nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                                 'admntemplateoverview' => 'admintemplateoverview'\r
 212                         );\r
 213                 }\r
 214                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 215                 {\r
 216                         $action = $alias[$action];\r
 217                 }\r
 218                 $methodName = "action_{$action}";\r
 219                 self::$action = strtolower($action);\r
 220                 \r
 221                 /* 2. check the action */\r
 222                 $synonimActions = array(\r
 223                         'banlistnewfromitem',\r
 224                         'memberedit',\r
 225                         'login',\r
 226                 );\r
 227                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 228                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 229                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 230                 {\r
 231                         if (!$manager->checkTicket())\r
 232                         {\r
 233                                 self::error(_ERROR_BADTICKET);\r
 234                         }\r
 235                 }\r
 236 \r
 237                 /* 3. parse according to the action */\r
 238                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 239                 {\r
 240                         /* TODO: what is this?\r
 241                         self::action_parseSpecialskin();\r
 242                         */\r
 243                 }\r
 244                 elseif ( method_exists('Admin', $methodName) )\r
 245                 {\r
 246                         call_user_func(array(__CLASS__, $methodName));\r
 247                 }\r
 248                 else if ( self::existsSkinContents('adminerrorpage') )\r
 249                 {\r
 250                         self::error(_BADACTION . ENTITY::hsc($action));\r
 251                 }\r
 252                 elseif ( $id != $CONF['AdminSkin'] )\r
 253                 {\r
 254                         self::$skin = new Skin($CONF['AdminSkin']);\r
 255                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 256                         {\r
 257                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 258                         }\r
 259                 }\r
 260                 else\r
 261                 {\r
 262                         self::error(_BADACTION . ENTITY::hsc($action));\r
 263                 }\r
 264                 exit;\r
 265         }\r
 266         \r
 267         /**\r
 268          * Action::existsSkinContents()\r
 269          * Check skin contents\r
 270          *\r
 271          * @param       string  $action action type\r
 272          * @return      boolean\r
 273          */\r
 274         static private function existsSkinContents($action)\r
 275         {\r
 276                 $in_array  = in_array($action, self::$skinless_actions);\r
 277                 \r
 278                 if ( $in_array )\r
 279                 {\r
 280                         return $in_array;\r
 281                 }\r
 282                 else\r
 283                 {\r
 284                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 285                         /* TODO: skinid should be a default */\r
 286                         if ( !is_object(self::$skin) )\r
 287                         {\r
 288                                 global $CONF;\r
 289                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 290                         }\r
 291                         else\r
 292                         {\r
 293                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 294                         }\r
 295                 }\r
 296                 return;\r
 297         }\r
 298         \r
 299         /**\r
 300          * Action::specialActionsAllow()\r
 301          * Check exists specialskinparts\r
 302          *\r
 303          * @param       string  $action action type\r
 304          * @return boolean\r
 305          */\r
 306         static private function specialActionsAllow($action)\r
 307         {\r
 308                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 309                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 310                 return DB::getValue($query);\r
 311         }\r
 312         \r
 313         /**\r
 314          * Action::action_showlogin()\r
 315          * \r
 316          * @param       void\r
 317          * @return      void\r
 318          */\r
 319         static private function action_showlogin()\r
 320         {\r
 321                 global $error;\r
 322                 self::action_login($error);\r
 323                 return;\r
 324         }\r
 325         \r
 326         /**\r
 327          * Action::action_login()\r
 328          * \r
 329          * @param       string  $msg            message for pageheader\r
 330          * @param       integer $passvars       ???\r
 331          */\r
 332         static private function action_login($msg = '', $passvars = 1)\r
 333         {\r
 334                 global $member;\r
 335                 \r
 336                 // skip to overview when allowed\r
 337                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 338                 {\r
 339                         self::action_overview();\r
 340                         exit;\r
 341                 }\r
 342                 \r
 343                 /* TODO: needless variable??? */\r
 344                 self::$passvar = $passvars;\r
 345                 if ( $msg )\r
 346                 {\r
 347                         self::$headMess = $msg;\r
 348                 }\r
 349                 \r
 350                 self::$skin->parse('showlogin');\r
 351         }\r
 352         \r
 353         /**\r
 354          * Action::action_overview()\r
 355          * provides a screen with the overview of the actions available\r
 356          * \r
 357          * @param       string  $msg    message for pageheader\r
 358          * @return      void\r
 359          */\r
 360         static private function action_overview($msg = '')\r
 361         {\r
 362                 if ( $msg )\r
 363                 {\r
 364                         self::$headMess = $msg;\r
 365                 }\r
 366                 \r
 367                 self::$skin->parse('overview');\r
 368                 return;\r
 369         }\r
 370         \r
 371         /**\r
 372          * Admin::action_manage()\r
 373          * \r
 374          * @param       string  $msg    message for pageheader\r
 375          * @retrn       void\r
 376          */\r
 377         static private function action_manage($msg = '')\r
 378         {\r
 379                 global $member;\r
 380                 \r
 381                 if ( $msg )\r
 382                 {\r
 383                         self::$headMess = $msg;\r
 384                 }\r
 385                 $member->isAdmin() or self::disallow();\r
 386                 \r
 387                 self::$skin->parse('manage');\r
 388                 return;\r
 389         }\r
 390         \r
 391         /**\r
 392          * Action::action_itemlist()\r
 393          * \r
 394          * @param       integer id for weblod\r
 395          * @return      void\r
 396          */\r
 397         static private function action_itemlist($blogid = '')\r
 398         {\r
 399                 global $member, $manager, $CONF;\r
 400                 \r
 401                 if ( $blogid == '' )\r
 402                 {\r
 403                         $blogid = intRequestVar('blogid');\r
 404                 }\r
 405                 \r
 406                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 407                 \r
 408                 self::$skin->parse('itemlist');\r
 409                 return;\r
 410         }\r
 411         \r
 412         /**\r
 413          * Action::action_batchitem()\r
 414          * \r
 415          * @param       void\r
 416          * @return      void\r
 417          */\r
 418         static private function action_batchitem()\r
 419         {\r
 420                 global $member, $manager;\r
 421                 \r
 422                 $member->isLoggedIn() or self::disallow();\r
 423                 \r
 424                 $selected       = requestIntArray('batch');\r
 425                 $action         = requestVar('batchaction');\r
 426                 \r
 427                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 428                 {\r
 429                         self::error(_BATCH_NOSELECTION);\r
 430                 }\r
 431                 \r
 432                 // On move: when no destination blog/category chosen, show choice now\r
 433                 $destCatid = intRequestVar('destcatid');\r
 434                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 435                 {\r
 436                         self::batchMoveSelectDestination('item', $selected);\r
 437                 }\r
 438                 \r
 439                 // On delete: check if confirmation has been given\r
 440                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 441                 {\r
 442                         self::batchAskDeleteConfirmation('item', $selected);\r
 443                 }\r
 444                 \r
 445                 self::$skin->parse('batchitem');\r
 446                 return;\r
 447         }\r
 448         \r
 449         /**\r
 450          * Action::action_batchcomment()\r
 451          * \r
 452          * @param       void\r
 453          * @return      void\r
 454          */\r
 455         static private function action_batchcomment()\r
 456         {\r
 457                 global $member;\r
 458                 \r
 459                 $member->isLoggedIn() or self::disallow();\r
 460                 \r
 461                 $selected       = requestIntArray('batch');\r
 462                 $action         = requestVar('batchaction');\r
 463                 \r
 464                 // Show error when no items were selected\r
 465                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 466                 {\r
 467                         self::error(_BATCH_NOSELECTION);\r
 468                 }\r
 469                 \r
 470                 // On delete: check if confirmation has been given\r
 471                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 472                 {\r
 473                         self::batchAskDeleteConfirmation('comment', $selected);\r
 474                 }\r
 475                 \r
 476                 self::$skin->parse('batchcomment');\r
 477                 return;\r
 478         }\r
 479         \r
 480         /**\r
 481          * Admin::setAdminAction()\r
 482          *\r
 483          * @param       string  $action\r
 484          * @return      void\r
 485          */\r
 486         static public function setAdminAction($action)\r
 487         {\r
 488                 self::$action = $action;\r
 489                 return;\r
 490         }\r
 491         \r
 492         /**\r
 493          * Admin::action_batchmember()\r
 494          * \r
 495          * @param       void\r
 496          * @return      void\r
 497          */\r
 498         static private function action_batchmember()\r
 499         {\r
 500                 global $member;\r
 501                 \r
 502                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 503                 \r
 504                 $selected       = requestIntArray('batch');\r
 505                 $action         = requestVar('batchaction');\r
 506                 \r
 507                 // Show error when no members selected\r
 508                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 509                 {\r
 510                         self::error(_BATCH_NOSELECTION);\r
 511                 }\r
 512                 \r
 513                 // On delete: check if confirmation has been given\r
 514                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 515                 {\r
 516                         self::batchAskDeleteConfirmation('member',$selected);\r
 517                 }\r
 518                 \r
 519                 self::$skin->parse('batchmember');\r
 520                 return;\r
 521         }\r
 522         \r
 523         /**\r
 524          * Admin::action_batchteam()\r
 525          * \r
 526          * @param       void\r
 527          * @return      void\r
 528          */\r
 529         static private function action_batchteam()\r
 530         {\r
 531                 global $member;\r
 532                 \r
 533                 $blogid = intRequestVar('blogid');\r
 534                 \r
 535                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 536                 \r
 537                 $selected       = requestIntArray('batch');\r
 538                 $action         = requestVar('batchaction');\r
 539                 \r
 540                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 541                 {\r
 542                         self::error(_BATCH_NOSELECTION);\r
 543                 }\r
 544                 \r
 545                 // On delete: check if confirmation has been given\r
 546                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 547                 {\r
 548                         self::batchAskDeleteConfirmation('team',$selected);\r
 549                 }\r
 550                 \r
 551                 self::$skin->parse('batchteam');\r
 552                 return;\r
 553         }\r
 554         \r
 555         /**\r
 556          * Admin::action_batchcategory()\r
 557          * \r
 558          * @param       void\r
 559          * @return      void\r
 560          */\r
 561         static private function action_batchcategory()\r
 562         {\r
 563                 global $member, $manager;\r
 564                 \r
 565                 $member->isLoggedIn() or self::disallow();\r
 566                 \r
 567                 $selected       = requestIntArray('batch');\r
 568                 $action         = requestVar('batchaction');\r
 569                 \r
 570                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 571                 {\r
 572                         self::error(_BATCH_NOSELECTION);\r
 573                 }\r
 574                 \r
 575                 // On move: when no destination blog chosen, show choice now\r
 576                 $destBlogId = intRequestVar('destblogid');\r
 577                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 578                 {\r
 579                         self::batchMoveCategorySelectDestination('category', $selected);\r
 580                 }\r
 581                 \r
 582                 // On delete: check if confirmation has been given\r
 583                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 584                 {\r
 585                         self::batchAskDeleteConfirmation('category', $selected);\r
 586                 }\r
 587                 \r
 588                 self::$skin->parse('batchcategory');\r
 589                 return;\r
 590         }\r
 591         \r
 592         /**\r
 593          * Admin::batchMoveSelectDestination()\r
 594          * \r
 595          * @param       string  $type   type of batch action\r
 596          * @param       integer $ids    needless???\r
 597          * @return      void\r
 598          * \r
 599          * TODO: remove needless argument\r
 600          */\r
 601         static private function batchMoveSelectDestination($type, $ids)\r
 602         {\r
 603                 $_POST['batchmove'] = $type;\r
 604                 self::$skin->parse('batchmove');\r
 605                 return;\r
 606         }\r
 607         \r
 608         /**\r
 609          * Admin::batchMoveCategorySelectDestination()\r
 610          * \r
 611          * @param       string  $type   type of batch action\r
 612          * @param       integer $ids    needless???\r
 613          * @return      void\r
 614          * \r
 615          * TODO: remove needless argument\r
 616          */\r
 617         static private function batchMoveCategorySelectDestination($type, $ids)\r
 618         {\r
 619                 $_POST['batchmove'] = $type;\r
 620                 global $manager;\r
 621                 self::$skin->parse('batchmovecat');\r
 622                 return;\r
 623         }\r
 624         \r
 625         /**\r
 626          * Admin::batchAskDeleteConfirmation()\r
 627          * \r
 628          * @param       string  $type   type of batch action\r
 629          * @param       integer $ids    needless???\r
 630          * @return      void\r
 631          * \r
 632          * TODO: remove needless argument\r
 633          */\r
 634         static private function batchAskDeleteConfirmation($type, $ids)\r
 635         {\r
 636                 self::$skin->parse('batchdelete');\r
 637                 return;\r
 638         }\r
 639         \r
 640         /**\r
 641          * Admin::action_browseownitems()\r
 642          * \r
 643          * @param       void\r
 644          * @return      void\r
 645          */\r
 646         static private function action_browseownitems()\r
 647         {\r
 648                 global $member, $manager, $CONF;\r
 649                 \r
 650                 self::$skin->parse('browseownitems');\r
 651                 return;\r
 652         }\r
 653         \r
 654         /**\r
 655          * Admin::action_itemcommentlist()\r
 656          * Show all the comments for a given item\r
 657          * \r
 658          * @param       integer $itemid ID for item\r
 659          * @return      void\r
 660          */\r
 661         static private function action_itemcommentlist($itemid = '')\r
 662         {\r
 663                 global $member, $manager, $CONF;\r
 664                 \r
 665                 if ( $itemid == '' )\r
 666                 {\r
 667                         $itemid = intRequestVar('itemid');\r
 668                 }\r
 669                 \r
 670                 /* TODO: we consider to use the other way insterad of this */\r
 671                 $_REQUEST['itemid'] = $itemid;\r
 672                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 673                 \r
 674                 // only allow if user is allowed to alter item\r
 675                 $member->canAlterItem($itemid) or self::disallow();\r
 676                 \r
 677                 $blogid = getBlogIdFromItemId($itemid);\r
 678                 \r
 679                 self::$skin->parse('itemcommentlist');\r
 680                 return;\r
 681         }\r
 682         \r
 683         /**\r
 684          * Admin::action_browseowncomments()\r
 685          * Browse own comments\r
 686          * \r
 687          * @param       void\r
 688          * @return      void\r
 689          */\r
 690         static private function action_browseowncomments()\r
 691         {\r
 692                 self::$skin->parse('browseowncomments');\r
 693                 return;\r
 694         }\r
 695         \r
 696         /**\r
 697          * Admin::action_blogcommentlist()\r
 698          * Browse all comments for a weblog\r
 699          * \r
 700          * @param       integer $blogid ID for weblog\r
 701          * @return      void\r
 702          */\r
 703         static private function action_blogcommentlist($blogid = '')\r
 704         {\r
 705                 global $member, $manager, $CONF;\r
 706                 \r
 707                 if ( $blogid == '' )\r
 708                 {\r
 709                         $blogid = intRequestVar('blogid');\r
 710                 }\r
 711                 else\r
 712                 {\r
 713                         $blogid = intval($blogid);\r
 714                 }\r
 715                 \r
 716                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 717                 \r
 718                 /* TODO: we consider to use the other way insterad of this */\r
 719                 $_REQUEST['blogid'] = $blogid;\r
 720                 \r
 721                 self::$skin->parse('blogcommentlist');\r
 722                 return;\r
 723         }\r
 724         \r
 725         /**\r
 726          * Admin::action_createaccount()\r
 727          * \r
 728          * @param       void\r
 729          * @return      void\r
 730          */\r
 731         static private function action_createaccount()\r
 732         {\r
 733                 global $CONF;\r
 734                 \r
 735                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 736                 {\r
 737                         self::$skin->parse('createaccountdisable');\r
 738                         return;\r
 739                 }\r
 740                 \r
 741                 $name = '';\r
 742                 $realname ='';\r
 743                 $email = '';\r
 744                 $url = '';\r
 745                 \r
 746                 $contents = array(\r
 747                         'name'          => '',\r
 748                         'realname'      => '',\r
 749                         'email'         => '',\r
 750                         'url'           => ''\r
 751                 );\r
 752                 \r
 753                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 754                 {\r
 755                         $action = new Action();\r
 756                         $message = $action->createAccount();\r
 757                         if ( $message === 1 )\r
 758                         {\r
 759                                 self::$headMess = $message;\r
 760                                 self::$skin->parse('createaccountsuccess');\r
 761                                 return;\r
 762                         }\r
 763                         \r
 764                         /* TODO: validation */\r
 765                         if ( array_key_exists('name', $_POST) )\r
 766                         {\r
 767                                 $contents['name'] = $_POST['name'];\r
 768                         }\r
 769                         if ( array_key_exists('realname', $_POST) )\r
 770                         {\r
 771                                 $contents['realname'] = $_POST['realname'];\r
 772                         }\r
 773                         if ( array_key_exists('email', $_POST) )\r
 774                         {\r
 775                                 $contents['email'] = $_POST['email'];\r
 776                         }\r
 777                         if ( array_key_exists('url', $_POST) )\r
 778                         {\r
 779                                 $contents['url'] = $_POST['url'];\r
 780                         }\r
 781                         \r
 782                         self::$contents = $contents;\r
 783                         \r
 784                 }\r
 785                 \r
 786                 self::$skin->parse('createaccountinput');\r
 787                 return;\r
 788         }\r
 789         \r
 790         /**\r
 791          * Admin::action_createitem()\r
 792          * Provide a page to item a new item to the given blog\r
 793          * \r
 794          * @param       void\r
 795          * @return      void\r
 796          */\r
 797         static private function action_createitem()\r
 798         {\r
 799                 global $member, $manager;\r
 800                 \r
 801                 $blogid = intRequestVar('blogid');\r
 802                 \r
 803                 // check if allowed\r
 804                 $member->teamRights($blogid) or self::disallow();\r
 805                 \r
 806                 $blog =& $manager->getBlog($blogid);\r
 807                 $contents = array();\r
 808                 \r
 809                 $data = array(\r
 810                         'blog'          => &$blog,\r
 811                         'contents'      => &$contents\r
 812                 );\r
 813                 $manager->notify('PreAddItemForm', $data);\r
 814                 \r
 815                 if ( $blog->convertBreaks() )\r
 816                 {\r
 817                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 818                         {\r
 819                                 $contents['body'] = removeBreaks($contents['body']);\r
 820                         }\r
 821                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 822                         {\r
 823                                 $contents['more'] = removeBreaks($contents['more']);\r
 824                         }\r
 825                 }\r
 826                 \r
 827                 self::$blog = &$blog;\r
 828                 self::$contents = &$contents;\r
 829                 \r
 830                 self::$skin->parse('createitem');\r
 831                 return;\r
 832         }\r
 833         \r
 834         /**\r
 835          * Admin::action_itemedit()\r
 836          * \r
 837          * @param       void\r
 838          * @return      void\r
 839          */\r
 840         static private function action_itemedit()\r
 841         {\r
 842                 global $member, $manager;\r
 843                 \r
 844                 $itemid = intRequestVar('itemid');\r
 845                 \r
 846                 // only allow if user is allowed to alter item\r
 847                 $member->canAlterItem($itemid) or self::disallow();\r
 848                 \r
 849                 $blogid = getBlogIDFromItemID($itemid);\r
 850                 $blog =& $manager->getBlog($blogid);\r
 851                 \r
 852                 $contents =& $manager->getItem($itemid, 1, 1);\r
 853                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$contents));\r
 854                 \r
 855                 if ( $blog->convertBreaks() )\r
 856                 {\r
 857                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 858                         {\r
 859                                 $contents['body'] = removeBreaks($contents['body']);\r
 860                         }\r
 861                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 862                         {\r
 863                                 $contents['more'] = removeBreaks($contents['more']);\r
 864                         }\r
 865                 }\r
 866                 \r
 867                 self::$blog = &$blog;\r
 868                 self::$contents = &$contents;\r
 869                 \r
 870                 self::$skin->parse('itemedit');\r
 871                 return;\r
 872         }\r
 873         \r
 874         /**\r
 875          * Admin::action_itemupdate()\r
 876          * \r
 877          * @param       void\r
 878          * @return      void\r
 879          */\r
 880         static private function action_itemupdate()\r
 881         {\r
 882                 global $member, $manager, $CONF;\r
 883                 \r
 884                 $itemid = intRequestVar('itemid');\r
 885                 $catid  = postVar('catid');\r
 886                 \r
 887                 // only allow if user is allowed to alter item\r
 888                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 889                 \r
 890                 $actiontype = postVar('actiontype');\r
 891                 \r
 892                 // delete actions are handled by itemdelete (which has confirmation)\r
 893                 if ( $actiontype == 'delete' )\r
 894                 {\r
 895                         self::action_itemdelete();\r
 896                         return;\r
 897                 }\r
 898                 \r
 899                 $body           = postVar('body');\r
 900                 $title          = postVar('title');\r
 901                 $more           = postVar('more');\r
 902                 $closed         = intPostVar('closed');\r
 903                 $draftid        = intPostVar('draftid');\r
 904                 \r
 905                 // default action = add now\r
 906                 if ( !$actiontype )\r
 907                 {\r
 908                         $actiontype='addnow';\r
 909                 }\r
 910                 \r
 911                 // create new category if needed\r
 912                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 913                 {\r
 914                         // get blogid\r
 915                         list($blogid) = sscanf($catid,"newcat-%d");\r
 916                         \r
 917                         // create\r
 918                         $blog =& $manager->getBlog($blogid);\r
 919                         $catid = $blog->createNewCategory();\r
 920                         \r
 921                         // show error when sth goes wrong\r
 922                         if ( !$catid )\r
 923                         {\r
 924                                 self::doError(_ERROR_CATCREATEFAIL);\r
 925                         }\r
 926                 }\r
 927                 \r
 928                 /*\r
 929                         set some variables based on actiontype\r
 930 \r
 931                         actiontypes:\r
 932                                 draft items -> addnow, addfuture, adddraft, delete\r
 933                                 non-draft items -> edit, changedate, delete\r
 934 \r
 935                         variables set:\r
 936                                 $timestamp: set to a nonzero value for future dates or date changes\r
 937                                 $wasdraft: set to 1 when the item used to be a draft item\r
 938                                 $publish: set to 1 when the edited item is not a draft\r
 939          */\r
 940                 $blogid =  getBlogIDFromItemID($itemid);\r
 941                 $blog   =& $manager->getBlog($blogid);\r
 942                 \r
 943                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 944                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 945                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 946                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 947                 {\r
 948                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 949                 }\r
 950                 else\r
 951                 {\r
 952                         $timestamp =0;\r
 953                 }\r
 954                 \r
 955                 // edit the item for real\r
 956                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 957                 \r
 958                 self::updateFuturePosted($blogid);\r
 959                 \r
 960                 if ( $draftid > 0 )\r
 961                 {\r
 962                         // delete permission is checked inside Item::delete()\r
 963                         Item::delete($draftid);\r
 964                 }\r
 965                 \r
 966                 if ( $catid != intPostVar('catid') )\r
 967                 {\r
 968                         self::action_categoryedit(\r
 969                                 $catid,\r
 970                                 $blog->getID(),\r
 971                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 972                         );\r
 973                 }\r
 974                 else\r
 975                 {\r
 976                         // TODO: set start item correctly for itemlist\r
 977                         $item =& $manager->getitem($itemid, 0, 0);\r
 978                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 979                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 980                         $cnt  = DB::getValue($query);\r
 981                         $_REQUEST['start'] = $cnt + 1;\r
 982                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 983                 }\r
 984                 return;\r
 985         }\r
 986         \r
 987         /**\r
 988          * Admin::action_itemdelete()\r
 989          * Delete item\r
 990          * \r
 991          * @param       Void\r
 992          * @return      Void\r
 993          */\r
 994         static private function action_itemdelete()\r
 995         {\r
 996                 global $member, $manager;\r
 997                 \r
 998                 $itemid = intRequestVar('itemid');\r
 999                 \r
1000                 // only allow if user is allowed to alter item\r
1001                 $member->canAlterItem($itemid) or self::disallow();\r
1002                 \r
1003                 if ( !$manager->existsItem($itemid,1,1) )\r
1004                 {\r
1005                         self::error(_ERROR_NOSUCHITEM);\r
1006                 }\r
1007                 \r
1008                 self::$skin->parse('itemdelete');\r
1009                 return;\r
1010         }\r
1011         \r
1012         /**\r
1013          * Admin::action_itemdeleteconfirm()\r
1014          * \r
1015          * @param       void\r
1016          * @return      void\r
1017          */\r
1018         static private function action_itemdeleteconfirm()\r
1019         {\r
1020                 global $member;\r
1021                 \r
1022                 $itemid = intRequestVar('itemid');\r
1023                 \r
1024                 // only allow if user is allowed to alter item\r
1025                 $member->canAlterItem($itemid) or self::disallow();\r
1026                 \r
1027                 // get blogid first\r
1028                 $blogid = getBlogIdFromItemId($itemid);\r
1029                 \r
1030                 // delete item (note: some checks will be performed twice)\r
1031                 self::deleteOneItem($itemid);\r
1032                 \r
1033                 self::action_itemlist($blogid);\r
1034                 return;\r
1035         }\r
1036         \r
1037         /**\r
1038          * Admin::deleteOneItem()\r
1039          * Deletes one item and returns error if something goes wrong\r
1040          * \r
1041          * @param       integer $itemid ID for item\r
1042          * @return      void\r
1043          */\r
1044         static public function deleteOneItem($itemid)\r
1045         {\r
1046                 global $member, $manager;\r
1047                 \r
1048                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1049                 if ( !$member->canAlterItem($itemid) )\r
1050                 {\r
1051                         return _ERROR_DISALLOWED;\r
1052                 }\r
1053                 \r
1054                 // need to get blogid before the item is deleted\r
1055                 $blogid = getBlogIDFromItemId($itemid);\r
1056                 \r
1057                 $manager->loadClass('ITEM');\r
1058                 Item::delete($itemid);\r
1059                 \r
1060                 // update blog's futureposted\r
1061                 self::updateFuturePosted($blogid);\r
1062                 return;\r
1063         }\r
1064         \r
1065         /**\r
1066          * Admin::updateFuturePosted()\r
1067          * Update a blog's future posted flag\r
1068          * \r
1069          * @param integer $blogid\r
1070          * @return      void\r
1071          */\r
1072         static private function updateFuturePosted($blogid)\r
1073         {\r
1074                 global $manager;\r
1075                 \r
1076                 $blogid                 =  intval($blogid);\r
1077                 $blog                   =& $manager->getBlog($blogid);\r
1078                 $currenttime    =  $blog->getCorrectTime(time());\r
1079                 \r
1080                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1081                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1082                 $result = DB::getResult($query);\r
1083                 \r
1084                 if ( $result->rowCount() > 0 )\r
1085                 {\r
1086                                 $blog->setFuturePost();\r
1087                 }\r
1088                 else\r
1089                 {\r
1090                                 $blog->clearFuturePost();\r
1091                 }\r
1092                 return;\r
1093         }\r
1094 \r
1095         /**\r
1096          * Admin::action_itemmove()\r
1097          * \r
1098          * @param       void\r
1099          * @return      void\r
1100          */\r
1101         static private function action_itemmove()\r
1102         {\r
1103                 global $member, $manager;\r
1104                 \r
1105                 $itemid = intRequestVar('itemid');\r
1106                 \r
1107                 $member->canAlterItem($itemid) or self::disallow();\r
1108                 \r
1109                 self::$skin->parse('itemmove');\r
1110                 return;\r
1111         }\r
1112         \r
1113         /**\r
1114          * Admin::action_itemmoveto()\r
1115          * \r
1116          * @param       void\r
1117          * @return      void\r
1118          */\r
1119         static private function action_itemmoveto()\r
1120         {\r
1121                 global $member, $manager;\r
1122                 \r
1123                 $itemid = intRequestVar('itemid');\r
1124                 $catid = requestVar('catid');\r
1125                 \r
1126                 // create new category if needed\r
1127                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1128                 {\r
1129                         // get blogid\r
1130                         list($blogid) = sscanf($catid,'newcat-%d');\r
1131                         \r
1132                         // create\r
1133                         $blog =& $manager->getBlog($blogid);\r
1134                         $catid = $blog->createNewCategory();\r
1135                         \r
1136                         // show error when sth goes wrong\r
1137                         if ( !$catid )\r
1138                         {\r
1139                                 self::doError(_ERROR_CATCREATEFAIL);\r
1140                         }\r
1141                 }\r
1142                 \r
1143                 // only allow if user is allowed to alter item\r
1144                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1145                 \r
1146                 $old_blogid = getBlogIDFromItemId($itemid);\r
1147                 \r
1148                 Item::move($itemid, $catid);\r
1149                 \r
1150                 // set the futurePosted flag on the blog\r
1151                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1152                 \r
1153                 // reset the futurePosted in case the item is moved from one blog to another\r
1154                 self::updateFuturePosted($old_blogid);\r
1155                 \r
1156                 if ( $catid != intRequestVar('catid') )\r
1157                 {\r
1158                         self::action_categoryedit($catid, $blog->getID());\r
1159                 }\r
1160                 else\r
1161                 {\r
1162                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1163                 }\r
1164                 return;\r
1165         }\r
1166         \r
1167         /**\r
1168          * Admin::moveOneItem()\r
1169          * Moves one item to a given category (category existance should be checked by caller)\r
1170          * errors are returned\r
1171          * \r
1172          * @param       integer $itemid         ID for item\r
1173          * @param       integer $destCatid      ID for category to which the item will be moved\r
1174          * @return      void\r
1175          */\r
1176         static public function moveOneItem($itemid, $destCatid)\r
1177         {\r
1178                 global $member;\r
1179                 \r
1180                 // only allow if user is allowed to move item\r
1181                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1182                 {\r
1183                         return _ERROR_DISALLOWED;\r
1184                 }\r
1185                 \r
1186                 Item::move($itemid, $destCatid);\r
1187                 return;\r
1188         }\r
1189         \r
1190         /**\r
1191          * Admin::action_additem()\r
1192          * Adds a item to the chosen blog\r
1193          * \r
1194          * @param       void\r
1195          * @return      void\r
1196          */\r
1197         static private function action_additem()\r
1198         {\r
1199                 global $manager, $CONF;\r
1200                 \r
1201                 $manager->loadClass('ITEM');\r
1202                 \r
1203                 $result = Item::createFromRequest();\r
1204                 \r
1205                 if ( $result['status'] == 'error' )\r
1206                 {\r
1207                         self::error($result['message']);\r
1208                 }\r
1209                 \r
1210                 $itemid = (integer) $result['itemid'];\r
1211                 \r
1212                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1213                 \r
1214                 if ( $result['status'] == 'newcategory' )\r
1215                 {\r
1216                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1217                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1218                 }\r
1219                 else\r
1220                 {\r
1221                         $methodName = 'action_itemlist';\r
1222                         self::action_itemlist($blogid);\r
1223                 }\r
1224                 return;\r
1225         }\r
1226         \r
1227         /**\r
1228          * Admin::action_commentedit()\r
1229          * Allows to edit previously made comments\r
1230          * \r
1231          * @param       void\r
1232          * @return      void\r
1233          */\r
1234         static private function action_commentedit()\r
1235         {\r
1236                 global $member, $manager;\r
1237                 \r
1238                 $commentid = intRequestVar('commentid');\r
1239                 \r
1240                 $member->canAlterComment($commentid) or self::disallow();\r
1241                 \r
1242                 self::$skin->parse('commentedit');\r
1243                 return;\r
1244         }\r
1245         \r
1246         /**\r
1247          * Admin::action_commentupdate()\r
1248          * \r
1249          * @param       void\r
1250          * @return      void\r
1251          */\r
1252         static private function action_commentupdate()\r
1253         {\r
1254                 global $member, $manager;\r
1255                 \r
1256                 $commentid = intRequestVar('commentid');\r
1257                 \r
1258                 $member->canAlterComment($commentid) or self::disallow();\r
1259                 \r
1260                 $url    = postVar('url');\r
1261                 $email  = postVar('email');\r
1262                 $body   = postVar('body');\r
1263                 \r
1264                 // intercept words that are too long\r
1265                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1266                 {\r
1267                         self::error(_ERROR_COMMENT_LONGWORD);\r
1268                 }\r
1269                 \r
1270                 // check length\r
1271                 if ( i18n::strlen($body) < 3 )\r
1272                 {\r
1273                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1274                 }\r
1275                 \r
1276                 if ( i18n::strlen($body) > 5000 )\r
1277                 {\r
1278                         self::error(_ERROR_COMMENT_TOOLONG);\r
1279                 }\r
1280                 \r
1281                 // prepare body\r
1282                 $body = Comment::prepareBody($body);\r
1283                 \r
1284                 // call plugins\r
1285                 $data = array(\r
1286                         'body' => &$body\r
1287                 );\r
1288                 $manager->notify('PreUpdateComment', $data);\r
1289                 \r
1290                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1291                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1292                 DB::execute($query);\r
1293                 \r
1294                 // get itemid\r
1295                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1296                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1297                 \r
1298                 $itemid = DB::getValue($query);\r
1299                 \r
1300                 if ( $member->canAlterItem($itemid) )\r
1301                 {\r
1302                         self::action_itemcommentlist($itemid);\r
1303                 }\r
1304                 else\r
1305                 {\r
1306                         self::action_browseowncomments();\r
1307                 }\r
1308                 return;\r
1309         }\r
1310         \r
1311         /**\r
1312          * Admin::action_commentdelete()\r
1313          * Update comment\r
1314          * \r
1315          * @param       void\r
1316          * @return      void\r
1317          */\r
1318         static private function action_commentdelete()\r
1319         {\r
1320                 global $member, $manager;\r
1321                 \r
1322                 $commentid = intRequestVar('commentid');\r
1323                 $member->canAlterComment($commentid) or self::disallow();\r
1324                 \r
1325                 self::$skin->parse('commentdelete');\r
1326                 return;\r
1327         }\r
1328         \r
1329         /**\r
1330          * Admin::action_commentdeleteconfirm()\r
1331          * \r
1332          * @param       void\r
1333          * @return      void\r
1334          */\r
1335         static private function action_commentdeleteconfirm()\r
1336         {\r
1337                 global $member;\r
1338                 \r
1339                 $commentid = intRequestVar('commentid');\r
1340                 \r
1341                 // get item id first\r
1342                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1343                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1344                 \r
1345                 $itemid = DB::getValue($query);\r
1346                 \r
1347                 $error = self::deleteOneComment($commentid);\r
1348                 if ( $error )\r
1349                 {\r
1350                         self::doError($error);\r
1351                 }\r
1352                 \r
1353                 if ( $member->canAlterItem($itemid) )\r
1354                 {\r
1355                         self::action_itemcommentlist($itemid);\r
1356                 }\r
1357                 else\r
1358                 {\r
1359                         self::action_browseowncomments();\r
1360                 }\r
1361                 return;\r
1362         }\r
1363         \r
1364         /**\r
1365          * Admin::deleteOneComment()\r
1366          * \r
1367          * @param       integer $commentid      ID for comment\r
1368          * @return      void\r
1369          */\r
1370         static public function deleteOneComment($commentid)\r
1371         {\r
1372                 global $member, $manager;\r
1373                 \r
1374                 $commentid = (integer) $commentid;\r
1375                 \r
1376                 if ( !$member->canAlterComment($commentid) )\r
1377                 {\r
1378                         return _ERROR_DISALLOWED;\r
1379                 }\r
1380                 \r
1381                 $data = array(\r
1382                         'commentid' => $commentid\r
1383                 );\r
1384                 \r
1385                 $manager->notify('PreDeleteComment', $data);\r
1386                 \r
1387                 // delete the comments associated with the item\r
1388                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1389                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1390                 DB::execute($query);\r
1391                 \r
1392                 $data = array(\r
1393                         'commentid' => $commentid\r
1394                 );\r
1395                 \r
1396                 $manager->notify('PostDeleteComment', $data);\r
1397                 \r
1398                 return '';\r
1399         }\r
1400         \r
1401         /**\r
1402          * Admin::action_usermanagement()\r
1403          * Usermanagement main\r
1404          * \r
1405          * @param       void\r
1406          * @return      void\r
1407          */\r
1408         static private function action_usermanagement()\r
1409         {\r
1410                 global $member, $manager;\r
1411                 \r
1412                 // check if allowed\r
1413                 $member->isAdmin() or self::disallow();\r
1414                 \r
1415                 self::$skin->parse('usermanagement');\r
1416                 return;\r
1417         }\r
1418         \r
1419         /**\r
1420          * Admin::action_memberedit()\r
1421          * Edit member settings\r
1422          * \r
1423          * @param       void\r
1424          * @return      void\r
1425          */\r
1426         static private function action_memberedit()\r
1427         {\r
1428                 self::action_editmembersettings(intRequestVar('memberid'));\r
1429                 return;\r
1430         }\r
1431         \r
1432         /**\r
1433          * Admin::action_editmembersettings()\r
1434          * \r
1435          * @param       integer $memberid       ID for member\r
1436          * @return      void\r
1437          * \r
1438          */\r
1439         static private function action_editmembersettings($memberid = '')\r
1440         {\r
1441                 global $member, $manager, $CONF;\r
1442                 \r
1443                 if ( $memberid == '' )\r
1444                 {\r
1445                         $memberid = $member->getID();\r
1446                 }\r
1447                 \r
1448                 /* TODO: we should consider to use the other way insterad of this */\r
1449                 $_REQUEST['memberid'] = $memberid;\r
1450                 \r
1451                 // check if allowed\r
1452                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1453                 \r
1454                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1455                 \r
1456                 self::$skin->parse('editmembersettings');\r
1457                 return;\r
1458         }\r
1459         \r
1460         /**\r
1461          * Admin::action_changemembersettings()\r
1462          * \r
1463          * @param       void\r
1464          * @return      void\r
1465          */\r
1466         static private function action_changemembersettings()\r
1467         {\r
1468                 global $member, $CONF, $manager;\r
1469                 \r
1470                 $memberid = intRequestVar('memberid');\r
1471                 \r
1472                 // check if allowed\r
1473                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1474                 \r
1475                 $name                   = trim(strip_tags(postVar('name')));\r
1476                 $realname               = trim(strip_tags(postVar('realname')));\r
1477                 $password               = postVar('password');\r
1478                 $repeatpassword = postVar('repeatpassword');\r
1479                 $email                  = strip_tags(postVar('email'));\r
1480                 $url                    = strip_tags(postVar('url'));\r
1481                 $adminskin              = intPostVar('adminskin');\r
1482                 \r
1483                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1484                 if ( !preg_match('#^https?://#', $url) )\r
1485                 {\r
1486                         $url = 'http://' . $url;\r
1487                 }\r
1488                 \r
1489                 $admin          = postVar('admin');\r
1490                 $canlogin       = postVar('canlogin');\r
1491                 $notes          = strip_tags(postVar('notes'));\r
1492                 $locale         = postVar('locale');\r
1493                 \r
1494                 $mem =& $manager->getMember($memberid);\r
1495                 \r
1496                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1497                 {\r
1498                         if ( !isValidDisplayName($name) )\r
1499                         {\r
1500                                 self::error(_ERROR_BADNAME);\r
1501                         }\r
1502                         \r
1503                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1504                         {\r
1505                                 self::error(_ERROR_NICKNAMEINUSE);\r
1506                         }\r
1507                         \r
1508                         if ( $password != $repeatpassword )\r
1509                         {\r
1510                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1511                         }\r
1512                         \r
1513                         if ( $password && (i18n::strlen($password) < 6) )\r
1514                         {\r
1515                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1516                         }\r
1517                                 \r
1518                         if ( $password )\r
1519                         {\r
1520                                 $pwdvalid = true;\r
1521                                 $pwderror = '';\r
1522                                 \r
1523                                 $data = array(\r
1524                                         'password'     => $password,\r
1525                                         'errormessage' => &$pwderror,\r
1526                                         'valid'        => &$pwdvalid\r
1527                                 );\r
1528                                 $manager->notify('PrePasswordSet', $data);\r
1529                                 \r
1530                                 if ( !$pwdvalid )\r
1531                                 {\r
1532                                         self::error($pwderror);\r
1533                                 }\r
1534                         }\r
1535                 }\r
1536                 \r
1537                 if ( !NOTIFICATION::address_validation($email) )\r
1538                 {\r
1539                         self::error(_ERROR_BADMAILADDRESS);\r
1540                 }\r
1541                 if ( !$realname )\r
1542                 {\r
1543                         self::error(_ERROR_REALNAMEMISSING);\r
1544                 }\r
1545                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1546                 {\r
1547                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1548                 }\r
1549                 \r
1550                 // check if there will remain at least one site member with both the logon and admin rights\r
1551                 // (check occurs when taking away one of these rights from such a member)\r
1552                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1553                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1554                         )\r
1555                 {\r
1556                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1557                         if ( $r->rowCount() < 2 )\r
1558                         {\r
1559                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1560                         }\r
1561                 }\r
1562                 \r
1563                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1564                 {\r
1565                         $mem->setDisplayName($name);\r
1566                         if ( $password )\r
1567                         {\r
1568                                 $mem->setPassword($password);\r
1569                         }\r
1570                 }\r
1571                 \r
1572                 $oldEmail = $mem->getEmail();\r
1573                 \r
1574                 $mem->setRealName($realname);\r
1575                 $mem->setEmail($email);\r
1576                 $mem->setURL($url);\r
1577                 $mem->setNotes($notes);\r
1578                 $mem->setLocale($locale);\r
1579                 \r
1580                 // only allow super-admins to make changes to the admin status\r
1581                 if ( $member->isAdmin() )\r
1582                 {\r
1583                         $mem->setAdmin($admin);\r
1584                         $mem->setCanLogin($canlogin);\r
1585                 }\r
1586                 \r
1587                 $autosave = postVar('autosave');\r
1588                 $mem->setAutosave($autosave);\r
1589                 \r
1590                 $mem->write();\r
1591                 \r
1592                 // store plugin options\r
1593                 $aOptions = requestArray('plugoption');\r
1594                 NucleusPlugin::apply_plugin_options($aOptions);\r
1595                 $data = array(\r
1596                         'context'  => 'member',\r
1597                         'memberid' => $memberid,\r
1598                         'member'   => &$mem\r
1599                 );\r
1600                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1601                 \r
1602                 // if email changed, generate new password\r
1603                 if ( $oldEmail != $mem->getEmail() )\r
1604                 {\r
1605                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1606                         // logout member\r
1607                         $mem->newCookieKey();\r
1608                         \r
1609                         // only log out if the member being edited is the current member.\r
1610                         if ( $member->getID() == $memberid )\r
1611                         {\r
1612                                 $member->logout();\r
1613                         }\r
1614                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1615                         return;\r
1616                 }\r
1617                 \r
1618                 if ( ($mem->getID() == $member->getID())\r
1619                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1620                 {\r
1621                         $mem->newCookieKey();\r
1622                         $member->logout();\r
1623                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1624                 }\r
1625                 else\r
1626                 {\r
1627                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1628                 }\r
1629                 return;\r
1630         }\r
1631 \r
1632         /**\r
1633          * Admin::action_memberadd()\r
1634          * \r
1635          * @param       void\r
1636          * @return      void\r
1637          * \r
1638          */\r
1639         static private function action_memberadd()\r
1640         {\r
1641                 global $member, $manager;\r
1642                 \r
1643                 // check if allowed\r
1644                 $member->isAdmin() or self::disallow();\r
1645                 \r
1646                 if ( postVar('password') != postVar('repeatpassword') )\r
1647                 {\r
1648                         self::error(_ERROR_PASSWORDMISMATCH);\r
1649                 }\r
1650                 \r
1651                 if ( i18n::strlen(postVar('password')) < 6 )\r
1652                 {\r
1653                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1654                 }\r
1655                 \r
1656                 $res = Member::create(\r
1657                         postVar('name'),\r
1658                         postVar('realname'),\r
1659                         postVar('password'),\r
1660                         postVar('email'),\r
1661                         postVar('url'),\r
1662                         postVar('admin'),\r
1663                         postVar('canlogin'),\r
1664                         postVar('notes')\r
1665                 );\r
1666                 \r
1667                 if ( $res != 1 )\r
1668                 {\r
1669                         self::error($res);\r
1670                 }\r
1671                 \r
1672                 // fire PostRegister event\r
1673                 $newmem = new Member();\r
1674                 $newmem->readFromName(postVar('name'));\r
1675                 $data = array(\r
1676                         'member' => &$newmem\r
1677                 );\r
1678                 $manager->notify('PostRegister', $data);\r
1679                 \r
1680                 self::action_usermanagement();\r
1681                 return;\r
1682         }\r
1683         \r
1684         /**\r
1685          * Admin::action_forgotpassword()\r
1686          * \r
1687          * @param       void\r
1688          * @return      void\r
1689          */\r
1690         static private function action_forgotpassword()\r
1691         {\r
1692                 self::$skin->parse('forgotpassword');\r
1693                 return;\r
1694         }\r
1695         \r
1696         /**\r
1697          * Admin::action_activate()\r
1698          * Account activation\r
1699          * \r
1700          * @param       void\r
1701          * @return      void\r
1702          */\r
1703         static private function action_activate()\r
1704         {\r
1705                 $key = getVar('key');\r
1706                 self::showActivationPage($key);\r
1707                 return;\r
1708         }\r
1709         \r
1710         /**\r
1711          * Admin::showActivationPage()\r
1712          * \r
1713          * @param       void\r
1714          * @return      void\r
1715          */\r
1716         static private function showActivationPage($key, $message = '')\r
1717         {\r
1718                 global $manager;\r
1719                 \r
1720                 // clean up old activation keys\r
1721                 Member::cleanupActivationTable();\r
1722                 \r
1723                 // get activation info\r
1724                 $info = Member::getActivationInfo($key);\r
1725                 \r
1726                 if ( !$info )\r
1727                 {\r
1728                         self::error(_ERROR_ACTIVATE);\r
1729                 }\r
1730                 \r
1731                 $mem =& $manager->getMember($info->vmember);\r
1732                 \r
1733                 if ( !$mem )\r
1734                 {\r
1735                         self::error(_ERROR_ACTIVATE);\r
1736                 }\r
1737                 \r
1738                 /* TODO: we should consider to use the other way insterad of this */\r
1739                 $_POST['ackey']                                 = $key;\r
1740                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1741                 \r
1742                 self::$headMess = $message;\r
1743                 self::$skin->parse('activate');\r
1744                 return;\r
1745         }\r
1746         \r
1747         /**\r
1748          * Admin::action_activatesetpwd()\r
1749          * Account activation - set password part\r
1750          * \r
1751          * @param       void\r
1752          * @return      void\r
1753          */\r
1754         static private function action_activatesetpwd()\r
1755         {\r
1756                 global $manager;\r
1757                 $key = postVar('key');\r
1758                 \r
1759                 // clean up old activation keys\r
1760                 Member::cleanupActivationTable();\r
1761                 \r
1762                 // get activation info\r
1763                 $info = Member::getActivationInfo($key);\r
1764                 \r
1765                 if ( !$info || ($info->type == 'addresschange') )\r
1766                 {\r
1767                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1768                 }\r
1769                 \r
1770                 $mem =& $manager->getMember($info->vmember);\r
1771                 \r
1772                 if ( !$mem )\r
1773                 {\r
1774                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1775                 }\r
1776                 \r
1777                 $password               = postVar('password');\r
1778                 $repeatpassword = postVar('repeatpassword');\r
1779                 \r
1780                 if ( $password != $repeatpassword )\r
1781                 {\r
1782                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1783                 }\r
1784                 \r
1785                 if ( $password && (i18n::strlen($password) < 6) )\r
1786                 {\r
1787                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1788                 }\r
1789                         \r
1790                 if ( $password )\r
1791                 {\r
1792                         $pwdvalid = true;\r
1793                         $pwderror = '';\r
1794                         \r
1795                         $data = array(\r
1796                                 'password'              => $password,\r
1797                                 'errormessage'  => &$pwderror,\r
1798                                 'valid'                 => &$pwdvalid\r
1799                         );\r
1800                         $manager->notify('PrePasswordSet', $data);\r
1801                         if ( !$pwdvalid )\r
1802                         {\r
1803                                 return self::showActivationPage($key,$pwderror);\r
1804                         }\r
1805                 }\r
1806                 \r
1807                 $error = '';\r
1808                 \r
1809                 $data = array(\r
1810                         'type'   => 'activation',\r
1811                         'member' => $mem,\r
1812                         'error'  => &$error\r
1813                 );\r
1814                 $manager->notify('ValidateForm', $data);\r
1815                 if ( $error != '' )\r
1816                 {\r
1817                         return self::showActivationPage($key, $error);\r
1818                 }\r
1819                 \r
1820                 // set password\r
1821                 $mem->setPassword($password);\r
1822                 $mem->write();\r
1823                 \r
1824                 // do the activation\r
1825                 Member::activate($key);\r
1826                 \r
1827                 self::$skin->parse('activatesetpwd');\r
1828                 return;\r
1829         }\r
1830         \r
1831         /**\r
1832          * Admin::action_manageteam()\r
1833          * Manage team\r
1834          * \r
1835          * @param       void\r
1836          * @return      void\r
1837          */\r
1838         static private function action_manageteam()\r
1839         {\r
1840                 global $member, $manager;\r
1841                 \r
1842                 $blogid = intRequestVar('blogid');\r
1843                 \r
1844                 // check if allowed\r
1845                 $member->blogAdminRights($blogid) or self::disallow();\r
1846                 \r
1847                 self::$skin->parse('manageteam');\r
1848                 return;\r
1849         }\r
1850         \r
1851         /**\r
1852          * Admin::action_teamaddmember()\r
1853          * Add member to team\r
1854          * \r
1855          * @param       void\r
1856          * @return      void\r
1857          */\r
1858         static private function action_teamaddmember()\r
1859         {\r
1860                 global $member, $manager;\r
1861                 \r
1862                 $memberid       = intPostVar('memberid');\r
1863                 $blogid         = intPostVar('blogid');\r
1864                 $admin          = intPostVar('admin');\r
1865                 \r
1866                 // check if allowed\r
1867                 $member->blogAdminRights($blogid) or self::disallow();\r
1868                 \r
1869                 $blog =& $manager->getBlog($blogid);\r
1870                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1871                 {\r
1872                         self::error(_ERROR_ALREADYONTEAM);\r
1873                 }\r
1874                 \r
1875                 self::action_manageteam();\r
1876                 return;\r
1877         }\r
1878         \r
1879         /**\r
1880          * Admin::action_teamdelete()\r
1881          * \r
1882          * @param       void\r
1883          * @return      void\r
1884          */\r
1885         static private function action_teamdelete()\r
1886         {\r
1887                 global $member, $manager;\r
1888                 \r
1889                 $memberid       = intRequestVar('memberid');\r
1890                 $blogid         = intRequestVar('blogid');\r
1891                 \r
1892                 // check if allowed\r
1893                 $member->blogAdminRights($blogid) or self::disallow();\r
1894                 \r
1895                 $teammem =& $manager->getMember($memberid);\r
1896                 $blog =& $manager->getBlog($blogid);\r
1897                 \r
1898                 self::$skin->parse('teamdelete');\r
1899                 return;\r
1900         }\r
1901         \r
1902         /**\r
1903          * Admin::action_teamdeleteconfirm()\r
1904          * \r
1905          * @param       void\r
1906          * @return      void\r
1907          */\r
1908         static private function action_teamdeleteconfirm()\r
1909         {\r
1910                 global $member;\r
1911                 \r
1912                 $memberid = intRequestVar('memberid');\r
1913                 $blogid = intRequestVar('blogid');\r
1914                 \r
1915                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1916                 if ( $error )\r
1917                 {\r
1918                         self::error($error);\r
1919                 }\r
1920                 self::action_manageteam();\r
1921                 return;\r
1922         }\r
1923         \r
1924         /**\r
1925          * Admin::deleteOneTeamMember()\r
1926          * \r
1927          * @param       void\r
1928          * @return      void\r
1929          */\r
1930         static public function deleteOneTeamMember($blogid, $memberid)\r
1931         {\r
1932                 global $member, $manager;\r
1933                 \r
1934                 $blogid   = intval($blogid);\r
1935                 $memberid = intval($memberid);\r
1936                 \r
1937                 // check if allowed\r
1938                 if ( !$member->blogAdminRights($blogid) )\r
1939                 {\r
1940                         return _ERROR_DISALLOWED;\r
1941                 }\r
1942                 \r
1943                 // check if: - there remains at least one blog admin\r
1944                 //           - (there remains at least one team member)\r
1945                 $tmem =& $manager->getMember($memberid);\r
1946                 \r
1947                 \r
1948                 $data = array(\r
1949                         'member' => &$tmem,\r
1950                         'blogid' => $blogid\r
1951                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1952                 \r
1953                 if ( $tmem->isBlogAdmin($blogid) )\r
1954                 {\r
1955                         /* TODO: why we did double check? */\r
1956                         // check if there are more blog members left and at least one admin\r
1957                         // (check for at least two admins before deletion)\r
1958                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1959                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1960                         $r     = DB::getResult($query);\r
1961                         if ( $r->rowCount() < 2 )\r
1962                         {\r
1963                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1964                         }\r
1965                 }\r
1966                 \r
1967                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1968                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1969                 DB::execute($query);\r
1970                 \r
1971                 $data = array(\r
1972                         'member' => &$tmem,\r
1973                         'blogid' => $blogid\r
1974                 );\r
1975                 $manager->notify('PostDeleteTeamMember', $data);\r
1976                 \r
1977                 return '';\r
1978         }\r
1979         \r
1980         /**\r
1981          * Admin::action_teamchangeadmin()\r
1982          * \r
1983          * @param       void\r
1984          * @return      void\r
1985          */\r
1986         static private function action_teamchangeadmin()\r
1987         {\r
1988                 global $manager, $member;\r
1989                 \r
1990                 $blogid         = intRequestVar('blogid');\r
1991                 $memberid       = intRequestVar('memberid');\r
1992                 \r
1993                 // check if allowed\r
1994                 $member->blogAdminRights($blogid) or self::disallow();\r
1995                 \r
1996                 $mem =& $manager->getMember($memberid);\r
1997                 \r
1998                 // don't allow when there is only one admin at this moment\r
1999                 if ( $mem->isBlogAdmin($blogid) )\r
2000                 {\r
2001                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2002                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2003                         $r = DB::getResult($query);\r
2004                         if ( $r->rowCount() == 1 )\r
2005                         {\r
2006                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2007                         }\r
2008                 }\r
2009                 \r
2010                 if ( $mem->isBlogAdmin($blogid) )\r
2011                 {\r
2012                         $newval = 0;\r
2013                 }\r
2014                 else\r
2015                 {\r
2016                         $newval = 1;\r
2017                 }\r
2018                 \r
2019                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2020                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2021                 DB::execute($query);\r
2022                 \r
2023                 // only show manageteam if member did not change its own admin privileges\r
2024                 if ( $member->isBlogAdmin($blogid) )\r
2025                 {\r
2026                         self::action_manageteam();\r
2027                 }\r
2028                 else\r
2029                 {\r
2030                         self::action_overview(_MSG_ADMINCHANGED);\r
2031                 }\r
2032                 return;\r
2033         }\r
2034         \r
2035         /**\r
2036          * Admin::action_blogsettings()\r
2037          * \r
2038          * @param       void\r
2039          * @return      void\r
2040          */\r
2041         static private function action_blogsettings()\r
2042         {\r
2043                 global $member, $manager;\r
2044                 \r
2045                 $blogid = intRequestVar('blogid');\r
2046                 \r
2047                 // check if allowed\r
2048                 $member->blogAdminRights($blogid) or self::disallow();\r
2049                 \r
2050                 $blog =& $manager->getBlog($blogid);\r
2051                 \r
2052                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2053                 \r
2054                 self::$skin->parse('blogsettings');\r
2055                 return;\r
2056         }\r
2057         \r
2058         /**\r
2059          * Admin::action_categorynew()\r
2060          * \r
2061          * @param       void\r
2062          * @return      void\r
2063          */\r
2064         static private function action_categorynew()\r
2065         {\r
2066                 global $member, $manager;\r
2067                 \r
2068                 $blogid = intRequestVar('blogid');\r
2069                 \r
2070                 $member->blogAdminRights($blogid) or self::disallow();\r
2071                 \r
2072                 $cname = postVar('cname');\r
2073                 $cdesc = postVar('cdesc');\r
2074                 \r
2075                 if ( !isValidCategoryName($cname) )\r
2076                 {\r
2077                         self::error(_ERROR_BADCATEGORYNAME);\r
2078                 }\r
2079                 \r
2080                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2081                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2082                 $res = DB::getResult($query);\r
2083                 if ( $res->rowCount() > 0 )\r
2084                 {\r
2085                         self::error(_ERROR_DUPCATEGORYNAME);\r
2086                 }\r
2087                 \r
2088                 $blog           =& $manager->getBlog($blogid);\r
2089                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2090                 \r
2091                 self::action_blogsettings();\r
2092                 return;\r
2093         }\r
2094         \r
2095         /**\r
2096          * Admin::action_categoryedit()\r
2097          * \r
2098          * @param       void\r
2099          * @return      void\r
2100          */\r
2101         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2102         {\r
2103                 global $member, $manager;\r
2104                 \r
2105                 if ( $blogid == '' )\r
2106                 {\r
2107                         $blogid = intGetVar('blogid');\r
2108                 }\r
2109                 else\r
2110                 {\r
2111                         $blogid = intval($blogid);\r
2112                 }\r
2113                 if ( $catid == '' )\r
2114                 {\r
2115                         $catid = intGetVar('catid');\r
2116                 }\r
2117                 else\r
2118                 {\r
2119                         $catid = intval($catid);\r
2120                 }\r
2121                 \r
2122                 /* TODO: we should consider to use the other way insterad of this */\r
2123                 $_REQUEST['blogid']             = $blogid;\r
2124                 $_REQUEST['catid']              = $catid;\r
2125                 $_REQUEST['desturl']    = $desturl;\r
2126                 $member->blogAdminRights($blogid) or self::disallow();\r
2127                 \r
2128                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2129                 \r
2130                 self::$skin->parse('categoryedit');\r
2131                 return;\r
2132         }\r
2133         \r
2134         /**\r
2135          * Admin::action_categoryupdate()\r
2136          * \r
2137          * @param       void\r
2138          * @return      void\r
2139          */\r
2140         static private function action_categoryupdate()\r
2141         {\r
2142                 global $member, $manager;\r
2143                 \r
2144                 $blogid         = intPostVar('blogid');\r
2145                 $catid          = intPostVar('catid');\r
2146                 $cname          = postVar('cname');\r
2147                 $cdesc          = postVar('cdesc');\r
2148                 $desturl        = postVar('desturl');\r
2149                 \r
2150                 $member->blogAdminRights($blogid) or self::disallow();\r
2151                 \r
2152                 if ( !isValidCategoryName($cname) )\r
2153                 {\r
2154                         self::error(_ERROR_BADCATEGORYNAME);\r
2155                 }\r
2156                 \r
2157                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2158                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2159                 $res    = DB::getResult($query);\r
2160                 if ( $res->rowCount() > 0 )\r
2161                 {\r
2162                         self::error(_ERROR_DUPCATEGORYNAME);\r
2163                 }\r
2164                 \r
2165                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2166                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2167                 DB::execute($query);\r
2168                 \r
2169                 // store plugin options\r
2170                 $aOptions = requestArray('plugoption');\r
2171                 NucleusPlugin::apply_plugin_options($aOptions);\r
2172                 $data = array(\r
2173                         'context'       => 'category',\r
2174                         'catid'         => $catid\r
2175                 );\r
2176                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2177                 \r
2178                 if ( $desturl )\r
2179                 {\r
2180                         redirect($desturl);\r
2181                         exit;\r
2182                 }\r
2183                 else\r
2184                 {\r
2185                         self::action_blogsettings();\r
2186                 }\r
2187                 return;\r
2188         }\r
2189         \r
2190         /**\r
2191          * Admin::action_categorydelete()\r
2192          * \r
2193          * @param       void\r
2194          * @return      void\r
2195          */\r
2196         static private function action_categorydelete()\r
2197         {\r
2198                 global $member, $manager;\r
2199                 \r
2200                 $blogid = intRequestVar('blogid');\r
2201                 $catid  = intRequestVar('catid');\r
2202                 \r
2203                 $member->blogAdminRights($blogid) or self::disallow();\r
2204                 \r
2205                 $blog =& $manager->getBlog($blogid);\r
2206                 \r
2207                 // check if the category is valid\r
2208                 if ( !$blog->isValidCategory($catid) )\r
2209                 {\r
2210                         self::error(_ERROR_NOSUCHCATEGORY);\r
2211                 }\r
2212                 \r
2213                 // don't allow deletion of default category\r
2214                 if ( $blog->getDefaultCategory() == $catid )\r
2215                 {\r
2216                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2217                 }\r
2218                 \r
2219                 // check if catid is the only category left for blogid\r
2220                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2221                 $query = sprintf($query, sql_table('category'), $blogid);\r
2222                 $res = DB::getResult($query);\r
2223                 if ( $res->rowCount() == 1 )\r
2224                 {\r
2225                         self::error(_ERROR_DELETELASTCATEGORY);\r
2226                 }\r
2227                 \r
2228                 self::$skin->parse('categorydelete');\r
2229                 return;\r
2230         }\r
2231         \r
2232         /**\r
2233          * Admin::action_categorydeleteconfirm()\r
2234          * \r
2235          * @param       void\r
2236          * @return      void\r
2237          */\r
2238         static private function action_categorydeleteconfirm()\r
2239         {\r
2240                 global $member, $manager;\r
2241                 \r
2242                 $blogid = intRequestVar('blogid');\r
2243                 $catid  = intRequestVar('catid');\r
2244                 \r
2245                 $member->blogAdminRights($blogid) or self::disallow();\r
2246                 \r
2247                 $error = self::deleteOneCategory($catid);\r
2248                 if ( $error )\r
2249                 {\r
2250                         self::error($error);\r
2251                 }\r
2252                 \r
2253                 self::action_blogsettings();\r
2254                 return;\r
2255         }\r
2256         \r
2257         /**\r
2258          * Admin::deleteOneCategory()\r
2259          * Delete a category by its id\r
2260          * \r
2261          * @param       String  $catid  category id for deleting\r
2262          * @return      Void\r
2263          */\r
2264         static public function deleteOneCategory($catid)\r
2265         {\r
2266                 global $manager, $member;\r
2267                 \r
2268                 $catid  = intval($catid);\r
2269                 $blogid = getBlogIDFromCatID($catid);\r
2270                 \r
2271                 if ( !$member->blogAdminRights($blogid) )\r
2272                 {\r
2273                         return ERROR_DISALLOWED;\r
2274                 }\r
2275                 \r
2276                 // get blog\r
2277                 $blog =& $manager->getBlog($blogid);\r
2278                 \r
2279                 // check if the category is valid\r
2280                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2281                 {\r
2282                         return _ERROR_NOSUCHCATEGORY;\r
2283                 }\r
2284                 \r
2285                 $destcatid = $blog->getDefaultCategory();\r
2286                 \r
2287                 // don't allow deletion of default category\r
2288                 if ( $blog->getDefaultCategory() == $catid )\r
2289                 {\r
2290                         return _ERROR_DELETEDEFCATEGORY;\r
2291                 }\r
2292                 \r
2293                 // check if catid is the only category left for blogid\r
2294                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2295                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2296                 \r
2297                 $res = DB::getResult($query);\r
2298                 if ( $res->rowCount() == 1 )\r
2299                 {\r
2300                         return _ERROR_DELETELASTCATEGORY;\r
2301                 }\r
2302                 \r
2303                 $data = array('catid' => $catid);\r
2304                 $manager->notify('PreDeleteCategory', $data);\r
2305                 \r
2306                 // change category for all items to the default category\r
2307                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2308                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2309                 DB::execute($query);\r
2310                 \r
2311                 // delete all associated plugin options\r
2312                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2313                 \r
2314                 // delete category\r
2315                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2316                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2317                 DB::execute($query);\r
2318                 \r
2319                 $data = array('catid' => $catid);\r
2320                 $manager->notify('PostDeleteCategory', $data);\r
2321                 return;\r
2322         }\r
2323         \r
2324         /**\r
2325          * Admin::moveOneCategory()\r
2326          * Delete a category by its id\r
2327          * \r
2328          * @param       int     $catid          category id for move\r
2329          * @param       int     $destblogid     blog id for destination\r
2330          * @return      void\r
2331          */\r
2332         static public function moveOneCategory($catid, $destblogid)\r
2333         {\r
2334                 global $manager, $member;\r
2335                 $catid      = intval($catid);\r
2336                 $destblogid = intval($destblogid);\r
2337                 $blogid     = getBlogIDFromCatID($catid);\r
2338                 // mover should have admin rights on both blogs\r
2339                 if (!$member->blogAdminRights($blogid)) {\r
2340                         return _ERROR_DISALLOWED;\r
2341                 }\r
2342                 if (!$member->blogAdminRights($destblogid)) {\r
2343                         return _ERROR_DISALLOWED;\r
2344                 }\r
2345                 // cannot move to self\r
2346                 if ($blogid == $destblogid) {\r
2347                         return _ERROR_MOVETOSELF;\r
2348                 }\r
2349                 // get blogs\r
2350                 $blog     =& $manager->getBlog($blogid);\r
2351                 $destblog =& $manager->getBlog($destblogid);\r
2352                 // check if the category is valid\r
2353                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2354                         return _ERROR_NOSUCHCATEGORY;\r
2355                 }\r
2356                 // don't allow default category to be moved\r
2357                 if ($blog->getDefaultCategory() == $catid) {\r
2358                         return _ERROR_MOVEDEFCATEGORY;\r
2359                 }\r
2360                 $manager->notify(\r
2361                                 'PreMoveCategory',\r
2362                                 array(\r
2363                                                 'catid'      => &$catid,\r
2364                                                 'sourceblog' => &$blog,\r
2365                                                 'destblog'   => &$destblog\r
2366                                 )\r
2367                 );\r
2368                 // update comments table (cblog)\r
2369                 $query = 'SELECT '\r
2370                 . '    inumber '\r
2371                 . 'FROM '\r
2372                 .      sql_table('item') . ' '\r
2373                 . 'WHERE '\r
2374                 . '    icat = %d';\r
2375                 $items = sql_query(sprintf($query, $catid));\r
2376                 while ($oItem = sql_fetch_object($items)) {\r
2377                         $query = 'UPDATE '\r
2378                         .      sql_table('comment') . ' '\r
2379                         . 'SET '\r
2380                         . '    cblog = %d' . ' '\r
2381                         . 'WHERE '\r
2382                         . '    citem = %d';\r
2383                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2384                 }\r
2385         \r
2386                 // update items (iblog)\r
2387                 $query = 'UPDATE '\r
2388                 .      sql_table('item') . ' '\r
2389                 . 'SET '\r
2390                 . '    iblog = %d '\r
2391                 . 'WHERE '\r
2392                 . '    icat = %d';\r
2393                 sql_query(sprintf($query, $destblogid, $catid));\r
2394         \r
2395                 // move category\r
2396                 $query = 'UPDATE '\r
2397                 .      sql_table('category') . ' '\r
2398                 . 'SET '\r
2399                 . '    cblog = %d' . ' '\r
2400                 . 'WHERE '\r
2401                 . '    catid = %d';\r
2402                 sql_query(sprintf($query, $destblogid, $catid));\r
2403                 $manager->notify(\r
2404                                 'PostMoveCategory',\r
2405                                 array(\r
2406                                                 'catid'      => &$catid,\r
2407                                                 'sourceblog' => &$blog,\r
2408                                                 'destblog'   => $destblog\r
2409                                 )\r
2410                 );\r
2411                 return;\r
2412         }\r
2413 \r
2414         /**\r
2415          * Admin::action_blogsettingsupdate\r
2416          * Updating blog settings\r
2417          * \r
2418          * @param       Void\r
2419          * @return      Void\r
2420          */\r
2421         static private function action_blogsettingsupdate()\r
2422         {\r
2423                 global $member, $manager;\r
2424                 \r
2425                 $blogid = intRequestVar('blogid');\r
2426                 \r
2427                 $member->blogAdminRights($blogid) or self::disallow();\r
2428                 \r
2429                 $blog =& $manager->getBlog($blogid);\r
2430                 \r
2431                 $notify_address = trim(postVar('notify'));\r
2432                 $shortname              = trim(postVar('shortname'));\r
2433                 $updatefile             = trim(postVar('update'));\r
2434                 \r
2435                 $notifyComment  = intPostVar('notifyComment');\r
2436                 $notifyVote             = intPostVar('notifyVote');\r
2437                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2438                 \r
2439                 if ( $notifyComment == 0 )\r
2440                 {\r
2441                         $notifyComment = 1;\r
2442                 }\r
2443                 if ( $notifyVote == 0 )\r
2444                 {\r
2445                         $notifyVote = 1;\r
2446                 }\r
2447                 if ( $notifyNewItem == 0 )\r
2448                 {\r
2449                         $notifyNewItem = 1;\r
2450                 }\r
2451                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2452                 \r
2453                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2454                 {\r
2455                         self::error(_ERROR_BADNOTIFY);\r
2456                 }\r
2457                 \r
2458                 if ( !isValidShortName($shortname) )\r
2459                 {\r
2460                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2461                 }\r
2462                 \r
2463                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2464                 {\r
2465                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2466                 }\r
2467                 // check if update file is writable\r
2468                 if ( $updatefile && !is_writeable($updatefile) )\r
2469                 {\r
2470                         self::error(_ERROR_UPDATEFILE);\r
2471                 }\r
2472                 \r
2473                 $blog->setName(trim(postVar('name')));\r
2474                 $blog->setShortName($shortname);\r
2475                 $blog->setNotifyAddress($notify_address);\r
2476                 $blog->setNotifyType($notifyType);\r
2477                 $blog->setMaxComments(postVar('maxcomments'));\r
2478                 $blog->setCommentsEnabled(postVar('comments'));\r
2479                 $blog->setTimeOffset(postVar('timeoffset'));\r
2480                 $blog->setUpdateFile($updatefile);\r
2481                 $blog->setURL(trim(postVar('url')));\r
2482                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2483                 $blog->setDescription(trim(postVar('desc')));\r
2484                 $blog->setPublic(postVar('public'));\r
2485                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2486                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2487                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2488                 $blog->setSearchable(intPostVar('searchable'));\r
2489                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2490                 $blog->writeSettings();\r
2491                 \r
2492                 // store plugin options\r
2493                 $aOptions = requestArray('plugoption');\r
2494                 NucleusPlugin::apply_plugin_options($aOptions);\r
2495                 \r
2496                 $data = array(\r
2497                         'context' => 'blog',\r
2498                         'blogid'  => $blogid,\r
2499                         'blog'    => &$blog\r
2500                 );\r
2501                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2502                 \r
2503                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2504                 return;\r
2505         }\r
2506         \r
2507         /**\r
2508          * Admin::action_deleteblog()\r
2509          * \r
2510          * @param       void\r
2511          * @return      void\r
2512          */\r
2513         static private function action_deleteblog()\r
2514         {\r
2515                 global $member, $CONF, $manager;\r
2516                 \r
2517                 $blogid = intRequestVar('blogid');\r
2518                 \r
2519                 $member->blogAdminRights($blogid) or self::disallow();\r
2520                 \r
2521                 // check if blog is default blog\r
2522                 if ( $CONF['DefaultBlog'] == $blogid )\r
2523                 {\r
2524                         self::error(_ERROR_DELDEFBLOG);\r
2525                 }\r
2526                 \r
2527                 $blog =& $manager->getBlog($blogid);\r
2528                 \r
2529                 self::$skin->parse('deleteblog');\r
2530                 return;\r
2531         }\r
2532         \r
2533         /**\r
2534          * Admin::action_deleteblogconfirm()\r
2535          * Delete Blog\r
2536          * \r
2537          * @param       Void\r
2538          * @return      Void\r
2539          */\r
2540         static private function action_deleteblogconfirm()\r
2541         {\r
2542                 global $member, $CONF, $manager;\r
2543                 \r
2544                 $blogid = intRequestVar('blogid');\r
2545                 \r
2546                 $data = array('blogid' => $blogid);\r
2547                 $manager->notify('PreDeleteBlog', $data);\r
2548                 \r
2549                 $member->blogAdminRights($blogid) or self::disallow();\r
2550                 \r
2551                 // check if blog is default blog\r
2552                 if ( $CONF['DefaultBlog'] == $blogid )\r
2553                 {\r
2554                         self::error(_ERROR_DELDEFBLOG);\r
2555                 }\r
2556                 \r
2557                 // delete all comments\r
2558                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2559                 DB::execute($query);\r
2560                 \r
2561                 // delete all items\r
2562                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2563                 DB::execute($query);\r
2564                 \r
2565                 // delete all team members\r
2566                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2567                 DB::execute($query);\r
2568                 \r
2569                 // delete all bans\r
2570                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2571                 DB::execute($query);\r
2572                 \r
2573                 // delete all categories\r
2574                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2575                 DB::execute($query);\r
2576                 \r
2577                 // delete all associated plugin options\r
2578                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2579                 \r
2580                 // delete the blog itself\r
2581                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2582                 DB::execute($query);\r
2583                 \r
2584                 $data = array('blogid' => $blogid);\r
2585                 $manager->notify('PostDeleteBlog', $data);\r
2586                 \r
2587                 self::action_overview(_DELETED_BLOG);\r
2588                 return;\r
2589         }\r
2590         \r
2591         /**\r
2592          * Admin::action_memberdelete()\r
2593          * \r
2594          * @param       void\r
2595          * @return      void\r
2596          */\r
2597         static private function action_memberdelete()\r
2598         {\r
2599                 global $member, $manager;\r
2600                 \r
2601                 $memberid = intRequestVar('memberid');\r
2602                 \r
2603                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2604                 \r
2605                 $mem =& $manager->getMember($memberid);\r
2606                 \r
2607                 self::$skin->parse('memberdelete');\r
2608                 return;\r
2609         }\r
2610         \r
2611         /**\r
2612          * Admin::action_memberdeleteconfirm()\r
2613          * \r
2614          * @param       void\r
2615          * @return      void\r
2616          */\r
2617         static private function action_memberdeleteconfirm()\r
2618         {\r
2619                 global $member;\r
2620                 \r
2621                 $memberid = intRequestVar('memberid');\r
2622                 \r
2623                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2624                 \r
2625                 $error = self::deleteOneMember($memberid);\r
2626                 if ( $error )\r
2627                 {\r
2628                         self::error($error);\r
2629                 }\r
2630                 \r
2631                 if ( $member->isAdmin() )\r
2632                 {\r
2633                         self::action_usermanagement();\r
2634                 }\r
2635                 else\r
2636                 {\r
2637                         self::action_overview(_DELETED_MEMBER);\r
2638                 }\r
2639                 return;\r
2640         }\r
2641         \r
2642         /**\r
2643          * Admin::deleteOneMember()\r
2644          * Delete a member by id\r
2645          * \r
2646          * @static\r
2647          * @params      Integer $memberid       member id\r
2648          * @return      String  null string or error messages\r
2649          */\r
2650         static public function deleteOneMember($memberid)\r
2651         {\r
2652                 global $manager;\r
2653                 \r
2654                 $memberid = intval($memberid);\r
2655                 $mem =& $manager->getMember($memberid);\r
2656                 \r
2657                 if ( !$mem->canBeDeleted() )\r
2658                 {\r
2659                         return _ERROR_DELETEMEMBER;\r
2660                 }\r
2661                 \r
2662                 $data = array('member' => &$mem);\r
2663                 $manager->notify('PreDeleteMember', $data);\r
2664                 \r
2665                 /* unlink comments from memberid */\r
2666                 if ( $memberid )\r
2667                 {\r
2668                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2669                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2670                         DB::execute($query);\r
2671                 }\r
2672                 \r
2673                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2674                 DB::execute($query);\r
2675                 \r
2676                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2677                 DB::execute($query);\r
2678                 \r
2679                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2680                 DB::execute($query);\r
2681                 \r
2682                 // delete all associated plugin options\r
2683                 NucleusPlugin::delete_option_values('member', $memberid);\r
2684                 \r
2685                 $data = array('member' => &$mem);\r
2686                 $manager->notify('PostDeleteMember', $data);\r
2687                 \r
2688                 return '';\r
2689         }\r
2690         \r
2691         /**\r
2692          * Admin::action_createnewlog()\r
2693          * \r
2694          * @param       void\r
2695          * @return      void\r
2696          */\r
2697         static private function action_createnewlog()\r
2698         {\r
2699                 global $member, $CONF, $manager;\r
2700                 \r
2701                 // Only Super-Admins can do this\r
2702                 $member->isAdmin() or self::disallow();\r
2703                 \r
2704                 self::$skin->parse('createnewlog');\r
2705                 return;\r
2706         }\r
2707         \r
2708         /**\r
2709          * Admin::action_addnewlog()\r
2710          * \r
2711          * @param       void\r
2712          * @return      void\r
2713          */\r
2714         static private function action_addnewlog()\r
2715         {\r
2716                 global $member, $manager, $CONF;\r
2717                 \r
2718                 // Only Super-Admins can do this\r
2719                 $member->isAdmin() or self::disallow();\r
2720                 \r
2721                 $bname                  = trim(postVar('name'));\r
2722                 $bshortname             = trim(postVar('shortname'));\r
2723                 $btimeoffset    = postVar('timeoffset');\r
2724                 $bdesc                  = trim(postVar('desc'));\r
2725                 $bdefskin               = postVar('defskin');\r
2726                 \r
2727                 if ( !isValidShortName($bshortname) )\r
2728                 {\r
2729                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2730                 }\r
2731                 \r
2732                 if ( $manager->existsBlog($bshortname) )\r
2733                 {\r
2734                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2735                 }\r
2736                 \r
2737                 $data = array(\r
2738                         'name'        => &$bname,\r
2739                         'shortname'   => &$bshortname,\r
2740                         'timeoffset'  => &$btimeoffset,\r
2741                         'description' => &$bdesc,\r
2742                         'defaultskin' => &$bdefskin\r
2743                 );\r
2744                 $manager->notify('PreAddBlog', $data);\r
2745                 \r
2746                 // add slashes for sql queries\r
2747                 $bname                  = DB::quoteValue($bname);\r
2748                 $bshortname             = DB::quoteValue($bshortname);\r
2749                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2750                 $bdesc                  = DB::quoteValue($bdesc);\r
2751                 $bdefskin               = DB::quoteValue($bdefskin);\r
2752                 \r
2753                 // create blog\r
2754                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2755                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2756                 DB::execute($query);\r
2757                 \r
2758                 $blogid = DB::getInsertId();\r
2759                 $blog   =& $manager->getBlog($blogid);\r
2760                 \r
2761                 // create new category\r
2762                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2763                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2764                 \r
2765                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2766                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2767                 $catid = DB::getInsertId();\r
2768                 \r
2769                 // set as default category\r
2770                 $blog->setDefaultCategory($catid);\r
2771                 $blog->writeSettings();\r
2772                 \r
2773                 // create team member\r
2774                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2775                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2776                 DB::execute($query);\r
2777                 \r
2778                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2779                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2780                 \r
2781                 $blog->additem(\r
2782                         $blog->getDefaultCategory(),\r
2783                         $itemdeftitle,$itemdefbody,\r
2784                         '',\r
2785                         $blogid,\r
2786                         $member->getID(),\r
2787                         $blog->getCorrectTime(),\r
2788                         0,\r
2789                         0,\r
2790                         0\r
2791                 );\r
2792                 \r
2793                 $data = array('blog' => &$blog);\r
2794                 $manager->notify('PostAddBlog', $data);\r
2795                 \r
2796                 $data = array(\r
2797                         'blog'                  => &$blog,\r
2798                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2799                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2800                         'catid'                 => $catid\r
2801                 );\r
2802                 $manager->notify('PostAddCategory', $data);\r
2803                 \r
2804                 /* TODO: we should consider to use the other way insterad of this */\r
2805                 $_REQUEST['blogid'] = $blogid;\r
2806                 $_REQUEST['catid']  = $catid;\r
2807                 self::$skin->parse('addnewlog');\r
2808                 return;\r
2809         }\r
2810         \r
2811         /**\r
2812          * Admin::action_addnewlog2()\r
2813          * \r
2814          * @param       void\r
2815          * @return      void\r
2816          */\r
2817         static private function action_addnewlog2()\r
2818         {\r
2819                 global $member, $manager;\r
2820                 $blogid = intRequestVar('blogid');\r
2821                 \r
2822                 $member->blogAdminRights($blogid) or self::disallow();\r
2823                 \r
2824                 $burl = requestVar('url');\r
2825                 \r
2826                 $blog =& $manager->getBlog($blogid);\r
2827                 $blog->setURL(trim($burl));\r
2828                 $blog->writeSettings();\r
2829                 \r
2830                 self::action_overview(_MSG_NEWBLOG);\r
2831                 return;\r
2832         }\r
2833         \r
2834         /**\r
2835          * Admin::action_skinieoverview()\r
2836          * \r
2837          * @param       void\r
2838          * @return      void\r
2839          */\r
2840         static private function action_skinieoverview()\r
2841         {\r
2842                 global $member, $DIR_LIBS, $manager;\r
2843                 \r
2844                 $member->isAdmin() or self::disallow();\r
2845                 \r
2846                 include_once($DIR_LIBS . 'skinie.php');\r
2847                 \r
2848                 self::$skin->parse('skinieoverview');\r
2849                 return;\r
2850         }\r
2851         \r
2852         /**\r
2853          * Admin::action_skinieimport()\r
2854          * \r
2855          * @param       void\r
2856          * @return      void\r
2857          */\r
2858         static private function action_skinieimport()\r
2859         {\r
2860                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2861                 \r
2862                 $member->isAdmin() or self::disallow();\r
2863                 \r
2864                 // load skinie class\r
2865                 include_once($DIR_LIBS . 'skinie.php');\r
2866                 \r
2867                 $skinFileRaw    = postVar('skinfile');\r
2868                 $mode                   = postVar('mode');\r
2869                 \r
2870                 $importer = new SkinImport();\r
2871                 \r
2872                 // get full filename\r
2873                 if ( $mode == 'file' )\r
2874                 {\r
2875                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2876                         \r
2877                         /* TODO: remove this\r
2878                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2879                         if ( !file_exists($skinFile) )\r
2880                         {\r
2881                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2882                         }\r
2883                          */\r
2884                 }\r
2885                 else\r
2886                 {\r
2887                         $skinFile = $skinFileRaw;\r
2888                 }\r
2889                 \r
2890                 // read only metadata\r
2891                 $error = $importer->readFile($skinFile, 1);\r
2892                 \r
2893                 /* TODO: we should consider to use the other way insterad of this */\r
2894                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2895                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2896                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2897                 \r
2898                 // clashes\r
2899                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2900                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2901                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2902                 \r
2903                 /* TODO: we should consider to use the other way insterad of this */\r
2904                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2905                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2906                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2907                 \r
2908                 if ( $error )\r
2909                 {\r
2910                         self::error($error);\r
2911                 }\r
2912                 \r
2913                 self::$skin->parse('skinieimport');\r
2914                 return;\r
2915         }\r
2916         \r
2917         /**\r
2918          * Admin::action_skiniedoimport()\r
2919          * \r
2920          * @param       void\r
2921          * @return      void\r
2922          */\r
2923         static private function action_skiniedoimport()\r
2924         {\r
2925                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2926                 \r
2927                 $member->isAdmin() or self::disallow();\r
2928                 \r
2929                 // load skinie class\r
2930                 include_once($DIR_LIBS . 'skinie.php');\r
2931                 \r
2932                 $skinFileRaw    = postVar('skinfile');\r
2933                 $mode                   = postVar('mode');\r
2934                 \r
2935                 $allowOverwrite = intPostVar('overwrite');\r
2936                 \r
2937                 // get full filename\r
2938                 if ( $mode == 'file' )\r
2939                 {\r
2940                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2941                         \r
2942                         /* TODO: remove this\r
2943                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2944                         if ( !file_exists($skinFile) )\r
2945                         {\r
2946                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2947                         }\r
2948                         */\r
2949                 }\r
2950                 else\r
2951                 {\r
2952                         $skinFile = $skinFileRaw;\r
2953                 }\r
2954                 \r
2955                 $importer = new SkinImport();\r
2956                 \r
2957                 $error = $importer->readFile($skinFile);\r
2958                 \r
2959                 if ( $error )\r
2960                 {\r
2961                         self::error($error);\r
2962                 }\r
2963                 \r
2964                 $error = $importer->writeToDatabase($allowOverwrite);\r
2965                 \r
2966                 if ( $error )\r
2967                 {\r
2968                         self::error($error);\r
2969                 }\r
2970                 \r
2971                 /* TODO: we should consider to use the other way insterad of this */\r
2972                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2973                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2974                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2975                 \r
2976                 self::$skin->parse('skiniedoimport');\r
2977                 return;\r
2978         }\r
2979 \r
2980         /**\r
2981          * Admin::action_skinieexport()\r
2982          * \r
2983          * @param       void\r
2984          * @return      void\r
2985          */\r
2986         static private function action_skinieexport()\r
2987         {\r
2988                 global $member, $DIR_LIBS;\r
2989                 \r
2990                 $member->isAdmin() or self::disallow();\r
2991                 \r
2992                 // load skinie class\r
2993                 include_once($DIR_LIBS . 'skinie.php');\r
2994                 \r
2995                 $aSkins         = requestIntArray('skin');\r
2996                 $aTemplates     = requestIntArray('template');\r
2997                 \r
2998                 if ( !is_array($aTemplates) )\r
2999                 {\r
3000                         $aTemplates = array();\r
3001                 }\r
3002                 if ( !is_array($aSkins) )\r
3003                 {\r
3004                         $aSkins = array();\r
3005                 }\r
3006                 \r
3007                 $skinList               = array_keys($aSkins);\r
3008                 $templateList   = array_keys($aTemplates);\r
3009                 \r
3010                 $info = postVar('info');\r
3011                 \r
3012                 $exporter = new SkinExport();\r
3013                 foreach ( $skinList as $skinId )\r
3014                 {\r
3015                         $exporter->addSkin($skinId);\r
3016                 }\r
3017                 foreach ($templateList as $templateId)\r
3018                 {\r
3019                         $exporter->addTemplate($templateId);\r
3020                 }\r
3021                 $exporter->setInfo($info);\r
3022                 \r
3023                 $exporter->export();\r
3024                 return;\r
3025         }\r
3026         \r
3027         /**\r
3028          * Admin::action_templateoverview()\r
3029          * \r
3030          * @param       void\r
3031          * @return      void\r
3032          */\r
3033         static private function action_templateoverview()\r
3034         {\r
3035                 global $member, $manager;\r
3036                 \r
3037                 $member->isAdmin() or self::disallow();\r
3038                 \r
3039                 self::$skin->parse('templateoverview');\r
3040                 return;\r
3041         }\r
3042         \r
3043         /**\r
3044          * Admin::action_templateedit()\r
3045          * \r
3046          * @param       string  $msg    message for pageheader\r
3047          * @return      void\r
3048          */\r
3049         static private function action_templateedit($msg = '')\r
3050         {\r
3051                 global $member, $manager;\r
3052                 if ( $msg )\r
3053                 {\r
3054                         self::$headMess = $msg;\r
3055                 }\r
3056                 \r
3057                 $templateid = intRequestVar('templateid');\r
3058                 \r
3059                 $member->isAdmin() or self::disallow();\r
3060                 \r
3061                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3062                 Admin::$extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3063                 \r
3064                 self::$skin->parse('templateedit');\r
3065                 return;\r
3066         }\r
3067         \r
3068         /**\r
3069          * TODO: remove this\r
3070          *\r
3071         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3072                 static $count = 1;\r
3073                 if (!isset($template[$name])) $template[$name] = '';\r
3074         ?>\r
3075                 </tr><tr>\r
3076                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3077                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3078         <?php       $count++;\r
3079         }\r
3080         */\r
3081         \r
3082         /**\r
3083          * Admin::action_templateupdate()\r
3084          * \r
3085          * @param       void\r
3086          * @return      void\r
3087          */\r
3088         static private function action_templateupdate()\r
3089         {\r
3090                 global $member,$manager;\r
3091                 \r
3092                 $templateid = intRequestVar('templateid');\r
3093                 \r
3094                 $member->isAdmin() or self::disallow();\r
3095                 \r
3096                 $name = postVar('tname');\r
3097                 $desc = postVar('tdesc');\r
3098                 \r
3099                 if ( !isValidTemplateName($name) )\r
3100                 {\r
3101                         self::error(_ERROR_BADTEMPLATENAME);\r
3102                 }\r
3103                 \r
3104                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3105                 {\r
3106                         self::error(_ERROR_DUPTEMPLATENAME);\r
3107                 }\r
3108                 \r
3109                 // 1. Remove all template parts\r
3110                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3111                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3112                 DB::execute($query);\r
3113                 \r
3114                 // 2. Update description\r
3115                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3116                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3117                 DB::execute($query);\r
3118                 \r
3119                 // 3. Add non-empty template parts\r
3120                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3121                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3122                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3123                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3124                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3125                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3126                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3127                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3128                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3129                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3130                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3131                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3132                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3133                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3134                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3135                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3136                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3137                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3138                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3139                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3140                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3141                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3142                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3143                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3144                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3145                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3146                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3147                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3148                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3149                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3150                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3151                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3152                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3153                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3154                 \r
3155                 $data = array('fields' => array());\r
3156                 $manager->notify('TemplateExtraFields', $data);\r
3157                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3158                 {\r
3159                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3160                         {\r
3161                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3162                         }\r
3163                 }\r
3164                 \r
3165                 // jump back to template edit\r
3166                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3167                 return;\r
3168         }\r
3169         \r
3170         /**\r
3171          * Admin::addToTemplate()\r
3172          * \r
3173          * @param       Integer $id     ID for template\r
3174          * @param       String  $partname       parts name\r
3175          * @param       String  $content        template contents\r
3176          * @return      Integer record index\r
3177          * \r
3178          */\r
3179         static private function addToTemplate($id, $partname, $content)\r
3180         {\r
3181                 // don't add empty parts:\r
3182                 if ( !trim($content) )\r
3183                 {\r
3184                         return -1;\r
3185                 }\r
3186                 \r
3187                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3188                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3189                 if ( DB::execute($query) === FALSE )\r
3190                 {\r
3191                         $err = DB::getError();\r
3192                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3193                 }\r
3194                 return DB::getInsertId();\r
3195         }\r
3196         \r
3197         /**\r
3198          * Admin::action_templatedelete()\r
3199          * \r
3200          * @param       void\r
3201          * @return      void\r
3202          */\r
3203         static private function action_templatedelete()\r
3204         {\r
3205                 global $member, $manager;\r
3206                 \r
3207                 $member->isAdmin() or self::disallow();\r
3208                 \r
3209                 $templateid = intRequestVar('templateid');\r
3210                 // TODO: check if template can be deleted\r
3211                 \r
3212                 self::$skin->parse('templatedelete');\r
3213                 return;\r
3214         }\r
3215         \r
3216         /**\r
3217          * Admin::action_templatedeleteconfirm()\r
3218          * \r
3219          * @param       void\r
3220          * @return      void\r
3221          */\r
3222         static private function action_templatedeleteconfirm()\r
3223         {\r
3224                 global $member, $manager;\r
3225                 \r
3226                 $templateid = intRequestVar('templateid');\r
3227                 \r
3228                 $member->isAdmin() or self::disallow();\r
3229                 \r
3230                 $data = array('templateid' => $templateid);\r
3231                 $manager->notify('PreDeleteTemplate', $data);\r
3232                 \r
3233                 // 1. delete description\r
3234                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3235                 \r
3236                 // 2. delete parts\r
3237                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3238                 \r
3239                 \r
3240                 $data = array('templateid' => $templateid);\r
3241                 $manager->notify('PostDeleteTemplate', $data);\r
3242                 \r
3243                 self::action_templateoverview();\r
3244                 return;\r
3245         }\r
3246         \r
3247         /**\r
3248          * Admin::action_templatenew()\r
3249          * \r
3250          * @param       void\r
3251          * @return      void\r
3252          */\r
3253         static private function action_templatenew()\r
3254         {\r
3255                 global $member;\r
3256                 \r
3257                 $member->isAdmin() or self::disallow();\r
3258                 \r
3259                 $name = postVar('name');\r
3260                 $desc = postVar('desc');\r
3261                 \r
3262                 if ( !isValidTemplateName($name) )\r
3263                 {\r
3264                         self::error(_ERROR_BADTEMPLATENAME);\r
3265                 }\r
3266                 \r
3267                 if ( Template::exists($name) )\r
3268                 {\r
3269                         self::error(_ERROR_DUPTEMPLATENAME);\r
3270                 }\r
3271                 \r
3272                 $newTemplateId = Template::createNew($name, $desc);\r
3273                 \r
3274                 self::action_templateoverview();\r
3275                 return;\r
3276         }\r
3277         \r
3278         /**\r
3279          * Admin::action_templateclone()\r
3280          * \r
3281          * @param       void\r
3282          * @return      void\r
3283          */\r
3284         static private function action_templateclone()\r
3285         {\r
3286                 global $member;\r
3287                 \r
3288                 $templateid = intRequestVar('templateid');\r
3289                 \r
3290                 $member->isAdmin() or self::disallow();\r
3291                 \r
3292                 // 1. read old template\r
3293                 $name = Template::getNameFromId($templateid);\r
3294                 $desc = Template::getDesc($templateid);\r
3295                 \r
3296                 // 2. create desc thing\r
3297                 $name = "cloned" . $name;\r
3298                 \r
3299                 // if a template with that name already exists:\r
3300                 if ( Template::exists($name) )\r
3301                 {\r
3302                         $i = 1;\r
3303                         while (Template::exists($name . $i))\r
3304                         {\r
3305                                 $i++;\r
3306                         }\r
3307                         $name .= $i;\r
3308                 }\r
3309                 \r
3310                 $newid = Template::createNew($name, $desc);\r
3311                 \r
3312                 // 3. create clone\r
3313                 // go through parts of old template and add them to the new one\r
3314                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3315                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3316                 \r
3317                 $res = DB::getResult($query);\r
3318                 foreach ( $res as $row)\r
3319                 {\r
3320                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3321                 }\r
3322                 \r
3323                 self::action_templateoverview();\r
3324                 return;\r
3325         }\r
3326         \r
3327         /**\r
3328          * Admin::action_admintemplateoverview()\r
3329          * \r
3330          * @param       void\r
3331          * @return      void\r
3332          */\r
3333         static private function action_admintemplateoverview()\r
3334         {\r
3335                 global $member;\r
3336                 $member->isAdmin() or self::disallow();\r
3337                 self::$skin->parse('admntemplateoverview');\r
3338                 return;\r
3339         }\r
3340         \r
3341         /**\r
3342          * Admin::action_admintemplateedit()\r
3343          * \r
3344          * @param       string  $msg    message for pageheader\r
3345          * @return      void\r
3346          */\r
3347         static private function action_admintemplateedit($msg = '')\r
3348         {\r
3349                 global $member, $manager;\r
3350                 if ( $msg )\r
3351                 {\r
3352                         self::$headMess = $msg;\r
3353                 }\r
3354                 $member->isAdmin() or self::disallow();\r
3355                 \r
3356                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3357                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3358                 \r
3359                 self::$skin->parse('admintemplateedit');\r
3360                 return;\r
3361         }\r
3362         \r
3363         /**\r
3364          * Admin::action_admintemplateupdate()\r
3365          * \r
3366          * @param       void\r
3367          * @return      void\r
3368          */\r
3369         static private function action_admintemplateupdate()\r
3370         {\r
3371                 global $member, $manager;\r
3372                 $templateid = intRequestVar('templateid');\r
3373                 $member->isAdmin() or self::disallow();\r
3374                 $name = postVar('tname');\r
3375                 $desc = postVar('tdesc');\r
3376                 \r
3377                 if ( !isValidTemplateName($name) )\r
3378                 {\r
3379                         self::error(_ERROR_BADTEMPLATENAME);\r
3380                 }\r
3381                 \r
3382                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3383                 {\r
3384                         self::error(_ERROR_DUPTEMPLATENAME);\r
3385                 }\r
3386                 \r
3387                 // 1. Remove all template parts\r
3388                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3389                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3390                 DB::execute($query);\r
3391                 \r
3392                 // 2. Update description\r
3393                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3394                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3395                 DB::execute($query);\r
3396                 \r
3397                 // 3. Add non-empty template parts\r
3398                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3399                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3400                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3401                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3402                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3403                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3404                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3405                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3406                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3407                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3408                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3409                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3410                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3411                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3412                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3414                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3415                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3416                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3417                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3418                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3419                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3420                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3421                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3422                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3423                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3424                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3425                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3426                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3484                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3485                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3486                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3487                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3488                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3489                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3490                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3491                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3492                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3493                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3494                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3495                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3496                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3497                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3498                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3499                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3500                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3501                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3502                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3503                 \r
3504                 $data = array('fields' => array());\r
3505                 $manager->notify('AdminTemplateExtraFields', $data);\r
3506                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3507                 {\r
3508                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3509                         {\r
3510                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3511                         }\r
3512                 }\r
3513                 \r
3514                 // jump back to template edit\r
3515                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3516                 return;\r
3517         }\r
3518         \r
3519         /**\r
3520          * Admin::addToAdminTemplate()\r
3521          * \r
3522          * @param       integer $id                     ID for template\r
3523          * @param       string  $partname       name of part for template\r
3524          * @param       void    $contents       content for part of template\r
3525          * @return      integer ID for newly inserted Template\r
3526          */\r
3527         static private function addToAdminTemplate($id, $partname, $content)\r
3528         {\r
3529                 // don't add empty parts:\r
3530                 if ( !trim($content) )\r
3531                 {\r
3532                         return -1;\r
3533                 }\r
3534                 \r
3535                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3536                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3537                 if ( DB::execute($query) === FALSE )\r
3538                 {\r
3539                         $err = DB::getError();\r
3540                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3541                 }\r
3542                 return DB::getInsertId();\r
3543         }\r
3544         \r
3545         /**\r
3546          * Admin::action_admintemplatedelete()\r
3547          * \r
3548          * @param       void\r
3549          * @return      void\r
3550          */\r
3551         static private function action_admintemplatedelete()\r
3552         {\r
3553                 global $member, $manager;\r
3554                 $member->isAdmin() or self::disallow();\r
3555                 \r
3556                 // TODO: check if template can be deleted\r
3557                 self::$skin->parse('admintemplatedelete');\r
3558                 return;\r
3559         }\r
3560         \r
3561         /**\r
3562          * Admin::action_admintemplatedeleteconfirm()\r
3563          * \r
3564          * @param       void\r
3565          * @return      void\r
3566          */\r
3567         static private function action_admintemplatedeleteconfirm()\r
3568         {\r
3569                 global $member, $manager;\r
3570                 \r
3571                 $templateid = intRequestVar('templateid');\r
3572                 $member->isAdmin() or self::disallow();\r
3573                 \r
3574                 $data = array('templateid' => $templateid);\r
3575                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3576                 \r
3577                 // 1. delete description\r
3578                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3579                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3580                 DB::execute($query);\r
3581                 \r
3582                 // 2. delete parts\r
3583                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3584                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3585                 DB::execute($query);\r
3586                 \r
3587                 $data = array('templateid' => $templateid);\r
3588                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3589                 \r
3590                 self::action_admintemplateoverview();\r
3591                 return;\r
3592         }\r
3593         \r
3594         /**\r
3595          * Admin::action_admintemplatenew()\r
3596          * \r
3597          * @param       void\r
3598          * @return      void\r
3599          */\r
3600         static private function action_admintemplatenew()\r
3601         {\r
3602                 global $member;\r
3603                 $member->isAdmin() or self::disallow();\r
3604                 $name = postVar('name');\r
3605                 $desc = postVar('desc');\r
3606                 \r
3607                 if ( !isValidTemplateName($name) )\r
3608                 {\r
3609                         self::error(_ERROR_BADTEMPLATENAME);\r
3610                 }\r
3611                 else if ( !preg_match('#^admin/#', $name) )\r
3612                 {\r
3613                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3614                 }\r
3615                 else if ( Template::exists($name) )\r
3616                 {\r
3617                         self::error(_ERROR_DUPTEMPLATENAME);\r
3618                 }\r
3619                 \r
3620                 $newTemplateId = Template::createNew($name, $desc);\r
3621                 self::action_admintemplateoverview();\r
3622                 return;\r
3623         }\r
3624         \r
3625         /**\r
3626          * Admin::action_admintemplateclone()\r
3627          * \r
3628          * @param       void\r
3629          * @return      void\r
3630          */\r
3631         static private function action_admintemplateclone()\r
3632         {\r
3633                 global $member;\r
3634                 $templateid = intRequestVar('templateid');\r
3635                 $member->isAdmin() or self::disallow();\r
3636                 \r
3637                 // 1. read old template\r
3638                 $name = Template::getNameFromId($templateid);\r
3639                 $desc = Template::getDesc($templateid);\r
3640                 \r
3641                 // 2. create desc thing\r
3642                 $name = $name . "cloned";\r
3643                 \r
3644                 // if a template with that name already exists:\r
3645                 if ( Template::exists($name) )\r
3646                 {\r
3647                         $i = 1;\r
3648                         while ( Template::exists($name . $i) )\r
3649                         {\r
3650                                 $i++;\r
3651                         }\r
3652                         $name .= $i;\r
3653                 }\r
3654                 \r
3655                 $newid = Template::createNew($name, $desc);\r
3656                 \r
3657                 // 3. create clone\r
3658                 // go through parts of old template and add them to the new one\r
3659                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3660                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3661                 \r
3662                 $res = DB::getResult($query);\r
3663                 foreach ( $res as $row )\r
3664                 {\r
3665                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3666                 }\r
3667                 \r
3668                 self::action_admintemplateoverview();\r
3669                 return;\r
3670         }\r
3671 \r
3672         /**\r
3673          * Admin::action_skinoverview()\r
3674          * \r
3675          * @param       void\r
3676          * @return      void\r
3677          */\r
3678         static private function action_skinoverview()\r
3679         {\r
3680                 global $member, $manager;\r
3681                 \r
3682                 $member->isAdmin() or self::disallow();\r
3683                 \r
3684                 self::$skin->parse('skinoverview');\r
3685                 return;\r
3686         }\r
3687         \r
3688         /**\r
3689          * Admin::action_skinnew()\r
3690          * \r
3691          * @param       void\r
3692          * @return      void\r
3693          */\r
3694         static private function action_skinnew()\r
3695         {\r
3696                 global $member;\r
3697                 \r
3698                 $member->isAdmin() or self::disallow();\r
3699                 \r
3700                 $name = trim(postVar('name'));\r
3701                 $desc = trim(postVar('desc'));\r
3702                 \r
3703                 if ( !isValidSkinName($name) )\r
3704                 {\r
3705                         self::error(_ERROR_BADSKINNAME);\r
3706                 }\r
3707                 \r
3708                 if ( SKIN::exists($name) )\r
3709                 {\r
3710                         self::error(_ERROR_DUPSKINNAME);\r
3711                 }\r
3712                 \r
3713                 $newId = SKIN::createNew($name, $desc);\r
3714                 \r
3715                 self::action_skinoverview();\r
3716                 return;\r
3717         }\r
3718         \r
3719         /**\r
3720          * Admin::action_skinedit()\r
3721          * \r
3722          * @param       void\r
3723          * @return      void\r
3724          */\r
3725         static private function action_skinedit()\r
3726         {\r
3727                 global $member, $manager;\r
3728                 \r
3729                 $member->isAdmin() or self::disallow();\r
3730                 \r
3731                 self::$skin->parse('skinedit');\r
3732                 return;\r
3733         }\r
3734         \r
3735         /**\r
3736          * Admin::action_skineditgeneral()\r
3737          * \r
3738          * @param       void\r
3739          * @return      void\r
3740          */\r
3741         static private function action_skineditgeneral()\r
3742         {\r
3743                 global $member;\r
3744                 \r
3745                 $skinid = intRequestVar('skinid');\r
3746                 \r
3747                 $member->isAdmin() or self::disallow();\r
3748                 \r
3749                 $name           = postVar('name');\r
3750                 $desc           = postVar('desc');\r
3751                 $type           = postVar('type');\r
3752                 $inc_mode       = postVar('inc_mode');\r
3753                 $inc_prefix     = postVar('inc_prefix');\r
3754                 \r
3755                 $skin = new Skin($skinid);\r
3756                 \r
3757                 // 1. Some checks\r
3758                 if ( !isValidSkinName($name) )\r
3759                 {\r
3760                         self::error(_ERROR_BADSKINNAME);\r
3761                 }\r
3762                 \r
3763                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3764                 {\r
3765                         self::error(_ERROR_DUPSKINNAME);\r
3766                 }\r
3767                 \r
3768                 if ( !$type )\r
3769                 {\r
3770                         $type = 'text/html';\r
3771                 }\r
3772                 if ( !$inc_mode )\r
3773                 {\r
3774                         $inc_mode = 'normal';\r
3775                 }\r
3776                 \r
3777                 // 2. Update description\r
3778                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3779                 \r
3780                 self::action_skinedit();\r
3781                 return;\r
3782         }\r
3783         \r
3784         static private function action_skinedittype($msg = '')\r
3785         {\r
3786                 global $member, $manager;\r
3787                 \r
3788                 $member->isAdmin() or self::disallow();\r
3789                 \r
3790                 if ( $msg )\r
3791                 {\r
3792                         self::$headMess = $msg;\r
3793                 }\r
3794                 \r
3795                 $skinid = intRequestVar('skinid');\r
3796                 $type   = requestVar('type');\r
3797                 $type   = trim($type);\r
3798                 $type   = strtolower($type);\r
3799                 \r
3800                 if ( !isValidShortName($type) )\r
3801                 {\r
3802                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3803                 }\r
3804                 \r
3805                 self::$skin->parse('skinedittype');\r
3806                 return;\r
3807         }\r
3808         \r
3809         /**\r
3810          * Admin::action_skinupdate()\r
3811          * \r
3812          * @param       void\r
3813          * @return      void\r
3814          */\r
3815         static private function action_skinupdate()\r
3816         {\r
3817                 global $member;\r
3818                 \r
3819                 $skinid = intRequestVar('skinid');\r
3820                 $content = trim(postVar('content'));\r
3821                 $type = postVar('type');\r
3822                 \r
3823                 $member->isAdmin() or self::disallow();\r
3824                 \r
3825                 $skin = new SKIN($skinid);\r
3826                 $skin->update($type, $content);\r
3827                 \r
3828                 self::action_skinedittype(_SKIN_UPDATED);\r
3829                 return;\r
3830         }\r
3831         \r
3832         /**\r
3833          * Admin::action_skindelete()\r
3834          * \r
3835          * @param       void\r
3836          * @return      void\r
3837          */\r
3838         static private function action_skindelete()\r
3839         {\r
3840                 global $member, $manager, $CONF;\r
3841                 \r
3842                 $skinid = intRequestVar('skinid');\r
3843                 \r
3844                 $member->isAdmin() or self::disallow();\r
3845                 \r
3846                 // don't allow default skin to be deleted\r
3847                 if ( $skinid == $CONF['BaseSkin'] )\r
3848                 {\r
3849                         self::error(_ERROR_DEFAULTSKIN);\r
3850                 }\r
3851                 \r
3852                 // don't allow deletion of default skins for blogs\r
3853                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3854                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3855                 \r
3856                 $name = DB::getValue($query);\r
3857                 if ( $name )\r
3858                 {\r
3859                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3860                 }\r
3861                 \r
3862                 self::$skin->parse('skindelete');\r
3863                 return;\r
3864         }\r
3865         \r
3866         /**\r
3867          * Admin::action_skindeleteconfirm()\r
3868          * \r
3869          * @param       void\r
3870          * @return      void\r
3871          */\r
3872         static private function action_skindeleteconfirm()\r
3873         {\r
3874                 global $member, $CONF, $manager;\r
3875                 \r
3876                 $skinid = intRequestVar('skinid');\r
3877                 \r
3878                 $member->isAdmin() or self::disallow();\r
3879                 \r
3880                 // don't allow default skin to be deleted\r
3881                 if ( $skinid == $CONF['BaseSkin'] )\r
3882                 {\r
3883                         self::error(_ERROR_DEFAULTSKIN);\r
3884                 }\r
3885                 \r
3886                 // don't allow deletion of default skins for blogs\r
3887                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3888                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3889                 \r
3890                 $name = DB::getValue($query);\r
3891                 if ( $name )\r
3892                                 {\r
3893                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3894                 }\r
3895                 \r
3896                 $data = array('skinid' => $skinid);\r
3897                 $manager->notify('PreDeleteSkin', $data);\r
3898                 \r
3899                 // 1. delete description\r
3900                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3901                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3902                 DB::execute($query);\r
3903                 \r
3904                 // 2. delete parts\r
3905                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3906                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3907                 DB::execute($query);\r
3908                 \r
3909                 $data = array('skinid' => $skinid);\r
3910                 $manager->notify('PostDeleteSkin', $data);\r
3911                 \r
3912                 self::action_skinoverview();\r
3913                 return;\r
3914         }\r
3915         \r
3916         /**\r
3917          * Admin::action_skinremovetype()\r
3918          * \r
3919          * @param       void\r
3920          * @return      void\r
3921          */\r
3922         static private function action_skinremovetype()\r
3923         {\r
3924                 global $member, $manager, $CONF;\r
3925                 \r
3926                 $member->isAdmin() or self::disallow();\r
3927                 \r
3928                 $skinid = intRequestVar('skinid');\r
3929                 $skintype = requestVar('type');\r
3930                 \r
3931                 if ( !isValidShortName($skintype) )\r
3932                 {\r
3933                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3934                 }\r
3935                 \r
3936                 // don't allow default skinparts to be deleted\r
3937                 /* TODO: this array should be retrieved from Action class */\r
3938                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3939                 {\r
3940                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3941                 }\r
3942                 \r
3943                 self::$skin->parse('skinremovetype');\r
3944                 return;\r
3945         }\r
3946         \r
3947         /**\r
3948          * Admin::action_skinremovetypeconfirm()\r
3949          * \r
3950          * @param       void\r
3951          * @return      void\r
3952          */\r
3953         static private function action_skinremovetypeconfirm()\r
3954         {\r
3955                 global $member, $CONF, $manager;\r
3956                 \r
3957                 $member->isAdmin() or self::disallow();\r
3958                 \r
3959                 $skinid = intRequestVar('skinid');\r
3960                 $skintype = requestVar('type');\r
3961                 \r
3962                 if ( !isValidShortName($skintype) )\r
3963                 {\r
3964                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3965                 }\r
3966                 \r
3967                 // don't allow default skinparts to be deleted\r
3968                 /* TODO: this array should be retrieved from Action class */\r
3969                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3970                 {\r
3971                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3972                 }\r
3973                 \r
3974                 $data = array(\r
3975                         'skinid'   => $skinid,\r
3976                         'skintype' => $skintype\r
3977                 );\r
3978                 $manager->notify('PreDeleteSkinPart', $data);\r
3979                 // delete part\r
3980                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3981                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3982                 DB::execute($query);\r
3983                 \r
3984                 $data = array(\r
3985                         'skinid'   => $skinid,\r
3986                         'skintype' => $skintype\r
3987                 );\r
3988                 $manager->notify('PostDeleteSkinPart', $data);\r
3989                 \r
3990                 self::action_skinedit();\r
3991                 return;\r
3992         }\r
3993 \r
3994         /**\r
3995          * Admin::action_skinclone()\r
3996          * \r
3997          * @param       void\r
3998          * @return      void\r
3999          */\r
4000         static private function action_skinclone()\r
4001         {\r
4002                 global $member;\r
4003                 \r
4004                 $member->isAdmin() or self::disallow();\r
4005                 \r
4006                 $skinid = intRequestVar('skinid');\r
4007                 \r
4008                 // 1. read skin to clone\r
4009                 $skin = new Skin($skinid);\r
4010                 \r
4011                 $name = "{$skin->getName()}_clone";\r
4012                 \r
4013                 // if a skin with that name already exists:\r
4014                 if ( Skin::exists($name) )\r
4015                 {\r
4016                         $i = 1;\r
4017                         while ( Skin::exists($name . $i) )\r
4018                         {\r
4019                                 $i++;\r
4020                         }\r
4021                         $name .= $i;\r
4022                 }\r
4023                 \r
4024                 // 2. create skin desc\r
4025                 $newid = Skin::createNew(\r
4026                         $name,\r
4027                         $skin->getDescription(),\r
4028                         $skin->getContentType(),\r
4029                         $skin->getIncludeMode(),\r
4030                         $skin->getIncludePrefix()\r
4031                 );\r
4032                 \r
4033                 // 3. clone\r
4034                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4035                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4036                 \r
4037                 $res = DB::getResult($query);\r
4038                 foreach ( $res as $row )\r
4039                 {\r
4040                         self::skinclonetype($skin, $newid, $row['stype']);\r
4041                 }\r
4042                 \r
4043                 self::action_skinoverview();\r
4044                 return;\r
4045         }\r
4046         \r
4047         /**\r
4048          * Admin::skinclonetype()\r
4049          * \r
4050          * @param       String  $skin   Skin object\r
4051          * @param       Integer $newid  ID for this clone\r
4052          * @param       String  $type   type of skin\r
4053          * @return      Void\r
4054          */\r
4055         static private function skinclonetype($skin, $newid, $type)\r
4056         {\r
4057                 $newid = intval($newid);\r
4058                 $content = $skin->getContentFromDB($type);\r
4059                 \r
4060                 if ( $content )\r
4061                 {\r
4062                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4063                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4064                         DB::execute($query);\r
4065                 }\r
4066                 return;\r
4067         }\r
4068         \r
4069         /**\r
4070          * Admin::action_adminskinoverview()\r
4071          * \r
4072          * @param       void\r
4073          * @return      void\r
4074          */\r
4075         static private function action_adminskinoverview()\r
4076         {\r
4077                 global $member, $manager;\r
4078                 \r
4079                 $member->isAdmin() or self::disallow();\r
4080                 \r
4081                 self::$skin->parse('adminskinoverview');\r
4082                 return;\r
4083         }\r
4084         \r
4085         /**\r
4086          * Admin::action_adminskinnew()\r
4087          * \r
4088          * @param       void\r
4089          * @return      void\r
4090          */\r
4091         static private function action_adminskinnew()\r
4092         {\r
4093                 global $member;\r
4094                 $member->isAdmin() or self::disallow();\r
4095                 $name = trim(postVar('name'));\r
4096                 $desc = trim(postVar('desc'));\r
4097                 \r
4098                 if ( !isValidSkinName($name) )\r
4099                 {\r
4100                         self::error(_ERROR_BADSKINNAME);\r
4101                 }\r
4102                 else if ( !preg_match('#^admin/#', $name) )\r
4103                 {\r
4104                         self::error(_ERROR_BADADMINSKINNAME);\r
4105                 }\r
4106                 else if ( Skin::exists($name) )\r
4107                 {\r
4108                         self::error(_ERROR_DUPSKINNAME);\r
4109                 }\r
4110                 /* TODO: $newId is not reused... */\r
4111                 $newId = Skin::createNew($name, $desc);\r
4112                 self::action_adminskinoverview();\r
4113                 return;\r
4114         }\r
4115         \r
4116         /**\r
4117          * Admin::action_adminskinedit()\r
4118          * \r
4119          * @param       void\r
4120          * @return      void\r
4121          */\r
4122         static private function action_adminskinedit()\r
4123         {\r
4124                 global $member, $manager;\r
4125                 \r
4126                 $member->isAdmin() or self::disallow();\r
4127                 self::$skin->parse('adminskinedit');\r
4128                 return;\r
4129         }\r
4130         \r
4131         /**\r
4132          * Admin::action_adminskineditgeneral()\r
4133          * \r
4134          * @param       void\r
4135          * @return      void\r
4136          */\r
4137         static private function action_adminskineditgeneral()\r
4138         {\r
4139                 global $member;\r
4140                 \r
4141                 $skinid = intRequestVar('skinid');\r
4142                 \r
4143                 $member->isAdmin() or self::disallow();\r
4144                 \r
4145                 $name           = postVar('name');\r
4146                 $desc           = postVar('desc');\r
4147                 $type           = postVar('type');\r
4148                 $inc_mode       = postVar('inc_mode');\r
4149                 $inc_prefix     = postVar('inc_prefix');\r
4150                 \r
4151                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4152                 \r
4153                 // 1. Some checks\r
4154                 if ( !isValidSkinName($name) )\r
4155                 {\r
4156                         self::error(_ERROR_BADSKINNAME);\r
4157                 }\r
4158                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4159                 {\r
4160                         self::error(_ERROR_DUPSKINNAME);\r
4161                 }\r
4162                 if ( !$type )\r
4163                 {\r
4164                         $type = 'text/html';\r
4165                 }\r
4166                 if ( !$inc_mode )\r
4167                 {\r
4168                         $inc_mode = 'normal';\r
4169                 }\r
4170                 // 2. Update description\r
4171                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4172                 self::action_adminskinedit();\r
4173                 return;\r
4174         }\r
4175         \r
4176         /**\r
4177          * Admin::action_adminskinedittype()\r
4178          * \r
4179          * @param       string  $msg    message for pageheader\r
4180          * @return      void\r
4181          */\r
4182         static private function action_adminskinedittype($msg = '')\r
4183         {\r
4184                 global $member, $manager;\r
4185                 \r
4186                 $member->isAdmin() or self::disallow();\r
4187                 \r
4188                 if ( $msg )\r
4189                 {\r
4190                         self::$headMess = $msg;\r
4191                 }\r
4192                 $type = requestVar('type');\r
4193                 $type = trim($type);\r
4194                 $type = strtolower($type);\r
4195                 \r
4196                 if ( !isValidShortName($type) )\r
4197                 {\r
4198                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4199                 }\r
4200                 \r
4201                 self::$skin->parse('adminskinedittype');\r
4202                 return;\r
4203         }\r
4204         \r
4205         /**\r
4206          * Admin::action_adminskinupdate()\r
4207          * \r
4208          * @param       void\r
4209          * @return      void\r
4210          */\r
4211         static private function action_adminskinupdate()\r
4212         {\r
4213                 global $member;\r
4214                 $skinid         = intRequestVar('skinid');\r
4215                 $content        = trim(postVar('content'));\r
4216                 $type           = postVar('type');\r
4217                 \r
4218                 $member->isAdmin() or self::disallow();\r
4219                 \r
4220                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4221                 $skin->update($type, $content);\r
4222                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4223                 return;\r
4224         }\r
4225         \r
4226         /**\r
4227          * Admin::action_adminskindelete()\r
4228          * \r
4229          * @param       void\r
4230          * @return      void\r
4231          */\r
4232         static private function action_adminskindelete()\r
4233         {\r
4234                 global $member, $manager, $CONF;\r
4235                 $member->isAdmin() or self::disallow();\r
4236                 \r
4237                 /* TODO: needless variable $skinid... */\r
4238                 $skinid = intRequestVar('skinid');\r
4239                 self::$skin->parse('adminskindelete');\r
4240                 return;\r
4241         }\r
4242 \r
4243         /**\r
4244          * Admin::action_adminskindeleteconfirm()\r
4245          * \r
4246          * @param       void\r
4247          * @return      void\r
4248          */\r
4249         static private function action_adminskindeleteconfirm()\r
4250         {\r
4251                 global $member, $CONF, $manager;\r
4252                 \r
4253                 $member->isAdmin() or self::disallow();\r
4254                 $skinid = intRequestVar('skinid');\r
4255                 \r
4256                 // don't allow default skin to be deleted\r
4257                 if ( $skinid == $CONF['AdminSkin'] )\r
4258                 {\r
4259                         self::error(_ERROR_DEFAULTSKIN);\r
4260                 }\r
4261                 \r
4262                 /*\r
4263                  * TODO: NOT Implemented\r
4264                  *  don't allow deletion of default skins for members\r
4265                 $memberDefaults =  $member->getAdminSkin();\r
4266                 foreach ( $memberDefaults as $memID => $adminskin )\r
4267                 {\r
4268                         if ( $skinid == $adminskin )\r
4269                         {\r
4270                                 $mem =& $manager->getMember($memID);\r
4271                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4272                         }\r
4273                 }\r
4274                 */\r
4275                 \r
4276                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4277                 \r
4278                 // 1. delete description\r
4279                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4280                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4281                 DB::execute($query);\r
4282                 \r
4283                 // 2. delete parts\r
4284                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4285                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4286                 \r
4287                 DB::execute($query);\r
4288                 \r
4289                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4290                 self::action_adminskinoverview();\r
4291                 return;\r
4292         }\r
4293         \r
4294         /**\r
4295          * Admin::action_adminskinremovetype()\r
4296          * \r
4297          * @param       void\r
4298          * @return      void\r
4299          */\r
4300         static private function action_adminskinremovetype()\r
4301         {\r
4302                 global $member, $manager, $CONF;\r
4303 \r
4304                 $member->isAdmin() or self::disallow();\r
4305                 \r
4306                 $skinid         = intRequestVar('skinid');\r
4307                 $skintype       = requestVar('type');\r
4308                 \r
4309                 if ( !isValidShortName($skintype) )\r
4310                 {\r
4311                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4312                 }\r
4313                 \r
4314                 self::$skin->parse('adminskinremovetype');\r
4315                 return;\r
4316         }\r
4317         \r
4318         /**\r
4319          * Admin::action_adminskinremovetypeconfirm()\r
4320          * \r
4321          * @param       void\r
4322          * @return      void\r
4323          */\r
4324         static private function action_adminskinremovetypeconfirm()\r
4325         {\r
4326                 global $member, $CONF, $manager;\r
4327                 \r
4328                 $member->isAdmin() or self::disallow();\r
4329                 \r
4330                 $skinid         = intRequestVar('skinid');\r
4331                 $skintype       = requestVar('type');\r
4332                 \r
4333                 if ( !isValidShortName($skintype) )\r
4334                 {\r
4335                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4336                 }\r
4337                 \r
4338                 $data =array(\r
4339                         'skinid'        => $skinid,\r
4340                         'skintype'      => $skintype\r
4341                 );\r
4342                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4343 \r
4344                 // delete part\r
4345                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4346                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4347                 DB::execute($query);\r
4348                 \r
4349                 $data = array(\r
4350                         'skinid'        => $skinid,\r
4351                         'skintype'      => $skintype\r
4352                 );\r
4353                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4354                 \r
4355                 self::action_adminskinedit();\r
4356                 return;\r
4357         }\r
4358 \r
4359         /**\r
4360          * Admin::action_adminskinclone()\r
4361          * \r
4362          * @param       void\r
4363          * @return      void\r
4364          */\r
4365         static private function action_adminskinclone()\r
4366         {\r
4367                 global $member;\r
4368                 \r
4369                 $member->isAdmin() or self::disallow();\r
4370                 \r
4371                 $skinid = intRequestVar('skinid');\r
4372                 \r
4373                 // 1. read skin to clone\r
4374                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4375                 $name = "{$skin->getName()}_clone";\r
4376                 \r
4377                 // if a skin with that name already exists:\r
4378                 if ( Skin::exists($name) )\r
4379                 {\r
4380                         $i = 1;\r
4381                         while ( Skin::exists($name . $i) )\r
4382                         {\r
4383                                 $i++;\r
4384                         }\r
4385                         $name .= $i;\r
4386                 }\r
4387                 \r
4388                 // 2. create skin desc\r
4389                 $newid = Skin::createNew(\r
4390                         $name,\r
4391                         $skin->getDescription(),\r
4392                         $skin->getContentType(),\r
4393                         $skin->getIncludeMode(),\r
4394                         $skin->getIncludePrefix()\r
4395                 );\r
4396                 \r
4397                 // 3. clone\r
4398                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4399                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4400                 \r
4401                 $res = DB::getResult($query);\r
4402                 foreach ( $res as $row )\r
4403                 {\r
4404                         self::skinclonetype($skin, $newid, $row['stype']);\r
4405                 }\r
4406                 self::action_adminskinoverview();\r
4407                 return;\r
4408         }\r
4409         \r
4410         /**\r
4411          * Admin::adminskinclonetype()\r
4412          * \r
4413          * @param       string  $skin   an instance of Skin class\r
4414          * @param       integer $newid  ID for new skin\r
4415          * @param       string  $type   skin type\r
4416          * @return      void\r
4417          */\r
4418         static private function adminskinclonetype($skin, $newid, $type)\r
4419         {\r
4420                 $content = $skin->getContentFromDB($type);\r
4421                 \r
4422                 if ( $content )\r
4423                 {\r
4424                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4425                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4426                         DB::execute($query);\r
4427                 }\r
4428                 return;\r
4429         }\r
4430         \r
4431         /**\r
4432          * Admin::action_adminskinieoverview()\r
4433          * \r
4434          * @param       void\r
4435          * @return      void\r
4436          */\r
4437         static private function action_adminskinieoverview()\r
4438         {\r
4439                 global $member, $DIR_LIBS, $manager;\r
4440                 \r
4441                 $member->isAdmin() or self::disallow();\r
4442                 \r
4443                 // load skinie class\r
4444                 include_once($DIR_LIBS . 'skinie.php');\r
4445                 \r
4446                 self::$skin->parse('adminskinieoverview');\r
4447                 return;\r
4448         }\r
4449 \r
4450         /**\r
4451          * Admin::action_adminskinieimport()\r
4452          * \r
4453          * @param       void\r
4454          * @return      void\r
4455          */\r
4456         static private function action_adminskinieimport()\r
4457         {\r
4458                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4459                 \r
4460                 $member->isAdmin() or self::disallow();\r
4461                 \r
4462                 // load skinie class\r
4463                 include_once($DIR_LIBS . 'skinie.php');\r
4464                 \r
4465                 $skinFileRaw    = postVar('skinfile');\r
4466                 $mode                   = postVar('mode');\r
4467                 \r
4468                 $importer = new SKINIMPORT();\r
4469                 \r
4470                 // get full filename\r
4471                 if ( $mode == 'file' )\r
4472                 {\r
4473                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4474                         \r
4475                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4476                         if ( !file_exists($skinFile) )\r
4477                         {\r
4478                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4479                         }\r
4480                 }\r
4481                 else\r
4482                 {\r
4483                         $skinFile = $skinFileRaw;\r
4484                 }\r
4485                 \r
4486                 // read only metadata\r
4487                 $error = $importer->readFile($skinFile, 1);\r
4488                 if ( $error )\r
4489                 {\r
4490                         self::error($error);\r
4491                 }\r
4492                 \r
4493                 /* TODO: we should consider to use the other way instead of this */\r
4494                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4495                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4496                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4497                 \r
4498                 // clashes\r
4499                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4500                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4501                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4502                 /* TODO: we should consider to use the other way instead of this */\r
4503                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4504                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4505                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4506 \r
4507                 if ( !is_object(self::$skin) )\r
4508                 {\r
4509                         self::action_adminskiniedoimport();\r
4510                 }\r
4511                 else\r
4512                 {\r
4513                         self::$skin->parse('adminskinieimport');\r
4514                 }\r
4515                 return;\r
4516         }\r
4517         \r
4518         /**\r
4519          * Admin::action_adminskiniedoimport()\r
4520          * \r
4521          * @param       void\r
4522          * @return      void\r
4523          */\r
4524         static private function action_adminskiniedoimport()\r
4525         {\r
4526                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4527                 \r
4528                 $member->isAdmin() or self::disallow();\r
4529                 \r
4530                 // load skinie class\r
4531                 include_once($DIR_LIBS . 'skinie.php');\r
4532                 \r
4533                 $skinFileRaw    = postVar('skinfile');\r
4534                 $mode                   = postVar('mode');\r
4535                 $allowOverwrite = intPostVar('overwrite');\r
4536                 \r
4537                 // get full filename\r
4538                 if ( $mode == 'file' )\r
4539                 {\r
4540                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4541                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4542                         if ( !file_exists($skinFile) )\r
4543                         {\r
4544                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4545                         }\r
4546                 }\r
4547                 else\r
4548                 {\r
4549                         $skinFile = $skinFileRaw;\r
4550                 }\r
4551                 \r
4552                 $importer = new SKINIMPORT();\r
4553                 \r
4554                 $error = $importer->readFile($skinFile);\r
4555                 if ( $error )\r
4556                 {\r
4557                         self::error($error);\r
4558                 }\r
4559                 \r
4560                 $error = $importer->writeToDatabase($allowOverwrite);\r
4561                 if ( $error )\r
4562                 {\r
4563                         self::error($error);\r
4564                 }\r
4565                 \r
4566                 /* TODO: we should consider to use the other way instead of this */\r
4567                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4568                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4569                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4570                 \r
4571                 if ( !is_object(self::$skin) )\r
4572                 {\r
4573                         global $DIR_SKINS;\r
4574                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4575                         $query  = sprintf($query, sql_table('skin_desc'));\r
4576                         $res    = intval(DB::getValue($query));\r
4577                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4578                         $query  = sprintf($query, sql_table('config'), $res);\r
4579                         DB::execute($query);\r
4580                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');\r
4581                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4582                 }\r
4583                 else\r
4584                 {\r
4585                         self::$skin->parse('adminskiniedoimport');\r
4586                 }\r
4587                 return;\r
4588         }\r
4589 \r
4590         /**\r
4591          * Admin::action_adminskinieexport()\r
4592          * \r
4593          * @param       void\r
4594          * @return      void\r
4595          */\r
4596         static private function action_adminskinieexport()\r
4597         {\r
4598                 global $member, $DIR_PLUGINS;\r
4599                 \r
4600                 $member->isAdmin() or self::disallow();\r
4601                 \r
4602                 // load skinie class\r
4603                 $aSkins = requestIntArray('skin');\r
4604                 if (!is_array($aSkins)) {\r
4605                         $aSkins = array();\r
4606                 }\r
4607                 $skinList = array_keys($aSkins);\r
4608                 \r
4609                 $aTemplates = requestIntArray('template');\r
4610                 if (!is_array($aTemplates))\r
4611                 {\r
4612                         $aTemplates = array();\r
4613                 }\r
4614                 $templateList = array_keys($aTemplates);\r
4615                 \r
4616                 $info = postVar('info');\r
4617                 \r
4618                 include_libs('skinie.php');\r
4619                 $exporter = new SkinExport();\r
4620                 foreach ( $skinList as $skinId )\r
4621                 {\r
4622                         $exporter->addSkin($skinId);\r
4623                 }\r
4624                 foreach ( $templateList as $templateId )\r
4625                 {\r
4626                         $exporter->addTemplate($templateId);\r
4627                 }\r
4628                 $exporter->setInfo($info);\r
4629                 $exporter->export();\r
4630                 return;\r
4631         }\r
4632         \r
4633         /**\r
4634          * Admin::action_settingsedit()\r
4635          * \r
4636          * @param       Void\r
4637          * @return      Void\r
4638          */\r
4639         static private function action_settingsedit()\r
4640         {\r
4641                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4642                 \r
4643                 $member->isAdmin() or self::disallow();\r
4644                 \r
4645                 self::$skin->parse('settingsedit');\r
4646                 return;\r
4647         }\r
4648         \r
4649         /**\r
4650          * Admin::action_settingsupdate()\r
4651          * Update $CONFIG and redirect\r
4652          * \r
4653          * @param       void\r
4654          * @return      void\r
4655          */\r
4656         static private function action_settingsupdate()\r
4657         {\r
4658                 global $member, $CONF;\r
4659                 \r
4660                 $member->isAdmin() or self::disallow();\r
4661                 \r
4662                 // check if email address for admin is valid\r
4663                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4664                 {\r
4665                         self::error(_ERROR_BADMAILADDRESS);\r
4666                 }\r
4667                 \r
4668                 // save settings\r
4669                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4670                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4671                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4672                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4673                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4674                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4675                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4676                 self::updateConfig('Locale',                    postVar('Locale'));\r
4677                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4678                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4679                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4680                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4681                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4682                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4683                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4684                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4685                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4686                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4687                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4688                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4689                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4690                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4691                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4692                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4693                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4694                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4695                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4696                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4697                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4698                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4699                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4700                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4701                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4702                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4703                 \r
4704                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4705                 // note that when changing cookie settings, this redirect might cause the user\r
4706                 // to have to log in again.\r
4707                 getConfig();\r
4708                 redirect($CONF['AdminURL'] . '?action=manage');\r
4709                 return;\r
4710         }\r
4711         \r
4712         /**\r
4713          * Admin::action_systemoverview()\r
4714          * Output system overview\r
4715          * \r
4716          * @param       void\r
4717          * @return      void\r
4718          */\r
4719         static private function action_systemoverview()\r
4720         {\r
4721                 self::$skin->parse('systemoverview');\r
4722                 return;\r
4723         }\r
4724         \r
4725         /**\r
4726          * Admin::updateConfig()\r
4727          * \r
4728          * @param       string  $name   \r
4729          * @param       string  $val    \r
4730          * @return      integer return the ID in which the latest query posted\r
4731          */\r
4732         static private function updateConfig($name, $val)\r
4733         {\r
4734                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4735                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4736                 if ( DB::execute($query) === FALSE )\r
4737                 {\r
4738                         $err = DB::getError();\r
4739                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4740                 }\r
4741                 return DB::getInsertId();\r
4742         }\r
4743         \r
4744         /**\r
4745          * Admin::error()\r
4746          * Error message\r
4747          * \r
4748          * @param       string  $msg    message that will be shown\r
4749          * @return      void\r
4750          */\r
4751         static public function error($msg)\r
4752         {\r
4753                 self::$headMess = $msg;\r
4754                 self::$skin->parse('adminerrorpage');\r
4755                 return;\r
4756         }\r
4757         \r
4758         /**\r
4759          * Admin::disallow()\r
4760          * add error log and show error page \r
4761          * \r
4762          * @param       void\r
4763          * @return      void\r
4764          */\r
4765         static public function disallow()\r
4766         {\r
4767                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4768                 self::error(_ERROR_DISALLOWED);\r
4769                 return;\r
4770         }\r
4771 \r
4772         /**\r
4773          * Admin::action_PluginAdmin()\r
4774          * Output pluginadmin\r
4775          *\r
4776          * @param       string  $skinContents\r
4777          * @param       string  $extrahead\r
4778          * @return      void\r
4779          */\r
4780         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4781         {\r
4782                 self::$extrahead .= $extrahead;\r
4783                 self::$skin->parse('pluginadmin', $skinContents);\r
4784                 return;\r
4785         }\r
4786         \r
4787         /**\r
4788          * Admin::action_bookmarklet()\r
4789          * \r
4790          * @param       void\r
4791          * @return      void\r
4792          */\r
4793         static private function action_bookmarklet()\r
4794         {\r
4795                 global $member, $manager;\r
4796                 \r
4797                 $blogid = intRequestVar('blogid');\r
4798                 $member->teamRights($blogid) or self::disallow();\r
4799                 \r
4800                 self::$skin->parse('bookmarklet');\r
4801                 return;\r
4802         }\r
4803         \r
4804         /**\r
4805          * Admin::action_actionlog()\r
4806          * \r
4807          * @param       void\r
4808          * @return      void\r
4809          */\r
4810         static private function action_actionlog()\r
4811         {\r
4812                 global $member, $manager;\r
4813                 \r
4814                 $member->isAdmin() or self::disallow();\r
4815                 \r
4816                 self::$skin->parse('actionlog');\r
4817                 return;\r
4818         }\r
4819         \r
4820         /**\r
4821          * Admin::action_banlist()\r
4822          * \r
4823          * @param       void\r
4824          * @return      void\r
4825          */\r
4826         static private function action_banlist()\r
4827         {\r
4828                 global $member, $manager;\r
4829                 \r
4830                 $blogid = intRequestVar('blogid');\r
4831                 $member->blogAdminRights($blogid) or self::disallow();\r
4832                 \r
4833                 self::$skin->parse('banlist');\r
4834                 return;\r
4835         }\r
4836         \r
4837         /**\r
4838          * Admin::action_banlistdelete()\r
4839          * \r
4840          * @param       void\r
4841          * @return      void\r
4842          */\r
4843         static private function action_banlistdelete()\r
4844         {\r
4845                 global $member, $manager;\r
4846                 \r
4847                 $blogid = intRequestVar('blogid');\r
4848                 $member->blogAdminRights($blogid) or self::disallow();\r
4849                 \r
4850                 self::$skin->parse('banlistdelete');\r
4851                 return;\r
4852         }\r
4853         \r
4854         /**\r
4855          * Admin::action_banlistdeleteconfirm()\r
4856          * \r
4857          * @param       void\r
4858          * @return      void\r
4859          */\r
4860         static private function action_banlistdeleteconfirm()\r
4861         {\r
4862                 global $member, $manager;\r
4863                 \r
4864                 $blogid         = intPostVar('blogid');\r
4865                 $allblogs       = postVar('allblogs');\r
4866                 $iprange        = postVar('iprange');\r
4867                 \r
4868                 $member->blogAdminRights($blogid) or self::disallow();\r
4869                 \r
4870                 $deleted = array();\r
4871                 \r
4872                 if ( !$allblogs )\r
4873                 {\r
4874                         if ( Ban::removeBan($blogid, $iprange) )\r
4875                         {\r
4876                                 $deleted[] = $blogid;\r
4877                         }\r
4878                 }\r
4879                 else\r
4880                 {\r
4881                         // get blogs fot which member has admin rights\r
4882                         $adminblogs = $member->getAdminBlogs();\r
4883                         foreach ($adminblogs as $blogje)\r
4884                         {\r
4885                                 if ( Ban::removeBan($blogje, $iprange) )\r
4886                                 {\r
4887                                         $deleted[] = $blogje;\r
4888                                 }\r
4889                         }\r
4890                 }\r
4891                 \r
4892                 if ( sizeof($deleted) == 0 )\r
4893                 {\r
4894                         self::error(_ERROR_DELETEBAN);\r
4895                 }\r
4896                 \r
4897                 /* TODO: we should use other ways */\r
4898                 $_REQUEST['delblogs'] = $deleted;\r
4899                 \r
4900                 self::$skin->parse('banlistdeleteconfirm');\r
4901                 return;\r
4902         }\r
4903         \r
4904         /**\r
4905          * Admin::action_banlistnewfromitem()\r
4906          * \r
4907          * @param       void\r
4908          * @return      void\r
4909          */\r
4910         static private function action_banlistnewfromitem()\r
4911         {\r
4912                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
4913                 return;\r
4914         }\r
4915         \r
4916         /**\r
4917          * Admin::action_banlistnew()\r
4918          * \r
4919          * @param       integer $blogid ID for weblog\r
4920          * @return      void\r
4921          */\r
4922         static private function action_banlistnew($blogid = '')\r
4923         {\r
4924                 global $member, $manager;\r
4925                 \r
4926                 if ( $blogid == '' )\r
4927                 {\r
4928                         $blogid = intRequestVar('blogid');\r
4929                 }\r
4930                 \r
4931                 $ip = requestVar('ip');\r
4932                 \r
4933                 $member->blogAdminRights($blogid) or self::disallow();\r
4934                 \r
4935                 /* TODO: we should consider to use the other way instead of this */\r
4936                 $_REQUEST['blogid'] = $blogid;          \r
4937                 \r
4938                 self::$skin->parse('banlistnew');\r
4939                 \r
4940                 return;\r
4941         }\r
4942 \r
4943         /**\r
4944          * Admin::action_banlistadd()\r
4945          * \r
4946          * @param       void\r
4947          * @return      void\r
4948          */\r
4949         static private function action_banlistadd()\r
4950         {\r
4951                 global $member;\r
4952                 \r
4953                 $blogid         = intPostVar('blogid');\r
4954                 $allblogs       = postVar('allblogs');\r
4955                 $iprange        = postVar('iprange');\r
4956                 \r
4957                 if ( $iprange == "custom" )\r
4958                 {\r
4959                         $iprange = postVar('customiprange');\r
4960                 }\r
4961                 $reason   = postVar('reason');\r
4962                 \r
4963                 $member->blogAdminRights($blogid) or self::disallow();\r
4964                 \r
4965                 // TODO: check IP range validity\r
4966                 \r
4967                 if ( !$allblogs )\r
4968                 {\r
4969                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4970                         {\r
4971                                 self::error(_ERROR_ADDBAN);\r
4972                         }\r
4973                 }\r
4974                 else\r
4975                 {\r
4976                         // get blogs fot which member has admin rights\r
4977                         $adminblogs = $member->getAdminBlogs();\r
4978                         $failed = 0;\r
4979                         foreach ($adminblogs as $blogje)\r
4980                         {\r
4981                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4982                                 {\r
4983                                         $failed = 1;\r
4984                                 }\r
4985                         }\r
4986                         if ( $failed )\r
4987                         {\r
4988                                 self::error(_ERROR_ADDBAN);\r
4989                         }\r
4990                 }\r
4991                 self::action_banlist();\r
4992                 return;\r
4993         }\r
4994         \r
4995         /**\r
4996          * Admin::action_clearactionlog()\r
4997          * \r
4998          * @param       void\r
4999          * @return      void\r
5000          */\r
5001         static private function action_clearactionlog()\r
5002         {\r
5003                 global $member;\r
5004                 \r
5005                 $member->isAdmin() or self::disallow();\r
5006                 \r
5007                 ActionLog::clear();\r
5008                 \r
5009                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5010                 return;\r
5011         }\r
5012         \r
5013         /**\r
5014          * Admin::action_backupoverview()\r
5015          * \r
5016          * @param       void\r
5017          * @return      void\r
5018          */\r
5019         static private function action_backupoverview()\r
5020         {\r
5021                 global $member, $manager;\r
5022                 \r
5023                 $member->isAdmin() or self::disallow();\r
5024                 \r
5025                 self::$skin->parse('backupoverview');\r
5026                 return;\r
5027         }\r
5028 \r
5029         /**\r
5030          * Admin::action_backupcreate()\r
5031          * create file for backup\r
5032          * \r
5033          * @param               void\r
5034          * @return      void\r
5035          * \r
5036          */\r
5037         static private function action_backupcreate()\r
5038         {\r
5039                 global $member, $DIR_LIBS;\r
5040                 \r
5041                 $member->isAdmin() or self::disallow();\r
5042                 \r
5043                 // use compression ?\r
5044                 $useGzip = (integer) postVar('gzip');\r
5045                 \r
5046                 include($DIR_LIBS . 'backup.php');\r
5047                 \r
5048                 // try to extend time limit\r
5049                 // (creating/restoring dumps might take a while)\r
5050                 @set_time_limit(1200);\r
5051                 \r
5052                 Backup::do_backup($useGzip);\r
5053                 exit;\r
5054         }\r
5055         \r
5056         /**\r
5057          * Admin::action_backuprestore()\r
5058          * restoring from uploaded file\r
5059          * \r
5060          * @param               void\r
5061          * @return      void\r
5062          */\r
5063         static private function action_backuprestore()\r
5064         {\r
5065                 global $member, $DIR_LIBS;\r
5066                 \r
5067                 $member->isAdmin() or self::disallow();\r
5068                 \r
5069                 if ( intPostVar('letsgo') != 1 )\r
5070                 {\r
5071                         self::error(_ERROR_BACKUP_NOTSURE);\r
5072                 }\r
5073                 \r
5074                 include($DIR_LIBS . 'backup.php');\r
5075                 \r
5076                 // try to extend time limit\r
5077                 // (creating/restoring dumps might take a while)\r
5078                 @set_time_limit(1200);\r
5079                 \r
5080                 $message = Backup::do_restore();\r
5081                 if ( $message != '' )\r
5082                 {\r
5083                         self::error($message);\r
5084                 }\r
5085                 self::$skin->parse('backuprestore');\r
5086                 return;\r
5087         }\r
5088         \r
5089         /**\r
5090          * Admin::action_pluginlist()\r
5091          * output the list of installed plugins\r
5092          * \r
5093          * @param       void\r
5094          * @return      void\r
5095          * \r
5096          */\r
5097         static private function action_pluginlist()\r
5098         {\r
5099                 global $DIR_PLUGINS, $member, $manager;\r
5100                 \r
5101                 // check if allowed\r
5102                 $member->isAdmin() or self::disallow();\r
5103                 \r
5104                 self::$skin->parse('pluginlist');\r
5105                 return;\r
5106         }\r
5107         \r
5108         /**\r
5109          * Admin::action_pluginhelp()\r
5110          * \r
5111          * @param       void\r
5112          * @return      void\r
5113          */\r
5114         static private function action_pluginhelp()\r
5115         {\r
5116                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5117                 \r
5118                 // check if allowed\r
5119                 $member->isAdmin() or self::disallow();\r
5120                 \r
5121                 $plugid = intGetVar('plugid');\r
5122                 \r
5123                 if ( !$manager->pidInstalled($plugid) )\r
5124                 {\r
5125                         self::error(_ERROR_NOSUCHPLUGIN);\r
5126                 }\r
5127                 \r
5128                 self::$skin->parse('pluginhelp');\r
5129                 return;\r
5130         }\r
5131         \r
5132         /**\r
5133          * Admin::action_pluginadd()\r
5134          * \r
5135          * @param       Void\r
5136          * @return      Void\r
5137          * \r
5138          */\r
5139         static private function action_pluginadd()\r
5140         {\r
5141                 global $member, $manager, $DIR_PLUGINS;\r
5142                 \r
5143                 // check if allowed\r
5144                 $member->isAdmin() or self::disallow();\r
5145                 \r
5146                 $name = postVar('filename');\r
5147                 \r
5148                 if ( $manager->pluginInstalled($name) )\r
5149                 {\r
5150                         self::error(_ERROR_DUPPLUGIN);\r
5151                 }\r
5152                 \r
5153                 if ( !checkPlugin($name) )\r
5154                 {\r
5155                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5156                 }\r
5157                 \r
5158                 // get number of currently installed plugins\r
5159                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5160                 $numCurrent = $res->rowCount();\r
5161                 \r
5162                 // plugin will be added as last one in the list\r
5163                 $newOrder = $numCurrent + 1;\r
5164                 \r
5165                 $data = array('file' => &$name);\r
5166                 $manager->notify('PreAddPlugin', $data);\r
5167                 \r
5168                 // do this before calling getPlugin (in case the plugin id is used there)\r
5169                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5170                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5171                 DB::execute($query);\r
5172                 $iPid = DB::getInsertId();\r
5173                 \r
5174                 $manager->clearCachedInfo('installedPlugins');\r
5175                 \r
5176                 // Load the plugin for condition checking and instalation\r
5177                 $plugin =& $manager->getPlugin($name);\r
5178                 \r
5179                 // check if it got loaded (could have failed)\r
5180                 if ( !$plugin )\r
5181                 {\r
5182                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5183                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5184                         \r
5185                         DB::execute($query);\r
5186                         \r
5187                         $manager->clearCachedInfo('installedPlugins');\r
5188                         self::error(_ERROR_PLUGIN_LOAD);\r
5189                 }\r
5190                 \r
5191                 // check if plugin needs a newer Nucleus version\r
5192                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5193                 {\r
5194                         // uninstall plugin again...\r
5195                         self::deleteOnePlugin($plugin->getID());\r
5196                         \r
5197                         // ...and show error\r
5198                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5199                 }\r
5200                 \r
5201                 // check if plugin needs a newer Nucleus version\r
5202                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5203                 {\r
5204                         // uninstall plugin again...\r
5205                         self::deleteOnePlugin($plugin->getID());\r
5206                         \r
5207                         // ...and show error\r
5208                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5209                 }\r
5210                 \r
5211                 $pluginList = $plugin->getPluginDep();\r
5212                 foreach ( $pluginList as $pluginName )\r
5213                 {\r
5214                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5215                         if ($res->rowCount() == 0)\r
5216                         {\r
5217                                 // uninstall plugin again...\r
5218                                 self::deleteOnePlugin($plugin->getID());\r
5219                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5220                         }\r
5221                 }\r
5222                 \r
5223                 // call the install method of the plugin\r
5224                 $plugin->install();\r
5225                 \r
5226                 $data = array('plugin' => &$plugin);\r
5227                 $manager->notify('PostAddPlugin', $data);\r
5228                 \r
5229                 // update all events\r
5230                 self::action_pluginupdate();\r
5231                 return;\r
5232         }\r
5233         \r
5234         /**\r
5235          * ADMIN:action_pluginupdate():\r
5236          * \r
5237          * @param       Void\r
5238          * @return      Void\r
5239          * \r
5240          */\r
5241         static private function action_pluginupdate()\r
5242         {\r
5243                 global $member, $manager, $CONF;\r
5244                 \r
5245                 // check if allowed\r
5246                 $member->isAdmin() or self::disallow();\r
5247                 \r
5248                 // delete everything from plugin_events\r
5249                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5250                 \r
5251                 // loop over all installed plugins\r
5252                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5253                 foreach ( $res as $row )\r
5254                 {\r
5255                         $pid  =  $row['pid'];\r
5256                         $plug =& $manager->getPlugin($row['pfile']);\r
5257                         if ( $plug )\r
5258                         {\r
5259                                 $eventList = $plug->getEventList();\r
5260                                 foreach ( $eventList as $eventName )\r
5261                                 {\r
5262                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5263                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5264                                         DB::execute($query);\r
5265                                 }\r
5266                         }\r
5267                 }\r
5268                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5269                 return;\r
5270         }\r
5271         \r
5272         /**\r
5273          * Admin::action_plugindelete()\r
5274          * \r
5275          * @param       void\r
5276          * @return      void\r
5277          */\r
5278         static private function action_plugindelete()\r
5279         {\r
5280                 global $member, $manager;\r
5281                 \r
5282                 // check if allowed\r
5283                 $member->isAdmin() or self::disallow();\r
5284                 \r
5285                 $pid = intGetVar('plugid');\r
5286                 \r
5287                 if ( !$manager->pidInstalled($pid) )\r
5288                 {\r
5289                         self::error(_ERROR_NOSUCHPLUGIN);\r
5290                 }\r
5291                 \r
5292                 self::$skin->parse('plugindelete');\r
5293                 return;\r
5294         }\r
5295 \r
5296         /**\r
5297          * Admin::action_plugindeleteconfirm()\r
5298          * \r
5299          * @param       void\r
5300          * @return      void\r
5301          */\r
5302         static private function action_plugindeleteconfirm()\r
5303         {\r
5304                 global $member, $manager, $CONF;\r
5305                 \r
5306                 // check if allowed\r
5307                 $member->isAdmin() or self::disallow();\r
5308                 \r
5309                 $pid = intPostVar('plugid');\r
5310                 \r
5311                 $error = self::deleteOnePlugin($pid, 1);\r
5312                 if ( $error )\r
5313                 {\r
5314                         self::error($error);\r
5315                 }\r
5316                 \r
5317                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5318                 return;\r
5319         }\r
5320         \r
5321         /**\r
5322          * Admin::\r
5323          * \r
5324          * @param       void\r
5325          * @return      void\r
5326          */\r
5327         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5328         {\r
5329                 global $manager;\r
5330                 \r
5331                 $pid = intval($pid);\r
5332                 \r
5333                 if ( !$manager->pidInstalled($pid) )\r
5334                 {\r
5335                         return _ERROR_NOSUCHPLUGIN;\r
5336                 }\r
5337                 \r
5338                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5339                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5340                 $name = DB::getValue($query);\r
5341                 \r
5342                 // check dependency before delete\r
5343                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5344                 foreach ( $res as $row )\r
5345                 {\r
5346                         $plug =& $manager->getPlugin($row['pfile']);\r
5347                         if ( $plug )\r
5348                         {\r
5349                                 $depList = $plug->getPluginDep();\r
5350                                 foreach ( $depList as $depName )\r
5351                                 {\r
5352                                         if ( $name == $depName )\r
5353                                         {\r
5354                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5355                                         }\r
5356                                 }\r
5357                         }\r
5358                 }\r
5359                 \r
5360                 $data = array('plugid' => $pid);\r
5361                 $manager->notify('PreDeletePlugin', $data);\r
5362                 \r
5363                 // call the unInstall method of the plugin\r
5364                 if ( $callUninstall )\r
5365                 {\r
5366                         $plugin =& $manager->getPlugin($name);\r
5367                         if ( $plugin )\r
5368                         {\r
5369                                 $plugin->unInstall();\r
5370                         }\r
5371                 }\r
5372                 \r
5373                 // delete all subscriptions\r
5374                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5375                 \r
5376                 // delete all options\r
5377                 // get OIDs from plugin_option_desc\r
5378                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5379                 $aOIDs = array();\r
5380                 foreach ( $res as $row )\r
5381                 {\r
5382                         array_push($aOIDs, $row['oid']);\r
5383                 }\r
5384                 \r
5385                 // delete from plugin_option and plugin_option_desc\r
5386                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5387                 if (count($aOIDs) > 0)\r
5388                 {\r
5389                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5390                 }\r
5391                 \r
5392                 // update order numbers\r
5393                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5394                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5395                 \r
5396                 // delete row\r
5397                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5398                 \r
5399                 $manager->clearCachedInfo('installedPlugins');\r
5400                 $data = array('plugid' => $pid);\r
5401                 $manager->notify('PostDeletePlugin', $data);\r
5402                 \r
5403                 return '';\r
5404         }\r
5405         \r
5406         /**\r
5407          * Admin::action_pluginup()\r
5408          * \r
5409          * @param       void\r
5410          * @return      void\r
5411          */\r
5412         static private function action_pluginup()\r
5413         {\r
5414                 global $member, $manager, $CONF;\r
5415                 \r
5416                 // check if allowed\r
5417                 $member->isAdmin() or self::disallow();\r
5418                 \r
5419                 $plugid = intGetVar('plugid');\r
5420                 \r
5421                 if ( !$manager->pidInstalled($plugid) )\r
5422                 {\r
5423                         self::error(_ERROR_NOSUCHPLUGIN);\r
5424                 }\r
5425                 \r
5426                 // 1. get old order number\r
5427                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5428                 \r
5429                 // 2. calculate new order number\r
5430                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5431                 \r
5432                 // 3. update plug numbers\r
5433                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5434                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5435                 \r
5436                 //self::action_pluginlist();\r
5437                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5438                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5439                 return;\r
5440         }\r
5441         \r
5442         /**\r
5443          * Admin::action_plugindown()\r
5444          * \r
5445          * @param       void\r
5446          * @return      void\r
5447          */\r
5448         static private function action_plugindown()\r
5449         {\r
5450                 global $member, $manager, $CONF;\r
5451                 \r
5452                 // check if allowed\r
5453                 $member->isAdmin() or self::disallow();\r
5454                 \r
5455                 $plugid = intGetVar('plugid');\r
5456                 if ( !$manager->pidInstalled($plugid) )\r
5457                 {\r
5458                         self::error(_ERROR_NOSUCHPLUGIN);\r
5459                 }\r
5460                 \r
5461                 // 1. get old order number\r
5462                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5463                 \r
5464                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5465                 $maxOrder = $res->rowCount();\r
5466                 \r
5467                 // 2. calculate new order number\r
5468                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5469                 \r
5470                 // 3. update plug numbers\r
5471                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5472                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5473                 \r
5474                 //self::action_pluginlist();\r
5475                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5476                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5477                 return;\r
5478         }\r
5479         \r
5480         /**\r
5481          * Admin::action_pluginoptions()\r
5482          * \r
5483          * Output Plugin option page\r
5484          * \r
5485          * @access      public\r
5486          * @param       string $message message when fallbacked\r
5487          * @return      void\r
5488          * \r
5489          */\r
5490         static private function action_pluginoptions($message = '')\r
5491         {\r
5492                 global $member, $manager;\r
5493                 \r
5494                 // check if allowed\r
5495                 $member->isAdmin() or self::disallow();\r
5496                 \r
5497                 $pid = intRequestVar('plugid');\r
5498                 if ( !$manager->pidInstalled($pid) )\r
5499                 {\r
5500                         self::error(_ERROR_NOSUCHPLUGIN);\r
5501                 }\r
5502                 \r
5503                 if ( isset($message) )\r
5504                 {\r
5505                         self::$headMess = $message;\r
5506                 }\r
5507                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5508                 $plugin         = $manager->getPlugin($plugname);\r
5509                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5510                 \r
5511                 self::$skin->parse('pluginoptions');\r
5512                 return;\r
5513         }\r
5514         \r
5515         /**\r
5516          * Admin::action_pluginoptionsupdate()\r
5517          * \r
5518          * Update plugin options and fallback to plugin option page\r
5519          * \r
5520          * @access      public\r
5521          * @param       void\r
5522          * @return      void\r
5523          */\r
5524         static private function action_pluginoptionsupdate()\r
5525         {\r
5526                 global $member, $manager;\r
5527                 \r
5528                 // check if allowed\r
5529                 $member->isAdmin() or self::disallow();\r
5530                 \r
5531                 $pid = intRequestVar('plugid');\r
5532                 \r
5533                 if ( !$manager->pidInstalled($pid) )\r
5534                 {\r
5535                         self::error(_ERROR_NOSUCHPLUGIN);\r
5536                 }\r
5537                 \r
5538                 $aOptions = requestArray('plugoption');\r
5539                 NucleusPlugin::apply_plugin_options($aOptions);\r
5540                 \r
5541                 $data = array(\r
5542                         'context'       => 'global',\r
5543                         'plugid'        => $pid\r
5544                 );\r
5545                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5546                 \r
5547                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5548                 return;\r
5549         }\r
5550         \r
5551         /**\r
5552          * Admin::action_parseSpecialskin()\r
5553          * \r
5554          * @param       void\r
5555          * @return      void\r
5556          */\r
5557         static private function action_parseSpecialskin()\r
5558         {\r
5559                 self::$skin->parse(self::$action);\r
5560                 return;\r
5561         }\r
5562         \r
5563         /**\r
5564          * Admin::getAdminskinIDFromName()\r
5565          * \r
5566          * @param       string  $skinname       name of skin\r
5567          * @return      integer ID for skin\r
5568          */\r
5569         static private function getAdminskinIDFromName($skinname)\r
5570         {\r
5571                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5572                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5573                 $admnSknID      = DB::getValue($query);\r
5574                 return (integer) $adminSkinID;\r
5575         }\r
5576         \r
5577         /**\r
5578          * Admin::getAdminskinNameFromID()\r
5579          * \r
5580          * @param       integer $skinid ID for skin\r
5581          * @return      integer ID for skin\r
5582          */\r
5583         static private function getAdminskinNameFromID($skinid)\r
5584         {\r
5585                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5586                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5587                 $admnSknID      = DB::getValue($query);\r
5588                 return (integer) $adminSkinID;\r
5589         }\r
5590         \r
5591         /**\r
5592          * Admin::getAdminextrahead()\r
5593          */\r
5594         static public function getAdminextrahead()\r
5595         {\r
5596                 return self::$extrahead;\r
5597         }\r
5598         \r
5599         /**\r
5600          * Admin::getAdminpassvar()\r
5601          */\r
5602         static public function getAdminpassvar()\r
5603         {\r
5604                 return self::$passvar;\r
5605         }\r
5606         \r
5607         /**\r
5608          * Admin::getAdminAction()\r
5609          */\r
5610         static public function getAdminAction()\r
5611         {\r
5612                 return self::$action;\r
5613         }\r
5614         \r
5615         /**\r
5616          * Admin::getAdminaOption()\r
5617          */\r
5618         static public function getAdminaOption()\r
5619         {\r
5620                 return self::$aOptions;\r
5621         }\r
5622         \r
5623         /**\r
5624          * Admin::action_importAdmin()\r
5625          * \r
5626          * @param       void\r
5627          * @return      void\r
5628          */\r
5629         static private function action_importAdmin()\r
5630         {\r
5631                 global $DIR_ADMINSKINS, $action;\r
5632                 if ( $action == 'adminskinieimport' )\r
5633                 {\r
5634                         self::doAdminskinimport();\r
5635                 }\r
5636                 $skn = array();\r
5637                 if ( $action == 'showlogin' )\r
5638                 {\r
5639                         $skinName = 'showlogin';\r
5640                         $actnName = 'showlogin';\r
5641                 }\r
5642                 else\r
5643                 {\r
5644                         $skinName = 'defaultimporter';\r
5645                         $actnName = 'importAdmin';\r
5646                 }\r
5647                 \r
5648                 /* TODO: why??? */\r
5649                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5650                 $skn['id']                              = 0;\r
5651                 $skn['description']             = $skinName;\r
5652                 $skn['contentType']             = 'importAdmin';\r
5653                 $skn['includeMode']             = 'normal';\r
5654                 $skn['includePrefix']   = '';\r
5655                 $skn['name']                    = 'defaultinporter';\r
5656                 \r
5657                 self::$skin                             = (object) $skn;\r
5658                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5659                 \r
5660                 $parser = new PARSER($handler);\r
5661                 $parser->setSkin(self::$skin);\r
5662                 $parser->parse($contents);\r
5663                 \r
5664                 return;\r
5665         }\r
5666         \r
5667         /**\r
5668          * Admin::doAdminskinimport()\r
5669          * \r
5670          * @param       void\r
5671          * @return      void\r
5672          */\r
5673         static private function doAdminskinimport()\r
5674         {\r
5675                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5676                 \r
5677                 $member->isAdmin() or self::disallow();\r
5678                 \r
5679                 include_once($DIR_LIBS . 'Skinie.php');\r
5680                 $skinFileRaw    = postVar('skinfile');\r
5681                 $mode                   = postVar('mode');\r
5682                 $allowOverwrite = intPostVar('overwrite');\r
5683                 \r
5684                 if ( $mode == 'file' )\r
5685                 {\r
5686                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5687                 }\r
5688                 else\r
5689                 {\r
5690                         $skinFile = $skinFileRaw;\r
5691                 }\r
5692                 \r
5693                 $importer       = new SKINIMPORT();\r
5694                 $error          = $importer->readFile($skinFile);\r
5695                 if ( $error )\r
5696                 {\r
5697                         self::error($error);\r
5698                 }\r
5699                 $error = $importer->writeToDatabase($allowOverwrite);\r
5700                 if ( $error )\r
5701                 {\r
5702                         self::error($error);\r
5703                 }\r
5704                 \r
5705                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5706                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5707                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5708                 \r
5709                 header('Location: ' . $CONF['AdminURL']);\r
5710                 exit;\r
5711         }\r
5712 }\r