isAdmin() or self::disallow();\r
3259                 \r
3260                 // 1. read old template\r
3261                 $name = Template::getNameFromId($templateid);\r
3262                 $desc = Template::getDesc($templateid);\r
3263                 \r
3264                 // 2. create desc thing\r
3265                 $name = "cloned" . $name;\r
3266                 \r
3267                 // if a template with that name already exists:\r
3268                 if ( Template::exists($name) )\r
3269                 {\r
3270                         $i = 1;\r
3271                         while (Template::exists($name . $i))\r
3272                         {\r
3273                                 $i++;\r
3274                         }\r
3275                         $name .= $i;\r
3276                 }\r
3277                 \r
3278                 $newid = Template::createNew($name, $desc);\r
3279                 \r
3280                 // 3. create clone\r
3281                 // go through parts of old template and add them to the new one\r
3282                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3283                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3284                 \r
3285                 $res = sql_query($query);\r
3286                 while ( $o = sql_fetch_object($res) )\r
3287                 {\r
3288                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3289                 }\r
3290                 \r
3291                 self::action_templateoverview();\r
3292                 return;\r
3293         }\r
3294         \r
3295         /**\r
3296          * Admin::action_admintemplateoverview()\r
3297          * \r
3298          * @param       void\r
3299          * @return      void\r
3300          */\r
3301         static private function action_admintemplateoverview()\r
3302         {\r
3303                 global $member, $manager;\r
3304                 $member->isAdmin() or self::disallow();\r
3305                 self::pagehead();\r
3306                 self::$skin->parse('admntemplateoverview');\r
3307                 self::pagefoot();\r
3308                 return;\r
3309         }\r
3310         \r
3311         /**\r
3312          * Admin::action_admintemplateedit()\r
3313          * \r
3314          * @param       string  $msg    message for pageheader\r
3315          * @return      void\r
3316          */\r
3317         static private function action_admintemplateedit($msg = '')\r
3318         {\r
3319                 global $member, $manager;\r
3320                 if ( $msg )\r
3321                 {\r
3322                         self::$headMess = $msg;\r
3323                 }\r
3324                 $member->isAdmin() or self::disallow();\r
3325                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3326                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3327                 self::pagehead($extrahead);\r
3328                 self::$skin->parse('admintemplateedit');\r
3329                 self::pagefoot();\r
3330                 return;\r
3331         }\r
3332         \r
3333         /**\r
3334          * Admin::action_admintemplateupdate()\r
3335          * \r
3336          * @param       void\r
3337          * @return      void\r
3338          */\r
3339         static private function action_admintemplateupdate()\r
3340         {\r
3341                 global $member, $manager;\r
3342                 $templateid = intRequestVar('templateid');\r
3343                 $member->isAdmin() or self::disallow();\r
3344                 $name = postVar('tname');\r
3345                 $desc = postVar('tdesc');\r
3346                 \r
3347                 if ( !isValidTemplateName($name) )\r
3348                 {\r
3349                         self::error(_ERROR_BADTEMPLATENAME);\r
3350                 }\r
3351                 \r
3352                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3353                 {\r
3354                         self::error(_ERROR_DUPTEMPLATENAME);\r
3355                 }\r
3356                 $name = sql_real_escape_string($name);\r
3357                 $desc = sql_real_escape_string($desc);\r
3358                 \r
3359                 // 1. Remove all template parts\r
3360                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3361                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3362                 sql_query($query);\r
3363                 \r
3364                 // 2. Update description\r
3365                 $query = "UPDATE %s SET tdname='%s', tddesc='%s' WHERE tdnumber=%d;";\r
3366                 $query = sprintf($query, sql_table('template_desc'), sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3367                 sql_query($query);\r
3368                 \r
3369                 // 3. Add non-empty template parts\r
3370                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3371                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3372                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3376                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3377                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3378                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3379                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3380                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3381                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3382                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3383                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3384                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3385                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3386                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3387                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3388                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3389                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3390                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3391                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3392                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3393                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3394                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3395                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3396                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3397                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3398                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3471                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3472                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3473                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3474                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3475                 \r
3476                 $data = array('fields' => array());\r
3477                 $manager->notify('TemplateExtraFields', $data);\r
3478                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3479                 {\r
3480                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3481                         {\r
3482                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3483                         }\r
3484                 }\r
3485                 \r
3486                 // jump back to template edit\r
3487                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3488                 return;\r
3489         }\r
3490         \r
3491         /**\r
3492          * Admin::addToAdminTemplate()\r
3493          * \r
3494          * @param       integer $id                     ID for template\r
3495          * @param       string  $partname       name of part for template\r
3496          * @param       void    $contents       content for part of template\r
3497          * @return      integer ID for newly inserted Template\r
3498          */\r
3499         static private function addToAdminTemplate($id, $partname, $content)\r
3500         {\r
3501                 // don't add empty parts:\r
3502                 if ( !trim($content) )\r
3503                 {\r
3504                         return -1;\r
3505                 }\r
3506                 \r
3507                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3508                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($content));\r
3509                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3510                 return sql_insert_id();\r
3511         }\r
3512         \r
3513         /**\r
3514          * Admin::action_admintemplatedelete()\r
3515          * \r
3516          * @param       void\r
3517          * @return      void\r
3518          */\r
3519         static private function action_admintemplatedelete()\r
3520         {\r
3521                 global $member, $manager;\r
3522                 $member->isAdmin() or self::disallow();\r
3523                 \r
3524                 // TODO: check if template can be deleted\r
3525                 self::pagehead();\r
3526                 self::$skin->parse('admintemplatedelete');\r
3527                 self::pagefoot();\r
3528                 return;\r
3529         }\r
3530         \r
3531         /**\r
3532          * Admin::action_admintemplatedeleteconfirm()\r
3533          * \r
3534          * @param       void\r
3535          * @return      void\r
3536          */\r
3537         static private function action_admintemplatedeleteconfirm()\r
3538         {\r
3539                 global $member, $manager;\r
3540                 \r
3541                 $templateid = intRequestVar('templateid');\r
3542                 $member->isAdmin() or self::disallow();\r
3543                 \r
3544                 $data = array('templateid' => $templateid);\r
3545                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3546                 \r
3547                 // 1. delete description\r
3548                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3549                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3550                 sql_query($query);\r
3551                 \r
3552                 // 2. delete parts\r
3553                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3554                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3555                 sql_query($query);\r
3556                 \r
3557                 $data = array('templateid' => $templateid);\r
3558                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3559                 \r
3560                 self::action_admintemplateoverview();\r
3561                 return;\r
3562         }\r
3563         \r
3564         /**\r
3565          * Admin::action_admintemplatenew()\r
3566          * \r
3567          * @param       void\r
3568          * @return      void\r
3569          */\r
3570         static private function action_admintemplatenew()\r
3571         {\r
3572                 global $member;\r
3573                 $member->isAdmin() or self::disallow();\r
3574                 $name = postVar('name');\r
3575                 $desc = postVar('desc');\r
3576                 \r
3577                 if ( !isValidTemplateName($name) )\r
3578                 {\r
3579                         self::error(_ERROR_BADTEMPLATENAME);\r
3580                 }\r
3581                 else if ( !preg_match('#^admin/#', $name) )\r
3582                 {\r
3583                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3584                 }\r
3585                 else if ( Template::exists($name) )\r
3586                 {\r
3587                         self::error(_ERROR_DUPTEMPLATENAME);\r
3588                 }\r
3589                 \r
3590                 $newTemplateId = Template::createNew($name, $desc);\r
3591                 self::action_admintemplateoverview();\r
3592                 return;\r
3593         }\r
3594         \r
3595         /**\r
3596          * Admin::action_admintemplateclone()\r
3597          * \r
3598          * @param       void\r
3599          * @return      void\r
3600          */\r
3601         static private function action_admintemplateclone()\r
3602         {\r
3603                 global $member;\r
3604                 $templateid = intRequestVar('templateid');\r
3605                 $member->isAdmin() or self::disallow();\r
3606                 \r
3607                 // 1. read old template\r
3608                 $name = Template::getNameFromId($templateid);\r
3609                 $desc = Template::getDesc($templateid);\r
3610                 \r
3611                 // 2. create desc thing\r
3612                 $name = $name . "cloned";\r
3613                 \r
3614                 // if a template with that name already exists:\r
3615                 if ( Template::exists($name) )\r
3616                 {\r
3617                         $i = 1;\r
3618                         while ( Template::exists($name . $i) )\r
3619                         {\r
3620                                 $i++;\r
3621                         }\r
3622                         $name .= $i;\r
3623                 }\r
3624                 \r
3625                 $newid = Template::createNew($name, $desc);\r
3626                 \r
3627                 // 3. create clone\r
3628                 // go through parts of old template and add them to the new one\r
3629                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3630                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3631                 \r
3632                 $res = sql_query($query);\r
3633                 while ( $o = sql_fetch_object($res) )\r
3634                 {\r
3635                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3636                 }\r
3637                 \r
3638                 self::action_admintemplateoverview();\r
3639                 return;\r
3640         }\r
3641 \r
3642         /**\r
3643          * Admin::action_skinoverview()\r
3644          * \r
3645          * @param       void\r
3646          * @return      void\r
3647          */\r
3648         static private function action_skinoverview()\r
3649         {\r
3650                 global $member, $manager;\r
3651                 \r
3652                 $member->isAdmin() or self::disallow();\r
3653                 \r
3654                 self::pagehead();\r
3655                 self::$skin->parse('skinoverview');\r
3656                 self::pagefoot();\r
3657                 return;\r
3658         }\r
3659         \r
3660         /**\r
3661          * Admin::action_skinnew()\r
3662          * \r
3663          * @param       void\r
3664          * @return      void\r
3665          */\r
3666         static private function action_skinnew()\r
3667         {\r
3668                 global $member;\r
3669                 \r
3670                 $member->isAdmin() or self::disallow();\r
3671                 \r
3672                 $name = trim(postVar('name'));\r
3673                 $desc = trim(postVar('desc'));\r
3674                 \r
3675                 if ( !isValidSkinName($name) )\r
3676                 {\r
3677                         self::error(_ERROR_BADSKINNAME);\r
3678                 }\r
3679                 \r
3680                 if ( SKIN::exists($name) )\r
3681                 {\r
3682                         self::error(_ERROR_DUPSKINNAME);\r
3683                 }\r
3684                 \r
3685                 $newId = SKIN::createNew($name, $desc);\r
3686                 \r
3687                 self::action_skinoverview();\r
3688                 return;\r
3689         }\r
3690         \r
3691         /**\r
3692          * Admin::action_skinedit()\r
3693          * \r
3694          * @param       void\r
3695          * @return      void\r
3696          */\r
3697         static private function action_skinedit()\r
3698         {\r
3699                 global $member, $manager;\r
3700                 \r
3701                 $member->isAdmin() or self::disallow();\r
3702                 \r
3703                 self::pagehead();\r
3704                 self::$skin->parse('skinedit');\r
3705                 self::pagefoot();\r
3706                 return;\r
3707         }\r
3708         \r
3709         /**\r
3710          * Admin::action_skineditgeneral()\r
3711          * \r
3712          * @param       void\r
3713          * @return      void\r
3714          */\r
3715         static private function action_skineditgeneral()\r
3716         {\r
3717                 global $member;\r
3718                 \r
3719                 $skinid = intRequestVar('skinid');\r
3720                 \r
3721                 $member->isAdmin() or self::disallow();\r
3722                 \r
3723                 $name           = postVar('name');\r
3724                 $desc           = postVar('desc');\r
3725                 $type           = postVar('type');\r
3726                 $inc_mode       = postVar('inc_mode');\r
3727                 $inc_prefix     = postVar('inc_prefix');\r
3728                 \r
3729                 $skin = new Skin($skinid);\r
3730                 \r
3731                 // 1. Some checks\r
3732                 if ( !isValidSkinName($name) )\r
3733                 {\r
3734                         self::error(_ERROR_BADSKINNAME);\r
3735                 }\r
3736                 \r
3737                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3738                 {\r
3739                         self::error(_ERROR_DUPSKINNAME);\r
3740                 }\r
3741                 \r
3742                 if ( !$type )\r
3743                 {\r
3744                         $type = 'text/html';\r
3745                 }\r
3746                 if ( !$inc_mode )\r
3747                 {\r
3748                         $inc_mode = 'normal';\r
3749                 }\r
3750                 \r
3751                 // 2. Update description\r
3752                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3753                 \r
3754                 self::action_skinedit();\r
3755                 return;\r
3756         }\r
3757         \r
3758         static private function action_skinedittype($msg = '')\r
3759         {\r
3760                 global $member, $manager;\r
3761                 \r
3762                 $member->isAdmin() or self::disallow();\r
3763                 \r
3764                 if ( $msg )\r
3765                 {\r
3766                         self::$headMess = $msg;\r
3767                 }\r
3768                 \r
3769                 $skinid = intRequestVar('skinid');\r
3770                 $type   = requestVar('type');\r
3771                 $type   = trim($type);\r
3772                 $type   = strtolower($type);\r
3773                 \r
3774                 if ( !isValidShortName($type) )\r
3775                 {\r
3776                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3777                 }\r
3778                 \r
3779                 self::pagehead();\r
3780                 self::$skin->parse('skinedittype');\r
3781                 self::pagefoot();\r
3782                 return;\r
3783         }\r
3784         \r
3785         /**\r
3786          * Admin::action_skinupdate()\r
3787          * \r
3788          * @param       void\r
3789          * @return      void\r
3790          */\r
3791         static private function action_skinupdate()\r
3792         {\r
3793                 global $member;\r
3794                 \r
3795                 $skinid = intRequestVar('skinid');\r
3796                 $content = trim(postVar('content'));\r
3797                 $type = postVar('type');\r
3798                 \r
3799                 $member->isAdmin() or self::disallow();\r
3800                 \r
3801                 $skin = new SKIN($skinid);\r
3802                 $skin->update($type, $content);\r
3803                 \r
3804                 self::action_skinedittype(_SKIN_UPDATED);\r
3805                 return;\r
3806         }\r
3807         \r
3808         /**\r
3809          * Admin::action_skindelete()\r
3810          * \r
3811          * @param       void\r
3812          * @return      void\r
3813          */\r
3814         static private function action_skindelete()\r
3815         {\r
3816                 global $member, $manager, $CONF;\r
3817                 \r
3818                 $skinid = intRequestVar('skinid');\r
3819                 \r
3820                 $member->isAdmin() or self::disallow();\r
3821                 \r
3822                 // don't allow default skin to be deleted\r
3823                 if ( $skinid == $CONF['BaseSkin'] )\r
3824                 {\r
3825                         self::error(_ERROR_DEFAULTSKIN);\r
3826                 }\r
3827                 \r
3828                 // don't allow deletion of default skins for blogs\r
3829                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3830                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3831                 \r
3832                 $r = sql_query($query);\r
3833                 if ( $o = sql_fetch_object($r) )\r
3834                 {\r
3835                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3836                 }\r
3837                 \r
3838                 self::pagehead();\r
3839                 self::$skin->parse('skindelete');\r
3840                 self::pagefoot();\r
3841                 return;\r
3842         }\r
3843         \r
3844         /**\r
3845          * Admin::action_skindeleteconfirm()\r
3846          * \r
3847          * @param       void\r
3848          * @return      void\r
3849          */\r
3850         static private function action_skindeleteconfirm()\r
3851         {\r
3852                 global $member, $CONF, $manager;\r
3853                 \r
3854                 $skinid = intRequestVar('skinid');\r
3855                 \r
3856                 $member->isAdmin() or self::disallow();\r
3857                 \r
3858                 // don't allow default skin to be deleted\r
3859                 if ( $skinid == $CONF['BaseSkin'] )\r
3860                 {\r
3861                         self::error(_ERROR_DEFAULTSKIN);\r
3862                 }\r
3863                 \r
3864                 // don't allow deletion of default skins for blogs\r
3865                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3866                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3867                 \r
3868                 $r = sql_query($query);\r
3869                 if ( $o = sql_fetch_object($r) )\r
3870                 {\r
3871                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3872                 }\r
3873                 \r
3874                 $data = array('skinid' => $skinid);\r
3875                 $manager->notify('PreDeleteSkin', $data);\r
3876                 \r
3877                 // 1. delete description\r
3878                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3879                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3880                 sql_query($query);\r
3881                 \r
3882                 // 2. delete parts\r
3883                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3884                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3885                 sql_query($query);\r
3886                 \r
3887                 $data = array('skinid' => $skinid);\r
3888                 $manager->notify('PostDeleteSkin', $data);\r
3889                 \r
3890                 self::action_skinoverview();\r
3891                 return;\r
3892         }\r
3893         \r
3894         /**\r
3895          * Admin::action_skinremovetype()\r
3896          * \r
3897          * @param       void\r
3898          * @return      void\r
3899          */\r
3900         static private function action_skinremovetype()\r
3901         {\r
3902                 global $member, $manager, $CONF;\r
3903                 \r
3904                 $member->isAdmin() or self::disallow();\r
3905                 \r
3906                 $skinid = intRequestVar('skinid');\r
3907                 $skintype = requestVar('type');\r
3908                 \r
3909                 if ( !isValidShortName($skintype) )\r
3910                 {\r
3911                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3912                 }\r
3913                 \r
3914                 // don't allow default skinparts to be deleted\r
3915                 /* TODO: this array should be retrieved from Action class */\r
3916                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3917                 {\r
3918                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3919                 }\r
3920                 \r
3921                 self::pagehead();\r
3922                 self::$skin->parse('skinremovetype');\r
3923                 self::pagefoot();\r
3924                 return;\r
3925         }\r
3926         \r
3927         /**\r
3928          * Admin::action_skinremovetypeconfirm()\r
3929          * \r
3930          * @param       void\r
3931          * @return      void\r
3932          */\r
3933         static private function action_skinremovetypeconfirm()\r
3934         {\r
3935                 global $member, $CONF, $manager;\r
3936                 \r
3937                 $member->isAdmin() or self::disallow();\r
3938                 \r
3939                 $skinid = intRequestVar('skinid');\r
3940                 $skintype = requestVar('type');\r
3941                 \r
3942                 if ( !isValidShortName($skintype) )\r
3943                 {\r
3944                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3945                 }\r
3946                 \r
3947                 // don't allow default skinparts to be deleted\r
3948                 /* TODO: this array should be retrieved from Action class */\r
3949                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3950                 {\r
3951                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3952                 }\r
3953                 \r
3954                 $data = array(\r
3955                         'skinid'   => $skinid,\r
3956                         'skintype' => $skintype\r
3957                 );\r
3958                 $manager->notify('PreDeleteSkinPart', $data);\r
3959                 \r
3960                 // delete part\r
3961                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3962                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3963                 sql_query($query);\r
3964                 \r
3965                 $data = array(\r
3966                         'skinid'   => $skinid,\r
3967                         'skintype' => $skintype\r
3968                 );\r
3969                 $manager->notify('PostDeleteSkinPart', $data);\r
3970                 \r
3971                 self::action_skinedit();\r
3972                 return;\r
3973         }\r
3974 \r
3975         /**\r
3976          * Admin::action_skinclone()\r
3977          * \r
3978          * @param       void\r
3979          * @return      void\r
3980          */\r
3981         static private function action_skinclone()\r
3982         {\r
3983                 global $member;\r
3984                 \r
3985                 $member->isAdmin() or self::disallow();\r
3986                 \r
3987                 $skinid = intRequestVar('skinid');\r
3988                 \r
3989                 // 1. read skin to clone\r
3990                 $skin = new Skin($skinid);\r
3991                 \r
3992                 $name = "{$skin->getName()}_clone";\r
3993                 \r
3994                 // if a skin with that name already exists:\r
3995                 if ( Skin::exists($name) )\r
3996                 {\r
3997                         $i = 1;\r
3998                         while ( Skin::exists($name . $i) )\r
3999                         {\r
4000                                 $i++;\r
4001                         }\r
4002                         $name .= $i;\r
4003                 }\r
4004                 \r
4005                 // 2. create skin desc\r
4006                 $newid = Skin::createNew(\r
4007                         $name,\r
4008                         $skin->getDescription(),\r
4009                         $skin->getContentType(),\r
4010                         $skin->getIncludeMode(),\r
4011                         $skin->getIncludePrefix()\r
4012                 );\r
4013                 \r
4014                 // 3. clone\r
4015                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4016                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4017                 \r
4018                 $res = sql_query($query);\r
4019                 while ( $row = sql_fetch_assoc($res) )\r
4020                 {\r
4021                         self::skinclonetype($skin, $newid, $row['stype']);\r
4022                 }\r
4023                 \r
4024                 self::action_skinoverview();\r
4025                 return;\r
4026         }\r
4027         \r
4028         /**\r
4029          * Admin::skinclonetype()\r
4030          * \r
4031          * @param       String  $skin   Skin object\r
4032          * @param       Integer $newid  ID for this clone\r
4033          * @param       String  $type   type of skin\r
4034          * @return      Void\r
4035          */\r
4036         static private function skinclonetype($skin, $newid, $type)\r
4037         {\r
4038                 $newid = intval($newid);\r
4039                 $content = $skin->getContentFromDB($type);\r
4040                 \r
4041                 if ( $content )\r
4042                 {\r
4043                         $content = sql_real_escape_string($content);\r
4044                         $type = sql_real_escape_string($type);\r
4045                         \r
4046                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4047                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4048                         sql_query($query);\r
4049                 }\r
4050                 return;\r
4051         }\r
4052         \r
4053         /**\r
4054          * Admin::action_adminskinoverview()\r
4055          * \r
4056          * @param       void\r
4057          * @return      void\r
4058          */\r
4059         static private function action_adminskinoverview()\r
4060         {\r
4061                 global $member, $manager;\r
4062                 \r
4063                 $member->isAdmin() or self::disallow();\r
4064                 \r
4065                 self::pagehead();\r
4066                 self::$skin->parse('adminskinoverview');\r
4067                 self::pagefoot();\r
4068                 return;\r
4069         }\r
4070         \r
4071         /**\r
4072          * Admin::action_adminskinnew()\r
4073          * \r
4074          * @param       void\r
4075          * @return      void\r
4076          */\r
4077         static private function action_adminskinnew()\r
4078         {\r
4079                 global $member;\r
4080                 $member->isAdmin() or self::disallow();\r
4081                 $name = trim(postVar('name'));\r
4082                 $desc = trim(postVar('desc'));\r
4083                 \r
4084                 if ( !isValidSkinName($name) )\r
4085                 {\r
4086                         self::error(_ERROR_BADSKINNAME);\r
4087                 }\r
4088                 else if ( !preg_match('#^admin/#', $name) )\r
4089                 {\r
4090                         self::error(_ERROR_BADADMINSKINNAME);\r
4091                 }\r
4092                 else if ( Skin::exists($name) )\r
4093                 {\r
4094                         self::error(_ERROR_DUPSKINNAME);\r
4095                 }\r
4096                 /* TODO: $newId is not reused... */\r
4097                 $newId = Skin::createNew($name, $desc);\r
4098                 self::action_adminskinoverview();\r
4099                 return;\r
4100         }\r
4101         \r
4102         /**\r
4103          * Admin::action_adminskinedit()\r
4104          * \r
4105          * @param       void\r
4106          * @return      void\r
4107          */\r
4108         static private function action_adminskinedit()\r
4109         {\r
4110                 global $member, $manager;\r
4111                 \r
4112                 $member->isAdmin() or self::disallow();\r
4113                 self::pagehead();\r
4114                 self::$skin->parse('adminskinedit');\r
4115                 self::pagefoot();\r
4116                 return;\r
4117         }\r
4118         \r
4119         /**\r
4120          * Admin::action_adminskineditgeneral()\r
4121          * \r
4122          * @param       void\r
4123          * @return      void\r
4124          */\r
4125         static private function action_adminskineditgeneral()\r
4126         {\r
4127                 global $member;\r
4128                 \r
4129                 $skinid = intRequestVar('skinid');\r
4130                 \r
4131                 $member->isAdmin() or self::disallow();\r
4132                 \r
4133                 $name           = postVar('name');\r
4134                 $desc           = postVar('desc');\r
4135                 $type           = postVar('type');\r
4136                 $inc_mode       = postVar('inc_mode');\r
4137                 $inc_prefix     = postVar('inc_prefix');\r
4138                 \r
4139                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4140                 \r
4141                 // 1. Some checks\r
4142                 if ( !isValidSkinName($name) )\r
4143                 {\r
4144                         self::error(_ERROR_BADSKINNAME);\r
4145                 }\r
4146                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4147                 {\r
4148                         self::error(_ERROR_DUPSKINNAME);\r
4149                 }\r
4150                 if ( !$type )\r
4151                 {\r
4152                         $type = 'text/html';\r
4153                 }\r
4154                 if ( !$inc_mode )\r
4155                 {\r
4156                         $inc_mode = 'normal';\r
4157                 }\r
4158                 // 2. Update description\r
4159                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4160                 self::action_adminskinedit();\r
4161                 return;\r
4162         }\r
4163         \r
4164         /**\r
4165          * Admin::action_adminskinedittype()\r
4166          * \r
4167          * @param       string  $msg    message for pageheader\r
4168          * @return      void\r
4169          */\r
4170         static private function action_adminskinedittype($msg = '')\r
4171         {\r
4172                 global $member, $manager;\r
4173                 \r
4174                 $member->isAdmin() or self::disallow();\r
4175                 \r
4176                 if ( $msg )\r
4177                 {\r
4178                         self::$headMess = $msg;\r
4179                 }\r
4180                 $type = requestVar('type');\r
4181                 $type = trim($type);\r
4182                 $type = strtolower($type);\r
4183                 \r
4184                 if ( !isValidShortName($type) )\r
4185                 {\r
4186                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4187                 }\r
4188                 \r
4189                 self::pagehead();\r
4190                 self::$skin->parse('adminskinedittype');\r
4191                 self::pagefoot();\r
4192                 return;\r
4193         }\r
4194         \r
4195         /**\r
4196          * Admin::action_adminskinupdate()\r
4197          * \r
4198          * @param       void\r
4199          * @return      void\r
4200          */\r
4201         static private function action_adminskinupdate()\r
4202         {\r
4203                 global $member;\r
4204                 $skinid         = intRequestVar('skinid');\r
4205                 $content        = trim(postVar('content'));\r
4206                 $type           = postVar('type');\r
4207                 \r
4208                 $member->isAdmin() or self::disallow();\r
4209                 \r
4210                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4211                 $skin->update($type, $content);\r
4212                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4213                 return;\r
4214         }\r
4215         \r
4216         /**\r
4217          * Admin::action_adminskindelete()\r
4218          * \r
4219          * @param       void\r
4220          * @return      void\r
4221          */\r
4222         static private function action_adminskindelete()\r
4223         {\r
4224                 global $member, $manager, $CONF;\r
4225                 $member->isAdmin() or self::disallow();\r
4226                 \r
4227                 /* TODO: needless variable $skinid... */\r
4228                 $skinid = intRequestVar('skinid');\r
4229                 self::pagehead();\r
4230                 self::$skin->parse('adminskindelete');\r
4231                 self::pagefoot();\r
4232                 return;\r
4233         }\r
4234 \r
4235         /**\r
4236          * Admin::action_adminskindeleteconfirm()\r
4237          * \r
4238          * @param       void\r
4239          * @return      void\r
4240          */\r
4241         static private function action_adminskindeleteconfirm()\r
4242         {\r
4243                 global $member, $CONF, $manager;\r
4244                 \r
4245                 $member->isAdmin() or self::disallow();\r
4246                 $skinid = intRequestVar('skinid');\r
4247                 \r
4248                 // don't allow default skin to be deleted\r
4249                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4250                 {\r
4251                         self::error(_ERROR_DEFAULTSKIN);\r
4252                 }\r
4253                 \r
4254                 /*\r
4255                  * TODO: NOT Implemented\r
4256                  *  don't allow deletion of default skins for members\r
4257                 $memberDefaults =  $member->getAdminSkin();\r
4258                 foreach ( $memberDefaults as $memID => $adminskin )\r
4259                 {\r
4260                         if ( $skinid == $adminskin )\r
4261                         {\r
4262                                 $mem = MEMBER::createFromID($memID);\r
4263                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4264                         }\r
4265                 }\r
4266                 */\r
4267                 \r
4268                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4269                 \r
4270                 // 1. delete description\r
4271                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4272                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4273                 sql_query($query);\r
4274                 \r
4275                 // 2. delete parts\r
4276                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4277                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4278                 \r
4279                 sql_query($query);\r
4280                 \r
4281                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4282                 self::action_adminskinoverview();\r
4283                 return;\r
4284         }\r
4285         \r
4286         /**\r
4287          * Admin::action_adminskinremovetype()\r
4288          * \r
4289          * @param       void\r
4290          * @return      void\r
4291          */\r
4292         static private function action_adminskinremovetype()\r
4293         {\r
4294                 global $member, $manager, $CONF;\r
4295 \r
4296                 $member->isAdmin() or self::disallow();\r
4297                 \r
4298                 $skinid         = intRequestVar('skinid');\r
4299                 $skintype       = requestVar('type');\r
4300                 \r
4301                 if ( !isValidShortName($skintype) )\r
4302                 {\r
4303                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4304                 }\r
4305                 \r
4306                 self::pagehead();\r
4307                 self::$skin->parse('adminskinremovetype');\r
4308                 self::pagefoot();\r
4309                 return;\r
4310         }\r
4311         \r
4312         /**\r
4313          * Admin::action_adminskinremovetypeconfirm()\r
4314          * \r
4315          * @param       void\r
4316          * @return      void\r
4317          */\r
4318         static private function action_adminskinremovetypeconfirm()\r
4319         {\r
4320                 global $member, $CONF, $manager;\r
4321                 \r
4322                 $member->isAdmin() or self::disallow();\r
4323                 \r
4324                 $skinid         = intRequestVar('skinid');\r
4325                 $skintype       = requestVar('type');\r
4326                 \r
4327                 if ( !isValidShortName($skintype) )\r
4328                 {\r
4329                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4330                 }\r
4331                 \r
4332                 $data =array(\r
4333                         'skinid'        => $skinid,\r
4334                         'skintype'      => $skintype\r
4335                 );\r
4336                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4337                 \r
4338                 // delete part\r
4339                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4340                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4341                 sql_query($query);\r
4342                 \r
4343                 $data = array(\r
4344                         'skinid'        => $skinid,\r
4345                         'skintype'      => $skintype\r
4346                 );\r
4347                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4348                 \r
4349                 self::action_adminskinedit();\r
4350                 return;\r
4351         }\r
4352 \r
4353         /**\r
4354          * Admin::action_adminskinclone()\r
4355          * \r
4356          * @param       void\r
4357          * @return      void\r
4358          */\r
4359         static private function action_adminskinclone()\r
4360         {\r
4361                 global $member;\r
4362                 \r
4363                 $member->isAdmin() or self::disallow();\r
4364                 \r
4365                 $skinid = intRequestVar('skinid');\r
4366                 \r
4367                 // 1. read skin to clone\r
4368                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4369                 $name = "{$skin->getName()}_clone";\r
4370                 \r
4371                 // if a skin with that name already exists:\r
4372                 if ( Skin::exists($name) )\r
4373                 {\r
4374                         $i = 1;\r
4375                         while ( Skin::exists($name . $i) )\r
4376                         {\r
4377                                 $i++;\r
4378                         }\r
4379                         $name .= $i;\r
4380                 }\r
4381                 \r
4382                 // 2. create skin desc\r
4383                 $newid = Skin::createNew(\r
4384                         $name,\r
4385                         $skin->getDescription(),\r
4386                         $skin->getContentType(),\r
4387                         $skin->getIncludeMode(),\r
4388                         $skin->getIncludePrefix()\r
4389                 );\r
4390                 \r
4391                 // 3. clone\r
4392                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4393                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4394                 \r
4395                 $res = sql_query($query);\r
4396                 while ( $row = sql_fetch_assoc($res) )\r
4397                 {\r
4398                         self::skinclonetype($skin, $newid, $row['stype']);\r
4399                 }\r
4400                 self::action_adminskinoverview();\r
4401                 return;\r
4402         }\r
4403         \r
4404         /**\r
4405          * Admin::adminskinclonetype()\r
4406          * \r
4407          * @param       string  $skin   an instance of Skin class\r
4408          * @param       integer $newid  ID for new skin\r
4409          * @param       string  $type   skin type\r
4410          * @return      void\r
4411          */\r
4412         static private function adminskinclonetype($skin, $newid, $type)\r
4413         {\r
4414                 $content = $skin->getContentFromDB($type);\r
4415                 \r
4416                 if ( $content )\r
4417                 {\r
4418                         $content        = sql_real_escape_string($content);\r
4419                         $type           = sql_real_escape_string($type);\r
4420                         \r
4421                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4422                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4423                         sql_query($query);\r
4424                 }\r
4425                 return;\r
4426         }\r
4427         \r
4428         /**\r
4429          * Admin::action_adminskinieoverview()\r
4430          * \r
4431          * @param       void\r
4432          * @return      void\r
4433          */\r
4434         static private function action_adminskinieoverview()\r
4435         {\r
4436                 global $member, $DIR_LIBS, $manager;\r
4437                 \r
4438                 $member->isAdmin() or self::disallow();\r
4439                 \r
4440                 // load skinie class\r
4441                 include_once($DIR_LIBS . 'skinie.php');\r
4442                 \r
4443                 self::pagehead();\r
4444                 self::$skin->parse('adminskinieoverview');\r
4445                 self::pagefoot();\r
4446                 return;\r
4447         }\r
4448 \r
4449         /**\r
4450          * Admin::action_adminskinieimport()\r
4451          * \r
4452          * @param       void\r
4453          * @return      void\r
4454          */\r
4455         static private function action_adminskinieimport()\r
4456         {\r
4457                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4458                 \r
4459                 $member->isAdmin() or self::disallow();\r
4460                 \r
4461                 // load skinie class\r
4462                 include_once($DIR_LIBS . 'skinie.php');\r
4463                 \r
4464                 $skinFileRaw    = postVar('skinfile');\r
4465                 $mode                   = postVar('mode');\r
4466                 \r
4467                 $importer = new SKINIMPORT();\r
4468                 \r
4469                 // get full filename\r
4470                 if ( $mode == 'file' )\r
4471                 {\r
4472                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4473                         \r
4474                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4475                         if ( !file_exists($skinFile) )\r
4476                         {\r
4477                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4478                         }\r
4479                 }\r
4480                 else\r
4481                 {\r
4482                         $skinFile = $skinFileRaw;\r
4483                 }\r
4484                 \r
4485                 // read only metadata\r
4486                 $error = $importer->readFile($skinFile, 1);\r
4487                 if ( $error )\r
4488                 {\r
4489                         self::error($error);\r
4490                 }\r
4491                 \r
4492                 /* TODO: we should consider to use the other way instead of this */\r
4493                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4494                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4495                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4496                 \r
4497                 // clashes\r
4498                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4499                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4500                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4501                 /* TODO: we should consider to use the other way instead of this */\r
4502                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4503                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4504                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4505                 \r
4506                 self::pagehead();\r
4507                 self::$skin->parse('adminskinieimport');\r
4508                 self::pagefoot();\r
4509                 return;\r
4510         }\r
4511         \r
4512         /**\r
4513          * Admin::action_adminskiniedoimport()\r
4514          * \r
4515          * @param       void\r
4516          * @return      void\r
4517          */\r
4518         static private function action_adminskiniedoimport()\r
4519         {\r
4520                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4521                 \r
4522                 $member->isAdmin() or self::disallow();\r
4523                 \r
4524                 // load skinie class\r
4525                 include_once($DIR_LIBS . 'skinie.php');\r
4526                 \r
4527                 $skinFileRaw    = postVar('skinfile');\r
4528                 $mode                   = postVar('mode');\r
4529                 $allowOverwrite = intPostVar('overwrite');\r
4530                 \r
4531                 // get full filename\r
4532                 if ( $mode == 'file' )\r
4533                 {\r
4534                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4535                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4536                         if ( !file_exists($skinFile) )\r
4537                         {\r
4538                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4539                         }\r
4540                 }\r
4541                 else\r
4542                 {\r
4543                         $skinFile = $skinFileRaw;\r
4544                 }\r
4545                 \r
4546                 $importer = new SKINIMPORT();\r
4547                 \r
4548                 $error = $importer->readFile($skinFile);\r
4549                 if ( $error )\r
4550                 {\r
4551                         self::error($error);\r
4552                 }\r
4553                 \r
4554                 $error = $importer->writeToDatabase($allowOverwrite);\r
4555                 if ( $error )\r
4556                 {\r
4557                         self::error($error);\r
4558                 }\r
4559                 \r
4560                 /* TODO: we should consider to use the other way instead of this */\r
4561                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4562                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4563                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4564                 \r
4565                 self::pagehead();\r
4566                 self::$skin->parse('adminskiniedoimport');\r
4567                 self::pagefoot();\r
4568                 return;\r
4569         }\r
4570 \r
4571         /**\r
4572          * Admin::action_adminskinieexport()\r
4573          * \r
4574          * @param       void\r
4575          * @return      void\r
4576          */\r
4577         static private function action_adminskinieexport()\r
4578         {\r
4579                 global $member, $DIR_PLUGINS;\r
4580                 \r
4581                 $member->isAdmin() or self::disallow();\r
4582                 \r
4583                 // load skinie class\r
4584                 $aSkins = requestIntArray('skin');\r
4585                 if (!is_array($aSkins)) {\r
4586                         $aSkins = array();\r
4587                 }\r
4588                 $skinList = array_keys($aSkins);\r
4589                 \r
4590                 $aTemplates = requestIntArray('template');\r
4591                 if (!is_array($aTemplates))\r
4592                 {\r
4593                         $aTemplates = array();\r
4594                 }\r
4595                 $templateList = array_keys($aTemplates);\r
4596                 \r
4597                 $info = postVar('info');\r
4598                 \r
4599                 include_libs('skinie.php');\r
4600                 $exporter = new SkinExport();\r
4601                 foreach ( $skinList as $skinId )\r
4602                 {\r
4603                         $exporter->addSkin($skinId);\r
4604                 }\r
4605                 foreach ( $templateList as $templateId )\r
4606                 {\r
4607                         $exporter->addTemplate($templateId);\r
4608                 }\r
4609                 $exporter->setInfo($info);\r
4610                 $exporter->export();\r
4611                 return;\r
4612         }\r
4613         \r
4614         /**\r
4615          * Admin::action_settingsedit()\r
4616          * \r
4617          * @param       Void\r
4618          * @return      Void\r
4619          */\r
4620         static private function action_settingsedit()\r
4621         {\r
4622                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4623                 \r
4624                 $member->isAdmin() or self::disallow();\r
4625                 \r
4626                 self::pagehead();\r
4627                 self::$skin->parse('settingsedit');\r
4628                 self::pagefoot();\r
4629                 return;\r
4630         }\r
4631         \r
4632         /**\r
4633          * Admin::action_settingsupdate()\r
4634          * Update $CONFIG and redirect\r
4635          * \r
4636          * @param       void\r
4637          * @return      void\r
4638          */\r
4639         static private function action_settingsupdate()\r
4640         {\r
4641                 global $member, $CONF;\r
4642                 \r
4643                 $member->isAdmin() or self::disallow();\r
4644                 \r
4645                 // check if email address for admin is valid\r
4646                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4647                 {\r
4648                         self::error(_ERROR_BADMAILADDRESS);\r
4649                 }\r
4650                 \r
4651                 // save settings\r
4652                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4653                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4654                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4655                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4656                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4657                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4658                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4659                 self::updateConfig('Locale',                    postVar('Locale'));\r
4660                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4661                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4662                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4663                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4664                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4665                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4666                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4667                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4668                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4669                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4670                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4671                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4672                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4673                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4674                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4675                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4676                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4677                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4678                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4679                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4680                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4681                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4682                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4683                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4684                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4685                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4686                 \r
4687                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4688                 // note that when changing cookie settings, this redirect might cause the user\r
4689                 // to have to log in again.\r
4690                 getConfig();\r
4691                 redirect($CONF['AdminURL'] . '?action=manage');\r
4692                 return;\r
4693         }\r
4694         \r
4695         /**\r
4696          * Admin::action_systemoverview()\r
4697          * Output system overview\r
4698          * \r
4699          * @param       void\r
4700          * @return      void\r
4701          */\r
4702         static private function action_systemoverview()\r
4703         {\r
4704                 self::pagehead();\r
4705                 self::$skin->parse('systemoverview');\r
4706                 self::pagefoot();\r
4707                 return;\r
4708         }\r
4709         \r
4710         /**\r
4711          * Admin::updateConfig()\r
4712          * \r
4713          * @param       string  $name   \r
4714          * @param       string  $val    \r
4715          * @return      integer return the ID in which the latest query posted\r
4716          */\r
4717         static private function updateConfig($name, $val)\r
4718         {\r
4719                 $name = sql_real_escape_string($name);\r
4720                 $val = trim(sql_real_escape_string($val));\r
4721                 \r
4722                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4723                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4724                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4725                 return sql_insert_id();\r
4726         }\r
4727         \r
4728         /**\r
4729          * Admin::error()\r
4730          * Error message\r
4731          * \r
4732          * @param       string  $msg    message that will be shown\r
4733          * @return      void\r
4734          */\r
4735         static private function error($msg)\r
4736         {\r
4737                 self::$headMess = $msg;\r
4738                 self::pagehead();\r
4739                 self::$skin->parse('adminerrorpage');\r
4740                 self::pagefoot();\r
4741                 return;\r
4742         }\r
4743         \r
4744         /**\r
4745          * Admin::disallow()\r
4746          * add error log and show error page \r
4747          * \r
4748          * @param       void\r
4749          * @return      void\r
4750          */\r
4751         static private function disallow()\r
4752         {\r
4753                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4754                 self::error(_ERROR_DISALLOWED);\r
4755                 return;\r
4756         }\r
4757         \r
4758         /**\r
4759          * Admin::PluninAdminPagehead()\r
4760          * Output pluginadmin page head\r
4761          *\r
4762          * @param       string  $extrahead\r
4763          * @return      void\r
4764          */\r
4765         static public function PluninAdminPagehead($extrahead = '')\r
4766         {\r
4767                 self::pagehead();\r
4768                 return;\r
4769         }\r
4770         \r
4771         /**\r
4772          * Admin::PluninAdminPagefoot()\r
4773          * Output pluginadmin page foot\r
4774          *\r
4775          * @param       void\r
4776          * @return      void\r
4777          */\r
4778         static public function PluninAdminPagefoot()\r
4779         {\r
4780                 self::pagefoot();\r
4781                 return;\r
4782         }\r
4783         \r
4784         /**\r
4785          * Admin::pagehead()\r
4786          * Output admin page head\r
4787          * \r
4788          * @param       string  PluninAdminPagehead\r
4789          * @return      void\r
4790          */\r
4791         static private function pagehead($extrahead = '')\r
4792         {\r
4793                 global $member, $nucleus, $CONF, $manager;\r
4794 \r
4795                 if ( self::existsSkinContents('pagehead') )\r
4796                 {\r
4797                         if ( isset($extrahead) && !empty($extrahead) )\r
4798                         {\r
4799                         self::$extrahead = $extrahead;\r
4800                         }\r
4801                         self::$skin->parse('pagehead');\r
4802                 }\r
4803                 else\r
4804                 {\r
4805                         $data = array(\r
4806                                 'extrahead'     => &$extrahead,\r
4807                                 'action'        => self::$action\r
4808                         );\r
4809                         \r
4810                         $manager->notify('AdminPrePageHead', $data);\r
4811                         \r
4812                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4813                         \r
4814                         /*\r
4815                          * TODO: obsoleted\r
4816                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4817                         {\r
4818                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4819                                 $CONF['AdminCSS'] = 'original';\r
4820                         }\r
4821                         */\r
4822                         \r
4823                         /* HTTP 1.1 application for no caching */\r
4824                         header("Cache-Control: no-cache, must-revalidate");\r
4825                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4826                         \r
4827                         $root_element = 'html';\r
4828                         $charset = i18n::get_current_charset();\r
4829                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4830                         $xml_version_info = self::$xml_version_info;\r
4831                         $formal_public_identifier = self::$formal_public_identifier;\r
4832                         $system_identifier = self::$system_identifier;\r
4833                         $xhtml_namespace = self::$xhtml_namespace;\r
4834                         \r
4835                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4836                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4837                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4838                         echo "<head>\n";\r
4839                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4840                         /*\r
4841                          * TODO: obsoleted\r
4842                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4843                         */\r
4844                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4845                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4846                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4847                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4848                         echo "{$extrahead}\n";\r
4849                         echo "</head>\n\n";\r
4850                         echo "<body>\n";\r
4851                         echo "<div id=\"adminwrapper\">\n";\r
4852                         echo "<div class=\"header\">\n";\r
4853                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4854                         echo "</div>\n";\r
4855                         echo "<div id=\"container\">\n";\r
4856                         echo "<div id=\"content\">\n";\r
4857                         echo "<div class=\"loginname\">\n";\r
4858                         if ( $member->isLoggedIn() )\r
4859                         {\r
4860                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4861                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4862                         }\r
4863                         else\r
4864                         {\r
4865                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4866                         }\r
4867                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4868                         echo '(';\r
4869                         \r
4870                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4871                         {\r
4872                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4873                         }\r
4874                         else\r
4875                         {\r
4876                                 $codenamestring = '';\r
4877                         }\r
4878                         \r
4879                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4880                         {\r
4881                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4882                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4883                                 \r
4884                                 $newestVersion = getLatestVersion();\r
4885                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4886                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4887                                 \r
4888                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4889                                 {\r
4890                                         echo "<br />\n";\r
4891                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4892                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4893                                         echo "</a>";\r
4894                                 }\r
4895                         }\r
4896                         else\r
4897                         {\r
4898                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4899                         }\r
4900                         echo ')';\r
4901                         echo '</div>';\r
4902                 }\r
4903                 return;\r
4904         }\r
4905         \r
4906         /**\r
4907          * Admin::pagefoot()\r
4908          * Output admin page foot include quickmenu\r
4909          * \r
4910          * @param       void\r
4911          * @return      void\r
4912          */\r
4913         static private function pagefoot()\r
4914         {\r
4915                 global $action, $member, $manager;\r
4916                 \r
4917                 if ( self::existsSkinContents('pagefoot') )\r
4918                 {\r
4919                         self::$skin->parse('pagefoot');\r
4920                         exit;\r
4921                 }\r
4922                 else\r
4923                 {\r
4924                         $data = array(\r
4925                                 'action' => self::$action\r
4926                         );\r
4927                         \r
4928                         $manager->notify('AdminPrePageFoot', $data);\r
4929                         \r
4930                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4931                         {\r
4932                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4933                                 echo "<ul>\n";\r
4934                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4935                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4936                                 echo "</ul>\n";\r
4937                         }\r
4938                         \r
4939                         echo "<div class=\"foot\">\n";\r
4940                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4941                         echo '-';\r
4942                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4943                         echo "</div>\n";\r
4944                         \r
4945                         echo "<div id=\"quickmenu\">\n";\r
4946                         \r
4947                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4948                         {\r
4949                                 echo "<ul>\n";\r
4950                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4951                                 echo "</ul>\n";\r
4952                                 \r
4953                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4954                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4955                                 echo "<p>\n";\r
4956                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4957                                 \r
4958                                 $showAll = requestVar('showall');\r
4959                                 \r
4960                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4961                                 {\r
4962                                         // Super-Admins have access to all blogs! (no add item support though)\r
4963                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4964                                         $query = sprintf($query, sql_table('blog'));\r
4965                                 }\r
4966                                 else\r
4967                                 {\r
4968                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4969                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4970                                 }\r
4971                                 $template['name']               = 'blogid';\r
4972                                 $template['tabindex']   = 15000;\r
4973                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4974                                 $template['selected']   = -1;\r
4975                                 $template['shorten']    = 10;\r
4976                                 $template['shortenel']  = '';\r
4977                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4978                                 showlist($query, 'select', $template);\r
4979                                 \r
4980                                 echo "</p>\n";\r
4981                                 echo "</form>\n";\r
4982                                 \r
4983                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4984                                 echo "<ul>\n";\r
4985                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4986                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4987                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4988                                 echo "</ul>\n";\r
4989                                 \r
4990                                 if ( $member->isAdmin() )\r
4991                                 {\r
4992                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4993                                         echo "<ul>\n";\r
4994                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4995                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4996                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4997                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4998                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4999                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
5000                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
5001                                         echo "</ul>\n";\r
5002                                         \r
5003                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
5004                                         echo "<ul>\n";\r
5005                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
5006                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
5007                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
5008                                         echo "</ul>\n";\r
5009                                 }\r
5010                                 \r
5011                                 $data = array('options' => array());\r
5012                                 \r
5013                                 $manager->notify('QuickMenu', $data);\r
5014                                 \r
5015                                 if ( count($data['options']) > 0 )\r
5016                                 {\r
5017                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
5018                                         echo "<ul>\n";\r
5019                                         foreach ( $data['options'] as $option )\r
5020                                         {\r
5021                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
5022                                         }\r
5023                                         echo "</ul>\n";\r
5024                                 }\r
5025                         }\r
5026                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
5027                         {\r
5028                         \r
5029                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
5030                         }\r
5031                         else\r
5032                         {\r
5033                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
5034                         }\r
5035                         \r
5036                         echo "<!-- quickmenu -->\n";\r
5037                         echo "</div>\n";\r
5038                         \r
5039                         echo "<!-- content -->\n";\r
5040                         echo "</div>\n";\r
5041                         \r
5042                         echo "<!-- container -->\n";\r
5043                         echo "</div>\n";\r
5044                         \r
5045                         echo "<!-- adminwrapper -->\n";\r
5046                         echo "</div>\n";\r
5047                         \r
5048                         echo "</body>\n";\r
5049                         echo "</html>\n";\r
5050                 }\r
5051                 return;\r
5052         }\r
5053         \r
5054         /**\r
5055          * Admin::action_bookmarklet()\r
5056          * \r
5057          * @param       void\r
5058          * @return      void\r
5059          */\r
5060         static private function action_bookmarklet()\r
5061         {\r
5062                 global $member, $manager;\r
5063                 \r
5064                 $blogid = intRequestVar('blogid');\r
5065                 $member->teamRights($blogid) or self::disallow();\r
5066                 \r
5067                 self::pagehead();\r
5068                 self::$skin->parse('bookmarklet');\r
5069                 self::pagefoot();\r
5070                 return;\r
5071         }\r
5072         \r
5073         /**\r
5074          * Admin::action_actionlog()\r
5075          * \r
5076          * @param       void\r
5077          * @return      void\r
5078          */\r
5079         static private function action_actionlog()\r
5080         {\r
5081                 global $member, $manager;\r
5082                 \r
5083                 $member->isAdmin() or self::disallow();\r
5084                 \r
5085                 self::pagehead();\r
5086                 self::$skin->parse('actionlog');\r
5087                 self::pagefoot();\r
5088                 return;\r
5089         }\r
5090         \r
5091         /**\r
5092          * Admin::action_banlist()\r
5093          * \r
5094          * @param       void\r
5095          * @return      void\r
5096          */\r
5097         static private function action_banlist()\r
5098         {\r
5099                 global $member, $manager;\r
5100                 \r
5101                 $blogid = intRequestVar('blogid');\r
5102                 $member->blogAdminRights($blogid) or self::disallow();\r
5103                 \r
5104                 self::pagehead();\r
5105                 self::$skin->parse('banlist');\r
5106                 self::pagefoot();\r
5107                 return;\r
5108         }\r
5109         \r
5110         /**\r
5111          * Admin::action_banlistdelete()\r
5112          * \r
5113          * @param       void\r
5114          * @return      void\r
5115          */\r
5116         static private function action_banlistdelete()\r
5117         {\r
5118                 global $member, $manager;\r
5119                 \r
5120                 $blogid = intRequestVar('blogid');\r
5121                 $member->blogAdminRights($blogid) or self::disallow();\r
5122                 \r
5123                 self::pagehead();\r
5124                 self::$skin->parse('banlistdelete');\r
5125                 self::pagefoot();\r
5126                 return;\r
5127         }\r
5128         \r
5129         /**\r
5130          * Admin::action_banlistdeleteconfirm()\r
5131          * \r
5132          * @param       void\r
5133          * @return      void\r
5134          */\r
5135         static private function action_banlistdeleteconfirm()\r
5136         {\r
5137                 global $member, $manager;\r
5138                 \r
5139                 $blogid         = intPostVar('blogid');\r
5140                 $allblogs       = postVar('allblogs');\r
5141                 $iprange        = postVar('iprange');\r
5142                 \r
5143                 $member->blogAdminRights($blogid) or self::disallow();\r
5144                 \r
5145                 $deleted = array();\r
5146                 \r
5147                 if ( !$allblogs )\r
5148                 {\r
5149                         if ( Ban::removeBan($blogid, $iprange) )\r
5150                         {\r
5151                                 $deleted[] = $blogid;\r
5152                         }\r
5153                 }\r
5154                 else\r
5155                 {\r
5156                         // get blogs fot which member has admin rights\r
5157                         $adminblogs = $member->getAdminBlogs();\r
5158                         foreach ($adminblogs as $blogje)\r
5159                         {\r
5160                                 if ( Ban::removeBan($blogje, $iprange) )\r
5161                                 {\r
5162                                         $deleted[] = $blogje;\r
5163                                 }\r
5164                         }\r
5165                 }\r
5166                 \r
5167                 if ( sizeof($deleted) == 0 )\r
5168                 {\r
5169                         self::error(_ERROR_DELETEBAN);\r
5170                 }\r
5171                 \r
5172                 /* TODO: we should use other ways */\r
5173                 $_REQUEST['delblogs'] = $deleted;\r
5174                 \r
5175                 self::pagehead();\r
5176                 self::$skin->parse('banlistdeleteconfirm');\r
5177                 self::pagefoot();\r
5178                 return;\r
5179         }\r
5180         \r
5181         /**\r
5182          * Admin::action_banlistnewfromitem()\r
5183          * \r
5184          * @param       void\r
5185          * @return      void\r
5186          */\r
5187         static private function action_banlistnewfromitem()\r
5188         {\r
5189                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5190                 return;\r
5191         }\r
5192         \r
5193         /**\r
5194          * Admin::action_banlistnew()\r
5195          * \r
5196          * @param       integer $blogid ID for weblog\r
5197          * @return      void\r
5198          */\r
5199         static private function action_banlistnew($blogid = '')\r
5200         {\r
5201                 global $member, $manager;\r
5202                 \r
5203                 if ( $blogid == '' )\r
5204                 {\r
5205                         $blogid = intRequestVar('blogid');\r
5206                 }\r
5207                 \r
5208                 $ip = requestVar('ip');\r
5209                 \r
5210                 $member->blogAdminRights($blogid) or self::disallow();\r
5211                 \r
5212                 /* TODO: we should consider to use the other way instead of this */\r
5213                 $_REQUEST['blogid'] = $blogid;          \r
5214                 \r
5215                 self::pagehead();\r
5216                 self::$skin->parse('banlistnew');\r
5217                 self::pagefoot();\r
5218                 \r
5219                 return;\r
5220         }\r
5221 \r
5222         /**\r
5223          * Admin::action_banlistadd()\r
5224          * \r
5225          * @param       void\r
5226          * @return      void\r
5227          */\r
5228         static private function action_banlistadd()\r
5229         {\r
5230                 global $member;\r
5231                 \r
5232                 $blogid         = intPostVar('blogid');\r
5233                 $allblogs       = postVar('allblogs');\r
5234                 $iprange        = postVar('iprange');\r
5235                 \r
5236                 if ( $iprange == "custom" )\r
5237                 {\r
5238                         $iprange = postVar('customiprange');\r
5239                 }\r
5240                 $reason   = postVar('reason');\r
5241                 \r
5242                 $member->blogAdminRights($blogid) or self::disallow();\r
5243                 \r
5244                 // TODO: check IP range validity\r
5245                 \r
5246                 if ( !$allblogs )\r
5247                 {\r
5248                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5249                         {\r
5250                                 self::error(_ERROR_ADDBAN);\r
5251                         }\r
5252                 }\r
5253                 else\r
5254                 {\r
5255                         // get blogs fot which member has admin rights\r
5256                         $adminblogs = $member->getAdminBlogs();\r
5257                         $failed = 0;\r
5258                         foreach ($adminblogs as $blogje)\r
5259                         {\r
5260                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5261                                 {\r
5262                                         $failed = 1;\r
5263                                 }\r
5264                         }\r
5265                         if ( $failed )\r
5266                         {\r
5267                                 self::error(_ERROR_ADDBAN);\r
5268                         }\r
5269                 }\r
5270                 self::action_banlist();\r
5271                 return;\r
5272         }\r
5273         \r
5274         /**\r
5275          * Admin::action_clearactionlog()\r
5276          * \r
5277          * @param       void\r
5278          * @return      void\r
5279          */\r
5280         static private function action_clearactionlog()\r
5281         {\r
5282                 global $member;\r
5283                 \r
5284                 $member->isAdmin() or self::disallow();\r
5285                 \r
5286                 ActionLog::clear();\r
5287                 \r
5288                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5289                 return;\r
5290         }\r
5291         \r
5292         /**\r
5293          * Admin::action_backupoverview()\r
5294          * \r
5295          * @param       void\r
5296          * @return      void\r
5297          */\r
5298         static private function action_backupoverview()\r
5299         {\r
5300                 global $member, $manager;\r
5301                 \r
5302                 $member->isAdmin() or self::disallow();\r
5303                 \r
5304                 self::pagehead();\r
5305                 self::$skin->parse('backupoverview');\r
5306                 self::pagefoot();\r
5307                 return;\r
5308         }\r
5309 \r
5310         /**\r
5311          * Admin::action_backupcreate()\r
5312          * create file for backup\r
5313          * \r
5314          * @param               void\r
5315          * @return      void\r
5316          * \r
5317          */\r
5318         static private function action_backupcreate()\r
5319         {\r
5320                 global $member, $DIR_LIBS;\r
5321                 \r
5322                 $member->isAdmin() or self::disallow();\r
5323                 \r
5324                 // use compression ?\r
5325                 $useGzip = (integer) postVar('gzip');\r
5326                 \r
5327                 include($DIR_LIBS . 'backup.php');\r
5328                 \r
5329                 // try to extend time limit\r
5330                 // (creating/restoring dumps might take a while)\r
5331                 @set_time_limit(1200);\r
5332                 \r
5333                 Backup::do_backup($useGzip);\r
5334                 exit;\r
5335         }\r
5336         \r
5337         /**\r
5338          * Admin::action_backuprestore()\r
5339          * restoring from uploaded file\r
5340          * \r
5341          * @param               void\r
5342          * @return      void\r
5343          */\r
5344         static private function action_backuprestore()\r
5345         {\r
5346                 global $member, $DIR_LIBS;\r
5347                 \r
5348                 $member->isAdmin() or self::disallow();\r
5349                 \r
5350                 if ( intPostVar('letsgo') != 1 )\r
5351                 {\r
5352                         self::error(_ERROR_BACKUP_NOTSURE);\r
5353                 }\r
5354                 \r
5355                 include($DIR_LIBS . 'backup.php');\r
5356                 \r
5357                 // try to extend time limit\r
5358                 // (creating/restoring dumps might take a while)\r
5359                 @set_time_limit(1200);\r
5360                 \r
5361                 $message = Backup::do_restore();\r
5362                 if ( $message != '' )\r
5363                 {\r
5364                         self::error($message);\r
5365                 }\r
5366                 self::pagehead();\r
5367                 self::$skin->parse('backuprestore');\r
5368                 self::pagefoot();\r
5369                 return;\r
5370         }\r
5371         \r
5372         /**\r
5373          * Admin::action_pluginlist()\r
5374          * output the list of installed plugins\r
5375          * \r
5376          * @param       void\r
5377          * @return      void\r
5378          * \r
5379          */\r
5380         static private function action_pluginlist()\r
5381         {\r
5382                 global $DIR_PLUGINS, $member, $manager;\r
5383                 \r
5384                 // check if allowed\r
5385                 $member->isAdmin() or self::disallow();\r
5386                 \r
5387                 self::pagehead();\r
5388                 self::$skin->parse('pluginlist');\r
5389                 self::pagefoot();\r
5390                 return;\r
5391         }\r
5392         \r
5393         /**\r
5394          * Admin::action_pluginhelp()\r
5395          * \r
5396          * @param       void\r
5397          * @return      void\r
5398          */\r
5399         static private function action_pluginhelp()\r
5400         {\r
5401                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5402                 \r
5403                 // check if allowed\r
5404                 $member->isAdmin() or self::disallow();\r
5405                 \r
5406                 $plugid = intGetVar('plugid');\r
5407                 \r
5408                 if ( !$manager->pidInstalled($plugid) )\r
5409                 {\r
5410                         self::error(_ERROR_NOSUCHPLUGIN);\r
5411                 }\r
5412                 \r
5413                 self::pagehead();\r
5414                 self::$skin->parse('pluginhelp');\r
5415                 self::pagefoot();\r
5416                 return;\r
5417         }\r
5418         \r
5419         /**\r
5420          * Admin::action_pluginadd()\r
5421          * \r
5422          * @param       Void\r
5423          * @return      Void\r
5424          * \r
5425          */\r
5426         static private function action_pluginadd()\r
5427         {\r
5428                 global $member, $manager, $DIR_PLUGINS;\r
5429                 \r
5430                 // check if allowed\r
5431                 $member->isAdmin() or self::disallow();\r
5432                 \r
5433                 $name = postVar('filename');\r
5434                 \r
5435                 if ( $manager->pluginInstalled($name) )\r
5436                 {\r
5437                         self::error(_ERROR_DUPPLUGIN);\r
5438                 }\r
5439                 \r
5440                 if ( !checkPlugin($name) )\r
5441                 {\r
5442                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5443                 }\r
5444                 \r
5445                 // get number of currently installed plugins\r
5446                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5447                 $numCurrent = sql_num_rows($res);\r
5448                 \r
5449                 // plugin will be added as last one in the list\r
5450                 $newOrder = $numCurrent + 1;\r
5451                 \r
5452                 $data = array('file' => &$name);\r
5453                 $manager->notify('PreAddPlugin', $data);\r
5454                 \r
5455                 // do this before calling getPlugin (in case the plugin id is used there)\r
5456                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5457                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5458                 sql_query($query);\r
5459                 $iPid = sql_insert_id();\r
5460                 \r
5461                 $manager->clearCachedInfo('installedPlugins');\r
5462                 \r
5463                 // Load the plugin for condition checking and instalation\r
5464                 $plugin =& $manager->getPlugin($name);\r
5465                 \r
5466                 // check if it got loaded (could have failed)\r
5467                 if ( !$plugin )\r
5468                 {\r
5469                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5470                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5471                         \r
5472                         sql_query($query);\r
5473                         \r
5474                         $manager->clearCachedInfo('installedPlugins');\r
5475                         self::error(_ERROR_PLUGIN_LOAD);\r
5476                 }\r
5477                 \r
5478                 // check if plugin needs a newer Nucleus version\r
5479                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5480                 {\r
5481                         // uninstall plugin again...\r
5482                         self::deleteOnePlugin($plugin->getID());\r
5483                         \r
5484                         // ...and show error\r
5485                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5486                 }\r
5487                 \r
5488                 // check if plugin needs a newer Nucleus version\r
5489                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5490                 {\r
5491                         // uninstall plugin again...\r
5492                         self::deleteOnePlugin($plugin->getID());\r
5493                         \r
5494                         // ...and show error\r
5495                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5496                 }\r
5497                 \r
5498                 $pluginList = $plugin->getPluginDep();\r
5499                 foreach ( $pluginList as $pluginName )\r
5500                 {\r
5501                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5502                         if (sql_num_rows($res) == 0)\r
5503                         {\r
5504                                 // uninstall plugin again...\r
5505                                 self::deleteOnePlugin($plugin->getID());\r
5506                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5507                         }\r
5508                 }\r
5509                 \r
5510                 // call the install method of the plugin\r
5511                 $plugin->install();\r
5512                 \r
5513                 $data = array('plugin' => &$plugin);\r
5514                 $manager->notify('PostAddPlugin', $data);\r
5515                 \r
5516                 // update all events\r
5517                 self::action_pluginupdate();\r
5518                 return;\r
5519         }\r
5520         \r
5521         /**\r
5522          * ADMIN:action_pluginupdate():\r
5523          * \r
5524          * @param       Void\r
5525          * @return      Void\r
5526          * \r
5527          */\r
5528         static private function action_pluginupdate()\r
5529         {\r
5530                 global $member, $manager, $CONF;\r
5531                 \r
5532                 // check if allowed\r
5533                 $member->isAdmin() or self::disallow();\r
5534                 \r
5535                 // delete everything from plugin_events\r
5536                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5537                 \r
5538                 // loop over all installed plugins\r
5539                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5540                 while ( $o = sql_fetch_object($res) )\r
5541                 {\r
5542                         $pid  =  $o->pid;\r
5543                         $plug =& $manager->getPlugin($o->pfile);\r
5544                         if ( $plug )\r
5545                         {\r
5546                                 $eventList = $plug->getEventList();\r
5547                                 foreach ( $eventList as $eventName )\r
5548                                 {\r
5549                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5550                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5551                                         sql_query($query);\r
5552                                 }\r
5553                         }\r
5554                 }\r
5555                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5556                 return;\r
5557         }\r
5558         \r
5559         /**\r
5560          * Admin::action_plugindelete()\r
5561          * \r
5562          * @param       void\r
5563          * @return      void\r
5564          */\r
5565         static private function action_plugindelete()\r
5566         {\r
5567                 global $member, $manager;\r
5568                 \r
5569                 // check if allowed\r
5570                 $member->isAdmin() or self::disallow();\r
5571                 \r
5572                 $pid = intGetVar('plugid');\r
5573                 \r
5574                 if ( !$manager->pidInstalled($pid) )\r
5575                 {\r
5576                         self::error(_ERROR_NOSUCHPLUGIN);\r
5577                 }\r
5578                 \r
5579                 self::pagehead();\r
5580                 self::$skin->parse('plugindelete');\r
5581                 self::pagefoot();\r
5582                 return;\r
5583         }\r
5584 \r
5585         /**\r
5586          * Admin::action_plugindeleteconfirm()\r
5587          * \r
5588          * @param       void\r
5589          * @return      void\r
5590          */\r
5591         static private function action_plugindeleteconfirm()\r
5592         {\r
5593                 global $member, $manager, $CONF;\r
5594                 \r
5595                 // check if allowed\r
5596                 $member->isAdmin() or self::disallow();\r
5597                 \r
5598                 $pid = intPostVar('plugid');\r
5599                 \r
5600                 $error = self::deleteOnePlugin($pid, 1);\r
5601                 if ( $error )\r
5602                 {\r
5603                         self::error($error);\r
5604                 }\r
5605                 \r
5606                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5607                 return;\r
5608         }\r
5609         \r
5610         /**\r
5611          * Admin::\r
5612          * \r
5613          * @param       void\r
5614          * @return      void\r
5615          */\r
5616         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5617         {\r
5618                 global $manager;\r
5619                 \r
5620                 $pid = intval($pid);\r
5621                 \r
5622                 if ( !$manager->pidInstalled($pid) )\r
5623                 {\r
5624                         return _ERROR_NOSUCHPLUGIN;\r
5625                 }\r
5626                 \r
5627                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5628                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5629                 $name = quickQuery($query);\r
5630                 \r
5631                 // check dependency before delete\r
5632                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5633                 while ($o = sql_fetch_object($res))\r
5634                 {\r
5635                         $plug =& $manager->getPlugin($o->pfile);\r
5636                         if ( $plug )\r
5637                         {\r
5638                                 $depList = $plug->getPluginDep();\r
5639                                 foreach ( $depList as $depName )\r
5640                                 {\r
5641                                         if ( $name == $depName )\r
5642                                         {\r
5643                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5644                                         }\r
5645                                 }\r
5646                         }\r
5647                 }\r
5648                 \r
5649                 $data = array('plugid' => $pid);\r
5650                 $manager->notify('PreDeletePlugin', $data);\r
5651                 \r
5652                 // call the unInstall method of the plugin\r
5653                 if ( $callUninstall )\r
5654                 {\r
5655                         $plugin =& $manager->getPlugin($name);\r
5656                         if ( $plugin )\r
5657                         {\r
5658                                 $plugin->unInstall();\r
5659                         }\r
5660                 }\r
5661                 \r
5662                 // delete all subscriptions\r
5663                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5664                 \r
5665                 // delete all options\r
5666                 // get OIDs from plugin_option_desc\r
5667                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5668                 $aOIDs = array();\r
5669                 while ($o = sql_fetch_object($res))\r
5670                 {\r
5671                         array_push($aOIDs, $o->oid);\r
5672                 }\r
5673                 \r
5674                 // delete from plugin_option and plugin_option_desc\r
5675                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5676                 if (count($aOIDs) > 0)\r
5677                 {\r
5678                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5679                 }\r
5680                 \r
5681                 // update order numbers\r
5682                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5683                 $o = sql_fetch_object($res);\r
5684                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5685                 \r
5686                 // delete row\r
5687                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5688                 \r
5689                 $manager->clearCachedInfo('installedPlugins');\r
5690                 $data = array('plugid' => $pid);\r
5691                 $manager->notify('PostDeletePlugin', $data);\r
5692                 \r
5693                 return '';\r
5694         }\r
5695         \r
5696         /**\r
5697          * Admin::action_pluginup()\r
5698          * \r
5699          * @param       void\r
5700          * @return      void\r
5701          */\r
5702         static private function action_pluginup()\r
5703         {\r
5704                 global $member, $manager, $CONF;\r
5705                 \r
5706                 // check if allowed\r
5707                 $member->isAdmin() or self::disallow();\r
5708                 \r
5709                 $plugid = intGetVar('plugid');\r
5710                 \r
5711                 if ( !$manager->pidInstalled($plugid) )\r
5712                 {\r
5713                         self::error(_ERROR_NOSUCHPLUGIN);\r
5714                 }\r
5715                 \r
5716                 // 1. get old order number\r
5717                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5718                 $o = sql_fetch_object($res);\r
5719                 $oldOrder = $o->porder;\r
5720                 \r
5721                 // 2. calculate new order number\r
5722                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5723                 \r
5724                 // 3. update plug numbers\r
5725                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5726                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5727                 \r
5728                 //self::action_pluginlist();\r
5729                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5730                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5731                 return;\r
5732         }\r
5733         \r
5734         /**\r
5735          * Admin::action_plugindown()\r
5736          * \r
5737          * @param       void\r
5738          * @return      void\r
5739          */\r
5740         static private function action_plugindown()\r
5741         {\r
5742                 global $member, $manager, $CONF;\r
5743                 \r
5744                 // check if allowed\r
5745                 $member->isAdmin() or self::disallow();\r
5746                 \r
5747                 $plugid = intGetVar('plugid');\r
5748                 if ( !$manager->pidInstalled($plugid) )\r
5749                 {\r
5750                         self::error(_ERROR_NOSUCHPLUGIN);\r
5751                 }\r
5752                 \r
5753                 // 1. get old order number\r
5754                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5755                 $o = sql_fetch_object($res);\r
5756                 $oldOrder = $o->porder;\r
5757                 \r
5758                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5759                 $maxOrder = sql_num_rows($res);\r
5760                 \r
5761                 // 2. calculate new order number\r
5762                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5763                 \r
5764                 // 3. update plug numbers\r
5765                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5766                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5767                 \r
5768                 //self::action_pluginlist();\r
5769                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5770                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5771                 return;\r
5772         }\r
5773         \r
5774         /**\r
5775          * Admin::action_pluginoptions()\r
5776          * \r
5777          * Output Plugin option page\r
5778          * \r
5779          * @access      public\r
5780          * @param       string $message message when fallbacked\r
5781          * @return      void\r
5782          * \r
5783          */\r
5784         static private function action_pluginoptions($message = '')\r
5785         {\r
5786                 global $member, $manager;\r
5787                 \r
5788                 // check if allowed\r
5789                 $member->isAdmin() or self::disallow();\r
5790                 \r
5791                 $pid = intRequestVar('plugid');\r
5792                 if ( !$manager->pidInstalled($pid) )\r
5793                 {\r
5794                         self::error(_ERROR_NOSUCHPLUGIN);\r
5795                 }\r
5796                 \r
5797                 if ( isset($message) )\r
5798                 {\r
5799                         self::$headMess = $message;\r
5800                 }\r
5801                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5802                 self::pagehead($extrahead);\r
5803                 self::$skin->parse('pluginoptions');\r
5804                 self::pagefoot();\r
5805                 return;\r
5806         }\r
5807         \r
5808         /**\r
5809          * Admin::action_pluginoptionsupdate()\r
5810          * \r
5811          * Update plugin options and fallback to plugin option page\r
5812          * \r
5813          * @access      public\r
5814          * @param       void\r
5815          * @return      void\r
5816          */\r
5817         static private function action_pluginoptionsupdate()\r
5818         {\r
5819                 global $member, $manager;\r
5820                 \r
5821                 // check if allowed\r
5822                 $member->isAdmin() or self::disallow();\r
5823                 \r
5824                 $pid = intRequestVar('plugid');\r
5825                 \r
5826                 if ( !$manager->pidInstalled($pid) )\r
5827                 {\r
5828                         self::error(_ERROR_NOSUCHPLUGIN);\r
5829                 }\r
5830                 \r
5831                 $aOptions = requestArray('plugoption');\r
5832                 NucleusPlugin::apply_plugin_options($aOptions);\r
5833                 \r
5834                 $data = array(\r
5835                         'context'       => 'global',\r
5836                         'plugid'        => $pid\r
5837                 );\r
5838                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5839                 \r
5840                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5841                 return;\r
5842         }\r
5843         \r
5844         /**\r
5845          * Admin::insertPluginOptions()\r
5846          * \r
5847          * Output plugin option field\r
5848          * \r
5849          * @access      public\r
5850          * @param string        $context        plugin option context\r
5851          * @param integer       $contextid      plugin option context id\r
5852          * @return      void\r
5853          */\r
5854         static public function insertPluginOptions($context, $contextid = 0)\r
5855         {\r
5856                 global $manager;\r
5857                 \r
5858                 // get all current values for this contextid\r
5859                 // (note: this might contain doubles for overlapping contextids)\r
5860                 $aIdToValue = array();\r
5861                 \r
5862                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5863                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5864                 \r
5865                 $res = sql_query($query);\r
5866                 while ( $object = sql_fetch_object($res) )\r
5867                 {\r
5868                         $aIdToValue[$object->oid] = $object->ovalue;\r
5869                 }\r
5870                 \r
5871                 // get list of oids per pid\r
5872                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5873                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5874                 $res    = sql_query($query);\r
5875                 \r
5876                 $aOptions = array();\r
5877                 while ( $object = sql_fetch_object($res) )\r
5878                 {\r
5879                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5880                         {\r
5881                                 $value = $object->odef;\r
5882                         }\r
5883                         else\r
5884                         {\r
5885                                 $value = $aIdToValue[$object->oid];\r
5886                         }\r
5887                         \r
5888                         array_push(\r
5889                                 $aOptions,\r
5890                                 array(\r
5891                                         'pid'                   => $object->pid,\r
5892                                         'pfile'                 => $object->pfile,\r
5893                                         'oid'                   => $object->oid,\r
5894                                         'value'                 => $value,\r
5895                                         'name'                  => $object->oname,\r
5896                                         'description'   => $object->odesc,\r
5897                                         'type'                  => $object->otype,\r
5898                                         'typeinfo'              => $object->oextra,\r
5899                                         'contextid'             => $contextid,\r
5900                                         'extra'                 => ''\r
5901                                 )\r
5902                         );\r
5903                 }\r
5904                 \r
5905                 $data = array(\r
5906                         'context'       =>  $context,\r
5907                         'contextid'     =>  $contextid,\r
5908                         'options'       =>& $aOptions\r
5909                 );\r
5910                 $manager->notify('PrePluginOptionsEdit', $data);\r
5911                 \r
5912                 self::$aOptions = $aOptions;\r
5913                 self::$skin->parse('insertpluginoptions');\r
5914                 return;\r
5915         }\r
5916         \r
5917         /**\r
5918          * Admin::action_parseSpecialskin()\r
5919          * \r
5920          * @param       void\r
5921          * @return      void\r
5922          */\r
5923         static private function action_parseSpecialskin()\r
5924         {\r
5925                 self::pagehead();\r
5926                 self::$skin->parse(self::$action);\r
5927                 self::pagefoot();\r
5928                 return;\r
5929         }\r
5930         \r
5931         /**\r
5932          * Admin::getAdminskinIDFromName()\r
5933          * \r
5934          * @param       string  $skinname       name of skin\r
5935          * @return      integer ID for skin\r
5936          */\r
5937         static private function getAdminskinIDFromName($skinname)\r
5938         {\r
5939                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5940                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5941                 $admnSknID      = quickQuery($query);\r
5942                 return (integer) $adminSkinID;\r
5943         }\r
5944         \r
5945         /**\r
5946          * Admin::getAdminskinNameFromID()\r
5947          * \r
5948          * @param       integer $skinid ID for skin\r
5949          * @return      integer ID for skin\r
5950          */\r
5951         static private function getAdminskinNameFromID($skinid)\r
5952         {\r
5953                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5954                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5955                 $admnSknID      = quickQuery($query);\r
5956                 return (integer) $adminSkinID;\r
5957         }\r
5958         \r
5959         /**\r
5960          * Admin::getAdminextrahead()\r
5961          */\r
5962         static function getAdminextrahead()\r
5963         {\r
5964                 return self::$extrahead;\r
5965         }\r
5966         \r
5967         /**\r
5968          * Admin::getAdminpassvar()\r
5969          */\r
5970         static function getAdminpassvar()\r
5971         {\r
5972                 return self::$passvar;\r
5973         }\r
5974         \r
5975         /**\r
5976          * Admin::getAdminAction()\r
5977          */\r
5978         static function getAdminAction()\r
5979         {\r
5980                 return self::$action;\r
5981         }\r
5982         \r
5983         /**\r
5984          * Admin::getAdminaOption()\r
5985          */\r
5986         static function getAdminaOption()\r
5987         {\r
5988                 return self::$aOptions;\r
5989         }\r
5990         \r
5991         /**\r
5992          * Admin::action_importAdmin()\r
5993          * \r
5994          * @param       void\r
5995          * @return      void\r
5996          */\r
5997         static private function action_importAdmin()\r
5998         {\r
5999                 global $DIR_ADMINSKINS, $action;\r
6000                 if ( $action == 'adminskinieimport' )\r
6001                 {\r
6002                         self::doAdminskinimport();\r
6003                 }\r
6004                 $skn = array();\r
6005                 if ( $action == 'showlogin' )\r
6006                 {\r
6007                         $skinName = 'showlogin';\r
6008                         $actnName = 'showlogin';\r
6009                 }\r
6010                 else\r
6011                 {\r
6012                         $skinName = 'defaultimporter';\r
6013                         $actnName = 'importAdmin';\r
6014                 }\r
6015                 \r
6016                 /* TODO: why??? */\r
6017                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6018                 $skn['id']                              = 0;\r
6019                 $skn['description']             = $skinName;\r
6020                 $skn['contentType']             = 'importAdmin';\r
6021                 $skn['includeMode']             = 'normal';\r
6022                 $skn['includePrefix']   = '';\r
6023                 $skn['name']                    = 'defaultinporter';\r
6024                 \r
6025                 self::$skin                             = (object) $skn;\r
6026                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6027                 $handler->setSkin(self::$skin);\r
6028                 \r
6029                 $parser = new PARSER($handler);\r
6030                 $parser->parse($contents);\r
6031                 \r
6032                 return;\r
6033         }\r
6034         \r
6035         /**\r
6036          * Admin::doAdminskinimport()\r
6037          * \r
6038          * @param       void\r
6039          * @return      void\r
6040          */\r
6041         static private function doAdminskinimport()\r
6042         {\r
6043                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6044                 \r
6045                 $member->isAdmin() or self::disallow();\r
6046                 \r
6047                 include_once($DIR_LIBS . 'Skinie.php');\r
6048                 $skinFileRaw    = postVar('skinfile');\r
6049                 $mode                   = postVar('mode');\r
6050                 $allowOverwrite = intPostVar('overwrite');\r
6051                 \r
6052                 if ( $mode == 'file' )\r
6053                 {\r
6054                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6055                 }\r
6056                 else\r
6057                 {\r
6058                         $skinFile = $skinFileRaw;\r
6059                 }\r
6060                 \r
6061                 $importer       = new SKINIMPORT();\r
6062                 $error          = $importer->readFile($skinFile);\r
6063                 if ( $error )\r
6064                 {\r
6065                         self::error($error);\r
6066                 }\r
6067                 $error = $importer->writeToDatabase($allowOverwrite);\r
6068                 if ( $error )\r
6069                 {\r
6070                         self::error($error);\r
6071                 }\r
6072                 \r
6073                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6074                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6075                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6076                 \r
6077                 header('Location: ' . $CONF['AdminURL']);\r
6078                 exit;\r
6079         }\r
6080 }\r