nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                         );\r
 212                 }\r
 213                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 214                 {\r
 215                         $action = $alias[$action];\r
 216                 }\r
 217                 $methodName = "action_{$action}";\r
 218                 self::$action = strtolower($action);\r
 219                 \r
 220                 /* 2. check the action */\r
 221                 $synonimActions = array(\r
 222                         'banlistnewfromitem',\r
 223                         'memberedit',\r
 224                         'login',\r
 225                 );\r
 226                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 227                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 228                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 229                 {\r
 230                         if (!$manager->checkTicket())\r
 231                         {\r
 232                                 self::error(_ERROR_BADTICKET);\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                 }\r
 251                 elseif ( $id != $CONF['AdminSkin'] )\r
 252                 {\r
 253                         self::$skin = new Skin($CONF['AdminSkin'], 'AdminActions');\r
 254                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 255                         {\r
 256                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 257                         }\r
 258                 }\r
 259                 else\r
 260                 {\r
 261                         self::error(_BADACTION . ENTITY::hsc($action));\r
 262                 }\r
 263                 exit;\r
 264         }\r
 265         \r
 266         /**\r
 267          * Action::existsSkinContents()\r
 268          * Check skin contents\r
 269          *\r
 270          * @param       string  $action action type\r
 271          * @return      boolean\r
 272          */\r
 273         static private function existsSkinContents($action)\r
 274         {\r
 275                 $in_array  = in_array($action, self::$skinless_actions);\r
 276                 \r
 277                 if ( $in_array )\r
 278                 {\r
 279                         return $in_array;\r
 280                 }\r
 281                 else\r
 282                 {\r
 283                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 284                         /* TODO: skinid should be a default */\r
 285                         if ( !is_object(self::$skin) )\r
 286                         {\r
 287                                 global $CONF;\r
 288                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 289                         }\r
 290                         else\r
 291                         {\r
 292                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 293                         }\r
 294                 }\r
 295                 return;\r
 296         }\r
 297         \r
 298         /**\r
 299          * Action::specialActionsAllow()\r
 300          * Check exists specialskinparts\r
 301          *\r
 302          * @param       string  $action action type\r
 303          * @return boolean\r
 304          */\r
 305         static private function specialActionsAllow($action)\r
 306         {\r
 307                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 308                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 309                 return DB::getValue($query);\r
 310         }\r
 311         \r
 312         /**\r
 313          * Action::action_showlogin()\r
 314          * \r
 315          * @param       void\r
 316          * @return      void\r
 317          */\r
 318         static private function action_showlogin()\r
 319         {\r
 320                 global $error;\r
 321                 self::action_login($error);\r
 322                 return;\r
 323         }\r
 324         \r
 325         /**\r
 326          * Action::action_login()\r
 327          * \r
 328          * @param       string  $msg            message for pageheader\r
 329          * @param       integer $passvars       ???\r
 330          */\r
 331         static private function action_login($msg = '', $passvars = 1)\r
 332         {\r
 333                 global $member;\r
 334                 \r
 335                 // skip to overview when allowed\r
 336                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 337                 {\r
 338                         self::action_overview();\r
 339                         exit;\r
 340                 }\r
 341                 \r
 342                 /* TODO: needless variable??? */\r
 343                 self::$passvar = $passvars;\r
 344                 if ( $msg )\r
 345                 {\r
 346                         self::$headMess = $msg;\r
 347                 }\r
 348                 \r
 349                 self::$skin->parse('showlogin');\r
 350         }\r
 351         \r
 352         /**\r
 353          * Action::action_overview()\r
 354          * provides a screen with the overview of the actions available\r
 355          * \r
 356          * @param       string  $msg    message for pageheader\r
 357          * @return      void\r
 358          */\r
 359         static private function action_overview($msg = '')\r
 360         {\r
 361                 if ( $msg )\r
 362                 {\r
 363                         self::$headMess = $msg;\r
 364                 }\r
 365                 \r
 366                 self::$skin->parse('overview');\r
 367                 return;\r
 368         }\r
 369         \r
 370         /**\r
 371          * Admin::action_manage()\r
 372          * \r
 373          * @param       string  $msg    message for pageheader\r
 374          * @retrn       void\r
 375          */\r
 376         static private function action_manage($msg = '')\r
 377         {\r
 378                 global $member;\r
 379                 \r
 380                 if ( $msg )\r
 381                 {\r
 382                         self::$headMess = $msg;\r
 383                 }\r
 384                 $member->isAdmin() or self::disallow();\r
 385                 \r
 386                 self::$skin->parse('manage');\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::$skin->parse('itemlist');\r
 408                 return;\r
 409         }\r
 410         \r
 411         /**\r
 412          * Action::action_batchitem()\r
 413          * \r
 414          * @param       void\r
 415          * @return      void\r
 416          */\r
 417         static private function action_batchitem()\r
 418         {\r
 419                 global $member, $manager;\r
 420                 \r
 421                 $member->isLoggedIn() or self::disallow();\r
 422                 \r
 423                 $selected       = requestIntArray('batch');\r
 424                 $action         = requestVar('batchaction');\r
 425                 \r
 426                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 427                 {\r
 428                         self::error(_BATCH_NOSELECTION);\r
 429                 }\r
 430                 \r
 431                 // On move: when no destination blog/category chosen, show choice now\r
 432                 $destCatid = intRequestVar('destcatid');\r
 433                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 434                 {\r
 435                         self::batchMoveSelectDestination('item', $selected);\r
 436                 }\r
 437                 \r
 438                 // On delete: check if confirmation has been given\r
 439                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 440                 {\r
 441                         self::batchAskDeleteConfirmation('item', $selected);\r
 442                 }\r
 443                 \r
 444                 self::$skin->parse('batchitem');\r
 445                 return;\r
 446         }\r
 447         \r
 448         /**\r
 449          * Action::action_batchcomment()\r
 450          * \r
 451          * @param       void\r
 452          * @return      void\r
 453          */\r
 454         static private function action_batchcomment()\r
 455         {\r
 456                 global $member;\r
 457                 \r
 458                 $member->isLoggedIn() or self::disallow();\r
 459                 \r
 460                 $selected       = requestIntArray('batch');\r
 461                 $action         = requestVar('batchaction');\r
 462                 \r
 463                 // Show error when no items were selected\r
 464                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 465                 {\r
 466                         self::error(_BATCH_NOSELECTION);\r
 467                 }\r
 468                 \r
 469                 // On delete: check if confirmation has been given\r
 470                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 471                 {\r
 472                         self::batchAskDeleteConfirmation('comment', $selected);\r
 473                 }\r
 474                 \r
 475                 self::$skin->parse('batchcomment');\r
 476                 return;\r
 477         }\r
 478         \r
 479         /**\r
 480          * Admin::setAdminAction()\r
 481          *\r
 482          * @param       string  $action\r
 483          * @return      void\r
 484          */\r
 485         static public function setAdminAction($action)\r
 486         {\r
 487                 self::$action = $action;\r
 488                 return;\r
 489         }\r
 490         \r
 491         /**\r
 492          * Admin::action_batchmember()\r
 493          * \r
 494          * @param       void\r
 495          * @return      void\r
 496          */\r
 497         static private function action_batchmember()\r
 498         {\r
 499                 global $member;\r
 500                 \r
 501                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 502                 \r
 503                 $selected       = requestIntArray('batch');\r
 504                 $action         = requestVar('batchaction');\r
 505                 \r
 506                 // Show error when no members selected\r
 507                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 508                 {\r
 509                         self::error(_BATCH_NOSELECTION);\r
 510                 }\r
 511                 \r
 512                 // On delete: check if confirmation has been given\r
 513                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 514                 {\r
 515                         self::batchAskDeleteConfirmation('member',$selected);\r
 516                 }\r
 517                 \r
 518                 self::$skin->parse('batchmember');\r
 519                 return;\r
 520         }\r
 521         \r
 522         /**\r
 523          * Admin::action_batchteam()\r
 524          * \r
 525          * @param       void\r
 526          * @return      void\r
 527          */\r
 528         static private function action_batchteam()\r
 529         {\r
 530                 global $member;\r
 531                 \r
 532                 $blogid = intRequestVar('blogid');\r
 533                 \r
 534                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 535                 \r
 536                 $selected       = requestIntArray('batch');\r
 537                 $action         = requestVar('batchaction');\r
 538                 \r
 539                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 540                 {\r
 541                         self::error(_BATCH_NOSELECTION);\r
 542                 }\r
 543                 \r
 544                 // On delete: check if confirmation has been given\r
 545                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 546                 {\r
 547                         self::batchAskDeleteConfirmation('team',$selected);\r
 548                 }\r
 549                 \r
 550                 self::$skin->parse('batchteam');\r
 551                 return;\r
 552         }\r
 553         \r
 554         /**\r
 555          * Admin::action_batchcategory()\r
 556          * \r
 557          * @param       void\r
 558          * @return      void\r
 559          */\r
 560         static private function action_batchcategory()\r
 561         {\r
 562                 global $member, $manager;\r
 563                 \r
 564                 $member->isLoggedIn() or self::disallow();\r
 565                 \r
 566                 $selected       = requestIntArray('batch');\r
 567                 $action         = requestVar('batchaction');\r
 568                 \r
 569                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 570                 {\r
 571                         self::error(_BATCH_NOSELECTION);\r
 572                 }\r
 573                 \r
 574                 // On move: when no destination blog chosen, show choice now\r
 575                 $destBlogId = intRequestVar('destblogid');\r
 576                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 577                 {\r
 578                         self::batchMoveCategorySelectDestination('category', $selected);\r
 579                 }\r
 580                 \r
 581                 // On delete: check if confirmation has been given\r
 582                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 583                 {\r
 584                         self::batchAskDeleteConfirmation('category', $selected);\r
 585                 }\r
 586                 \r
 587                 self::$skin->parse('batchcategory');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::$skin->parse('batchmove');\r
 604                 return;\r
 605         }\r
 606         \r
 607         /**\r
 608          * Admin::batchMoveCategorySelectDestination()\r
 609          * \r
 610          * @param       string  $type   type of batch action\r
 611          * @param       integer $ids    needless???\r
 612          * @return      void\r
 613          * \r
 614          * TODO: remove needless argument\r
 615          */\r
 616         static private function batchMoveCategorySelectDestination($type, $ids)\r
 617         {\r
 618                 $_POST['batchmove'] = $type;\r
 619                 global $manager;\r
 620                 self::$skin->parse('batchmovecat');\r
 621                 return;\r
 622         }\r
 623         \r
 624         /**\r
 625          * Admin::batchAskDeleteConfirmation()\r
 626          * \r
 627          * @param       string  $type   type of batch action\r
 628          * @param       integer $ids    needless???\r
 629          * @return      void\r
 630          * \r
 631          * TODO: remove needless argument\r
 632          */\r
 633         static private function batchAskDeleteConfirmation($type, $ids)\r
 634         {\r
 635                 self::$skin->parse('batchdelete');\r
 636                 return;\r
 637         }\r
 638         \r
 639         /**\r
 640          * Admin::action_browseownitems()\r
 641          * \r
 642          * @param       void\r
 643          * @return      void\r
 644          */\r
 645         static private function action_browseownitems()\r
 646         {\r
 647                 global $member, $manager, $CONF;\r
 648                 \r
 649                 self::$skin->parse('browseownitems');\r
 650                 return;\r
 651         }\r
 652         \r
 653         /**\r
 654          * Admin::action_itemcommentlist()\r
 655          * Show all the comments for a given item\r
 656          * \r
 657          * @param       integer $itemid ID for item\r
 658          * @return      void\r
 659          */\r
 660         static private function action_itemcommentlist($itemid = '')\r
 661         {\r
 662                 global $member, $manager, $CONF;\r
 663                 \r
 664                 if ( $itemid == '' )\r
 665                 {\r
 666                         $itemid = intRequestVar('itemid');\r
 667                 }\r
 668                 \r
 669                 /* TODO: we consider to use the other way insterad of this */\r
 670                 $_REQUEST['itemid'] = $itemid;\r
 671                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 672                 \r
 673                 // only allow if user is allowed to alter item\r
 674                 $member->canAlterItem($itemid) or self::disallow();\r
 675                 \r
 676                 $blogid = getBlogIdFromItemId($itemid);\r
 677                 \r
 678                 self::$skin->parse('itemcommentlist');\r
 679                 return;\r
 680         }\r
 681         \r
 682         /**\r
 683          * Admin::action_browseowncomments()\r
 684          * Browse own comments\r
 685          * \r
 686          * @param       void\r
 687          * @return      void\r
 688          */\r
 689         static private function action_browseowncomments()\r
 690         {\r
 691                 self::$skin->parse('browseowncomments');\r
 692                 return;\r
 693         }\r
 694         \r
 695         /**\r
 696          * Admin::action_blogcommentlist()\r
 697          * Browse all comments for a weblog\r
 698          * \r
 699          * @param       integer $blogid ID for weblog\r
 700          * @return      void\r
 701          */\r
 702         static private function action_blogcommentlist($blogid = '')\r
 703         {\r
 704                 global $member, $manager, $CONF;\r
 705                 \r
 706                 if ( $blogid == '' )\r
 707                 {\r
 708                         $blogid = intRequestVar('blogid');\r
 709                 }\r
 710                 else\r
 711                 {\r
 712                         $blogid = intval($blogid);\r
 713                 }\r
 714                 \r
 715                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 716                 \r
 717                 /* TODO: we consider to use the other way insterad of this */\r
 718                 $_REQUEST['blogid'] = $blogid;\r
 719                 \r
 720                 self::$skin->parse('blogcommentlist');\r
 721                 return;\r
 722         }\r
 723         \r
 724         /**\r
 725          * Admin::action_createaccount()\r
 726          * \r
 727          * @param       void\r
 728          * @return      void\r
 729          */\r
 730         static private function action_createaccount()\r
 731         {\r
 732                 global $CONF;\r
 733                 \r
 734                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 735                 {\r
 736                         self::$skin->parse('createaccountdisable');\r
 737                         return;\r
 738                 }\r
 739                 \r
 740                 $name = '';\r
 741                 $realname ='';\r
 742                 $email = '';\r
 743                 $url = '';\r
 744                 \r
 745                 $contents = array(\r
 746                         'name'          => '',\r
 747                         'realname'      => '',\r
 748                         'email'         => '',\r
 749                         'url'           => ''\r
 750                 );\r
 751                 \r
 752                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 753                 {\r
 754                         $action = new Action();\r
 755                         $message = $action->createAccount();\r
 756                         if ( $message === 1 )\r
 757                         {\r
 758                                 self::$headMess = $message;\r
 759                                 self::$skin->parse('createaccountsuccess');\r
 760                                 return;\r
 761                         }\r
 762                         \r
 763                         /* TODO: validation */\r
 764                         if ( array_key_exists('name', $_POST) )\r
 765                         {\r
 766                                 $contents['name'] = $_POST['name'];\r
 767                         }\r
 768                         if ( array_key_exists('realname', $_POST) )\r
 769                         {\r
 770                                 $contents['realname'] = $_POST['realname'];\r
 771                         }\r
 772                         if ( array_key_exists('email', $_POST) )\r
 773                         {\r
 774                                 $contents['email'] = $_POST['email'];\r
 775                         }\r
 776                         if ( array_key_exists('url', $_POST) )\r
 777                         {\r
 778                                 $contents['url'] = $_POST['url'];\r
 779                         }\r
 780                         \r
 781                         self::$contents = $contents;\r
 782                         \r
 783                 }\r
 784                 \r
 785                 self::$skin->parse('createaccountinput');\r
 786                 return;\r
 787         }\r
 788         \r
 789         /**\r
 790          * Admin::action_createitem()\r
 791          * Provide a page to item a new item to the given blog\r
 792          * \r
 793          * @param       void\r
 794          * @return      void\r
 795          */\r
 796         static private function action_createitem()\r
 797         {\r
 798                 global $member, $manager;\r
 799                 \r
 800                 $blogid = intRequestVar('blogid');\r
 801                 \r
 802                 // check if allowed\r
 803                 $member->teamRights($blogid) or self::disallow();\r
 804                 \r
 805                 $blog =& $manager->getBlog($blogid);\r
 806                 $contents = array();\r
 807                 \r
 808                 $data = array(\r
 809                         'blog'          => &$blog,\r
 810                         'contents'      => &$contents\r
 811                 );\r
 812                 $manager->notify('PreAddItemForm', $data);\r
 813                 \r
 814                 if ( $blog->convertBreaks() )\r
 815                 {\r
 816                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 817                         {\r
 818                                 $contents['body'] = removeBreaks($contents['body']);\r
 819                         }\r
 820                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 821                         {\r
 822                                 $contents['more'] = removeBreaks($contents['more']);\r
 823                         }\r
 824                 }\r
 825                 \r
 826                 self::$blog = &$blog;\r
 827                 self::$contents = &$contents;\r
 828                 \r
 829                 self::$skin->parse('createitem');\r
 830                 return;\r
 831         }\r
 832         \r
 833         /**\r
 834          * Admin::action_itemedit()\r
 835          * \r
 836          * @param       void\r
 837          * @return      void\r
 838          */\r
 839         static private function action_itemedit()\r
 840         {\r
 841                 global $member, $manager;\r
 842                 \r
 843                 $itemid = intRequestVar('itemid');\r
 844                 \r
 845                 // only allow if user is allowed to alter item\r
 846                 $member->canAlterItem($itemid) or self::disallow();\r
 847                 \r
 848                 $blogid = getBlogIDFromItemID($itemid);\r
 849                 $blog =& $manager->getBlog($blogid);\r
 850                 \r
 851                 $contents =& $manager->getItem($itemid, 1, 1);\r
 852                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$contents));\r
 853                 \r
 854                 if ( $blog->convertBreaks() )\r
 855                 {\r
 856                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 857                         {\r
 858                                 $contents['body'] = removeBreaks($contents['body']);\r
 859                         }\r
 860                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 861                         {\r
 862                                 $contents['more'] = removeBreaks($contents['more']);\r
 863                         }\r
 864                 }\r
 865                 \r
 866                 self::$blog = &$blog;\r
 867                 self::$contents = &$contents;\r
 868                 \r
 869                 self::$skin->parse('itemedit');\r
 870                 return;\r
 871         }\r
 872         \r
 873         /**\r
 874          * Admin::action_itemupdate()\r
 875          * \r
 876          * @param       void\r
 877          * @return      void\r
 878          */\r
 879         static private function action_itemupdate()\r
 880         {\r
 881                 global $member, $manager, $CONF;\r
 882                 \r
 883                 $itemid = intRequestVar('itemid');\r
 884                 $catid  = postVar('catid');\r
 885                 \r
 886                 // only allow if user is allowed to alter item\r
 887                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 888                 \r
 889                 $actiontype = postVar('actiontype');\r
 890                 \r
 891                 // delete actions are handled by itemdelete (which has confirmation)\r
 892                 if ( $actiontype == 'delete' )\r
 893                 {\r
 894                         self::action_itemdelete();\r
 895                         return;\r
 896                 }\r
 897                 \r
 898                 $body           = postVar('body');\r
 899                 $title          = postVar('title');\r
 900                 $more           = postVar('more');\r
 901                 $closed         = intPostVar('closed');\r
 902                 $draftid        = intPostVar('draftid');\r
 903                 \r
 904                 // default action = add now\r
 905                 if ( !$actiontype )\r
 906                 {\r
 907                         $actiontype='addnow';\r
 908                 }\r
 909                 \r
 910                 // create new category if needed\r
 911                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 912                 {\r
 913                         // get blogid\r
 914                         list($blogid) = sscanf($catid,"newcat-%d");\r
 915                         \r
 916                         // create\r
 917                         $blog =& $manager->getBlog($blogid);\r
 918                         $catid = $blog->createNewCategory();\r
 919                         \r
 920                         // show error when sth goes wrong\r
 921                         if ( !$catid )\r
 922                         {\r
 923                                 self::doError(_ERROR_CATCREATEFAIL);\r
 924                         }\r
 925                 }\r
 926                 \r
 927                 /*\r
 928                         set some variables based on actiontype\r
 929 \r
 930                         actiontypes:\r
 931                                 draft items -> addnow, addfuture, adddraft, delete\r
 932                                 non-draft items -> edit, changedate, delete\r
 933 \r
 934                         variables set:\r
 935                                 $timestamp: set to a nonzero value for future dates or date changes\r
 936                                 $wasdraft: set to 1 when the item used to be a draft item\r
 937                                 $publish: set to 1 when the edited item is not a draft\r
 938          */\r
 939                 $blogid =  getBlogIDFromItemID($itemid);\r
 940                 $blog   =& $manager->getBlog($blogid);\r
 941                 \r
 942                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 943                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 944                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 945                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 946                 {\r
 947                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 948                 }\r
 949                 else\r
 950                 {\r
 951                         $timestamp =0;\r
 952                 }\r
 953                 \r
 954                 // edit the item for real\r
 955                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 956                 \r
 957                 self::updateFuturePosted($blogid);\r
 958                 \r
 959                 if ( $draftid > 0 )\r
 960                 {\r
 961                         // delete permission is checked inside Item::delete()\r
 962                         Item::delete($draftid);\r
 963                 }\r
 964                 \r
 965                 if ( $catid != intPostVar('catid') )\r
 966                 {\r
 967                         self::action_categoryedit(\r
 968                                 $catid,\r
 969                                 $blog->getID(),\r
 970                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 971                         );\r
 972                 }\r
 973                 else\r
 974                 {\r
 975                         // TODO: set start item correctly for itemlist\r
 976                         $item =& $manager->getitem($itemid, 0, 0);\r
 977                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 978                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 979                         $cnt  = DB::getValue($query);\r
 980                         $_REQUEST['start'] = $cnt + 1;\r
 981                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 982                 }\r
 983                 return;\r
 984         }\r
 985         \r
 986         /**\r
 987          * Admin::action_itemdelete()\r
 988          * Delete item\r
 989          * \r
 990          * @param       Void\r
 991          * @return      Void\r
 992          */\r
 993         static private function action_itemdelete()\r
 994         {\r
 995                 global $member, $manager;\r
 996                 \r
 997                 $itemid = intRequestVar('itemid');\r
 998                 \r
 999                 // only allow if user is allowed to alter item\r
1000                 $member->canAlterItem($itemid) or self::disallow();\r
1001                 \r
1002                 if ( !$manager->existsItem($itemid,1,1) )\r
1003                 {\r
1004                         self::error(_ERROR_NOSUCHITEM);\r
1005                 }\r
1006                 \r
1007                 self::$skin->parse('itemdelete');\r
1008                 return;\r
1009         }\r
1010         \r
1011         /**\r
1012          * Admin::action_itemdeleteconfirm()\r
1013          * \r
1014          * @param       void\r
1015          * @return      void\r
1016          */\r
1017         static private function action_itemdeleteconfirm()\r
1018         {\r
1019                 global $member;\r
1020                 \r
1021                 $itemid = intRequestVar('itemid');\r
1022                 \r
1023                 // only allow if user is allowed to alter item\r
1024                 $member->canAlterItem($itemid) or self::disallow();\r
1025                 \r
1026                 // get blogid first\r
1027                 $blogid = getBlogIdFromItemId($itemid);\r
1028                 \r
1029                 // delete item (note: some checks will be performed twice)\r
1030                 self::deleteOneItem($itemid);\r
1031                 \r
1032                 self::action_itemlist($blogid);\r
1033                 return;\r
1034         }\r
1035         \r
1036         /**\r
1037          * Admin::deleteOneItem()\r
1038          * Deletes one item and returns error if something goes wrong\r
1039          * \r
1040          * @param       integer $itemid ID for item\r
1041          * @return      void\r
1042          */\r
1043         static public function deleteOneItem($itemid)\r
1044         {\r
1045                 global $member, $manager;\r
1046                 \r
1047                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1048                 if ( !$member->canAlterItem($itemid) )\r
1049                 {\r
1050                         return _ERROR_DISALLOWED;\r
1051                 }\r
1052                 \r
1053                 // need to get blogid before the item is deleted\r
1054                 $blogid = getBlogIDFromItemId($itemid);\r
1055                 \r
1056                 $manager->loadClass('ITEM');\r
1057                 Item::delete($itemid);\r
1058                 \r
1059                 // update blog's futureposted\r
1060                 self::updateFuturePosted($blogid);\r
1061                 return;\r
1062         }\r
1063         \r
1064         /**\r
1065          * Admin::updateFuturePosted()\r
1066          * Update a blog's future posted flag\r
1067          * \r
1068          * @param integer $blogid\r
1069          * @return      void\r
1070          */\r
1071         static private function updateFuturePosted($blogid)\r
1072         {\r
1073                 global $manager;\r
1074                 \r
1075                 $blogid                 =  intval($blogid);\r
1076                 $blog                   =& $manager->getBlog($blogid);\r
1077                 $currenttime    =  $blog->getCorrectTime(time());\r
1078                 \r
1079                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1080                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1081                 $result = DB::getResult($query);\r
1082                 \r
1083                 if ( $result->rowCount() > 0 )\r
1084                 {\r
1085                                 $blog->setFuturePost();\r
1086                 }\r
1087                 else\r
1088                 {\r
1089                                 $blog->clearFuturePost();\r
1090                 }\r
1091                 return;\r
1092         }\r
1093 \r
1094         /**\r
1095          * Admin::action_itemmove()\r
1096          * \r
1097          * @param       void\r
1098          * @return      void\r
1099          */\r
1100         static private function action_itemmove()\r
1101         {\r
1102                 global $member, $manager;\r
1103                 \r
1104                 $itemid = intRequestVar('itemid');\r
1105                 \r
1106                 $member->canAlterItem($itemid) or self::disallow();\r
1107                 \r
1108                 self::$skin->parse('itemmove');\r
1109                 return;\r
1110         }\r
1111         \r
1112         /**\r
1113          * Admin::action_itemmoveto()\r
1114          * \r
1115          * @param       void\r
1116          * @return      void\r
1117          */\r
1118         static private function action_itemmoveto()\r
1119         {\r
1120                 global $member, $manager;\r
1121                 \r
1122                 $itemid = intRequestVar('itemid');\r
1123                 $catid = requestVar('catid');\r
1124                 \r
1125                 // create new category if needed\r
1126                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1127                 {\r
1128                         // get blogid\r
1129                         list($blogid) = sscanf($catid,'newcat-%d');\r
1130                         \r
1131                         // create\r
1132                         $blog =& $manager->getBlog($blogid);\r
1133                         $catid = $blog->createNewCategory();\r
1134                         \r
1135                         // show error when sth goes wrong\r
1136                         if ( !$catid )\r
1137                         {\r
1138                                 self::doError(_ERROR_CATCREATEFAIL);\r
1139                         }\r
1140                 }\r
1141                 \r
1142                 // only allow if user is allowed to alter item\r
1143                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1144                 \r
1145                 $old_blogid = getBlogIDFromItemId($itemid);\r
1146                 \r
1147                 Item::move($itemid, $catid);\r
1148                 \r
1149                 // set the futurePosted flag on the blog\r
1150                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1151                 \r
1152                 // reset the futurePosted in case the item is moved from one blog to another\r
1153                 self::updateFuturePosted($old_blogid);\r
1154                 \r
1155                 if ( $catid != intRequestVar('catid') )\r
1156                 {\r
1157                         self::action_categoryedit($catid, $blog->getID());\r
1158                 }\r
1159                 else\r
1160                 {\r
1161                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1162                 }\r
1163                 return;\r
1164         }\r
1165         \r
1166         /**\r
1167          * Admin::moveOneItem()\r
1168          * Moves one item to a given category (category existance should be checked by caller)\r
1169          * errors are returned\r
1170          * \r
1171          * @param       integer $itemid         ID for item\r
1172          * @param       integer $destCatid      ID for category to which the item will be moved\r
1173          * @return      void\r
1174          */\r
1175         static public function moveOneItem($itemid, $destCatid)\r
1176         {\r
1177                 global $member;\r
1178                 \r
1179                 // only allow if user is allowed to move item\r
1180                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1181                 {\r
1182                         return _ERROR_DISALLOWED;\r
1183                 }\r
1184                 \r
1185                 Item::move($itemid, $destCatid);\r
1186                 return;\r
1187         }\r
1188         \r
1189         /**\r
1190          * Admin::action_additem()\r
1191          * Adds a item to the chosen blog\r
1192          * \r
1193          * @param       void\r
1194          * @return      void\r
1195          */\r
1196         static private function action_additem()\r
1197         {\r
1198                 global $manager, $CONF;\r
1199                 \r
1200                 $manager->loadClass('ITEM');\r
1201                 \r
1202                 $result = Item::createFromRequest();\r
1203                 \r
1204                 if ( $result['status'] == 'error' )\r
1205                 {\r
1206                         self::error($result['message']);\r
1207                 }\r
1208                 \r
1209                 $itemid = (integer) $result['itemid'];\r
1210                 \r
1211                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1212                 \r
1213                 if ( $result['status'] == 'newcategory' )\r
1214                 {\r
1215                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1216                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1217                 }\r
1218                 else\r
1219                 {\r
1220                         $methodName = 'action_itemlist';\r
1221                         self::action_itemlist($blogid);\r
1222                 }\r
1223                 return;\r
1224         }\r
1225         \r
1226         /**\r
1227          * Admin::action_commentedit()\r
1228          * Allows to edit previously made comments\r
1229          * \r
1230          * @param       void\r
1231          * @return      void\r
1232          */\r
1233         static private function action_commentedit()\r
1234         {\r
1235                 global $member, $manager;\r
1236                 \r
1237                 $commentid = intRequestVar('commentid');\r
1238                 \r
1239                 $member->canAlterComment($commentid) or self::disallow();\r
1240                 \r
1241                 self::$skin->parse('commentedit');\r
1242                 return;\r
1243         }\r
1244         \r
1245         /**\r
1246          * Admin::action_commentupdate()\r
1247          * \r
1248          * @param       void\r
1249          * @return      void\r
1250          */\r
1251         static private function action_commentupdate()\r
1252         {\r
1253                 global $member, $manager;\r
1254                 \r
1255                 $commentid = intRequestVar('commentid');\r
1256                 \r
1257                 $member->canAlterComment($commentid) or self::disallow();\r
1258                 \r
1259                 $url    = postVar('url');\r
1260                 $email  = postVar('email');\r
1261                 $body   = postVar('body');\r
1262                 \r
1263                 // intercept words that are too long\r
1264                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1265                 {\r
1266                         self::error(_ERROR_COMMENT_LONGWORD);\r
1267                 }\r
1268                 \r
1269                 // check length\r
1270                 if ( i18n::strlen($body) < 3 )\r
1271                 {\r
1272                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1273                 }\r
1274                 \r
1275                 if ( i18n::strlen($body) > 5000 )\r
1276                 {\r
1277                         self::error(_ERROR_COMMENT_TOOLONG);\r
1278                 }\r
1279                 \r
1280                 // prepare body\r
1281                 $body = Comment::prepareBody($body);\r
1282                 \r
1283                 // call plugins\r
1284                 $data = array(\r
1285                         'body' => &$body\r
1286                 );\r
1287                 $manager->notify('PreUpdateComment', $data);\r
1288                 \r
1289                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1290                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1291                 DB::execute($query);\r
1292                 \r
1293                 // get itemid\r
1294                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1295                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1296                 \r
1297                 $itemid = DB::getValue($query);\r
1298                 \r
1299                 if ( $member->canAlterItem($itemid) )\r
1300                 {\r
1301                         self::action_itemcommentlist($itemid);\r
1302                 }\r
1303                 else\r
1304                 {\r
1305                         self::action_browseowncomments();\r
1306                 }\r
1307                 return;\r
1308         }\r
1309         \r
1310         /**\r
1311          * Admin::action_commentdelete()\r
1312          * Update comment\r
1313          * \r
1314          * @param       void\r
1315          * @return      void\r
1316          */\r
1317         static private function action_commentdelete()\r
1318         {\r
1319                 global $member, $manager;\r
1320                 \r
1321                 $commentid = intRequestVar('commentid');\r
1322                 $member->canAlterComment($commentid) or self::disallow();\r
1323                 \r
1324                 self::$skin->parse('commentdelete');\r
1325                 return;\r
1326         }\r
1327         \r
1328         /**\r
1329          * Admin::action_commentdeleteconfirm()\r
1330          * \r
1331          * @param       void\r
1332          * @return      void\r
1333          */\r
1334         static private function action_commentdeleteconfirm()\r
1335         {\r
1336                 global $member;\r
1337                 \r
1338                 $commentid = intRequestVar('commentid');\r
1339                 \r
1340                 // get item id first\r
1341                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1342                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1343                 \r
1344                 $itemid = DB::getValue($query);\r
1345                 \r
1346                 $error = self::deleteOneComment($commentid);\r
1347                 if ( $error )\r
1348                 {\r
1349                         self::doError($error);\r
1350                 }\r
1351                 \r
1352                 if ( $member->canAlterItem($itemid) )\r
1353                 {\r
1354                         self::action_itemcommentlist($itemid);\r
1355                 }\r
1356                 else\r
1357                 {\r
1358                         self::action_browseowncomments();\r
1359                 }\r
1360                 return;\r
1361         }\r
1362         \r
1363         /**\r
1364          * Admin::deleteOneComment()\r
1365          * \r
1366          * @param       integer $commentid      ID for comment\r
1367          * @return      void\r
1368          */\r
1369         static public function deleteOneComment($commentid)\r
1370         {\r
1371                 global $member, $manager;\r
1372                 \r
1373                 $commentid = (integer) $commentid;\r
1374                 \r
1375                 if ( !$member->canAlterComment($commentid) )\r
1376                 {\r
1377                         return _ERROR_DISALLOWED;\r
1378                 }\r
1379                 \r
1380                 $data = array(\r
1381                         'commentid' => $commentid\r
1382                 );\r
1383                 \r
1384                 $manager->notify('PreDeleteComment', $data);\r
1385                 \r
1386                 // delete the comments associated with the item\r
1387                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1388                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1389                 DB::execute($query);\r
1390                 \r
1391                 $data = array(\r
1392                         'commentid' => $commentid\r
1393                 );\r
1394                 \r
1395                 $manager->notify('PostDeleteComment', $data);\r
1396                 \r
1397                 return '';\r
1398         }\r
1399         \r
1400         /**\r
1401          * Admin::action_usermanagement()\r
1402          * Usermanagement main\r
1403          * \r
1404          * @param       void\r
1405          * @return      void\r
1406          */\r
1407         static private function action_usermanagement()\r
1408         {\r
1409                 global $member, $manager;\r
1410                 \r
1411                 // check if allowed\r
1412                 $member->isAdmin() or self::disallow();\r
1413                 \r
1414                 self::$skin->parse('usermanagement');\r
1415                 return;\r
1416         }\r
1417         \r
1418         /**\r
1419          * Admin::action_memberedit()\r
1420          * Edit member settings\r
1421          * \r
1422          * @param       void\r
1423          * @return      void\r
1424          */\r
1425         static private function action_memberedit()\r
1426         {\r
1427                 self::action_editmembersettings(intRequestVar('memberid'));\r
1428                 return;\r
1429         }\r
1430         \r
1431         /**\r
1432          * Admin::action_editmembersettings()\r
1433          * \r
1434          * @param       integer $memberid       ID for member\r
1435          * @return      void\r
1436          * \r
1437          */\r
1438         static private function action_editmembersettings($memberid = '')\r
1439         {\r
1440                 global $member, $manager, $CONF;\r
1441                 \r
1442                 if ( $memberid == '' )\r
1443                 {\r
1444                         $memberid = $member->getID();\r
1445                 }\r
1446                 \r
1447                 /* TODO: we should consider to use the other way insterad of this */\r
1448                 $_REQUEST['memberid'] = $memberid;\r
1449                 \r
1450                 // check if allowed\r
1451                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1452                 \r
1453                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1454                 \r
1455                 self::$skin->parse('editmembersettings');\r
1456                 return;\r
1457         }\r
1458         \r
1459         /**\r
1460          * Admin::action_changemembersettings()\r
1461          * \r
1462          * @param       void\r
1463          * @return      void\r
1464          */\r
1465         static private function action_changemembersettings()\r
1466         {\r
1467                 global $member, $CONF, $manager;\r
1468                 \r
1469                 $memberid = intRequestVar('memberid');\r
1470                 \r
1471                 // check if allowed\r
1472                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1473                 \r
1474                 $name                   = trim(strip_tags(postVar('name')));\r
1475                 $realname               = trim(strip_tags(postVar('realname')));\r
1476                 $password               = postVar('password');\r
1477                 $repeatpassword = postVar('repeatpassword');\r
1478                 $email                  = strip_tags(postVar('email'));\r
1479                 $url                    = strip_tags(postVar('url'));\r
1480                 $adminskin              = intPostVar('adminskin');\r
1481                 \r
1482                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1483                 if ( !preg_match('#^https?://#', $url) )\r
1484                 {\r
1485                         $url = 'http://' . $url;\r
1486                 }\r
1487                 \r
1488                 $admin          = postVar('admin');\r
1489                 $canlogin       = postVar('canlogin');\r
1490                 $notes          = strip_tags(postVar('notes'));\r
1491                 $locale         = postVar('locale');\r
1492                 \r
1493                 $mem =& $manager->getMember($memberid);\r
1494                 \r
1495                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1496                 {\r
1497                         if ( !isValidDisplayName($name) )\r
1498                         {\r
1499                                 self::error(_ERROR_BADNAME);\r
1500                         }\r
1501                         \r
1502                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1503                         {\r
1504                                 self::error(_ERROR_NICKNAMEINUSE);\r
1505                         }\r
1506                         \r
1507                         if ( $password != $repeatpassword )\r
1508                         {\r
1509                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1510                         }\r
1511                         \r
1512                         if ( $password && (i18n::strlen($password) < 6) )\r
1513                         {\r
1514                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1515                         }\r
1516                                 \r
1517                         if ( $password )\r
1518                         {\r
1519                                 $pwdvalid = true;\r
1520                                 $pwderror = '';\r
1521                                 \r
1522                                 $data = array(\r
1523                                         'password'     => $password,\r
1524                                         'errormessage' => &$pwderror,\r
1525                                         'valid'        => &$pwdvalid\r
1526                                 );\r
1527                                 $manager->notify('PrePasswordSet', $data);\r
1528                                 \r
1529                                 if ( !$pwdvalid )\r
1530                                 {\r
1531                                         self::error($pwderror);\r
1532                                 }\r
1533                         }\r
1534                 }\r
1535                 \r
1536                 if ( !NOTIFICATION::address_validation($email) )\r
1537                 {\r
1538                         self::error(_ERROR_BADMAILADDRESS);\r
1539                 }\r
1540                 if ( !$realname )\r
1541                 {\r
1542                         self::error(_ERROR_REALNAMEMISSING);\r
1543                 }\r
1544                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1545                 {\r
1546                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1547                 }\r
1548                 \r
1549                 // check if there will remain at least one site member with both the logon and admin rights\r
1550                 // (check occurs when taking away one of these rights from such a member)\r
1551                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1552                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1553                         )\r
1554                 {\r
1555                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1556                         if ( $r->rowCount() < 2 )\r
1557                         {\r
1558                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1559                         }\r
1560                 }\r
1561                 \r
1562                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1563                 {\r
1564                         $mem->setDisplayName($name);\r
1565                         if ( $password )\r
1566                         {\r
1567                                 $mem->setPassword($password);\r
1568                         }\r
1569                 }\r
1570                 \r
1571                 $oldEmail = $mem->getEmail();\r
1572                 \r
1573                 $mem->setRealName($realname);\r
1574                 $mem->setEmail($email);\r
1575                 $mem->setURL($url);\r
1576                 $mem->setNotes($notes);\r
1577                 $mem->setLocale($locale);\r
1578                 \r
1579                 // only allow super-admins to make changes to the admin status\r
1580                 if ( $member->isAdmin() )\r
1581                 {\r
1582                         $mem->setAdmin($admin);\r
1583                         $mem->setCanLogin($canlogin);\r
1584                 }\r
1585                 \r
1586                 $autosave = postVar('autosave');\r
1587                 $mem->setAutosave($autosave);\r
1588                 \r
1589                 $mem->write();\r
1590                 \r
1591                 // store plugin options\r
1592                 $aOptions = requestArray('plugoption');\r
1593                 NucleusPlugin::apply_plugin_options($aOptions);\r
1594                 $data = array(\r
1595                         'context'  => 'member',\r
1596                         'memberid' => $memberid,\r
1597                         'member'   => &$mem\r
1598                 );\r
1599                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1600                 \r
1601                 // if email changed, generate new password\r
1602                 if ( $oldEmail != $mem->getEmail() )\r
1603                 {\r
1604                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1605                         // logout member\r
1606                         $mem->newCookieKey();\r
1607                         \r
1608                         // only log out if the member being edited is the current member.\r
1609                         if ( $member->getID() == $memberid )\r
1610                         {\r
1611                                 $member->logout();\r
1612                         }\r
1613                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1614                         return;\r
1615                 }\r
1616                 \r
1617                 if ( ($mem->getID() == $member->getID())\r
1618                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1619                 {\r
1620                         $mem->newCookieKey();\r
1621                         $member->logout();\r
1622                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1623                 }\r
1624                 else\r
1625                 {\r
1626                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1627                 }\r
1628                 return;\r
1629         }\r
1630 \r
1631         /**\r
1632          * Admin::action_memberadd()\r
1633          * \r
1634          * @param       void\r
1635          * @return      void\r
1636          * \r
1637          */\r
1638         static private function action_memberadd()\r
1639         {\r
1640                 global $member, $manager;\r
1641                 \r
1642                 // check if allowed\r
1643                 $member->isAdmin() or self::disallow();\r
1644                 \r
1645                 if ( postVar('password') != postVar('repeatpassword') )\r
1646                 {\r
1647                         self::error(_ERROR_PASSWORDMISMATCH);\r
1648                 }\r
1649                 \r
1650                 if ( i18n::strlen(postVar('password')) < 6 )\r
1651                 {\r
1652                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1653                 }\r
1654                 \r
1655                 $res = Member::create(\r
1656                         postVar('name'),\r
1657                         postVar('realname'),\r
1658                         postVar('password'),\r
1659                         postVar('email'),\r
1660                         postVar('url'),\r
1661                         postVar('admin'),\r
1662                         postVar('canlogin'),\r
1663                         postVar('notes')\r
1664                 );\r
1665                 \r
1666                 if ( $res != 1 )\r
1667                 {\r
1668                         self::error($res);\r
1669                 }\r
1670                 \r
1671                 // fire PostRegister event\r
1672                 $newmem = new Member();\r
1673                 $newmem->readFromName(postVar('name'));\r
1674                 $data = array(\r
1675                         'member' => &$newmem\r
1676                 );\r
1677                 $manager->notify('PostRegister', $data);\r
1678                 \r
1679                 self::action_usermanagement();\r
1680                 return;\r
1681         }\r
1682         \r
1683         /**\r
1684          * Admin::action_forgotpassword()\r
1685          * \r
1686          * @param       void\r
1687          * @return      void\r
1688          */\r
1689         static private function action_forgotpassword()\r
1690         {\r
1691                 self::$skin->parse('forgotpassword');\r
1692                 return;\r
1693         }\r
1694         \r
1695         /**\r
1696          * Admin::action_activate()\r
1697          * Account activation\r
1698          * \r
1699          * @param       void\r
1700          * @return      void\r
1701          */\r
1702         static private function action_activate()\r
1703         {\r
1704                 $key = getVar('key');\r
1705                 self::showActivationPage($key);\r
1706                 return;\r
1707         }\r
1708         \r
1709         /**\r
1710          * Admin::showActivationPage()\r
1711          * \r
1712          * @param       void\r
1713          * @return      void\r
1714          */\r
1715         static private function showActivationPage($key, $message = '')\r
1716         {\r
1717                 global $manager;\r
1718                 \r
1719                 // clean up old activation keys\r
1720                 Member::cleanupActivationTable();\r
1721                 \r
1722                 // get activation info\r
1723                 $info = Member::getActivationInfo($key);\r
1724                 \r
1725                 if ( !$info )\r
1726                 {\r
1727                         self::error(_ERROR_ACTIVATE);\r
1728                 }\r
1729                 \r
1730                 $mem =& $manager->getMember($info->vmember);\r
1731                 \r
1732                 if ( !$mem )\r
1733                 {\r
1734                         self::error(_ERROR_ACTIVATE);\r
1735                 }\r
1736                 \r
1737                 /* TODO: we should consider to use the other way insterad of this */\r
1738                 $_POST['ackey']                                 = $key;\r
1739                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1740                 \r
1741                 self::$headMess = $message;\r
1742                 self::$skin->parse('activate');\r
1743                 return;\r
1744         }\r
1745         \r
1746         /**\r
1747          * Admin::action_activatesetpwd()\r
1748          * Account activation - set password part\r
1749          * \r
1750          * @param       void\r
1751          * @return      void\r
1752          */\r
1753         static private function action_activatesetpwd()\r
1754         {\r
1755                 global $manager;\r
1756                 $key = postVar('key');\r
1757                 \r
1758                 // clean up old activation keys\r
1759                 Member::cleanupActivationTable();\r
1760                 \r
1761                 // get activation info\r
1762                 $info = Member::getActivationInfo($key);\r
1763                 \r
1764                 if ( !$info || ($info->type == 'addresschange') )\r
1765                 {\r
1766                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1767                 }\r
1768                 \r
1769                 $mem =& $manager->getMember($info->vmember);\r
1770                 \r
1771                 if ( !$mem )\r
1772                 {\r
1773                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1774                 }\r
1775                 \r
1776                 $password               = postVar('password');\r
1777                 $repeatpassword = postVar('repeatpassword');\r
1778                 \r
1779                 if ( $password != $repeatpassword )\r
1780                 {\r
1781                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1782                 }\r
1783                 \r
1784                 if ( $password && (i18n::strlen($password) < 6) )\r
1785                 {\r
1786                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1787                 }\r
1788                         \r
1789                 if ( $password )\r
1790                 {\r
1791                         $pwdvalid = true;\r
1792                         $pwderror = '';\r
1793                         \r
1794                         $data = array(\r
1795                                 'password'              => $password,\r
1796                                 'errormessage'  => &$pwderror,\r
1797                                 'valid'                 => &$pwdvalid\r
1798                         );\r
1799                         $manager->notify('PrePasswordSet', $data);\r
1800                         if ( !$pwdvalid )\r
1801                         {\r
1802                                 return self::showActivationPage($key,$pwderror);\r
1803                         }\r
1804                 }\r
1805                 \r
1806                 $error = '';\r
1807                 \r
1808                 $data = array(\r
1809                         'type'   => 'activation',\r
1810                         'member' => $mem,\r
1811                         'error'  => &$error\r
1812                 );\r
1813                 $manager->notify('ValidateForm', $data);\r
1814                 if ( $error != '' )\r
1815                 {\r
1816                         return self::showActivationPage($key, $error);\r
1817                 }\r
1818                 \r
1819                 // set password\r
1820                 $mem->setPassword($password);\r
1821                 $mem->write();\r
1822                 \r
1823                 // do the activation\r
1824                 Member::activate($key);\r
1825                 \r
1826                 self::$skin->parse('activatesetpwd');\r
1827                 return;\r
1828         }\r
1829         \r
1830         /**\r
1831          * Admin::action_manageteam()\r
1832          * Manage team\r
1833          * \r
1834          * @param       void\r
1835          * @return      void\r
1836          */\r
1837         static private function action_manageteam()\r
1838         {\r
1839                 global $member, $manager;\r
1840                 \r
1841                 $blogid = intRequestVar('blogid');\r
1842                 \r
1843                 // check if allowed\r
1844                 $member->blogAdminRights($blogid) or self::disallow();\r
1845                 \r
1846                 self::$skin->parse('manageteam');\r
1847                 return;\r
1848         }\r
1849         \r
1850         /**\r
1851          * Admin::action_teamaddmember()\r
1852          * Add member to team\r
1853          * \r
1854          * @param       void\r
1855          * @return      void\r
1856          */\r
1857         static private function action_teamaddmember()\r
1858         {\r
1859                 global $member, $manager;\r
1860                 \r
1861                 $memberid       = intPostVar('memberid');\r
1862                 $blogid         = intPostVar('blogid');\r
1863                 $admin          = intPostVar('admin');\r
1864                 \r
1865                 // check if allowed\r
1866                 $member->blogAdminRights($blogid) or self::disallow();\r
1867                 \r
1868                 $blog =& $manager->getBlog($blogid);\r
1869                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1870                 {\r
1871                         self::error(_ERROR_ALREADYONTEAM);\r
1872                 }\r
1873                 \r
1874                 self::action_manageteam();\r
1875                 return;\r
1876         }\r
1877         \r
1878         /**\r
1879          * Admin::action_teamdelete()\r
1880          * \r
1881          * @param       void\r
1882          * @return      void\r
1883          */\r
1884         static private function action_teamdelete()\r
1885         {\r
1886                 global $member, $manager;\r
1887                 \r
1888                 $memberid       = intRequestVar('memberid');\r
1889                 $blogid         = intRequestVar('blogid');\r
1890                 \r
1891                 // check if allowed\r
1892                 $member->blogAdminRights($blogid) or self::disallow();\r
1893                 \r
1894                 $teammem =& $manager->getMember($memberid);\r
1895                 $blog =& $manager->getBlog($blogid);\r
1896                 \r
1897                 self::$skin->parse('teamdelete');\r
1898                 return;\r
1899         }\r
1900         \r
1901         /**\r
1902          * Admin::action_teamdeleteconfirm()\r
1903          * \r
1904          * @param       void\r
1905          * @return      void\r
1906          */\r
1907         static private function action_teamdeleteconfirm()\r
1908         {\r
1909                 global $member;\r
1910                 \r
1911                 $memberid = intRequestVar('memberid');\r
1912                 $blogid = intRequestVar('blogid');\r
1913                 \r
1914                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1915                 if ( $error )\r
1916                 {\r
1917                         self::error($error);\r
1918                 }\r
1919                 self::action_manageteam();\r
1920                 return;\r
1921         }\r
1922         \r
1923         /**\r
1924          * Admin::deleteOneTeamMember()\r
1925          * \r
1926          * @param       void\r
1927          * @return      void\r
1928          */\r
1929         static public function deleteOneTeamMember($blogid, $memberid)\r
1930         {\r
1931                 global $member, $manager;\r
1932                 \r
1933                 $blogid   = intval($blogid);\r
1934                 $memberid = intval($memberid);\r
1935                 \r
1936                 // check if allowed\r
1937                 if ( !$member->blogAdminRights($blogid) )\r
1938                 {\r
1939                         return _ERROR_DISALLOWED;\r
1940                 }\r
1941                 \r
1942                 // check if: - there remains at least one blog admin\r
1943                 //           - (there remains at least one team member)\r
1944                 $tmem =& $manager->getMember($memberid);\r
1945                 \r
1946                 \r
1947                 $data = array(\r
1948                         'member' => &$tmem,\r
1949                         'blogid' => $blogid\r
1950                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1951                 \r
1952                 if ( $tmem->isBlogAdmin($blogid) )\r
1953                 {\r
1954                         /* TODO: why we did double check? */\r
1955                         // check if there are more blog members left and at least one admin\r
1956                         // (check for at least two admins before deletion)\r
1957                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1958                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1959                         $r     = DB::getResult($query);\r
1960                         if ( $r->rowCount() < 2 )\r
1961                         {\r
1962                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1963                         }\r
1964                 }\r
1965                 \r
1966                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1967                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1968                 DB::execute($query);\r
1969                 \r
1970                 $data = array(\r
1971                         'member' => &$tmem,\r
1972                         'blogid' => $blogid\r
1973                 );\r
1974                 $manager->notify('PostDeleteTeamMember', $data);\r
1975                 \r
1976                 return '';\r
1977         }\r
1978         \r
1979         /**\r
1980          * Admin::action_teamchangeadmin()\r
1981          * \r
1982          * @param       void\r
1983          * @return      void\r
1984          */\r
1985         static private function action_teamchangeadmin()\r
1986         {\r
1987                 global $manager, $member;\r
1988                 \r
1989                 $blogid         = intRequestVar('blogid');\r
1990                 $memberid       = intRequestVar('memberid');\r
1991                 \r
1992                 // check if allowed\r
1993                 $member->blogAdminRights($blogid) or self::disallow();\r
1994                 \r
1995                 $mem =& $manager->getMember($memberid);\r
1996                 \r
1997                 // don't allow when there is only one admin at this moment\r
1998                 if ( $mem->isBlogAdmin($blogid) )\r
1999                 {\r
2000                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2001                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2002                         $r = DB::getResult($query);\r
2003                         if ( $r->rowCount() == 1 )\r
2004                         {\r
2005                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2006                         }\r
2007                 }\r
2008                 \r
2009                 if ( $mem->isBlogAdmin($blogid) )\r
2010                 {\r
2011                         $newval = 0;\r
2012                 }\r
2013                 else\r
2014                 {\r
2015                         $newval = 1;\r
2016                 }\r
2017                 \r
2018                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2019                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2020                 DB::execute($query);\r
2021                 \r
2022                 // only show manageteam if member did not change its own admin privileges\r
2023                 if ( $member->isBlogAdmin($blogid) )\r
2024                 {\r
2025                         self::action_manageteam();\r
2026                 }\r
2027                 else\r
2028                 {\r
2029                         self::action_overview(_MSG_ADMINCHANGED);\r
2030                 }\r
2031                 return;\r
2032         }\r
2033         \r
2034         /**\r
2035          * Admin::action_blogsettings()\r
2036          * \r
2037          * @param       void\r
2038          * @return      void\r
2039          */\r
2040         static private function action_blogsettings()\r
2041         {\r
2042                 global $member, $manager;\r
2043                 \r
2044                 $blogid = intRequestVar('blogid');\r
2045                 \r
2046                 // check if allowed\r
2047                 $member->blogAdminRights($blogid) or self::disallow();\r
2048                 \r
2049                 $blog =& $manager->getBlog($blogid);\r
2050                 \r
2051                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2052                 \r
2053                 self::$skin->parse('blogsettings');\r
2054                 return;\r
2055         }\r
2056         \r
2057         /**\r
2058          * Admin::action_categorynew()\r
2059          * \r
2060          * @param       void\r
2061          * @return      void\r
2062          */\r
2063         static private function action_categorynew()\r
2064         {\r
2065                 global $member, $manager;\r
2066                 \r
2067                 $blogid = intRequestVar('blogid');\r
2068                 \r
2069                 $member->blogAdminRights($blogid) or self::disallow();\r
2070                 \r
2071                 $cname = postVar('cname');\r
2072                 $cdesc = postVar('cdesc');\r
2073                 \r
2074                 if ( !isValidCategoryName($cname) )\r
2075                 {\r
2076                         self::error(_ERROR_BADCATEGORYNAME);\r
2077                 }\r
2078                 \r
2079                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2080                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2081                 $res = DB::getResult($query);\r
2082                 if ( $res->rowCount() > 0 )\r
2083                 {\r
2084                         self::error(_ERROR_DUPCATEGORYNAME);\r
2085                 }\r
2086                 \r
2087                 $blog           =& $manager->getBlog($blogid);\r
2088                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2089                 \r
2090                 self::action_blogsettings();\r
2091                 return;\r
2092         }\r
2093         \r
2094         /**\r
2095          * Admin::action_categoryedit()\r
2096          * \r
2097          * @param       void\r
2098          * @return      void\r
2099          */\r
2100         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2101         {\r
2102                 global $member, $manager;\r
2103                 \r
2104                 if ( $blogid == '' )\r
2105                 {\r
2106                         $blogid = intGetVar('blogid');\r
2107                 }\r
2108                 else\r
2109                 {\r
2110                         $blogid = intval($blogid);\r
2111                 }\r
2112                 if ( $catid == '' )\r
2113                 {\r
2114                         $catid = intGetVar('catid');\r
2115                 }\r
2116                 else\r
2117                 {\r
2118                         $catid = intval($catid);\r
2119                 }\r
2120                 \r
2121                 /* TODO: we should consider to use the other way insterad of this */\r
2122                 $_REQUEST['blogid']             = $blogid;\r
2123                 $_REQUEST['catid']              = $catid;\r
2124                 $_REQUEST['desturl']    = $desturl;\r
2125                 $member->blogAdminRights($blogid) or self::disallow();\r
2126                 \r
2127                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2128                 \r
2129                 self::$skin->parse('categoryedit');\r
2130                 return;\r
2131         }\r
2132         \r
2133         /**\r
2134          * Admin::action_categoryupdate()\r
2135          * \r
2136          * @param       void\r
2137          * @return      void\r
2138          */\r
2139         static private function action_categoryupdate()\r
2140         {\r
2141                 global $member, $manager;\r
2142                 \r
2143                 $blogid         = intPostVar('blogid');\r
2144                 $catid          = intPostVar('catid');\r
2145                 $cname          = postVar('cname');\r
2146                 $cdesc          = postVar('cdesc');\r
2147                 $desturl        = postVar('desturl');\r
2148                 \r
2149                 $member->blogAdminRights($blogid) or self::disallow();\r
2150                 \r
2151                 if ( !isValidCategoryName($cname) )\r
2152                 {\r
2153                         self::error(_ERROR_BADCATEGORYNAME);\r
2154                 }\r
2155                 \r
2156                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2157                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2158                 $res    = DB::getResult($query);\r
2159                 if ( $res->rowCount() > 0 )\r
2160                 {\r
2161                         self::error(_ERROR_DUPCATEGORYNAME);\r
2162                 }\r
2163                 \r
2164                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2165                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2166                 DB::execute($query);\r
2167                 \r
2168                 // store plugin options\r
2169                 $aOptions = requestArray('plugoption');\r
2170                 NucleusPlugin::apply_plugin_options($aOptions);\r
2171                 $data = array(\r
2172                         'context'       => 'category',\r
2173                         'catid'         => $catid\r
2174                 );\r
2175                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2176                 \r
2177                 if ( $desturl )\r
2178                 {\r
2179                         redirect($desturl);\r
2180                         exit;\r
2181                 }\r
2182                 else\r
2183                 {\r
2184                         self::action_blogsettings();\r
2185                 }\r
2186                 return;\r
2187         }\r
2188         \r
2189         /**\r
2190          * Admin::action_categorydelete()\r
2191          * \r
2192          * @param       void\r
2193          * @return      void\r
2194          */\r
2195         static private function action_categorydelete()\r
2196         {\r
2197                 global $member, $manager;\r
2198                 \r
2199                 $blogid = intRequestVar('blogid');\r
2200                 $catid  = intRequestVar('catid');\r
2201                 \r
2202                 $member->blogAdminRights($blogid) or self::disallow();\r
2203                 \r
2204                 $blog =& $manager->getBlog($blogid);\r
2205                 \r
2206                 // check if the category is valid\r
2207                 if ( !$blog->isValidCategory($catid) )\r
2208                 {\r
2209                         self::error(_ERROR_NOSUCHCATEGORY);\r
2210                 }\r
2211                 \r
2212                 // don't allow deletion of default category\r
2213                 if ( $blog->getDefaultCategory() == $catid )\r
2214                 {\r
2215                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2216                 }\r
2217                 \r
2218                 // check if catid is the only category left for blogid\r
2219                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2220                 $query = sprintf($query, sql_table('category'), $blogid);\r
2221                 $res = DB::getResult($query);\r
2222                 if ( $res->rowCount() == 1 )\r
2223                 {\r
2224                         self::error(_ERROR_DELETELASTCATEGORY);\r
2225                 }\r
2226                 \r
2227                 self::$skin->parse('categorydelete');\r
2228                 return;\r
2229         }\r
2230         \r
2231         /**\r
2232          * Admin::action_categorydeleteconfirm()\r
2233          * \r
2234          * @param       void\r
2235          * @return      void\r
2236          */\r
2237         static private function action_categorydeleteconfirm()\r
2238         {\r
2239                 global $member, $manager;\r
2240                 \r
2241                 $blogid = intRequestVar('blogid');\r
2242                 $catid  = intRequestVar('catid');\r
2243                 \r
2244                 $member->blogAdminRights($blogid) or self::disallow();\r
2245                 \r
2246                 $error = self::deleteOneCategory($catid);\r
2247                 if ( $error )\r
2248                 {\r
2249                         self::error($error);\r
2250                 }\r
2251                 \r
2252                 self::action_blogsettings();\r
2253                 return;\r
2254         }\r
2255         \r
2256         /**\r
2257          * Admin::deleteOneCategory()\r
2258          * Delete a category by its id\r
2259          * \r
2260          * @param       String  $catid  category id for deleting\r
2261          * @return      Void\r
2262          */\r
2263         static public function deleteOneCategory($catid)\r
2264         {\r
2265                 global $manager, $member;\r
2266                 \r
2267                 $catid  = intval($catid);\r
2268                 $blogid = getBlogIDFromCatID($catid);\r
2269                 \r
2270                 if ( !$member->blogAdminRights($blogid) )\r
2271                 {\r
2272                         return ERROR_DISALLOWED;\r
2273                 }\r
2274                 \r
2275                 // get blog\r
2276                 $blog =& $manager->getBlog($blogid);\r
2277                 \r
2278                 // check if the category is valid\r
2279                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2280                 {\r
2281                         return _ERROR_NOSUCHCATEGORY;\r
2282                 }\r
2283                 \r
2284                 $destcatid = $blog->getDefaultCategory();\r
2285                 \r
2286                 // don't allow deletion of default category\r
2287                 if ( $blog->getDefaultCategory() == $catid )\r
2288                 {\r
2289                         return _ERROR_DELETEDEFCATEGORY;\r
2290                 }\r
2291                 \r
2292                 // check if catid is the only category left for blogid\r
2293                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2294                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2295                 \r
2296                 $res = DB::getResult($query);\r
2297                 if ( $res->rowCount() == 1 )\r
2298                 {\r
2299                         return _ERROR_DELETELASTCATEGORY;\r
2300                 }\r
2301                 \r
2302                 $data = array('catid' => $catid);\r
2303                 $manager->notify('PreDeleteCategory', $data);\r
2304                 \r
2305                 // change category for all items to the default category\r
2306                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2307                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2308                 DB::execute($query);\r
2309                 \r
2310                 // delete all associated plugin options\r
2311                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2312                 \r
2313                 // delete category\r
2314                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2315                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2316                 DB::execute($query);\r
2317                 \r
2318                 $data = array('catid' => $catid);\r
2319                 $manager->notify('PostDeleteCategory', $data);\r
2320                 return;\r
2321         }\r
2322         \r
2323         /**\r
2324          * Admin::moveOneCategory()\r
2325          * Delete a category by its id\r
2326          * \r
2327          * @param       int     $catid          category id for move\r
2328          * @param       int     $destblogid     blog id for destination\r
2329          * @return      void\r
2330          */\r
2331         static public function moveOneCategory($catid, $destblogid)\r
2332         {\r
2333                 global $manager, $member;\r
2334                 $catid      = intval($catid);\r
2335                 $destblogid = intval($destblogid);\r
2336                 $blogid     = getBlogIDFromCatID($catid);\r
2337                 // mover should have admin rights on both blogs\r
2338                 if (!$member->blogAdminRights($blogid)) {\r
2339                         return _ERROR_DISALLOWED;\r
2340                 }\r
2341                 if (!$member->blogAdminRights($destblogid)) {\r
2342                         return _ERROR_DISALLOWED;\r
2343                 }\r
2344                 // cannot move to self\r
2345                 if ($blogid == $destblogid) {\r
2346                         return _ERROR_MOVETOSELF;\r
2347                 }\r
2348                 // get blogs\r
2349                 $blog     =& $manager->getBlog($blogid);\r
2350                 $destblog =& $manager->getBlog($destblogid);\r
2351                 // check if the category is valid\r
2352                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2353                         return _ERROR_NOSUCHCATEGORY;\r
2354                 }\r
2355                 // don't allow default category to be moved\r
2356                 if ($blog->getDefaultCategory() == $catid) {\r
2357                         return _ERROR_MOVEDEFCATEGORY;\r
2358                 }\r
2359                 $manager->notify(\r
2360                                 'PreMoveCategory',\r
2361                                 array(\r
2362                                                 'catid'      => &$catid,\r
2363                                                 'sourceblog' => &$blog,\r
2364                                                 'destblog'   => &$destblog\r
2365                                 )\r
2366                 );\r
2367                 // update comments table (cblog)\r
2368                 $query = 'SELECT '\r
2369                 . '    inumber '\r
2370                 . 'FROM '\r
2371                 .      sql_table('item') . ' '\r
2372                 . 'WHERE '\r
2373                 . '    icat = %d';\r
2374                 $items = sql_query(sprintf($query, $catid));\r
2375                 while ($oItem = sql_fetch_object($items)) {\r
2376                         $query = 'UPDATE '\r
2377                         .      sql_table('comment') . ' '\r
2378                         . 'SET '\r
2379                         . '    cblog = %d' . ' '\r
2380                         . 'WHERE '\r
2381                         . '    citem = %d';\r
2382                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2383                 }\r
2384         \r
2385                 // update items (iblog)\r
2386                 $query = 'UPDATE '\r
2387                 .      sql_table('item') . ' '\r
2388                 . 'SET '\r
2389                 . '    iblog = %d '\r
2390                 . 'WHERE '\r
2391                 . '    icat = %d';\r
2392                 sql_query(sprintf($query, $destblogid, $catid));\r
2393         \r
2394                 // move category\r
2395                 $query = 'UPDATE '\r
2396                 .      sql_table('category') . ' '\r
2397                 . 'SET '\r
2398                 . '    cblog = %d' . ' '\r
2399                 . 'WHERE '\r
2400                 . '    catid = %d';\r
2401                 sql_query(sprintf($query, $destblogid, $catid));\r
2402                 $manager->notify(\r
2403                                 'PostMoveCategory',\r
2404                                 array(\r
2405                                                 'catid'      => &$catid,\r
2406                                                 'sourceblog' => &$blog,\r
2407                                                 'destblog'   => $destblog\r
2408                                 )\r
2409                 );\r
2410                 return;\r
2411         }\r
2412 \r
2413         /**\r
2414          * Admin::action_blogsettingsupdate\r
2415          * Updating blog settings\r
2416          * \r
2417          * @param       Void\r
2418          * @return      Void\r
2419          */\r
2420         static private function action_blogsettingsupdate()\r
2421         {\r
2422                 global $member, $manager;\r
2423                 \r
2424                 $blogid = intRequestVar('blogid');\r
2425                 \r
2426                 $member->blogAdminRights($blogid) or self::disallow();\r
2427                 \r
2428                 $blog =& $manager->getBlog($blogid);\r
2429                 \r
2430                 $notify_address = trim(postVar('notify'));\r
2431                 $shortname              = trim(postVar('shortname'));\r
2432                 $updatefile             = trim(postVar('update'));\r
2433                 \r
2434                 $notifyComment  = intPostVar('notifyComment');\r
2435                 $notifyVote             = intPostVar('notifyVote');\r
2436                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2437                 \r
2438                 if ( $notifyComment == 0 )\r
2439                 {\r
2440                         $notifyComment = 1;\r
2441                 }\r
2442                 if ( $notifyVote == 0 )\r
2443                 {\r
2444                         $notifyVote = 1;\r
2445                 }\r
2446                 if ( $notifyNewItem == 0 )\r
2447                 {\r
2448                         $notifyNewItem = 1;\r
2449                 }\r
2450                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2451                 \r
2452                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2453                 {\r
2454                         self::error(_ERROR_BADNOTIFY);\r
2455                 }\r
2456                 \r
2457                 if ( !isValidShortName($shortname) )\r
2458                 {\r
2459                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2460                 }\r
2461                 \r
2462                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2463                 {\r
2464                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2465                 }\r
2466                 // check if update file is writable\r
2467                 if ( $updatefile && !is_writeable($updatefile) )\r
2468                 {\r
2469                         self::error(_ERROR_UPDATEFILE);\r
2470                 }\r
2471                 \r
2472                 $blog->setName(trim(postVar('name')));\r
2473                 $blog->setShortName($shortname);\r
2474                 $blog->setNotifyAddress($notify_address);\r
2475                 $blog->setNotifyType($notifyType);\r
2476                 $blog->setMaxComments(postVar('maxcomments'));\r
2477                 $blog->setCommentsEnabled(postVar('comments'));\r
2478                 $blog->setTimeOffset(postVar('timeoffset'));\r
2479                 $blog->setUpdateFile($updatefile);\r
2480                 $blog->setURL(trim(postVar('url')));\r
2481                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2482                 $blog->setDescription(trim(postVar('desc')));\r
2483                 $blog->setPublic(postVar('public'));\r
2484                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2485                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2486                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2487                 $blog->setSearchable(intPostVar('searchable'));\r
2488                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2489                 $blog->writeSettings();\r
2490                 \r
2491                 // store plugin options\r
2492                 $aOptions = requestArray('plugoption');\r
2493                 NucleusPlugin::apply_plugin_options($aOptions);\r
2494                 \r
2495                 $data = array(\r
2496                         'context' => 'blog',\r
2497                         'blogid'  => $blogid,\r
2498                         'blog'    => &$blog\r
2499                 );\r
2500                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2501                 \r
2502                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2503                 return;\r
2504         }\r
2505         \r
2506         /**\r
2507          * Admin::action_deleteblog()\r
2508          * \r
2509          * @param       void\r
2510          * @return      void\r
2511          */\r
2512         static private function action_deleteblog()\r
2513         {\r
2514                 global $member, $CONF, $manager;\r
2515                 \r
2516                 $blogid = intRequestVar('blogid');\r
2517                 \r
2518                 $member->blogAdminRights($blogid) or self::disallow();\r
2519                 \r
2520                 // check if blog is default blog\r
2521                 if ( $CONF['DefaultBlog'] == $blogid )\r
2522                 {\r
2523                         self::error(_ERROR_DELDEFBLOG);\r
2524                 }\r
2525                 \r
2526                 $blog =& $manager->getBlog($blogid);\r
2527                 \r
2528                 self::$skin->parse('deleteblog');\r
2529                 return;\r
2530         }\r
2531         \r
2532         /**\r
2533          * Admin::action_deleteblogconfirm()\r
2534          * Delete Blog\r
2535          * \r
2536          * @param       Void\r
2537          * @return      Void\r
2538          */\r
2539         static private function action_deleteblogconfirm()\r
2540         {\r
2541                 global $member, $CONF, $manager;\r
2542                 \r
2543                 $blogid = intRequestVar('blogid');\r
2544                 \r
2545                 $data = array('blogid' => $blogid);\r
2546                 $manager->notify('PreDeleteBlog', $data);\r
2547                 \r
2548                 $member->blogAdminRights($blogid) or self::disallow();\r
2549                 \r
2550                 // check if blog is default blog\r
2551                 if ( $CONF['DefaultBlog'] == $blogid )\r
2552                 {\r
2553                         self::error(_ERROR_DELDEFBLOG);\r
2554                 }\r
2555                 \r
2556                 // delete all comments\r
2557                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2558                 DB::execute($query);\r
2559                 \r
2560                 // delete all items\r
2561                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2562                 DB::execute($query);\r
2563                 \r
2564                 // delete all team members\r
2565                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2566                 DB::execute($query);\r
2567                 \r
2568                 // delete all bans\r
2569                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2570                 DB::execute($query);\r
2571                 \r
2572                 // delete all categories\r
2573                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2574                 DB::execute($query);\r
2575                 \r
2576                 // delete all associated plugin options\r
2577                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2578                 \r
2579                 // delete the blog itself\r
2580                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2581                 DB::execute($query);\r
2582                 \r
2583                 $data = array('blogid' => $blogid);\r
2584                 $manager->notify('PostDeleteBlog', $data);\r
2585                 \r
2586                 self::action_overview(_DELETED_BLOG);\r
2587                 return;\r
2588         }\r
2589         \r
2590         /**\r
2591          * Admin::action_memberdelete()\r
2592          * \r
2593          * @param       void\r
2594          * @return      void\r
2595          */\r
2596         static private function action_memberdelete()\r
2597         {\r
2598                 global $member, $manager;\r
2599                 \r
2600                 $memberid = intRequestVar('memberid');\r
2601                 \r
2602                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2603                 \r
2604                 $mem =& $manager->getMember($memberid);\r
2605                 \r
2606                 self::$skin->parse('memberdelete');\r
2607                 return;\r
2608         }\r
2609         \r
2610         /**\r
2611          * Admin::action_memberdeleteconfirm()\r
2612          * \r
2613          * @param       void\r
2614          * @return      void\r
2615          */\r
2616         static private function action_memberdeleteconfirm()\r
2617         {\r
2618                 global $member;\r
2619                 \r
2620                 $memberid = intRequestVar('memberid');\r
2621                 \r
2622                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2623                 \r
2624                 $error = self::deleteOneMember($memberid);\r
2625                 if ( $error )\r
2626                 {\r
2627                         self::error($error);\r
2628                 }\r
2629                 \r
2630                 if ( $member->isAdmin() )\r
2631                 {\r
2632                         self::action_usermanagement();\r
2633                 }\r
2634                 else\r
2635                 {\r
2636                         self::action_overview(_DELETED_MEMBER);\r
2637                 }\r
2638                 return;\r
2639         }\r
2640         \r
2641         /**\r
2642          * Admin::deleteOneMember()\r
2643          * Delete a member by id\r
2644          * \r
2645          * @static\r
2646          * @params      Integer $memberid       member id\r
2647          * @return      String  null string or error messages\r
2648          */\r
2649         static public function deleteOneMember($memberid)\r
2650         {\r
2651                 global $manager;\r
2652                 \r
2653                 $memberid = intval($memberid);\r
2654                 $mem =& $manager->getMember($memberid);\r
2655                 \r
2656                 if ( !$mem->canBeDeleted() )\r
2657                 {\r
2658                         return _ERROR_DELETEMEMBER;\r
2659                 }\r
2660                 \r
2661                 $data = array('member' => &$mem);\r
2662                 $manager->notify('PreDeleteMember', $data);\r
2663                 \r
2664                 /* unlink comments from memberid */\r
2665                 if ( $memberid )\r
2666                 {\r
2667                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2668                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2669                         DB::execute($query);\r
2670                 }\r
2671                 \r
2672                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2673                 DB::execute($query);\r
2674                 \r
2675                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2676                 DB::execute($query);\r
2677                 \r
2678                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2679                 DB::execute($query);\r
2680                 \r
2681                 // delete all associated plugin options\r
2682                 NucleusPlugin::delete_option_values('member', $memberid);\r
2683                 \r
2684                 $data = array('member' => &$mem);\r
2685                 $manager->notify('PostDeleteMember', $data);\r
2686                 \r
2687                 return '';\r
2688         }\r
2689         \r
2690         /**\r
2691          * Admin::action_createnewlog()\r
2692          * \r
2693          * @param       void\r
2694          * @return      void\r
2695          */\r
2696         static private function action_createnewlog()\r
2697         {\r
2698                 global $member, $CONF, $manager;\r
2699                 \r
2700                 // Only Super-Admins can do this\r
2701                 $member->isAdmin() or self::disallow();\r
2702                 \r
2703                 self::$skin->parse('createnewlog');\r
2704                 return;\r
2705         }\r
2706         \r
2707         /**\r
2708          * Admin::action_addnewlog()\r
2709          * \r
2710          * @param       void\r
2711          * @return      void\r
2712          */\r
2713         static private function action_addnewlog()\r
2714         {\r
2715                 global $member, $manager, $CONF;\r
2716                 \r
2717                 // Only Super-Admins can do this\r
2718                 $member->isAdmin() or self::disallow();\r
2719                 \r
2720                 $bname                  = trim(postVar('name'));\r
2721                 $bshortname             = trim(postVar('shortname'));\r
2722                 $btimeoffset    = postVar('timeoffset');\r
2723                 $bdesc                  = trim(postVar('desc'));\r
2724                 $bdefskin               = postVar('defskin');\r
2725                 \r
2726                 if ( !isValidShortName($bshortname) )\r
2727                 {\r
2728                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2729                 }\r
2730                 \r
2731                 if ( $manager->existsBlog($bshortname) )\r
2732                 {\r
2733                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2734                 }\r
2735                 \r
2736                 $data = array(\r
2737                         'name'        => &$bname,\r
2738                         'shortname'   => &$bshortname,\r
2739                         'timeoffset'  => &$btimeoffset,\r
2740                         'description' => &$bdesc,\r
2741                         'defaultskin' => &$bdefskin\r
2742                 );\r
2743                 $manager->notify('PreAddBlog', $data);\r
2744                 \r
2745                 // add slashes for sql queries\r
2746                 $bname                  = DB::quoteValue($bname);\r
2747                 $bshortname             = DB::quoteValue($bshortname);\r
2748                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2749                 $bdesc                  = DB::quoteValue($bdesc);\r
2750                 $bdefskin               = DB::quoteValue($bdefskin);\r
2751                 \r
2752                 // create blog\r
2753                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2754                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2755                 DB::execute($query);\r
2756                 \r
2757                 $blogid = DB::getInsertId();\r
2758                 $blog   =& $manager->getBlog($blogid);\r
2759                 \r
2760                 // create new category\r
2761                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2762                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2763                 \r
2764                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2765                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2766                 $catid = DB::getInsertId();\r
2767                 \r
2768                 // set as default category\r
2769                 $blog->setDefaultCategory($catid);\r
2770                 $blog->writeSettings();\r
2771                 \r
2772                 // create team member\r
2773                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2774                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2775                 DB::execute($query);\r
2776                 \r
2777                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2778                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2779                 \r
2780                 $blog->additem(\r
2781                         $blog->getDefaultCategory(),\r
2782                         $itemdeftitle,$itemdefbody,\r
2783                         '',\r
2784                         $blogid,\r
2785                         $member->getID(),\r
2786                         $blog->getCorrectTime(),\r
2787                         0,\r
2788                         0,\r
2789                         0\r
2790                 );\r
2791                 \r
2792                 $data = array('blog' => &$blog);\r
2793                 $manager->notify('PostAddBlog', $data);\r
2794                 \r
2795                 $data = array(\r
2796                         'blog'                  => &$blog,\r
2797                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2798                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2799                         'catid'                 => $catid\r
2800                 );\r
2801                 $manager->notify('PostAddCategory', $data);\r
2802                 \r
2803                 /* TODO: we should consider to use the other way insterad of this */\r
2804                 $_REQUEST['blogid'] = $blogid;\r
2805                 $_REQUEST['catid']  = $catid;\r
2806                 self::$skin->parse('addnewlog');\r
2807                 return;\r
2808         }\r
2809         \r
2810         /**\r
2811          * Admin::action_addnewlog2()\r
2812          * \r
2813          * @param       void\r
2814          * @return      void\r
2815          */\r
2816         static private function action_addnewlog2()\r
2817         {\r
2818                 global $member, $manager;\r
2819                 $blogid = intRequestVar('blogid');\r
2820                 \r
2821                 $member->blogAdminRights($blogid) or self::disallow();\r
2822                 \r
2823                 $burl = requestVar('url');\r
2824                 \r
2825                 $blog =& $manager->getBlog($blogid);\r
2826                 $blog->setURL(trim($burl));\r
2827                 $blog->writeSettings();\r
2828                 \r
2829                 self::action_overview(_MSG_NEWBLOG);\r
2830                 return;\r
2831         }\r
2832         \r
2833         /**\r
2834          * Admin::action_skinieoverview()\r
2835          * \r
2836          * @param       void\r
2837          * @return      void\r
2838          */\r
2839         static private function action_skinieoverview()\r
2840         {\r
2841                 global $member, $DIR_LIBS, $manager;\r
2842                 \r
2843                 $member->isAdmin() or self::disallow();\r
2844                 \r
2845                 include_once($DIR_LIBS . 'skinie.php');\r
2846                 \r
2847                 self::$skin->parse('skinieoverview');\r
2848                 return;\r
2849         }\r
2850         \r
2851         /**\r
2852          * Admin::action_skinieimport()\r
2853          * \r
2854          * @param       void\r
2855          * @return      void\r
2856          */\r
2857         static private function action_skinieimport()\r
2858         {\r
2859                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2860                 \r
2861                 $member->isAdmin() or self::disallow();\r
2862                 \r
2863                 // load skinie class\r
2864                 include_once($DIR_LIBS . 'skinie.php');\r
2865                 \r
2866                 $skinFileRaw    = postVar('skinfile');\r
2867                 $mode                   = postVar('mode');\r
2868                 \r
2869                 $importer = new SkinImport();\r
2870                 \r
2871                 // get full filename\r
2872                 if ( $mode == 'file' )\r
2873                 {\r
2874                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2875                         \r
2876                         /* TODO: remove this\r
2877                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2878                         if ( !file_exists($skinFile) )\r
2879                         {\r
2880                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2881                         }\r
2882                          */\r
2883                 }\r
2884                 else\r
2885                 {\r
2886                         $skinFile = $skinFileRaw;\r
2887                 }\r
2888                 \r
2889                 // read only metadata\r
2890                 $error = $importer->readFile($skinFile, 1);\r
2891                 \r
2892                 /* TODO: we should consider to use the other way insterad of this */\r
2893                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2894                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2895                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2896                 \r
2897                 // clashes\r
2898                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2899                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2900                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2901                 \r
2902                 /* TODO: we should consider to use the other way insterad of this */\r
2903                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2904                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2905                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2906                 \r
2907                 if ( $error )\r
2908                 {\r
2909                         self::error($error);\r
2910                 }\r
2911                 \r
2912                 self::$skin->parse('skinieimport');\r
2913                 return;\r
2914         }\r
2915         \r
2916         /**\r
2917          * Admin::action_skiniedoimport()\r
2918          * \r
2919          * @param       void\r
2920          * @return      void\r
2921          */\r
2922         static private function action_skiniedoimport()\r
2923         {\r
2924                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2925                 \r
2926                 $member->isAdmin() or self::disallow();\r
2927                 \r
2928                 // load skinie class\r
2929                 include_once($DIR_LIBS . 'skinie.php');\r
2930                 \r
2931                 $skinFileRaw    = postVar('skinfile');\r
2932                 $mode                   = postVar('mode');\r
2933                 \r
2934                 $allowOverwrite = intPostVar('overwrite');\r
2935                 \r
2936                 // get full filename\r
2937                 if ( $mode == 'file' )\r
2938                 {\r
2939                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2940                         \r
2941                         /* TODO: remove this\r
2942                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2943                         if ( !file_exists($skinFile) )\r
2944                         {\r
2945                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2946                         }\r
2947                         */\r
2948                 }\r
2949                 else\r
2950                 {\r
2951                         $skinFile = $skinFileRaw;\r
2952                 }\r
2953                 \r
2954                 $importer = new SkinImport();\r
2955                 \r
2956                 $error = $importer->readFile($skinFile);\r
2957                 \r
2958                 if ( $error )\r
2959                 {\r
2960                         self::error($error);\r
2961                 }\r
2962                 \r
2963                 $error = $importer->writeToDatabase($allowOverwrite);\r
2964                 \r
2965                 if ( $error )\r
2966                 {\r
2967                         self::error($error);\r
2968                 }\r
2969                 \r
2970                 /* TODO: we should consider to use the other way insterad of this */\r
2971                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2972                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2973                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2974                 \r
2975                 self::$skin->parse('skiniedoimport');\r
2976                 return;\r
2977         }\r
2978 \r
2979         /**\r
2980          * Admin::action_skinieexport()\r
2981          * \r
2982          * @param       void\r
2983          * @return      void\r
2984          */\r
2985         static private function action_skinieexport()\r
2986         {\r
2987                 global $member, $DIR_LIBS;\r
2988                 \r
2989                 $member->isAdmin() or self::disallow();\r
2990                 \r
2991                 // load skinie class\r
2992                 include_once($DIR_LIBS . 'skinie.php');\r
2993                 \r
2994                 $aSkins         = requestIntArray('skin');\r
2995                 $aTemplates     = requestIntArray('template');\r
2996                 \r
2997                 if ( !is_array($aTemplates) )\r
2998                 {\r
2999                         $aTemplates = array();\r
3000                 }\r
3001                 if ( !is_array($aSkins) )\r
3002                 {\r
3003                         $aSkins = array();\r
3004                 }\r
3005                 \r
3006                 $skinList               = array_keys($aSkins);\r
3007                 $templateList   = array_keys($aTemplates);\r
3008                 \r
3009                 $info = postVar('info');\r
3010                 \r
3011                 $exporter = new SkinExport();\r
3012                 foreach ( $skinList as $skinId )\r
3013                 {\r
3014                         $exporter->addSkin($skinId);\r
3015                 }\r
3016                 foreach ($templateList as $templateId)\r
3017                 {\r
3018                         $exporter->addTemplate($templateId);\r
3019                 }\r
3020                 $exporter->setInfo($info);\r
3021                 \r
3022                 $exporter->export();\r
3023                 return;\r
3024         }\r
3025         \r
3026         /**\r
3027          * Admin::action_templateoverview()\r
3028          * \r
3029          * @param       void\r
3030          * @return      void\r
3031          */\r
3032         static private function action_templateoverview()\r
3033         {\r
3034                 global $member, $manager;\r
3035                 \r
3036                 $member->isAdmin() or self::disallow();\r
3037                 \r
3038                 self::$skin->parse('templateoverview');\r
3039                 return;\r
3040         }\r
3041         \r
3042         /**\r
3043          * Admin::action_templateedit()\r
3044          * \r
3045          * @param       string  $msg    message for pageheader\r
3046          * @return      void\r
3047          */\r
3048         static private function action_templateedit($msg = '')\r
3049         {\r
3050                 global $member, $manager;\r
3051                 if ( $msg )\r
3052                 {\r
3053                         self::$headMess = $msg;\r
3054                 }\r
3055                 \r
3056                 $templateid = intRequestVar('templateid');\r
3057                 \r
3058                 $member->isAdmin() or self::disallow();\r
3059                 \r
3060                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3061                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3062                 \r
3063                 self::$skin->parse('templateedit');\r
3064                 return;\r
3065         }\r
3066         \r
3067         /**\r
3068          * Admin::action_templateupdate()\r
3069          * \r
3070          * @param       void\r
3071          * @return      void\r
3072          */\r
3073         static private function action_templateupdate()\r
3074         {\r
3075                 global $member,$manager;\r
3076                 \r
3077                 $templateid = intRequestVar('templateid');\r
3078                 \r
3079                 $member->isAdmin() or self::disallow();\r
3080                 \r
3081                 $name = postVar('tname');\r
3082                 $desc = postVar('tdesc');\r
3083                 \r
3084                 if ( !isValidTemplateName($name) )\r
3085                 {\r
3086                         self::error(_ERROR_BADTEMPLATENAME);\r
3087                 }\r
3088                 \r
3089                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3090                 {\r
3091                         self::error(_ERROR_DUPTEMPLATENAME);\r
3092                 }\r
3093                 \r
3094                 // 1. Remove all template parts\r
3095                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3096                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3097                 DB::execute($query);\r
3098                 \r
3099                 // 2. Update description\r
3100                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3101                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3102                 DB::execute($query);\r
3103                 \r
3104                 // 3. Add non-empty template parts\r
3105                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3106                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3107                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3108                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3109                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3110                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3111                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3114                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3115                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3116                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3117                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3118                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3119                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3120                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3121                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3122                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3123                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3124                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3125                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3126                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3127                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3128                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3129                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3130                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3131                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3132                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3133                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3134                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3135                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3136                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3137                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3138                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3139                 \r
3140                 $data = array('fields' => array());\r
3141                 $manager->notify('TemplateExtraFields', $data);\r
3142                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3143                 {\r
3144                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3145                         {\r
3146                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3147                         }\r
3148                 }\r
3149                 \r
3150                 // jump back to template edit\r
3151                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3152                 return;\r
3153         }\r
3154         \r
3155         /**\r
3156          * Admin::addToTemplate()\r
3157          * \r
3158          * @param       Integer $id     ID for template\r
3159          * @param       String  $partname       parts name\r
3160          * @param       String  $content        template contents\r
3161          * @return      Integer record index\r
3162          * \r
3163          */\r
3164         static private function addToTemplate($id, $partname, $content)\r
3165         {\r
3166                 // don't add empty parts:\r
3167                 if ( !trim($content) )\r
3168                 {\r
3169                         return -1;\r
3170                 }\r
3171                 \r
3172                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3173                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3174                 if ( DB::execute($query) === FALSE )\r
3175                 {\r
3176                         $err = DB::getError();\r
3177                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3178                 }\r
3179                 return DB::getInsertId();\r
3180         }\r
3181         \r
3182         /**\r
3183          * Admin::action_templatedelete()\r
3184          * \r
3185          * @param       void\r
3186          * @return      void\r
3187          */\r
3188         static private function action_templatedelete()\r
3189         {\r
3190                 global $member, $manager;\r
3191                 \r
3192                 $member->isAdmin() or self::disallow();\r
3193                 \r
3194                 $templateid = intRequestVar('templateid');\r
3195                 // TODO: check if template can be deleted\r
3196                 \r
3197                 self::$skin->parse('templatedelete');\r
3198                 return;\r
3199         }\r
3200         \r
3201         /**\r
3202          * Admin::action_templatedeleteconfirm()\r
3203          * \r
3204          * @param       void\r
3205          * @return      void\r
3206          */\r
3207         static private function action_templatedeleteconfirm()\r
3208         {\r
3209                 global $member, $manager;\r
3210                 \r
3211                 $templateid = intRequestVar('templateid');\r
3212                 \r
3213                 $member->isAdmin() or self::disallow();\r
3214                 \r
3215                 $data = array('templateid' => $templateid);\r
3216                 $manager->notify('PreDeleteTemplate', $data);\r
3217                 \r
3218                 // 1. delete description\r
3219                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3220                 \r
3221                 // 2. delete parts\r
3222                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3223                 \r
3224                 \r
3225                 $data = array('templateid' => $templateid);\r
3226                 $manager->notify('PostDeleteTemplate', $data);\r
3227                 \r
3228                 self::action_templateoverview();\r
3229                 return;\r
3230         }\r
3231         \r
3232         /**\r
3233          * Admin::action_templatenew()\r
3234          * \r
3235          * @param       void\r
3236          * @return      void\r
3237          */\r
3238         static private function action_templatenew()\r
3239         {\r
3240                 global $member;\r
3241                 \r
3242                 $member->isAdmin() or self::disallow();\r
3243                 \r
3244                 $name = postVar('name');\r
3245                 $desc = postVar('desc');\r
3246                 \r
3247                 if ( !isValidTemplateName($name) )\r
3248                 {\r
3249                         self::error(_ERROR_BADTEMPLATENAME);\r
3250                 }\r
3251                 \r
3252                 if ( Template::exists($name) )\r
3253                 {\r
3254                         self::error(_ERROR_DUPTEMPLATENAME);\r
3255                 }\r
3256                 \r
3257                 $newTemplateId = Template::createNew($name, $desc);\r
3258                 \r
3259                 self::action_templateoverview();\r
3260                 return;\r
3261         }\r
3262         \r
3263         /**\r
3264          * Admin::action_templateclone()\r
3265          * \r
3266          * @param       void\r
3267          * @return      void\r
3268          */\r
3269         static private function action_templateclone()\r
3270         {\r
3271                 global $member;\r
3272                 \r
3273                 $templateid = intRequestVar('templateid');\r
3274                 \r
3275                 $member->isAdmin() or self::disallow();\r
3276                 \r
3277                 // 1. read old template\r
3278                 $name = Template::getNameFromId($templateid);\r
3279                 $desc = Template::getDesc($templateid);\r
3280                 \r
3281                 // 2. create desc thing\r
3282                 $name = "cloned" . $name;\r
3283                 \r
3284                 // if a template with that name already exists:\r
3285                 if ( Template::exists($name) )\r
3286                 {\r
3287                         $i = 1;\r
3288                         while (Template::exists($name . $i))\r
3289                         {\r
3290                                 $i++;\r
3291                         }\r
3292                         $name .= $i;\r
3293                 }\r
3294                 \r
3295                 $newid = Template::createNew($name, $desc);\r
3296                 \r
3297                 // 3. create clone\r
3298                 // go through parts of old template and add them to the new one\r
3299                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3300                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3301                 \r
3302                 $res = DB::getResult($query);\r
3303                 foreach ( $res as $row)\r
3304                 {\r
3305                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3306                 }\r
3307                 \r
3308                 self::action_templateoverview();\r
3309                 return;\r
3310         }\r
3311         \r
3312         /**\r
3313          * Admin::action_admintemplateoverview()\r
3314          * \r
3315          * @param       void\r
3316          * @return      void\r
3317          */\r
3318         static private function action_admintemplateoverview()\r
3319         {\r
3320                 global $member;\r
3321                 $member->isAdmin() or self::disallow();\r
3322                 self::$skin->parse('admntemplateoverview');\r
3323                 return;\r
3324         }\r
3325         \r
3326         /**\r
3327          * Admin::action_admintemplateedit()\r
3328          * \r
3329          * @param       string  $msg    message for pageheader\r
3330          * @return      void\r
3331          */\r
3332         static private function action_admintemplateedit($msg = '')\r
3333         {\r
3334                 global $member, $manager;\r
3335                 if ( $msg )\r
3336                 {\r
3337                         self::$headMess = $msg;\r
3338                 }\r
3339                 $member->isAdmin() or self::disallow();\r
3340                 \r
3341                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3342                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3343                 \r
3344                 self::$skin->parse('admintemplateedit');\r
3345                 return;\r
3346         }\r
3347         \r
3348         /**\r
3349          * Admin::action_admintemplateupdate()\r
3350          * \r
3351          * @param       void\r
3352          * @return      void\r
3353          */\r
3354         static private function action_admintemplateupdate()\r
3355         {\r
3356                 global $member, $manager;\r
3357                 $templateid = intRequestVar('templateid');\r
3358                 $member->isAdmin() or self::disallow();\r
3359                 $name = postVar('tname');\r
3360                 $desc = postVar('tdesc');\r
3361                 \r
3362                 if ( !isValidTemplateName($name) )\r
3363                 {\r
3364                         self::error(_ERROR_BADTEMPLATENAME);\r
3365                 }\r
3366                 \r
3367                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3368                 {\r
3369                         self::error(_ERROR_DUPTEMPLATENAME);\r
3370                 }\r
3371                 \r
3372                 // 1. Remove all template parts\r
3373                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3374                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3375                 DB::execute($query);\r
3376                 \r
3377                 // 2. Update description\r
3378                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3379                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3380                 DB::execute($query);\r
3381                 \r
3382                 // 3. Add non-empty template parts\r
3383                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3384                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3385                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3386                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3387                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3388                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3389                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3390                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3391                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3392                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3393                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3394                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3395                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3396                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3397                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3399                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3400                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3401                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3402                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3403                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3404                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3405                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3406                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3407                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3408                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3409                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3410                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3411                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3484                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3485                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3486                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3487                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3488                 \r
3489                 $data = array('fields' => array());\r
3490                 $manager->notify('AdminTemplateExtraFields', $data);\r
3491                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3492                 {\r
3493                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3494                         {\r
3495                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3496                         }\r
3497                 }\r
3498                 \r
3499                 // jump back to template edit\r
3500                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3501                 return;\r
3502         }\r
3503         \r
3504         /**\r
3505          * Admin::addToAdminTemplate()\r
3506          * \r
3507          * @param       integer $id                     ID for template\r
3508          * @param       string  $partname       name of part for template\r
3509          * @param       void    $contents       content for part of template\r
3510          * @return      integer ID for newly inserted Template\r
3511          */\r
3512         static private function addToAdminTemplate($id, $partname, $content)\r
3513         {\r
3514                 // don't add empty parts:\r
3515                 if ( !trim($content) )\r
3516                 {\r
3517                         return -1;\r
3518                 }\r
3519                 \r
3520                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3521                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3522                 if ( DB::execute($query) === FALSE )\r
3523                 {\r
3524                         $err = DB::getError();\r
3525                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3526                 }\r
3527                 return DB::getInsertId();\r
3528         }\r
3529         \r
3530         /**\r
3531          * Admin::action_admintemplatedelete()\r
3532          * \r
3533          * @param       void\r
3534          * @return      void\r
3535          */\r
3536         static private function action_admintemplatedelete()\r
3537         {\r
3538                 global $member, $manager;\r
3539                 $member->isAdmin() or self::disallow();\r
3540                 \r
3541                 // TODO: check if template can be deleted\r
3542                 self::$skin->parse('admintemplatedelete');\r
3543                 return;\r
3544         }\r
3545         \r
3546         /**\r
3547          * Admin::action_admintemplatedeleteconfirm()\r
3548          * \r
3549          * @param       void\r
3550          * @return      void\r
3551          */\r
3552         static private function action_admintemplatedeleteconfirm()\r
3553         {\r
3554                 global $member, $manager;\r
3555                 \r
3556                 $templateid = intRequestVar('templateid');\r
3557                 $member->isAdmin() or self::disallow();\r
3558                 \r
3559                 $data = array('templateid' => $templateid);\r
3560                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3561                 \r
3562                 // 1. delete description\r
3563                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3564                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3565                 DB::execute($query);\r
3566                 \r
3567                 // 2. delete parts\r
3568                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3569                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3570                 DB::execute($query);\r
3571                 \r
3572                 $data = array('templateid' => $templateid);\r
3573                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3574                 \r
3575                 self::action_admintemplateoverview();\r
3576                 return;\r
3577         }\r
3578         \r
3579         /**\r
3580          * Admin::action_admintemplatenew()\r
3581          * \r
3582          * @param       void\r
3583          * @return      void\r
3584          */\r
3585         static private function action_admintemplatenew()\r
3586         {\r
3587                 global $member;\r
3588                 $member->isAdmin() or self::disallow();\r
3589                 $name = postVar('name');\r
3590                 $desc = postVar('desc');\r
3591                 \r
3592                 if ( !isValidTemplateName($name) )\r
3593                 {\r
3594                         self::error(_ERROR_BADTEMPLATENAME);\r
3595                 }\r
3596                 else if ( !preg_match('#^admin/#', $name) )\r
3597                 {\r
3598                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3599                 }\r
3600                 else if ( Template::exists($name) )\r
3601                 {\r
3602                         self::error(_ERROR_DUPTEMPLATENAME);\r
3603                 }\r
3604                 \r
3605                 $newTemplateId = Template::createNew($name, $desc);\r
3606                 self::action_admintemplateoverview();\r
3607                 return;\r
3608         }\r
3609         \r
3610         /**\r
3611          * Admin::action_admintemplateclone()\r
3612          * \r
3613          * @param       void\r
3614          * @return      void\r
3615          */\r
3616         static private function action_admintemplateclone()\r
3617         {\r
3618                 global $member;\r
3619                 $templateid = intRequestVar('templateid');\r
3620                 $member->isAdmin() or self::disallow();\r
3621                 \r
3622                 // 1. read old template\r
3623                 $name = Template::getNameFromId($templateid);\r
3624                 $desc = Template::getDesc($templateid);\r
3625                 \r
3626                 // 2. create desc thing\r
3627                 $name = $name . "cloned";\r
3628                 \r
3629                 // if a template with that name already exists:\r
3630                 if ( Template::exists($name) )\r
3631                 {\r
3632                         $i = 1;\r
3633                         while ( Template::exists($name . $i) )\r
3634                         {\r
3635                                 $i++;\r
3636                         }\r
3637                         $name .= $i;\r
3638                 }\r
3639                 \r
3640                 $newid = Template::createNew($name, $desc);\r
3641                 \r
3642                 // 3. create clone\r
3643                 // go through parts of old template and add them to the new one\r
3644                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3645                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3646                 \r
3647                 $res = DB::getResult($query);\r
3648                 foreach ( $res as $row )\r
3649                 {\r
3650                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3651                 }\r
3652                 \r
3653                 self::action_admintemplateoverview();\r
3654                 return;\r
3655         }\r
3656 \r
3657         /**\r
3658          * Admin::action_skinoverview()\r
3659          * \r
3660          * @param       void\r
3661          * @return      void\r
3662          */\r
3663         static private function action_skinoverview()\r
3664         {\r
3665                 global $member, $manager;\r
3666                 \r
3667                 $member->isAdmin() or self::disallow();\r
3668                 \r
3669                 self::$skin->parse('skinoverview');\r
3670                 return;\r
3671         }\r
3672         \r
3673         /**\r
3674          * Admin::action_skinnew()\r
3675          * \r
3676          * @param       void\r
3677          * @return      void\r
3678          */\r
3679         static private function action_skinnew()\r
3680         {\r
3681                 global $member;\r
3682                 \r
3683                 $member->isAdmin() or self::disallow();\r
3684                 \r
3685                 $name = trim(postVar('name'));\r
3686                 $desc = trim(postVar('desc'));\r
3687                 \r
3688                 if ( !isValidSkinName($name) )\r
3689                 {\r
3690                         self::error(_ERROR_BADSKINNAME);\r
3691                 }\r
3692                 \r
3693                 if ( SKIN::exists($name) )\r
3694                 {\r
3695                         self::error(_ERROR_DUPSKINNAME);\r
3696                 }\r
3697                 \r
3698                 $newId = SKIN::createNew($name, $desc);\r
3699                 \r
3700                 self::action_skinoverview();\r
3701                 return;\r
3702         }\r
3703         \r
3704         /**\r
3705          * Admin::action_skinedit()\r
3706          * \r
3707          * @param       void\r
3708          * @return      void\r
3709          */\r
3710         static private function action_skinedit()\r
3711         {\r
3712                 global $member, $manager;\r
3713                 \r
3714                 $member->isAdmin() or self::disallow();\r
3715                 \r
3716                 self::$skin->parse('skinedit');\r
3717                 return;\r
3718         }\r
3719         \r
3720         /**\r
3721          * Admin::action_skineditgeneral()\r
3722          * \r
3723          * @param       void\r
3724          * @return      void\r
3725          */\r
3726         static private function action_skineditgeneral()\r
3727         {\r
3728                 global $member;\r
3729                 \r
3730                 $skinid = intRequestVar('skinid');\r
3731                 \r
3732                 $member->isAdmin() or self::disallow();\r
3733                 \r
3734                 $name           = postVar('name');\r
3735                 $desc           = postVar('desc');\r
3736                 $type           = postVar('type');\r
3737                 $inc_mode       = postVar('inc_mode');\r
3738                 $inc_prefix     = postVar('inc_prefix');\r
3739                 \r
3740                 $skin = new Skin($skinid);\r
3741                 \r
3742                 // 1. Some checks\r
3743                 if ( !isValidSkinName($name) )\r
3744                 {\r
3745                         self::error(_ERROR_BADSKINNAME);\r
3746                 }\r
3747                 \r
3748                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3749                 {\r
3750                         self::error(_ERROR_DUPSKINNAME);\r
3751                 }\r
3752                 \r
3753                 if ( !$type )\r
3754                 {\r
3755                         $type = 'text/html';\r
3756                 }\r
3757                 if ( !$inc_mode )\r
3758                 {\r
3759                         $inc_mode = 'normal';\r
3760                 }\r
3761                 \r
3762                 // 2. Update description\r
3763                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3764                 \r
3765                 self::action_skinedit();\r
3766                 return;\r
3767         }\r
3768         \r
3769         static private function action_skinedittype($msg = '')\r
3770         {\r
3771                 global $member, $manager;\r
3772                 \r
3773                 $member->isAdmin() or self::disallow();\r
3774                 \r
3775                 if ( $msg )\r
3776                 {\r
3777                         self::$headMess = $msg;\r
3778                 }\r
3779                 \r
3780                 $skinid = intRequestVar('skinid');\r
3781                 $type   = requestVar('type');\r
3782                 $type   = trim($type);\r
3783                 $type   = strtolower($type);\r
3784                 \r
3785                 if ( !isValidShortName($type) )\r
3786                 {\r
3787                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3788                 }\r
3789                 \r
3790                 self::$skin->parse('skinedittype');\r
3791                 return;\r
3792         }\r
3793         \r
3794         /**\r
3795          * Admin::action_skinupdate()\r
3796          * \r
3797          * @param       void\r
3798          * @return      void\r
3799          */\r
3800         static private function action_skinupdate()\r
3801         {\r
3802                 global $member;\r
3803                 \r
3804                 $skinid = intRequestVar('skinid');\r
3805                 $content = trim(postVar('content'));\r
3806                 $type = postVar('type');\r
3807                 \r
3808                 $member->isAdmin() or self::disallow();\r
3809                 \r
3810                 $skin = new SKIN($skinid);\r
3811                 $skin->update($type, $content);\r
3812                 \r
3813                 self::action_skinedittype(_SKIN_UPDATED);\r
3814                 return;\r
3815         }\r
3816         \r
3817         /**\r
3818          * Admin::action_skindelete()\r
3819          * \r
3820          * @param       void\r
3821          * @return      void\r
3822          */\r
3823         static private function action_skindelete()\r
3824         {\r
3825                 global $member, $manager, $CONF;\r
3826                 \r
3827                 $skinid = intRequestVar('skinid');\r
3828                 \r
3829                 $member->isAdmin() or self::disallow();\r
3830                 \r
3831                 // don't allow default skin to be deleted\r
3832                 if ( $skinid == $CONF['BaseSkin'] )\r
3833                 {\r
3834                         self::error(_ERROR_DEFAULTSKIN);\r
3835                 }\r
3836                 \r
3837                 // don't allow deletion of default skins for blogs\r
3838                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3839                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3840                 \r
3841                 $name = DB::getValue($query);\r
3842                 if ( $name )\r
3843                 {\r
3844                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3845                 }\r
3846                 \r
3847                 self::$skin->parse('skindelete');\r
3848                 return;\r
3849         }\r
3850         \r
3851         /**\r
3852          * Admin::action_skindeleteconfirm()\r
3853          * \r
3854          * @param       void\r
3855          * @return      void\r
3856          */\r
3857         static private function action_skindeleteconfirm()\r
3858         {\r
3859                 global $member, $CONF, $manager;\r
3860                 \r
3861                 $skinid = intRequestVar('skinid');\r
3862                 \r
3863                 $member->isAdmin() or self::disallow();\r
3864                 \r
3865                 // don't allow default skin to be deleted\r
3866                 if ( $skinid == $CONF['BaseSkin'] )\r
3867                 {\r
3868                         self::error(_ERROR_DEFAULTSKIN);\r
3869                 }\r
3870                 \r
3871                 // don't allow deletion of default skins for blogs\r
3872                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3873                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3874                 \r
3875                 $name = DB::getValue($query);\r
3876                 if ( $name )\r
3877                                 {\r
3878                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3879                 }\r
3880                 \r
3881                 $data = array('skinid' => $skinid);\r
3882                 $manager->notify('PreDeleteSkin', $data);\r
3883                 \r
3884                 // 1. delete description\r
3885                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3886                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3887                 DB::execute($query);\r
3888                 \r
3889                 // 2. delete parts\r
3890                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3891                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3892                 DB::execute($query);\r
3893                 \r
3894                 $data = array('skinid' => $skinid);\r
3895                 $manager->notify('PostDeleteSkin', $data);\r
3896                 \r
3897                 self::action_skinoverview();\r
3898                 return;\r
3899         }\r
3900         \r
3901         /**\r
3902          * Admin::action_skinremovetype()\r
3903          * \r
3904          * @param       void\r
3905          * @return      void\r
3906          */\r
3907         static private function action_skinremovetype()\r
3908         {\r
3909                 global $member, $manager, $CONF;\r
3910                 \r
3911                 $member->isAdmin() or self::disallow();\r
3912                 \r
3913                 $skinid = intRequestVar('skinid');\r
3914                 $skintype = requestVar('type');\r
3915                 \r
3916                 if ( !isValidShortName($skintype) )\r
3917                 {\r
3918                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3919                 }\r
3920                 \r
3921                 // don't allow default skinparts to be deleted\r
3922                 /* TODO: this array should be retrieved from Action class */\r
3923                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3924                 {\r
3925                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3926                 }\r
3927                 \r
3928                 self::$skin->parse('skinremovetype');\r
3929                 return;\r
3930         }\r
3931         \r
3932         /**\r
3933          * Admin::action_skinremovetypeconfirm()\r
3934          * \r
3935          * @param       void\r
3936          * @return      void\r
3937          */\r
3938         static private function action_skinremovetypeconfirm()\r
3939         {\r
3940                 global $member, $CONF, $manager;\r
3941                 \r
3942                 $member->isAdmin() or self::disallow();\r
3943                 \r
3944                 $skinid = intRequestVar('skinid');\r
3945                 $skintype = requestVar('type');\r
3946                 \r
3947                 if ( !isValidShortName($skintype) )\r
3948                 {\r
3949                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3950                 }\r
3951                 \r
3952                 // don't allow default skinparts to be deleted\r
3953                 /* TODO: this array should be retrieved from Action class */\r
3954                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3955                 {\r
3956                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3957                 }\r
3958                 \r
3959                 $data = array(\r
3960                         'skinid'   => $skinid,\r
3961                         'skintype' => $skintype\r
3962                 );\r
3963                 $manager->notify('PreDeleteSkinPart', $data);\r
3964                 // delete part\r
3965                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3966                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3967                 DB::execute($query);\r
3968                 \r
3969                 $data = array(\r
3970                         'skinid'   => $skinid,\r
3971                         'skintype' => $skintype\r
3972                 );\r
3973                 $manager->notify('PostDeleteSkinPart', $data);\r
3974                 \r
3975                 self::action_skinedit();\r
3976                 return;\r
3977         }\r
3978 \r
3979         /**\r
3980          * Admin::action_skinclone()\r
3981          * \r
3982          * @param       void\r
3983          * @return      void\r
3984          */\r
3985         static private function action_skinclone()\r
3986         {\r
3987                 global $member;\r
3988                 \r
3989                 $member->isAdmin() or self::disallow();\r
3990                 \r
3991                 $skinid = intRequestVar('skinid');\r
3992                 \r
3993                 // 1. read skin to clone\r
3994                 $skin = new Skin($skinid);\r
3995                 \r
3996                 $name = "{$skin->getName()}_clone";\r
3997                 \r
3998                 // if a skin with that name already exists:\r
3999                 if ( Skin::exists($name) )\r
4000                 {\r
4001                         $i = 1;\r
4002                         while ( Skin::exists($name . $i) )\r
4003                         {\r
4004                                 $i++;\r
4005                         }\r
4006                         $name .= $i;\r
4007                 }\r
4008                 \r
4009                 // 2. create skin desc\r
4010                 $newid = Skin::createNew(\r
4011                         $name,\r
4012                         $skin->getDescription(),\r
4013                         $skin->getContentType(),\r
4014                         $skin->getIncludeMode(),\r
4015                         $skin->getIncludePrefix()\r
4016                 );\r
4017                 \r
4018                 // 3. clone\r
4019                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4020                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4021                 \r
4022                 $res = DB::getResult($query);\r
4023                 foreach ( $res as $row )\r
4024                 {\r
4025                         self::skinclonetype($skin, $newid, $row['stype']);\r
4026                 }\r
4027                 \r
4028                 self::action_skinoverview();\r
4029                 return;\r
4030         }\r
4031         \r
4032         /**\r
4033          * Admin::skinclonetype()\r
4034          * \r
4035          * @param       String  $skin   Skin object\r
4036          * @param       Integer $newid  ID for this clone\r
4037          * @param       String  $type   type of skin\r
4038          * @return      Void\r
4039          */\r
4040         static private function skinclonetype($skin, $newid, $type)\r
4041         {\r
4042                 $newid = intval($newid);\r
4043                 $content = $skin->getContentFromDB($type);\r
4044                 \r
4045                 if ( $content )\r
4046                 {\r
4047                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4048                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4049                         DB::execute($query);\r
4050                 }\r
4051                 return;\r
4052         }\r
4053         \r
4054         /**\r
4055          * Admin::action_adminskinoverview()\r
4056          * \r
4057          * @param       void\r
4058          * @return      void\r
4059          */\r
4060         static private function action_adminskinoverview()\r
4061         {\r
4062                 global $member, $manager;\r
4063                 \r
4064                 $member->isAdmin() or self::disallow();\r
4065                 \r
4066                 self::$skin->parse('adminskinoverview');\r
4067                 return;\r
4068         }\r
4069         \r
4070         /**\r
4071          * Admin::action_adminskinnew()\r
4072          * \r
4073          * @param       void\r
4074          * @return      void\r
4075          */\r
4076         static private function action_adminskinnew()\r
4077         {\r
4078                 global $member;\r
4079                 $member->isAdmin() or self::disallow();\r
4080                 $name = trim(postVar('name'));\r
4081                 $desc = trim(postVar('desc'));\r
4082                 \r
4083                 if ( !isValidSkinName($name) )\r
4084                 {\r
4085                         self::error(_ERROR_BADSKINNAME);\r
4086                 }\r
4087                 else if ( !preg_match('#^admin/#', $name) )\r
4088                 {\r
4089                         self::error(_ERROR_BADADMINSKINNAME);\r
4090                 }\r
4091                 else if ( Skin::exists($name) )\r
4092                 {\r
4093                         self::error(_ERROR_DUPSKINNAME);\r
4094                 }\r
4095                 /* TODO: $newId is not reused... */\r
4096                 $newId = Skin::createNew($name, $desc);\r
4097                 self::action_adminskinoverview();\r
4098                 return;\r
4099         }\r
4100         \r
4101         /**\r
4102          * Admin::action_adminskinedit()\r
4103          * \r
4104          * @param       void\r
4105          * @return      void\r
4106          */\r
4107         static private function action_adminskinedit()\r
4108         {\r
4109                 global $member, $manager;\r
4110                 \r
4111                 $member->isAdmin() or self::disallow();\r
4112                 self::$skin->parse('adminskinedit');\r
4113                 return;\r
4114         }\r
4115         \r
4116         /**\r
4117          * Admin::action_adminskineditgeneral()\r
4118          * \r
4119          * @param       void\r
4120          * @return      void\r
4121          */\r
4122         static private function action_adminskineditgeneral()\r
4123         {\r
4124                 global $member;\r
4125                 \r
4126                 $skinid = intRequestVar('skinid');\r
4127                 \r
4128                 $member->isAdmin() or self::disallow();\r
4129                 \r
4130                 $name           = postVar('name');\r
4131                 $desc           = postVar('desc');\r
4132                 $type           = postVar('type');\r
4133                 $inc_mode       = postVar('inc_mode');\r
4134                 $inc_prefix     = postVar('inc_prefix');\r
4135                 \r
4136                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4137                 \r
4138                 // 1. Some checks\r
4139                 if ( !isValidSkinName($name) )\r
4140                 {\r
4141                         self::error(_ERROR_BADSKINNAME);\r
4142                 }\r
4143                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4144                 {\r
4145                         self::error(_ERROR_DUPSKINNAME);\r
4146                 }\r
4147                 if ( !$type )\r
4148                 {\r
4149                         $type = 'text/html';\r
4150                 }\r
4151                 if ( !$inc_mode )\r
4152                 {\r
4153                         $inc_mode = 'normal';\r
4154                 }\r
4155                 // 2. Update description\r
4156                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4157                 self::action_adminskinedit();\r
4158                 return;\r
4159         }\r
4160         \r
4161         /**\r
4162          * Admin::action_adminskinedittype()\r
4163          * \r
4164          * @param       string  $msg    message for pageheader\r
4165          * @return      void\r
4166          */\r
4167         static private function action_adminskinedittype($msg = '')\r
4168         {\r
4169                 global $member, $manager;\r
4170                 \r
4171                 $member->isAdmin() or self::disallow();\r
4172                 \r
4173                 if ( $msg )\r
4174                 {\r
4175                         self::$headMess = $msg;\r
4176                 }\r
4177                 $type = requestVar('type');\r
4178                 $type = trim($type);\r
4179                 $type = strtolower($type);\r
4180                 \r
4181                 if ( !isValidShortName($type) )\r
4182                 {\r
4183                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4184                 }\r
4185                 \r
4186                 self::$skin->parse('adminskinedittype');\r
4187                 return;\r
4188         }\r
4189         \r
4190         /**\r
4191          * Admin::action_adminskinupdate()\r
4192          * \r
4193          * @param       void\r
4194          * @return      void\r
4195          */\r
4196         static private function action_adminskinupdate()\r
4197         {\r
4198                 global $member;\r
4199                 $skinid         = intRequestVar('skinid');\r
4200                 $content        = trim(postVar('content'));\r
4201                 $type           = postVar('type');\r
4202                 \r
4203                 $member->isAdmin() or self::disallow();\r
4204                 \r
4205                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4206                 $skin->update($type, $content);\r
4207                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4208                 return;\r
4209         }\r
4210         \r
4211         /**\r
4212          * Admin::action_adminskindelete()\r
4213          * \r
4214          * @param       void\r
4215          * @return      void\r
4216          */\r
4217         static private function action_adminskindelete()\r
4218         {\r
4219                 global $member, $manager, $CONF;\r
4220                 $member->isAdmin() or self::disallow();\r
4221                 \r
4222                 /* TODO: needless variable $skinid... */\r
4223                 $skinid = intRequestVar('skinid');\r
4224                 self::$skin->parse('adminskindelete');\r
4225                 return;\r
4226         }\r
4227 \r
4228         /**\r
4229          * Admin::action_adminskindeleteconfirm()\r
4230          * \r
4231          * @param       void\r
4232          * @return      void\r
4233          */\r
4234         static private function action_adminskindeleteconfirm()\r
4235         {\r
4236                 global $member, $CONF, $manager;\r
4237                 \r
4238                 $member->isAdmin() or self::disallow();\r
4239                 $skinid = intRequestVar('skinid');\r
4240                 \r
4241                 // don't allow default skin to be deleted\r
4242                 if ( $skinid == $CONF['AdminSkin'] )\r
4243                 {\r
4244                         self::error(_ERROR_DEFAULTSKIN);\r
4245                 }\r
4246                 \r
4247                 /*\r
4248                  * TODO: NOT Implemented\r
4249                  *  don't allow deletion of default skins for members\r
4250                 $memberDefaults =  $member->getAdminSkin();\r
4251                 foreach ( $memberDefaults as $memID => $adminskin )\r
4252                 {\r
4253                         if ( $skinid == $adminskin )\r
4254                         {\r
4255                                 $mem =& $manager->getMember($memID);\r
4256                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4257                         }\r
4258                 }\r
4259                 */\r
4260                 \r
4261                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4262                 \r
4263                 // 1. delete description\r
4264                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4265                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4266                 DB::execute($query);\r
4267                 \r
4268                 // 2. delete parts\r
4269                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4270                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4271                 \r
4272                 DB::execute($query);\r
4273                 \r
4274                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4275                 self::action_adminskinoverview();\r
4276                 return;\r
4277         }\r
4278         \r
4279         /**\r
4280          * Admin::action_adminskinremovetype()\r
4281          * \r
4282          * @param       void\r
4283          * @return      void\r
4284          */\r
4285         static private function action_adminskinremovetype()\r
4286         {\r
4287                 global $member, $manager, $CONF;\r
4288 \r
4289                 $member->isAdmin() or self::disallow();\r
4290                 \r
4291                 $skinid         = intRequestVar('skinid');\r
4292                 $skintype       = requestVar('type');\r
4293                 \r
4294                 if ( !isValidShortName($skintype) )\r
4295                 {\r
4296                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4297                 }\r
4298                 \r
4299                 self::$skin->parse('adminskinremovetype');\r
4300                 return;\r
4301         }\r
4302         \r
4303         /**\r
4304          * Admin::action_adminskinremovetypeconfirm()\r
4305          * \r
4306          * @param       void\r
4307          * @return      void\r
4308          */\r
4309         static private function action_adminskinremovetypeconfirm()\r
4310         {\r
4311                 global $member, $CONF, $manager;\r
4312                 \r
4313                 $member->isAdmin() or self::disallow();\r
4314                 \r
4315                 $skinid         = intRequestVar('skinid');\r
4316                 $skintype       = requestVar('type');\r
4317                 \r
4318                 if ( !isValidShortName($skintype) )\r
4319                 {\r
4320                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4321                 }\r
4322                 \r
4323                 $data =array(\r
4324                         'skinid'        => $skinid,\r
4325                         'skintype'      => $skintype\r
4326                 );\r
4327                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4328 \r
4329                 // delete part\r
4330                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4331                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4332                 DB::execute($query);\r
4333                 \r
4334                 $data = array(\r
4335                         'skinid'        => $skinid,\r
4336                         'skintype'      => $skintype\r
4337                 );\r
4338                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4339                 \r
4340                 self::action_adminskinedit();\r
4341                 return;\r
4342         }\r
4343 \r
4344         /**\r
4345          * Admin::action_adminskinclone()\r
4346          * \r
4347          * @param       void\r
4348          * @return      void\r
4349          */\r
4350         static private function action_adminskinclone()\r
4351         {\r
4352                 global $member;\r
4353                 \r
4354                 $member->isAdmin() or self::disallow();\r
4355                 \r
4356                 $skinid = intRequestVar('skinid');\r
4357                 \r
4358                 // 1. read skin to clone\r
4359                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4360                 $name = "{$skin->getName()}_clone";\r
4361                 \r
4362                 // if a skin with that name already exists:\r
4363                 if ( Skin::exists($name) )\r
4364                 {\r
4365                         $i = 1;\r
4366                         while ( Skin::exists($name . $i) )\r
4367                         {\r
4368                                 $i++;\r
4369                         }\r
4370                         $name .= $i;\r
4371                 }\r
4372                 \r
4373                 // 2. create skin desc\r
4374                 $newid = Skin::createNew(\r
4375                         $name,\r
4376                         $skin->getDescription(),\r
4377                         $skin->getContentType(),\r
4378                         $skin->getIncludeMode(),\r
4379                         $skin->getIncludePrefix()\r
4380                 );\r
4381                 \r
4382                 // 3. clone\r
4383                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4384                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4385                 \r
4386                 $res = DB::getResult($query);\r
4387                 foreach ( $res as $row )\r
4388                 {\r
4389                         self::skinclonetype($skin, $newid, $row['stype']);\r
4390                 }\r
4391                 self::action_adminskinoverview();\r
4392                 return;\r
4393         }\r
4394         \r
4395         /**\r
4396          * Admin::adminskinclonetype()\r
4397          * \r
4398          * @param       string  $skin   an instance of Skin class\r
4399          * @param       integer $newid  ID for new skin\r
4400          * @param       string  $type   skin type\r
4401          * @return      void\r
4402          */\r
4403         static private function adminskinclonetype($skin, $newid, $type)\r
4404         {\r
4405                 $content = $skin->getContentFromDB($type);\r
4406                 \r
4407                 if ( $content )\r
4408                 {\r
4409                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4410                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4411                         DB::execute($query);\r
4412                 }\r
4413                 return;\r
4414         }\r
4415         \r
4416         /**\r
4417          * Admin::action_adminskinieoverview()\r
4418          * \r
4419          * @param       void\r
4420          * @return      void\r
4421          */\r
4422         static private function action_adminskinieoverview()\r
4423         {\r
4424                 global $member, $DIR_LIBS, $manager;\r
4425                 \r
4426                 $member->isAdmin() or self::disallow();\r
4427                 \r
4428                 // load skinie class\r
4429                 include_once($DIR_LIBS . 'skinie.php');\r
4430                 \r
4431                 self::$skin->parse('adminskinieoverview');\r
4432                 return;\r
4433         }\r
4434 \r
4435         /**\r
4436          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4437          * Admin::action_adminskinieimport()\r
4438          * \r
4439          * @param       void\r
4440          * @return      void\r
4441          */\r
4442         static private function action_adminskinieimport()\r
4443         {\r
4444                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4445                 \r
4446                 $member->isAdmin() or self::disallow();\r
4447                 \r
4448                 // load skinie class\r
4449                 include_once($DIR_LIBS . 'skinie.php');\r
4450                 \r
4451                 $skinFileRaw    = postVar('skinfile');\r
4452                 $mode                   = postVar('mode');\r
4453                 \r
4454                 $importer = new SKINIMPORT();\r
4455                 \r
4456                 // get full filename\r
4457                 if ( $mode == 'file' )\r
4458                 {\r
4459                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4460                         \r
4461                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4462                         if ( !file_exists($skinFile) )\r
4463                         {\r
4464                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4465                         }\r
4466                 }\r
4467                 else\r
4468                 {\r
4469                         $skinFile = $skinFileRaw;\r
4470                 }\r
4471                 \r
4472                 // read only metadata\r
4473                 $error = $importer->readFile($skinFile, 1);\r
4474                 if ( $error )\r
4475                 {\r
4476                         self::error($error);\r
4477                 }\r
4478                 \r
4479                 /* TODO: we should consider to use the other way instead of this */\r
4480                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4481                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4482                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4483                 \r
4484                 // clashes\r
4485                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4486                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4487                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4488                 /* TODO: we should consider to use the other way instead of this */\r
4489                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4490                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4491                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4492 \r
4493                 if ( !is_object(self::$skin) )\r
4494                 {\r
4495                         self::action_adminskiniedoimport();\r
4496                 }\r
4497                 else\r
4498                 {\r
4499                         self::$skin->parse('adminskinieimport');\r
4500                 }\r
4501                 return;\r
4502         }\r
4503         \r
4504         /**\r
4505          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4506          * Admin::action_adminskiniedoimport()\r
4507          * \r
4508          * @param       void\r
4509          * @return      void\r
4510          */\r
4511         static private function action_adminskiniedoimport()\r
4512         {\r
4513                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4514                 \r
4515                 $member->isAdmin() or self::disallow();\r
4516                 \r
4517                 // load skinie class\r
4518                 include_once($DIR_LIBS . 'skinie.php');\r
4519                 \r
4520                 $skinFileRaw    = postVar('skinfile');\r
4521                 $mode                   = postVar('mode');\r
4522                 $allowOverwrite = intPostVar('overwrite');\r
4523                 \r
4524                 // get full filename\r
4525                 if ( $mode == 'file' )\r
4526                 {\r
4527                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4528                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4529                         if ( !file_exists($skinFile) )\r
4530                         {\r
4531                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4532                         }\r
4533                 }\r
4534                 else\r
4535                 {\r
4536                         $skinFile = $skinFileRaw;\r
4537                 }\r
4538                 \r
4539                 $importer = new SKINIMPORT();\r
4540                 \r
4541                 $error = $importer->readFile($skinFile);\r
4542                 if ( $error )\r
4543                 {\r
4544                         self::error($error);\r
4545                 }\r
4546                 \r
4547                 $error = $importer->writeToDatabase($allowOverwrite);\r
4548                 if ( $error )\r
4549                 {\r
4550                         self::error($error);\r
4551                 }\r
4552                 \r
4553                 /* TODO: we should consider to use the other way instead of this */\r
4554                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4555                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4556                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4557                 \r
4558                 if ( !is_object(self::$skin) )\r
4559                 {\r
4560                         global $DIR_SKINS;\r
4561                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4562                         $query  = sprintf($query, sql_table('skin_desc'));\r
4563                         $res    = intval(DB::getValue($query));\r
4564                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4565                         $query  = sprintf($query, sql_table('config'), $res);\r
4566                         DB::execute($query);\r
4567                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');\r
4568                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4569                 }\r
4570                 else\r
4571                 {\r
4572                         self::$skin->parse('adminskiniedoimport');\r
4573                 }\r
4574                 return;\r
4575         }\r
4576 \r
4577         /**\r
4578          * Admin::action_adminskinieexport()\r
4579          * \r
4580          * @param       void\r
4581          * @return      void\r
4582          */\r
4583         static private function action_adminskinieexport()\r
4584         {\r
4585                 global $member, $DIR_PLUGINS;\r
4586                 \r
4587                 $member->isAdmin() or self::disallow();\r
4588                 \r
4589                 // load skinie class\r
4590                 $aSkins = requestIntArray('skin');\r
4591                 if (!is_array($aSkins)) {\r
4592                         $aSkins = array();\r
4593                 }\r
4594                 $skinList = array_keys($aSkins);\r
4595                 \r
4596                 $aTemplates = requestIntArray('template');\r
4597                 if (!is_array($aTemplates))\r
4598                 {\r
4599                         $aTemplates = array();\r
4600                 }\r
4601                 $templateList = array_keys($aTemplates);\r
4602                 \r
4603                 $info = postVar('info');\r
4604                 \r
4605                 include_libs('skinie.php');\r
4606                 $exporter = new SkinExport();\r
4607                 foreach ( $skinList as $skinId )\r
4608                 {\r
4609                         $exporter->addSkin($skinId);\r
4610                 }\r
4611                 foreach ( $templateList as $templateId )\r
4612                 {\r
4613                         $exporter->addTemplate($templateId);\r
4614                 }\r
4615                 $exporter->setInfo($info);\r
4616                 $exporter->export();\r
4617                 return;\r
4618         }\r
4619         \r
4620         /**\r
4621          * Admin::action_settingsedit()\r
4622          * \r
4623          * @param       Void\r
4624          * @return      Void\r
4625          */\r
4626         static private function action_settingsedit()\r
4627         {\r
4628                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4629                 \r
4630                 $member->isAdmin() or self::disallow();\r
4631                 \r
4632                 self::$skin->parse('settingsedit');\r
4633                 return;\r
4634         }\r
4635         \r
4636         /**\r
4637          * Admin::action_settingsupdate()\r
4638          * Update $CONFIG and redirect\r
4639          * \r
4640          * @param       void\r
4641          * @return      void\r
4642          */\r
4643         static private function action_settingsupdate()\r
4644         {\r
4645                 global $member, $CONF;\r
4646                 \r
4647                 $member->isAdmin() or self::disallow();\r
4648                 \r
4649                 // check if email address for admin is valid\r
4650                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4651                 {\r
4652                         self::error(_ERROR_BADMAILADDRESS);\r
4653                 }\r
4654                 \r
4655                 // save settings\r
4656                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4657                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4658                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4659                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4660                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4661                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4662                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4663                 self::updateConfig('Locale',                    postVar('Locale'));\r
4664                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4665                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4666                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4667                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4668                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4669                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4670                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4671                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4672                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4673                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4674                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4675                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4676                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4677                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4678                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4679                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4680                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4681                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4682                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4683                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4684                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4685                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4686                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4687                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4688                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4689                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4690                 \r
4691                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4692                 // note that when changing cookie settings, this redirect might cause the user\r
4693                 // to have to log in again.\r
4694                 getConfig();\r
4695                 redirect($CONF['AdminURL'] . '?action=manage');\r
4696                 return;\r
4697         }\r
4698         \r
4699         /**\r
4700          * Admin::action_systemoverview()\r
4701          * Output system overview\r
4702          * \r
4703          * @param       void\r
4704          * @return      void\r
4705          */\r
4706         static private function action_systemoverview()\r
4707         {\r
4708                 self::$skin->parse('systemoverview');\r
4709                 return;\r
4710         }\r
4711         \r
4712         /**\r
4713          * Admin::updateConfig()\r
4714          * \r
4715          * @param       string  $name   \r
4716          * @param       string  $val    \r
4717          * @return      integer return the ID in which the latest query posted\r
4718          */\r
4719         static private function updateConfig($name, $val)\r
4720         {\r
4721                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4722                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4723                 if ( DB::execute($query) === FALSE )\r
4724                 {\r
4725                         $err = DB::getError();\r
4726                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4727                 }\r
4728                 return DB::getInsertId();\r
4729         }\r
4730         \r
4731         /**\r
4732          * Admin::error()\r
4733          * Error message\r
4734          * \r
4735          * @param       string  $msg    message that will be shown\r
4736          * @return      void\r
4737          */\r
4738         static public function error($msg)\r
4739         {\r
4740                 self::$headMess = $msg;\r
4741                 self::$skin->parse('adminerrorpage');\r
4742                 return;\r
4743         }\r
4744         \r
4745         /**\r
4746          * Admin::disallow()\r
4747          * add error log and show error page \r
4748          * \r
4749          * @param       void\r
4750          * @return      void\r
4751          */\r
4752         static public function disallow()\r
4753         {\r
4754                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4755                 self::error(_ERROR_DISALLOWED);\r
4756                 return;\r
4757         }\r
4758 \r
4759         /**\r
4760          * Admin::action_PluginAdmin()\r
4761          * Output pluginadmin\r
4762          *\r
4763          * @param       string  $skinContents\r
4764          * @param       string  $extrahead\r
4765          * @return      void\r
4766          */\r
4767         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4768         {\r
4769                 self::$extrahead .= $extrahead;\r
4770                 self::$skin->parse('pluginadmin', $skinContents);\r
4771                 return;\r
4772         }\r
4773         \r
4774         /**\r
4775          * Admin::action_bookmarklet()\r
4776          * \r
4777          * @param       void\r
4778          * @return      void\r
4779          */\r
4780         static private function action_bookmarklet()\r
4781         {\r
4782                 global $member, $manager;\r
4783                 \r
4784                 $blogid = intRequestVar('blogid');\r
4785                 $member->teamRights($blogid) or self::disallow();\r
4786                 \r
4787                 self::$skin->parse('bookmarklet');\r
4788                 return;\r
4789         }\r
4790         \r
4791         /**\r
4792          * Admin::action_actionlog()\r
4793          * \r
4794          * @param       void\r
4795          * @return      void\r
4796          */\r
4797         static private function action_actionlog()\r
4798         {\r
4799                 global $member, $manager;\r
4800                 \r
4801                 $member->isAdmin() or self::disallow();\r
4802                 \r
4803                 self::$skin->parse('actionlog');\r
4804                 return;\r
4805         }\r
4806         \r
4807         /**\r
4808          * Admin::action_banlist()\r
4809          * \r
4810          * @param       void\r
4811          * @return      void\r
4812          */\r
4813         static private function action_banlist()\r
4814         {\r
4815                 global $member, $manager;\r
4816                 \r
4817                 $blogid = intRequestVar('blogid');\r
4818                 $member->blogAdminRights($blogid) or self::disallow();\r
4819                 \r
4820                 self::$skin->parse('banlist');\r
4821                 return;\r
4822         }\r
4823         \r
4824         /**\r
4825          * Admin::action_banlistdelete()\r
4826          * \r
4827          * @param       void\r
4828          * @return      void\r
4829          */\r
4830         static private function action_banlistdelete()\r
4831         {\r
4832                 global $member, $manager;\r
4833                 \r
4834                 $blogid = intRequestVar('blogid');\r
4835                 $member->blogAdminRights($blogid) or self::disallow();\r
4836                 \r
4837                 self::$skin->parse('banlistdelete');\r
4838                 return;\r
4839         }\r
4840         \r
4841         /**\r
4842          * Admin::action_banlistdeleteconfirm()\r
4843          * \r
4844          * @param       void\r
4845          * @return      void\r
4846          */\r
4847         static private function action_banlistdeleteconfirm()\r
4848         {\r
4849                 global $member, $manager;\r
4850                 \r
4851                 $blogid         = intPostVar('blogid');\r
4852                 $allblogs       = postVar('allblogs');\r
4853                 $iprange        = postVar('iprange');\r
4854                 \r
4855                 $member->blogAdminRights($blogid) or self::disallow();\r
4856                 \r
4857                 $deleted = array();\r
4858                 \r
4859                 if ( !$allblogs )\r
4860                 {\r
4861                         if ( Ban::removeBan($blogid, $iprange) )\r
4862                         {\r
4863                                 $deleted[] = $blogid;\r
4864                         }\r
4865                 }\r
4866                 else\r
4867                 {\r
4868                         // get blogs fot which member has admin rights\r
4869                         $adminblogs = $member->getAdminBlogs();\r
4870                         foreach ($adminblogs as $blogje)\r
4871                         {\r
4872                                 if ( Ban::removeBan($blogje, $iprange) )\r
4873                                 {\r
4874                                         $deleted[] = $blogje;\r
4875                                 }\r
4876                         }\r
4877                 }\r
4878                 \r
4879                 if ( sizeof($deleted) == 0 )\r
4880                 {\r
4881                         self::error(_ERROR_DELETEBAN);\r
4882                 }\r
4883                 \r
4884                 /* TODO: we should use other ways */\r
4885                 $_REQUEST['delblogs'] = $deleted;\r
4886                 \r
4887                 self::$skin->parse('banlistdeleteconfirm');\r
4888                 return;\r
4889         }\r
4890         \r
4891         /**\r
4892          * Admin::action_banlistnewfromitem()\r
4893          * \r
4894          * @param       void\r
4895          * @return      void\r
4896          */\r
4897         static private function action_banlistnewfromitem()\r
4898         {\r
4899                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
4900                 return;\r
4901         }\r
4902         \r
4903         /**\r
4904          * Admin::action_banlistnew()\r
4905          * \r
4906          * @param       integer $blogid ID for weblog\r
4907          * @return      void\r
4908          */\r
4909         static private function action_banlistnew($blogid = '')\r
4910         {\r
4911                 global $member, $manager;\r
4912                 \r
4913                 if ( $blogid == '' )\r
4914                 {\r
4915                         $blogid = intRequestVar('blogid');\r
4916                 }\r
4917                 \r
4918                 $ip = requestVar('ip');\r
4919                 \r
4920                 $member->blogAdminRights($blogid) or self::disallow();\r
4921                 \r
4922                 /* TODO: we should consider to use the other way instead of this */\r
4923                 $_REQUEST['blogid'] = $blogid;          \r
4924                 \r
4925                 self::$skin->parse('banlistnew');\r
4926                 \r
4927                 return;\r
4928         }\r
4929 \r
4930         /**\r
4931          * Admin::action_banlistadd()\r
4932          * \r
4933          * @param       void\r
4934          * @return      void\r
4935          */\r
4936         static private function action_banlistadd()\r
4937         {\r
4938                 global $member;\r
4939                 \r
4940                 $blogid         = intPostVar('blogid');\r
4941                 $allblogs       = postVar('allblogs');\r
4942                 $iprange        = postVar('iprange');\r
4943                 \r
4944                 if ( $iprange == "custom" )\r
4945                 {\r
4946                         $iprange = postVar('customiprange');\r
4947                 }\r
4948                 $reason   = postVar('reason');\r
4949                 \r
4950                 $member->blogAdminRights($blogid) or self::disallow();\r
4951                 \r
4952                 // TODO: check IP range validity\r
4953                 \r
4954                 if ( !$allblogs )\r
4955                 {\r
4956                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4957                         {\r
4958                                 self::error(_ERROR_ADDBAN);\r
4959                         }\r
4960                 }\r
4961                 else\r
4962                 {\r
4963                         // get blogs fot which member has admin rights\r
4964                         $adminblogs = $member->getAdminBlogs();\r
4965                         $failed = 0;\r
4966                         foreach ($adminblogs as $blogje)\r
4967                         {\r
4968                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4969                                 {\r
4970                                         $failed = 1;\r
4971                                 }\r
4972                         }\r
4973                         if ( $failed )\r
4974                         {\r
4975                                 self::error(_ERROR_ADDBAN);\r
4976                         }\r
4977                 }\r
4978                 self::action_banlist();\r
4979                 return;\r
4980         }\r
4981         \r
4982         /**\r
4983          * Admin::action_clearactionlog()\r
4984          * \r
4985          * @param       void\r
4986          * @return      void\r
4987          */\r
4988         static private function action_clearactionlog()\r
4989         {\r
4990                 global $member;\r
4991                 \r
4992                 $member->isAdmin() or self::disallow();\r
4993                 \r
4994                 ActionLog::clear();\r
4995                 \r
4996                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4997                 return;\r
4998         }\r
4999         \r
5000         /**\r
5001          * Admin::action_backupoverview()\r
5002          * \r
5003          * @param       void\r
5004          * @return      void\r
5005          */\r
5006         static private function action_backupoverview()\r
5007         {\r
5008                 global $member, $manager;\r
5009                 \r
5010                 $member->isAdmin() or self::disallow();\r
5011                 \r
5012                 self::$skin->parse('backupoverview');\r
5013                 return;\r
5014         }\r
5015 \r
5016         /**\r
5017          * Admin::action_backupcreate()\r
5018          * create file for backup\r
5019          * \r
5020          * @param               void\r
5021          * @return      void\r
5022          * \r
5023          */\r
5024         static private function action_backupcreate()\r
5025         {\r
5026                 global $member, $DIR_LIBS;\r
5027                 \r
5028                 $member->isAdmin() or self::disallow();\r
5029                 \r
5030                 // use compression ?\r
5031                 $useGzip = (integer) postVar('gzip');\r
5032                 \r
5033                 include($DIR_LIBS . 'backup.php');\r
5034                 \r
5035                 // try to extend time limit\r
5036                 // (creating/restoring dumps might take a while)\r
5037                 @set_time_limit(1200);\r
5038                 \r
5039                 Backup::do_backup($useGzip);\r
5040                 exit;\r
5041         }\r
5042         \r
5043         /**\r
5044          * Admin::action_backuprestore()\r
5045          * restoring from uploaded file\r
5046          * \r
5047          * @param               void\r
5048          * @return      void\r
5049          */\r
5050         static private function action_backuprestore()\r
5051         {\r
5052                 global $member, $DIR_LIBS;\r
5053                 \r
5054                 $member->isAdmin() or self::disallow();\r
5055                 \r
5056                 if ( intPostVar('letsgo') != 1 )\r
5057                 {\r
5058                         self::error(_ERROR_BACKUP_NOTSURE);\r
5059                 }\r
5060                 \r
5061                 include($DIR_LIBS . 'backup.php');\r
5062                 \r
5063                 // try to extend time limit\r
5064                 // (creating/restoring dumps might take a while)\r
5065                 @set_time_limit(1200);\r
5066                 \r
5067                 $message = Backup::do_restore();\r
5068                 if ( $message != '' )\r
5069                 {\r
5070                         self::error($message);\r
5071                 }\r
5072                 self::$skin->parse('backuprestore');\r
5073                 return;\r
5074         }\r
5075         \r
5076         /**\r
5077          * Admin::action_pluginlist()\r
5078          * output the list of installed plugins\r
5079          * \r
5080          * @param       void\r
5081          * @return      void\r
5082          * \r
5083          */\r
5084         static private function action_pluginlist()\r
5085         {\r
5086                 global $DIR_PLUGINS, $member, $manager;\r
5087                 \r
5088                 // check if allowed\r
5089                 $member->isAdmin() or self::disallow();\r
5090                 \r
5091                 self::$skin->parse('pluginlist');\r
5092                 return;\r
5093         }\r
5094         \r
5095         /**\r
5096          * Admin::action_pluginhelp()\r
5097          * \r
5098          * @param       void\r
5099          * @return      void\r
5100          */\r
5101         static private function action_pluginhelp()\r
5102         {\r
5103                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5104                 \r
5105                 // check if allowed\r
5106                 $member->isAdmin() or self::disallow();\r
5107                 \r
5108                 $plugid = intGetVar('plugid');\r
5109                 \r
5110                 if ( !$manager->pidInstalled($plugid) )\r
5111                 {\r
5112                         self::error(_ERROR_NOSUCHPLUGIN);\r
5113                 }\r
5114                 \r
5115                 self::$skin->parse('pluginhelp');\r
5116                 return;\r
5117         }\r
5118         \r
5119         /**\r
5120          * Admin::action_pluginadd()\r
5121          * \r
5122          * @param       Void\r
5123          * @return      Void\r
5124          * \r
5125          */\r
5126         static private function action_pluginadd()\r
5127         {\r
5128                 global $member, $manager, $DIR_PLUGINS;\r
5129                 \r
5130                 // check if allowed\r
5131                 $member->isAdmin() or self::disallow();\r
5132                 \r
5133                 $name = postVar('filename');\r
5134                 \r
5135                 if ( $manager->pluginInstalled($name) )\r
5136                 {\r
5137                         self::error(_ERROR_DUPPLUGIN);\r
5138                 }\r
5139                 \r
5140                 if ( !checkPlugin($name) )\r
5141                 {\r
5142                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5143                 }\r
5144                 \r
5145                 // get number of currently installed plugins\r
5146                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5147                 $numCurrent = $res->rowCount();\r
5148                 \r
5149                 // plugin will be added as last one in the list\r
5150                 $newOrder = $numCurrent + 1;\r
5151                 \r
5152                 $data = array('file' => &$name);\r
5153                 $manager->notify('PreAddPlugin', $data);\r
5154                 \r
5155                 // do this before calling getPlugin (in case the plugin id is used there)\r
5156                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5157                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5158                 DB::execute($query);\r
5159                 $iPid = DB::getInsertId();\r
5160                 \r
5161                 $manager->clearCachedInfo('installedPlugins');\r
5162                 \r
5163                 // Load the plugin for condition checking and instalation\r
5164                 $plugin =& $manager->getPlugin($name);\r
5165                 \r
5166                 // check if it got loaded (could have failed)\r
5167                 if ( !$plugin )\r
5168                 {\r
5169                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5170                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5171                         \r
5172                         DB::execute($query);\r
5173                         \r
5174                         $manager->clearCachedInfo('installedPlugins');\r
5175                         self::error(_ERROR_PLUGIN_LOAD);\r
5176                 }\r
5177                 \r
5178                 // check if plugin needs a newer Nucleus version\r
5179                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5180                 {\r
5181                         // uninstall plugin again...\r
5182                         self::deleteOnePlugin($plugin->getID());\r
5183                         \r
5184                         // ...and show error\r
5185                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5186                 }\r
5187                 \r
5188                 // check if plugin needs a newer Nucleus version\r
5189                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5190                 {\r
5191                         // uninstall plugin again...\r
5192                         self::deleteOnePlugin($plugin->getID());\r
5193                         \r
5194                         // ...and show error\r
5195                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5196                 }\r
5197                 \r
5198                 $pluginList = $plugin->getPluginDep();\r
5199                 foreach ( $pluginList as $pluginName )\r
5200                 {\r
5201                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5202                         if ($res->rowCount() == 0)\r
5203                         {\r
5204                                 // uninstall plugin again...\r
5205                                 self::deleteOnePlugin($plugin->getID());\r
5206                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5207                         }\r
5208                 }\r
5209                 \r
5210                 // call the install method of the plugin\r
5211                 $plugin->install();\r
5212                 \r
5213                 $data = array('plugin' => &$plugin);\r
5214                 $manager->notify('PostAddPlugin', $data);\r
5215                 \r
5216                 // update all events\r
5217                 self::action_pluginupdate();\r
5218                 return;\r
5219         }\r
5220         \r
5221         /**\r
5222          * ADMIN:action_pluginupdate():\r
5223          * \r
5224          * @param       Void\r
5225          * @return      Void\r
5226          * \r
5227          */\r
5228         static private function action_pluginupdate()\r
5229         {\r
5230                 global $member, $manager, $CONF;\r
5231                 \r
5232                 // check if allowed\r
5233                 $member->isAdmin() or self::disallow();\r
5234                 \r
5235                 // delete everything from plugin_events\r
5236                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5237                 \r
5238                 // loop over all installed plugins\r
5239                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5240                 foreach ( $res as $row )\r
5241                 {\r
5242                         $pid  =  $row['pid'];\r
5243                         $plug =& $manager->getPlugin($row['pfile']);\r
5244                         if ( $plug )\r
5245                         {\r
5246                                 $eventList = $plug->getEventList();\r
5247                                 foreach ( $eventList as $eventName )\r
5248                                 {\r
5249                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5250                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5251                                         DB::execute($query);\r
5252                                 }\r
5253                         }\r
5254                 }\r
5255                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5256                 return;\r
5257         }\r
5258         \r
5259         /**\r
5260          * Admin::action_plugindelete()\r
5261          * \r
5262          * @param       void\r
5263          * @return      void\r
5264          */\r
5265         static private function action_plugindelete()\r
5266         {\r
5267                 global $member, $manager;\r
5268                 \r
5269                 // check if allowed\r
5270                 $member->isAdmin() or self::disallow();\r
5271                 \r
5272                 $pid = intGetVar('plugid');\r
5273                 \r
5274                 if ( !$manager->pidInstalled($pid) )\r
5275                 {\r
5276                         self::error(_ERROR_NOSUCHPLUGIN);\r
5277                 }\r
5278                 \r
5279                 self::$skin->parse('plugindelete');\r
5280                 return;\r
5281         }\r
5282 \r
5283         /**\r
5284          * Admin::action_plugindeleteconfirm()\r
5285          * \r
5286          * @param       void\r
5287          * @return      void\r
5288          */\r
5289         static private function action_plugindeleteconfirm()\r
5290         {\r
5291                 global $member, $manager, $CONF;\r
5292                 \r
5293                 // check if allowed\r
5294                 $member->isAdmin() or self::disallow();\r
5295                 \r
5296                 $pid = intPostVar('plugid');\r
5297                 \r
5298                 $error = self::deleteOnePlugin($pid, 1);\r
5299                 if ( $error )\r
5300                 {\r
5301                         self::error($error);\r
5302                 }\r
5303                 \r
5304                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5305                 return;\r
5306         }\r
5307         \r
5308         /**\r
5309          * Admin::\r
5310          * \r
5311          * @param       void\r
5312          * @return      void\r
5313          */\r
5314         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5315         {\r
5316                 global $manager;\r
5317                 \r
5318                 $pid = intval($pid);\r
5319                 \r
5320                 if ( !$manager->pidInstalled($pid) )\r
5321                 {\r
5322                         return _ERROR_NOSUCHPLUGIN;\r
5323                 }\r
5324                 \r
5325                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5326                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5327                 $name = DB::getValue($query);\r
5328                 \r
5329                 // check dependency before delete\r
5330                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5331                 foreach ( $res as $row )\r
5332                 {\r
5333                         $plug =& $manager->getPlugin($row['pfile']);\r
5334                         if ( $plug )\r
5335                         {\r
5336                                 $depList = $plug->getPluginDep();\r
5337                                 foreach ( $depList as $depName )\r
5338                                 {\r
5339                                         if ( $name == $depName )\r
5340                                         {\r
5341                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5342                                         }\r
5343                                 }\r
5344                         }\r
5345                 }\r
5346                 \r
5347                 $data = array('plugid' => $pid);\r
5348                 $manager->notify('PreDeletePlugin', $data);\r
5349                 \r
5350                 // call the unInstall method of the plugin\r
5351                 if ( $callUninstall )\r
5352                 {\r
5353                         $plugin =& $manager->getPlugin($name);\r
5354                         if ( $plugin )\r
5355                         {\r
5356                                 $plugin->unInstall();\r
5357                         }\r
5358                 }\r
5359                 \r
5360                 // delete all subscriptions\r
5361                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5362                 \r
5363                 // delete all options\r
5364                 // get OIDs from plugin_option_desc\r
5365                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5366                 $aOIDs = array();\r
5367                 foreach ( $res as $row )\r
5368                 {\r
5369                         array_push($aOIDs, $row['oid']);\r
5370                 }\r
5371                 \r
5372                 // delete from plugin_option and plugin_option_desc\r
5373                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5374                 if (count($aOIDs) > 0)\r
5375                 {\r
5376                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5377                 }\r
5378                 \r
5379                 // update order numbers\r
5380                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5381                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5382                 \r
5383                 // delete row\r
5384                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5385                 \r
5386                 $manager->clearCachedInfo('installedPlugins');\r
5387                 $data = array('plugid' => $pid);\r
5388                 $manager->notify('PostDeletePlugin', $data);\r
5389                 \r
5390                 return '';\r
5391         }\r
5392         \r
5393         /**\r
5394          * Admin::action_pluginup()\r
5395          * \r
5396          * @param       void\r
5397          * @return      void\r
5398          */\r
5399         static private function action_pluginup()\r
5400         {\r
5401                 global $member, $manager, $CONF;\r
5402                 \r
5403                 // check if allowed\r
5404                 $member->isAdmin() or self::disallow();\r
5405                 \r
5406                 $plugid = intGetVar('plugid');\r
5407                 \r
5408                 if ( !$manager->pidInstalled($plugid) )\r
5409                 {\r
5410                         self::error(_ERROR_NOSUCHPLUGIN);\r
5411                 }\r
5412                 \r
5413                 // 1. get old order number\r
5414                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5415                 \r
5416                 // 2. calculate new order number\r
5417                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5418                 \r
5419                 // 3. update plug numbers\r
5420                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5421                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5422                 \r
5423                 //self::action_pluginlist();\r
5424                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5425                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5426                 return;\r
5427         }\r
5428         \r
5429         /**\r
5430          * Admin::action_plugindown()\r
5431          * \r
5432          * @param       void\r
5433          * @return      void\r
5434          */\r
5435         static private function action_plugindown()\r
5436         {\r
5437                 global $member, $manager, $CONF;\r
5438                 \r
5439                 // check if allowed\r
5440                 $member->isAdmin() or self::disallow();\r
5441                 \r
5442                 $plugid = intGetVar('plugid');\r
5443                 if ( !$manager->pidInstalled($plugid) )\r
5444                 {\r
5445                         self::error(_ERROR_NOSUCHPLUGIN);\r
5446                 }\r
5447                 \r
5448                 // 1. get old order number\r
5449                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5450                 \r
5451                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5452                 $maxOrder = $res->rowCount();\r
5453                 \r
5454                 // 2. calculate new order number\r
5455                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5456                 \r
5457                 // 3. update plug numbers\r
5458                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5459                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5460                 \r
5461                 //self::action_pluginlist();\r
5462                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5463                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5464                 return;\r
5465         }\r
5466         \r
5467         /**\r
5468          * Admin::action_pluginoptions()\r
5469          * \r
5470          * Output Plugin option page\r
5471          * \r
5472          * @access      public\r
5473          * @param       string $message message when fallbacked\r
5474          * @return      void\r
5475          * \r
5476          */\r
5477         static private function action_pluginoptions($message = '')\r
5478         {\r
5479                 global $member, $manager;\r
5480                 \r
5481                 // check if allowed\r
5482                 $member->isAdmin() or self::disallow();\r
5483                 \r
5484                 $pid = intRequestVar('plugid');\r
5485                 if ( !$manager->pidInstalled($pid) )\r
5486                 {\r
5487                         self::error(_ERROR_NOSUCHPLUGIN);\r
5488                 }\r
5489                 \r
5490                 if ( isset($message) )\r
5491                 {\r
5492                         self::$headMess = $message;\r
5493                 }\r
5494                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5495                 $plugin         = $manager->getPlugin($plugname);\r
5496                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5497                 \r
5498                 self::$skin->parse('pluginoptions');\r
5499                 return;\r
5500         }\r
5501         \r
5502         /**\r
5503          * Admin::action_pluginoptionsupdate()\r
5504          * \r
5505          * Update plugin options and fallback to plugin option page\r
5506          * \r
5507          * @access      public\r
5508          * @param       void\r
5509          * @return      void\r
5510          */\r
5511         static private function action_pluginoptionsupdate()\r
5512         {\r
5513                 global $member, $manager;\r
5514                 \r
5515                 // check if allowed\r
5516                 $member->isAdmin() or self::disallow();\r
5517                 \r
5518                 $pid = intRequestVar('plugid');\r
5519                 \r
5520                 if ( !$manager->pidInstalled($pid) )\r
5521                 {\r
5522                         self::error(_ERROR_NOSUCHPLUGIN);\r
5523                 }\r
5524                 \r
5525                 $aOptions = requestArray('plugoption');\r
5526                 NucleusPlugin::apply_plugin_options($aOptions);\r
5527                 \r
5528                 $data = array(\r
5529                         'context'       => 'global',\r
5530                         'plugid'        => $pid\r
5531                 );\r
5532                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5533                 \r
5534                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5535                 return;\r
5536         }\r
5537         \r
5538         /**\r
5539          * Admin::action_parseSpecialskin()\r
5540          * \r
5541          * @param       void\r
5542          * @return      void\r
5543          */\r
5544         static private function action_parseSpecialskin()\r
5545         {\r
5546                 self::$skin->parse(self::$action);\r
5547                 return;\r
5548         }\r
5549         \r
5550         /**\r
5551          * Admin::getAdminskinIDFromName()\r
5552          * \r
5553          * @param       string  $skinname       name of skin\r
5554          * @return      integer ID for skin\r
5555          */\r
5556         static private function getAdminskinIDFromName($skinname)\r
5557         {\r
5558                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5559                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5560                 $admnSknID      = DB::getValue($query);\r
5561                 return (integer) $adminSkinID;\r
5562         }\r
5563         \r
5564         /**\r
5565          * Admin::getAdminskinNameFromID()\r
5566          * \r
5567          * @param       integer $skinid ID for skin\r
5568          * @return      integer ID for skin\r
5569          */\r
5570         static private function getAdminskinNameFromID($skinid)\r
5571         {\r
5572                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5573                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5574                 $admnSknID      = DB::getValue($query);\r
5575                 return (integer) $adminSkinID;\r
5576         }\r
5577         \r
5578         /**\r
5579          * Admin::getAdminextrahead()\r
5580          */\r
5581         static public function getAdminextrahead()\r
5582         {\r
5583                 return self::$extrahead;\r
5584         }\r
5585         \r
5586         /**\r
5587          * Admin::getAdminpassvar()\r
5588          */\r
5589         static public function getAdminpassvar()\r
5590         {\r
5591                 return self::$passvar;\r
5592         }\r
5593         \r
5594         /**\r
5595          * Admin::getAdminAction()\r
5596          */\r
5597         static public function getAdminAction()\r
5598         {\r
5599                 return self::$action;\r
5600         }\r
5601         \r
5602         /**\r
5603          * Admin::getAdminaOption()\r
5604          */\r
5605         static public function getAdminaOption()\r
5606         {\r
5607                 return self::$aOptions;\r
5608         }\r
5609         \r
5610         /**\r
5611          * Admin::action_importAdmin()\r
5612          * \r
5613          * @param       void\r
5614          * @return      void\r
5615          */\r
5616         static private function action_importAdmin()\r
5617         {\r
5618                 global $DIR_ADMINSKINS, $action;\r
5619                 if ( $action == 'adminskinieimport' )\r
5620                 {\r
5621                         self::doAdminskinimport();\r
5622                 }\r
5623                 $skn = array();\r
5624                 if ( $action == 'showlogin' )\r
5625                 {\r
5626                         $skinName = 'showlogin';\r
5627                         $actnName = 'showlogin';\r
5628                 }\r
5629                 else\r
5630                 {\r
5631                         $skinName = 'defaultimporter';\r
5632                         $actnName = 'importAdmin';\r
5633                 }\r
5634                 \r
5635                 /* TODO: why??? */\r
5636                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5637                 $skn['id']                              = 0;\r
5638                 $skn['description']             = $skinName;\r
5639                 $skn['contentType']             = 'importAdmin';\r
5640                 $skn['includeMode']             = 'normal';\r
5641                 $skn['includePrefix']   = '';\r
5642                 $skn['name']                    = 'defaultinporter';\r
5643                 \r
5644                 self::$skin                             = (object) $skn;\r
5645                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5646                 \r
5647                 $parser = new PARSER($handler);\r
5648                 $parser->setSkin(self::$skin);\r
5649                 $parser->parse($contents);\r
5650                 \r
5651                 return;\r
5652         }\r
5653         \r
5654         /**\r
5655          * Admin::doAdminskinimport()\r
5656          * \r
5657          * @param       void\r
5658          * @return      void\r
5659          */\r
5660         static private function doAdminskinimport()\r
5661         {\r
5662                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5663                 \r
5664                 $member->isAdmin() or self::disallow();\r
5665                 \r
5666                 include_once($DIR_LIBS . 'Skinie.php');\r
5667                 $skinFileRaw    = postVar('skinfile');\r
5668                 $mode                   = postVar('mode');\r
5669                 $allowOverwrite = intPostVar('overwrite');\r
5670                 \r
5671                 if ( $mode == 'file' )\r
5672                 {\r
5673                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5674                 }\r
5675                 else\r
5676                 {\r
5677                         $skinFile = $skinFileRaw;\r
5678                 }\r
5679                 \r
5680                 $importer       = new SKINIMPORT();\r
5681                 $error          = $importer->readFile($skinFile);\r
5682                 if ( $error )\r
5683                 {\r
5684                         self::error($error);\r
5685                 }\r
5686                 $error = $importer->writeToDatabase($allowOverwrite);\r
5687                 if ( $error )\r
5688                 {\r
5689                         self::error($error);\r
5690                 }\r
5691                 \r
5692                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5693                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5694                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5695                 \r
5696                 header('Location: ' . $CONF['AdminURL']);\r
5697                 exit;\r
5698         }\r
5699 }\r