nucleus/libs/ADMIN.php

   1 <?php
   2 /**
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18  */
  19
  20 if ( !function_exists('requestVar') ) exit;
  21 require_once dirname(__FILE__) . '/showlist.php';
  22
  23 class Admin
  24 {
  25         static private $skin;
  26
  27         static public $action;
  28         static public $aOptions;
  29         static public $blog;
  30         static public $contents;
  31         static public $extrahead;
  32         static public $headMess;
  33         static public $passvar;
  34
  35         static private $skinless_actions = array(
  36                 'plugindeleteconfirm',
  37                 'pluginoptionsupdate',
  38                 'blogsettingsupdate',
  39                 'settingsupdate',
  40                 'addnewlog2',
  41                 'additem',
  42                 'banlistnewfromitem',
  43                 'itemdeleteconfirm',
  44                 'itemupdate',
  45                 'changemembersettings',
  46                 'clearactionlog',
  47                 'memberedit',
  48                 'login',
  49
  50                 'skinremovetypeconfirm',
  51                 'skinclone',
  52                 'skindeleteconfirm',
  53                 'skinnew',
  54                 'skineditgeneral',
  55                 'skinupdate',
  56
  57                 'skinieexport',
  58
  59                 'templateupdate',
  60                 'templatedeleteconfirm',
  61                 'templatenew',
  62                 'templateclone',
  63
  64                 'adminskinremovetypeconfirm',
  65                 'adminskinclone',
  66                 'adminskindeleteconfirm',
  67                 'adminskinnew',
  68                 'adminskineditgeneral',
  69                 'adminskinupdate',
  70
  71                 'adminskinieexport',
  72
  73                 'admintemplateupdate',
  74                 'admintemplatedeleteconfirm',
  75                 'admintemplatenew',
  76                 'admintemplateclone'
  77         );
  78
  79         static private $ticketless_actions = array(
  80                 'showlogin',
  81                 'login',
  82                 'overview',
  83                 'itemlist',
  84                 'blogcommentlist',
  85                 'bookmarklet',
  86                 'blogsettings',
  87                 'banlist',
  88                 'createaccount',
  89                 'deleteblog',
  90                 'editmembersettings',
  91                 'createaccount',
  92                 'forgotpassword',
  93                 'browseowncomments',
  94                 'createitem',
  95                 'browseownitems',
  96                 'itemedit',
  97                 'itemmove',
  98                 'categoryedit',
  99                 'categorydelete',
 100                 'manage',
 101                 'actionlog',
 102                 'settingsedit',
 103                 'backupoverview',
 104                 'pluginlist',
 105                 'createnewlog',
 106                 'usermanagement',
 107                 'itemcommentlist',
 108                 'commentedit',
 109                 'commentdelete',
 110                 'banlistnewfromitem',
 111                 'banlistdelete',
 112                 'itemdelete',
 113                 'manageteam',
 114                 'teamdelete',
 115                 'banlistnew',
 116                 'memberedit',
 117                 'memberdelete',
 118                 'pluginhelp',
 119                 'pluginoptions',
 120                 'plugindelete',
 121
 122                 'activate',
 123                 'systemoverview',
 124                 'activatesetpwd',
 125
 126                 'skinoverview',
 127                 'skinclone',
 128                 'skindelete',
 129                 'skinedit',
 130                 'skinedittype',
 131                 'skinnew',
 132                 'skinremovetype',
 133
 134                 'skinieoverview',
 135
 136                 'templateoverview',
 137                 'templateclone',
 138                 'templateedit',
 139                 'templatedelete',
 140
 141                 'adminskinoverview',
 142                 'adminskinclone',
 143                 'adminskindelete',
 144                 'adminskinedit',
 145                 'adminskinedittype',
 146                 'adminskinnew',
 147                 'adminskinremovetype',
 148
 149                 'adminskinieoverview',
 150
 151                 'admintemplateoverview',
 152                 'admintemplateclone',
 153                 'admintemplateedit',
 154                 'admintemplatedelete'
 155         );
 156
 157         /**
 158          * NOTE: This is for condition of admin/normal skin actions
 159          */
 160         static public $adminskin_actions = array(
 161                 /* ticketless */
 162                 'adminskinoverview',
 163                 'adminskinclone',
 164                 'adminskindelete',
 165                 'adminskinedit',
 166                 'adminskinedittype',
 167                 'adminskinnew',
 168                 'adminskinremovetype',
 169
 170                 'adminskinieoverview',
 171
 172                 'admintemplateoverview',
 173                 'admintemplateclone',
 174                 'admintemplateedit',
 175                 'admintemplatedelete',
 176
 177                 /* ticket needed */
 178                 'adminskineditgeneral',
 179                 'adminskinupdate',
 180                 'adminskindeleteconfirm',
 181                 'adminskinremovetypeconfirm',
 182
 183                 'adminskinieoverview',
 184                 'adminskiniedoimport',
 185                 'adminskinieexport',
 186                 'adminskinieimport',
 187
 188                 'admintemplatenew',
 189                 'admintemplatedeleteconfirm',
 190                 'admintemplateupdate'
 191         );
 192
 193         static public function initialize()
 194         {
 195                 global $CONF, $manager, $member;
 196
 197                 /* NOTE: 1. decide which skinid to use */
 198                 $skinid = $CONF['AdminSkin'];
 199                 if ( $member->isLoggedIn() )
 200                 {
 201                         $memskin = $member->getAdminSkin();
 202                         if ( $memskin && Skin::existsID($memskin))
 203                         {
 204                                 $skinid = $memskin;
 205                         }
 206                 }
 207
 208                 /* NOTE: 2. make an instance of skin object */
 209                 if ( !Skin::existsID($skinid) )
 210                 {
 211                         return FALSE;
 212                 }
 213
 214                 /* NOTE: 3. initializing each members */
 215                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
 216                 self::$action           = '';
 217                 self::$extrahead        = '';
 218                 self::$passvar          = '';
 219                 self::$headMess         = '';
 220                 self::$aOptions         = '';
 221                 return TRUE;
 222         }
 223
 224         /**
 225          * Admin::action()
 226          * Executes an action
 227          *
 228          * @param       string  $action action to be performed
 229          * @return      void
 230          */
 231         static public function action($action)
 232         {
 233                 global $CONF, $manager, $member;
 234
 235                 /* 1. decide action name */
 236                 $customAction = postvar('customaction');
 237                 if ( empty($customAction) )
 238                 {
 239                         $alias = array(
 240                                 'login' => 'overview',
 241                                 ''              => 'overview',
 242                         );
 243                 }
 244                 else
 245                 {
 246                         $alias = array(
 247                                 'login' => $customAction,
 248                                 ''              => $customAction
 249                         );
 250                 }
 251                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )
 252                 {
 253                         $action = $alias[$action];
 254                 }
 255                 $method_name = "action_{$action}";
 256                 self::$action = strtolower($action);
 257
 258                 /* 2. check ticket-needed action */
 259                 if ( !in_array(self::$action, self::$ticketless_actions) && !$manager->checkTicket() )
 260                 {
 261                         self::error(_ERROR_BADTICKET);
 262                         return;
 263                 }
 264
 265                 /* 3. parse according to the action */
 266                 else if ( method_exists('Admin', $method_name) )
 267                 {
 268                         call_user_func(array(__CLASS__, $method_name));
 269                         return;
 270                 }
 271                 /* 4. parse special admin skin */
 272                 elseif ( in_array(self::$action, self::$skinless_actions) )
 273                 {
 274                         /* TODO: need to be implemented or not?
 275                         self::action_parseSpecialskin();
 276                         */
 277                 }
 278                 else
 279                 {
 280                         self::error(_BADACTION . ENTITY::hsc($action));
 281                         return;
 282                 }
 283
 284                 return;
 285         }
 286
 287         /**
 288          * Action::action_showlogin()
 289          *
 290          * @param       void
 291          * @return      void
 292          */
 293         static private function action_showlogin()
 294         {
 295                 global $error;
 296                 self::action_login($error);
 297                 return;
 298         }
 299
 300         /**
 301          * Action::action_login()
 302          *
 303          * @param       string  $msg            message for pageheader
 304          * @param       integer $passvars       ???
 305          */
 306         static private function action_login($msg = '', $passvars = 1)
 307         {
 308                 global $member;
 309
 310                 // skip to overview when allowed
 311                 if ( $member->isLoggedIn() && $member->canLogin() )
 312                 {
 313                         self::action_overview();
 314                         return;
 315                 }
 316
 317                 /* TODO: needless variable??? */
 318                 self::$passvar = $passvars;
 319                 if ( $msg )
 320                 {
 321                         self::$headMess = $msg;
 322                 }
 323
 324                 self::$skin->parse('showlogin');
 325         }
 326
 327         /**
 328          * Action::action_overview()
 329          * provides a screen with the overview of the actions available
 330          *
 331          * @param       string  $msg    message for pageheader
 332          * @return      void
 333          */
 334         static private function action_overview($msg = '')
 335         {
 336                 if ( $msg )
 337                 {
 338                         self::$headMess = $msg;
 339                 }
 340
 341                 self::$skin->parse('overview');
 342                 return;
 343         }
 344
 345         /**
 346          * Admin::action_manage()
 347          *
 348          * @param       string  $msg    message for pageheader
 349          * @retrn       void
 350          */
 351         static private function action_manage($msg = '')
 352         {
 353                 global $member;
 354
 355                 if ( $msg )
 356                 {
 357                         self::$headMess = $msg;
 358                 }
 359                 $member->isAdmin() or self::disallow();
 360
 361                 self::$skin->parse('manage');
 362                 return;
 363         }
 364
 365         /**
 366          * Action::action_itemlist()
 367          *
 368          * @param       integer id for weblod
 369          * @return      void
 370          */
 371         static private function action_itemlist($blogid = '')
 372         {
 373                 global $member, $manager, $CONF;
 374
 375                 if ( $blogid == '' )
 376                 {
 377                         $blogid = intRequestVar('blogid');
 378                 }
 379
 380                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 381
 382                 self::$skin->parse('itemlist');
 383                 return;
 384         }
 385
 386         /**
 387          * Action::action_batchitem()
 388          *
 389          * @param       void
 390          * @return      void
 391          */
 392         static private function action_batchitem()
 393         {
 394                 global $member, $manager;
 395
 396                 $member->isLoggedIn() or self::disallow();
 397
 398                 $selected       = requestIntArray('batch');
 399                 $action         = requestVar('batchaction');
 400
 401                 if ( !is_array($selected) || sizeof($selected) == 0 )
 402                 {
 403                         self::error(_BATCH_NOSELECTION);
 404                         return;
 405                 }
 406
 407                 // On move: when no destination blog/category chosen, show choice now
 408                 $destCatid = intRequestVar('destcatid');
 409                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )
 410                 {
 411                         self::batchMoveSelectDestination('item', $selected);
 412                 }
 413
 414                 // On delete: check if confirmation has been given
 415                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 416                 {
 417                         self::batchAskDeleteConfirmation('item', $selected);
 418                 }
 419
 420                 self::$skin->parse('batchitem');
 421                 return;
 422         }
 423
 424         /**
 425          * Action::action_batchcomment()
 426          *
 427          * @param       void
 428          * @return      void
 429          */
 430         static private function action_batchcomment()
 431         {
 432                 global $member;
 433
 434                 $member->isLoggedIn() or self::disallow();
 435
 436                 $selected       = requestIntArray('batch');
 437                 $action         = requestVar('batchaction');
 438
 439                 // Show error when no items were selected
 440                 if ( !is_array($selected) || sizeof($selected) == 0 )
 441                 {
 442                         self::error(_BATCH_NOSELECTION);
 443                         return;
 444                 }
 445
 446                 // On delete: check if confirmation has been given
 447                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 448                 {
 449                         self::batchAskDeleteConfirmation('comment', $selected);
 450                 }
 451
 452                 self::$skin->parse('batchcomment');
 453                 return;
 454         }
 455
 456         /**
 457          * Admin::action_batchmember()
 458          *
 459          * @param       void
 460          * @return      void
 461          */
 462         static private function action_batchmember()
 463         {
 464                 global $member;
 465
 466                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();
 467
 468                 $selected       = requestIntArray('batch');
 469                 $action         = requestVar('batchaction');
 470
 471                 // Show error when no members selected
 472                 if ( !is_array($selected) || sizeof($selected) == 0 )
 473                 {
 474                         self::error(_BATCH_NOSELECTION);
 475                         return;
 476                 }
 477
 478                 // On delete: check if confirmation has been given
 479                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 480                 {
 481                         self::batchAskDeleteConfirmation('member',$selected);
 482                 }
 483
 484                 self::$skin->parse('batchmember');
 485                 return;
 486         }
 487
 488         /**
 489          * Admin::action_batchteam()
 490          *
 491          * @param       void
 492          * @return      void
 493          */
 494         static private function action_batchteam()
 495         {
 496                 global $member;
 497
 498                 $blogid = intRequestVar('blogid');
 499
 500                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();
 501
 502                 $selected       = requestIntArray('batch');
 503                 $action         = requestVar('batchaction');
 504
 505                 if ( !is_array($selected) || sizeof($selected) == 0 )
 506                 {
 507                         self::error(_BATCH_NOSELECTION);
 508                         return;
 509                 }
 510
 511                 // On delete: check if confirmation has been given
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 513                 {
 514                         self::batchAskDeleteConfirmation('team',$selected);
 515                 }
 516
 517                 self::$skin->parse('batchteam');
 518                 return;
 519         }
 520
 521         /**
 522          * Admin::action_batchcategory()
 523          *
 524          * @param       void
 525          * @return      void
 526          */
 527         static private function action_batchcategory()
 528         {
 529                 global $member, $manager;
 530
 531                 $member->isLoggedIn() or self::disallow();
 532
 533                 $selected       = requestIntArray('batch');
 534                 $action         = requestVar('batchaction');
 535
 536                 if ( !is_array($selected) || sizeof($selected) == 0 )
 537                 {
 538                         self::error(_BATCH_NOSELECTION);
 539                         return;
 540                 }
 541
 542                 // On move: when no destination blog chosen, show choice now
 543                 $destBlogId = intRequestVar('destblogid');
 544                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )
 545                 {
 546                         self::batchMoveCategorySelectDestination('category', $selected);
 547                 }
 548
 549                 // On delete: check if confirmation has been given
 550                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 551                 {
 552                         self::batchAskDeleteConfirmation('category', $selected);
 553                 }
 554
 555                 self::$skin->parse('batchcategory');
 556                 return;
 557         }
 558
 559         /**
 560          * Admin::batchMoveSelectDestination()
 561          *
 562          * @param       string  $type   type of batch action
 563          * @param       integer $ids    needless???
 564          * @return      void
 565          *
 566          * TODO: remove needless argument
 567          */
 568         static private function batchMoveSelectDestination($type, $ids)
 569         {
 570                 $_POST['batchmove'] = $type;
 571                 self::$skin->parse('batchmove');
 572                 return;
 573         }
 574
 575         /**
 576          * Admin::batchMoveCategorySelectDestination()
 577          *
 578          * @param       string  $type   type of batch action
 579          * @param       integer $ids    needless???
 580          * @return      void
 581          *
 582          * TODO: remove needless argument
 583          */
 584         static private function batchMoveCategorySelectDestination($type, $ids)
 585         {
 586                 $_POST['batchmove'] = $type;
 587                 global $manager;
 588                 self::$skin->parse('batchmovecat');
 589                 return;
 590         }
 591
 592         /**
 593          * Admin::batchAskDeleteConfirmation()
 594          *
 595          * @param       string  $type   type of batch action
 596          * @param       integer $ids    needless???
 597          * @return      void
 598          *
 599          * TODO: remove needless argument
 600          */
 601         static private function batchAskDeleteConfirmation($type, $ids)
 602         {
 603                 self::$skin->parse('batchdelete');
 604                 return;
 605         }
 606
 607         /**
 608          * Admin::action_browseownitems()
 609          *
 610          * @param       void
 611          * @return      void
 612          */
 613         static private function action_browseownitems()
 614         {
 615                 global $member, $manager, $CONF;
 616
 617                 self::$skin->parse('browseownitems');
 618                 return;
 619         }
 620
 621         /**
 622          * Admin::action_itemcommentlist()
 623          * Show all the comments for a given item
 624          *
 625          * @param       integer $itemid ID for item
 626          * @return      void
 627          */
 628         static private function action_itemcommentlist($itemid = '')
 629         {
 630                 global $member, $manager, $CONF;
 631
 632                 if ( $itemid == '' )
 633                 {
 634                         $itemid = intRequestVar('itemid');
 635                 }
 636
 637                 // only allow if user is allowed to alter item
 638                 $member->canAlterItem($itemid) or self::disallow();
 639
 640                 $item =& $manager->getItem($itemid, 1, 1);
 641                 $_REQUEST['itemid'] = $item['itemid'];
 642                 $_REQUEST['blogid'] = $item['blogid'];
 643
 644                 self::$skin->parse('itemcommentlist');
 645                 return;
 646         }
 647
 648         /**
 649          * Admin::action_browseowncomments()
 650          * Browse own comments
 651          *
 652          * @param       void
 653          * @return      void
 654          */
 655         static private function action_browseowncomments()
 656         {
 657                 self::$skin->parse('browseowncomments');
 658                 return;
 659         }
 660
 661         /**
 662          * Admin::action_blogcommentlist()
 663          * Browse all comments for a weblog
 664          *
 665          * @param       integer $blogid ID for weblog
 666          * @return      void
 667          */
 668         static private function action_blogcommentlist($blogid = '')
 669         {
 670                 global $member, $manager, $CONF;
 671
 672                 if ( $blogid == '' )
 673                 {
 674                         $blogid = intRequestVar('blogid');
 675                 }
 676                 else
 677                 {
 678                         $blogid = intval($blogid);
 679                 }
 680
 681                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 682
 683                 /* TODO: we consider to use the other way insterad of this */
 684                 $_REQUEST['blogid'] = $blogid;
 685
 686                 self::$skin->parse('blogcommentlist');
 687                 return;
 688         }
 689
 690         /**
 691          * Admin::action_createaccount()
 692          *
 693          * @param       void
 694          * @return      void
 695          */
 696         static private function action_createaccount()
 697         {
 698                 global $CONF;
 699
 700                 if ( $CONF['AllowMemberCreate'] != 1 )
 701                 {
 702                         self::$skin->parse('createaccountdisable');
 703                         return;
 704                 }
 705
 706                 $name = '';
 707                 $realname ='';
 708                 $email = '';
 709                 $url = '';
 710
 711                 $contents = array(
 712                         'name'          => '',
 713                         'realname'      => '',
 714                         'email'         => '',
 715                         'url'           => ''
 716                 );
 717
 718                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )
 719                 {
 720                         $action = new Action();
 721                         $message = $action->createAccount();
 722                         if ( $message === 1 )
 723                         {
 724                                 self::$headMess = $message;
 725                                 self::$skin->parse('createaccountsuccess');
 726                                 return;
 727                         }
 728
 729                         /* TODO: validation */
 730                         if ( array_key_exists('name', $_POST) )
 731                         {
 732                                 $contents['name'] = $_POST['name'];
 733                         }
 734                         if ( array_key_exists('realname', $_POST) )
 735                         {
 736                                 $contents['realname'] = $_POST['realname'];
 737                         }
 738                         if ( array_key_exists('email', $_POST) )
 739                         {
 740                                 $contents['email'] = $_POST['email'];
 741                         }
 742                         if ( array_key_exists('url', $_POST) )
 743                         {
 744                                 $contents['url'] = $_POST['url'];
 745                         }
 746
 747                         self::$contents = $contents;
 748
 749                 }
 750
 751                 self::$skin->parse('createaccountinput');
 752                 return;
 753         }
 754
 755         /**
 756          * Admin::action_createitem()
 757          * Provide a page to item a new item to the given blog
 758          *
 759          * @param       void
 760          * @return      void
 761          */
 762         static private function action_createitem()
 763         {
 764                 global $member, $manager;
 765
 766                 $blogid = intRequestVar('blogid');
 767
 768                 // check if allowed
 769                 $member->teamRights($blogid) or self::disallow();
 770
 771                 $blog =& $manager->getBlog($blogid);
 772                 $contents = array();
 773
 774                 $data = array(
 775                         'blog'          => &$blog,
 776                         'contents'      => &$contents
 777                 );
 778                 $manager->notify('PreAddItemForm', $data);
 779
 780                 if ( $blog->convertBreaks() )
 781                 {
 782                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )
 783                         {
 784                                 $contents['body'] = removeBreaks($contents['body']);
 785                         }
 786                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )
 787                         {
 788                                 $contents['more'] = removeBreaks($contents['more']);
 789                         }
 790                 }
 791
 792                 self::$blog = &$blog;
 793                 self::$contents = &$contents;
 794
 795                 self::$skin->parse('createitem');
 796                 return;
 797         }
 798
 799         /**
 800          * Admin::action_itemedit()
 801          *
 802          * @param       void
 803          * @return      void
 804          */
 805         static private function action_itemedit()
 806         {
 807                 global $member, $manager;
 808
 809                 $itemid = intRequestVar('itemid');
 810
 811                 // only allow if user is allowed to alter item
 812                 $member->canAlterItem($itemid) or self::disallow();
 813
 814                 $item =& $manager->getItem($itemid, 1, 1);
 815                 $blog =& $manager->getBlog($item['blogid']);
 816                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));
 817
 818                 if ( $blog->convertBreaks() )
 819                 {
 820                         if ( array_key_exists('body', $item) && !empty($item['body']) )
 821                         {
 822                                 $item['body'] = removeBreaks($item['body']);
 823                         }
 824                         if ( array_key_exists('more', $item) && !empty($item['more']) )
 825                         {
 826                                 $item['more'] = removeBreaks($item['more']);
 827                         }
 828                 }
 829
 830                 self::$blog = &$blog;
 831                 self::$contents = &$item;
 832
 833                 self::$skin->parse('itemedit');
 834                 return;
 835         }
 836
 837         /**
 838          * Admin::action_itemupdate()
 839          *
 840          * @param       void
 841          * @return      void
 842          */
 843         static private function action_itemupdate()
 844         {
 845                 global $member, $manager, $CONF;
 846
 847                 $itemid = intRequestVar('itemid');
 848                 $catid  = postVar('catid');
 849
 850                 // only allow if user is allowed to alter item
 851                 $member->canUpdateItem($itemid, $catid) or self::disallow();
 852
 853                 $actiontype = postVar('actiontype');
 854
 855                 // delete actions are handled by itemdelete (which has confirmation)
 856                 if ( $actiontype == 'delete' )
 857                 {
 858                         self::action_itemdelete();
 859                         return;
 860                 }
 861
 862                 $body           = postVar('body');
 863                 $title          = postVar('title');
 864                 $more           = postVar('more');
 865                 $closed         = intPostVar('closed');
 866                 $draftid        = intPostVar('draftid');
 867
 868                 // default action = add now
 869                 if ( !$actiontype )
 870                 {
 871                         $actiontype='addnow';
 872                 }
 873
 874                 // create new category if needed
 875                 if ( i18n::strpos($catid,'newcat') === 0 )
 876                 {
 877                         // get blogid
 878                         list($blogid) = sscanf($catid,"newcat-%d");
 879
 880                         // create
 881                         $blog =& $manager->getBlog($blogid);
 882                         $catid = $blog->createNewCategory();
 883
 884                         // show error when sth goes wrong
 885                         if ( !$catid )
 886                         {
 887                                 self::doError(_ERROR_CATCREATEFAIL);
 888                         }
 889                 }
 890
 891                 /**
 892                  * set some variables based on actiontype
 893                  *
 894                  * actiontypes:
 895                  *      draft items -> addnow, addfuture, adddraft, delete
 896                  *      non-draft items -> edit, changedate, delete
 897                  *
 898                  * variables set:
 899                  *      $timestamp: set to a nonzero value for future dates or date changes
 900                  *      $wasdraft: set to 1 when the item used to be a draft item
 901                  *      $publish: set to 1 when the edited item is not a draft
 902                  */
 903                 $blogid =  getBlogIDFromItemID($itemid);
 904                 $blog =& $manager->getBlog($blogid);
 905
 906                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');
 907                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
 908                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
 909                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )
 910                 {
 911                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
 912                 }
 913                 else
 914                 {
 915                         $timestamp =0;
 916                 }
 917
 918                 // edit the item for real
 919                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
 920
 921                 self::updateFuturePosted($blogid);
 922
 923                 if ( $draftid > 0 )
 924                 {
 925                         // delete permission is checked inside Item::delete()
 926                         Item::delete($draftid);
 927                 }
 928
 929                 if ( $catid != intPostVar('catid') )
 930                 {
 931                         self::action_categoryedit(
 932                                 $catid,
 933                                 $blog->getID(),
 934                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
 935                         );
 936                 }
 937                 else
 938                 {
 939                         // TODO: set start item correctly for itemlist
 940                         $item =& $manager->getitem($itemid, 1, 1);
 941                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";
 942                         $query = sprintf($query, sql_table('item'), $item['timestamp']);
 943                         $cnt  = DB::getValue($query);
 944                         $_REQUEST['start'] = $cnt + 1;
 945                         self::action_itemlist(getBlogIDFromItemID($itemid));
 946                 }
 947                 return;
 948         }
 949
 950         /**
 951          * Admin::action_itemdelete()
 952          * Delete item
 953          *
 954          * @param       Void
 955          * @return      Void
 956          */
 957         static private function action_itemdelete()
 958         {
 959                 global $member, $manager;
 960
 961                 $itemid = intRequestVar('itemid');
 962
 963                 // only allow if user is allowed to alter item
 964                 $member->canAlterItem($itemid) or self::disallow();
 965
 966                 if ( !$manager->existsItem($itemid,1,1) )
 967                 {
 968                         self::error(_ERROR_NOSUCHITEM);
 969                         return;
 970                 }
 971
 972                 self::$skin->parse('itemdelete');
 973                 return;
 974         }
 975
 976         /**
 977          * Admin::action_itemdeleteconfirm()
 978          *
 979          * @param       void
 980          * @return      void
 981          */
 982         static private function action_itemdeleteconfirm()
 983         {
 984                 global $member, $manager;
 985
 986                 $itemid = intRequestVar('itemid');
 987
 988                 // only allow if user is allowed to alter item
 989                 $member->canAlterItem($itemid) or self::disallow();
 990
 991                 // get item first
 992                 $item =& $manager->getItem($itemid, 1, 1);
 993
 994                 // delete item (note: some checks will be performed twice)
 995                 self::deleteOneItem($item['itemid']);
 996
 997                 self::action_itemlist($item['blogid']);
 998                 return;
 999         }
1000
1001         /**
1002          * Admin::deleteOneItem()
1003          * Deletes one item and returns error if something goes wrong
1004          *
1005          * @param       integer $itemid ID for item
1006          * @return      void
1007          */
1008         static public function deleteOneItem($itemid)
1009         {
1010                 global $member, $manager;
1011
1012                 // only allow if user is allowed to alter item (also checks if itemid exists)
1013                 if ( !$member->canAlterItem($itemid) )
1014                 {
1015                         return _ERROR_DISALLOWED;
1016                 }
1017
1018                 // need to get blogid before the item is deleted
1019                 $item =& $manager->getItem($itemid, 1, 1);
1020
1021                 $manager->loadClass('ITEM');
1022                 Item::delete($item['itemid']);
1023
1024                 // update blog's futureposted
1025                 self::updateFuturePosted($item['itemid']);
1026                 return;
1027         }
1028
1029         /**
1030          * Admin::updateFuturePosted()
1031          * Update a blog's future posted flag
1032          *
1033          * @param integer $blogid
1034          * @return      void
1035          */
1036         static private function updateFuturePosted($blogid)
1037         {
1038                 global $manager;
1039
1040                 $blogid                 =  intval($blogid);
1041                 $blog                   =& $manager->getBlog($blogid);
1042                 $currenttime    =  $blog->getCorrectTime(time());
1043
1044                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1045                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1046                 $result = DB::getResult($query);
1047
1048                 if ( $result->rowCount() > 0 )
1049                 {
1050                                 $blog->setFuturePost();
1051                 }
1052                 else
1053                 {
1054                                 $blog->clearFuturePost();
1055                 }
1056                 return;
1057         }
1058
1059         /**
1060          * Admin::action_itemmove()
1061          *
1062          * @param       void
1063          * @return      void
1064          */
1065         static private function action_itemmove()
1066         {
1067                 global $member, $manager;
1068
1069                 $itemid = intRequestVar('itemid');
1070
1071                 $member->canAlterItem($itemid) or self::disallow();
1072
1073                 self::$skin->parse('itemmove');
1074                 return;
1075         }
1076
1077         /**
1078          * Admin::action_itemmoveto()
1079          *
1080          * @param       void
1081          * @return      void
1082          */
1083         static private function action_itemmoveto()
1084         {
1085                 global $member, $manager;
1086
1087                 $itemid = intRequestVar('itemid');
1088                 $catid = requestVar('catid');
1089
1090                 // create new category if needed
1091                 if ( i18n::strpos($catid,'newcat') === 0 )
1092                 {
1093                         // get blogid
1094                         list($blogid) = sscanf($catid,'newcat-%d');
1095
1096                         // create
1097                         $blog =& $manager->getBlog($blogid);
1098                         $catid = $blog->createNewCategory();
1099
1100                         // show error when sth goes wrong
1101                         if ( !$catid )
1102                         {
1103                                 self::doError(_ERROR_CATCREATEFAIL);
1104                         }
1105                 }
1106
1107                 // only allow if user is allowed to alter item
1108                 $member->canUpdateItem($itemid, $catid) or self::disallow();
1109
1110                 $old_blogid = getBlogIDFromItemId($itemid);
1111
1112                 Item::move($itemid, $catid);
1113
1114                 // set the futurePosted flag on the blog
1115                 self::updateFuturePosted(getBlogIDFromItemId($itemid));
1116
1117                 // reset the futurePosted in case the item is moved from one blog to another
1118                 self::updateFuturePosted($old_blogid);
1119
1120                 if ( $catid != intRequestVar('catid') )
1121                 {
1122                         self::action_categoryedit($catid, $blog->getID());
1123                 }
1124                 else
1125                 {
1126                         self::action_itemlist(getBlogIDFromCatID($catid));
1127                 }
1128                 return;
1129         }
1130
1131         /**
1132          * Admin::moveOneItem()
1133          * Moves one item to a given category (category existance should be checked by caller)
1134          * errors are returned
1135          *
1136          * @param       integer $itemid         ID for item
1137          * @param       integer $destCatid      ID for category to which the item will be moved
1138          * @return      void
1139          */
1140         static public function moveOneItem($itemid, $destCatid)
1141         {
1142                 global $member;
1143
1144                 // only allow if user is allowed to move item
1145                 if ( !$member->canUpdateItem($itemid, $destCatid) )
1146                 {
1147                         return _ERROR_DISALLOWED;
1148                 }
1149
1150                 Item::move($itemid, $destCatid);
1151                 return;
1152         }
1153
1154         /**
1155          * Admin::action_additem()
1156          * Adds a item to the chosen blog
1157          *
1158          * @param       void
1159          * @return      void
1160          */
1161         static private function action_additem()
1162         {
1163                 global $manager, $CONF;
1164
1165                 $manager->loadClass('ITEM');
1166
1167                 $result = Item::createFromRequest();
1168
1169                 if ( $result['status'] == 'error' )
1170                 {
1171                         self::error($result['message']);
1172                         return;
1173                 }
1174
1175                 $item =& $manager->getItem($result['itemid'], 0, 0);
1176
1177                 if ( $result['status'] == 'newcategory' )
1178                 {
1179                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);
1180                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);
1181                 }
1182                 else
1183                 {
1184                         $methodName = 'action_itemlist';
1185                         self::action_itemlist($item['blogid']);
1186                 }
1187                 return;
1188         }
1189
1190         /**
1191          * Admin::action_commentedit()
1192          * Allows to edit previously made comments
1193          *
1194          * @param       void
1195          * @return      void
1196          */
1197         static private function action_commentedit()
1198         {
1199                 global $member, $manager;
1200
1201                 $commentid = intRequestVar('commentid');
1202
1203                 $member->canAlterComment($commentid) or self::disallow();
1204
1205                 $comment = COMMENT::getComment($commentid);
1206                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));
1207
1208                 self::$contents = $comment;
1209                 self::$skin->parse('commentedit');
1210                 return;
1211         }
1212
1213         /**
1214          * Admin::action_commentupdate()
1215          *
1216          * @param       void
1217          * @return      void
1218          */
1219         static private function action_commentupdate()
1220         {
1221                 global $member, $manager;
1222
1223                 $commentid = intRequestVar('commentid');
1224
1225                 $member->canAlterComment($commentid) or self::disallow();
1226
1227                 $url    = postVar('url');
1228                 $email  = postVar('email');
1229                 $body   = postVar('body');
1230
1231                 // intercept words that are too long
1232                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1233                 {
1234                         self::error(_ERROR_COMMENT_LONGWORD);
1235                         return;
1236                 }
1237
1238                 // check length
1239                 if ( i18n::strlen($body) < 3 )
1240                 {
1241                         self::error(_ERROR_COMMENT_NOCOMMENT);
1242                         return;
1243                 }
1244
1245                 if ( i18n::strlen($body) > 5000 )
1246                 {
1247                         self::error(_ERROR_COMMENT_TOOLONG);
1248                         return;
1249                 }
1250
1251                 // prepare body
1252                 $body = Comment::prepareBody($body);
1253
1254                 // call plugins
1255                 $data = array(
1256                         'body' => &$body
1257                 );
1258                 $manager->notify('PreUpdateComment', $data);
1259
1260                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";
1261                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);
1262                 DB::execute($query);
1263
1264                 // get itemid
1265                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1266                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1267
1268                 $itemid = DB::getValue($query);
1269
1270                 if ( $member->canAlterItem($itemid) )
1271                 {
1272                         self::action_itemcommentlist($itemid);
1273                 }
1274                 else
1275                 {
1276                         self::action_browseowncomments();
1277                 }
1278                 return;
1279         }
1280
1281         /**
1282          * Admin::action_commentdelete()
1283          * Update comment
1284          *
1285          * @param       void
1286          * @return      void
1287          */
1288         static private function action_commentdelete()
1289         {
1290                 global $member, $manager;
1291
1292                 $commentid = intRequestVar('commentid');
1293                 $member->canAlterComment($commentid) or self::disallow();
1294
1295                 self::$skin->parse('commentdelete');
1296                 return;
1297         }
1298
1299         /**
1300          * Admin::action_commentdeleteconfirm()
1301          *
1302          * @param       void
1303          * @return      void
1304          */
1305         static private function action_commentdeleteconfirm()
1306         {
1307                 global $member;
1308
1309                 $commentid = intRequestVar('commentid');
1310
1311                 // get item id first
1312                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1313                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1314
1315                 $itemid = DB::getValue($query);
1316
1317                 $error = self::deleteOneComment($commentid);
1318                 if ( $error )
1319                 {
1320                         self::doError($error);
1321                 }
1322
1323                 if ( $member->canAlterItem($itemid) )
1324                 {
1325                         self::action_itemcommentlist($itemid);
1326                 }
1327                 else
1328                 {
1329                         self::action_browseowncomments();
1330                 }
1331                 return;
1332         }
1333
1334         /**
1335          * Admin::deleteOneComment()
1336          *
1337          * @param       integer $commentid      ID for comment
1338          * @return      void
1339          */
1340         static public function deleteOneComment($commentid)
1341         {
1342                 global $member, $manager;
1343
1344                 $commentid = (integer) $commentid;
1345
1346                 if ( !$member->canAlterComment($commentid) )
1347                 {
1348                         return _ERROR_DISALLOWED;
1349                 }
1350
1351                 $data = array(
1352                         'commentid' => $commentid
1353                 );
1354
1355                 $manager->notify('PreDeleteComment', $data);
1356
1357                 // delete the comments associated with the item
1358                 $query = "DELETE FROM %s WHERE cnumber=%d;";
1359                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1360                 DB::execute($query);
1361
1362                 $data = array(
1363                         'commentid' => $commentid
1364                 );
1365
1366                 $manager->notify('PostDeleteComment', $data);
1367
1368                 return '';
1369         }
1370
1371         /**
1372          * Admin::action_usermanagement()
1373          * Usermanagement main
1374          *
1375          * @param       void
1376          * @return      void
1377          */
1378         static private function action_usermanagement()
1379         {
1380                 global $member, $manager;
1381
1382                 // check if allowed
1383                 $member->isAdmin() or self::disallow();
1384
1385                 self::$skin->parse('usermanagement');
1386                 return;
1387         }
1388
1389         /**
1390          * Admin::action_memberedit()
1391          * Edit member settings
1392          *
1393          * @param       void
1394          * @return      void
1395          */
1396         static private function action_memberedit()
1397         {
1398                 self::action_editmembersettings(intRequestVar('memberid'));
1399                 return;
1400         }
1401
1402         /**
1403          * Admin::action_editmembersettings()
1404          *
1405          * @param       integer $memberid       ID for member
1406          * @return      void
1407          *
1408          */
1409         static private function action_editmembersettings($memberid = '')
1410         {
1411                 global $member, $manager, $CONF;
1412
1413                 if ( $memberid == '' )
1414                 {
1415                         $memberid = $member->getID();
1416                 }
1417
1418                 /* TODO: we should consider to use the other way insterad of this */
1419                 $_REQUEST['memberid'] = $memberid;
1420
1421                 // check if allowed
1422                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1423
1424                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
1425
1426                 self::$skin->parse('editmembersettings');
1427                 return;
1428         }
1429
1430         /**
1431          * Admin::action_changemembersettings()
1432          *
1433          * @param       void
1434          * @return      void
1435          */
1436         static private function action_changemembersettings()
1437         {
1438                 global $member, $CONF, $manager;
1439
1440                 $memberid = intRequestVar('memberid');
1441
1442                 // check if allowed
1443                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1444
1445                 $name                   = trim(strip_tags(postVar('name')));
1446                 $realname               = trim(strip_tags(postVar('realname')));
1447                 $password               = postVar('password');
1448                 $repeatpassword = postVar('repeatpassword');
1449                 $email                  = strip_tags(postVar('email'));
1450                 $url                    = strip_tags(postVar('url'));
1451                 $adminskin              = intPostVar('adminskin');
1452                 $bookmarklet    = intPostVar('bookmarklet');
1453
1454                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1455                 if ( !preg_match('#^https?://#', $url) )
1456                 {
1457                         $url = 'http://' . $url;
1458                 }
1459
1460                 $admin          = postVar('admin');
1461                 $canlogin       = postVar('canlogin');
1462                 $notes          = strip_tags(postVar('notes'));
1463                 $locale         = postVar('locale');
1464
1465                 $mem =& $manager->getMember($memberid);
1466
1467                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1468                 {
1469                         if ( !isValidDisplayName($name) )
1470                         {
1471                                 self::error(_ERROR_BADNAME);
1472                                 return;
1473                         }
1474
1475                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )
1476                         {
1477                                 self::error(_ERROR_NICKNAMEINUSE);
1478                                 return;
1479                         }
1480
1481                         if ( $password != $repeatpassword )
1482                         {
1483                                 self::error(_ERROR_PASSWORDMISMATCH);
1484                                 return;
1485                         }
1486
1487                         if ( $password && (i18n::strlen($password) < 6) )
1488                         {
1489                                 self::error(_ERROR_PASSWORDTOOSHORT);
1490                                 return;
1491                         }
1492
1493                         if ( $password )
1494                         {
1495                                 $pwdvalid = true;
1496                                 $pwderror = '';
1497
1498                                 $data = array(
1499                                         'password'     => $password,
1500                                         'errormessage' => &$pwderror,
1501                                         'valid'        => &$pwdvalid
1502                                 );
1503                                 $manager->notify('PrePasswordSet', $data);
1504
1505                                 if ( !$pwdvalid )
1506                                 {
1507                                         self::error($pwderror);
1508                                         return;
1509                                 }
1510                         }
1511                 }
1512
1513                 if ( !NOTIFICATION::address_validation($email) )
1514                 {
1515                         self::error(_ERROR_BADMAILADDRESS);
1516                         return;
1517                 }
1518                 if ( !$realname )
1519                 {
1520                         self::error(_ERROR_REALNAMEMISSING);
1521                         return;
1522                 }
1523                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
1524                 {
1525                         self::error(_ERROR_NOSUCHTRANSLATION);
1526                         return;
1527                 }
1528
1529                 // check if there will remain at least one site member with both the logon and admin rights
1530                 // (check occurs when taking away one of these rights from such a member)
1531                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1532                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1533                         )
1534                 {
1535                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1536                         if ( $r->rowCount() < 2 )
1537                         {
1538                                 self::error(_ERROR_ATLEASTONEADMIN);
1539                                 return;
1540                         }
1541                 }
1542
1543                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1544                 {
1545                         $mem->setDisplayName($name);
1546                         if ( $password )
1547                         {
1548                                 $mem->setPassword($password);
1549                         }
1550                 }
1551
1552                 $oldEmail = $mem->getEmail();
1553
1554                 $mem->setRealName($realname);
1555                 $mem->setEmail($email);
1556                 $mem->setURL($url);
1557                 $mem->setNotes($notes);
1558                 $mem->setLocale($locale);
1559                 $mem->setAdminSkin($adminskin);
1560                 $mem->setBookmarklet($bookmarklet);
1561
1562                 // only allow super-admins to make changes to the admin status
1563                 if ( $member->isAdmin() )
1564                 {
1565                         $mem->setAdmin($admin);
1566                         $mem->setCanLogin($canlogin);
1567                 }
1568
1569                 $autosave = postVar('autosave');
1570                 $mem->setAutosave($autosave);
1571
1572                 $mem->write();
1573
1574                 // store plugin options
1575                 $aOptions = requestArray('plugoption');
1576                 NucleusPlugin::apply_plugin_options($aOptions);
1577                 $data = array(
1578                         'context'  => 'member',
1579                         'memberid' => $memberid,
1580                         'member'   => &$mem
1581                 );
1582                 $manager->notify('PostPluginOptionsUpdate', $data);
1583
1584                 // if email changed, generate new password
1585                 if ( $oldEmail != $mem->getEmail() )
1586                 {
1587                         $mem->sendActivationLink('addresschange', $oldEmail);
1588                         // logout member
1589                         $mem->newCookieKey();
1590
1591                         // only log out if the member being edited is the current member.
1592                         if ( $member->getID() == $memberid )
1593                         {
1594                                 $member->logout();
1595                         }
1596                         self::action_login(_MSG_ACTIVATION_SENT, 0);
1597                         return;
1598                 }
1599
1600                 if ( ($mem->getID() == $member->getID())
1601                         && ($mem->getDisplayName() != $member->getDisplayName()) )
1602                 {
1603                         $mem->newCookieKey();
1604                         $member->logout();
1605                         self::action_login(_MSG_LOGINAGAIN, 0);
1606                 }
1607                 else
1608                 {
1609                         self::action_overview(_MSG_SETTINGSCHANGED);
1610                 }
1611                 return;
1612         }
1613
1614         /**
1615          * Admin::action_memberadd()
1616          *
1617          * @param       void
1618          * @return      void
1619          *
1620          */
1621         static private function action_memberadd()
1622         {
1623                 global $member, $manager;
1624
1625                 // check if allowed
1626                 $member->isAdmin() or self::disallow();
1627
1628                 if ( postVar('password') != postVar('repeatpassword') )
1629                 {
1630                         self::error(_ERROR_PASSWORDMISMATCH);
1631                         return;
1632                 }
1633
1634                 if ( i18n::strlen(postVar('password')) < 6 )
1635                 {
1636                         self::error(_ERROR_PASSWORDTOOSHORT);
1637                         return;
1638                 }
1639
1640                 $res = Member::create(
1641                         postVar('name'),
1642                         postVar('realname'),
1643                         postVar('password'),
1644                         postVar('email'),
1645                         postVar('url'),
1646                         postVar('admin'),
1647                         postVar('canlogin'),
1648                         postVar('notes')
1649                 );
1650
1651                 if ( $res != 1 )
1652                 {
1653                         self::error($res);
1654                         return;
1655                 }
1656
1657                 // fire PostRegister event
1658                 $newmem = new Member();
1659                 $newmem->readFromName(postVar('name'));
1660                 $data = array(
1661                         'member' => &$newmem
1662                 );
1663                 $manager->notify('PostRegister', $data);
1664
1665                 self::action_usermanagement();
1666                 return;
1667         }
1668
1669         /**
1670          * Admin::action_forgotpassword()
1671          *
1672          * @param       void
1673          * @return      void
1674          */
1675         static private function action_forgotpassword()
1676         {
1677                 self::$skin->parse('forgotpassword');
1678                 return;
1679         }
1680
1681         /**
1682          * Admin::action_activate()
1683          * Account activation
1684          *
1685          * @param       void
1686          * @return      void
1687          */
1688         static private function action_activate()
1689         {
1690                 $key = getVar('key');
1691                 self::showActivationPage($key);
1692                 return;
1693         }
1694
1695         /**
1696          * Admin::showActivationPage()
1697          *
1698          * @param       void
1699          * @return      void
1700          */
1701         static private function showActivationPage($key, $message = '')
1702         {
1703                 global $manager;
1704
1705                 // clean up old activation keys
1706                 Member::cleanupActivationTable();
1707
1708                 // get activation info
1709                 $info = Member::getActivationInfo($key);
1710
1711                 if ( !$info )
1712                 {
1713                         self::error(_ERROR_ACTIVATE);
1714                         return;
1715                 }
1716
1717                 $mem =& $manager->getMember($info->vmember);
1718
1719                 if ( !$mem )
1720                 {
1721                         self::error(_ERROR_ACTIVATE);
1722                         return;
1723                 }
1724
1725                 /* TODO: we should consider to use the other way insterad of this */
1726                 $_POST['ackey']                                 = $key;
1727                 $_POST['bNeedsPasswordChange']  = TRUE;
1728
1729                 self::$headMess = $message;
1730                 self::$skin->parse('activate');
1731                 return;
1732         }
1733
1734         /**
1735          * Admin::action_activatesetpwd()
1736          * Account activation - set password part
1737          *
1738          * @param       void
1739          * @return      void
1740          */
1741         static private function action_activatesetpwd()
1742         {
1743                 global $manager;
1744                 $key = postVar('key');
1745
1746                 // clean up old activation keys
1747                 Member::cleanupActivationTable();
1748
1749                 // get activation info
1750                 $info = Member::getActivationInfo($key);
1751
1752                 if ( !$info || ($info->type == 'addresschange') )
1753                 {
1754                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1755                 }
1756
1757                 $mem =& $manager->getMember($info->vmember);
1758
1759                 if ( !$mem )
1760                 {
1761                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1762                 }
1763
1764                 $password               = postVar('password');
1765                 $repeatpassword = postVar('repeatpassword');
1766
1767                 if ( $password != $repeatpassword )
1768                 {
1769                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);
1770                 }
1771
1772                 if ( $password && (i18n::strlen($password) < 6) )
1773                 {
1774                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
1775                 }
1776
1777                 if ( $password )
1778                 {
1779                         $pwdvalid = true;
1780                         $pwderror = '';
1781
1782                         $data = array(
1783                                 'password'              => $password,
1784                                 'errormessage'  => &$pwderror,
1785                                 'valid'                 => &$pwdvalid
1786                         );
1787                         $manager->notify('PrePasswordSet', $data);
1788                         if ( !$pwdvalid )
1789                         {
1790                                 return self::showActivationPage($key,$pwderror);
1791                         }
1792                 }
1793
1794                 $error = '';
1795
1796                 $data = array(
1797                         'type'   => 'activation',
1798                         'member' => $mem,
1799                         'error'  => &$error
1800                 );
1801                 $manager->notify('ValidateForm', $data);
1802                 if ( $error != '' )
1803                 {
1804                         return self::showActivationPage($key, $error);
1805                 }
1806
1807                 // set password
1808                 $mem->setPassword($password);
1809                 $mem->write();
1810
1811                 // do the activation
1812                 Member::activate($key);
1813
1814                 self::$skin->parse('activatesetpwd');
1815                 return;
1816         }
1817
1818         /**
1819          * Admin::action_manageteam()
1820          * Manage team
1821          *
1822          * @param       void
1823          * @return      void
1824          */
1825         static private function action_manageteam()
1826         {
1827                 global $member, $manager;
1828
1829                 $blogid = intRequestVar('blogid');
1830
1831                 // check if allowed
1832                 $member->blogAdminRights($blogid) or self::disallow();
1833
1834                 self::$skin->parse('manageteam');
1835                 return;
1836         }
1837
1838         /**
1839          * Admin::action_teamaddmember()
1840          * Add member to team
1841          *
1842          * @param       void
1843          * @return      void
1844          */
1845         static private function action_teamaddmember()
1846         {
1847                 global $member, $manager;
1848
1849                 $memberid       = intPostVar('memberid');
1850                 $blogid         = intPostVar('blogid');
1851                 $admin          = intPostVar('admin');
1852
1853                 // check if allowed
1854                 $member->blogAdminRights($blogid) or self::disallow();
1855
1856                 $blog =& $manager->getBlog($blogid);
1857                 if ( !$blog->addTeamMember($memberid, $admin) )
1858                 {
1859                         self::error(_ERROR_ALREADYONTEAM);
1860                         return;
1861                 }
1862
1863                 self::action_manageteam();
1864                 return;
1865         }
1866
1867         /**
1868          * Admin::action_teamdelete()
1869          *
1870          * @param       void
1871          * @return      void
1872          */
1873         static private function action_teamdelete()
1874         {
1875                 global $member, $manager;
1876
1877                 $memberid       = intRequestVar('memberid');
1878                 $blogid         = intRequestVar('blogid');
1879
1880                 // check if allowed
1881                 $member->blogAdminRights($blogid) or self::disallow();
1882
1883                 $teammem =& $manager->getMember($memberid);
1884                 $blog =& $manager->getBlog($blogid);
1885
1886                 self::$skin->parse('teamdelete');
1887                 return;
1888         }
1889
1890         /**
1891          * Admin::action_teamdeleteconfirm()
1892          *
1893          * @param       void
1894          * @return      void
1895          */
1896         static private function action_teamdeleteconfirm()
1897         {
1898                 global $member;
1899
1900                 $memberid = intRequestVar('memberid');
1901                 $blogid = intRequestVar('blogid');
1902
1903                 $error = self::deleteOneTeamMember($blogid, $memberid);
1904                 if ( $error )
1905                 {
1906                         self::error($error);
1907                         return;
1908                 }
1909                 self::action_manageteam();
1910                 return;
1911         }
1912
1913         /**
1914          * Admin::deleteOneTeamMember()
1915          *
1916          * @param       void
1917          * @return      void
1918          */
1919         static public function deleteOneTeamMember($blogid, $memberid)
1920         {
1921                 global $member, $manager;
1922
1923                 $blogid   = intval($blogid);
1924                 $memberid = intval($memberid);
1925
1926                 // check if allowed
1927                 if ( !$member->blogAdminRights($blogid) )
1928                 {
1929                         return _ERROR_DISALLOWED;
1930                 }
1931
1932                 // check if: - there remains at least one blog admin
1933                 //           - (there remains at least one team member)
1934                 $tmem =& $manager->getMember($memberid);
1935
1936
1937                 $data = array(
1938                         'member' => &$tmem,
1939                         'blogid' => $blogid
1940                 );
1941                 $manager->notify('PreDeleteTeamMember', $data);
1942
1943                 if ( $tmem->isBlogAdmin($blogid) )
1944                 {
1945                         /* TODO: why we did double check? */
1946                         // check if there are more blog members left and at least one admin
1947                         // (check for at least two admins before deletion)
1948                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";
1949                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1950                         $r     = DB::getResult($query);
1951                         if ( $r->rowCount() < 2 )
1952                         {
1953                                 return _ERROR_ATLEASTONEBLOGADMIN;
1954                         }
1955                 }
1956
1957                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";
1958                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);
1959                 DB::execute($query);
1960
1961                 $data = array(
1962                         'member' => &$tmem,
1963                         'blogid' => $blogid
1964                 );
1965                 $manager->notify('PostDeleteTeamMember', $data);
1966
1967                 return '';
1968         }
1969
1970         /**
1971          * Admin::action_teamchangeadmin()
1972          *
1973          * @param       void
1974          * @return      void
1975          */
1976         static private function action_teamchangeadmin()
1977         {
1978                 global $manager, $member;
1979
1980                 $blogid         = intRequestVar('blogid');
1981                 $memberid       = intRequestVar('memberid');
1982
1983                 // check if allowed
1984                 $member->blogAdminRights($blogid) or self::disallow();
1985
1986                 $mem =& $manager->getMember($memberid);
1987
1988                 // don't allow when there is only one admin at this moment
1989                 if ( $mem->isBlogAdmin($blogid) )
1990                 {
1991                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";
1992                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1993                         $r = DB::getResult($query);
1994                         if ( $r->rowCount() == 1 )
1995                         {
1996                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);
1997                                 return;
1998                         }
1999                 }
2000
2001                 if ( $mem->isBlogAdmin($blogid) )
2002                 {
2003                         $newval = 0;
2004                 }
2005                 else
2006                 {
2007                         $newval = 1;
2008                 }
2009
2010                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";
2011                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);
2012                 DB::execute($query);
2013
2014                 // only show manageteam if member did not change its own admin privileges
2015                 if ( $member->isBlogAdmin($blogid) )
2016                 {
2017                         self::action_manageteam();
2018                 }
2019                 else
2020                 {
2021                         self::action_overview(_MSG_ADMINCHANGED);
2022                 }
2023                 return;
2024         }
2025
2026         /**
2027          * Admin::action_blogsettings()
2028          *
2029          * @param       void
2030          * @return      void
2031          */
2032         static private function action_blogsettings()
2033         {
2034                 global $member, $manager;
2035
2036                 $blogid = intRequestVar('blogid');
2037
2038                 // check if allowed
2039                 $member->blogAdminRights($blogid) or self::disallow();
2040
2041                 $blog =& $manager->getBlog($blogid);
2042
2043                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2044
2045                 self::$skin->parse('blogsettings');
2046                 return;
2047         }
2048
2049         /**
2050          * Admin::action_categorynew()
2051          *
2052          * @param       void
2053          * @return      void
2054          */
2055         static private function action_categorynew()
2056         {
2057                 global $member, $manager;
2058
2059                 $blogid = intRequestVar('blogid');
2060
2061                 $member->blogAdminRights($blogid) or self::disallow();
2062
2063                 $cname = postVar('cname');
2064                 $cdesc = postVar('cdesc');
2065
2066                 if ( !isValidCategoryName($cname) )
2067                 {
2068                         self::error(_ERROR_BADCATEGORYNAME);
2069                         return;
2070                 }
2071
2072                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";
2073                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);
2074                 $res = DB::getResult($query);
2075                 if ( $res->rowCount() > 0 )
2076                 {
2077                         self::error(_ERROR_DUPCATEGORYNAME);
2078                         return;
2079                 }
2080
2081                 $blog           =& $manager->getBlog($blogid);
2082                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2083
2084                 self::action_blogsettings();
2085                 return;
2086         }
2087
2088         /**
2089          * Admin::action_categoryedit()
2090          *
2091          * @param       void
2092          * @return      void
2093          */
2094         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')
2095         {
2096                 global $member, $manager;
2097
2098                 if ( $blogid == '' )
2099                 {
2100                         $blogid = intGetVar('blogid');
2101                 }
2102                 else
2103                 {
2104                         $blogid = intval($blogid);
2105                 }
2106                 if ( $catid == '' )
2107                 {
2108                         $catid = intGetVar('catid');
2109                 }
2110                 else
2111                 {
2112                         $catid = intval($catid);
2113                 }
2114
2115                 /* TODO: we should consider to use the other way insterad of this */
2116                 $_REQUEST['blogid']             = $blogid;
2117                 $_REQUEST['catid']              = $catid;
2118                 $_REQUEST['desturl']    = $desturl;
2119                 $member->blogAdminRights($blogid) or self::disallow();
2120
2121                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2122
2123                 self::$skin->parse('categoryedit');
2124                 return;
2125         }
2126
2127         /**
2128          * Admin::action_categoryupdate()
2129          *
2130          * @param       void
2131          * @return      void
2132          */
2133         static private function action_categoryupdate()
2134         {
2135                 global $member, $manager;
2136
2137                 $blogid         = intPostVar('blogid');
2138                 $catid          = intPostVar('catid');
2139                 $cname          = postVar('cname');
2140                 $cdesc          = postVar('cdesc');
2141                 $desturl        = postVar('desturl');
2142
2143                 $member->blogAdminRights($blogid) or self::disallow();
2144
2145                 if ( !isValidCategoryName($cname) )
2146                 {
2147                         self::error(_ERROR_BADCATEGORYNAME);
2148                         return;
2149                 }
2150
2151                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";
2152                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);
2153                 $res    = DB::getResult($query);
2154                 if ( $res->rowCount() > 0 )
2155                 {
2156                         self::error(_ERROR_DUPCATEGORYNAME);
2157                         return;
2158                 }
2159
2160                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";
2161                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);
2162                 DB::execute($query);
2163
2164                 // store plugin options
2165                 $aOptions = requestArray('plugoption');
2166                 NucleusPlugin::apply_plugin_options($aOptions);
2167                 $data = array(
2168                         'context'       => 'category',
2169                         'catid'         => $catid
2170                 );
2171                 $manager->notify('PostPluginOptionsUpdate', $data);
2172
2173                 if ( $desturl )
2174                 {
2175                         redirect($desturl);
2176                         return;
2177                 }
2178
2179                 self::action_blogsettings();
2180
2181                 return;
2182         }
2183
2184         /**
2185          * Admin::action_categorydelete()
2186          *
2187          * @param       void
2188          * @return      void
2189          */
2190         static private function action_categorydelete()
2191         {
2192                 global $member, $manager;
2193
2194                 $blogid = intRequestVar('blogid');
2195                 $catid  = intRequestVar('catid');
2196
2197                 $member->blogAdminRights($blogid) or self::disallow();
2198
2199                 $blog =& $manager->getBlog($blogid);
2200
2201                 // check if the category is valid
2202                 if ( !$blog->isValidCategory($catid) )
2203                 {
2204                         self::error(_ERROR_NOSUCHCATEGORY);
2205                         return;
2206                 }
2207
2208                 // don't allow deletion of default category
2209                 if ( $blog->getDefaultCategory() == $catid )
2210                 {
2211                         self::error(_ERROR_DELETEDEFCATEGORY);
2212                         return;
2213                 }
2214
2215                 // check if catid is the only category left for blogid
2216                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2217                 $query = sprintf($query, sql_table('category'), $blogid);
2218                 $res = DB::getResult($query);
2219                 if ( $res->rowCount() == 1 )
2220                 {
2221                         self::error(_ERROR_DELETELASTCATEGORY);
2222                         return;
2223                 }
2224
2225                 self::$skin->parse('categorydelete');
2226                 return;
2227         }
2228
2229         /**
2230          * Admin::action_categorydeleteconfirm()
2231          *
2232          * @param       void
2233          * @return      void
2234          */
2235         static private function action_categorydeleteconfirm()
2236         {
2237                 global $member, $manager;
2238
2239                 $blogid = intRequestVar('blogid');
2240                 $catid  = intRequestVar('catid');
2241
2242                 $member->blogAdminRights($blogid) or self::disallow();
2243
2244                 $error = self::deleteOneCategory($catid);
2245                 if ( $error )
2246                 {
2247                         self::error($error);
2248                         return;
2249                 }
2250
2251                 self::action_blogsettings();
2252                 return;
2253         }
2254
2255         /**
2256          * Admin::deleteOneCategory()
2257          * Delete a category by its id
2258          *
2259          * @param       String  $catid  category id for deleting
2260          * @return      Void
2261          */
2262         static public function deleteOneCategory($catid)
2263         {
2264                 global $manager, $member;
2265
2266                 $catid  = intval($catid);
2267                 $blogid = getBlogIDFromCatID($catid);
2268
2269                 if ( !$member->blogAdminRights($blogid) )
2270                 {
2271                         return ERROR_DISALLOWED;
2272                 }
2273
2274                 // get blog
2275                 $blog =& $manager->getBlog($blogid);
2276
2277                 // check if the category is valid
2278                 if ( !$blog || !$blog->isValidCategory($catid) )
2279                 {
2280                         return _ERROR_NOSUCHCATEGORY;
2281                 }
2282
2283                 $destcatid = $blog->getDefaultCategory();
2284
2285                 // don't allow deletion of default category
2286                 if ( $blog->getDefaultCategory() == $catid )
2287                 {
2288                         return _ERROR_DELETEDEFCATEGORY;
2289                 }
2290
2291                 // check if catid is the only category left for blogid
2292                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2293                 $query = sprintf($query, sql_table('category'), (integer) $blogid);
2294
2295                 $res = DB::getResult($query);
2296                 if ( $res->rowCount() == 1 )
2297                 {
2298                         return _ERROR_DELETELASTCATEGORY;
2299                 }
2300
2301                 $data = array('catid' => $catid);
2302                 $manager->notify('PreDeleteCategory', $data);
2303
2304                 // change category for all items to the default category
2305                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";
2306                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);
2307                 DB::execute($query);
2308
2309                 // delete all associated plugin options
2310                 NucleusPlugin::delete_option_values('category', (integer) $catid);
2311
2312                 // delete category
2313                 $query = "DELETE FROM %s WHERE catid=%d;";
2314                 $query = sprintf($query, sql_table('category'), (integer) $catid);
2315                 DB::execute($query);
2316
2317                 $data = array('catid' => $catid);
2318                 $manager->notify('PostDeleteCategory', $data);
2319                 return;
2320         }
2321
2322         /**
2323          * Admin::moveOneCategory()
2324          * Delete a category by its id
2325          *
2326          * @param       int     $catid          category id for move
2327          * @param       int     $destblogid     blog id for destination
2328          * @return      void
2329          */
2330         static public function moveOneCategory($catid, $destblogid)
2331         {
2332                 global $manager, $member;
2333                 $catid      = intval($catid);
2334                 $destblogid = intval($destblogid);
2335                 $blogid     = getBlogIDFromCatID($catid);
2336                 // mover should have admin rights on both blogs
2337                 if (!$member->blogAdminRights($blogid)) {
2338                         return _ERROR_DISALLOWED;
2339                 }
2340                 if (!$member->blogAdminRights($destblogid)) {
2341                         return _ERROR_DISALLOWED;
2342                 }
2343                 // cannot move to self
2344                 if ($blogid == $destblogid) {
2345                         return _ERROR_MOVETOSELF;
2346                 }
2347                 // get blogs
2348                 $blog     =& $manager->getBlog($blogid);
2349                 $destblog =& $manager->getBlog($destblogid);
2350                 // check if the category is valid
2351                 if (!$blog || !$blog->isValidCategory($catid)) {
2352                         return _ERROR_NOSUCHCATEGORY;
2353                 }
2354                 // don't allow default category to be moved
2355                 if ($blog->getDefaultCategory() == $catid) {
2356                         return _ERROR_MOVEDEFCATEGORY;
2357                 }
2358                 $manager->notify(
2359                                 'PreMoveCategory',
2360                                 array(
2361                                                 'catid'      => &$catid,
2362                                                 'sourceblog' => &$blog,
2363                                                 'destblog'   => &$destblog
2364                                 )
2365                 );
2366                 // update comments table (cblog)
2367                 $query = 'SELECT '
2368                 . '    inumber '
2369                 . 'FROM '
2370                 .      sql_table('item') . ' '
2371                 . 'WHERE '
2372                 . '    icat = %d';
2373                 $items = sql_query(sprintf($query, $catid));
2374                 while ($oItem = sql_fetch_object($items)) {
2375                         $query = 'UPDATE '
2376                         .      sql_table('comment') . ' '
2377                         . 'SET '
2378                         . '    cblog = %d' . ' '
2379                         . 'WHERE '
2380                         . '    citem = %d';
2381                         sql_query(sprintf($query, $destblogid, $oItem->inumber));
2382                 }
2383
2384                 // update items (iblog)
2385                 $query = 'UPDATE '
2386                 .      sql_table('item') . ' '
2387                 . 'SET '
2388                 . '    iblog = %d '
2389                 . 'WHERE '
2390                 . '    icat = %d';
2391                 sql_query(sprintf($query, $destblogid, $catid));
2392
2393                 // move category
2394                 $query = 'UPDATE '
2395                 .      sql_table('category') . ' '
2396                 . 'SET '
2397                 . '    cblog = %d' . ' '
2398                 . 'WHERE '
2399                 . '    catid = %d';
2400                 sql_query(sprintf($query, $destblogid, $catid));
2401                 $manager->notify(
2402                                 'PostMoveCategory',
2403                                 array(
2404                                                 'catid'      => &$catid,
2405                                                 'sourceblog' => &$blog,
2406                                                 'destblog'   => $destblog
2407                                 )
2408                 );
2409                 return;
2410         }
2411
2412         /**
2413          * Admin::action_blogsettingsupdate
2414          * Updating blog settings
2415          *
2416          * @param       Void
2417          * @return      Void
2418          */
2419         static private function action_blogsettingsupdate()
2420         {
2421                 global $member, $manager;
2422
2423                 $blogid = intRequestVar('blogid');
2424
2425                 $member->blogAdminRights($blogid) or self::disallow();
2426
2427                 $blog =& $manager->getBlog($blogid);
2428
2429                 $notify_address = trim(postVar('notify'));
2430                 $shortname              = trim(postVar('shortname'));
2431                 $updatefile             = trim(postVar('update'));
2432
2433                 $notifyComment  = intPostVar('notifyComment');
2434                 $notifyVote             = intPostVar('notifyVote');
2435                 $notifyNewItem  = intPostVar('notifyNewItem');
2436
2437                 if ( $notifyComment == 0 )
2438                 {
2439                         $notifyComment = 1;
2440                 }
2441                 if ( $notifyVote == 0 )
2442                 {
2443                         $notifyVote = 1;
2444                 }
2445                 if ( $notifyNewItem == 0 )
2446                 {
2447                         $notifyNewItem = 1;
2448                 }
2449                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2450
2451                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2452                 {
2453                         self::error(_ERROR_BADNOTIFY);
2454                         return;
2455                 }
2456
2457                 if ( !isValidShortName($shortname) )
2458                 {
2459                         self::error(_ERROR_BADSHORTBLOGNAME);
2460                         return;
2461                 }
2462
2463                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2464                 {
2465                         self::error(_ERROR_DUPSHORTBLOGNAME);
2466                         return;
2467                 }
2468                 // check if update file is writable
2469                 if ( $updatefile && !is_writeable($updatefile) )
2470                 {
2471                         self::error(_ERROR_UPDATEFILE);
2472                         return;
2473                 }
2474
2475                 $blog->setName(trim(postVar('name')));
2476                 $blog->setShortName($shortname);
2477                 $blog->setNotifyAddress($notify_address);
2478                 $blog->setNotifyType($notifyType);
2479                 $blog->setMaxComments(postVar('maxcomments'));
2480                 $blog->setCommentsEnabled(postVar('comments'));
2481                 $blog->setTimeOffset(postVar('timeoffset'));
2482                 $blog->setUpdateFile($updatefile);
2483                 $blog->setURL(trim(postVar('url')));
2484                 $blog->setDefaultSkin(intPostVar('defskin'));
2485                 $blog->setDescription(trim(postVar('desc')));
2486                 $blog->setPublic(postVar('public'));
2487                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2488                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2489                 $blog->setDefaultCategory(intPostVar('defcat'));
2490                 $blog->setSearchable(intPostVar('searchable'));
2491                 $blog->setEmailRequired(intPostVar('reqemail'));
2492                 $blog->writeSettings();
2493
2494                 // store plugin options
2495                 $aOptions = requestArray('plugoption');
2496                 NucleusPlugin::apply_plugin_options($aOptions);
2497
2498                 $data = array(
2499                         'context' => 'blog',
2500                         'blogid'  => $blogid,
2501                         'blog'    => &$blog
2502                 );
2503                 $manager->notify('PostPluginOptionsUpdate', $data);
2504
2505                 self::action_overview(_MSG_SETTINGSCHANGED);
2506                 return;
2507         }
2508
2509         /**
2510          * Admin::action_deleteblog()
2511          *
2512          * @param       void
2513          * @return      void
2514          */
2515         static private function action_deleteblog()
2516         {
2517                 global $member, $CONF, $manager;
2518
2519                 $blogid = intRequestVar('blogid');
2520
2521                 $member->blogAdminRights($blogid) or self::disallow();
2522
2523                 // check if blog is default blog
2524                 if ( $CONF['DefaultBlog'] == $blogid )
2525                 {
2526                         self::error(_ERROR_DELDEFBLOG);
2527                         return;
2528                 }
2529
2530                 $blog =& $manager->getBlog($blogid);
2531
2532                 self::$skin->parse('deleteblog');
2533                 return;
2534         }
2535
2536         /**
2537          * Admin::action_deleteblogconfirm()
2538          * Delete Blog
2539          *
2540          * @param       Void
2541          * @return      Void
2542          */
2543         static private function action_deleteblogconfirm()
2544         {
2545                 global $member, $CONF, $manager;
2546
2547                 $blogid = intRequestVar('blogid');
2548
2549                 $data = array('blogid' => $blogid);
2550                 $manager->notify('PreDeleteBlog', $data);
2551
2552                 $member->blogAdminRights($blogid) or self::disallow();
2553
2554                 // check if blog is default blog
2555                 if ( $CONF['DefaultBlog'] == $blogid )
2556                 {
2557                         self::error(_ERROR_DELDEFBLOG);
2558                         return;
2559                 }
2560
2561                 // delete all comments
2562                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;
2563                 DB::execute($query);
2564
2565                 // delete all items
2566                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;
2567                 DB::execute($query);
2568
2569                 // delete all team members
2570                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;
2571                 DB::execute($query);
2572
2573                 // delete all bans
2574                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;
2575                 DB::execute($query);
2576
2577                 // delete all categories
2578                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;
2579                 DB::execute($query);
2580
2581                 // delete all associated plugin options
2582                 NucleusPlugin::delete_option_values('blog', $blogid);
2583
2584                 // delete the blog itself
2585                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;
2586                 DB::execute($query);
2587
2588                 $data = array('blogid' => $blogid);
2589                 $manager->notify('PostDeleteBlog', $data);
2590
2591                 self::action_overview(_DELETED_BLOG);
2592                 return;
2593         }
2594
2595         /**
2596          * Admin::action_memberdelete()
2597          *
2598          * @param       void
2599          * @return      void
2600          */
2601         static private function action_memberdelete()
2602         {
2603                 global $member, $manager;
2604
2605                 $memberid = intRequestVar('memberid');
2606
2607                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2608
2609                 $mem =& $manager->getMember($memberid);
2610
2611                 self::$skin->parse('memberdelete');
2612                 return;
2613         }
2614
2615         /**
2616          * Admin::action_memberdeleteconfirm()
2617          *
2618          * @param       void
2619          * @return      void
2620          */
2621         static private function action_memberdeleteconfirm()
2622         {
2623                 global $member;
2624
2625                 $memberid = intRequestVar('memberid');
2626
2627                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2628
2629                 $error = self::deleteOneMember($memberid);
2630                 if ( $error )
2631                 {
2632                         self::error($error);
2633                         return;
2634                 }
2635
2636                 if ( $member->isAdmin() )
2637                 {
2638                         self::action_usermanagement();
2639                         return;
2640                 }
2641                 else
2642                 {
2643                         self::action_overview(_DELETED_MEMBER);
2644                         return;
2645                 }
2646                 return;
2647         }
2648
2649         /**
2650          * Admin::deleteOneMember()
2651          * Delete a member by id
2652          *
2653          * @static
2654          * @params      Integer $memberid       member id
2655          * @return      String  null string or error messages
2656          */
2657         static public function deleteOneMember($memberid)
2658         {
2659                 global $manager;
2660
2661                 $memberid = intval($memberid);
2662                 $mem =& $manager->getMember($memberid);
2663
2664                 if ( !$mem->canBeDeleted() )
2665                 {
2666                         return _ERROR_DELETEMEMBER;
2667                 }
2668
2669                 $data = array('member' => &$mem);
2670                 $manager->notify('PreDeleteMember', $data);
2671
2672                 /* unlink comments from memberid */
2673                 if ( $memberid )
2674                 {
2675                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";
2676                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);
2677                         DB::execute($query);
2678                 }
2679
2680                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;
2681                 DB::execute($query);
2682
2683                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;
2684                 DB::execute($query);
2685
2686                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;
2687                 DB::execute($query);
2688
2689                 // delete all associated plugin options
2690                 NucleusPlugin::delete_option_values('member', $memberid);
2691
2692                 $data = array('member' => &$mem);
2693                 $manager->notify('PostDeleteMember', $data);
2694
2695                 return '';
2696         }
2697
2698         /**
2699          * Admin::action_createnewlog()
2700          *
2701          * @param       void
2702          * @return      void
2703          */
2704         static private function action_createnewlog()
2705         {
2706                 global $member, $CONF, $manager;
2707
2708                 // Only Super-Admins can do this
2709                 $member->isAdmin() or self::disallow();
2710
2711                 self::$skin->parse('createnewlog');
2712                 return;
2713         }
2714
2715         /**
2716          * Admin::action_addnewlog()
2717          *
2718          * @param       void
2719          * @return      void
2720          */
2721         static private function action_addnewlog()
2722         {
2723                 global $member, $manager, $CONF;
2724
2725                 // Only Super-Admins can do this
2726                 $member->isAdmin() or self::disallow();
2727
2728                 $bname                  = trim(postVar('name'));
2729                 $bshortname             = trim(postVar('shortname'));
2730                 $btimeoffset    = postVar('timeoffset');
2731                 $bdesc                  = trim(postVar('desc'));
2732                 $bdefskin               = postVar('defskin');
2733
2734                 if ( !isValidShortName($bshortname) )
2735                 {
2736                         self::error(_ERROR_BADSHORTBLOGNAME);
2737                         return;
2738                 }
2739
2740                 if ( $manager->existsBlog($bshortname) )
2741                 {
2742                         self::error(_ERROR_DUPSHORTBLOGNAME);
2743                         return;
2744                 }
2745
2746                 $data = array(
2747                         'name'        => &$bname,
2748                         'shortname'   => &$bshortname,
2749                         'timeoffset'  => &$btimeoffset,
2750                         'description' => &$bdesc,
2751                         'defaultskin' => &$bdefskin
2752                 );
2753                 $manager->notify('PreAddBlog', $data);
2754
2755                 // add slashes for sql queries
2756                 $bname                  = DB::quoteValue($bname);
2757                 $bshortname             = DB::quoteValue($bshortname);
2758                 $btimeoffset    = DB::quoteValue($btimeoffset);
2759                 $bdesc                  = DB::quoteValue($bdesc);
2760                 $bdefskin               = DB::quoteValue($bdefskin);
2761
2762                 // create blog
2763                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";
2764                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);
2765                 DB::execute($query);
2766
2767                 $blogid = DB::getInsertId();
2768                 $blog   =& $manager->getBlog($blogid);
2769
2770                 // create new category
2771                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);
2772                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);
2773
2774                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';
2775                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));
2776                 $catid = DB::getInsertId();
2777
2778                 // set as default category
2779                 $blog->setDefaultCategory($catid);
2780                 $blog->writeSettings();
2781
2782                 // create team member
2783                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";
2784                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);
2785                 DB::execute($query);
2786
2787                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
2788                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');
2789
2790                 $blog->additem(
2791                         $blog->getDefaultCategory(),
2792                         $itemdeftitle,$itemdefbody,
2793                         '',
2794                         $blogid,
2795                         $member->getID(),
2796                         $blog->getCorrectTime(),
2797                         0,
2798                         0,
2799                         0
2800                 );
2801
2802                 $data = array('blog' => &$blog);
2803                 $manager->notify('PostAddBlog', $data);
2804
2805                 $data = array(
2806                         'blog'                  => &$blog,
2807                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,
2808                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,
2809                         'catid'                 => $catid
2810                 );
2811                 $manager->notify('PostAddCategory', $data);
2812
2813                 /* TODO: we should consider to use the other way insterad of this */
2814                 $_REQUEST['blogid'] = $blogid;
2815                 $_REQUEST['catid']  = $catid;
2816                 self::$skin->parse('addnewlog');
2817                 return;
2818         }
2819
2820         /**
2821          * Admin::action_addnewlog2()
2822          *
2823          * @param       void
2824          * @return      void
2825          */
2826         static private function action_addnewlog2()
2827         {
2828                 global $member, $manager;
2829                 $blogid = intRequestVar('blogid');
2830
2831                 $member->blogAdminRights($blogid) or self::disallow();
2832
2833                 $burl = requestVar('url');
2834
2835                 $blog =& $manager->getBlog($blogid);
2836                 $blog->setURL(trim($burl));
2837                 $blog->writeSettings();
2838
2839                 self::action_overview(_MSG_NEWBLOG);
2840                 return;
2841         }
2842
2843         /**
2844          * Admin::action_skinieoverview()
2845          *
2846          * @param       void
2847          * @return      void
2848          */
2849         static private function action_skinieoverview()
2850         {
2851                 global $member, $DIR_LIBS, $manager;
2852
2853                 $member->isAdmin() or self::disallow();
2854
2855                 include_once($DIR_LIBS . 'skinie.php');
2856
2857                 self::$skin->parse('skinieoverview');
2858                 return;
2859         }
2860
2861         /**
2862          * Admin::action_skinieimport()
2863          *
2864          * @param       void
2865          * @return      void
2866          */
2867         static private function action_skinieimport()
2868         {
2869                 global $member;
2870
2871                 $member->isAdmin() or self::disallow();
2872
2873                 $skinFileRaw = postVar('skinfile');
2874                 $mode = postVar('mode');
2875
2876                 $error = self::skinieimport($mode, $skinFileRaw);
2877                 if ( $error )
2878                 {
2879                         self::error($error);
2880                         return;
2881                 }
2882
2883                 self::$skin->parse('skinieimport');
2884                 return;
2885         }
2886
2887         /**
2888          * Admin::action_skiniedoimport()
2889          *
2890          * @param       void
2891          * @return      void
2892          */
2893         static private function action_skiniedoimport()
2894         {
2895                 global $member, $DIR_LIBS, $DIR_SKINS;
2896
2897                 $member->isAdmin() or self::disallow();
2898
2899                 // load skinie class
2900                 include_once($DIR_LIBS . 'skinie.php');
2901
2902                 $mode = postVar('mode');
2903                 $skinFileRaw = postVar('skinfile');
2904                 $allowOverwrite = intPostVar('overwrite');
2905
2906                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
2907                 if ( $error )
2908                 {
2909                         self::error($msg);
2910                         return;
2911                 }
2912
2913                 self::$skin->parse('skiniedoimport');
2914                 return;
2915         }
2916
2917         /**
2918          * Admin::action_skinieexport()
2919          *
2920          * @param       void
2921          * @return      void
2922          */
2923         static private function action_skinieexport()
2924         {
2925                 global $member;
2926
2927                 $member->isAdmin() or self::disallow();
2928
2929                 $aSkins = requestIntArray('skin');
2930                 $aTemplates = requestIntArray('template');
2931                 $info = postVar('info');
2932
2933                 self::skinieexport($aSkins, $aTemplates, $info);
2934
2935                 return;
2936         }
2937
2938         /**
2939          * Admin::action_templateoverview()
2940          *
2941          * @param       void
2942          * @return      void
2943          */
2944         static private function action_templateoverview()
2945         {
2946                 global $member, $manager;
2947
2948                 $member->isAdmin() or self::disallow();
2949
2950                 self::$skin->parse('templateoverview');
2951                 return;
2952         }
2953
2954         /**
2955          * Admin::action_templateedit()
2956          *
2957          * @param       string  $msg    message for pageheader
2958          * @return      void
2959          */
2960         static private function action_templateedit($msg = '')
2961         {
2962                 global $member, $manager;
2963                 if ( $msg )
2964                 {
2965                         self::$headMess = $msg;
2966                 }
2967
2968                 $templateid = intRequestVar('templateid');
2969
2970                 $member->isAdmin() or self::disallow();
2971
2972                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";
2973                 self::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";
2974
2975                 self::$skin->parse('templateedit');
2976                 return;
2977         }
2978
2979         /**
2980          * Admin::action_templateupdate()
2981          *
2982          * @param       void
2983          * @return      void
2984          */
2985         static private function action_templateupdate()
2986         {
2987                 global $member,$manager;
2988
2989                 $templateid = intRequestVar('templateid');
2990
2991                 $member->isAdmin() or self::disallow();
2992
2993                 $name = postVar('tname');
2994                 $desc = postVar('tdesc');
2995
2996                 if ( !isValidTemplateName($name) )
2997                 {
2998                         self::error(_ERROR_BADTEMPLATENAME);
2999                         return;
3000                 }
3001
3002                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3003                 {
3004                         self::error(_ERROR_DUPTEMPLATENAME);
3005                         return;
3006                 }
3007
3008                 // 1. Remove all template parts
3009                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3010                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3011                 DB::execute($query);
3012
3013                 // 2. Update description
3014                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3015                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3016                 DB::execute($query);
3017
3018                 // 3. Add non-empty template parts
3019                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));
3020                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));
3021                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));
3022                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));
3023                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));
3024                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));
3025                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));
3026                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));
3027                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));
3028                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));
3029                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));
3030                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));
3031                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));
3032                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));
3033                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));
3034                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));
3035                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3036                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));
3037                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));
3038                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));
3039                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));
3040                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));
3041                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));
3042                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));
3043                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));
3044                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));
3045                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));
3046                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));
3047                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));
3048                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));
3049                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3050                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));
3051                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));
3052                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));
3053
3054                 $data = array('fields' => array());
3055                 $manager->notify('TemplateExtraFields', $data);
3056                 foreach ( $data['fields'] as $pfkey=>$pfvalue )
3057                 {
3058                         foreach ( $pfvalue as $pffield => $pfdesc )
3059                         {
3060                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3061                         }
3062                 }
3063
3064                 // jump back to template edit
3065                 self::action_templateedit(_TEMPLATE_UPDATED);
3066                 return;
3067         }
3068
3069         /**
3070          * Admin::addToTemplate()
3071          *
3072          * @param       Integer $id     ID for template
3073          * @param       String  $partname       parts name
3074          * @param       String  $content        template contents
3075          * @return      Integer record index
3076          *
3077          */
3078         static private function addToTemplate($id, $partname, $content)
3079         {
3080                 // don't add empty parts:
3081                 if ( !trim($content) )
3082                 {
3083                         return -1;
3084                 }
3085
3086                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";
3087                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));
3088                 if ( DB::execute($query) === FALSE )
3089                 {
3090                         $err = DB::getError();
3091                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
3092                 }
3093                 return DB::getInsertId();
3094         }
3095
3096         /**
3097          * Admin::action_templatedelete()
3098          *
3099          * @param       void
3100          * @return      void
3101          */
3102         static private function action_templatedelete()
3103         {
3104                 global $member, $manager;
3105
3106                 $member->isAdmin() or self::disallow();
3107
3108                 $templateid = intRequestVar('templateid');
3109                 // TODO: check if template can be deleted
3110
3111                 self::$skin->parse('templatedelete');
3112                 return;
3113         }
3114
3115         /**
3116          * Admin::action_templatedeleteconfirm()
3117          *
3118          * @param       void
3119          * @return      void
3120          */
3121         static private function action_templatedeleteconfirm()
3122         {
3123                 global $member, $manager;
3124
3125                 $templateid = intRequestVar('templateid');
3126
3127                 $member->isAdmin() or self::disallow();
3128
3129                 $data = array('templateid' => $templateid);
3130                 $manager->notify('PreDeleteTemplate', $data);
3131
3132                 // 1. delete description
3133                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);
3134
3135                 // 2. delete parts
3136                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);
3137
3138
3139                 $data = array('templateid' => $templateid);
3140                 $manager->notify('PostDeleteTemplate', $data);
3141
3142                 self::action_templateoverview();
3143                 return;
3144         }
3145
3146         /**
3147          * Admin::action_templatenew()
3148          *
3149          * @param       void
3150          * @return      void
3151          */
3152         static private function action_templatenew()
3153         {
3154                 global $member;
3155
3156                 $member->isAdmin() or self::disallow();
3157
3158                 $name = postVar('name');
3159                 $desc = postVar('desc');
3160
3161                 if ( !isValidTemplateName($name) )
3162                 {
3163                         self::error(_ERROR_BADTEMPLATENAME);
3164                         return;
3165                 }
3166
3167                 if ( Template::exists($name) )
3168                 {
3169                         self::error(_ERROR_DUPTEMPLATENAME);
3170                         return;
3171                 }
3172
3173                 $newTemplateId = Template::createNew($name, $desc);
3174
3175                 self::action_templateoverview();
3176                 return;
3177         }
3178
3179         /**
3180          * Admin::action_templateclone()
3181          *
3182          * @param       void
3183          * @return      void
3184          */
3185         static private function action_templateclone()
3186         {
3187                 global $member;
3188
3189                 $templateid = intRequestVar('templateid');
3190
3191                 $member->isAdmin() or self::disallow();
3192
3193                 // 1. read old template
3194                 $name = Template::getNameFromId($templateid);
3195                 $desc = Template::getDesc($templateid);
3196
3197                 // 2. create desc thing
3198                 $name = "cloned" . $name;
3199
3200                 // if a template with that name already exists:
3201                 if ( Template::exists($name) )
3202                 {
3203                         $i = 1;
3204                         while (Template::exists($name . $i))
3205                         {
3206                                 $i++;
3207                         }
3208                         $name .= $i;
3209                 }
3210
3211                 $newid = Template::createNew($name, $desc);
3212
3213                 // 3. create clone
3214                 // go through parts of old template and add them to the new one
3215                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3216                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3217
3218                 $res = DB::getResult($query);
3219                 foreach ( $res as $row)
3220                 {
3221                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3222                 }
3223
3224                 self::action_templateoverview();
3225                 return;
3226         }
3227
3228         /**
3229          * Admin::action_admintemplateoverview()
3230          *
3231          * @param       void
3232          * @return      void
3233          */
3234         static private function action_admintemplateoverview()
3235         {
3236                 global $member;
3237                 $member->isAdmin() or self::disallow();
3238                 self::$skin->parse('admntemplateoverview');
3239                 return;
3240         }
3241
3242         /**
3243          * Admin::action_admintemplateedit()
3244          *
3245          * @param       string  $msg    message for pageheader
3246          * @return      void
3247          */
3248         static private function action_admintemplateedit($msg = '')
3249         {
3250                 global $member, $manager;
3251                 if ( $msg )
3252                 {
3253                         self::$headMess = $msg;
3254                 }
3255                 $member->isAdmin() or self::disallow();
3256
3257                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";
3258                 self::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";
3259
3260                 self::$skin->parse('admintemplateedit');
3261                 return;
3262         }
3263
3264         /**
3265          * Admin::action_admintemplateupdate()
3266          *
3267          * @param       void
3268          * @return      void
3269          */
3270         static private function action_admintemplateupdate()
3271         {
3272                 global $member, $manager;
3273                 $templateid = intRequestVar('templateid');
3274                 $member->isAdmin() or self::disallow();
3275                 $name = postVar('tname');
3276                 $desc = postVar('tdesc');
3277
3278                 if ( !isValidTemplateName($name) )
3279                 {
3280                         self::error(_ERROR_BADTEMPLATENAME);
3281                         return;
3282                 }
3283
3284                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3285                 {
3286                         self::error(_ERROR_DUPTEMPLATENAME);
3287                         return;
3288                 }
3289
3290                 // 1. Remove all template parts
3291                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3292                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3293                 DB::execute($query);
3294
3295                 // 2. Update description
3296                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3297                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3298                 DB::execute($query);
3299
3300                 // 3. Add non-empty template parts
3301                 self::addToTemplate($templateid, 'NORMALSKINLIST_HEAD',                                         postVar('NORMALSKINLIST_HEAD'));
3302                 self::addToTemplate($templateid, 'NORMALSKINLIST_BODY',                                         postVar('NORMALSKINLIST_BODY'));
3303                 self::addToTemplate($templateid, 'NORMALSKINLIST_FOOT',                                         postVar('NORMALSKINLIST_FOOT'));
3304                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                           postVar('ADMIN_CUSTOMHELPLINK_ICON'));
3305                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                         postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));
3306                 self::addToTemplate($templateid, 'ADMIN_BLOGLINK',                                                      postVar('ADMIN_BLOGLINK'));
3307                 self::addToTemplate($templateid, 'ADMIN_BATCHLIST',                                                     postVar('ADMIN_BATCHLIST'));
3308                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                       postVar('ACTIVATE_FORGOT_TITLE'));
3309                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                        postVar('ACTIVATE_FORGOT_TEXT'));
3310                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                     postVar('ACTIVATE_REGISTER_TITLE'));
3311                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                      postVar('ACTIVATE_REGISTER_TEXT'));
3312                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                       postVar('ACTIVATE_CHANGE_TITLE'));
3313                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                        postVar('ACTIVATE_CHANGE_TEXT'));
3314                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                            postVar('TEMPLATE_EDIT_EXPLUGNAME'));
3315                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                      postVar('TEMPLATE_EDIT_ROW_HEAD'));
3316                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                      postVar('TEMPLATE_EDIT_ROW_TAIL'));
3317                 self::addToTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                        postVar('SPECIALSKINLIST_HEAD'));
3318                 self::addToTemplate($templateid, 'SPECIALSKINLIST_BODY',                                        postVar('SPECIALSKINLIST_BODY'));
3319                 self::addToTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                        postVar('SPECIALSKINLIST_FOOT'));
3320                 self::addToTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                       postVar('SYSTEMINFO_GDSETTINGS'));
3321                 self::addToTemplate($templateid, 'BANLIST_DELETED_LIST',                                        postVar('BANLIST_DELETED_LIST'));
3322                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                     postVar('INSERT_PLUGOPTION_TITLE'));
3323                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                      postVar('INSERT_PLUGOPTION_BODY'));
3324                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                           postVar('INPUTYESNO_TEMPLATE_ADMIN'));
3325                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                          postVar('INPUTYESNO_TEMPLATE_NORMAL'));
3326                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                          postVar('ADMIN_SPECIALSKINLIST_HEAD'));
3327                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                          postVar('ADMIN_SPECIALSKINLIST_BODY'));
3328                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                          postVar('ADMIN_SPECIALSKINLIST_FOOT'));
3329                 self::addToTemplate($templateid, 'SKINIE_EXPORT_LIST',                                          postVar('SKINIE_EXPORT_LIST'));
3330                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                       postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));
3331                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                       postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));
3332                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                       postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));
3333                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                        postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));
3334                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                        postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));
3335                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                        postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));
3336                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));
3337                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));
3338                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));
3339                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));
3340                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));
3341                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));
3342                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));
3343                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));
3344                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));
3345                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));
3346                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));
3347                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));
3348                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));
3349                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));
3350                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));
3351                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));
3352                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));
3353                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));
3354                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));
3355                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));
3356                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));
3357                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));
3358                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));
3359                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));
3360                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));
3361                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));
3362                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));
3363                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));
3364                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));
3365                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));
3366                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));
3367                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));
3368                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));
3369                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));
3370                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));
3371                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));
3372                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));
3373                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));
3374                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));
3375                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));
3376                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));
3377                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));
3378                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));
3379                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));
3380                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));
3381                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));
3382                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));
3383                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));
3384                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));
3385                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));
3386                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));
3387                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));
3388                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));
3389                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));
3390                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));
3391                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));
3392                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));
3393                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));
3394                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));
3395                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));
3396                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));
3397                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));
3398                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));
3399                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));
3400                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));
3401                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));
3402                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                      postVar('PLUGIN_QUICKMENU_TITLE'));
3403                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                       postVar('PLUGIN_QUICKMENU_HEAD'));
3404                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                       postVar('PLUGIN_QUICKMENU_BODY'));
3405                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                       postVar('PLUGIN_QUICKMENU_FOOT'));
3406
3407                 $data = array('fields' => array());
3408                 $manager->notify('AdminTemplateExtraFields', $data);
3409                 foreach ( $data['fields'] as $pfkey => $pfvalue )
3410                 {
3411                         foreach ( $pfvalue as $pffield => $pfdesc )
3412                         {
3413                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3414                         }
3415                 }
3416
3417                 // jump back to template edit
3418                 self::action_admintemplateedit(_TEMPLATE_UPDATED);
3419                 return;
3420         }
3421
3422         /**
3423          * Admin::action_admintemplatedelete()
3424          *
3425          * @param       void
3426          * @return      void
3427          */
3428         static private function action_admintemplatedelete()
3429         {
3430                 global $member, $manager;
3431                 $member->isAdmin() or self::disallow();
3432
3433                 // TODO: check if template can be deleted
3434                 self::$skin->parse('admintemplatedelete');
3435                 return;
3436         }
3437
3438         /**
3439          * Admin::action_admintemplatedeleteconfirm()
3440          *
3441          * @param       void
3442          * @return      void
3443          */
3444         static private function action_admintemplatedeleteconfirm()
3445         {
3446                 global $member, $manager;
3447
3448                 $templateid = intRequestVar('templateid');
3449                 $member->isAdmin() or self::disallow();
3450
3451                 $data = array('templateid' => $templateid);
3452                 $manager->notify('PreDeleteAdminTemplate', $data);
3453
3454                 // 1. delete description
3455                 $query = "DELETE FROM %s WHERE tdnumber=%s;";
3456                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);
3457                 DB::execute($query);
3458
3459                 // 2. delete parts
3460                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3461                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3462                 DB::execute($query);
3463
3464                 $data = array('templateid' => $templateid);
3465                 $manager->notify('PostDeleteAdminTemplate', $data);
3466
3467                 self::action_admintemplateoverview();
3468                 return;
3469         }
3470
3471         /**
3472          * Admin::action_admintemplatenew()
3473          *
3474          * @param       void
3475          * @return      void
3476          */
3477         static private function action_admintemplatenew()
3478         {
3479                 global $member;
3480                 $member->isAdmin() or self::disallow();
3481                 $name = postVar('name');
3482                 $desc = postVar('desc');
3483
3484                 if ( !isValidTemplateName($name) )
3485                 {
3486                         self::error(_ERROR_BADTEMPLATENAME);
3487                         return;
3488                 }
3489                 else if ( !preg_match('#^admin/#', $name) )
3490                 {
3491                         self::error(_ERROR_BADADMINTEMPLATENAME);
3492                         return;
3493                 }
3494                 else if ( Template::exists($name) )
3495                 {
3496                         self::error(_ERROR_DUPTEMPLATENAME);
3497                         return;
3498                 }
3499
3500                 $newTemplateId = Template::createNew($name, $desc);
3501                 self::action_admintemplateoverview();
3502                 return;
3503         }
3504
3505         /**
3506          * Admin::action_admintemplateclone()
3507          *
3508          * @param       void
3509          * @return      void
3510          */
3511         static private function action_admintemplateclone()
3512         {
3513                 global $member;
3514                 $templateid = intRequestVar('templateid');
3515                 $member->isAdmin() or self::disallow();
3516
3517                 // 1. read old template
3518                 $name = Template::getNameFromId($templateid);
3519                 $desc = Template::getDesc($templateid);
3520
3521                 // 2. create desc thing
3522                 $name = $name . "cloned";
3523
3524                 // if a template with that name already exists:
3525                 if ( Template::exists($name) )
3526                 {
3527                         $i = 1;
3528                         while ( Template::exists($name . $i) )
3529                         {
3530                                 $i++;
3531                         }
3532                         $name .= $i;
3533                 }
3534
3535                 $newid = Template::createNew($name, $desc);
3536
3537                 // 3. create clone
3538                 // go through parts of old template and add them to the new one
3539                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3540                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3541
3542                 $res = DB::getResult($query);
3543                 foreach ( $res as $row )
3544                 {
3545                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3546                 }
3547
3548                 self::action_admintemplateoverview();
3549                 return;
3550         }
3551
3552         /**
3553          * Admin::action_skinoverview()
3554          *
3555          * @param       void
3556          * @return      void
3557          */
3558         static private function action_skinoverview()
3559         {
3560                 global $member, $manager;
3561
3562                 $member->isAdmin() or self::disallow();
3563
3564                 self::$skin->parse('skinoverview');
3565                 return;
3566         }
3567
3568         /**
3569          * Admin::action_skinnew()
3570          *
3571          * @param       void
3572          * @return      void
3573          */
3574         static private function action_skinnew()
3575         {
3576                 global $member;
3577
3578                 $member->isAdmin() or self::disallow();
3579
3580                 $name = trim(postVar('name'));
3581                 $desc = trim(postVar('desc'));
3582
3583                 if ( !isValidSkinName($name) )
3584                 {
3585                         self::error(_ERROR_BADSKINNAME);
3586                         return;
3587                 }
3588                 else if ( SKIN::exists($name) )
3589                 {
3590                         self::error(_ERROR_DUPSKINNAME);
3591                         return;
3592                 }
3593
3594                 SKIN::createNew($name, $desc);
3595
3596                 self::action_skinoverview();
3597                 return;
3598         }
3599
3600         /**
3601          * Admin::action_skinedit()
3602          *
3603          * @param       void
3604          * @return      void
3605          */
3606         static private function action_skinedit()
3607         {
3608                 global $member;
3609
3610                 $member->isAdmin() or self::disallow();
3611
3612                 self::$skin->parse('skinedit');
3613                 return;
3614         }
3615
3616         /**
3617          * Admin::action_skineditgeneral()
3618          *
3619          * @param       void
3620          * @return      void
3621          */
3622         static private function action_skineditgeneral()
3623         {
3624                 global $member;
3625
3626                 $skinid = intRequestVar('skinid');
3627
3628                 $member->isAdmin() or self::disallow();
3629
3630                 $error = self::skineditgeneral($skinid);
3631                 if ( $error )
3632                 {
3633                         self::error($error);
3634                         return;
3635                 }
3636
3637                 self::action_skinedit();
3638                 return;
3639         }
3640
3641         static private function action_skinedittype($msg = '')
3642         {
3643                 global $member;
3644
3645                 $member->isAdmin() or self::disallow();
3646
3647                 if ( $msg )
3648                 {
3649                         self::$headMess = $msg;
3650                 }
3651
3652                 $type = requestVar('type');
3653                 $type = trim($type);
3654                 $type = strtolower($type);
3655
3656                 if ( !isValidShortName($type) )
3657                 {
3658                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3659                         return;
3660                 }
3661
3662                 self::$skin->parse('skinedittype');
3663                 return;
3664         }
3665
3666         /**
3667          * Admin::action_skinupdate()
3668          *
3669          * @param       void
3670          * @return      void
3671          */
3672         static private function action_skinupdate()
3673         {
3674                 global $manager, $member;
3675
3676                 $skinid = intRequestVar('skinid');
3677                 $content = trim(postVar('content'));
3678                 $type = postVar('type');
3679
3680                 $member->isAdmin() or self::disallow();
3681
3682                 $skin =& $manager->getSKIN($skinid);
3683                 $skin->update($type, $content);
3684
3685                 self::action_skinedittype(_SKIN_UPDATED);
3686                 return;
3687         }
3688
3689         /**
3690          * Admin::action_skindelete()
3691          *
3692          * @param       void
3693          * @return      void
3694          */
3695         static private function action_skindelete()
3696         {
3697                 global $CONF, $member;
3698
3699                 $member->isAdmin() or self::disallow();
3700
3701                 $skinid = intRequestVar('skinid');
3702
3703                 // don't allow default skin to be deleted
3704                 if ( $skinid == $CONF['BaseSkin'] )
3705                 {
3706                         self::error(_ERROR_DEFAULTSKIN);
3707                         return;
3708                 }
3709
3710                 // don't allow deletion of default skins for blogs
3711                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";
3712                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3713
3714                 $name = DB::getValue($query);
3715                 if ( $name )
3716                 {
3717                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3718                         return;
3719                 }
3720
3721                 self::$skin->parse('skindelete');
3722                 return;
3723         }
3724
3725         /**
3726          * Admin::action_skindeleteconfirm()
3727          *
3728          * @param       void
3729          * @return      void
3730          */
3731         static private function action_skindeleteconfirm()
3732         {
3733                 global $member, $CONF;
3734
3735                 $member->isAdmin() or self::disallow();
3736
3737                 $skinid = intRequestVar('skinid');
3738
3739                 // don't allow default skin to be deleted
3740                 if ( $skinid == $CONF['BaseSkin'] )
3741                 {
3742                         self::error(_ERROR_DEFAULTSKIN);
3743                         return;
3744                 }
3745
3746                 // don't allow deletion of default skins for blogs
3747                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";
3748                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3749
3750                 $name = DB::getValue($query);
3751                 if ( $name )
3752                                 {
3753                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3754                         return;
3755                 }
3756
3757                 self::skindeleteconfirm($skinid);
3758
3759                 self::action_skinoverview();
3760                 return;
3761         }
3762
3763         /**
3764          * Admin::action_skinremovetype()
3765          *
3766          * @param       void
3767          * @return      void
3768          */
3769         static private function action_skinremovetype()
3770         {
3771                 global $member, $CONF;
3772
3773                 $member->isAdmin() or self::disallow();
3774
3775                 $skinid = intRequestVar('skinid');
3776                 $skintype = requestVar('type');
3777
3778                 if ( !isValidShortName($skintype) )
3779                 {
3780                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
3781                         return;
3782                 }
3783
3784                 self::$skin->parse('skinremovetype');
3785                 return;
3786         }
3787
3788         /**
3789          * Admin::action_skinremovetypeconfirm()
3790          *
3791          * @param       void
3792          * @return      void
3793          */
3794         static private function action_skinremovetypeconfirm()
3795         {
3796                 global $member;
3797
3798                 $member->isAdmin() or self::disallow();
3799
3800                 $skinid = intRequestVar('skinid');
3801                 $skintype = requestVar('type');
3802
3803                 $error = self::skinremovetypeconfirm($skinid, $skintype);
3804                 if ( $error )
3805                 {
3806                         self::error($error);
3807                         return;
3808                 }
3809
3810                 self::action_skinedit();
3811                 return;
3812         }
3813
3814         /**
3815          * Admin::action_skinclone()
3816          *
3817          * @param       void
3818          * @return      void
3819          */
3820         static private function action_skinclone()
3821         {
3822                 global $member;
3823
3824                 $member->isAdmin() or self::disallow();
3825
3826                 $skinid = intRequestVar('skinid');
3827
3828                 self::skinclone($skinid);
3829
3830                 self::action_skinoverview();
3831                 return;
3832         }
3833
3834         /**
3835          * Admin::action_adminskinoverview()
3836          *
3837          * @param       void
3838          * @return      void
3839          */
3840         static private function action_adminskinoverview()
3841         {
3842                 global $member;
3843
3844                 $member->isAdmin() or self::disallow();
3845
3846                 self::$skin->parse('adminskinoverview');
3847                 return;
3848         }
3849
3850         /**
3851          * Admin::action_adminskinnew()
3852          *
3853          * @param       void
3854          * @return      void
3855          */
3856         static private function action_adminskinnew()
3857         {
3858                 global $member;
3859
3860                 $member->isAdmin() or self::disallow();
3861
3862                 $name = trim(postVar('name'));
3863                 $desc = trim(postVar('desc'));
3864
3865                 if ( !isValidSkinName($name) )
3866                 {
3867                         self::error(_ERROR_BADSKINNAME);
3868                         return;
3869                 }
3870                 else if ( !preg_match('#^admin/#', $name) )
3871                 {
3872                         self::error(_ERROR_BADADMINSKINNAME);
3873                         return;
3874                 }
3875                 else if ( Skin::exists($name) )
3876                 {
3877                         self::error(_ERROR_DUPSKINNAME);
3878                         return;
3879                 }
3880
3881                 Skin::createNew($name, $desc);
3882
3883                 self::action_adminskinoverview();
3884                 return;
3885         }
3886
3887         /**
3888          * Admin::action_adminskinedit()
3889          *
3890          * @param       void
3891          * @return      void
3892          */
3893         static private function action_adminskinedit()
3894         {
3895                 global $member;
3896
3897                 $member->isAdmin() or self::disallow();
3898
3899                 self::$skin->parse('adminskinedit');
3900
3901                 return;
3902         }
3903
3904         /**
3905          * Admin::action_adminskineditgeneral()
3906          *
3907          * @param       void
3908          * @return      void
3909          */
3910         static private function action_adminskineditgeneral()
3911         {
3912                 global $member;
3913
3914                 $skinid = intRequestVar('skinid');
3915
3916                 $member->isAdmin() or self::disallow();
3917
3918                 $error = self::skineditgeneral($skinid, 'AdminActions');
3919                 if ( $error )
3920                 {
3921                         self::error($error);
3922                         return;
3923                 }
3924
3925                 self::action_adminskinedit();
3926                 return;
3927         }
3928
3929         /**
3930          * Admin::action_adminskinedittype()
3931          *
3932          * @param       string  $msg    message for pageheader
3933          * @return      void
3934          */
3935         static private function action_adminskinedittype($msg = '')
3936         {
3937                 global $member;
3938
3939                 $member->isAdmin() or self::disallow();
3940
3941                 if ( $msg )
3942                 {
3943                         self::$headMess = $msg;
3944                 }
3945                 $type = requestVar('type');
3946                 $type = trim($type);
3947                 $type = strtolower($type);
3948
3949                 if ( !isValidShortName($type) )
3950                 {
3951                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3952                         return;
3953                 }
3954
3955                 self::$skin->parse('adminskinedittype');
3956                 return;
3957         }
3958
3959         /**
3960          * Admin::action_adminskinupdate()
3961          *
3962          * @param       void
3963          * @return      void
3964          */
3965         static private function action_adminskinupdate()
3966         {
3967                 global $manager, $member;
3968
3969                 $skinid = intRequestVar('skinid');
3970                 $content = trim(postVar('content'));
3971                 $type = postVar('type');
3972
3973                 $member->isAdmin() or self::disallow();
3974
3975                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
3976                 $skin->update($type, $content);
3977
3978                 self::action_adminskinedittype(_SKIN_UPDATED);
3979                 return;
3980         }
3981
3982         /**
3983          * Admin::action_adminskindelete()
3984          *
3985          * @param       void
3986          * @return      void
3987          */
3988         static private function action_adminskindelete()
3989         {
3990                 global $CONF, $member;
3991
3992                 $member->isAdmin() or self::disallow();
3993
3994                 $skinid = intRequestVar('skinid');
3995
3996                 // don't allow default skin to be deleted
3997                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
3998                 {
3999                         self::error(_ERROR_DEFAULTSKIN);
4000                         return;
4001                 }
4002
4003                 /* don't allow if someone use it as a default*/
4004                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4005                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4006
4007                 $members = array();
4008                 while ( $row = $res->fetch() ) {
4009                         $members[] = $row['mrealname'];
4010                 }
4011                 if ( count($members) )
4012                 {
4013                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4014                         return;
4015                 }
4016
4017                 self::$skin->parse('adminskindelete');
4018                 return;
4019         }
4020
4021         /**
4022          * Admin::action_adminskindeleteconfirm()
4023          *
4024          * @param       void
4025          * @return      void
4026          */
4027         static private function action_adminskindeleteconfirm()
4028         {
4029                 global $member, $CONF;
4030
4031                 $member->isAdmin() or self::disallow();
4032
4033                 $skinid = intRequestVar('skinid');
4034
4035                 // don't allow default skin to be deleted
4036                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
4037                 {
4038                         self::error(_ERROR_DEFAULTSKIN);
4039                         return;
4040                 }
4041
4042                 /* don't allow if someone use it as a default*/
4043                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4044                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4045
4046                 $members = array();
4047                 while ( $row = $res->fetch() ) {
4048                         $members[] = $row['mrealname'];
4049                 }
4050                 if ( count($members) )
4051                 {
4052                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4053                         return;
4054                 }
4055
4056                 self::skindeleteconfirm($skinid);
4057
4058                 self::action_adminskinoverview();
4059                 return;
4060         }
4061
4062         /**
4063          * Admin::action_adminskinremovetype()
4064          *
4065          * @param       void
4066          * @return      void
4067          */
4068         static private function action_adminskinremovetype()
4069         {
4070                 global $member, $CONF;
4071
4072                 $member->isAdmin() or self::disallow();
4073
4074                 $skinid = intRequestVar('skinid');
4075                 $skintype = requestVar('type');
4076
4077                 if ( !isValidShortName($skintype) )
4078                 {
4079                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4080                         return;
4081                 }
4082
4083                 self::$skin->parse('adminskinremovetype');
4084                 return;
4085         }
4086
4087         /**
4088          * Admin::action_adminskinremovetypeconfirm()
4089          *
4090          * @param       void
4091          * @return      void
4092          */
4093         static private function action_adminskinremovetypeconfirm()
4094         {
4095                 global $member;
4096
4097                 $member->isAdmin() or self::disallow();
4098
4099                 $skinid = intRequestVar('skinid');
4100                 $skintype = requestVar('type');
4101
4102                 $error = self::skinremovetypeconfirm($skinid, $skintype);
4103                 if ( $error )
4104                 {
4105                         self::error($error);
4106                         return;
4107                 }
4108
4109                 self::action_adminskinedit();
4110                 return;
4111         }
4112
4113         /**
4114          * Admin::action_adminskinclone()
4115          *
4116          * @param       void
4117          * @return      void
4118          */
4119         static private function action_adminskinclone()
4120         {
4121                 global $member;
4122
4123                 $member->isAdmin() or self::disallow();
4124
4125                 $skinid = intRequestVar('skinid');
4126
4127                 self::skinclone($skinid, 'AdminActions');
4128
4129                 self::action_adminskinoverview();
4130                 return;
4131         }
4132
4133         /**
4134          * Admin::action_adminskinieoverview()
4135          *
4136          * @param       void
4137          * @return      void
4138          */
4139         static private function action_adminskinieoverview()
4140         {
4141                 global $member;
4142
4143                 $member->isAdmin() or self::disallow();
4144
4145                 self::$skin->parse('adminskinieoverview');
4146                 return;
4147         }
4148
4149         /**
4150          * Admin::action_adminskinieimport()
4151          *
4152          * @param       void
4153          * @return      void
4154          */
4155         static private function action_adminskinieimport()
4156         {
4157                 global $member;
4158
4159                 $member->isAdmin() or self::disallow();
4160
4161                 $skinFileRaw = postVar('skinfile');
4162                 $mode = postVar('mode');
4163
4164                 $error = self::skinieimport($mode, $skinFileRaw);
4165                 if ( $error )
4166                 {
4167                         self::error($error);
4168                         return;
4169                 }
4170
4171                 if ( !is_object(self::$skin) )
4172                 {
4173                         self::action_adminskiniedoimport();
4174                 }
4175                 else
4176                 {
4177                         self::$skin->parse('adminskinieimport');
4178                 }
4179                 return;
4180         }
4181
4182         /**
4183          * Admin::action_adminskiniedoimport()
4184          *
4185          * @param       void
4186          * @return      void
4187          */
4188         static private function action_adminskiniedoimport()
4189         {
4190                 global $DIR_SKINS, $member;
4191
4192                 $member->isAdmin() or self::disallow();
4193
4194                 $mode = postVar('mode');
4195                 $skinFileRaw = postVar('skinfile');
4196                 $allowOverwrite = intPostVar('overwrite');
4197
4198                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
4199                 if ( $error )
4200                 {
4201                         self::error($error);
4202                         return;
4203                 }
4204
4205                 if ( !is_object(self::$skin) )
4206                 {
4207                         global $DIR_SKINS;
4208                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";
4209                         $query  = sprintf($query, sql_table('skin_desc'));
4210                         $res    = intval(DB::getValue($query));
4211                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";
4212                         $query  = sprintf($query, sql_table('config'), $res);
4213                         DB::execute($query);
4214                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');
4215                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');
4216                 }
4217                 else
4218                 {
4219                         self::$skin->parse('adminskiniedoimport');
4220                 }
4221                 return;
4222         }
4223
4224         /**
4225          * Admin::action_adminskinieexport()
4226          *
4227          * @param       void
4228          * @return      void
4229          */
4230         static private function action_adminskinieexport()
4231         {
4232                 global $member;
4233
4234                 $member->isAdmin() or self::disallow();
4235
4236                 // load skinie class
4237                 $aSkins = requestIntArray('skin');
4238                 $aTemplates = requestIntArray('template');
4239                 $info = postVar('info');
4240
4241                 self::skinieexport($aSkins, $aTemplates, $info);
4242
4243                 return;
4244         }
4245
4246         /**
4247          * Admin::action_settingsedit()
4248          *
4249          * @param       Void
4250          * @return      Void
4251          */
4252         static private function action_settingsedit()
4253         {
4254                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4255
4256                 $member->isAdmin() or self::disallow();
4257
4258                 self::$skin->parse('settingsedit');
4259                 return;
4260         }
4261
4262         /**
4263          * Admin::action_settingsupdate()
4264          * Update $CONFIG and redirect
4265          *
4266          * @param       void
4267          * @return      void
4268          */
4269         static private function action_settingsupdate()
4270         {
4271                 global $member, $CONF;
4272
4273                 $member->isAdmin() or self::disallow();
4274
4275                 // check if email address for admin is valid
4276                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
4277                 {
4278                         self::error(_ERROR_BADMAILADDRESS);
4279                         return;
4280                 }
4281
4282                 // save settings
4283                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));
4284                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));
4285                 self::updateConfig('IndexURL',                  postVar('IndexURL'));
4286                 self::updateConfig('AdminURL',                  postVar('AdminURL'));
4287                 self::updateConfig('PluginURL',                 postVar('PluginURL'));
4288                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));
4289                 self::updateConfig('ActionURL',                 postVar('ActionURL'));
4290                 self::updateConfig('Locale',                    postVar('Locale'));
4291                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));
4292                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));
4293                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));
4294                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));
4295                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));
4296                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));
4297                 self::updateConfig('SiteName',                  postVar('SiteName'));
4298                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));
4299                 self::updateConfig('DisableSite',               postVar('DisableSite'));
4300                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));
4301                 self::updateConfig('LastVisit',                 postVar('LastVisit'));
4302                 self::updateConfig('MediaURL',                  postVar('MediaURL'));
4303                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));
4304                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));
4305                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));
4306                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));
4307                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));
4308                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));
4309                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));
4310                 self::updateConfig('CookiePath',                postVar('CookiePath'));
4311                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));
4312                 self::updateConfig('URLMode',                   postVar('URLMode'));
4313                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));
4314                 self::updateConfig('DebugVars',                 postVar('DebugVars'));
4315                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));
4316                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));
4317                 self::updateConfig('AdminSkin',                 postVar('adminskin'));
4318                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));
4319
4320                 // load new config and redirect (this way, the new locale will be used is necessary)
4321                 // note that when changing cookie settings, this redirect might cause the user
4322                 // to have to log in again.
4323                 getConfig();
4324                 redirect($CONF['AdminURL'] . '?action=manage');
4325                 return;
4326         }
4327
4328         /**
4329          * Admin::action_systemoverview()
4330          * Output system overview
4331          *
4332          * @param       void
4333          * @return      void
4334          */
4335         static private function action_systemoverview()
4336         {
4337                 self::$skin->parse('systemoverview');
4338                 return;
4339         }
4340
4341         /**
4342          * Admin::updateConfig()
4343          *
4344          * @param       string  $name
4345          * @param       string  $val
4346          * @return      integer return the ID in which the latest query posted
4347          */
4348         static private function updateConfig($name, $val)
4349         {
4350                 $query = "UPDATE %s SET value=%s WHERE name=%s";
4351                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));
4352                 if ( DB::execute($query) === FALSE )
4353                 {
4354                         $err = DB::getError();
4355                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
4356                 }
4357                 return DB::getInsertId();
4358         }
4359
4360         /**
4361          * Admin::error()
4362          * Error message
4363          *
4364          * @param       string  $msg    message that will be shown
4365          * @return      void
4366          */
4367         static public function error($msg)
4368         {
4369                 self::$headMess = $msg;
4370                 self::$skin->parse('adminerrorpage');
4371                 return;
4372         }
4373
4374         /**
4375          * Admin::disallow()
4376          * add error log and show error page
4377          *
4378          * @param       void
4379          * @return      void
4380          */
4381         static public function disallow()
4382         {
4383                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4384                 self::error(_ERROR_DISALLOWED);
4385                 return;
4386         }
4387
4388         /**
4389          * Admin::action_PluginAdmin()
4390          * Output pluginadmin
4391          *
4392          * @param       string  $skinContents
4393          * @param       string  $extrahead
4394          * @return      void
4395          */
4396         static public function action_PluginAdmin($skinContents, $extrahead = '')
4397         {
4398                 self::$extrahead .= $extrahead;
4399                 self::$skin->parse('pluginadmin', $skinContents);
4400                 return;
4401         }
4402
4403         /**
4404          * Admin::action_bookmarklet()
4405          *
4406          * @param       void
4407          * @return      void
4408          */
4409         static private function action_bookmarklet()
4410         {
4411                 global $member, $manager;
4412
4413                 $blogid = intRequestVar('blogid');
4414                 $member->teamRights($blogid) or self::disallow();
4415
4416                 self::$skin->parse('bookmarklet');
4417                 return;
4418         }
4419
4420         /**
4421          * Admin::action_actionlog()
4422          *
4423          * @param       void
4424          * @return      void
4425          */
4426         static private function action_actionlog()
4427         {
4428                 global $member, $manager;
4429
4430                 $member->isAdmin() or self::disallow();
4431
4432                 self::$skin->parse('actionlog');
4433                 return;
4434         }
4435
4436         /**
4437          * Admin::action_banlist()
4438          *
4439          * @param       void
4440          * @return      void
4441          */
4442         static private function action_banlist()
4443         {
4444                 global $member, $manager;
4445
4446                 $blogid = intRequestVar('blogid');
4447                 $member->blogAdminRights($blogid) or self::disallow();
4448
4449                 self::$skin->parse('banlist');
4450                 return;
4451         }
4452
4453         /**
4454          * Admin::action_banlistdelete()
4455          *
4456          * @param       void
4457          * @return      void
4458          */
4459         static private function action_banlistdelete()
4460         {
4461                 global $member, $manager;
4462
4463                 $blogid = intRequestVar('blogid');
4464                 $member->blogAdminRights($blogid) or self::disallow();
4465
4466                 self::$skin->parse('banlistdelete');
4467                 return;
4468         }
4469
4470         /**
4471          * Admin::action_banlistdeleteconfirm()
4472          *
4473          * @param       void
4474          * @return      void
4475          */
4476         static private function action_banlistdeleteconfirm()
4477         {
4478                 global $member, $manager;
4479
4480                 $blogid         = intPostVar('blogid');
4481                 $allblogs       = postVar('allblogs');
4482                 $iprange        = postVar('iprange');
4483
4484                 $member->blogAdminRights($blogid) or self::disallow();
4485
4486                 $deleted = array();
4487
4488                 if ( !$allblogs )
4489                 {
4490                         if ( Ban::removeBan($blogid, $iprange) )
4491                         {
4492                                 $deleted[] = $blogid;
4493                         }
4494                 }
4495                 else
4496                 {
4497                         // get blogs fot which member has admin rights
4498                         $adminblogs = $member->getAdminBlogs();
4499                         foreach ($adminblogs as $blogje)
4500                         {
4501                                 if ( Ban::removeBan($blogje, $iprange) )
4502                                 {
4503                                         $deleted[] = $blogje;
4504                                 }
4505                         }
4506                 }
4507
4508                 if ( sizeof($deleted) == 0 )
4509                 {
4510                         self::error(_ERROR_DELETEBAN);
4511                         return;
4512                 }
4513
4514                 /* TODO: we should use other ways */
4515                 $_REQUEST['delblogs'] = $deleted;
4516
4517                 self::$skin->parse('banlistdeleteconfirm');
4518                 return;
4519         }
4520
4521         /**
4522          * Admin::action_banlistnewfromitem()
4523          *
4524          * @param       void
4525          * @return      void
4526          */
4527         static private function action_banlistnewfromitem()
4528         {
4529                 global $manager;
4530
4531                 $itemid = intRequestVar('itemid');
4532                 $item =& $manager->getItem($itemid, 1, 1);
4533                 self::action_banlistnew($item['blogid']);
4534                 return;
4535         }
4536
4537         /**
4538          * Admin::action_banlistnew()
4539          *
4540          * @param       integer $blogid ID for weblog
4541          * @return      void
4542          */
4543         static private function action_banlistnew($blogid = '')
4544         {
4545                 global $member, $manager;
4546
4547                 if ( $blogid == '' )
4548                 {
4549                         $blogid = intRequestVar('blogid');
4550                 }
4551
4552                 $ip = requestVar('ip');
4553
4554                 $member->blogAdminRights($blogid) or self::disallow();
4555
4556                 /* TODO: we should consider to use the other way instead of this */
4557                 $_REQUEST['blogid'] = $blogid;
4558
4559                 self::$skin->parse('banlistnew');
4560
4561                 return;
4562         }
4563
4564         /**
4565          * Admin::action_banlistadd()
4566          *
4567          * @param       void
4568          * @return      void
4569          */
4570         static private function action_banlistadd()
4571         {
4572                 global $member;
4573
4574                 $blogid         = intPostVar('blogid');
4575                 $allblogs       = postVar('allblogs');
4576                 $iprange        = postVar('iprange');
4577
4578                 if ( $iprange == "custom" )
4579                 {
4580                         $iprange = postVar('customiprange');
4581                 }
4582                 $reason   = postVar('reason');
4583
4584                 $member->blogAdminRights($blogid) or self::disallow();
4585
4586                 // TODO: check IP range validity
4587
4588                 if ( !$allblogs )
4589                 {
4590                         if ( !Ban::addBan($blogid, $iprange, $reason) )
4591                         {
4592                                 self::error(_ERROR_ADDBAN);
4593                                 return;
4594                         }
4595                 }
4596                 else
4597                 {
4598                         // get blogs fot which member has admin rights
4599                         $adminblogs = $member->getAdminBlogs();
4600                         $failed = 0;
4601                         foreach ($adminblogs as $blogje)
4602                         {
4603                                 if ( !Ban::addBan($blogje, $iprange, $reason) )
4604                                 {
4605                                         $failed = 1;
4606                                 }
4607                         }
4608                         if ( $failed )
4609                         {
4610                                 self::error(_ERROR_ADDBAN);
4611                                 return;
4612                         }
4613                 }
4614                 self::action_banlist();
4615                 return;
4616         }
4617
4618         /**
4619          * Admin::action_clearactionlog()
4620          *
4621          * @param       void
4622          * @return      void
4623          */
4624         static private function action_clearactionlog()
4625         {
4626                 global $member;
4627
4628                 $member->isAdmin() or self::disallow();
4629
4630                 ActionLog::clear();
4631
4632                 self::action_manage(_MSG_ACTIONLOGCLEARED);
4633                 return;
4634         }
4635
4636         /**
4637          * Admin::action_backupoverview()
4638          *
4639          * @param       void
4640          * @return      void
4641          */
4642         static private function action_backupoverview()
4643         {
4644                 global $member, $manager;
4645
4646                 $member->isAdmin() or self::disallow();
4647
4648                 self::$skin->parse('backupoverview');
4649                 return;
4650         }
4651
4652         /**
4653          * Admin::action_backupcreate()
4654          * create file for backup
4655          *
4656          * @param               void
4657          * @return      void
4658          *
4659          */
4660         static private function action_backupcreate()
4661         {
4662                 global $member, $DIR_LIBS;
4663
4664                 $member->isAdmin() or self::disallow();
4665
4666                 // use compression ?
4667                 $useGzip = (integer) postVar('gzip');
4668
4669                 include($DIR_LIBS . 'backup.php');
4670
4671                 // try to extend time limit
4672                 // (creating/restoring dumps might take a while)
4673                 @set_time_limit(1200);
4674
4675                 Backup::do_backup($useGzip);
4676                 return;
4677         }
4678
4679         /**
4680          * Admin::action_backuprestore()
4681          * restoring from uploaded file
4682          *
4683          * @param               void
4684          * @return      void
4685          */
4686         static private function action_backuprestore()
4687         {
4688                 global $member, $DIR_LIBS;
4689
4690                 $member->isAdmin() or self::disallow();
4691
4692                 if ( intPostVar('letsgo') != 1 )
4693                 {
4694                         self::error(_ERROR_BACKUP_NOTSURE);
4695                         return;
4696                 }
4697
4698                 include($DIR_LIBS . 'backup.php');
4699
4700                 // try to extend time limit
4701                 // (creating/restoring dumps might take a while)
4702                 @set_time_limit(1200);
4703
4704                 $message = Backup::do_restore();
4705                 if ( $message != '' )
4706                 {
4707                         self::error($message);
4708                         return;
4709                 }
4710                 self::$skin->parse('backuprestore');
4711                 return;
4712         }
4713
4714         /**
4715          * Admin::action_pluginlist()
4716          * output the list of installed plugins
4717          *
4718          * @param       void
4719          * @return      void
4720          *
4721          */
4722         static private function action_pluginlist()
4723         {
4724                 global $DIR_PLUGINS, $member, $manager;
4725
4726                 // check if allowed
4727                 $member->isAdmin() or self::disallow();
4728
4729                 self::$skin->parse('pluginlist');
4730                 return;
4731         }
4732
4733         /**
4734          * Admin::action_pluginhelp()
4735          *
4736          * @param       void
4737          * @return      void
4738          */
4739         static private function action_pluginhelp()
4740         {
4741                 global $member, $manager, $DIR_PLUGINS, $CONF;
4742
4743                 // check if allowed
4744                 $member->isAdmin() or self::disallow();
4745
4746                 $plugid = intGetVar('plugid');
4747
4748                 if ( !$manager->pidInstalled($plugid) )
4749                 {
4750                         self::error(_ERROR_NOSUCHPLUGIN);
4751                         return;
4752                 }
4753
4754                 self::$skin->parse('pluginhelp');
4755                 return;
4756         }
4757
4758         /**
4759          * Admin::action_pluginadd()
4760          *
4761          * @param       Void
4762          * @return      Void
4763          *
4764          */
4765         static private function action_pluginadd()
4766         {
4767                 global $member, $manager, $DIR_PLUGINS;
4768
4769                 // check if allowed
4770                 $member->isAdmin() or self::disallow();
4771
4772                 $name = postVar('filename');
4773
4774                 if ( $manager->pluginInstalled($name) )
4775                 {
4776                         self::error(_ERROR_DUPPLUGIN);
4777                         return;
4778                 }
4779
4780                 if ( !checkPlugin($name) )
4781                 {
4782                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
4783                         return;
4784                 }
4785
4786                 // get number of currently installed plugins
4787                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
4788                 $numCurrent = $res->rowCount();
4789
4790                 // plugin will be added as last one in the list
4791                 $newOrder = $numCurrent + 1;
4792
4793                 $data = array('file' => &$name);
4794                 $manager->notify('PreAddPlugin', $data);
4795
4796                 // do this before calling getPlugin (in case the plugin id is used there)
4797                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";
4798                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));
4799                 DB::execute($query);
4800                 $iPid = DB::getInsertId();
4801
4802                 $manager->clearCachedInfo('installedPlugins');
4803
4804                 // Load the plugin for condition checking and instalation
4805                 $plugin =& $manager->getPlugin($name);
4806
4807                 // check if it got loaded (could have failed)
4808                 if ( !$plugin )
4809                 {
4810                         $query = "DELETE FROM %s WHERE pid=%d;";
4811                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);
4812
4813                         DB::execute($query);
4814
4815                         $manager->clearCachedInfo('installedPlugins');
4816                         self::error(_ERROR_PLUGIN_LOAD);
4817                         return;
4818                 }
4819
4820                 // check if plugin needs a newer Nucleus version
4821                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
4822                 {
4823                         // uninstall plugin again...
4824                         self::deleteOnePlugin($plugin->getID());
4825
4826                         // ...and show error
4827                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
4828                         return;
4829                 }
4830
4831                 // check if plugin needs a newer Nucleus version
4832                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
4833                 {
4834                         // uninstall plugin again...
4835                         self::deleteOnePlugin($plugin->getID());
4836
4837                         // ...and show error
4838                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
4839                         return;
4840                 }
4841
4842                 $pluginList = $plugin->getPluginDep();
4843                 foreach ( $pluginList as $pluginName )
4844                 {
4845                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));
4846                         if ($res->rowCount() == 0)
4847                         {
4848                                 // uninstall plugin again...
4849                                 self::deleteOnePlugin($plugin->getID());
4850                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
4851                                 return;
4852                         }
4853                 }
4854
4855                 // call the install method of the plugin
4856                 $plugin->install();
4857
4858                 $data = array('plugin' => &$plugin);
4859                 $manager->notify('PostAddPlugin', $data);
4860
4861                 // update all events
4862                 self::action_pluginupdate();
4863                 return;
4864         }
4865
4866         /**
4867          * ADMIN:action_pluginupdate():
4868          *
4869          * @param       Void
4870          * @return      Void
4871          *
4872          */
4873         static private function action_pluginupdate()
4874         {
4875                 global $member, $manager, $CONF;
4876
4877                 // check if allowed
4878                 $member->isAdmin() or self::disallow();
4879
4880                 // delete everything from plugin_events
4881                 DB::execute('DELETE FROM '.sql_table('plugin_event'));
4882
4883                 // loop over all installed plugins
4884                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));
4885                 foreach ( $res as $row )
4886                 {
4887                         $pid  =  $row['pid'];
4888                         $plug =& $manager->getPlugin($row['pfile']);
4889                         if ( $plug )
4890                         {
4891                                 $eventList = $plug->getEventList();
4892                                 foreach ( $eventList as $eventName )
4893                                 {
4894                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";
4895                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));
4896                                         DB::execute($query);
4897                                 }
4898                         }
4899                 }
4900                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4901                 return;
4902         }
4903
4904         /**
4905          * Admin::action_plugindelete()
4906          *
4907          * @param       void
4908          * @return      void
4909          */
4910         static private function action_plugindelete()
4911         {
4912                 global $member, $manager;
4913
4914                 // check if allowed
4915                 $member->isAdmin() or self::disallow();
4916
4917                 $pid = intGetVar('plugid');
4918
4919                 if ( !$manager->pidInstalled($pid) )
4920                 {
4921                         self::error(_ERROR_NOSUCHPLUGIN);
4922                         return;
4923                 }
4924
4925                 self::$skin->parse('plugindelete');
4926                 return;
4927         }
4928
4929         /**
4930          * Admin::action_plugindeleteconfirm()
4931          *
4932          * @param       void
4933          * @return      void
4934          */
4935         static private function action_plugindeleteconfirm()
4936         {
4937                 global $member, $manager, $CONF;
4938
4939                 // check if allowed
4940                 $member->isAdmin() or self::disallow();
4941
4942                 $pid = intPostVar('plugid');
4943
4944                 $error = self::deleteOnePlugin($pid, 1);
4945                 if ( $error )
4946                 {
4947                         self::error($error);
4948                         return;
4949                 }
4950
4951                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4952                 return;
4953         }
4954
4955         /**
4956          * Admin::deleteOnePlugin()
4957          *
4958          * @param       integer $pid
4959          * @param       boolean $callUninstall
4960          * @return      string  empty or message if failed
4961          */
4962         static public function deleteOnePlugin($pid, $callUninstall = 0)
4963         {
4964                 global $manager;
4965
4966                 $pid = intval($pid);
4967
4968                 if ( !$manager->pidInstalled($pid) )
4969                 {
4970                         return _ERROR_NOSUCHPLUGIN;
4971                 }
4972
4973                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";
4974                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);
4975                 $name = DB::getValue($query);
4976
4977                 // check dependency before delete
4978                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));
4979                 foreach ( $res as $row )
4980                 {
4981                         $plug =& $manager->getPlugin($row['pfile']);
4982                         if ( $plug )
4983                         {
4984                                 $depList = $plug->getPluginDep();
4985                                 foreach ( $depList as $depName )
4986                                 {
4987                                         if ( $name == $depName )
4988                                         {
4989                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);
4990                                         }
4991                                 }
4992                         }
4993                 }
4994
4995                 $data = array('plugid' => $pid);
4996                 $manager->notify('PreDeletePlugin', $data);
4997
4998                 // call the unInstall method of the plugin
4999                 if ( $callUninstall )
5000                 {
5001                         $plugin =& $manager->getPlugin($name);
5002                         if ( $plugin )
5003                         {
5004                                 $plugin->unInstall();
5005                         }
5006                 }
5007
5008                 // delete all subscriptions
5009                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);
5010
5011                 // delete all options
5012                 // get OIDs from plugin_option_desc
5013                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5014                 $aOIDs = array();
5015                 foreach ( $res as $row )
5016                 {
5017                         array_push($aOIDs, $row['oid']);
5018                 }
5019
5020                 // delete from plugin_option and plugin_option_desc
5021                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5022                 if (count($aOIDs) > 0)
5023                 {
5024                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');
5025                 }
5026
5027                 // update order numbers
5028                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5029                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);
5030
5031                 // delete row
5032                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5033
5034                 $manager->clearCachedInfo('installedPlugins');
5035                 $data = array('plugid' => $pid);
5036                 $manager->notify('PostDeletePlugin', $data);
5037
5038                 return '';
5039         }
5040
5041         /**
5042          * Admin::action_pluginup()
5043          *
5044          * @param       void
5045          * @return      void
5046          */
5047         static private function action_pluginup()
5048         {
5049                 global $member, $manager, $CONF;
5050
5051                 // check if allowed
5052                 $member->isAdmin() or self::disallow();
5053
5054                 $plugid = intGetVar('plugid');
5055
5056                 if ( !$manager->pidInstalled($plugid) )
5057                 {
5058                         self::error(_ERROR_NOSUCHPLUGIN);
5059                         return;
5060                 }
5061
5062                 // 1. get old order number
5063                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5064
5065                 // 2. calculate new order number
5066                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5067
5068                 // 3. update plug numbers
5069                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5070                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5071
5072                 //self::action_pluginlist();
5073                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5074                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5075                 return;
5076         }
5077
5078         /**
5079          * Admin::action_plugindown()
5080          *
5081          * @param       void
5082          * @return      void
5083          */
5084         static private function action_plugindown()
5085         {
5086                 global $member, $manager, $CONF;
5087
5088                 // check if allowed
5089                 $member->isAdmin() or self::disallow();
5090
5091                 $plugid = intGetVar('plugid');
5092                 if ( !$manager->pidInstalled($plugid) )
5093                 {
5094                         self::error(_ERROR_NOSUCHPLUGIN);
5095                         return;
5096                 }
5097
5098                 // 1. get old order number
5099                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5100
5101                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
5102                 $maxOrder = $res->rowCount();
5103
5104                 // 2. calculate new order number
5105                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
5106
5107                 // 3. update plug numbers
5108                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5109                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5110
5111                 //self::action_pluginlist();
5112                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5113                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5114                 return;
5115         }
5116
5117         /**
5118          * Admin::action_pluginoptions()
5119          *
5120          * Output Plugin option page
5121          *
5122          * @access      public
5123          * @param       string $message message when fallbacked
5124          * @return      void
5125          *
5126          */
5127         static private function action_pluginoptions($message = '')
5128         {
5129                 global $member, $manager;
5130
5131                 // check if allowed
5132                 $member->isAdmin() or self::disallow();
5133
5134                 $pid = intRequestVar('plugid');
5135                 if ( !$manager->pidInstalled($pid) )
5136                 {
5137                         self::error(_ERROR_NOSUCHPLUGIN);
5138                         return;
5139                 }
5140
5141                 if ( isset($message) )
5142                 {
5143                         self::$headMess = $message;
5144                 }
5145                 $plugname       = $manager->getPluginNameFromPid($pid);
5146                 $plugin         = $manager->getPlugin($plugname);
5147                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
5148
5149                 self::$skin->parse('pluginoptions');
5150                 return;
5151         }
5152
5153         /**
5154          * Admin::action_pluginoptionsupdate()
5155          *
5156          * Update plugin options and fallback to plugin option page
5157          *
5158          * @access      public
5159          * @param       void
5160          * @return      void
5161          */
5162         static private function action_pluginoptionsupdate()
5163         {
5164                 global $member, $manager;
5165
5166                 // check if allowed
5167                 $member->isAdmin() or self::disallow();
5168
5169                 $pid = intRequestVar('plugid');
5170
5171                 if ( !$manager->pidInstalled($pid) )
5172                 {
5173                         self::error(_ERROR_NOSUCHPLUGIN);
5174                         return;
5175                 }
5176
5177                 $aOptions = requestArray('plugoption');
5178                 NucleusPlugin::apply_plugin_options($aOptions);
5179
5180                 $data = array(
5181                         'context'       => 'global',
5182                         'plugid'        => $pid
5183                 );
5184                 $manager->notify('PostPluginOptionsUpdate', $data);
5185
5186                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
5187                 return;
5188         }
5189
5190         /**
5191          * Admin::skineditgeneral()
5192          *
5193          * @param       integer $skinid
5194          * @param       string  $handler
5195          * @return      string  empty or message if failed
5196          */
5197         static private function skineditgeneral($skinid, $handler='')
5198         {
5199                 global $manager;
5200
5201                 $name = postVar('name');
5202                 $desc = postVar('desc');
5203                 $type = postVar('type');
5204                 $inc_mode = postVar('inc_mode');
5205                 $inc_prefix = postVar('inc_prefix');
5206
5207                 $skin =& $manager->getSkin($skinid, $handler);
5208
5209                 // 1. Some checks
5210                 if ( !isValidSkinName($name) )
5211                 {
5212                         return _ERROR_BADSKINNAME;
5213                 }
5214
5215                 if ( ($skin->getName() != $name) && SKIN::exists($name) )
5216                 {
5217                         return _ERROR_DUPSKINNAME;
5218                 }
5219
5220                 if ( !$type )
5221                 {
5222                         $type = 'text/html';
5223                 }
5224
5225                 if ( !$inc_mode )
5226                 {
5227                         $inc_mode = 'normal';
5228                 }
5229
5230                 // 2. Update description
5231                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
5232
5233                 return '';
5234         }
5235         /**
5236          * Admin::skindeleteconfirm()
5237          *
5238          * @param       integer $skinid
5239          * @return      void
5240          */
5241         static private function skindeleteconfirm($skinid)
5242         {
5243                 global $manager;
5244
5245                 if ( !in_array(self::$action, self::$adminskin_actions) )
5246                 {
5247                         $event_identifier = 'Skin';
5248                 }
5249                 else
5250                 {
5251                         $event_identifier = 'AdminSkin';
5252                 }
5253
5254                 $manager->notify("PreDelete{$event_identifier}", array('skinid' => $skinid));
5255
5256                 // 1. delete description
5257                 $query = "DELETE FROM %s WHERE sdnumber=%d;";
5258                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);
5259                 DB::execute($query);
5260
5261                 // 2. delete parts
5262                 $query = "DELETE FROM %s WHERE sdesc=%d;";
5263                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5264                 DB::execute($query);
5265
5266                 $manager->notify("PostDelete{$event_identifier}", array('skinid' => $skinid));
5267
5268                 return;
5269         }
5270
5271         /**
5272          * Admin::skinremovetypeconfirm()
5273          *
5274          * @param       integer $skinid
5275          * @param       string  $skintype
5276          * @return      string  empty or message if failed
5277          */
5278         static private function skinremovetypeconfirm($skinid, $skintype)
5279         {
5280                 global $manager;
5281
5282                 if ( !in_array(self::$action, self::$adminskin_actions) )
5283                 {
5284                         $event_identifier = 'Skin';
5285                 }
5286                 else
5287                 {
5288                         $event_identifier = 'AdminSkin';
5289                 }
5290
5291                 if ( !isValidShortName($skintype) )
5292                 {
5293                         return _ERROR_SKIN_PARTS_SPECIAL_DELETE;
5294                 }
5295
5296                 $data = array(
5297                         'skinid'        => $skinid,
5298                         'skintype'      => $skintype
5299                 );
5300                 $manager->notify("PreDelete{$event_identifier}Part", $data);
5301
5302                 // delete part
5303                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s;';
5304                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );
5305                 DB::execute($query);
5306
5307                 $data = array(
5308                         'skinid'        => $skinid,
5309                         'skintype'      => $skintype
5310                 );
5311                 $manager->notify("PostDelete{$event_identifier}Part", $data);
5312
5313                 return '';
5314         }
5315
5316         /**
5317          * Admin::skinclone()
5318          *
5319          * @param       integer $skinid
5320          * @param       string  $handler
5321          * @return      void
5322          */
5323         static private function skinclone($skinid, $handler='')
5324         {
5325                 global $manager;
5326
5327                 // 1. read skin to clone
5328                 $skin =& $manager->getSkin($skinid, $handler);
5329                 $name = "{$skin->getName()}_clone";
5330
5331                 // if a skin with that name already exists:
5332                 if ( Skin::exists($name) )
5333                 {
5334                         $i = 1;
5335                         while ( Skin::exists($name . $i) )
5336                         {
5337                                 $i++;
5338                         }
5339                         $name .= $i;
5340                 }
5341
5342                 // 2. create skin desc
5343                 $newid = Skin::createNew(
5344                         $name,
5345                         $skin->getDescription(),
5346                         $skin->getContentType(),
5347                         $skin->getIncludeMode(),
5348                         $skin->getIncludePrefix()
5349                 );
5350
5351                 // 3. clone
5352                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";
5353                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5354
5355                 $res = DB::getResult($query);
5356                 foreach ( $res as $row )
5357                 {
5358                         $content = $skin->getContentFromDB($row['stype']);
5359                         if ( $content )
5360                         {
5361                                 $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";
5362                                 $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($row['stype']));
5363                                 DB::execute($query);
5364                         }
5365                 }
5366                 return;
5367         }
5368
5369         /**
5370          * Admin::skinieimport()
5371          *
5372          * @param       string  $mode
5373          * @param       string  $skinFileRaw
5374          * @return      string  empty or message if failed
5375          */
5376         static private function skinieimport($mode, $skinFileRaw)
5377         {
5378                 global $DIR_LIBS, $DIR_SKINS;
5379
5380                 // load skinie class
5381                 include_once($DIR_LIBS . 'skinie.php');
5382
5383                 $importer = new SkinImport();
5384
5385                 // get full filename
5386                 if ( $mode == 'file' )
5387                 {
5388                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5389                 }
5390                 else
5391                 {
5392                         $skinFile = $skinFileRaw;
5393                 }
5394
5395                 // read only metadata
5396                 $error = $importer->readFile($skinFile, 1);
5397                 if ( $error )
5398                 {
5399                         unset($importer);
5400                         return $error;
5401                 }
5402
5403                 self::$contents['mode']         = $mode;
5404                 self::$contents['skinfile']     = $skinFileRaw;
5405                 self::$contents['skininfo']     = $importer->getInfo();
5406                 self::$contents['skinnames']    = $importer->getSkinNames();
5407                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5408
5409                 // clashes
5410                 $skinNameClashes                = $importer->checkSkinNameClashes();
5411                 $templateNameClashes    = $importer->checkTemplateNameClashes();
5412                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
5413
5414                 self::$contents['skinclashes'] = $skinNameClashes;
5415                 self::$contents['tpltclashes'] = $templateNameClashes;
5416                 self::$contents['nameclashes'] = $hasNameClashes ? 1 : 0;
5417
5418                 unset($importer);
5419                 return '';
5420         }
5421
5422         /**
5423          * Admin::skinieedoimport()
5424          *
5425          * @param       string  $mode
5426          * @param       string  $skinFileRaw
5427          * @param       boolean $allowOverwrite
5428          * @return      string  empty   or message if failed
5429          */
5430         static private function skiniedoimport($mode, $skinFileRaw, $allowOverwrite)
5431         {
5432                 global $DIR_LIBS, $DIR_SKINS;
5433
5434                 // load skinie class
5435                 include_once($DIR_LIBS . 'skinie.php');
5436
5437                 $importer = new SkinImport();
5438
5439                 // get full filename
5440                 if ( $mode == 'file' )
5441                 {
5442                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5443                 }
5444                 else
5445                 {
5446                         $skinFile = $skinFileRaw;
5447                 }
5448
5449                 $error = $importer->readFile($skinFile);
5450                 if ( $error )
5451                 {
5452                         unset($importer);
5453                         return $error;
5454                 }
5455
5456                 $error = $importer->writeToDatabase($allowOverwrite);
5457                 if ( $error )
5458                 {
5459                         unset($importer);
5460                         return $error;
5461                 }
5462
5463                 self::$contents['mode']         = $mode;
5464                 self::$contents['skinfile']     = $skinFileRaw;
5465                 self::$contents['skininfo']     = $importer->getInfo();
5466                 self::$contents['skinnames']    = $importer->getSkinNames();
5467                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5468
5469                 unset($importer);
5470                 return '';
5471         }
5472
5473         /**
5474          * Admin::skinieexport()
5475          *
5476          * @param       array   $aSkins
5477          * @param       array   $aTemplates
5478          * @param       string  $info
5479          * @return      void
5480          */
5481         static private function skinieexport($aSkins, $aTemplates, $info)
5482         {
5483                 global $DIR_LIBS;
5484
5485                 // load skinie class
5486                 include_once($DIR_LIBS . 'skinie.php');
5487
5488                 if ( !is_array($aSkins) )
5489                 {
5490                         $aSkins = array();
5491                 }
5492
5493                 if (!is_array($aTemplates))
5494                 {
5495                         $aTemplates = array();
5496                 }
5497
5498                 $skinList = array_keys($aSkins);
5499                 $templateList = array_keys($aTemplates);
5500
5501                 $exporter = new SkinExport();
5502                 foreach ( $skinList as $skinId )
5503                 {
5504                         $exporter->addSkin($skinId);
5505                 }
5506                 foreach ( $templateList as $templateId )
5507                 {
5508                         $exporter->addTemplate($templateId);
5509                 }
5510                 $exporter->setInfo($info);
5511                 $exporter->export();
5512
5513                 return;
5514         }
5515
5516         /**
5517          * Admin::action_parseSpecialskin()
5518          *
5519          * @param       void
5520          * @return      void
5521          */
5522         static private function action_parseSpecialskin()
5523         {
5524                 self::$skin->parse(self::$action);
5525                 return;
5526         }
5527 }