nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS, $manager, $member;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet*/\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin && Skin::existsID($memskin))\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 \r
 169                 /* NOTE: 2. make an instance of skin object */\r
 170                 if ( !Skin::existsID($skinid) )\r
 171                 {\r
 172                         return FALSE;\r
 173                 }\r
 174                 \r
 175                 /* NOTE: 3. initializing each members */\r
 176                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 177                 self::$action           = '';\r
 178                 self::$extrahead        = '';\r
 179                 self::$passvar          = '';\r
 180                 self::$headMess         = '';\r
 181                 self::$aOptions         = '';\r
 182                 return TRUE;\r
 183         }\r
 184         \r
 185         /**\r
 186          * Admin::action()\r
 187          * Executes an action\r
 188          *\r
 189          * @param       string  $action action to be performed\r
 190          * @return      void\r
 191          */\r
 192         static public function action($action)\r
 193         {\r
 194                 global $CONF, $DIR_LIBS, $manager, $member;\r
 195                 \r
 196                 /* 1. decide action name */\r
 197                 $customAction = postvar('customaction');\r
 198                 if ( !empty($customAction) )\r
 199                 {\r
 200                         $alias = array(\r
 201                                 'login' => $customAction,\r
 202                                 ''              => $customAction\r
 203                         );\r
 204                 }\r
 205                 else\r
 206                 {\r
 207                         $alias = array(\r
 208                                 'login' => 'overview',\r
 209                                 ''              => 'overview',\r
 210                         );\r
 211                 }\r
 212                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 213                 {\r
 214                         $action = $alias[$action];\r
 215                 }\r
 216                 $methodName = "action_{$action}";\r
 217                 self::$action = strtolower($action);\r
 218                 \r
 219                 /* 2. check the action */\r
 220                 $synonimActions = array(\r
 221                         'banlistnewfromitem',\r
 222                         'memberedit',\r
 223                         'login',\r
 224                 );\r
 225                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 226                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 227                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 228                 {\r
 229                         if (!$manager->checkTicket())\r
 230                         {\r
 231                                 self::error(_ERROR_BADTICKET);\r
 232                                 return;\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                         return;\r
 251                 }\r
 252                 elseif ( $id != $CONF['AdminSkin'] )\r
 253                 {\r
 254                         self::$skin =& $manager->getSkin($CONF['AdminSkin'], 'AdminActions');\r
 255                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 256                         {\r
 257                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 258                                 return;\r
 259                         }\r
 260                 }\r
 261                 else\r
 262                 {\r
 263                         self::error(_BADACTION . ENTITY::hsc($action));\r
 264                         return;\r
 265                 }\r
 266                 return;\r
 267         }\r
 268         \r
 269         /**\r
 270          * Action::existsSkinContents()\r
 271          * Check skin contents\r
 272          *\r
 273          * @param       string  $action action type\r
 274          * @return      boolean\r
 275          */\r
 276         static private function existsSkinContents($action)\r
 277         {\r
 278                 $in_array  = in_array($action, self::$skinless_actions);\r
 279                 \r
 280                 if ( $in_array )\r
 281                 {\r
 282                         return $in_array;\r
 283                 }\r
 284                 else\r
 285                 {\r
 286                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 287                         /* TODO: skinid should be a default */\r
 288                         if ( !is_object(self::$skin) )\r
 289                         {\r
 290                                 global $CONF;\r
 291                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 292                         }\r
 293                         else\r
 294                         {\r
 295                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 296                         }\r
 297                 }\r
 298                 return;\r
 299         }\r
 300         \r
 301         /**\r
 302          * Action::specialActionsAllow()\r
 303          * Check exists specialskinparts\r
 304          *\r
 305          * @param       string  $action action type\r
 306          * @return boolean\r
 307          */\r
 308         static private function specialActionsAllow($action)\r
 309         {\r
 310                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 311                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 312                 return DB::getValue($query);\r
 313         }\r
 314         \r
 315         /**\r
 316          * Action::action_showlogin()\r
 317          * \r
 318          * @param       void\r
 319          * @return      void\r
 320          */\r
 321         static private function action_showlogin()\r
 322         {\r
 323                 global $error;\r
 324                 self::action_login($error);\r
 325                 return;\r
 326         }\r
 327         \r
 328         /**\r
 329          * Action::action_login()\r
 330          * \r
 331          * @param       string  $msg            message for pageheader\r
 332          * @param       integer $passvars       ???\r
 333          */\r
 334         static private function action_login($msg = '', $passvars = 1)\r
 335         {\r
 336                 global $member;\r
 337                 \r
 338                 // skip to overview when allowed\r
 339                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 340                 {\r
 341                         self::action_overview();\r
 342                         return;\r
 343                 }\r
 344                 \r
 345                 /* TODO: needless variable??? */\r
 346                 self::$passvar = $passvars;\r
 347                 if ( $msg )\r
 348                 {\r
 349                         self::$headMess = $msg;\r
 350                 }\r
 351                 \r
 352                 self::$skin->parse('showlogin');\r
 353         }\r
 354         \r
 355         /**\r
 356          * Action::action_overview()\r
 357          * provides a screen with the overview of the actions available\r
 358          * \r
 359          * @param       string  $msg    message for pageheader\r
 360          * @return      void\r
 361          */\r
 362         static private function action_overview($msg = '')\r
 363         {\r
 364                 if ( $msg )\r
 365                 {\r
 366                         self::$headMess = $msg;\r
 367                 }\r
 368                 \r
 369                 self::$skin->parse('overview');\r
 370                 return;\r
 371         }\r
 372         \r
 373         /**\r
 374          * Admin::action_manage()\r
 375          * \r
 376          * @param       string  $msg    message for pageheader\r
 377          * @retrn       void\r
 378          */\r
 379         static private function action_manage($msg = '')\r
 380         {\r
 381                 global $member;\r
 382                 \r
 383                 if ( $msg )\r
 384                 {\r
 385                         self::$headMess = $msg;\r
 386                 }\r
 387                 $member->isAdmin() or self::disallow();\r
 388                 \r
 389                 self::$skin->parse('manage');\r
 390                 return;\r
 391         }\r
 392         \r
 393         /**\r
 394          * Action::action_itemlist()\r
 395          * \r
 396          * @param       integer id for weblod\r
 397          * @return      void\r
 398          */\r
 399         static private function action_itemlist($blogid = '')\r
 400         {\r
 401                 global $member, $manager, $CONF;\r
 402                 \r
 403                 if ( $blogid == '' )\r
 404                 {\r
 405                         $blogid = intRequestVar('blogid');\r
 406                 }\r
 407                 \r
 408                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 409                 \r
 410                 self::$skin->parse('itemlist');\r
 411                 return;\r
 412         }\r
 413         \r
 414         /**\r
 415          * Action::action_batchitem()\r
 416          * \r
 417          * @param       void\r
 418          * @return      void\r
 419          */\r
 420         static private function action_batchitem()\r
 421         {\r
 422                 global $member, $manager;\r
 423                 \r
 424                 $member->isLoggedIn() or self::disallow();\r
 425                 \r
 426                 $selected       = requestIntArray('batch');\r
 427                 $action         = requestVar('batchaction');\r
 428                 \r
 429                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 430                 {\r
 431                         self::error(_BATCH_NOSELECTION);\r
 432                         return;\r
 433                 }\r
 434                 \r
 435                 // On move: when no destination blog/category chosen, show choice now\r
 436                 $destCatid = intRequestVar('destcatid');\r
 437                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 438                 {\r
 439                         self::batchMoveSelectDestination('item', $selected);\r
 440                 }\r
 441                 \r
 442                 // On delete: check if confirmation has been given\r
 443                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 444                 {\r
 445                         self::batchAskDeleteConfirmation('item', $selected);\r
 446                 }\r
 447                 \r
 448                 self::$skin->parse('batchitem');\r
 449                 return;\r
 450         }\r
 451         \r
 452         /**\r
 453          * Action::action_batchcomment()\r
 454          * \r
 455          * @param       void\r
 456          * @return      void\r
 457          */\r
 458         static private function action_batchcomment()\r
 459         {\r
 460                 global $member;\r
 461                 \r
 462                 $member->isLoggedIn() or self::disallow();\r
 463                 \r
 464                 $selected       = requestIntArray('batch');\r
 465                 $action         = requestVar('batchaction');\r
 466                 \r
 467                 // Show error when no items were selected\r
 468                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 469                 {\r
 470                         self::error(_BATCH_NOSELECTION);\r
 471                         return;\r
 472                 }\r
 473                 \r
 474                 // On delete: check if confirmation has been given\r
 475                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 476                 {\r
 477                         self::batchAskDeleteConfirmation('comment', $selected);\r
 478                 }\r
 479                 \r
 480                 self::$skin->parse('batchcomment');\r
 481                 return;\r
 482         }\r
 483         \r
 484         /**\r
 485          * Admin::setAdminAction()\r
 486          *\r
 487          * @param       string  $action\r
 488          * @return      void\r
 489          */\r
 490         static public function setAdminAction($action)\r
 491         {\r
 492                 self::$action = $action;\r
 493                 return;\r
 494         }\r
 495         \r
 496         /**\r
 497          * Admin::action_batchmember()\r
 498          * \r
 499          * @param       void\r
 500          * @return      void\r
 501          */\r
 502         static private function action_batchmember()\r
 503         {\r
 504                 global $member;\r
 505                 \r
 506                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 507                 \r
 508                 $selected       = requestIntArray('batch');\r
 509                 $action         = requestVar('batchaction');\r
 510                 \r
 511                 // Show error when no members selected\r
 512                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 513                 {\r
 514                         self::error(_BATCH_NOSELECTION);\r
 515                         return;\r
 516                 }\r
 517                 \r
 518                 // On delete: check if confirmation has been given\r
 519                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 520                 {\r
 521                         self::batchAskDeleteConfirmation('member',$selected);\r
 522                 }\r
 523                 \r
 524                 self::$skin->parse('batchmember');\r
 525                 return;\r
 526         }\r
 527         \r
 528         /**\r
 529          * Admin::action_batchteam()\r
 530          * \r
 531          * @param       void\r
 532          * @return      void\r
 533          */\r
 534         static private function action_batchteam()\r
 535         {\r
 536                 global $member;\r
 537                 \r
 538                 $blogid = intRequestVar('blogid');\r
 539                 \r
 540                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 541                 \r
 542                 $selected       = requestIntArray('batch');\r
 543                 $action         = requestVar('batchaction');\r
 544                 \r
 545                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 546                 {\r
 547                         self::error(_BATCH_NOSELECTION);\r
 548                         return;\r
 549                 }\r
 550                 \r
 551                 // On delete: check if confirmation has been given\r
 552                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 553                 {\r
 554                         self::batchAskDeleteConfirmation('team',$selected);\r
 555                 }\r
 556                 \r
 557                 self::$skin->parse('batchteam');\r
 558                 return;\r
 559         }\r
 560         \r
 561         /**\r
 562          * Admin::action_batchcategory()\r
 563          * \r
 564          * @param       void\r
 565          * @return      void\r
 566          */\r
 567         static private function action_batchcategory()\r
 568         {\r
 569                 global $member, $manager;\r
 570                 \r
 571                 $member->isLoggedIn() or self::disallow();\r
 572                 \r
 573                 $selected       = requestIntArray('batch');\r
 574                 $action         = requestVar('batchaction');\r
 575                 \r
 576                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 577                 {\r
 578                         self::error(_BATCH_NOSELECTION);\r
 579                         return;\r
 580                 }\r
 581                 \r
 582                 // On move: when no destination blog chosen, show choice now\r
 583                 $destBlogId = intRequestVar('destblogid');\r
 584                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 585                 {\r
 586                         self::batchMoveCategorySelectDestination('category', $selected);\r
 587                 }\r
 588                 \r
 589                 // On delete: check if confirmation has been given\r
 590                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 591                 {\r
 592                         self::batchAskDeleteConfirmation('category', $selected);\r
 593                 }\r
 594                 \r
 595                 self::$skin->parse('batchcategory');\r
 596                 return;\r
 597         }\r
 598         \r
 599         /**\r
 600          * Admin::batchMoveSelectDestination()\r
 601          * \r
 602          * @param       string  $type   type of batch action\r
 603          * @param       integer $ids    needless???\r
 604          * @return      void\r
 605          * \r
 606          * TODO: remove needless argument\r
 607          */\r
 608         static private function batchMoveSelectDestination($type, $ids)\r
 609         {\r
 610                 $_POST['batchmove'] = $type;\r
 611                 self::$skin->parse('batchmove');\r
 612                 return;\r
 613         }\r
 614         \r
 615         /**\r
 616          * Admin::batchMoveCategorySelectDestination()\r
 617          * \r
 618          * @param       string  $type   type of batch action\r
 619          * @param       integer $ids    needless???\r
 620          * @return      void\r
 621          * \r
 622          * TODO: remove needless argument\r
 623          */\r
 624         static private function batchMoveCategorySelectDestination($type, $ids)\r
 625         {\r
 626                 $_POST['batchmove'] = $type;\r
 627                 global $manager;\r
 628                 self::$skin->parse('batchmovecat');\r
 629                 return;\r
 630         }\r
 631         \r
 632         /**\r
 633          * Admin::batchAskDeleteConfirmation()\r
 634          * \r
 635          * @param       string  $type   type of batch action\r
 636          * @param       integer $ids    needless???\r
 637          * @return      void\r
 638          * \r
 639          * TODO: remove needless argument\r
 640          */\r
 641         static private function batchAskDeleteConfirmation($type, $ids)\r
 642         {\r
 643                 self::$skin->parse('batchdelete');\r
 644                 return;\r
 645         }\r
 646         \r
 647         /**\r
 648          * Admin::action_browseownitems()\r
 649          * \r
 650          * @param       void\r
 651          * @return      void\r
 652          */\r
 653         static private function action_browseownitems()\r
 654         {\r
 655                 global $member, $manager, $CONF;\r
 656                 \r
 657                 self::$skin->parse('browseownitems');\r
 658                 return;\r
 659         }\r
 660         \r
 661         /**\r
 662          * Admin::action_itemcommentlist()\r
 663          * Show all the comments for a given item\r
 664          * \r
 665          * @param       integer $itemid ID for item\r
 666          * @return      void\r
 667          */\r
 668         static private function action_itemcommentlist($itemid = '')\r
 669         {\r
 670                 global $member, $manager, $CONF;\r
 671                 \r
 672                 if ( $itemid == '' )\r
 673                 {\r
 674                         $itemid = intRequestVar('itemid');\r
 675                 }\r
 676                 \r
 677                 // only allow if user is allowed to alter item\r
 678                 $member->canAlterItem($itemid) or self::disallow();\r
 679                 \r
 680                 $item =& $manager->getItem($itemid, 1, 1);\r
 681                 $_REQUEST['itemid'] = $item['itemid'];\r
 682                 $_REQUEST['blogid'] = $item['blogid'];\r
 683                 \r
 684                 self::$skin->parse('itemcommentlist');\r
 685                 return;\r
 686         }\r
 687         \r
 688         /**\r
 689          * Admin::action_browseowncomments()\r
 690          * Browse own comments\r
 691          * \r
 692          * @param       void\r
 693          * @return      void\r
 694          */\r
 695         static private function action_browseowncomments()\r
 696         {\r
 697                 self::$skin->parse('browseowncomments');\r
 698                 return;\r
 699         }\r
 700         \r
 701         /**\r
 702          * Admin::action_blogcommentlist()\r
 703          * Browse all comments for a weblog\r
 704          * \r
 705          * @param       integer $blogid ID for weblog\r
 706          * @return      void\r
 707          */\r
 708         static private function action_blogcommentlist($blogid = '')\r
 709         {\r
 710                 global $member, $manager, $CONF;\r
 711                 \r
 712                 if ( $blogid == '' )\r
 713                 {\r
 714                         $blogid = intRequestVar('blogid');\r
 715                 }\r
 716                 else\r
 717                 {\r
 718                         $blogid = intval($blogid);\r
 719                 }\r
 720                 \r
 721                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 722                 \r
 723                 /* TODO: we consider to use the other way insterad of this */\r
 724                 $_REQUEST['blogid'] = $blogid;\r
 725                 \r
 726                 self::$skin->parse('blogcommentlist');\r
 727                 return;\r
 728         }\r
 729         \r
 730         /**\r
 731          * Admin::action_createaccount()\r
 732          * \r
 733          * @param       void\r
 734          * @return      void\r
 735          */\r
 736         static private function action_createaccount()\r
 737         {\r
 738                 global $CONF;\r
 739                 \r
 740                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 741                 {\r
 742                         self::$skin->parse('createaccountdisable');\r
 743                         return;\r
 744                 }\r
 745                 \r
 746                 $name = '';\r
 747                 $realname ='';\r
 748                 $email = '';\r
 749                 $url = '';\r
 750                 \r
 751                 $contents = array(\r
 752                         'name'          => '',\r
 753                         'realname'      => '',\r
 754                         'email'         => '',\r
 755                         'url'           => ''\r
 756                 );\r
 757                 \r
 758                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 759                 {\r
 760                         $action = new Action();\r
 761                         $message = $action->createAccount();\r
 762                         if ( $message === 1 )\r
 763                         {\r
 764                                 self::$headMess = $message;\r
 765                                 self::$skin->parse('createaccountsuccess');\r
 766                                 return;\r
 767                         }\r
 768                         \r
 769                         /* TODO: validation */\r
 770                         if ( array_key_exists('name', $_POST) )\r
 771                         {\r
 772                                 $contents['name'] = $_POST['name'];\r
 773                         }\r
 774                         if ( array_key_exists('realname', $_POST) )\r
 775                         {\r
 776                                 $contents['realname'] = $_POST['realname'];\r
 777                         }\r
 778                         if ( array_key_exists('email', $_POST) )\r
 779                         {\r
 780                                 $contents['email'] = $_POST['email'];\r
 781                         }\r
 782                         if ( array_key_exists('url', $_POST) )\r
 783                         {\r
 784                                 $contents['url'] = $_POST['url'];\r
 785                         }\r
 786                         \r
 787                         self::$contents = $contents;\r
 788                         \r
 789                 }\r
 790                 \r
 791                 self::$skin->parse('createaccountinput');\r
 792                 return;\r
 793         }\r
 794         \r
 795         /**\r
 796          * Admin::action_createitem()\r
 797          * Provide a page to item a new item to the given blog\r
 798          * \r
 799          * @param       void\r
 800          * @return      void\r
 801          */\r
 802         static private function action_createitem()\r
 803         {\r
 804                 global $member, $manager;\r
 805                 \r
 806                 $blogid = intRequestVar('blogid');\r
 807                 \r
 808                 // check if allowed\r
 809                 $member->teamRights($blogid) or self::disallow();\r
 810                 \r
 811                 $blog =& $manager->getBlog($blogid);\r
 812                 $contents = array();\r
 813                 \r
 814                 $data = array(\r
 815                         'blog'          => &$blog,\r
 816                         'contents'      => &$contents\r
 817                 );\r
 818                 $manager->notify('PreAddItemForm', $data);\r
 819                 \r
 820                 if ( $blog->convertBreaks() )\r
 821                 {\r
 822                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 823                         {\r
 824                                 $contents['body'] = removeBreaks($contents['body']);\r
 825                         }\r
 826                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 827                         {\r
 828                                 $contents['more'] = removeBreaks($contents['more']);\r
 829                         }\r
 830                 }\r
 831                 \r
 832                 self::$blog = &$blog;\r
 833                 self::$contents = &$contents;\r
 834                 \r
 835                 self::$skin->parse('createitem');\r
 836                 return;\r
 837         }\r
 838         \r
 839         /**\r
 840          * Admin::action_itemedit()\r
 841          * \r
 842          * @param       void\r
 843          * @return      void\r
 844          */\r
 845         static private function action_itemedit()\r
 846         {\r
 847                 global $member, $manager;\r
 848                 \r
 849                 $itemid = intRequestVar('itemid');\r
 850                 \r
 851                 // only allow if user is allowed to alter item\r
 852                 $member->canAlterItem($itemid) or self::disallow();\r
 853                 \r
 854                 $item =& $manager->getItem($itemid, 1, 1);\r
 855                 $blog =& $manager->getBlog($item['blogid']);\r
 856                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 857                 \r
 858                 if ( $blog->convertBreaks() )\r
 859                 {\r
 860                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 861                         {\r
 862                                 $item['body'] = removeBreaks($item['body']);\r
 863                         }\r
 864                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 865                         {\r
 866                                 $item['more'] = removeBreaks($item['more']);\r
 867                         }\r
 868                 }\r
 869                 \r
 870                 self::$blog = &$blog;\r
 871                 self::$contents = &$item;\r
 872                 \r
 873                 self::$skin->parse('itemedit');\r
 874                 return;\r
 875         }\r
 876         \r
 877         /**\r
 878          * Admin::action_itemupdate()\r
 879          * \r
 880          * @param       void\r
 881          * @return      void\r
 882          */\r
 883         static private function action_itemupdate()\r
 884         {\r
 885                 global $member, $manager, $CONF;\r
 886                 \r
 887                 $itemid = intRequestVar('itemid');\r
 888                 $catid  = postVar('catid');\r
 889                 \r
 890                 // only allow if user is allowed to alter item\r
 891                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 892                 \r
 893                 $actiontype = postVar('actiontype');\r
 894                 \r
 895                 // delete actions are handled by itemdelete (which has confirmation)\r
 896                 if ( $actiontype == 'delete' )\r
 897                 {\r
 898                         self::action_itemdelete();\r
 899                         return;\r
 900                 }\r
 901                 \r
 902                 $body           = postVar('body');\r
 903                 $title          = postVar('title');\r
 904                 $more           = postVar('more');\r
 905                 $closed         = intPostVar('closed');\r
 906                 $draftid        = intPostVar('draftid');\r
 907                 \r
 908                 // default action = add now\r
 909                 if ( !$actiontype )\r
 910                 {\r
 911                         $actiontype='addnow';\r
 912                 }\r
 913                 \r
 914                 // create new category if needed\r
 915                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 916                 {\r
 917                         // get blogid\r
 918                         list($blogid) = sscanf($catid,"newcat-%d");\r
 919                         \r
 920                         // create\r
 921                         $blog =& $manager->getBlog($blogid);\r
 922                         $catid = $blog->createNewCategory();\r
 923                         \r
 924                         // show error when sth goes wrong\r
 925                         if ( !$catid )\r
 926                         {\r
 927                                 self::doError(_ERROR_CATCREATEFAIL);\r
 928                         }\r
 929                 }\r
 930                 \r
 931                 /**\r
 932                  * set some variables based on actiontype\r
 933                  * \r
 934                  * actiontypes:\r
 935                  *      draft items -> addnow, addfuture, adddraft, delete\r
 936                  *      non-draft items -> edit, changedate, delete\r
 937                  * \r
 938                  * variables set:\r
 939                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 940                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 941                  *      $publish: set to 1 when the edited item is not a draft\r
 942                  */\r
 943                 $blogid =  getBlogIDFromItemID($itemid);\r
 944                 $blog =& $manager->getBlog($blogid);\r
 945                 \r
 946                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 947                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 948                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 949                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 950                 {\r
 951                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 952                 }\r
 953                 else\r
 954                 {\r
 955                         $timestamp =0;\r
 956                 }\r
 957                 \r
 958                 // edit the item for real\r
 959                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 960                 \r
 961                 self::updateFuturePosted($blogid);\r
 962                 \r
 963                 if ( $draftid > 0 )\r
 964                 {\r
 965                         // delete permission is checked inside Item::delete()\r
 966                         Item::delete($draftid);\r
 967                 }\r
 968                 \r
 969                 if ( $catid != intPostVar('catid') )\r
 970                 {\r
 971                         self::action_categoryedit(\r
 972                                 $catid,\r
 973                                 $blog->getID(),\r
 974                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 975                         );\r
 976                 }\r
 977                 else\r
 978                 {\r
 979                         // TODO: set start item correctly for itemlist\r
 980                         $item =& $manager->getitem($itemid, 1, 1);\r
 981                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 982                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 983                         $cnt  = DB::getValue($query);\r
 984                         $_REQUEST['start'] = $cnt + 1;\r
 985                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 986                 }\r
 987                 return;\r
 988         }\r
 989         \r
 990         /**\r
 991          * Admin::action_itemdelete()\r
 992          * Delete item\r
 993          * \r
 994          * @param       Void\r
 995          * @return      Void\r
 996          */\r
 997         static private function action_itemdelete()\r
 998         {\r
 999                 global $member, $manager;\r
1000                 \r
1001                 $itemid = intRequestVar('itemid');\r
1002                 \r
1003                 // only allow if user is allowed to alter item\r
1004                 $member->canAlterItem($itemid) or self::disallow();\r
1005                 \r
1006                 if ( !$manager->existsItem($itemid,1,1) )\r
1007                 {\r
1008                         self::error(_ERROR_NOSUCHITEM);\r
1009                         return;\r
1010                 }\r
1011                 \r
1012                 self::$skin->parse('itemdelete');\r
1013                 return;\r
1014         }\r
1015         \r
1016         /**\r
1017          * Admin::action_itemdeleteconfirm()\r
1018          * \r
1019          * @param       void\r
1020          * @return      void\r
1021          */\r
1022         static private function action_itemdeleteconfirm()\r
1023         {\r
1024                 global $member, $manager;\r
1025                 \r
1026                 $itemid = intRequestVar('itemid');\r
1027                 \r
1028                 // only allow if user is allowed to alter item\r
1029                 $member->canAlterItem($itemid) or self::disallow();\r
1030                 \r
1031                 // get item first\r
1032                 $item =& $manager->getItem($itemid, 1, 1);\r
1033                 \r
1034                 // delete item (note: some checks will be performed twice)\r
1035                 self::deleteOneItem($item['itemid']);\r
1036                 \r
1037                 self::action_itemlist($item['blogid']);\r
1038                 return;\r
1039         }\r
1040         \r
1041         /**\r
1042          * Admin::deleteOneItem()\r
1043          * Deletes one item and returns error if something goes wrong\r
1044          * \r
1045          * @param       integer $itemid ID for item\r
1046          * @return      void\r
1047          */\r
1048         static public function deleteOneItem($itemid)\r
1049         {\r
1050                 global $member, $manager;\r
1051                 \r
1052                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1053                 if ( !$member->canAlterItem($itemid) )\r
1054                 {\r
1055                         return _ERROR_DISALLOWED;\r
1056                 }\r
1057                 \r
1058                 // need to get blogid before the item is deleted\r
1059                 $item =& $manager->getItem($itemid, 1, 1);\r
1060                 \r
1061                 $manager->loadClass('ITEM');\r
1062                 Item::delete($item['itemid']);\r
1063                 \r
1064                 // update blog's futureposted\r
1065                 self::updateFuturePosted($item['itemid']);\r
1066                 return;\r
1067         }\r
1068         \r
1069         /**\r
1070          * Admin::updateFuturePosted()\r
1071          * Update a blog's future posted flag\r
1072          * \r
1073          * @param integer $blogid\r
1074          * @return      void\r
1075          */\r
1076         static private function updateFuturePosted($blogid)\r
1077         {\r
1078                 global $manager;\r
1079                 \r
1080                 $blogid                 =  intval($blogid);\r
1081                 $blog                   =& $manager->getBlog($blogid);\r
1082                 $currenttime    =  $blog->getCorrectTime(time());\r
1083                 \r
1084                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1085                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1086                 $result = DB::getResult($query);\r
1087                 \r
1088                 if ( $result->rowCount() > 0 )\r
1089                 {\r
1090                                 $blog->setFuturePost();\r
1091                 }\r
1092                 else\r
1093                 {\r
1094                                 $blog->clearFuturePost();\r
1095                 }\r
1096                 return;\r
1097         }\r
1098 \r
1099         /**\r
1100          * Admin::action_itemmove()\r
1101          * \r
1102          * @param       void\r
1103          * @return      void\r
1104          */\r
1105         static private function action_itemmove()\r
1106         {\r
1107                 global $member, $manager;\r
1108                 \r
1109                 $itemid = intRequestVar('itemid');\r
1110                 \r
1111                 $member->canAlterItem($itemid) or self::disallow();\r
1112                 \r
1113                 self::$skin->parse('itemmove');\r
1114                 return;\r
1115         }\r
1116         \r
1117         /**\r
1118          * Admin::action_itemmoveto()\r
1119          * \r
1120          * @param       void\r
1121          * @return      void\r
1122          */\r
1123         static private function action_itemmoveto()\r
1124         {\r
1125                 global $member, $manager;\r
1126                 \r
1127                 $itemid = intRequestVar('itemid');\r
1128                 $catid = requestVar('catid');\r
1129                 \r
1130                 // create new category if needed\r
1131                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1132                 {\r
1133                         // get blogid\r
1134                         list($blogid) = sscanf($catid,'newcat-%d');\r
1135                         \r
1136                         // create\r
1137                         $blog =& $manager->getBlog($blogid);\r
1138                         $catid = $blog->createNewCategory();\r
1139                         \r
1140                         // show error when sth goes wrong\r
1141                         if ( !$catid )\r
1142                         {\r
1143                                 self::doError(_ERROR_CATCREATEFAIL);\r
1144                         }\r
1145                 }\r
1146                 \r
1147                 // only allow if user is allowed to alter item\r
1148                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1149                 \r
1150                 $old_blogid = getBlogIDFromItemId($itemid);\r
1151                 \r
1152                 Item::move($itemid, $catid);\r
1153                 \r
1154                 // set the futurePosted flag on the blog\r
1155                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1156                 \r
1157                 // reset the futurePosted in case the item is moved from one blog to another\r
1158                 self::updateFuturePosted($old_blogid);\r
1159                 \r
1160                 if ( $catid != intRequestVar('catid') )\r
1161                 {\r
1162                         self::action_categoryedit($catid, $blog->getID());\r
1163                 }\r
1164                 else\r
1165                 {\r
1166                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1167                 }\r
1168                 return;\r
1169         }\r
1170         \r
1171         /**\r
1172          * Admin::moveOneItem()\r
1173          * Moves one item to a given category (category existance should be checked by caller)\r
1174          * errors are returned\r
1175          * \r
1176          * @param       integer $itemid         ID for item\r
1177          * @param       integer $destCatid      ID for category to which the item will be moved\r
1178          * @return      void\r
1179          */\r
1180         static public function moveOneItem($itemid, $destCatid)\r
1181         {\r
1182                 global $member;\r
1183                 \r
1184                 // only allow if user is allowed to move item\r
1185                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1186                 {\r
1187                         return _ERROR_DISALLOWED;\r
1188                 }\r
1189                 \r
1190                 Item::move($itemid, $destCatid);\r
1191                 return;\r
1192         }\r
1193         \r
1194         /**\r
1195          * Admin::action_additem()\r
1196          * Adds a item to the chosen blog\r
1197          * \r
1198          * @param       void\r
1199          * @return      void\r
1200          */\r
1201         static private function action_additem()\r
1202         {\r
1203                 global $manager, $CONF;\r
1204                 \r
1205                 $manager->loadClass('ITEM');\r
1206                 \r
1207                 $result = Item::createFromRequest();\r
1208                 \r
1209                 if ( $result['status'] == 'error' )\r
1210                 {\r
1211                         self::error($result['message']);\r
1212                         return;\r
1213                 }\r
1214                 \r
1215                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1216                 \r
1217                 if ( $result['status'] == 'newcategory' )\r
1218                 {\r
1219                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1220                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1221                 }\r
1222                 else\r
1223                 {\r
1224                         $methodName = 'action_itemlist';\r
1225                         self::action_itemlist($item['blogid']);\r
1226                 }\r
1227                 return;\r
1228         }\r
1229         \r
1230         /**\r
1231          * Admin::action_commentedit()\r
1232          * Allows to edit previously made comments\r
1233          * \r
1234          * @param       void\r
1235          * @return      void\r
1236          */\r
1237         static private function action_commentedit()\r
1238         {\r
1239                 global $member, $manager;\r
1240                 \r
1241                 $commentid = intRequestVar('commentid');\r
1242                 \r
1243                 $member->canAlterComment($commentid) or self::disallow();\r
1244                 \r
1245                 $comment = COMMENT::getComment($commentid);\r
1246                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));\r
1247                 \r
1248                 Admin::$contents = $comment;\r
1249                 self::$skin->parse('commentedit');\r
1250                 return;\r
1251         }\r
1252         \r
1253         /**\r
1254          * Admin::action_commentupdate()\r
1255          * \r
1256          * @param       void\r
1257          * @return      void\r
1258          */\r
1259         static private function action_commentupdate()\r
1260         {\r
1261                 global $member, $manager;\r
1262                 \r
1263                 $commentid = intRequestVar('commentid');\r
1264                 \r
1265                 $member->canAlterComment($commentid) or self::disallow();\r
1266                 \r
1267                 $url    = postVar('url');\r
1268                 $email  = postVar('email');\r
1269                 $body   = postVar('body');\r
1270                 \r
1271                 // intercept words that are too long\r
1272                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1273                 {\r
1274                         self::error(_ERROR_COMMENT_LONGWORD);\r
1275                         return;\r
1276                 }\r
1277                 \r
1278                 // check length\r
1279                 if ( i18n::strlen($body) < 3 )\r
1280                 {\r
1281                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1282                         return;\r
1283                 }\r
1284                 \r
1285                 if ( i18n::strlen($body) > 5000 )\r
1286                 {\r
1287                         self::error(_ERROR_COMMENT_TOOLONG);\r
1288                         return;\r
1289                 }\r
1290                 \r
1291                 // prepare body\r
1292                 $body = Comment::prepareBody($body);\r
1293                 \r
1294                 // call plugins\r
1295                 $data = array(\r
1296                         'body' => &$body\r
1297                 );\r
1298                 $manager->notify('PreUpdateComment', $data);\r
1299                 \r
1300                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1301                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1302                 DB::execute($query);\r
1303                 \r
1304                 // get itemid\r
1305                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1306                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1307                 \r
1308                 $itemid = DB::getValue($query);\r
1309                 \r
1310                 if ( $member->canAlterItem($itemid) )\r
1311                 {\r
1312                         self::action_itemcommentlist($itemid);\r
1313                 }\r
1314                 else\r
1315                 {\r
1316                         self::action_browseowncomments();\r
1317                 }\r
1318                 return;\r
1319         }\r
1320         \r
1321         /**\r
1322          * Admin::action_commentdelete()\r
1323          * Update comment\r
1324          * \r
1325          * @param       void\r
1326          * @return      void\r
1327          */\r
1328         static private function action_commentdelete()\r
1329         {\r
1330                 global $member, $manager;\r
1331                 \r
1332                 $commentid = intRequestVar('commentid');\r
1333                 $member->canAlterComment($commentid) or self::disallow();\r
1334                 \r
1335                 self::$skin->parse('commentdelete');\r
1336                 return;\r
1337         }\r
1338         \r
1339         /**\r
1340          * Admin::action_commentdeleteconfirm()\r
1341          * \r
1342          * @param       void\r
1343          * @return      void\r
1344          */\r
1345         static private function action_commentdeleteconfirm()\r
1346         {\r
1347                 global $member;\r
1348                 \r
1349                 $commentid = intRequestVar('commentid');\r
1350                 \r
1351                 // get item id first\r
1352                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1353                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1354                 \r
1355                 $itemid = DB::getValue($query);\r
1356                 \r
1357                 $error = self::deleteOneComment($commentid);\r
1358                 if ( $error )\r
1359                 {\r
1360                         self::doError($error);\r
1361                 }\r
1362                 \r
1363                 if ( $member->canAlterItem($itemid) )\r
1364                 {\r
1365                         self::action_itemcommentlist($itemid);\r
1366                 }\r
1367                 else\r
1368                 {\r
1369                         self::action_browseowncomments();\r
1370                 }\r
1371                 return;\r
1372         }\r
1373         \r
1374         /**\r
1375          * Admin::deleteOneComment()\r
1376          * \r
1377          * @param       integer $commentid      ID for comment\r
1378          * @return      void\r
1379          */\r
1380         static public function deleteOneComment($commentid)\r
1381         {\r
1382                 global $member, $manager;\r
1383                 \r
1384                 $commentid = (integer) $commentid;\r
1385                 \r
1386                 if ( !$member->canAlterComment($commentid) )\r
1387                 {\r
1388                         return _ERROR_DISALLOWED;\r
1389                 }\r
1390                 \r
1391                 $data = array(\r
1392                         'commentid' => $commentid\r
1393                 );\r
1394                 \r
1395                 $manager->notify('PreDeleteComment', $data);\r
1396                 \r
1397                 // delete the comments associated with the item\r
1398                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1399                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1400                 DB::execute($query);\r
1401                 \r
1402                 $data = array(\r
1403                         'commentid' => $commentid\r
1404                 );\r
1405                 \r
1406                 $manager->notify('PostDeleteComment', $data);\r
1407                 \r
1408                 return '';\r
1409         }\r
1410         \r
1411         /**\r
1412          * Admin::action_usermanagement()\r
1413          * Usermanagement main\r
1414          * \r
1415          * @param       void\r
1416          * @return      void\r
1417          */\r
1418         static private function action_usermanagement()\r
1419         {\r
1420                 global $member, $manager;\r
1421                 \r
1422                 // check if allowed\r
1423                 $member->isAdmin() or self::disallow();\r
1424                 \r
1425                 self::$skin->parse('usermanagement');\r
1426                 return;\r
1427         }\r
1428         \r
1429         /**\r
1430          * Admin::action_memberedit()\r
1431          * Edit member settings\r
1432          * \r
1433          * @param       void\r
1434          * @return      void\r
1435          */\r
1436         static private function action_memberedit()\r
1437         {\r
1438                 self::action_editmembersettings(intRequestVar('memberid'));\r
1439                 return;\r
1440         }\r
1441         \r
1442         /**\r
1443          * Admin::action_editmembersettings()\r
1444          * \r
1445          * @param       integer $memberid       ID for member\r
1446          * @return      void\r
1447          * \r
1448          */\r
1449         static private function action_editmembersettings($memberid = '')\r
1450         {\r
1451                 global $member, $manager, $CONF;\r
1452                 \r
1453                 if ( $memberid == '' )\r
1454                 {\r
1455                         $memberid = $member->getID();\r
1456                 }\r
1457                 \r
1458                 /* TODO: we should consider to use the other way insterad of this */\r
1459                 $_REQUEST['memberid'] = $memberid;\r
1460                 \r
1461                 // check if allowed\r
1462                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1463                 \r
1464                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
1465                 \r
1466                 self::$skin->parse('editmembersettings');\r
1467                 return;\r
1468         }\r
1469         \r
1470         /**\r
1471          * Admin::action_changemembersettings()\r
1472          * \r
1473          * @param       void\r
1474          * @return      void\r
1475          */\r
1476         static private function action_changemembersettings()\r
1477         {\r
1478                 global $member, $CONF, $manager;\r
1479                 \r
1480                 $memberid = intRequestVar('memberid');\r
1481                 \r
1482                 // check if allowed\r
1483                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1484                 \r
1485                 $name                   = trim(strip_tags(postVar('name')));\r
1486                 $realname               = trim(strip_tags(postVar('realname')));\r
1487                 $password               = postVar('password');\r
1488                 $repeatpassword = postVar('repeatpassword');\r
1489                 $email                  = strip_tags(postVar('email'));\r
1490                 $url                    = strip_tags(postVar('url'));\r
1491                 $adminskin              = intPostVar('adminskin');\r
1492                 $bookmarklet    = intPostVar('bookmarklet');\r
1493                 \r
1494                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1495                 if ( !preg_match('#^https?://#', $url) )\r
1496                 {\r
1497                         $url = 'http://' . $url;\r
1498                 }\r
1499                 \r
1500                 $admin          = postVar('admin');\r
1501                 $canlogin       = postVar('canlogin');\r
1502                 $notes          = strip_tags(postVar('notes'));\r
1503                 $locale         = postVar('locale');\r
1504                 \r
1505                 $mem =& $manager->getMember($memberid);\r
1506                 \r
1507                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1508                 {\r
1509                         if ( !isValidDisplayName($name) )\r
1510                         {\r
1511                                 self::error(_ERROR_BADNAME);\r
1512                                 return;\r
1513                         }\r
1514                         \r
1515                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1516                         {\r
1517                                 self::error(_ERROR_NICKNAMEINUSE);\r
1518                                 return;\r
1519                         }\r
1520                         \r
1521                         if ( $password != $repeatpassword )\r
1522                         {\r
1523                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1524                                 return;\r
1525                         }\r
1526                         \r
1527                         if ( $password && (i18n::strlen($password) < 6) )\r
1528                         {\r
1529                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1530                                 return;\r
1531                         }\r
1532                                 \r
1533                         if ( $password )\r
1534                         {\r
1535                                 $pwdvalid = true;\r
1536                                 $pwderror = '';\r
1537                                 \r
1538                                 $data = array(\r
1539                                         'password'     => $password,\r
1540                                         'errormessage' => &$pwderror,\r
1541                                         'valid'        => &$pwdvalid\r
1542                                 );\r
1543                                 $manager->notify('PrePasswordSet', $data);\r
1544                                 \r
1545                                 if ( !$pwdvalid )\r
1546                                 {\r
1547                                         self::error($pwderror);\r
1548                                         return;\r
1549                                 }\r
1550                         }\r
1551                 }\r
1552                 \r
1553                 if ( !NOTIFICATION::address_validation($email) )\r
1554                 {\r
1555                         self::error(_ERROR_BADMAILADDRESS);\r
1556                         return;\r
1557                 }\r
1558                 if ( !$realname )\r
1559                 {\r
1560                         self::error(_ERROR_REALNAMEMISSING);\r
1561                         return;\r
1562                 }\r
1563                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1564                 {\r
1565                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1566                         return;\r
1567                 }\r
1568                 \r
1569                 // check if there will remain at least one site member with both the logon and admin rights\r
1570                 // (check occurs when taking away one of these rights from such a member)\r
1571                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1572                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1573                         )\r
1574                 {\r
1575                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1576                         if ( $r->rowCount() < 2 )\r
1577                         {\r
1578                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1579                                 return;\r
1580                         }\r
1581                 }\r
1582                 \r
1583                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1584                 {\r
1585                         $mem->setDisplayName($name);\r
1586                         if ( $password )\r
1587                         {\r
1588                                 $mem->setPassword($password);\r
1589                         }\r
1590                 }\r
1591                 \r
1592                 $oldEmail = $mem->getEmail();\r
1593                 \r
1594                 $mem->setRealName($realname);\r
1595                 $mem->setEmail($email);\r
1596                 $mem->setURL($url);\r
1597                 $mem->setNotes($notes);\r
1598                 $mem->setLocale($locale);\r
1599                 $mem->setAdminSkin($adminskin);\r
1600                 $mem->setBookmarklet($bookmarklet);\r
1601 \r
1602                 // only allow super-admins to make changes to the admin status\r
1603                 if ( $member->isAdmin() )\r
1604                 {\r
1605                         $mem->setAdmin($admin);\r
1606                         $mem->setCanLogin($canlogin);\r
1607                 }\r
1608                 \r
1609                 $autosave = postVar('autosave');\r
1610                 $mem->setAutosave($autosave);\r
1611                 \r
1612                 $mem->write();\r
1613                 \r
1614                 // store plugin options\r
1615                 $aOptions = requestArray('plugoption');\r
1616                 NucleusPlugin::apply_plugin_options($aOptions);\r
1617                 $data = array(\r
1618                         'context'  => 'member',\r
1619                         'memberid' => $memberid,\r
1620                         'member'   => &$mem\r
1621                 );\r
1622                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1623                 \r
1624                 // if email changed, generate new password\r
1625                 if ( $oldEmail != $mem->getEmail() )\r
1626                 {\r
1627                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1628                         // logout member\r
1629                         $mem->newCookieKey();\r
1630                         \r
1631                         // only log out if the member being edited is the current member.\r
1632                         if ( $member->getID() == $memberid )\r
1633                         {\r
1634                                 $member->logout();\r
1635                         }\r
1636                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1637                         return;\r
1638                 }\r
1639                 \r
1640                 if ( ($mem->getID() == $member->getID())\r
1641                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1642                 {\r
1643                         $mem->newCookieKey();\r
1644                         $member->logout();\r
1645                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1646                 }\r
1647                 else\r
1648                 {\r
1649                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1650                 }\r
1651                 return;\r
1652         }\r
1653 \r
1654         /**\r
1655          * Admin::action_memberadd()\r
1656          * \r
1657          * @param       void\r
1658          * @return      void\r
1659          * \r
1660          */\r
1661         static private function action_memberadd()\r
1662         {\r
1663                 global $member, $manager;\r
1664                 \r
1665                 // check if allowed\r
1666                 $member->isAdmin() or self::disallow();\r
1667                 \r
1668                 if ( postVar('password') != postVar('repeatpassword') )\r
1669                 {\r
1670                         self::error(_ERROR_PASSWORDMISMATCH);\r
1671                         return;\r
1672                 }\r
1673                 \r
1674                 if ( i18n::strlen(postVar('password')) < 6 )\r
1675                 {\r
1676                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1677                         return;\r
1678                 }\r
1679                 \r
1680                 $res = Member::create(\r
1681                         postVar('name'),\r
1682                         postVar('realname'),\r
1683                         postVar('password'),\r
1684                         postVar('email'),\r
1685                         postVar('url'),\r
1686                         postVar('admin'),\r
1687                         postVar('canlogin'),\r
1688                         postVar('notes')\r
1689                 );\r
1690                 \r
1691                 if ( $res != 1 )\r
1692                 {\r
1693                         self::error($res);\r
1694                         return;\r
1695                 }\r
1696                 \r
1697                 // fire PostRegister event\r
1698                 $newmem = new Member();\r
1699                 $newmem->readFromName(postVar('name'));\r
1700                 $data = array(\r
1701                         'member' => &$newmem\r
1702                 );\r
1703                 $manager->notify('PostRegister', $data);\r
1704                 \r
1705                 self::action_usermanagement();\r
1706                 return;\r
1707         }\r
1708         \r
1709         /**\r
1710          * Admin::action_forgotpassword()\r
1711          * \r
1712          * @param       void\r
1713          * @return      void\r
1714          */\r
1715         static private function action_forgotpassword()\r
1716         {\r
1717                 self::$skin->parse('forgotpassword');\r
1718                 return;\r
1719         }\r
1720         \r
1721         /**\r
1722          * Admin::action_activate()\r
1723          * Account activation\r
1724          * \r
1725          * @param       void\r
1726          * @return      void\r
1727          */\r
1728         static private function action_activate()\r
1729         {\r
1730                 $key = getVar('key');\r
1731                 self::showActivationPage($key);\r
1732                 return;\r
1733         }\r
1734         \r
1735         /**\r
1736          * Admin::showActivationPage()\r
1737          * \r
1738          * @param       void\r
1739          * @return      void\r
1740          */\r
1741         static private function showActivationPage($key, $message = '')\r
1742         {\r
1743                 global $manager;\r
1744                 \r
1745                 // clean up old activation keys\r
1746                 Member::cleanupActivationTable();\r
1747                 \r
1748                 // get activation info\r
1749                 $info = Member::getActivationInfo($key);\r
1750                 \r
1751                 if ( !$info )\r
1752                 {\r
1753                         self::error(_ERROR_ACTIVATE);\r
1754                         return;\r
1755                 }\r
1756                 \r
1757                 $mem =& $manager->getMember($info->vmember);\r
1758                 \r
1759                 if ( !$mem )\r
1760                 {\r
1761                         self::error(_ERROR_ACTIVATE);\r
1762                         return;\r
1763                 }\r
1764                 \r
1765                 /* TODO: we should consider to use the other way insterad of this */\r
1766                 $_POST['ackey']                                 = $key;\r
1767                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1768                 \r
1769                 self::$headMess = $message;\r
1770                 self::$skin->parse('activate');\r
1771                 return;\r
1772         }\r
1773         \r
1774         /**\r
1775          * Admin::action_activatesetpwd()\r
1776          * Account activation - set password part\r
1777          * \r
1778          * @param       void\r
1779          * @return      void\r
1780          */\r
1781         static private function action_activatesetpwd()\r
1782         {\r
1783                 global $manager;\r
1784                 $key = postVar('key');\r
1785                 \r
1786                 // clean up old activation keys\r
1787                 Member::cleanupActivationTable();\r
1788                 \r
1789                 // get activation info\r
1790                 $info = Member::getActivationInfo($key);\r
1791                 \r
1792                 if ( !$info || ($info->type == 'addresschange') )\r
1793                 {\r
1794                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1795                 }\r
1796                 \r
1797                 $mem =& $manager->getMember($info->vmember);\r
1798                 \r
1799                 if ( !$mem )\r
1800                 {\r
1801                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1802                 }\r
1803                 \r
1804                 $password               = postVar('password');\r
1805                 $repeatpassword = postVar('repeatpassword');\r
1806                 \r
1807                 if ( $password != $repeatpassword )\r
1808                 {\r
1809                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1810                 }\r
1811                 \r
1812                 if ( $password && (i18n::strlen($password) < 6) )\r
1813                 {\r
1814                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1815                 }\r
1816                         \r
1817                 if ( $password )\r
1818                 {\r
1819                         $pwdvalid = true;\r
1820                         $pwderror = '';\r
1821                         \r
1822                         $data = array(\r
1823                                 'password'              => $password,\r
1824                                 'errormessage'  => &$pwderror,\r
1825                                 'valid'                 => &$pwdvalid\r
1826                         );\r
1827                         $manager->notify('PrePasswordSet', $data);\r
1828                         if ( !$pwdvalid )\r
1829                         {\r
1830                                 return self::showActivationPage($key,$pwderror);\r
1831                         }\r
1832                 }\r
1833                 \r
1834                 $error = '';\r
1835                 \r
1836                 $data = array(\r
1837                         'type'   => 'activation',\r
1838                         'member' => $mem,\r
1839                         'error'  => &$error\r
1840                 );\r
1841                 $manager->notify('ValidateForm', $data);\r
1842                 if ( $error != '' )\r
1843                 {\r
1844                         return self::showActivationPage($key, $error);\r
1845                 }\r
1846                 \r
1847                 // set password\r
1848                 $mem->setPassword($password);\r
1849                 $mem->write();\r
1850                 \r
1851                 // do the activation\r
1852                 Member::activate($key);\r
1853                 \r
1854                 self::$skin->parse('activatesetpwd');\r
1855                 return;\r
1856         }\r
1857         \r
1858         /**\r
1859          * Admin::action_manageteam()\r
1860          * Manage team\r
1861          * \r
1862          * @param       void\r
1863          * @return      void\r
1864          */\r
1865         static private function action_manageteam()\r
1866         {\r
1867                 global $member, $manager;\r
1868                 \r
1869                 $blogid = intRequestVar('blogid');\r
1870                 \r
1871                 // check if allowed\r
1872                 $member->blogAdminRights($blogid) or self::disallow();\r
1873                 \r
1874                 self::$skin->parse('manageteam');\r
1875                 return;\r
1876         }\r
1877         \r
1878         /**\r
1879          * Admin::action_teamaddmember()\r
1880          * Add member to team\r
1881          * \r
1882          * @param       void\r
1883          * @return      void\r
1884          */\r
1885         static private function action_teamaddmember()\r
1886         {\r
1887                 global $member, $manager;\r
1888                 \r
1889                 $memberid       = intPostVar('memberid');\r
1890                 $blogid         = intPostVar('blogid');\r
1891                 $admin          = intPostVar('admin');\r
1892                 \r
1893                 // check if allowed\r
1894                 $member->blogAdminRights($blogid) or self::disallow();\r
1895                 \r
1896                 $blog =& $manager->getBlog($blogid);\r
1897                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1898                 {\r
1899                         self::error(_ERROR_ALREADYONTEAM);\r
1900                         return;\r
1901                 }\r
1902                 \r
1903                 self::action_manageteam();\r
1904                 return;\r
1905         }\r
1906         \r
1907         /**\r
1908          * Admin::action_teamdelete()\r
1909          * \r
1910          * @param       void\r
1911          * @return      void\r
1912          */\r
1913         static private function action_teamdelete()\r
1914         {\r
1915                 global $member, $manager;\r
1916                 \r
1917                 $memberid       = intRequestVar('memberid');\r
1918                 $blogid         = intRequestVar('blogid');\r
1919                 \r
1920                 // check if allowed\r
1921                 $member->blogAdminRights($blogid) or self::disallow();\r
1922                 \r
1923                 $teammem =& $manager->getMember($memberid);\r
1924                 $blog =& $manager->getBlog($blogid);\r
1925                 \r
1926                 self::$skin->parse('teamdelete');\r
1927                 return;\r
1928         }\r
1929         \r
1930         /**\r
1931          * Admin::action_teamdeleteconfirm()\r
1932          * \r
1933          * @param       void\r
1934          * @return      void\r
1935          */\r
1936         static private function action_teamdeleteconfirm()\r
1937         {\r
1938                 global $member;\r
1939                 \r
1940                 $memberid = intRequestVar('memberid');\r
1941                 $blogid = intRequestVar('blogid');\r
1942                 \r
1943                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1944                 if ( $error )\r
1945                 {\r
1946                         self::error($error);\r
1947                         return;\r
1948                 }\r
1949                 self::action_manageteam();\r
1950                 return;\r
1951         }\r
1952         \r
1953         /**\r
1954          * Admin::deleteOneTeamMember()\r
1955          * \r
1956          * @param       void\r
1957          * @return      void\r
1958          */\r
1959         static public function deleteOneTeamMember($blogid, $memberid)\r
1960         {\r
1961                 global $member, $manager;\r
1962                 \r
1963                 $blogid   = intval($blogid);\r
1964                 $memberid = intval($memberid);\r
1965                 \r
1966                 // check if allowed\r
1967                 if ( !$member->blogAdminRights($blogid) )\r
1968                 {\r
1969                         return _ERROR_DISALLOWED;\r
1970                 }\r
1971                 \r
1972                 // check if: - there remains at least one blog admin\r
1973                 //           - (there remains at least one team member)\r
1974                 $tmem =& $manager->getMember($memberid);\r
1975                 \r
1976                 \r
1977                 $data = array(\r
1978                         'member' => &$tmem,\r
1979                         'blogid' => $blogid\r
1980                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1981                 \r
1982                 if ( $tmem->isBlogAdmin($blogid) )\r
1983                 {\r
1984                         /* TODO: why we did double check? */\r
1985                         // check if there are more blog members left and at least one admin\r
1986                         // (check for at least two admins before deletion)\r
1987                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1988                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1989                         $r     = DB::getResult($query);\r
1990                         if ( $r->rowCount() < 2 )\r
1991                         {\r
1992                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1993                         }\r
1994                 }\r
1995                 \r
1996                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1997                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1998                 DB::execute($query);\r
1999                 \r
2000                 $data = array(\r
2001                         'member' => &$tmem,\r
2002                         'blogid' => $blogid\r
2003                 );\r
2004                 $manager->notify('PostDeleteTeamMember', $data);\r
2005                 \r
2006                 return '';\r
2007         }\r
2008         \r
2009         /**\r
2010          * Admin::action_teamchangeadmin()\r
2011          * \r
2012          * @param       void\r
2013          * @return      void\r
2014          */\r
2015         static private function action_teamchangeadmin()\r
2016         {\r
2017                 global $manager, $member;\r
2018                 \r
2019                 $blogid         = intRequestVar('blogid');\r
2020                 $memberid       = intRequestVar('memberid');\r
2021                 \r
2022                 // check if allowed\r
2023                 $member->blogAdminRights($blogid) or self::disallow();\r
2024                 \r
2025                 $mem =& $manager->getMember($memberid);\r
2026                 \r
2027                 // don't allow when there is only one admin at this moment\r
2028                 if ( $mem->isBlogAdmin($blogid) )\r
2029                 {\r
2030                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2031                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2032                         $r = DB::getResult($query);\r
2033                         if ( $r->rowCount() == 1 )\r
2034                         {\r
2035                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2036                                 return;\r
2037                         }\r
2038                 }\r
2039                 \r
2040                 if ( $mem->isBlogAdmin($blogid) )\r
2041                 {\r
2042                         $newval = 0;\r
2043                 }\r
2044                 else\r
2045                 {\r
2046                         $newval = 1;\r
2047                 }\r
2048                 \r
2049                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2050                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2051                 DB::execute($query);\r
2052                 \r
2053                 // only show manageteam if member did not change its own admin privileges\r
2054                 if ( $member->isBlogAdmin($blogid) )\r
2055                 {\r
2056                         self::action_manageteam();\r
2057                 }\r
2058                 else\r
2059                 {\r
2060                         self::action_overview(_MSG_ADMINCHANGED);\r
2061                 }\r
2062                 return;\r
2063         }\r
2064         \r
2065         /**\r
2066          * Admin::action_blogsettings()\r
2067          * \r
2068          * @param       void\r
2069          * @return      void\r
2070          */\r
2071         static private function action_blogsettings()\r
2072         {\r
2073                 global $member, $manager;\r
2074                 \r
2075                 $blogid = intRequestVar('blogid');\r
2076                 \r
2077                 // check if allowed\r
2078                 $member->blogAdminRights($blogid) or self::disallow();\r
2079                 \r
2080                 $blog =& $manager->getBlog($blogid);\r
2081                 \r
2082                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2083                 \r
2084                 self::$skin->parse('blogsettings');\r
2085                 return;\r
2086         }\r
2087         \r
2088         /**\r
2089          * Admin::action_categorynew()\r
2090          * \r
2091          * @param       void\r
2092          * @return      void\r
2093          */\r
2094         static private function action_categorynew()\r
2095         {\r
2096                 global $member, $manager;\r
2097                 \r
2098                 $blogid = intRequestVar('blogid');\r
2099                 \r
2100                 $member->blogAdminRights($blogid) or self::disallow();\r
2101                 \r
2102                 $cname = postVar('cname');\r
2103                 $cdesc = postVar('cdesc');\r
2104                 \r
2105                 if ( !isValidCategoryName($cname) )\r
2106                 {\r
2107                         self::error(_ERROR_BADCATEGORYNAME);\r
2108                         return;\r
2109                 }\r
2110                 \r
2111                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2112                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2113                 $res = DB::getResult($query);\r
2114                 if ( $res->rowCount() > 0 )\r
2115                 {\r
2116                         self::error(_ERROR_DUPCATEGORYNAME);\r
2117                         return;\r
2118                 }\r
2119                 \r
2120                 $blog           =& $manager->getBlog($blogid);\r
2121                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2122                 \r
2123                 self::action_blogsettings();\r
2124                 return;\r
2125         }\r
2126         \r
2127         /**\r
2128          * Admin::action_categoryedit()\r
2129          * \r
2130          * @param       void\r
2131          * @return      void\r
2132          */\r
2133         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2134         {\r
2135                 global $member, $manager;\r
2136                 \r
2137                 if ( $blogid == '' )\r
2138                 {\r
2139                         $blogid = intGetVar('blogid');\r
2140                 }\r
2141                 else\r
2142                 {\r
2143                         $blogid = intval($blogid);\r
2144                 }\r
2145                 if ( $catid == '' )\r
2146                 {\r
2147                         $catid = intGetVar('catid');\r
2148                 }\r
2149                 else\r
2150                 {\r
2151                         $catid = intval($catid);\r
2152                 }\r
2153                 \r
2154                 /* TODO: we should consider to use the other way insterad of this */\r
2155                 $_REQUEST['blogid']             = $blogid;\r
2156                 $_REQUEST['catid']              = $catid;\r
2157                 $_REQUEST['desturl']    = $desturl;\r
2158                 $member->blogAdminRights($blogid) or self::disallow();\r
2159                 \r
2160                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2161                 \r
2162                 self::$skin->parse('categoryedit');\r
2163                 return;\r
2164         }\r
2165         \r
2166         /**\r
2167          * Admin::action_categoryupdate()\r
2168          * \r
2169          * @param       void\r
2170          * @return      void\r
2171          */\r
2172         static private function action_categoryupdate()\r
2173         {\r
2174                 global $member, $manager;\r
2175                 \r
2176                 $blogid         = intPostVar('blogid');\r
2177                 $catid          = intPostVar('catid');\r
2178                 $cname          = postVar('cname');\r
2179                 $cdesc          = postVar('cdesc');\r
2180                 $desturl        = postVar('desturl');\r
2181                 \r
2182                 $member->blogAdminRights($blogid) or self::disallow();\r
2183                 \r
2184                 if ( !isValidCategoryName($cname) )\r
2185                 {\r
2186                         self::error(_ERROR_BADCATEGORYNAME);\r
2187                         return;\r
2188                 }\r
2189                 \r
2190                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2191                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2192                 $res    = DB::getResult($query);\r
2193                 if ( $res->rowCount() > 0 )\r
2194                 {\r
2195                         self::error(_ERROR_DUPCATEGORYNAME);\r
2196                         return;\r
2197                 }\r
2198                 \r
2199                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2200                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2201                 DB::execute($query);\r
2202                 \r
2203                 // store plugin options\r
2204                 $aOptions = requestArray('plugoption');\r
2205                 NucleusPlugin::apply_plugin_options($aOptions);\r
2206                 $data = array(\r
2207                         'context'       => 'category',\r
2208                         'catid'         => $catid\r
2209                 );\r
2210                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2211                 \r
2212                 if ( $desturl )\r
2213                 {\r
2214                         redirect($desturl);\r
2215                         return;\r
2216                 }\r
2217                 \r
2218                 self::action_blogsettings();\r
2219                 \r
2220                 return;\r
2221         }\r
2222         \r
2223         /**\r
2224          * Admin::action_categorydelete()\r
2225          * \r
2226          * @param       void\r
2227          * @return      void\r
2228          */\r
2229         static private function action_categorydelete()\r
2230         {\r
2231                 global $member, $manager;\r
2232                 \r
2233                 $blogid = intRequestVar('blogid');\r
2234                 $catid  = intRequestVar('catid');\r
2235                 \r
2236                 $member->blogAdminRights($blogid) or self::disallow();\r
2237                 \r
2238                 $blog =& $manager->getBlog($blogid);\r
2239                 \r
2240                 // check if the category is valid\r
2241                 if ( !$blog->isValidCategory($catid) )\r
2242                 {\r
2243                         self::error(_ERROR_NOSUCHCATEGORY);\r
2244                         return;\r
2245                 }\r
2246                 \r
2247                 // don't allow deletion of default category\r
2248                 if ( $blog->getDefaultCategory() == $catid )\r
2249                 {\r
2250                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2251                         return;\r
2252                 }\r
2253                 \r
2254                 // check if catid is the only category left for blogid\r
2255                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2256                 $query = sprintf($query, sql_table('category'), $blogid);\r
2257                 $res = DB::getResult($query);\r
2258                 if ( $res->rowCount() == 1 )\r
2259                 {\r
2260                         self::error(_ERROR_DELETELASTCATEGORY);\r
2261                         return;\r
2262                 }\r
2263                 \r
2264                 self::$skin->parse('categorydelete');\r
2265                 return;\r
2266         }\r
2267         \r
2268         /**\r
2269          * Admin::action_categorydeleteconfirm()\r
2270          * \r
2271          * @param       void\r
2272          * @return      void\r
2273          */\r
2274         static private function action_categorydeleteconfirm()\r
2275         {\r
2276                 global $member, $manager;\r
2277                 \r
2278                 $blogid = intRequestVar('blogid');\r
2279                 $catid  = intRequestVar('catid');\r
2280                 \r
2281                 $member->blogAdminRights($blogid) or self::disallow();\r
2282                 \r
2283                 $error = self::deleteOneCategory($catid);\r
2284                 if ( $error )\r
2285                 {\r
2286                         self::error($error);\r
2287                         return;\r
2288                 }\r
2289                 \r
2290                 self::action_blogsettings();\r
2291                 return;\r
2292         }\r
2293         \r
2294         /**\r
2295          * Admin::deleteOneCategory()\r
2296          * Delete a category by its id\r
2297          * \r
2298          * @param       String  $catid  category id for deleting\r
2299          * @return      Void\r
2300          */\r
2301         static public function deleteOneCategory($catid)\r
2302         {\r
2303                 global $manager, $member;\r
2304                 \r
2305                 $catid  = intval($catid);\r
2306                 $blogid = getBlogIDFromCatID($catid);\r
2307                 \r
2308                 if ( !$member->blogAdminRights($blogid) )\r
2309                 {\r
2310                         return ERROR_DISALLOWED;\r
2311                 }\r
2312                 \r
2313                 // get blog\r
2314                 $blog =& $manager->getBlog($blogid);\r
2315                 \r
2316                 // check if the category is valid\r
2317                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2318                 {\r
2319                         return _ERROR_NOSUCHCATEGORY;\r
2320                 }\r
2321                 \r
2322                 $destcatid = $blog->getDefaultCategory();\r
2323                 \r
2324                 // don't allow deletion of default category\r
2325                 if ( $blog->getDefaultCategory() == $catid )\r
2326                 {\r
2327                         return _ERROR_DELETEDEFCATEGORY;\r
2328                 }\r
2329                 \r
2330                 // check if catid is the only category left for blogid\r
2331                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2332                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2333                 \r
2334                 $res = DB::getResult($query);\r
2335                 if ( $res->rowCount() == 1 )\r
2336                 {\r
2337                         return _ERROR_DELETELASTCATEGORY;\r
2338                 }\r
2339                 \r
2340                 $data = array('catid' => $catid);\r
2341                 $manager->notify('PreDeleteCategory', $data);\r
2342                 \r
2343                 // change category for all items to the default category\r
2344                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2345                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2346                 DB::execute($query);\r
2347                 \r
2348                 // delete all associated plugin options\r
2349                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2350                 \r
2351                 // delete category\r
2352                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2353                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2354                 DB::execute($query);\r
2355                 \r
2356                 $data = array('catid' => $catid);\r
2357                 $manager->notify('PostDeleteCategory', $data);\r
2358                 return;\r
2359         }\r
2360         \r
2361         /**\r
2362          * Admin::moveOneCategory()\r
2363          * Delete a category by its id\r
2364          * \r
2365          * @param       int     $catid          category id for move\r
2366          * @param       int     $destblogid     blog id for destination\r
2367          * @return      void\r
2368          */\r
2369         static public function moveOneCategory($catid, $destblogid)\r
2370         {\r
2371                 global $manager, $member;\r
2372                 $catid      = intval($catid);\r
2373                 $destblogid = intval($destblogid);\r
2374                 $blogid     = getBlogIDFromCatID($catid);\r
2375                 // mover should have admin rights on both blogs\r
2376                 if (!$member->blogAdminRights($blogid)) {\r
2377                         return _ERROR_DISALLOWED;\r
2378                 }\r
2379                 if (!$member->blogAdminRights($destblogid)) {\r
2380                         return _ERROR_DISALLOWED;\r
2381                 }\r
2382                 // cannot move to self\r
2383                 if ($blogid == $destblogid) {\r
2384                         return _ERROR_MOVETOSELF;\r
2385                 }\r
2386                 // get blogs\r
2387                 $blog     =& $manager->getBlog($blogid);\r
2388                 $destblog =& $manager->getBlog($destblogid);\r
2389                 // check if the category is valid\r
2390                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2391                         return _ERROR_NOSUCHCATEGORY;\r
2392                 }\r
2393                 // don't allow default category to be moved\r
2394                 if ($blog->getDefaultCategory() == $catid) {\r
2395                         return _ERROR_MOVEDEFCATEGORY;\r
2396                 }\r
2397                 $manager->notify(\r
2398                                 'PreMoveCategory',\r
2399                                 array(\r
2400                                                 'catid'      => &$catid,\r
2401                                                 'sourceblog' => &$blog,\r
2402                                                 'destblog'   => &$destblog\r
2403                                 )\r
2404                 );\r
2405                 // update comments table (cblog)\r
2406                 $query = 'SELECT '\r
2407                 . '    inumber '\r
2408                 . 'FROM '\r
2409                 .      sql_table('item') . ' '\r
2410                 . 'WHERE '\r
2411                 . '    icat = %d';\r
2412                 $items = sql_query(sprintf($query, $catid));\r
2413                 while ($oItem = sql_fetch_object($items)) {\r
2414                         $query = 'UPDATE '\r
2415                         .      sql_table('comment') . ' '\r
2416                         . 'SET '\r
2417                         . '    cblog = %d' . ' '\r
2418                         . 'WHERE '\r
2419                         . '    citem = %d';\r
2420                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2421                 }\r
2422         \r
2423                 // update items (iblog)\r
2424                 $query = 'UPDATE '\r
2425                 .      sql_table('item') . ' '\r
2426                 . 'SET '\r
2427                 . '    iblog = %d '\r
2428                 . 'WHERE '\r
2429                 . '    icat = %d';\r
2430                 sql_query(sprintf($query, $destblogid, $catid));\r
2431         \r
2432                 // move category\r
2433                 $query = 'UPDATE '\r
2434                 .      sql_table('category') . ' '\r
2435                 . 'SET '\r
2436                 . '    cblog = %d' . ' '\r
2437                 . 'WHERE '\r
2438                 . '    catid = %d';\r
2439                 sql_query(sprintf($query, $destblogid, $catid));\r
2440                 $manager->notify(\r
2441                                 'PostMoveCategory',\r
2442                                 array(\r
2443                                                 'catid'      => &$catid,\r
2444                                                 'sourceblog' => &$blog,\r
2445                                                 'destblog'   => $destblog\r
2446                                 )\r
2447                 );\r
2448                 return;\r
2449         }\r
2450 \r
2451         /**\r
2452          * Admin::action_blogsettingsupdate\r
2453          * Updating blog settings\r
2454          * \r
2455          * @param       Void\r
2456          * @return      Void\r
2457          */\r
2458         static private function action_blogsettingsupdate()\r
2459         {\r
2460                 global $member, $manager;\r
2461                 \r
2462                 $blogid = intRequestVar('blogid');\r
2463                 \r
2464                 $member->blogAdminRights($blogid) or self::disallow();\r
2465                 \r
2466                 $blog =& $manager->getBlog($blogid);\r
2467                 \r
2468                 $notify_address = trim(postVar('notify'));\r
2469                 $shortname              = trim(postVar('shortname'));\r
2470                 $updatefile             = trim(postVar('update'));\r
2471                 \r
2472                 $notifyComment  = intPostVar('notifyComment');\r
2473                 $notifyVote             = intPostVar('notifyVote');\r
2474                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2475                 \r
2476                 if ( $notifyComment == 0 )\r
2477                 {\r
2478                         $notifyComment = 1;\r
2479                 }\r
2480                 if ( $notifyVote == 0 )\r
2481                 {\r
2482                         $notifyVote = 1;\r
2483                 }\r
2484                 if ( $notifyNewItem == 0 )\r
2485                 {\r
2486                         $notifyNewItem = 1;\r
2487                 }\r
2488                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2489                 \r
2490                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2491                 {\r
2492                         self::error(_ERROR_BADNOTIFY);\r
2493                         return;\r
2494                 }\r
2495                 \r
2496                 if ( !isValidShortName($shortname) )\r
2497                 {\r
2498                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2499                         return;\r
2500                 }\r
2501                 \r
2502                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2503                 {\r
2504                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2505                         return;\r
2506                 }\r
2507                 // check if update file is writable\r
2508                 if ( $updatefile && !is_writeable($updatefile) )\r
2509                 {\r
2510                         self::error(_ERROR_UPDATEFILE);\r
2511                         return;\r
2512                 }\r
2513                 \r
2514                 $blog->setName(trim(postVar('name')));\r
2515                 $blog->setShortName($shortname);\r
2516                 $blog->setNotifyAddress($notify_address);\r
2517                 $blog->setNotifyType($notifyType);\r
2518                 $blog->setMaxComments(postVar('maxcomments'));\r
2519                 $blog->setCommentsEnabled(postVar('comments'));\r
2520                 $blog->setTimeOffset(postVar('timeoffset'));\r
2521                 $blog->setUpdateFile($updatefile);\r
2522                 $blog->setURL(trim(postVar('url')));\r
2523                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2524                 $blog->setDescription(trim(postVar('desc')));\r
2525                 $blog->setPublic(postVar('public'));\r
2526                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2527                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2528                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2529                 $blog->setSearchable(intPostVar('searchable'));\r
2530                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2531                 $blog->writeSettings();\r
2532                 \r
2533                 // store plugin options\r
2534                 $aOptions = requestArray('plugoption');\r
2535                 NucleusPlugin::apply_plugin_options($aOptions);\r
2536                 \r
2537                 $data = array(\r
2538                         'context' => 'blog',\r
2539                         'blogid'  => $blogid,\r
2540                         'blog'    => &$blog\r
2541                 );\r
2542                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2543                 \r
2544                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2545                 return;\r
2546         }\r
2547         \r
2548         /**\r
2549          * Admin::action_deleteblog()\r
2550          * \r
2551          * @param       void\r
2552          * @return      void\r
2553          */\r
2554         static private function action_deleteblog()\r
2555         {\r
2556                 global $member, $CONF, $manager;\r
2557                 \r
2558                 $blogid = intRequestVar('blogid');\r
2559                 \r
2560                 $member->blogAdminRights($blogid) or self::disallow();\r
2561                 \r
2562                 // check if blog is default blog\r
2563                 if ( $CONF['DefaultBlog'] == $blogid )\r
2564                 {\r
2565                         self::error(_ERROR_DELDEFBLOG);\r
2566                         return;\r
2567                 }\r
2568                 \r
2569                 $blog =& $manager->getBlog($blogid);\r
2570                 \r
2571                 self::$skin->parse('deleteblog');\r
2572                 return;\r
2573         }\r
2574         \r
2575         /**\r
2576          * Admin::action_deleteblogconfirm()\r
2577          * Delete Blog\r
2578          * \r
2579          * @param       Void\r
2580          * @return      Void\r
2581          */\r
2582         static private function action_deleteblogconfirm()\r
2583         {\r
2584                 global $member, $CONF, $manager;\r
2585                 \r
2586                 $blogid = intRequestVar('blogid');\r
2587                 \r
2588                 $data = array('blogid' => $blogid);\r
2589                 $manager->notify('PreDeleteBlog', $data);\r
2590                 \r
2591                 $member->blogAdminRights($blogid) or self::disallow();\r
2592                 \r
2593                 // check if blog is default blog\r
2594                 if ( $CONF['DefaultBlog'] == $blogid )\r
2595                 {\r
2596                         self::error(_ERROR_DELDEFBLOG);\r
2597                         return;\r
2598                 }\r
2599                 \r
2600                 // delete all comments\r
2601                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2602                 DB::execute($query);\r
2603                 \r
2604                 // delete all items\r
2605                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2606                 DB::execute($query);\r
2607                 \r
2608                 // delete all team members\r
2609                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2610                 DB::execute($query);\r
2611                 \r
2612                 // delete all bans\r
2613                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2614                 DB::execute($query);\r
2615                 \r
2616                 // delete all categories\r
2617                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2618                 DB::execute($query);\r
2619                 \r
2620                 // delete all associated plugin options\r
2621                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2622                 \r
2623                 // delete the blog itself\r
2624                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2625                 DB::execute($query);\r
2626                 \r
2627                 $data = array('blogid' => $blogid);\r
2628                 $manager->notify('PostDeleteBlog', $data);\r
2629                 \r
2630                 self::action_overview(_DELETED_BLOG);\r
2631                 return;\r
2632         }\r
2633         \r
2634         /**\r
2635          * Admin::action_memberdelete()\r
2636          * \r
2637          * @param       void\r
2638          * @return      void\r
2639          */\r
2640         static private function action_memberdelete()\r
2641         {\r
2642                 global $member, $manager;\r
2643                 \r
2644                 $memberid = intRequestVar('memberid');\r
2645                 \r
2646                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2647                 \r
2648                 $mem =& $manager->getMember($memberid);\r
2649                 \r
2650                 self::$skin->parse('memberdelete');\r
2651                 return;\r
2652         }\r
2653         \r
2654         /**\r
2655          * Admin::action_memberdeleteconfirm()\r
2656          * \r
2657          * @param       void\r
2658          * @return      void\r
2659          */\r
2660         static private function action_memberdeleteconfirm()\r
2661         {\r
2662                 global $member;\r
2663                 \r
2664                 $memberid = intRequestVar('memberid');\r
2665                 \r
2666                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2667                 \r
2668                 $error = self::deleteOneMember($memberid);\r
2669                 if ( $error )\r
2670                 {\r
2671                         self::error($error);\r
2672                         return;\r
2673                 }\r
2674                 \r
2675                 if ( $member->isAdmin() )\r
2676                 {\r
2677                         self::action_usermanagement();\r
2678                         return;\r
2679                 }\r
2680                 else\r
2681                 {\r
2682                         self::action_overview(_DELETED_MEMBER);\r
2683                         return;\r
2684                 }\r
2685                 return;\r
2686         }\r
2687         \r
2688         /**\r
2689          * Admin::deleteOneMember()\r
2690          * Delete a member by id\r
2691          * \r
2692          * @static\r
2693          * @params      Integer $memberid       member id\r
2694          * @return      String  null string or error messages\r
2695          */\r
2696         static public function deleteOneMember($memberid)\r
2697         {\r
2698                 global $manager;\r
2699                 \r
2700                 $memberid = intval($memberid);\r
2701                 $mem =& $manager->getMember($memberid);\r
2702                 \r
2703                 if ( !$mem->canBeDeleted() )\r
2704                 {\r
2705                         return _ERROR_DELETEMEMBER;\r
2706                 }\r
2707                 \r
2708                 $data = array('member' => &$mem);\r
2709                 $manager->notify('PreDeleteMember', $data);\r
2710                 \r
2711                 /* unlink comments from memberid */\r
2712                 if ( $memberid )\r
2713                 {\r
2714                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2715                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2716                         DB::execute($query);\r
2717                 }\r
2718                 \r
2719                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2720                 DB::execute($query);\r
2721                 \r
2722                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2723                 DB::execute($query);\r
2724                 \r
2725                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2726                 DB::execute($query);\r
2727                 \r
2728                 // delete all associated plugin options\r
2729                 NucleusPlugin::delete_option_values('member', $memberid);\r
2730                 \r
2731                 $data = array('member' => &$mem);\r
2732                 $manager->notify('PostDeleteMember', $data);\r
2733                 \r
2734                 return '';\r
2735         }\r
2736         \r
2737         /**\r
2738          * Admin::action_createnewlog()\r
2739          * \r
2740          * @param       void\r
2741          * @return      void\r
2742          */\r
2743         static private function action_createnewlog()\r
2744         {\r
2745                 global $member, $CONF, $manager;\r
2746                 \r
2747                 // Only Super-Admins can do this\r
2748                 $member->isAdmin() or self::disallow();\r
2749                 \r
2750                 self::$skin->parse('createnewlog');\r
2751                 return;\r
2752         }\r
2753         \r
2754         /**\r
2755          * Admin::action_addnewlog()\r
2756          * \r
2757          * @param       void\r
2758          * @return      void\r
2759          */\r
2760         static private function action_addnewlog()\r
2761         {\r
2762                 global $member, $manager, $CONF;\r
2763                 \r
2764                 // Only Super-Admins can do this\r
2765                 $member->isAdmin() or self::disallow();\r
2766                 \r
2767                 $bname                  = trim(postVar('name'));\r
2768                 $bshortname             = trim(postVar('shortname'));\r
2769                 $btimeoffset    = postVar('timeoffset');\r
2770                 $bdesc                  = trim(postVar('desc'));\r
2771                 $bdefskin               = postVar('defskin');\r
2772                 \r
2773                 if ( !isValidShortName($bshortname) )\r
2774                 {\r
2775                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2776                         return;\r
2777                 }\r
2778                 \r
2779                 if ( $manager->existsBlog($bshortname) )\r
2780                 {\r
2781                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2782                         return;\r
2783                 }\r
2784                 \r
2785                 $data = array(\r
2786                         'name'        => &$bname,\r
2787                         'shortname'   => &$bshortname,\r
2788                         'timeoffset'  => &$btimeoffset,\r
2789                         'description' => &$bdesc,\r
2790                         'defaultskin' => &$bdefskin\r
2791                 );\r
2792                 $manager->notify('PreAddBlog', $data);\r
2793                 \r
2794                 // add slashes for sql queries\r
2795                 $bname                  = DB::quoteValue($bname);\r
2796                 $bshortname             = DB::quoteValue($bshortname);\r
2797                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2798                 $bdesc                  = DB::quoteValue($bdesc);\r
2799                 $bdefskin               = DB::quoteValue($bdefskin);\r
2800                 \r
2801                 // create blog\r
2802                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2803                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2804                 DB::execute($query);\r
2805                 \r
2806                 $blogid = DB::getInsertId();\r
2807                 $blog   =& $manager->getBlog($blogid);\r
2808                 \r
2809                 // create new category\r
2810                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2811                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2812                 \r
2813                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2814                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2815                 $catid = DB::getInsertId();\r
2816                 \r
2817                 // set as default category\r
2818                 $blog->setDefaultCategory($catid);\r
2819                 $blog->writeSettings();\r
2820                 \r
2821                 // create team member\r
2822                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2823                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2824                 DB::execute($query);\r
2825                 \r
2826                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2827                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2828                 \r
2829                 $blog->additem(\r
2830                         $blog->getDefaultCategory(),\r
2831                         $itemdeftitle,$itemdefbody,\r
2832                         '',\r
2833                         $blogid,\r
2834                         $member->getID(),\r
2835                         $blog->getCorrectTime(),\r
2836                         0,\r
2837                         0,\r
2838                         0\r
2839                 );\r
2840                 \r
2841                 $data = array('blog' => &$blog);\r
2842                 $manager->notify('PostAddBlog', $data);\r
2843                 \r
2844                 $data = array(\r
2845                         'blog'                  => &$blog,\r
2846                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2847                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2848                         'catid'                 => $catid\r
2849                 );\r
2850                 $manager->notify('PostAddCategory', $data);\r
2851                 \r
2852                 /* TODO: we should consider to use the other way insterad of this */\r
2853                 $_REQUEST['blogid'] = $blogid;\r
2854                 $_REQUEST['catid']  = $catid;\r
2855                 self::$skin->parse('addnewlog');\r
2856                 return;\r
2857         }\r
2858         \r
2859         /**\r
2860          * Admin::action_addnewlog2()\r
2861          * \r
2862          * @param       void\r
2863          * @return      void\r
2864          */\r
2865         static private function action_addnewlog2()\r
2866         {\r
2867                 global $member, $manager;\r
2868                 $blogid = intRequestVar('blogid');\r
2869                 \r
2870                 $member->blogAdminRights($blogid) or self::disallow();\r
2871                 \r
2872                 $burl = requestVar('url');\r
2873                 \r
2874                 $blog =& $manager->getBlog($blogid);\r
2875                 $blog->setURL(trim($burl));\r
2876                 $blog->writeSettings();\r
2877                 \r
2878                 self::action_overview(_MSG_NEWBLOG);\r
2879                 return;\r
2880         }\r
2881         \r
2882         /**\r
2883          * Admin::action_skinieoverview()\r
2884          * \r
2885          * @param       void\r
2886          * @return      void\r
2887          */\r
2888         static private function action_skinieoverview()\r
2889         {\r
2890                 global $member, $DIR_LIBS, $manager;\r
2891                 \r
2892                 $member->isAdmin() or self::disallow();\r
2893                 \r
2894                 include_once($DIR_LIBS . 'skinie.php');\r
2895                 \r
2896                 self::$skin->parse('skinieoverview');\r
2897                 return;\r
2898         }\r
2899         \r
2900         /**\r
2901          * Admin::action_skinieimport()\r
2902          * \r
2903          * @param       void\r
2904          * @return      void\r
2905          */\r
2906         static private function action_skinieimport()\r
2907         {\r
2908                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2909                 \r
2910                 $member->isAdmin() or self::disallow();\r
2911                 \r
2912                 // load skinie class\r
2913                 include_once($DIR_LIBS . 'skinie.php');\r
2914                 \r
2915                 $skinFileRaw    = postVar('skinfile');\r
2916                 $mode                   = postVar('mode');\r
2917                 \r
2918                 $importer = new SkinImport();\r
2919                 \r
2920                 // get full filename\r
2921                 if ( $mode == 'file' )\r
2922                 {\r
2923                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2924                         \r
2925                         /* TODO: remove this\r
2926                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2927                         if ( !file_exists($skinFile) )\r
2928                         {\r
2929                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2930                         }\r
2931                          */\r
2932                 }\r
2933                 else\r
2934                 {\r
2935                         $skinFile = $skinFileRaw;\r
2936                 }\r
2937                 \r
2938                 // read only metadata\r
2939                 $error = $importer->readFile($skinFile, 1);\r
2940                 \r
2941                 /* TODO: we should consider to use the other way insterad of this */\r
2942                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2943                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2944                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2945                 \r
2946                 // clashes\r
2947                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2948                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2949                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2950                 \r
2951                 /* TODO: we should consider to use the other way insterad of this */\r
2952                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2953                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2954                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2955                 \r
2956                 if ( $error )\r
2957                 {\r
2958                         self::error($error);\r
2959                         return;\r
2960                 }\r
2961                 \r
2962                 self::$skin->parse('skinieimport');\r
2963                 return;\r
2964         }\r
2965         \r
2966         /**\r
2967          * Admin::action_skiniedoimport()\r
2968          * \r
2969          * @param       void\r
2970          * @return      void\r
2971          */\r
2972         static private function action_skiniedoimport()\r
2973         {\r
2974                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2975                 \r
2976                 $member->isAdmin() or self::disallow();\r
2977                 \r
2978                 // load skinie class\r
2979                 include_once($DIR_LIBS . 'skinie.php');\r
2980                 \r
2981                 $skinFileRaw    = postVar('skinfile');\r
2982                 $mode                   = postVar('mode');\r
2983                 \r
2984                 $allowOverwrite = intPostVar('overwrite');\r
2985                 \r
2986                 // get full filename\r
2987                 if ( $mode == 'file' )\r
2988                 {\r
2989                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2990                         \r
2991                         /* TODO: remove this\r
2992                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2993                         if ( !file_exists($skinFile) )\r
2994                         {\r
2995                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2996                         }\r
2997                         */\r
2998                 }\r
2999                 else\r
3000                 {\r
3001                         $skinFile = $skinFileRaw;\r
3002                 }\r
3003                 \r
3004                 $importer = new SkinImport();\r
3005                 \r
3006                 $error = $importer->readFile($skinFile);\r
3007                 \r
3008                 if ( $error )\r
3009                 {\r
3010                         self::error($error);\r
3011                         return;\r
3012                 }\r
3013                 \r
3014                 $error = $importer->writeToDatabase($allowOverwrite);\r
3015                 \r
3016                 if ( $error )\r
3017                 {\r
3018                         self::error($error);\r
3019                         return;\r
3020                 }\r
3021                 \r
3022                 /* TODO: we should consider to use the other way insterad of this */\r
3023                 $_REQUEST['skininfo']  = $importer->getInfo();\r
3024                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
3025                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
3026                 \r
3027                 self::$skin->parse('skiniedoimport');\r
3028                 return;\r
3029         }\r
3030 \r
3031         /**\r
3032          * Admin::action_skinieexport()\r
3033          * \r
3034          * @param       void\r
3035          * @return      void\r
3036          */\r
3037         static private function action_skinieexport()\r
3038         {\r
3039                 global $member, $DIR_LIBS;\r
3040                 \r
3041                 $member->isAdmin() or self::disallow();\r
3042                 \r
3043                 // load skinie class\r
3044                 include_once($DIR_LIBS . 'skinie.php');\r
3045                 \r
3046                 $aSkins         = requestIntArray('skin');\r
3047                 $aTemplates     = requestIntArray('template');\r
3048                 \r
3049                 if ( !is_array($aTemplates) )\r
3050                 {\r
3051                         $aTemplates = array();\r
3052                 }\r
3053                 if ( !is_array($aSkins) )\r
3054                 {\r
3055                         $aSkins = array();\r
3056                 }\r
3057                 \r
3058                 $skinList               = array_keys($aSkins);\r
3059                 $templateList   = array_keys($aTemplates);\r
3060                 \r
3061                 $info = postVar('info');\r
3062                 \r
3063                 $exporter = new SkinExport();\r
3064                 foreach ( $skinList as $skinId )\r
3065                 {\r
3066                         $exporter->addSkin($skinId);\r
3067                 }\r
3068                 foreach ($templateList as $templateId)\r
3069                 {\r
3070                         $exporter->addTemplate($templateId);\r
3071                 }\r
3072                 $exporter->setInfo($info);\r
3073                 \r
3074                 $exporter->export();\r
3075                 return;\r
3076         }\r
3077         \r
3078         /**\r
3079          * Admin::action_templateoverview()\r
3080          * \r
3081          * @param       void\r
3082          * @return      void\r
3083          */\r
3084         static private function action_templateoverview()\r
3085         {\r
3086                 global $member, $manager;\r
3087                 \r
3088                 $member->isAdmin() or self::disallow();\r
3089                 \r
3090                 self::$skin->parse('templateoverview');\r
3091                 return;\r
3092         }\r
3093         \r
3094         /**\r
3095          * Admin::action_templateedit()\r
3096          * \r
3097          * @param       string  $msg    message for pageheader\r
3098          * @return      void\r
3099          */\r
3100         static private function action_templateedit($msg = '')\r
3101         {\r
3102                 global $member, $manager;\r
3103                 if ( $msg )\r
3104                 {\r
3105                         self::$headMess = $msg;\r
3106                 }\r
3107                 \r
3108                 $templateid = intRequestVar('templateid');\r
3109                 \r
3110                 $member->isAdmin() or self::disallow();\r
3111                 \r
3112                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3113                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3114                 \r
3115                 self::$skin->parse('templateedit');\r
3116                 return;\r
3117         }\r
3118         \r
3119         /**\r
3120          * Admin::action_templateupdate()\r
3121          * \r
3122          * @param       void\r
3123          * @return      void\r
3124          */\r
3125         static private function action_templateupdate()\r
3126         {\r
3127                 global $member,$manager;\r
3128                 \r
3129                 $templateid = intRequestVar('templateid');\r
3130                 \r
3131                 $member->isAdmin() or self::disallow();\r
3132                 \r
3133                 $name = postVar('tname');\r
3134                 $desc = postVar('tdesc');\r
3135                 \r
3136                 if ( !isValidTemplateName($name) )\r
3137                 {\r
3138                         self::error(_ERROR_BADTEMPLATENAME);\r
3139                         return;\r
3140                 }\r
3141                 \r
3142                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3143                 {\r
3144                         self::error(_ERROR_DUPTEMPLATENAME);\r
3145                         return;\r
3146                 }\r
3147                 \r
3148                 // 1. Remove all template parts\r
3149                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3150                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3151                 DB::execute($query);\r
3152                 \r
3153                 // 2. Update description\r
3154                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3155                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3156                 DB::execute($query);\r
3157                 \r
3158                 // 3. Add non-empty template parts\r
3159                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3160                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3161                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3162                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3163                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3164                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3165                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3166                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3167                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3168                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3169                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3170                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3171                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3172                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3173                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3174                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3175                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3176                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3177                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3178                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3179                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3180                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3181                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3182                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3183                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3184                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3185                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3186                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3187                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3188                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3189                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3190                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3191                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3192                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3193                 \r
3194                 $data = array('fields' => array());\r
3195                 $manager->notify('TemplateExtraFields', $data);\r
3196                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3197                 {\r
3198                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3199                         {\r
3200                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3201                         }\r
3202                 }\r
3203                 \r
3204                 // jump back to template edit\r
3205                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3206                 return;\r
3207         }\r
3208         \r
3209         /**\r
3210          * Admin::addToTemplate()\r
3211          * \r
3212          * @param       Integer $id     ID for template\r
3213          * @param       String  $partname       parts name\r
3214          * @param       String  $content        template contents\r
3215          * @return      Integer record index\r
3216          * \r
3217          */\r
3218         static private function addToTemplate($id, $partname, $content)\r
3219         {\r
3220                 // don't add empty parts:\r
3221                 if ( !trim($content) )\r
3222                 {\r
3223                         return -1;\r
3224                 }\r
3225                 \r
3226                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3227                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3228                 if ( DB::execute($query) === FALSE )\r
3229                 {\r
3230                         $err = DB::getError();\r
3231                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3232                 }\r
3233                 return DB::getInsertId();\r
3234         }\r
3235         \r
3236         /**\r
3237          * Admin::action_templatedelete()\r
3238          * \r
3239          * @param       void\r
3240          * @return      void\r
3241          */\r
3242         static private function action_templatedelete()\r
3243         {\r
3244                 global $member, $manager;\r
3245                 \r
3246                 $member->isAdmin() or self::disallow();\r
3247                 \r
3248                 $templateid = intRequestVar('templateid');\r
3249                 // TODO: check if template can be deleted\r
3250                 \r
3251                 self::$skin->parse('templatedelete');\r
3252                 return;\r
3253         }\r
3254         \r
3255         /**\r
3256          * Admin::action_templatedeleteconfirm()\r
3257          * \r
3258          * @param       void\r
3259          * @return      void\r
3260          */\r
3261         static private function action_templatedeleteconfirm()\r
3262         {\r
3263                 global $member, $manager;\r
3264                 \r
3265                 $templateid = intRequestVar('templateid');\r
3266                 \r
3267                 $member->isAdmin() or self::disallow();\r
3268                 \r
3269                 $data = array('templateid' => $templateid);\r
3270                 $manager->notify('PreDeleteTemplate', $data);\r
3271                 \r
3272                 // 1. delete description\r
3273                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3274                 \r
3275                 // 2. delete parts\r
3276                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3277                 \r
3278                 \r
3279                 $data = array('templateid' => $templateid);\r
3280                 $manager->notify('PostDeleteTemplate', $data);\r
3281                 \r
3282                 self::action_templateoverview();\r
3283                 return;\r
3284         }\r
3285         \r
3286         /**\r
3287          * Admin::action_templatenew()\r
3288          * \r
3289          * @param       void\r
3290          * @return      void\r
3291          */\r
3292         static private function action_templatenew()\r
3293         {\r
3294                 global $member;\r
3295                 \r
3296                 $member->isAdmin() or self::disallow();\r
3297                 \r
3298                 $name = postVar('name');\r
3299                 $desc = postVar('desc');\r
3300                 \r
3301                 if ( !isValidTemplateName($name) )\r
3302                 {\r
3303                         self::error(_ERROR_BADTEMPLATENAME);\r
3304                         return;\r
3305                 }\r
3306                 \r
3307                 if ( Template::exists($name) )\r
3308                 {\r
3309                         self::error(_ERROR_DUPTEMPLATENAME);\r
3310                         return;\r
3311                 }\r
3312                 \r
3313                 $newTemplateId = Template::createNew($name, $desc);\r
3314                 \r
3315                 self::action_templateoverview();\r
3316                 return;\r
3317         }\r
3318         \r
3319         /**\r
3320          * Admin::action_templateclone()\r
3321          * \r
3322          * @param       void\r
3323          * @return      void\r
3324          */\r
3325         static private function action_templateclone()\r
3326         {\r
3327                 global $member;\r
3328                 \r
3329                 $templateid = intRequestVar('templateid');\r
3330                 \r
3331                 $member->isAdmin() or self::disallow();\r
3332                 \r
3333                 // 1. read old template\r
3334                 $name = Template::getNameFromId($templateid);\r
3335                 $desc = Template::getDesc($templateid);\r
3336                 \r
3337                 // 2. create desc thing\r
3338                 $name = "cloned" . $name;\r
3339                 \r
3340                 // if a template with that name already exists:\r
3341                 if ( Template::exists($name) )\r
3342                 {\r
3343                         $i = 1;\r
3344                         while (Template::exists($name . $i))\r
3345                         {\r
3346                                 $i++;\r
3347                         }\r
3348                         $name .= $i;\r
3349                 }\r
3350                 \r
3351                 $newid = Template::createNew($name, $desc);\r
3352                 \r
3353                 // 3. create clone\r
3354                 // go through parts of old template and add them to the new one\r
3355                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3356                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3357                 \r
3358                 $res = DB::getResult($query);\r
3359                 foreach ( $res as $row)\r
3360                 {\r
3361                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3362                 }\r
3363                 \r
3364                 self::action_templateoverview();\r
3365                 return;\r
3366         }\r
3367         \r
3368         /**\r
3369          * Admin::action_admintemplateoverview()\r
3370          * \r
3371          * @param       void\r
3372          * @return      void\r
3373          */\r
3374         static private function action_admintemplateoverview()\r
3375         {\r
3376                 global $member;\r
3377                 $member->isAdmin() or self::disallow();\r
3378                 self::$skin->parse('admntemplateoverview');\r
3379                 return;\r
3380         }\r
3381         \r
3382         /**\r
3383          * Admin::action_admintemplateedit()\r
3384          * \r
3385          * @param       string  $msg    message for pageheader\r
3386          * @return      void\r
3387          */\r
3388         static private function action_admintemplateedit($msg = '')\r
3389         {\r
3390                 global $member, $manager;\r
3391                 if ( $msg )\r
3392                 {\r
3393                         self::$headMess = $msg;\r
3394                 }\r
3395                 $member->isAdmin() or self::disallow();\r
3396                 \r
3397                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3398                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3399                 \r
3400                 self::$skin->parse('admintemplateedit');\r
3401                 return;\r
3402         }\r
3403         \r
3404         /**\r
3405          * Admin::action_admintemplateupdate()\r
3406          * \r
3407          * @param       void\r
3408          * @return      void\r
3409          */\r
3410         static private function action_admintemplateupdate()\r
3411         {\r
3412                 global $member, $manager;\r
3413                 $templateid = intRequestVar('templateid');\r
3414                 $member->isAdmin() or self::disallow();\r
3415                 $name = postVar('tname');\r
3416                 $desc = postVar('tdesc');\r
3417                 \r
3418                 if ( !isValidTemplateName($name) )\r
3419                 {\r
3420                         self::error(_ERROR_BADTEMPLATENAME);\r
3421                         return;\r
3422                 }\r
3423                 \r
3424                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3425                 {\r
3426                         self::error(_ERROR_DUPTEMPLATENAME);\r
3427                         return;\r
3428                 }\r
3429                 \r
3430                 // 1. Remove all template parts\r
3431                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3432                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3433                 DB::execute($query);\r
3434                 \r
3435                 // 2. Update description\r
3436                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3437                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3438                 DB::execute($query);\r
3439                 \r
3440                 // 3. Add non-empty template parts\r
3441                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3442                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3443                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3444                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3445                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3446                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3447                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3448                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3449                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3450                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3451                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3452                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3453                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3454                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3455                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3456                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3457                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3458                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3459                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3461                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3462                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3463                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3464                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3465                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3466                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3484                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3485                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3486                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3487                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3488                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3489                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3490                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3491                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3492                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3493                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3494                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3495                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3496                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3497                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3498                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3499                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3500                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3501                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3502                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3503                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3504                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3505                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3506                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3507                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3508                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3509                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3510                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3511                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3512                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3513                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3514                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3515                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3516                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3517                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3518                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3519                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3520                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3521                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3522                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3523                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3524                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3525                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3526                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3527                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3528                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3529                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3530                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3531                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3532                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3533                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3534                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3535                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3536                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3537                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3538                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3539                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3540                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3541                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3542                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3543                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3544                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3545                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3546                 \r
3547                 $data = array('fields' => array());\r
3548                 $manager->notify('AdminTemplateExtraFields', $data);\r
3549                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3550                 {\r
3551                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3552                         {\r
3553                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3554                         }\r
3555                 }\r
3556                 \r
3557                 // jump back to template edit\r
3558                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3559                 return;\r
3560         }\r
3561         \r
3562         /**\r
3563          * Admin::addToAdminTemplate()\r
3564          * \r
3565          * @param       integer $id                     ID for template\r
3566          * @param       string  $partname       name of part for template\r
3567          * @param       void    $contents       content for part of template\r
3568          * @return      integer ID for newly inserted Template\r
3569          */\r
3570         static private function addToAdminTemplate($id, $partname, $content)\r
3571         {\r
3572                 // don't add empty parts:\r
3573                 if ( !trim($content) )\r
3574                 {\r
3575                         return -1;\r
3576                 }\r
3577                 \r
3578                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3579                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3580                 if ( DB::execute($query) === FALSE )\r
3581                 {\r
3582                         $err = DB::getError();\r
3583                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3584                 }\r
3585                 return DB::getInsertId();\r
3586         }\r
3587         \r
3588         /**\r
3589          * Admin::action_admintemplatedelete()\r
3590          * \r
3591          * @param       void\r
3592          * @return      void\r
3593          */\r
3594         static private function action_admintemplatedelete()\r
3595         {\r
3596                 global $member, $manager;\r
3597                 $member->isAdmin() or self::disallow();\r
3598                 \r
3599                 // TODO: check if template can be deleted\r
3600                 self::$skin->parse('admintemplatedelete');\r
3601                 return;\r
3602         }\r
3603         \r
3604         /**\r
3605          * Admin::action_admintemplatedeleteconfirm()\r
3606          * \r
3607          * @param       void\r
3608          * @return      void\r
3609          */\r
3610         static private function action_admintemplatedeleteconfirm()\r
3611         {\r
3612                 global $member, $manager;\r
3613                 \r
3614                 $templateid = intRequestVar('templateid');\r
3615                 $member->isAdmin() or self::disallow();\r
3616                 \r
3617                 $data = array('templateid' => $templateid);\r
3618                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3619                 \r
3620                 // 1. delete description\r
3621                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3622                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3623                 DB::execute($query);\r
3624                 \r
3625                 // 2. delete parts\r
3626                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3627                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3628                 DB::execute($query);\r
3629                 \r
3630                 $data = array('templateid' => $templateid);\r
3631                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3632                 \r
3633                 self::action_admintemplateoverview();\r
3634                 return;\r
3635         }\r
3636         \r
3637         /**\r
3638          * Admin::action_admintemplatenew()\r
3639          * \r
3640          * @param       void\r
3641          * @return      void\r
3642          */\r
3643         static private function action_admintemplatenew()\r
3644         {\r
3645                 global $member;\r
3646                 $member->isAdmin() or self::disallow();\r
3647                 $name = postVar('name');\r
3648                 $desc = postVar('desc');\r
3649                 \r
3650                 if ( !isValidTemplateName($name) )\r
3651                 {\r
3652                         self::error(_ERROR_BADTEMPLATENAME);\r
3653                         return;\r
3654                 }\r
3655                 else if ( !preg_match('#^admin/#', $name) )\r
3656                 {\r
3657                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3658                         return;\r
3659                 }\r
3660                 else if ( Template::exists($name) )\r
3661                 {\r
3662                         self::error(_ERROR_DUPTEMPLATENAME);\r
3663                         return;\r
3664                 }\r
3665                 \r
3666                 $newTemplateId = Template::createNew($name, $desc);\r
3667                 self::action_admintemplateoverview();\r
3668                 return;\r
3669         }\r
3670         \r
3671         /**\r
3672          * Admin::action_admintemplateclone()\r
3673          * \r
3674          * @param       void\r
3675          * @return      void\r
3676          */\r
3677         static private function action_admintemplateclone()\r
3678         {\r
3679                 global $member;\r
3680                 $templateid = intRequestVar('templateid');\r
3681                 $member->isAdmin() or self::disallow();\r
3682                 \r
3683                 // 1. read old template\r
3684                 $name = Template::getNameFromId($templateid);\r
3685                 $desc = Template::getDesc($templateid);\r
3686                 \r
3687                 // 2. create desc thing\r
3688                 $name = $name . "cloned";\r
3689                 \r
3690                 // if a template with that name already exists:\r
3691                 if ( Template::exists($name) )\r
3692                 {\r
3693                         $i = 1;\r
3694                         while ( Template::exists($name . $i) )\r
3695                         {\r
3696                                 $i++;\r
3697                         }\r
3698                         $name .= $i;\r
3699                 }\r
3700                 \r
3701                 $newid = Template::createNew($name, $desc);\r
3702                 \r
3703                 // 3. create clone\r
3704                 // go through parts of old template and add them to the new one\r
3705                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3706                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3707                 \r
3708                 $res = DB::getResult($query);\r
3709                 foreach ( $res as $row )\r
3710                 {\r
3711                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3712                 }\r
3713                 \r
3714                 self::action_admintemplateoverview();\r
3715                 return;\r
3716         }\r
3717 \r
3718         /**\r
3719          * Admin::action_skinoverview()\r
3720          * \r
3721          * @param       void\r
3722          * @return      void\r
3723          */\r
3724         static private function action_skinoverview()\r
3725         {\r
3726                 global $member, $manager;\r
3727                 \r
3728                 $member->isAdmin() or self::disallow();\r
3729                 \r
3730                 self::$skin->parse('skinoverview');\r
3731                 return;\r
3732         }\r
3733         \r
3734         /**\r
3735          * Admin::action_skinnew()\r
3736          * \r
3737          * @param       void\r
3738          * @return      void\r
3739          */\r
3740         static private function action_skinnew()\r
3741         {\r
3742                 global $member;\r
3743                 \r
3744                 $member->isAdmin() or self::disallow();\r
3745                 \r
3746                 $name = trim(postVar('name'));\r
3747                 $desc = trim(postVar('desc'));\r
3748                 \r
3749                 if ( !isValidSkinName($name) )\r
3750                 {\r
3751                         self::error(_ERROR_BADSKINNAME);\r
3752                         return;\r
3753                 }\r
3754                 \r
3755                 if ( SKIN::exists($name) )\r
3756                 {\r
3757                         self::error(_ERROR_DUPSKINNAME);\r
3758                         return;\r
3759                 }\r
3760                 \r
3761                 $newId = SKIN::createNew($name, $desc);\r
3762                 \r
3763                 self::action_skinoverview();\r
3764                 return;\r
3765         }\r
3766         \r
3767         /**\r
3768          * Admin::action_skinedit()\r
3769          * \r
3770          * @param       void\r
3771          * @return      void\r
3772          */\r
3773         static private function action_skinedit()\r
3774         {\r
3775                 global $member, $manager;\r
3776                 \r
3777                 $member->isAdmin() or self::disallow();\r
3778                 \r
3779                 self::$skin->parse('skinedit');\r
3780                 return;\r
3781         }\r
3782         \r
3783         /**\r
3784          * Admin::action_skineditgeneral()\r
3785          * \r
3786          * @param       void\r
3787          * @return      void\r
3788          */\r
3789         static private function action_skineditgeneral()\r
3790         {\r
3791                 global $manager, $member;\r
3792                 \r
3793                 $skinid = intRequestVar('skinid');\r
3794                 \r
3795                 $member->isAdmin() or self::disallow();\r
3796                 \r
3797                 $name           = postVar('name');\r
3798                 $desc           = postVar('desc');\r
3799                 $type           = postVar('type');\r
3800                 $inc_mode       = postVar('inc_mode');\r
3801                 $inc_prefix     = postVar('inc_prefix');\r
3802                 \r
3803                 $skin =& $manager->getSkin($skinid);\r
3804                 \r
3805                 // 1. Some checks\r
3806                 if ( !isValidSkinName($name) )\r
3807                 {\r
3808                         self::error(_ERROR_BADSKINNAME);\r
3809                         return;\r
3810                 }\r
3811                 \r
3812                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3813                 {\r
3814                         self::error(_ERROR_DUPSKINNAME);\r
3815                         return;\r
3816                 }\r
3817                 \r
3818                 if ( !$type )\r
3819                 {\r
3820                         $type = 'text/html';\r
3821                 }\r
3822                 if ( !$inc_mode )\r
3823                 {\r
3824                         $inc_mode = 'normal';\r
3825                 }\r
3826                 \r
3827                 // 2. Update description\r
3828                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3829                 \r
3830                 self::action_skinedit();\r
3831                 return;\r
3832         }\r
3833         \r
3834         static private function action_skinedittype($msg = '')\r
3835         {\r
3836                 global $member, $manager;\r
3837                 \r
3838                 $member->isAdmin() or self::disallow();\r
3839                 \r
3840                 if ( $msg )\r
3841                 {\r
3842                         self::$headMess = $msg;\r
3843                 }\r
3844                 \r
3845                 $skinid = intRequestVar('skinid');\r
3846                 $type   = requestVar('type');\r
3847                 $type   = trim($type);\r
3848                 $type   = strtolower($type);\r
3849                 \r
3850                 if ( !isValidShortName($type) )\r
3851                 {\r
3852                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3853                         return;\r
3854                 }\r
3855                 \r
3856                 self::$skin->parse('skinedittype');\r
3857                 return;\r
3858         }\r
3859         \r
3860         /**\r
3861          * Admin::action_skinupdate()\r
3862          * \r
3863          * @param       void\r
3864          * @return      void\r
3865          */\r
3866         static private function action_skinupdate()\r
3867         {\r
3868                 global $manager, $member;\r
3869                 \r
3870                 $skinid = intRequestVar('skinid');\r
3871                 $content = trim(postVar('content'));\r
3872                 $type = postVar('type');\r
3873                 \r
3874                 $member->isAdmin() or self::disallow();\r
3875                 \r
3876                 $skin =& $manager->getSKIN($skinid);\r
3877                 $skin->update($type, $content);\r
3878                 \r
3879                 self::action_skinedittype(_SKIN_UPDATED);\r
3880                 return;\r
3881         }\r
3882         \r
3883         /**\r
3884          * Admin::action_skindelete()\r
3885          * \r
3886          * @param       void\r
3887          * @return      void\r
3888          */\r
3889         static private function action_skindelete()\r
3890         {\r
3891                 global $manager, $member, $CONF;\r
3892                 \r
3893                 $skinid = intRequestVar('skinid');\r
3894                 \r
3895                 $member->isAdmin() or self::disallow();\r
3896                 \r
3897                 // don't allow default skin to be deleted\r
3898                 if ( $skinid == $CONF['BaseSkin'] )\r
3899                 {\r
3900                         self::error(_ERROR_DEFAULTSKIN);\r
3901                         return;\r
3902                 }\r
3903                 \r
3904                 // don't allow deletion of default skins for blogs\r
3905                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3906                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3907                 \r
3908                 $name = DB::getValue($query);\r
3909                 if ( $name )\r
3910                 {\r
3911                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3912                         return;\r
3913                 }\r
3914                 \r
3915                 self::$skin->parse('skindelete');\r
3916                 return;\r
3917         }\r
3918         \r
3919         /**\r
3920          * Admin::action_skindeleteconfirm()\r
3921          * \r
3922          * @param       void\r
3923          * @return      void\r
3924          */\r
3925         static private function action_skindeleteconfirm()\r
3926         {\r
3927                 global $member, $CONF, $manager;\r
3928                 \r
3929                 $skinid = intRequestVar('skinid');\r
3930                 \r
3931                 $member->isAdmin() or self::disallow();\r
3932                 \r
3933                 // don't allow default skin to be deleted\r
3934                 if ( $skinid == $CONF['BaseSkin'] )\r
3935                 {\r
3936                         self::error(_ERROR_DEFAULTSKIN);\r
3937                         return;\r
3938                 }\r
3939                 \r
3940                 // don't allow deletion of default skins for blogs\r
3941                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3942                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3943                 \r
3944                 $name = DB::getValue($query);\r
3945                 if ( $name )\r
3946                                 {\r
3947                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3948                         return;\r
3949                 }\r
3950                 \r
3951                 $data = array('skinid' => $skinid);\r
3952                 $manager->notify('PreDeleteSkin', $data);\r
3953                 \r
3954                 // 1. delete description\r
3955                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3956                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3957                 DB::execute($query);\r
3958                 \r
3959                 // 2. delete parts\r
3960                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3961                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3962                 DB::execute($query);\r
3963                 \r
3964                 $data = array('skinid' => $skinid);\r
3965                 $manager->notify('PostDeleteSkin', $data);\r
3966                 \r
3967                 self::action_skinoverview();\r
3968                 return;\r
3969         }\r
3970         \r
3971         /**\r
3972          * Admin::action_skinremovetype()\r
3973          * \r
3974          * @param       void\r
3975          * @return      void\r
3976          */\r
3977         static private function action_skinremovetype()\r
3978         {\r
3979                 global $member, $manager, $CONF;\r
3980                 \r
3981                 $member->isAdmin() or self::disallow();\r
3982                 \r
3983                 $skinid = intRequestVar('skinid');\r
3984                 $skintype = requestVar('type');\r
3985                 \r
3986                 if ( !isValidShortName($skintype) )\r
3987                 {\r
3988                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3989                         return;\r
3990                 }\r
3991                 \r
3992                 // don't allow default skinparts to be deleted\r
3993                 /* TODO: this array should be retrieved from Action class */\r
3994                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3995                 {\r
3996                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3997                         return;\r
3998                 }\r
3999                 \r
4000                 self::$skin->parse('skinremovetype');\r
4001                 return;\r
4002         }\r
4003         \r
4004         /**\r
4005          * Admin::action_skinremovetypeconfirm()\r
4006          * \r
4007          * @param       void\r
4008          * @return      void\r
4009          */\r
4010         static private function action_skinremovetypeconfirm()\r
4011         {\r
4012                 global $member, $CONF, $manager;\r
4013                 \r
4014                 $member->isAdmin() or self::disallow();\r
4015                 \r
4016                 $skinid = intRequestVar('skinid');\r
4017                 $skintype = requestVar('type');\r
4018                 \r
4019                 if ( !isValidShortName($skintype) )\r
4020                 {\r
4021                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4022                         return;\r
4023                 }\r
4024                 \r
4025                 // don't allow default skinparts to be deleted\r
4026                 /* TODO: this array should be retrieved from Action class */\r
4027                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
4028                 {\r
4029                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4030                         return;\r
4031                 }\r
4032                 \r
4033                 $data = array(\r
4034                         'skinid'   => $skinid,\r
4035                         'skintype' => $skintype\r
4036                 );\r
4037                 $manager->notify('PreDeleteSkinPart', $data);\r
4038                 // delete part\r
4039                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
4040                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4041                 DB::execute($query);\r
4042                 \r
4043                 $data = array(\r
4044                         'skinid'   => $skinid,\r
4045                         'skintype' => $skintype\r
4046                 );\r
4047                 $manager->notify('PostDeleteSkinPart', $data);\r
4048                 \r
4049                 self::action_skinedit();\r
4050                 return;\r
4051         }\r
4052 \r
4053         /**\r
4054          * Admin::action_skinclone()\r
4055          * \r
4056          * @param       void\r
4057          * @return      void\r
4058          */\r
4059         static private function action_skinclone()\r
4060         {\r
4061                 global $manager, $member;\r
4062                 \r
4063                 $member->isAdmin() or self::disallow();\r
4064                 \r
4065                 $skinid = intRequestVar('skinid');\r
4066                 \r
4067                 // 1. read skin to clone\r
4068                 $skin =& $manager->getSkin($skinid);\r
4069                 \r
4070                 $name = "{$skin->getName()}_clone";\r
4071                 \r
4072                 // if a skin with that name already exists:\r
4073                 if ( Skin::exists($name) )\r
4074                 {\r
4075                         $i = 1;\r
4076                         while ( Skin::exists($name . $i) )\r
4077                         {\r
4078                                 $i++;\r
4079                         }\r
4080                         $name .= $i;\r
4081                 }\r
4082                 \r
4083                 // 2. create skin desc\r
4084                 $newid = Skin::createNew(\r
4085                         $name,\r
4086                         $skin->getDescription(),\r
4087                         $skin->getContentType(),\r
4088                         $skin->getIncludeMode(),\r
4089                         $skin->getIncludePrefix()\r
4090                 );\r
4091                 \r
4092                 // 3. clone\r
4093                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4094                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4095                 \r
4096                 $res = DB::getResult($query);\r
4097                 foreach ( $res as $row )\r
4098                 {\r
4099                         self::skinclonetype($skin, $newid, $row['stype']);\r
4100                 }\r
4101                 \r
4102                 self::action_skinoverview();\r
4103                 return;\r
4104         }\r
4105         \r
4106         /**\r
4107          * Admin::skinclonetype()\r
4108          * \r
4109          * @param       String  $skin   Skin object\r
4110          * @param       Integer $newid  ID for this clone\r
4111          * @param       String  $type   type of skin\r
4112          * @return      Void\r
4113          */\r
4114         static private function skinclonetype($skin, $newid, $type)\r
4115         {\r
4116                 $newid = intval($newid);\r
4117                 $content = $skin->getContentFromDB($type);\r
4118                 \r
4119                 if ( $content )\r
4120                 {\r
4121                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4122                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4123                         DB::execute($query);\r
4124                 }\r
4125                 return;\r
4126         }\r
4127         \r
4128         /**\r
4129          * Admin::action_adminskinoverview()\r
4130          * \r
4131          * @param       void\r
4132          * @return      void\r
4133          */\r
4134         static private function action_adminskinoverview()\r
4135         {\r
4136                 global $member, $manager;\r
4137                 \r
4138                 $member->isAdmin() or self::disallow();\r
4139                 \r
4140                 self::$skin->parse('adminskinoverview');\r
4141                 return;\r
4142         }\r
4143         \r
4144         /**\r
4145          * Admin::action_adminskinnew()\r
4146          * \r
4147          * @param       void\r
4148          * @return      void\r
4149          */\r
4150         static private function action_adminskinnew()\r
4151         {\r
4152                 global $member;\r
4153                 $member->isAdmin() or self::disallow();\r
4154                 $name = trim(postVar('name'));\r
4155                 $desc = trim(postVar('desc'));\r
4156                 \r
4157                 if ( !isValidSkinName($name) )\r
4158                 {\r
4159                         self::error(_ERROR_BADSKINNAME);\r
4160                         return;\r
4161                 }\r
4162                 else if ( !preg_match('#^admin/#', $name) )\r
4163                 {\r
4164                         self::error(_ERROR_BADADMINSKINNAME);\r
4165                         return;\r
4166                 }\r
4167                 else if ( Skin::exists($name) )\r
4168                 {\r
4169                         self::error(_ERROR_DUPSKINNAME);\r
4170                         return;\r
4171                 }\r
4172                 /* TODO: $newId is not reused... */\r
4173                 $newId = Skin::createNew($name, $desc);\r
4174                 self::action_adminskinoverview();\r
4175                 return;\r
4176         }\r
4177         \r
4178         /**\r
4179          * Admin::action_adminskinedit()\r
4180          * \r
4181          * @param       void\r
4182          * @return      void\r
4183          */\r
4184         static private function action_adminskinedit()\r
4185         {\r
4186                 global $member, $manager;\r
4187                 \r
4188                 $member->isAdmin() or self::disallow();\r
4189                 self::$skin->parse('adminskinedit');\r
4190                 return;\r
4191         }\r
4192         \r
4193         /**\r
4194          * Admin::action_adminskineditgeneral()\r
4195          * \r
4196          * @param       void\r
4197          * @return      void\r
4198          */\r
4199         static private function action_adminskineditgeneral()\r
4200         {\r
4201                 global $manager, $member;\r
4202                 \r
4203                 $skinid = intRequestVar('skinid');\r
4204                 \r
4205                 $member->isAdmin() or self::disallow();\r
4206                 \r
4207                 $name           = postVar('name');\r
4208                 $desc           = postVar('desc');\r
4209                 $type           = postVar('type');\r
4210                 $inc_mode       = postVar('inc_mode');\r
4211                 $inc_prefix     = postVar('inc_prefix');\r
4212                 \r
4213                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4214                 \r
4215                 // 1. Some checks\r
4216                 if ( !isValidSkinName($name) )\r
4217                 {\r
4218                         self::error(_ERROR_BADSKINNAME);\r
4219                         return;\r
4220                 }\r
4221                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4222                 {\r
4223                         self::error(_ERROR_DUPSKINNAME);\r
4224                         return;\r
4225                 }\r
4226                 if ( !$type )\r
4227                 {\r
4228                         $type = 'text/html';\r
4229                 }\r
4230                 if ( !$inc_mode )\r
4231                 {\r
4232                         $inc_mode = 'normal';\r
4233                 }\r
4234                 // 2. Update description\r
4235                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4236                 self::action_adminskinedit();\r
4237                 return;\r
4238         }\r
4239         \r
4240         /**\r
4241          * Admin::action_adminskinedittype()\r
4242          * \r
4243          * @param       string  $msg    message for pageheader\r
4244          * @return      void\r
4245          */\r
4246         static private function action_adminskinedittype($msg = '')\r
4247         {\r
4248                 global $member, $manager;\r
4249                 \r
4250                 $member->isAdmin() or self::disallow();\r
4251                 \r
4252                 if ( $msg )\r
4253                 {\r
4254                         self::$headMess = $msg;\r
4255                 }\r
4256                 $type = requestVar('type');\r
4257                 $type = trim($type);\r
4258                 $type = strtolower($type);\r
4259                 \r
4260                 if ( !isValidShortName($type) )\r
4261                 {\r
4262                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4263                         return;\r
4264                 }\r
4265                 \r
4266                 self::$skin->parse('adminskinedittype');\r
4267                 return;\r
4268         }\r
4269         \r
4270         /**\r
4271          * Admin::action_adminskinupdate()\r
4272          * \r
4273          * @param       void\r
4274          * @return      void\r
4275          */\r
4276         static private function action_adminskinupdate()\r
4277         {\r
4278                 global $manager, $member;\r
4279                 \r
4280                 $skinid = intRequestVar('skinid');\r
4281                 $content = trim(postVar('content'));\r
4282                 $type = postVar('type');\r
4283                 \r
4284                 $member->isAdmin() or self::disallow();\r
4285                 \r
4286                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4287                 $skin->update($type, $content);\r
4288                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4289                 return;\r
4290         }\r
4291         \r
4292         /**\r
4293          * Admin::action_adminskindelete()\r
4294          * \r
4295          * @param       void\r
4296          * @return      void\r
4297          */\r
4298         static private function action_adminskindelete()\r
4299         {\r
4300                 global $member, $manager, $CONF;\r
4301                 $member->isAdmin() or self::disallow();\r
4302                 \r
4303                 /* TODO: needless variable $skinid... */\r
4304                 $skinid = intRequestVar('skinid');\r
4305                 self::$skin->parse('adminskindelete');\r
4306                 return;\r
4307         }\r
4308 \r
4309         /**\r
4310          * Admin::action_adminskindeleteconfirm()\r
4311          * \r
4312          * @param       void\r
4313          * @return      void\r
4314          */\r
4315         static private function action_adminskindeleteconfirm()\r
4316         {\r
4317                 global $member, $CONF, $manager;\r
4318                 \r
4319                 $member->isAdmin() or self::disallow();\r
4320                 $skinid = intRequestVar('skinid');\r
4321                 \r
4322                 // don't allow default skin to be deleted\r
4323                 if ( $skinid == $CONF['AdminSkin'] )\r
4324                 {\r
4325                         self::error(_ERROR_DEFAULTSKIN);\r
4326                         return;\r
4327                 }\r
4328                 \r
4329                 /*\r
4330                  * TODO: NOT Implemented\r
4331                  *  don't allow deletion of default skins for members\r
4332                  */\r
4333                 $query          = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d';\r
4334                 $res            = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));\r
4335                 $members        = array();\r
4336                 while ( $row = $res->fetch() ) {\r
4337                         $members[] = $row['mrealname'];\r
4338                 }\r
4339                 if ( count($members) )\r
4340                 {\r
4341                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));\r
4342                         return;\r
4343                 }\r
4344                 \r
4345                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4346                 \r
4347                 // 1. delete description\r
4348                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4349                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4350                 DB::execute($query);\r
4351                 \r
4352                 // 2. delete parts\r
4353                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4354                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4355                 \r
4356                 DB::execute($query);\r
4357                 \r
4358                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4359                 self::action_adminskinoverview();\r
4360                 return;\r
4361         }\r
4362         \r
4363         /**\r
4364          * Admin::action_adminskinremovetype()\r
4365          * \r
4366          * @param       void\r
4367          * @return      void\r
4368          */\r
4369         static private function action_adminskinremovetype()\r
4370         {\r
4371                 global $member, $manager, $CONF;\r
4372 \r
4373                 $member->isAdmin() or self::disallow();\r
4374                 \r
4375                 $skinid         = intRequestVar('skinid');\r
4376                 $skintype       = requestVar('type');\r
4377                 \r
4378                 if ( !isValidShortName($skintype) )\r
4379                 {\r
4380                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4381                         return;\r
4382                 }\r
4383                 \r
4384                 self::$skin->parse('adminskinremovetype');\r
4385                 return;\r
4386         }\r
4387         \r
4388         /**\r
4389          * Admin::action_adminskinremovetypeconfirm()\r
4390          * \r
4391          * @param       void\r
4392          * @return      void\r
4393          */\r
4394         static private function action_adminskinremovetypeconfirm()\r
4395         {\r
4396                 global $member, $CONF, $manager;\r
4397                 \r
4398                 $member->isAdmin() or self::disallow();\r
4399                 \r
4400                 $skinid         = intRequestVar('skinid');\r
4401                 $skintype       = requestVar('type');\r
4402                 \r
4403                 if ( !isValidShortName($skintype) )\r
4404                 {\r
4405                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4406                         return;\r
4407                 }\r
4408                 \r
4409                 $data =array(\r
4410                         'skinid'        => $skinid,\r
4411                         'skintype'      => $skintype\r
4412                 );\r
4413                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4414 \r
4415                 // delete part\r
4416                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4417                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4418                 DB::execute($query);\r
4419                 \r
4420                 $data = array(\r
4421                         'skinid'        => $skinid,\r
4422                         'skintype'      => $skintype\r
4423                 );\r
4424                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4425                 \r
4426                 self::action_adminskinedit();\r
4427                 return;\r
4428         }\r
4429 \r
4430         /**\r
4431          * Admin::action_adminskinclone()\r
4432          * \r
4433          * @param       void\r
4434          * @return      void\r
4435          */\r
4436         static private function action_adminskinclone()\r
4437         {\r
4438                 global $manager, $member;\r
4439                 \r
4440                 $member->isAdmin() or self::disallow();\r
4441                 \r
4442                 $skinid = intRequestVar('skinid');\r
4443                 \r
4444                 // 1. read skin to clone\r
4445                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4446                 $name = "{$skin->getName()}_clone";\r
4447                 \r
4448                 // if a skin with that name already exists:\r
4449                 if ( Skin::exists($name) )\r
4450                 {\r
4451                         $i = 1;\r
4452                         while ( Skin::exists($name . $i) )\r
4453                         {\r
4454                                 $i++;\r
4455                         }\r
4456                         $name .= $i;\r
4457                 }\r
4458                 \r
4459                 // 2. create skin desc\r
4460                 $newid = Skin::createNew(\r
4461                         $name,\r
4462                         $skin->getDescription(),\r
4463                         $skin->getContentType(),\r
4464                         $skin->getIncludeMode(),\r
4465                         $skin->getIncludePrefix()\r
4466                 );\r
4467                 \r
4468                 // 3. clone\r
4469                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4470                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4471                 \r
4472                 $res = DB::getResult($query);\r
4473                 foreach ( $res as $row )\r
4474                 {\r
4475                         self::skinclonetype($skin, $newid, $row['stype']);\r
4476                 }\r
4477                 self::action_adminskinoverview();\r
4478                 return;\r
4479         }\r
4480         \r
4481         /**\r
4482          * Admin::adminskinclonetype()\r
4483          * \r
4484          * @param       string  $skin   an instance of Skin class\r
4485          * @param       integer $newid  ID for new skin\r
4486          * @param       string  $type   skin type\r
4487          * @return      void\r
4488          */\r
4489         static private function adminskinclonetype($skin, $newid, $type)\r
4490         {\r
4491                 $content = $skin->getContentFromDB($type);\r
4492                 \r
4493                 if ( $content )\r
4494                 {\r
4495                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4496                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4497                         DB::execute($query);\r
4498                 }\r
4499                 return;\r
4500         }\r
4501         \r
4502         /**\r
4503          * Admin::action_adminskinieoverview()\r
4504          * \r
4505          * @param       void\r
4506          * @return      void\r
4507          */\r
4508         static private function action_adminskinieoverview()\r
4509         {\r
4510                 global $member, $DIR_LIBS, $manager;\r
4511                 \r
4512                 $member->isAdmin() or self::disallow();\r
4513                 \r
4514                 // load skinie class\r
4515                 include_once($DIR_LIBS . 'skinie.php');\r
4516                 \r
4517                 self::$skin->parse('adminskinieoverview');\r
4518                 return;\r
4519         }\r
4520 \r
4521         /**\r
4522          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4523          * Admin::action_adminskinieimport()\r
4524          * \r
4525          * @param       void\r
4526          * @return      void\r
4527          */\r
4528         static private function action_adminskinieimport()\r
4529         {\r
4530                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4531                 \r
4532                 $member->isAdmin() or self::disallow();\r
4533                 \r
4534                 // load skinie class\r
4535                 include_once($DIR_LIBS . 'skinie.php');\r
4536                 \r
4537                 $skinFileRaw    = postVar('skinfile');\r
4538                 $mode                   = postVar('mode');\r
4539                 \r
4540                 $importer = new SKINIMPORT();\r
4541                 \r
4542                 // get full filename\r
4543                 if ( $mode == 'file' )\r
4544                 {\r
4545                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4546                         \r
4547                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4548                         if ( !file_exists($skinFile) )\r
4549                         {\r
4550                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4551                         }\r
4552                 }\r
4553                 else\r
4554                 {\r
4555                         $skinFile = $skinFileRaw;\r
4556                 }\r
4557                 \r
4558                 // read only metadata\r
4559                 $error = $importer->readFile($skinFile, 1);\r
4560                 if ( $error )\r
4561                 {\r
4562                         self::error($error);\r
4563                         return;\r
4564                 }\r
4565                 \r
4566                 /* TODO: we should consider to use the other way instead of this */\r
4567                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4568                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4569                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4570                 \r
4571                 // clashes\r
4572                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4573                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4574                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4575                 /* TODO: we should consider to use the other way instead of this */\r
4576                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4577                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4578                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4579 \r
4580                 if ( !is_object(self::$skin) )\r
4581                 {\r
4582                         self::action_adminskiniedoimport();\r
4583                 }\r
4584                 else\r
4585                 {\r
4586                         self::$skin->parse('adminskinieimport');\r
4587                 }\r
4588                 return;\r
4589         }\r
4590         \r
4591         /**\r
4592          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4593          * Admin::action_adminskiniedoimport()\r
4594          * \r
4595          * @param       void\r
4596          * @return      void\r
4597          */\r
4598         static private function action_adminskiniedoimport()\r
4599         {\r
4600                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4601                 \r
4602                 $member->isAdmin() or self::disallow();\r
4603                 \r
4604                 // load skinie class\r
4605                 include_once($DIR_LIBS . 'skinie.php');\r
4606                 \r
4607                 $skinFileRaw    = postVar('skinfile');\r
4608                 $mode                   = postVar('mode');\r
4609                 $allowOverwrite = intPostVar('overwrite');\r
4610                 \r
4611                 // get full filename\r
4612                 if ( $mode == 'file' )\r
4613                 {\r
4614                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4615                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4616                         if ( !file_exists($skinFile) )\r
4617                         {\r
4618                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4619                         }\r
4620                 }\r
4621                 else\r
4622                 {\r
4623                         $skinFile = $skinFileRaw;\r
4624                 }\r
4625                 \r
4626                 $importer = new SKINIMPORT();\r
4627                 \r
4628                 $error = $importer->readFile($skinFile);\r
4629                 if ( $error )\r
4630                 {\r
4631                         self::error($error);\r
4632                         return;\r
4633                 }\r
4634                 \r
4635                 $error = $importer->writeToDatabase($allowOverwrite);\r
4636                 if ( $error )\r
4637                 {\r
4638                         self::error($error);\r
4639                         return;\r
4640                 }\r
4641                 \r
4642                 /* TODO: we should consider to use the other way instead of this */\r
4643                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4644                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4645                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4646                 \r
4647                 if ( !is_object(self::$skin) )\r
4648                 {\r
4649                         global $DIR_SKINS;\r
4650                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4651                         $query  = sprintf($query, sql_table('skin_desc'));\r
4652                         $res    = intval(DB::getValue($query));\r
4653                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4654                         $query  = sprintf($query, sql_table('config'), $res);\r
4655                         DB::execute($query);\r
4656                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');\r
4657                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4658                 }\r
4659                 else\r
4660                 {\r
4661                         self::$skin->parse('adminskiniedoimport');\r
4662                 }\r
4663                 return;\r
4664         }\r
4665 \r
4666         /**\r
4667          * Admin::action_adminskinieexport()\r
4668          * \r
4669          * @param       void\r
4670          * @return      void\r
4671          */\r
4672         static private function action_adminskinieexport()\r
4673         {\r
4674                 global $member, $DIR_PLUGINS;\r
4675                 \r
4676                 $member->isAdmin() or self::disallow();\r
4677                 \r
4678                 // load skinie class\r
4679                 $aSkins = requestIntArray('skin');\r
4680                 if (!is_array($aSkins)) {\r
4681                         $aSkins = array();\r
4682                 }\r
4683                 $skinList = array_keys($aSkins);\r
4684                 \r
4685                 $aTemplates = requestIntArray('template');\r
4686                 if (!is_array($aTemplates))\r
4687                 {\r
4688                         $aTemplates = array();\r
4689                 }\r
4690                 $templateList = array_keys($aTemplates);\r
4691                 \r
4692                 $info = postVar('info');\r
4693                 \r
4694                 include_libs('skinie.php');\r
4695                 $exporter = new SkinExport();\r
4696                 foreach ( $skinList as $skinId )\r
4697                 {\r
4698                         $exporter->addSkin($skinId);\r
4699                 }\r
4700                 foreach ( $templateList as $templateId )\r
4701                 {\r
4702                         $exporter->addTemplate($templateId);\r
4703                 }\r
4704                 $exporter->setInfo($info);\r
4705                 $exporter->export();\r
4706                 return;\r
4707         }\r
4708         \r
4709         /**\r
4710          * Admin::action_settingsedit()\r
4711          * \r
4712          * @param       Void\r
4713          * @return      Void\r
4714          */\r
4715         static private function action_settingsedit()\r
4716         {\r
4717                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4718                 \r
4719                 $member->isAdmin() or self::disallow();\r
4720                 \r
4721                 self::$skin->parse('settingsedit');\r
4722                 return;\r
4723         }\r
4724         \r
4725         /**\r
4726          * Admin::action_settingsupdate()\r
4727          * Update $CONFIG and redirect\r
4728          * \r
4729          * @param       void\r
4730          * @return      void\r
4731          */\r
4732         static private function action_settingsupdate()\r
4733         {\r
4734                 global $member, $CONF;\r
4735                 \r
4736                 $member->isAdmin() or self::disallow();\r
4737                 \r
4738                 // check if email address for admin is valid\r
4739                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4740                 {\r
4741                         self::error(_ERROR_BADMAILADDRESS);\r
4742                         return;\r
4743                 }\r
4744                 \r
4745                 // save settings\r
4746                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4747                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4748                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4749                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4750                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4751                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4752                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4753                 self::updateConfig('Locale',                    postVar('Locale'));\r
4754                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4755                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4756                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4757                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4758                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4759                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4760                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4761                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4762                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4763                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4764                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4765                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4766                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4767                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4768                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4769                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4770                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4771                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4772                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4773                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4774                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4775                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4776                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4777                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4778                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4779                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4780                 self::updateConfig('AdminSkin',                 postVar('adminskin'));\r
4781                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));\r
4782 \r
4783                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4784                 // note that when changing cookie settings, this redirect might cause the user\r
4785                 // to have to log in again.\r
4786                 getConfig();\r
4787                 redirect($CONF['AdminURL'] . '?action=manage');\r
4788                 return;\r
4789         }\r
4790         \r
4791         /**\r
4792          * Admin::action_systemoverview()\r
4793          * Output system overview\r
4794          * \r
4795          * @param       void\r
4796          * @return      void\r
4797          */\r
4798         static private function action_systemoverview()\r
4799         {\r
4800                 self::$skin->parse('systemoverview');\r
4801                 return;\r
4802         }\r
4803         \r
4804         /**\r
4805          * Admin::updateConfig()\r
4806          * \r
4807          * @param       string  $name   \r
4808          * @param       string  $val    \r
4809          * @return      integer return the ID in which the latest query posted\r
4810          */\r
4811         static private function updateConfig($name, $val)\r
4812         {\r
4813                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4814                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4815                 if ( DB::execute($query) === FALSE )\r
4816                 {\r
4817                         $err = DB::getError();\r
4818                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4819                 }\r
4820                 return DB::getInsertId();\r
4821         }\r
4822         \r
4823         /**\r
4824          * Admin::error()\r
4825          * Error message\r
4826          * \r
4827          * @param       string  $msg    message that will be shown\r
4828          * @return      void\r
4829          */\r
4830         static public function error($msg)\r
4831         {\r
4832                 self::$headMess = $msg;\r
4833                 self::$skin->parse('adminerrorpage');\r
4834                 return;\r
4835         }\r
4836         \r
4837         /**\r
4838          * Admin::disallow()\r
4839          * add error log and show error page \r
4840          * \r
4841          * @param       void\r
4842          * @return      void\r
4843          */\r
4844         static public function disallow()\r
4845         {\r
4846                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4847                 self::error(_ERROR_DISALLOWED);\r
4848                 return;\r
4849         }\r
4850 \r
4851         /**\r
4852          * Admin::action_PluginAdmin()\r
4853          * Output pluginadmin\r
4854          *\r
4855          * @param       string  $skinContents\r
4856          * @param       string  $extrahead\r
4857          * @return      void\r
4858          */\r
4859         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4860         {\r
4861                 self::$extrahead .= $extrahead;\r
4862                 self::$skin->parse('pluginadmin', $skinContents);\r
4863                 return;\r
4864         }\r
4865         \r
4866         /**\r
4867          * Admin::action_bookmarklet()\r
4868          * \r
4869          * @param       void\r
4870          * @return      void\r
4871          */\r
4872         static private function action_bookmarklet()\r
4873         {\r
4874                 global $member, $manager;\r
4875                 \r
4876                 $blogid = intRequestVar('blogid');\r
4877                 $member->teamRights($blogid) or self::disallow();\r
4878                 \r
4879                 self::$skin->parse('bookmarklet');\r
4880                 return;\r
4881         }\r
4882         \r
4883         /**\r
4884          * Admin::action_actionlog()\r
4885          * \r
4886          * @param       void\r
4887          * @return      void\r
4888          */\r
4889         static private function action_actionlog()\r
4890         {\r
4891                 global $member, $manager;\r
4892                 \r
4893                 $member->isAdmin() or self::disallow();\r
4894                 \r
4895                 self::$skin->parse('actionlog');\r
4896                 return;\r
4897         }\r
4898         \r
4899         /**\r
4900          * Admin::action_banlist()\r
4901          * \r
4902          * @param       void\r
4903          * @return      void\r
4904          */\r
4905         static private function action_banlist()\r
4906         {\r
4907                 global $member, $manager;\r
4908                 \r
4909                 $blogid = intRequestVar('blogid');\r
4910                 $member->blogAdminRights($blogid) or self::disallow();\r
4911                 \r
4912                 self::$skin->parse('banlist');\r
4913                 return;\r
4914         }\r
4915         \r
4916         /**\r
4917          * Admin::action_banlistdelete()\r
4918          * \r
4919          * @param       void\r
4920          * @return      void\r
4921          */\r
4922         static private function action_banlistdelete()\r
4923         {\r
4924                 global $member, $manager;\r
4925                 \r
4926                 $blogid = intRequestVar('blogid');\r
4927                 $member->blogAdminRights($blogid) or self::disallow();\r
4928                 \r
4929                 self::$skin->parse('banlistdelete');\r
4930                 return;\r
4931         }\r
4932         \r
4933         /**\r
4934          * Admin::action_banlistdeleteconfirm()\r
4935          * \r
4936          * @param       void\r
4937          * @return      void\r
4938          */\r
4939         static private function action_banlistdeleteconfirm()\r
4940         {\r
4941                 global $member, $manager;\r
4942                 \r
4943                 $blogid         = intPostVar('blogid');\r
4944                 $allblogs       = postVar('allblogs');\r
4945                 $iprange        = postVar('iprange');\r
4946                 \r
4947                 $member->blogAdminRights($blogid) or self::disallow();\r
4948                 \r
4949                 $deleted = array();\r
4950                 \r
4951                 if ( !$allblogs )\r
4952                 {\r
4953                         if ( Ban::removeBan($blogid, $iprange) )\r
4954                         {\r
4955                                 $deleted[] = $blogid;\r
4956                         }\r
4957                 }\r
4958                 else\r
4959                 {\r
4960                         // get blogs fot which member has admin rights\r
4961                         $adminblogs = $member->getAdminBlogs();\r
4962                         foreach ($adminblogs as $blogje)\r
4963                         {\r
4964                                 if ( Ban::removeBan($blogje, $iprange) )\r
4965                                 {\r
4966                                         $deleted[] = $blogje;\r
4967                                 }\r
4968                         }\r
4969                 }\r
4970                 \r
4971                 if ( sizeof($deleted) == 0 )\r
4972                 {\r
4973                         self::error(_ERROR_DELETEBAN);\r
4974                         return;\r
4975                 }\r
4976                 \r
4977                 /* TODO: we should use other ways */\r
4978                 $_REQUEST['delblogs'] = $deleted;\r
4979                 \r
4980                 self::$skin->parse('banlistdeleteconfirm');\r
4981                 return;\r
4982         }\r
4983         \r
4984         /**\r
4985          * Admin::action_banlistnewfromitem()\r
4986          * \r
4987          * @param       void\r
4988          * @return      void\r
4989          */\r
4990         static private function action_banlistnewfromitem()\r
4991         {\r
4992                 global $manager;\r
4993                 \r
4994                 $itemid = intRequestVar('itemid');\r
4995                 $item =& $manager->getItem($itemid, 1, 1);\r
4996                 self::action_banlistnew($item['blogid']);\r
4997                 return;\r
4998         }\r
4999         \r
5000         /**\r
5001          * Admin::action_banlistnew()\r
5002          * \r
5003          * @param       integer $blogid ID for weblog\r
5004          * @return      void\r
5005          */\r
5006         static private function action_banlistnew($blogid = '')\r
5007         {\r
5008                 global $member, $manager;\r
5009                 \r
5010                 if ( $blogid == '' )\r
5011                 {\r
5012                         $blogid = intRequestVar('blogid');\r
5013                 }\r
5014                 \r
5015                 $ip = requestVar('ip');\r
5016                 \r
5017                 $member->blogAdminRights($blogid) or self::disallow();\r
5018                 \r
5019                 /* TODO: we should consider to use the other way instead of this */\r
5020                 $_REQUEST['blogid'] = $blogid;          \r
5021                 \r
5022                 self::$skin->parse('banlistnew');\r
5023                 \r
5024                 return;\r
5025         }\r
5026 \r
5027         /**\r
5028          * Admin::action_banlistadd()\r
5029          * \r
5030          * @param       void\r
5031          * @return      void\r
5032          */\r
5033         static private function action_banlistadd()\r
5034         {\r
5035                 global $member;\r
5036                 \r
5037                 $blogid         = intPostVar('blogid');\r
5038                 $allblogs       = postVar('allblogs');\r
5039                 $iprange        = postVar('iprange');\r
5040                 \r
5041                 if ( $iprange == "custom" )\r
5042                 {\r
5043                         $iprange = postVar('customiprange');\r
5044                 }\r
5045                 $reason   = postVar('reason');\r
5046                 \r
5047                 $member->blogAdminRights($blogid) or self::disallow();\r
5048                 \r
5049                 // TODO: check IP range validity\r
5050                 \r
5051                 if ( !$allblogs )\r
5052                 {\r
5053                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5054                         {\r
5055                                 self::error(_ERROR_ADDBAN);\r
5056                                 return;\r
5057                         }\r
5058                 }\r
5059                 else\r
5060                 {\r
5061                         // get blogs fot which member has admin rights\r
5062                         $adminblogs = $member->getAdminBlogs();\r
5063                         $failed = 0;\r
5064                         foreach ($adminblogs as $blogje)\r
5065                         {\r
5066                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5067                                 {\r
5068                                         $failed = 1;\r
5069                                 }\r
5070                         }\r
5071                         if ( $failed )\r
5072                         {\r
5073                                 self::error(_ERROR_ADDBAN);\r
5074                                 return;\r
5075                         }\r
5076                 }\r
5077                 self::action_banlist();\r
5078                 return;\r
5079         }\r
5080         \r
5081         /**\r
5082          * Admin::action_clearactionlog()\r
5083          * \r
5084          * @param       void\r
5085          * @return      void\r
5086          */\r
5087         static private function action_clearactionlog()\r
5088         {\r
5089                 global $member;\r
5090                 \r
5091                 $member->isAdmin() or self::disallow();\r
5092                 \r
5093                 ActionLog::clear();\r
5094                 \r
5095                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5096                 return;\r
5097         }\r
5098         \r
5099         /**\r
5100          * Admin::action_backupoverview()\r
5101          * \r
5102          * @param       void\r
5103          * @return      void\r
5104          */\r
5105         static private function action_backupoverview()\r
5106         {\r
5107                 global $member, $manager;\r
5108                 \r
5109                 $member->isAdmin() or self::disallow();\r
5110                 \r
5111                 self::$skin->parse('backupoverview');\r
5112                 return;\r
5113         }\r
5114 \r
5115         /**\r
5116          * Admin::action_backupcreate()\r
5117          * create file for backup\r
5118          * \r
5119          * @param               void\r
5120          * @return      void\r
5121          * \r
5122          */\r
5123         static private function action_backupcreate()\r
5124         {\r
5125                 global $member, $DIR_LIBS;\r
5126                 \r
5127                 $member->isAdmin() or self::disallow();\r
5128                 \r
5129                 // use compression ?\r
5130                 $useGzip = (integer) postVar('gzip');\r
5131                 \r
5132                 include($DIR_LIBS . 'backup.php');\r
5133                 \r
5134                 // try to extend time limit\r
5135                 // (creating/restoring dumps might take a while)\r
5136                 @set_time_limit(1200);\r
5137                 \r
5138                 Backup::do_backup($useGzip);\r
5139                 return;\r
5140         }\r
5141         \r
5142         /**\r
5143          * Admin::action_backuprestore()\r
5144          * restoring from uploaded file\r
5145          * \r
5146          * @param               void\r
5147          * @return      void\r
5148          */\r
5149         static private function action_backuprestore()\r
5150         {\r
5151                 global $member, $DIR_LIBS;\r
5152                 \r
5153                 $member->isAdmin() or self::disallow();\r
5154                 \r
5155                 if ( intPostVar('letsgo') != 1 )\r
5156                 {\r
5157                         self::error(_ERROR_BACKUP_NOTSURE);\r
5158                         return;\r
5159                 }\r
5160                 \r
5161                 include($DIR_LIBS . 'backup.php');\r
5162                 \r
5163                 // try to extend time limit\r
5164                 // (creating/restoring dumps might take a while)\r
5165                 @set_time_limit(1200);\r
5166                 \r
5167                 $message = Backup::do_restore();\r
5168                 if ( $message != '' )\r
5169                 {\r
5170                         self::error($message);\r
5171                         return;\r
5172                 }\r
5173                 self::$skin->parse('backuprestore');\r
5174                 return;\r
5175         }\r
5176         \r
5177         /**\r
5178          * Admin::action_pluginlist()\r
5179          * output the list of installed plugins\r
5180          * \r
5181          * @param       void\r
5182          * @return      void\r
5183          * \r
5184          */\r
5185         static private function action_pluginlist()\r
5186         {\r
5187                 global $DIR_PLUGINS, $member, $manager;\r
5188                 \r
5189                 // check if allowed\r
5190                 $member->isAdmin() or self::disallow();\r
5191                 \r
5192                 self::$skin->parse('pluginlist');\r
5193                 return;\r
5194         }\r
5195         \r
5196         /**\r
5197          * Admin::action_pluginhelp()\r
5198          * \r
5199          * @param       void\r
5200          * @return      void\r
5201          */\r
5202         static private function action_pluginhelp()\r
5203         {\r
5204                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5205                 \r
5206                 // check if allowed\r
5207                 $member->isAdmin() or self::disallow();\r
5208                 \r
5209                 $plugid = intGetVar('plugid');\r
5210                 \r
5211                 if ( !$manager->pidInstalled($plugid) )\r
5212                 {\r
5213                         self::error(_ERROR_NOSUCHPLUGIN);\r
5214                         return;\r
5215                 }\r
5216                 \r
5217                 self::$skin->parse('pluginhelp');\r
5218                 return;\r
5219         }\r
5220         \r
5221         /**\r
5222          * Admin::action_pluginadd()\r
5223          * \r
5224          * @param       Void\r
5225          * @return      Void\r
5226          * \r
5227          */\r
5228         static private function action_pluginadd()\r
5229         {\r
5230                 global $member, $manager, $DIR_PLUGINS;\r
5231                 \r
5232                 // check if allowed\r
5233                 $member->isAdmin() or self::disallow();\r
5234                 \r
5235                 $name = postVar('filename');\r
5236                 \r
5237                 if ( $manager->pluginInstalled($name) )\r
5238                 {\r
5239                         self::error(_ERROR_DUPPLUGIN);\r
5240                         return;\r
5241                 }\r
5242                 \r
5243                 if ( !checkPlugin($name) )\r
5244                 {\r
5245                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5246                         return;\r
5247                 }\r
5248                 \r
5249                 // get number of currently installed plugins\r
5250                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5251                 $numCurrent = $res->rowCount();\r
5252                 \r
5253                 // plugin will be added as last one in the list\r
5254                 $newOrder = $numCurrent + 1;\r
5255                 \r
5256                 $data = array('file' => &$name);\r
5257                 $manager->notify('PreAddPlugin', $data);\r
5258                 \r
5259                 // do this before calling getPlugin (in case the plugin id is used there)\r
5260                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5261                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5262                 DB::execute($query);\r
5263                 $iPid = DB::getInsertId();\r
5264                 \r
5265                 $manager->clearCachedInfo('installedPlugins');\r
5266                 \r
5267                 // Load the plugin for condition checking and instalation\r
5268                 $plugin =& $manager->getPlugin($name);\r
5269                 \r
5270                 // check if it got loaded (could have failed)\r
5271                 if ( !$plugin )\r
5272                 {\r
5273                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5274                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5275                         \r
5276                         DB::execute($query);\r
5277                         \r
5278                         $manager->clearCachedInfo('installedPlugins');\r
5279                         self::error(_ERROR_PLUGIN_LOAD);\r
5280                         return;\r
5281                 }\r
5282                 \r
5283                 // check if plugin needs a newer Nucleus version\r
5284                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5285                 {\r
5286                         // uninstall plugin again...\r
5287                         self::deleteOnePlugin($plugin->getID());\r
5288                         \r
5289                         // ...and show error\r
5290                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5291                         return;\r
5292                 }\r
5293                 \r
5294                 // check if plugin needs a newer Nucleus version\r
5295                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5296                 {\r
5297                         // uninstall plugin again...\r
5298                         self::deleteOnePlugin($plugin->getID());\r
5299                         \r
5300                         // ...and show error\r
5301                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5302                         return;\r
5303                 }\r
5304                 \r
5305                 $pluginList = $plugin->getPluginDep();\r
5306                 foreach ( $pluginList as $pluginName )\r
5307                 {\r
5308                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5309                         if ($res->rowCount() == 0)\r
5310                         {\r
5311                                 // uninstall plugin again...\r
5312                                 self::deleteOnePlugin($plugin->getID());\r
5313                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5314                                 return;\r
5315                         }\r
5316                 }\r
5317                 \r
5318                 // call the install method of the plugin\r
5319                 $plugin->install();\r
5320                 \r
5321                 $data = array('plugin' => &$plugin);\r
5322                 $manager->notify('PostAddPlugin', $data);\r
5323                 \r
5324                 // update all events\r
5325                 self::action_pluginupdate();\r
5326                 return;\r
5327         }\r
5328         \r
5329         /**\r
5330          * ADMIN:action_pluginupdate():\r
5331          * \r
5332          * @param       Void\r
5333          * @return      Void\r
5334          * \r
5335          */\r
5336         static private function action_pluginupdate()\r
5337         {\r
5338                 global $member, $manager, $CONF;\r
5339                 \r
5340                 // check if allowed\r
5341                 $member->isAdmin() or self::disallow();\r
5342                 \r
5343                 // delete everything from plugin_events\r
5344                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5345                 \r
5346                 // loop over all installed plugins\r
5347                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5348                 foreach ( $res as $row )\r
5349                 {\r
5350                         $pid  =  $row['pid'];\r
5351                         $plug =& $manager->getPlugin($row['pfile']);\r
5352                         if ( $plug )\r
5353                         {\r
5354                                 $eventList = $plug->getEventList();\r
5355                                 foreach ( $eventList as $eventName )\r
5356                                 {\r
5357                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5358                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5359                                         DB::execute($query);\r
5360                                 }\r
5361                         }\r
5362                 }\r
5363                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5364                 return;\r
5365         }\r
5366         \r
5367         /**\r
5368          * Admin::action_plugindelete()\r
5369          * \r
5370          * @param       void\r
5371          * @return      void\r
5372          */\r
5373         static private function action_plugindelete()\r
5374         {\r
5375                 global $member, $manager;\r
5376                 \r
5377                 // check if allowed\r
5378                 $member->isAdmin() or self::disallow();\r
5379                 \r
5380                 $pid = intGetVar('plugid');\r
5381                 \r
5382                 if ( !$manager->pidInstalled($pid) )\r
5383                 {\r
5384                         self::error(_ERROR_NOSUCHPLUGIN);\r
5385                         return;\r
5386                 }\r
5387                 \r
5388                 self::$skin->parse('plugindelete');\r
5389                 return;\r
5390         }\r
5391 \r
5392         /**\r
5393          * Admin::action_plugindeleteconfirm()\r
5394          * \r
5395          * @param       void\r
5396          * @return      void\r
5397          */\r
5398         static private function action_plugindeleteconfirm()\r
5399         {\r
5400                 global $member, $manager, $CONF;\r
5401                 \r
5402                 // check if allowed\r
5403                 $member->isAdmin() or self::disallow();\r
5404                 \r
5405                 $pid = intPostVar('plugid');\r
5406                 \r
5407                 $error = self::deleteOnePlugin($pid, 1);\r
5408                 if ( $error )\r
5409                 {\r
5410                         self::error($error);\r
5411                         return;\r
5412                 }\r
5413                 \r
5414                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5415                 return;\r
5416         }\r
5417         \r
5418         /**\r
5419          * Admin::\r
5420          * \r
5421          * @param       void\r
5422          * @return      void\r
5423          */\r
5424         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5425         {\r
5426                 global $manager;\r
5427                 \r
5428                 $pid = intval($pid);\r
5429                 \r
5430                 if ( !$manager->pidInstalled($pid) )\r
5431                 {\r
5432                         return _ERROR_NOSUCHPLUGIN;\r
5433                 }\r
5434                 \r
5435                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5436                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5437                 $name = DB::getValue($query);\r
5438                 \r
5439                 // check dependency before delete\r
5440                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5441                 foreach ( $res as $row )\r
5442                 {\r
5443                         $plug =& $manager->getPlugin($row['pfile']);\r
5444                         if ( $plug )\r
5445                         {\r
5446                                 $depList = $plug->getPluginDep();\r
5447                                 foreach ( $depList as $depName )\r
5448                                 {\r
5449                                         if ( $name == $depName )\r
5450                                         {\r
5451                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5452                                         }\r
5453                                 }\r
5454                         }\r
5455                 }\r
5456                 \r
5457                 $data = array('plugid' => $pid);\r
5458                 $manager->notify('PreDeletePlugin', $data);\r
5459                 \r
5460                 // call the unInstall method of the plugin\r
5461                 if ( $callUninstall )\r
5462                 {\r
5463                         $plugin =& $manager->getPlugin($name);\r
5464                         if ( $plugin )\r
5465                         {\r
5466                                 $plugin->unInstall();\r
5467                         }\r
5468                 }\r
5469                 \r
5470                 // delete all subscriptions\r
5471                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5472                 \r
5473                 // delete all options\r
5474                 // get OIDs from plugin_option_desc\r
5475                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5476                 $aOIDs = array();\r
5477                 foreach ( $res as $row )\r
5478                 {\r
5479                         array_push($aOIDs, $row['oid']);\r
5480                 }\r
5481                 \r
5482                 // delete from plugin_option and plugin_option_desc\r
5483                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5484                 if (count($aOIDs) > 0)\r
5485                 {\r
5486                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5487                 }\r
5488                 \r
5489                 // update order numbers\r
5490                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5491                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5492                 \r
5493                 // delete row\r
5494                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5495                 \r
5496                 $manager->clearCachedInfo('installedPlugins');\r
5497                 $data = array('plugid' => $pid);\r
5498                 $manager->notify('PostDeletePlugin', $data);\r
5499                 \r
5500                 return '';\r
5501         }\r
5502         \r
5503         /**\r
5504          * Admin::action_pluginup()\r
5505          * \r
5506          * @param       void\r
5507          * @return      void\r
5508          */\r
5509         static private function action_pluginup()\r
5510         {\r
5511                 global $member, $manager, $CONF;\r
5512                 \r
5513                 // check if allowed\r
5514                 $member->isAdmin() or self::disallow();\r
5515                 \r
5516                 $plugid = intGetVar('plugid');\r
5517                 \r
5518                 if ( !$manager->pidInstalled($plugid) )\r
5519                 {\r
5520                         self::error(_ERROR_NOSUCHPLUGIN);\r
5521                         return;\r
5522                 }\r
5523                 \r
5524                 // 1. get old order number\r
5525                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5526                 \r
5527                 // 2. calculate new order number\r
5528                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5529                 \r
5530                 // 3. update plug numbers\r
5531                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5532                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5533                 \r
5534                 //self::action_pluginlist();\r
5535                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5536                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5537                 return;\r
5538         }\r
5539         \r
5540         /**\r
5541          * Admin::action_plugindown()\r
5542          * \r
5543          * @param       void\r
5544          * @return      void\r
5545          */\r
5546         static private function action_plugindown()\r
5547         {\r
5548                 global $member, $manager, $CONF;\r
5549                 \r
5550                 // check if allowed\r
5551                 $member->isAdmin() or self::disallow();\r
5552                 \r
5553                 $plugid = intGetVar('plugid');\r
5554                 if ( !$manager->pidInstalled($plugid) )\r
5555                 {\r
5556                         self::error(_ERROR_NOSUCHPLUGIN);\r
5557                         return;\r
5558                 }\r
5559                 \r
5560                 // 1. get old order number\r
5561                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5562                 \r
5563                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5564                 $maxOrder = $res->rowCount();\r
5565                 \r
5566                 // 2. calculate new order number\r
5567                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5568                 \r
5569                 // 3. update plug numbers\r
5570                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5571                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5572                 \r
5573                 //self::action_pluginlist();\r
5574                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5575                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5576                 return;\r
5577         }\r
5578         \r
5579         /**\r
5580          * Admin::action_pluginoptions()\r
5581          * \r
5582          * Output Plugin option page\r
5583          * \r
5584          * @access      public\r
5585          * @param       string $message message when fallbacked\r
5586          * @return      void\r
5587          * \r
5588          */\r
5589         static private function action_pluginoptions($message = '')\r
5590         {\r
5591                 global $member, $manager;\r
5592                 \r
5593                 // check if allowed\r
5594                 $member->isAdmin() or self::disallow();\r
5595                 \r
5596                 $pid = intRequestVar('plugid');\r
5597                 if ( !$manager->pidInstalled($pid) )\r
5598                 {\r
5599                         self::error(_ERROR_NOSUCHPLUGIN);\r
5600                         return;\r
5601                 }\r
5602                 \r
5603                 if ( isset($message) )\r
5604                 {\r
5605                         self::$headMess = $message;\r
5606                 }\r
5607                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5608                 $plugin         = $manager->getPlugin($plugname);\r
5609                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
5610                 \r
5611                 self::$skin->parse('pluginoptions');\r
5612                 return;\r
5613         }\r
5614         \r
5615         /**\r
5616          * Admin::action_pluginoptionsupdate()\r
5617          * \r
5618          * Update plugin options and fallback to plugin option page\r
5619          * \r
5620          * @access      public\r
5621          * @param       void\r
5622          * @return      void\r
5623          */\r
5624         static private function action_pluginoptionsupdate()\r
5625         {\r
5626                 global $member, $manager;\r
5627                 \r
5628                 // check if allowed\r
5629                 $member->isAdmin() or self::disallow();\r
5630                 \r
5631                 $pid = intRequestVar('plugid');\r
5632                 \r
5633                 if ( !$manager->pidInstalled($pid) )\r
5634                 {\r
5635                         self::error(_ERROR_NOSUCHPLUGIN);\r
5636                         return;\r
5637                 }\r
5638                 \r
5639                 $aOptions = requestArray('plugoption');\r
5640                 NucleusPlugin::apply_plugin_options($aOptions);\r
5641                 \r
5642                 $data = array(\r
5643                         'context'       => 'global',\r
5644                         'plugid'        => $pid\r
5645                 );\r
5646                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5647                 \r
5648                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5649                 return;\r
5650         }\r
5651         \r
5652         /**\r
5653          * Admin::action_parseSpecialskin()\r
5654          * \r
5655          * @param       void\r
5656          * @return      void\r
5657          */\r
5658         static private function action_parseSpecialskin()\r
5659         {\r
5660                 self::$skin->parse(self::$action);\r
5661                 return;\r
5662         }\r
5663         \r
5664         /**\r
5665          * Admin::getAdminskinIDFromName()\r
5666          * \r
5667          * @param       string  $skinname       name of skin\r
5668          * @return      integer ID for skin\r
5669          */\r
5670         static private function getAdminskinIDFromName($skinname)\r
5671         {\r
5672                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5673                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5674                 $admnSknID      = DB::getValue($query);\r
5675                 return (integer) $adminSkinID;\r
5676         }\r
5677         \r
5678         /**\r
5679          * Admin::getAdminskinNameFromID()\r
5680          * \r
5681          * @param       integer $skinid ID for skin\r
5682          * @return      integer ID for skin\r
5683          */\r
5684         static private function getAdminskinNameFromID($skinid)\r
5685         {\r
5686                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5687                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5688                 $admnSknID      = DB::getValue($query);\r
5689                 return (integer) $adminSkinID;\r
5690         }\r
5691         \r
5692         /**\r
5693          * Admin::getAdminextrahead()\r
5694          */\r
5695         static public function getAdminextrahead()\r
5696         {\r
5697                 return self::$extrahead;\r
5698         }\r
5699         \r
5700         /**\r
5701          * Admin::getAdminpassvar()\r
5702          */\r
5703         static public function getAdminpassvar()\r
5704         {\r
5705                 return self::$passvar;\r
5706         }\r
5707         \r
5708         /**\r
5709          * Admin::getAdminAction()\r
5710          */\r
5711         static public function getAdminAction()\r
5712         {\r
5713                 return self::$action;\r
5714         }\r
5715         \r
5716         /**\r
5717          * Admin::getAdminaOption()\r
5718          */\r
5719         static public function getAdminaOption()\r
5720         {\r
5721                 return self::$aOptions;\r
5722         }\r
5723         \r
5724         /**\r
5725          * Admin::action_importAdmin()\r
5726          * \r
5727          * @param       void\r
5728          * @return      void\r
5729          */\r
5730         static private function action_importAdmin()\r
5731         {\r
5732                 global $DIR_ADMINSKINS, $action;\r
5733                 if ( $action == 'adminskinieimport' )\r
5734                 {\r
5735                         self::doAdminskinimport();\r
5736                 }\r
5737                 $skn = array();\r
5738                 if ( $action == 'showlogin' )\r
5739                 {\r
5740                         $skinName = 'showlogin';\r
5741                         $actnName = 'showlogin';\r
5742                 }\r
5743                 else\r
5744                 {\r
5745                         $skinName = 'defaultimporter';\r
5746                         $actnName = 'importAdmin';\r
5747                 }\r
5748                 \r
5749                 /* TODO: why??? */\r
5750                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5751                 $skn['id']                              = 0;\r
5752                 $skn['description']             = $skinName;\r
5753                 $skn['contentType']             = 'importAdmin';\r
5754                 $skn['includeMode']             = 'normal';\r
5755                 $skn['includePrefix']   = '';\r
5756                 $skn['name']                    = 'defaultinporter';\r
5757                 \r
5758                 self::$skin                             = (object) $skn;\r
5759                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5760                 \r
5761                 $parser = new PARSER($handler);\r
5762                 $parser->setSkin(self::$skin);\r
5763                 $parser->parse($contents);\r
5764                 \r
5765                 return;\r
5766         }\r
5767         \r
5768         /**\r
5769          * Admin::doAdminskinimport()\r
5770          * \r
5771          * @param       void\r
5772          * @return      void\r
5773          */\r
5774         static private function doAdminskinimport()\r
5775         {\r
5776                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5777                 \r
5778                 $member->isAdmin() or self::disallow();\r
5779                 \r
5780                 include_once($DIR_LIBS . 'Skinie.php');\r
5781                 $skinFileRaw    = postVar('skinfile');\r
5782                 $mode                   = postVar('mode');\r
5783                 $allowOverwrite = intPostVar('overwrite');\r
5784                 \r
5785                 if ( $mode == 'file' )\r
5786                 {\r
5787                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5788                 }\r
5789                 else\r
5790                 {\r
5791                         $skinFile = $skinFileRaw;\r
5792                 }\r
5793                 \r
5794                 $importer       = new SKINIMPORT();\r
5795                 $error          = $importer->readFile($skinFile);\r
5796                 if ( $error )\r
5797                 {\r
5798                         self::error($error);\r
5799                         return;\r
5800                 }\r
5801                 $error = $importer->writeToDatabase($allowOverwrite);\r
5802                 if ( $error )\r
5803                 {\r
5804                         self::error($error);\r
5805                         return;\r
5806                 }\r
5807                 \r
5808                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5809                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5810                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5811                 \r
5812                 header('Location: ' . $CONF['AdminURL']);\r
5813                 return;\r
5814         }\r
5815 }\r