nucleus/libs/ADMIN.php

   1 <?php
   2 /**
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18  */
  19
  20 if ( !function_exists('requestVar') ) exit;
  21 require_once dirname(__FILE__) . '/showlist.php';
  22
  23 class Admin
  24 {
  25         static private $skin;
  26
  27         static public $action;
  28         static public $aOptions;
  29         static public $blog;
  30         static public $contents;
  31         static public $extrahead;
  32         static public $headMess;
  33         static public $passvar;
  34
  35         static private $skinless_actions = array(
  36                 'plugindeleteconfirm',
  37                 'pluginoptionsupdate',
  38                 'blogsettingsupdate',
  39                 'settingsupdate',
  40                 'addnewlog2',
  41                 'additem',
  42                 'banlistnewfromitem',
  43                 'itemdeleteconfirm',
  44                 'itemupdate',
  45                 'changemembersettings',
  46                 'clearactionlog',
  47                 'memberedit',
  48                 'login',
  49
  50                 'skinremovetypeconfirm',
  51                 'skinclone',
  52                 'skindeleteconfirm',
  53                 'skinnew',
  54                 'skineditgeneral',
  55                 'skinupdate',
  56
  57                 'skinieexport',
  58
  59                 'templateupdate',
  60                 'templatedeleteconfirm',
  61                 'templatenew',
  62                 'templateclone',
  63
  64                 'adminskinremovetypeconfirm',
  65                 'adminskinclone',
  66                 'adminskindeleteconfirm',
  67                 'adminskinnew',
  68                 'adminskineditgeneral',
  69                 'adminskinupdate',
  70
  71                 'adminskinieexport',
  72
  73                 'admintemplateupdate',
  74                 'admintemplatedeleteconfirm',
  75                 'admintemplatenew',
  76                 'admintemplateclone'
  77         );
  78
  79         static private $ticketless_actions = array(
  80                 'showlogin',
  81                 'login',
  82                 'overview',
  83                 'itemlist',
  84                 'blogcommentlist',
  85                 'bookmarklet',
  86                 'blogsettings',
  87                 'banlist',
  88                 'createaccount',
  89                 'deleteblog',
  90                 'editmembersettings',
  91                 'createaccount',
  92                 'forgotpassword',
  93                 'browseowncomments',
  94                 'createitem',
  95                 'browseownitems',
  96                 'itemedit',
  97                 'itemmove',
  98                 'categoryedit',
  99                 'categorydelete',
 100                 'manage',
 101                 'actionlog',
 102                 'settingsedit',
 103                 'backupoverview',
 104                 'pluginlist',
 105                 'createnewlog',
 106                 'usermanagement',
 107                 'itemcommentlist',
 108                 'commentedit',
 109                 'commentdelete',
 110                 'banlistnewfromitem',
 111                 'banlistdelete',
 112                 'itemdelete',
 113                 'manageteam',
 114                 'teamdelete',
 115                 'banlistnew',
 116                 'memberedit',
 117                 'memberdelete',
 118                 'pluginhelp',
 119                 'pluginoptions',
 120                 'plugindelete',
 121
 122                 'activate',
 123                 'systemoverview',
 124                 'activatesetpwd',
 125
 126                 'skinoverview',
 127                 'skinclone',
 128                 'skindelete',
 129                 'skinedit',
 130                 'skinedittype',
 131                 'skinnew',
 132                 'skinremovetype',
 133
 134                 'skinieoverview',
 135
 136                 'templateoverview',
 137                 'templateclone',
 138                 'templateedit',
 139                 'templatedelete',
 140
 141                 'adminskinoverview',
 142                 'adminskinclone',
 143                 'adminskindelete',
 144                 'adminskinedit',
 145                 'adminskinedittype',
 146                 'adminskinnew',
 147                 'adminskinremovetype',
 148
 149                 'adminskinieoverview',
 150
 151                 'admintemplateoverview',
 152                 'admintemplateclone',
 153                 'admintemplateedit',
 154                 'admintemplatedelete'
 155         );
 156
 157         /**
 158          * NOTE: This is for condition of admin/normal skin actions
 159          */
 160         static public $adminskin_actions = array(
 161                 /* ticketless */
 162                 'adminskinoverview',
 163                 'adminskinclone',
 164                 'adminskindelete',
 165                 'adminskinedit',
 166                 'adminskinedittype',
 167                 'adminskinnew',
 168                 'adminskinremovetype',
 169
 170                 'adminskinieoverview',
 171
 172                 'admintemplateoverview',
 173                 'admintemplateclone',
 174                 'admintemplateedit',
 175                 'admintemplatedelete',
 176
 177                 /* ticket needed */
 178                 'adminskineditgeneral',
 179                 'adminskinupdate',
 180                 'adminskindeleteconfirm',
 181                 'adminskinremovetypeconfirm',
 182
 183                 'adminskinieoverview',
 184                 'adminskiniedoimport',
 185                 'adminskinieexport',
 186                 'adminskinieimport',
 187
 188                 'admintemplatenew',
 189                 'admintemplatedeleteconfirm',
 190                 'admintemplateupdate'
 191         );
 192
 193         static public function initialize()
 194         {
 195                 global $CONF, $manager, $member;
 196
 197                 /* NOTE: 1. decide which skinid to use */
 198                 $skinid = $CONF['AdminSkin'];
 199                 if ( $member->isLoggedIn() )
 200                 {
 201                         $memskin = $member->getAdminSkin();
 202                         if ( $memskin && Skin::existsID($memskin))
 203                         {
 204                                 $skinid = $memskin;
 205                         }
 206                 }
 207
 208                 /* NOTE: 2. make an instance of skin object */
 209                 if ( !Skin::existsID($skinid) )
 210                 {
 211                         return FALSE;
 212                 }
 213
 214                 /* NOTE: 3. initializing each members */
 215                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
 216                 self::$action           = '';
 217                 self::$extrahead        = '';
 218                 self::$passvar          = '';
 219                 self::$headMess         = '';
 220                 self::$aOptions         = '';
 221                 return TRUE;
 222         }
 223
 224         /**
 225          * Admin::action()
 226          * Executes an action
 227          *
 228          * @param       string  $action action to be performed
 229          * @return      void
 230          */
 231         static public function action($action)
 232         {
 233                 global $CONF, $manager, $member;
 234
 235                 /* 1. decide action name */
 236                 $customAction = postvar('customaction');
 237                 if ( empty($customAction) )
 238                 {
 239                         $alias = array(
 240                                 'login' => 'overview',
 241                                 ''              => 'overview',
 242                         );
 243                 }
 244                 else
 245                 {
 246                         $alias = array(
 247                                 'login' => $customAction,
 248                                 ''              => $customAction
 249                         );
 250                 }
 251                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )
 252                 {
 253                         $action = $alias[$action];
 254                 }
 255                 $method_name = "action_{$action}";
 256                 self::$action = strtolower($action);
 257
 258                 /* 2. check ticket-needed action */
 259                 if ( !in_array(self::$action, self::$ticketless_actions) && !$manager->checkTicket() )
 260                 {
 261                         self::error(_ERROR_BADTICKET);
 262                         return;
 263                 }
 264
 265                 /* 3. parse according to the action */
 266                 else if ( method_exists('Admin', $method_name) )
 267                 {
 268                         call_user_func(array(__CLASS__, $method_name));
 269                         return;
 270                 }
 271                 /* 4. parse special admin skin */
 272                 elseif ( in_array(self::$action, self::$skinless_actions) )
 273                 {
 274                         /* TODO: need to be implemented or not?
 275                         self::action_parseSpecialskin();
 276                         */
 277                 }
 278                 else
 279                 {
 280                         self::error(_BADACTION . ENTITY::hsc($action));
 281                         return;
 282                 }
 283
 284                 return;
 285         }
 286
 287         /**
 288          * Action::action_showlogin()
 289          *
 290          * @param       void
 291          * @return      void
 292          */
 293         static private function action_showlogin()
 294         {
 295                 global $error;
 296                 self::action_login($error);
 297                 return;
 298         }
 299
 300         /**
 301          * Action::action_login()
 302          *
 303          * @param       string  $msg            message for pageheader
 304          * @param       integer $passvars       ???
 305          */
 306         static private function action_login($msg = '', $passvars = 1)
 307         {
 308                 global $member;
 309
 310                 // skip to overview when allowed
 311                 if ( $member->isLoggedIn() && $member->canLogin() )
 312                 {
 313                         self::action_overview();
 314                         return;
 315                 }
 316
 317                 /* TODO: needless variable??? */
 318                 self::$passvar = $passvars;
 319                 if ( $msg )
 320                 {
 321                         self::$headMess = $msg;
 322                 }
 323
 324                 self::$skin->parse('showlogin');
 325         }
 326
 327         /**
 328          * Action::action_overview()
 329          * provides a screen with the overview of the actions available
 330          *
 331          * @param       string  $msg    message for pageheader
 332          * @return      void
 333          */
 334         static private function action_overview($msg = '')
 335         {
 336                 if ( $msg )
 337                 {
 338                         self::$headMess = $msg;
 339                 }
 340
 341                 self::$skin->parse('overview');
 342                 return;
 343         }
 344
 345         /**
 346          * Admin::action_manage()
 347          *
 348          * @param       string  $msg    message for pageheader
 349          * @retrn       void
 350          */
 351         static private function action_manage($msg = '')
 352         {
 353                 global $member;
 354
 355                 if ( $msg )
 356                 {
 357                         self::$headMess = $msg;
 358                 }
 359                 $member->isAdmin() or self::disallow();
 360
 361                 self::$skin->parse('manage');
 362                 return;
 363         }
 364
 365         /**
 366          * Action::action_itemlist()
 367          *
 368          * @param       integer id for weblod
 369          * @return      void
 370          */
 371         static private function action_itemlist($blogid = '')
 372         {
 373                 global $member, $manager, $CONF;
 374
 375                 if ( $blogid == '' )
 376                 {
 377                         $blogid = intRequestVar('blogid');
 378                 }
 379
 380                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 381
 382                 self::$skin->parse('itemlist');
 383                 return;
 384         }
 385
 386         /**
 387          * Action::action_batchitem()
 388          *
 389          * @param       void
 390          * @return      void
 391          */
 392         static private function action_batchitem()
 393         {
 394                 global $member, $manager;
 395
 396                 $member->isLoggedIn() or self::disallow();
 397
 398                 $selected       = requestIntArray('batch');
 399                 $action         = requestVar('batchaction');
 400
 401                 if ( !is_array($selected) || sizeof($selected) == 0 )
 402                 {
 403                         self::error(_BATCH_NOSELECTION);
 404                         return;
 405                 }
 406
 407                 // On move: when no destination blog/category chosen, show choice now
 408                 $destCatid = intRequestVar('destcatid');
 409                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )
 410                 {
 411                         self::batchMoveSelectDestination('item', $selected);
 412                 }
 413
 414                 // On delete: check if confirmation has been given
 415                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 416                 {
 417                         self::batchAskDeleteConfirmation('item', $selected);
 418                 }
 419
 420                 self::$skin->parse('batchitem');
 421                 return;
 422         }
 423
 424         /**
 425          * Action::action_batchcomment()
 426          *
 427          * @param       void
 428          * @return      void
 429          */
 430         static private function action_batchcomment()
 431         {
 432                 global $member;
 433
 434                 $member->isLoggedIn() or self::disallow();
 435
 436                 $selected       = requestIntArray('batch');
 437                 $action         = requestVar('batchaction');
 438
 439                 // Show error when no items were selected
 440                 if ( !is_array($selected) || sizeof($selected) == 0 )
 441                 {
 442                         self::error(_BATCH_NOSELECTION);
 443                         return;
 444                 }
 445
 446                 // On delete: check if confirmation has been given
 447                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 448                 {
 449                         self::batchAskDeleteConfirmation('comment', $selected);
 450                 }
 451
 452                 self::$skin->parse('batchcomment');
 453                 return;
 454         }
 455
 456         /**
 457          * Admin::action_batchmember()
 458          *
 459          * @param       void
 460          * @return      void
 461          */
 462         static private function action_batchmember()
 463         {
 464                 global $member;
 465
 466                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();
 467
 468                 $selected       = requestIntArray('batch');
 469                 $action         = requestVar('batchaction');
 470
 471                 // Show error when no members selected
 472                 if ( !is_array($selected) || sizeof($selected) == 0 )
 473                 {
 474                         self::error(_BATCH_NOSELECTION);
 475                         return;
 476                 }
 477
 478                 // On delete: check if confirmation has been given
 479                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 480                 {
 481                         self::batchAskDeleteConfirmation('member',$selected);
 482                 }
 483
 484                 self::$skin->parse('batchmember');
 485                 return;
 486         }
 487
 488         /**
 489          * Admin::action_batchteam()
 490          *
 491          * @param       void
 492          * @return      void
 493          */
 494         static private function action_batchteam()
 495         {
 496                 global $member;
 497
 498                 $blogid = intRequestVar('blogid');
 499
 500                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();
 501
 502                 $selected       = requestIntArray('batch');
 503                 $action         = requestVar('batchaction');
 504
 505                 if ( !is_array($selected) || sizeof($selected) == 0 )
 506                 {
 507                         self::error(_BATCH_NOSELECTION);
 508                         return;
 509                 }
 510
 511                 // On delete: check if confirmation has been given
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 513                 {
 514                         self::batchAskDeleteConfirmation('team',$selected);
 515                 }
 516
 517                 self::$skin->parse('batchteam');
 518                 return;
 519         }
 520
 521         /**
 522          * Admin::action_batchcategory()
 523          *
 524          * @param       void
 525          * @return      void
 526          */
 527         static private function action_batchcategory()
 528         {
 529                 global $member, $manager;
 530
 531                 $member->isLoggedIn() or self::disallow();
 532
 533                 $selected       = requestIntArray('batch');
 534                 $action         = requestVar('batchaction');
 535
 536                 if ( !is_array($selected) || sizeof($selected) == 0 )
 537                 {
 538                         self::error(_BATCH_NOSELECTION);
 539                         return;
 540                 }
 541
 542                 // On move: when no destination blog chosen, show choice now
 543                 $destBlogId = intRequestVar('destblogid');
 544                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )
 545                 {
 546                         self::batchMoveCategorySelectDestination('category', $selected);
 547                 }
 548
 549                 // On delete: check if confirmation has been given
 550                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 551                 {
 552                         self::batchAskDeleteConfirmation('category', $selected);
 553                 }
 554
 555                 self::$skin->parse('batchcategory');
 556                 return;
 557         }
 558
 559         /**
 560          * Admin::batchMoveSelectDestination()
 561          *
 562          * @param       string  $type   type of batch action
 563          * @param       integer $ids    needless???
 564          * @return      void
 565          *
 566          * TODO: remove needless argument
 567          */
 568         static private function batchMoveSelectDestination($type, $ids)
 569         {
 570                 $_POST['batchmove'] = $type;
 571                 self::$skin->parse('batchmove');
 572                 return;
 573         }
 574
 575         /**
 576          * Admin::batchMoveCategorySelectDestination()
 577          *
 578          * @param       string  $type   type of batch action
 579          * @param       integer $ids    needless???
 580          * @return      void
 581          *
 582          * TODO: remove needless argument
 583          */
 584         static private function batchMoveCategorySelectDestination($type, $ids)
 585         {
 586                 $_POST['batchmove'] = $type;
 587                 global $manager;
 588                 self::$skin->parse('batchmovecat');
 589                 return;
 590         }
 591
 592         /**
 593          * Admin::batchAskDeleteConfirmation()
 594          *
 595          * @param       string  $type   type of batch action
 596          * @param       integer $ids    needless???
 597          * @return      void
 598          *
 599          * TODO: remove needless argument
 600          */
 601         static private function batchAskDeleteConfirmation($type, $ids)
 602         {
 603                 self::$skin->parse('batchdelete');
 604                 return;
 605         }
 606
 607         /**
 608          * Admin::action_browseownitems()
 609          *
 610          * @param       void
 611          * @return      void
 612          */
 613         static private function action_browseownitems()
 614         {
 615                 global $member, $manager, $CONF;
 616
 617                 self::$skin->parse('browseownitems');
 618                 return;
 619         }
 620
 621         /**
 622          * Admin::action_itemcommentlist()
 623          * Show all the comments for a given item
 624          *
 625          * @param       integer $itemid ID for item
 626          * @return      void
 627          */
 628         static private function action_itemcommentlist($itemid = '')
 629         {
 630                 global $member, $manager, $CONF;
 631
 632                 if ( $itemid == '' )
 633                 {
 634                         $itemid = intRequestVar('itemid');
 635                 }
 636
 637                 // only allow if user is allowed to alter item
 638                 $member->canAlterItem($itemid) or self::disallow();
 639
 640                 $item =& $manager->getItem($itemid, 1, 1);
 641                 $_REQUEST['itemid'] = $item['itemid'];
 642                 $_REQUEST['blogid'] = $item['blogid'];
 643
 644                 self::$skin->parse('itemcommentlist');
 645                 return;
 646         }
 647
 648         /**
 649          * Admin::action_browseowncomments()
 650          * Browse own comments
 651          *
 652          * @param       void
 653          * @return      void
 654          */
 655         static private function action_browseowncomments()
 656         {
 657                 self::$skin->parse('browseowncomments');
 658                 return;
 659         }
 660
 661         /**
 662          * Admin::action_blogcommentlist()
 663          * Browse all comments for a weblog
 664          *
 665          * @param       integer $blogid ID for weblog
 666          * @return      void
 667          */
 668         static private function action_blogcommentlist($blogid = '')
 669         {
 670                 global $member, $manager, $CONF;
 671
 672                 if ( $blogid == '' )
 673                 {
 674                         $blogid = intRequestVar('blogid');
 675                 }
 676                 else
 677                 {
 678                         $blogid = intval($blogid);
 679                 }
 680
 681                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 682
 683                 /* TODO: we consider to use the other way insterad of this */
 684                 $_REQUEST['blogid'] = $blogid;
 685
 686                 self::$skin->parse('blogcommentlist');
 687                 return;
 688         }
 689
 690         /**
 691          * Admin::action_createaccount()
 692          *
 693          * @param       void
 694          * @return      void
 695          */
 696         static private function action_createaccount()
 697         {
 698                 global $CONF;
 699
 700                 if ( $CONF['AllowMemberCreate'] != 1 )
 701                 {
 702                         self::$skin->parse('createaccountdisable');
 703                         return;
 704                 }
 705
 706                 $name = '';
 707                 $realname ='';
 708                 $email = '';
 709                 $url = '';
 710
 711                 $contents = array(
 712                         'name'          => '',
 713                         'realname'      => '',
 714                         'email'         => '',
 715                         'url'           => ''
 716                 );
 717
 718                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )
 719                 {
 720                         $action = new Action();
 721                         $message = $action->createAccount();
 722                         if ( $message === 1 )
 723                         {
 724                                 self::$headMess = $message;
 725                                 self::$skin->parse('createaccountsuccess');
 726                                 return;
 727                         }
 728
 729                         /* TODO: validation */
 730                         if ( array_key_exists('name', $_POST) )
 731                         {
 732                                 $contents['name'] = $_POST['name'];
 733                         }
 734                         if ( array_key_exists('realname', $_POST) )
 735                         {
 736                                 $contents['realname'] = $_POST['realname'];
 737                         }
 738                         if ( array_key_exists('email', $_POST) )
 739                         {
 740                                 $contents['email'] = $_POST['email'];
 741                         }
 742                         if ( array_key_exists('url', $_POST) )
 743                         {
 744                                 $contents['url'] = $_POST['url'];
 745                         }
 746
 747                         self::$contents = $contents;
 748
 749                 }
 750
 751                 self::$skin->parse('createaccountinput');
 752                 return;
 753         }
 754
 755         /**
 756          * Admin::action_createitem()
 757          * Provide a page to item a new item to the given blog
 758          *
 759          * @param       void
 760          * @return      void
 761          */
 762         static private function action_createitem()
 763         {
 764                 global $member, $manager;
 765
 766                 $blogid = intRequestVar('blogid');
 767
 768                 // check if allowed
 769                 $member->teamRights($blogid) or self::disallow();
 770
 771                 $blog =& $manager->getBlog($blogid);
 772                 $contents = array();
 773
 774                 $data = array(
 775                         'blog'          => &$blog,
 776                         'contents'      => &$contents
 777                 );
 778                 $manager->notify('PreAddItemForm', $data);
 779
 780                 if ( $blog->convertBreaks() )
 781                 {
 782                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )
 783                         {
 784                                 $contents['body'] = removeBreaks($contents['body']);
 785                         }
 786                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )
 787                         {
 788                                 $contents['more'] = removeBreaks($contents['more']);
 789                         }
 790                 }
 791
 792                 self::$blog = &$blog;
 793                 self::$contents = &$contents;
 794
 795                 self::$skin->parse('createitem');
 796                 return;
 797         }
 798
 799         /**
 800          * Admin::action_itemedit()
 801          *
 802          * @param       void
 803          * @return      void
 804          */
 805         static private function action_itemedit()
 806         {
 807                 global $member, $manager;
 808
 809                 $itemid = intRequestVar('itemid');
 810
 811                 // only allow if user is allowed to alter item
 812                 $member->canAlterItem($itemid) or self::disallow();
 813
 814                 $item =& $manager->getItem($itemid, 1, 1);
 815                 $blog =& $manager->getBlog($item['blogid']);
 816                 $data = array('blog'=> &$blog, 'item' => &$item);
 817                 $manager->notify('PrepareItemForEdit', $data);
 818
 819                 if ( $blog->convertBreaks() )
 820                 {
 821                         if ( array_key_exists('body', $item) && !empty($item['body']) )
 822                         {
 823                                 $item['body'] = removeBreaks($item['body']);
 824                         }
 825                         if ( array_key_exists('more', $item) && !empty($item['more']) )
 826                         {
 827                                 $item['more'] = removeBreaks($item['more']);
 828                         }
 829                 }
 830
 831                 self::$blog = &$blog;
 832                 self::$contents = &$item;
 833
 834                 self::$skin->parse('itemedit');
 835                 return;
 836         }
 837
 838         /**
 839          * Admin::action_itemupdate()
 840          *
 841          * @param       void
 842          * @return      void
 843          */
 844         static private function action_itemupdate()
 845         {
 846                 global $member, $manager, $CONF;
 847
 848                 $itemid = intRequestVar('itemid');
 849                 $catid  = postVar('catid');
 850
 851                 // only allow if user is allowed to alter item
 852                 $member->canUpdateItem($itemid, $catid) or self::disallow();
 853
 854                 $actiontype = postVar('actiontype');
 855
 856                 // delete actions are handled by itemdelete (which has confirmation)
 857                 if ( $actiontype == 'delete' )
 858                 {
 859                         self::action_itemdelete();
 860                         return;
 861                 }
 862
 863                 $body           = postVar('body');
 864                 $title          = postVar('title');
 865                 $more           = postVar('more');
 866                 $closed         = intPostVar('closed');
 867                 $draftid        = intPostVar('draftid');
 868
 869                 // default action = add now
 870                 if ( !$actiontype )
 871                 {
 872                         $actiontype='addnow';
 873                 }
 874
 875                 // create new category if needed
 876                 if ( i18n::strpos($catid,'newcat') === 0 )
 877                 {
 878                         // get blogid
 879                         list($blogid) = sscanf($catid,"newcat-%d");
 880
 881                         // create
 882                         $blog =& $manager->getBlog($blogid);
 883                         $catid = $blog->createNewCategory();
 884
 885                         // show error when sth goes wrong
 886                         if ( !$catid )
 887                         {
 888                                 self::doError(_ERROR_CATCREATEFAIL);
 889                         }
 890                 }
 891
 892                 /**
 893                  * set some variables based on actiontype
 894                  *
 895                  * actiontypes:
 896                  *      draft items -> addnow, addfuture, adddraft, delete
 897                  *      non-draft items -> edit, changedate, delete
 898                  *
 899                  * variables set:
 900                  *      $timestamp: set to a nonzero value for future dates or date changes
 901                  *      $wasdraft: set to 1 when the item used to be a draft item
 902                  *      $publish: set to 1 when the edited item is not a draft
 903                  */
 904                 $blogid =  getBlogIDFromItemID($itemid);
 905                 $blog =& $manager->getBlog($blogid);
 906
 907                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');
 908                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
 909                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
 910                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )
 911                 {
 912                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
 913                 }
 914                 else
 915                 {
 916                         $timestamp =0;
 917                 }
 918
 919                 // edit the item for real
 920                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
 921
 922                 self::updateFuturePosted($blogid);
 923
 924                 if ( $draftid > 0 )
 925                 {
 926                         // delete permission is checked inside Item::delete()
 927                         Item::delete($draftid);
 928                 }
 929
 930                 if ( $catid != intPostVar('catid') )
 931                 {
 932                         self::action_categoryedit(
 933                                 $catid,
 934                                 $blog->getID(),
 935                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
 936                         );
 937                 }
 938                 else
 939                 {
 940                         // TODO: set start item correctly for itemlist
 941                         $item =& $manager->getitem($itemid, 1, 1);
 942                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";
 943                         $query = sprintf($query, sql_table('item'), $item['timestamp']);
 944                         $cnt  = DB::getValue($query);
 945                         $_REQUEST['start'] = $cnt + 1;
 946                         self::action_itemlist(getBlogIDFromItemID($itemid));
 947                 }
 948                 return;
 949         }
 950
 951         /**
 952          * Admin::action_itemdelete()
 953          * Delete item
 954          *
 955          * @param       Void
 956          * @return      Void
 957          */
 958         static private function action_itemdelete()
 959         {
 960                 global $member, $manager;
 961
 962                 $itemid = intRequestVar('itemid');
 963
 964                 // only allow if user is allowed to alter item
 965                 $member->canAlterItem($itemid) or self::disallow();
 966
 967                 if ( !$manager->existsItem($itemid,1,1) )
 968                 {
 969                         self::error(_ERROR_NOSUCHITEM);
 970                         return;
 971                 }
 972
 973                 self::$skin->parse('itemdelete');
 974                 return;
 975         }
 976
 977         /**
 978          * Admin::action_itemdeleteconfirm()
 979          *
 980          * @param       void
 981          * @return      void
 982          */
 983         static private function action_itemdeleteconfirm()
 984         {
 985                 global $member, $manager;
 986
 987                 $itemid = intRequestVar('itemid');
 988
 989                 // only allow if user is allowed to alter item
 990                 $member->canAlterItem($itemid) or self::disallow();
 991
 992                 // get item first
 993                 $item =& $manager->getItem($itemid, 1, 1);
 994
 995                 // delete item (note: some checks will be performed twice)
 996                 self::deleteOneItem($item['itemid']);
 997
 998                 self::action_itemlist($item['blogid']);
 999                 return;
1000         }
1001
1002         /**
1003          * Admin::deleteOneItem()
1004          * Deletes one item and returns error if something goes wrong
1005          *
1006          * @param       integer $itemid ID for item
1007          * @return      void
1008          */
1009         static public function deleteOneItem($itemid)
1010         {
1011                 global $member, $manager;
1012
1013                 // only allow if user is allowed to alter item (also checks if itemid exists)
1014                 if ( !$member->canAlterItem($itemid) )
1015                 {
1016                         return _ERROR_DISALLOWED;
1017                 }
1018
1019                 // need to get blogid before the item is deleted
1020                 $item =& $manager->getItem($itemid, 1, 1);
1021
1022                 $manager->loadClass('ITEM');
1023                 Item::delete($item['itemid']);
1024
1025                 // update blog's futureposted
1026                 self::updateFuturePosted($item['itemid']);
1027                 return;
1028         }
1029
1030         /**
1031          * Admin::updateFuturePosted()
1032          * Update a blog's future posted flag
1033          *
1034          * @param integer $blogid
1035          * @return      void
1036          */
1037         static private function updateFuturePosted($blogid)
1038         {
1039                 global $manager;
1040
1041                 $blogid                 =  intval($blogid);
1042                 $blog                   =& $manager->getBlog($blogid);
1043                 $currenttime    =  $blog->getCorrectTime(time());
1044
1045                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1046                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1047                 $result = DB::getResult($query);
1048
1049                 if ( $result->rowCount() > 0 )
1050                 {
1051                                 $blog->setFuturePost();
1052                 }
1053                 else
1054                 {
1055                                 $blog->clearFuturePost();
1056                 }
1057                 return;
1058         }
1059
1060         /**
1061          * Admin::action_itemmove()
1062          *
1063          * @param       void
1064          * @return      void
1065          */
1066         static private function action_itemmove()
1067         {
1068                 global $member, $manager;
1069
1070                 $itemid = intRequestVar('itemid');
1071
1072                 $member->canAlterItem($itemid) or self::disallow();
1073
1074                 self::$skin->parse('itemmove');
1075                 return;
1076         }
1077
1078         /**
1079          * Admin::action_itemmoveto()
1080          *
1081          * @param       void
1082          * @return      void
1083          */
1084         static private function action_itemmoveto()
1085         {
1086                 global $member, $manager;
1087
1088                 $itemid = intRequestVar('itemid');
1089                 $catid = requestVar('catid');
1090
1091                 // create new category if needed
1092                 if ( i18n::strpos($catid,'newcat') === 0 )
1093                 {
1094                         // get blogid
1095                         list($blogid) = sscanf($catid,'newcat-%d');
1096
1097                         // create
1098                         $blog =& $manager->getBlog($blogid);
1099                         $catid = $blog->createNewCategory();
1100
1101                         // show error when sth goes wrong
1102                         if ( !$catid )
1103                         {
1104                                 self::doError(_ERROR_CATCREATEFAIL);
1105                         }
1106                 }
1107
1108                 // only allow if user is allowed to alter item
1109                 $member->canUpdateItem($itemid, $catid) or self::disallow();
1110
1111                 $old_blogid = getBlogIDFromItemId($itemid);
1112
1113                 Item::move($itemid, $catid);
1114
1115                 // set the futurePosted flag on the blog
1116                 self::updateFuturePosted(getBlogIDFromItemId($itemid));
1117
1118                 // reset the futurePosted in case the item is moved from one blog to another
1119                 self::updateFuturePosted($old_blogid);
1120
1121                 if ( $catid != intRequestVar('catid') )
1122                 {
1123                         self::action_categoryedit($catid, $blog->getID());
1124                 }
1125                 else
1126                 {
1127                         self::action_itemlist(getBlogIDFromCatID($catid));
1128                 }
1129                 return;
1130         }
1131
1132         /**
1133          * Admin::moveOneItem()
1134          * Moves one item to a given category (category existance should be checked by caller)
1135          * errors are returned
1136          *
1137          * @param       integer $itemid         ID for item
1138          * @param       integer $destCatid      ID for category to which the item will be moved
1139          * @return      void
1140          */
1141         static public function moveOneItem($itemid, $destCatid)
1142         {
1143                 global $member;
1144
1145                 // only allow if user is allowed to move item
1146                 if ( !$member->canUpdateItem($itemid, $destCatid) )
1147                 {
1148                         return _ERROR_DISALLOWED;
1149                 }
1150
1151                 Item::move($itemid, $destCatid);
1152                 return;
1153         }
1154
1155         /**
1156          * Admin::action_additem()
1157          * Adds a item to the chosen blog
1158          *
1159          * @param       void
1160          * @return      void
1161          */
1162         static private function action_additem()
1163         {
1164                 global $manager, $CONF;
1165
1166                 $manager->loadClass('ITEM');
1167
1168                 $result = Item::createFromRequest();
1169
1170                 if ( $result['status'] == 'error' )
1171                 {
1172                         self::error($result['message']);
1173                         return;
1174                 }
1175
1176                 $item =& $manager->getItem($result['itemid'], 0, 0);
1177
1178                 if ( $result['status'] == 'newcategory' )
1179                 {
1180                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);
1181                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);
1182                 }
1183                 else
1184                 {
1185                         $methodName = 'action_itemlist';
1186                         self::action_itemlist($item['blogid']);
1187                 }
1188                 return;
1189         }
1190
1191         /**
1192          * Admin::action_commentedit()
1193          * Allows to edit previously made comments
1194          *
1195          * @param       void
1196          * @return      void
1197          */
1198         static private function action_commentedit()
1199         {
1200                 global $member, $manager;
1201
1202                 $commentid = intRequestVar('commentid');
1203
1204                 $member->canAlterComment($commentid) or self::disallow();
1205
1206                 $comment = Comment::getComment($commentid);
1207                 $data = array('comment' => &$comment);
1208                 $manager->notify('PrepareCommentForEdit', $data);
1209
1210                 self::$contents = $comment;
1211                 self::$skin->parse('commentedit');
1212                 return;
1213         }
1214
1215         /**
1216          * Admin::action_commentupdate()
1217          *
1218          * @param       void
1219          * @return      void
1220          */
1221         static private function action_commentupdate()
1222         {
1223                 global $member, $manager;
1224
1225                 $commentid = intRequestVar('commentid');
1226
1227                 $member->canAlterComment($commentid) or self::disallow();
1228
1229                 $url    = postVar('url');
1230                 $email  = postVar('email');
1231                 $body   = postVar('body');
1232
1233                 // intercept words that are too long
1234                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1235                 {
1236                         self::error(_ERROR_COMMENT_LONGWORD);
1237                         return;
1238                 }
1239
1240                 // check length
1241                 if ( i18n::strlen($body) < 3 )
1242                 {
1243                         self::error(_ERROR_COMMENT_NOCOMMENT);
1244                         return;
1245                 }
1246
1247                 if ( i18n::strlen($body) > 5000 )
1248                 {
1249                         self::error(_ERROR_COMMENT_TOOLONG);
1250                         return;
1251                 }
1252
1253                 // prepare body
1254                 $body = Comment::prepareBody($body);
1255
1256                 // call plugins
1257                 $data = array(
1258                         'body' => &$body
1259                 );
1260                 $manager->notify('PreUpdateComment', $data);
1261
1262                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";
1263                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);
1264                 DB::execute($query);
1265
1266                 // get itemid
1267                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1268                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1269
1270                 $itemid = DB::getValue($query);
1271
1272                 if ( $member->canAlterItem($itemid) )
1273                 {
1274                         self::action_itemcommentlist($itemid);
1275                 }
1276                 else
1277                 {
1278                         self::action_browseowncomments();
1279                 }
1280                 return;
1281         }
1282
1283         /**
1284          * Admin::action_commentdelete()
1285          * Update comment
1286          *
1287          * @param       void
1288          * @return      void
1289          */
1290         static private function action_commentdelete()
1291         {
1292                 global $member, $manager;
1293
1294                 $commentid = intRequestVar('commentid');
1295                 $member->canAlterComment($commentid) or self::disallow();
1296
1297                 self::$skin->parse('commentdelete');
1298                 return;
1299         }
1300
1301         /**
1302          * Admin::action_commentdeleteconfirm()
1303          *
1304          * @param       void
1305          * @return      void
1306          */
1307         static private function action_commentdeleteconfirm()
1308         {
1309                 global $member;
1310
1311                 $commentid = intRequestVar('commentid');
1312
1313                 // get item id first
1314                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1315                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1316
1317                 $itemid = DB::getValue($query);
1318
1319                 $error = self::deleteOneComment($commentid);
1320                 if ( $error )
1321                 {
1322                         self::doError($error);
1323                 }
1324
1325                 if ( $member->canAlterItem($itemid) )
1326                 {
1327                         self::action_itemcommentlist($itemid);
1328                 }
1329                 else
1330                 {
1331                         self::action_browseowncomments();
1332                 }
1333                 return;
1334         }
1335
1336         /**
1337          * Admin::deleteOneComment()
1338          *
1339          * @param       integer $commentid      ID for comment
1340          * @return      void
1341          */
1342         static public function deleteOneComment($commentid)
1343         {
1344                 global $member, $manager;
1345
1346                 $commentid = (integer) $commentid;
1347
1348                 if ( !$member->canAlterComment($commentid) )
1349                 {
1350                         return _ERROR_DISALLOWED;
1351                 }
1352
1353                 $data = array(
1354                         'commentid' => $commentid
1355                 );
1356
1357                 $manager->notify('PreDeleteComment', $data);
1358
1359                 // delete the comments associated with the item
1360                 $query = "DELETE FROM %s WHERE cnumber=%d;";
1361                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1362                 DB::execute($query);
1363
1364                 $data = array(
1365                         'commentid' => $commentid
1366                 );
1367
1368                 $manager->notify('PostDeleteComment', $data);
1369
1370                 return '';
1371         }
1372
1373         /**
1374          * Admin::action_usermanagement()
1375          * Usermanagement main
1376          *
1377          * @param       void
1378          * @return      void
1379          */
1380         static private function action_usermanagement()
1381         {
1382                 global $member, $manager;
1383
1384                 // check if allowed
1385                 $member->isAdmin() or self::disallow();
1386
1387                 self::$skin->parse('usermanagement');
1388                 return;
1389         }
1390
1391         /**
1392          * Admin::action_memberedit()
1393          * Edit member settings
1394          *
1395          * @param       void
1396          * @return      void
1397          */
1398         static private function action_memberedit()
1399         {
1400                 self::action_editmembersettings(intRequestVar('memberid'));
1401                 return;
1402         }
1403
1404         /**
1405          * Admin::action_editmembersettings()
1406          *
1407          * @param       integer $memberid       ID for member
1408          * @return      void
1409          *
1410          */
1411         static private function action_editmembersettings($memberid = '')
1412         {
1413                 global $member, $manager, $CONF;
1414
1415                 if ( $memberid == '' )
1416                 {
1417                         $memberid = $member->getID();
1418                 }
1419
1420                 /* TODO: we should consider to use the other way insterad of this */
1421                 $_REQUEST['memberid'] = $memberid;
1422
1423                 // check if allowed
1424                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1425
1426                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
1427
1428                 self::$skin->parse('editmembersettings');
1429                 return;
1430         }
1431
1432         /**
1433          * Admin::action_changemembersettings()
1434          *
1435          * @param       void
1436          * @return      void
1437          */
1438         static private function action_changemembersettings()
1439         {
1440                 global $member, $CONF, $manager;
1441
1442                 $memberid = intRequestVar('memberid');
1443
1444                 // check if allowed
1445                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1446
1447                 $name                   = trim(strip_tags(postVar('name')));
1448                 $realname               = trim(strip_tags(postVar('realname')));
1449                 $password               = postVar('password');
1450                 $repeatpassword = postVar('repeatpassword');
1451                 $email                  = strip_tags(postVar('email'));
1452                 $url                    = strip_tags(postVar('url'));
1453                 $adminskin              = intPostVar('adminskin');
1454                 $bookmarklet    = intPostVar('bookmarklet');
1455
1456                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1457                 if ( !preg_match('#^https?://#', $url) )
1458                 {
1459                         $url = 'http://' . $url;
1460                 }
1461
1462                 $admin          = postVar('admin');
1463                 $canlogin       = postVar('canlogin');
1464                 $notes          = strip_tags(postVar('notes'));
1465                 $locale         = postVar('locale');
1466
1467                 $mem =& $manager->getMember($memberid);
1468
1469                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1470                 {
1471                         if ( !isValidDisplayName($name) )
1472                         {
1473                                 self::error(_ERROR_BADNAME);
1474                                 return;
1475                         }
1476
1477                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )
1478                         {
1479                                 self::error(_ERROR_NICKNAMEINUSE);
1480                                 return;
1481                         }
1482
1483                         if ( $password != $repeatpassword )
1484                         {
1485                                 self::error(_ERROR_PASSWORDMISMATCH);
1486                                 return;
1487                         }
1488
1489                         if ( $password && (i18n::strlen($password) < 6) )
1490                         {
1491                                 self::error(_ERROR_PASSWORDTOOSHORT);
1492                                 return;
1493                         }
1494
1495                         if ( $password )
1496                         {
1497                                 $pwdvalid = true;
1498                                 $pwderror = '';
1499
1500                                 $data = array(
1501                                         'password'     => $password,
1502                                         'errormessage' => &$pwderror,
1503                                         'valid'        => &$pwdvalid
1504                                 );
1505                                 $manager->notify('PrePasswordSet', $data);
1506
1507                                 if ( !$pwdvalid )
1508                                 {
1509                                         self::error($pwderror);
1510                                         return;
1511                                 }
1512                         }
1513                 }
1514
1515                 if ( !NOTIFICATION::address_validation($email) )
1516                 {
1517                         self::error(_ERROR_BADMAILADDRESS);
1518                         return;
1519                 }
1520                 if ( !$realname )
1521                 {
1522                         self::error(_ERROR_REALNAMEMISSING);
1523                         return;
1524                 }
1525                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
1526                 {
1527                         self::error(_ERROR_NOSUCHTRANSLATION);
1528                         return;
1529                 }
1530
1531                 // check if there will remain at least one site member with both the logon and admin rights
1532                 // (check occurs when taking away one of these rights from such a member)
1533                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1534                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1535                         )
1536                 {
1537                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1538                         if ( $r->rowCount() < 2 )
1539                         {
1540                                 self::error(_ERROR_ATLEASTONEADMIN);
1541                                 return;
1542                         }
1543                 }
1544
1545                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1546                 {
1547                         $mem->setDisplayName($name);
1548                         if ( $password )
1549                         {
1550                                 $mem->setPassword($password);
1551                         }
1552                 }
1553
1554                 $oldEmail = $mem->getEmail();
1555
1556                 $mem->setRealName($realname);
1557                 $mem->setEmail($email);
1558                 $mem->setURL($url);
1559                 $mem->setNotes($notes);
1560                 $mem->setLocale($locale);
1561                 $mem->setAdminSkin($adminskin);
1562                 $mem->setBookmarklet($bookmarklet);
1563
1564                 // only allow super-admins to make changes to the admin status
1565                 if ( $member->isAdmin() )
1566                 {
1567                         $mem->setAdmin($admin);
1568                         $mem->setCanLogin($canlogin);
1569                 }
1570
1571                 $autosave = postVar('autosave');
1572                 $mem->setAutosave($autosave);
1573
1574                 $mem->write();
1575
1576                 // store plugin options
1577                 $aOptions = requestArray('plugoption');
1578                 NucleusPlugin::apply_plugin_options($aOptions);
1579                 $data = array(
1580                         'context'  => 'member',
1581                         'memberid' => $memberid,
1582                         'member'   => &$mem
1583                 );
1584                 $manager->notify('PostPluginOptionsUpdate', $data);
1585
1586                 // if email changed, generate new password
1587                 if ( $oldEmail != $mem->getEmail() )
1588                 {
1589                         $mem->sendActivationLink('addresschange', $oldEmail);
1590                         // logout member
1591                         $mem->newCookieKey();
1592
1593                         // only log out if the member being edited is the current member.
1594                         if ( $member->getID() == $memberid )
1595                         {
1596                                 $member->logout();
1597                         }
1598                         self::action_login(_MSG_ACTIVATION_SENT, 0);
1599                         return;
1600                 }
1601
1602                 if ( ($mem->getID() == $member->getID())
1603                         && ($mem->getDisplayName() != $member->getDisplayName()) )
1604                 {
1605                         $mem->newCookieKey();
1606                         $member->logout();
1607                         self::action_login(_MSG_LOGINAGAIN, 0);
1608                 }
1609                 else
1610                 {
1611                         self::action_overview(_MSG_SETTINGSCHANGED);
1612                 }
1613                 return;
1614         }
1615
1616         /**
1617          * Admin::action_memberadd()
1618          *
1619          * @param       void
1620          * @return      void
1621          *
1622          */
1623         static private function action_memberadd()
1624         {
1625                 global $member, $manager;
1626
1627                 // check if allowed
1628                 $member->isAdmin() or self::disallow();
1629
1630                 if ( postVar('password') != postVar('repeatpassword') )
1631                 {
1632                         self::error(_ERROR_PASSWORDMISMATCH);
1633                         return;
1634                 }
1635
1636                 if ( i18n::strlen(postVar('password')) < 6 )
1637                 {
1638                         self::error(_ERROR_PASSWORDTOOSHORT);
1639                         return;
1640                 }
1641
1642                 $res = Member::create(
1643                         postVar('name'),
1644                         postVar('realname'),
1645                         postVar('password'),
1646                         postVar('email'),
1647                         postVar('url'),
1648                         postVar('admin'),
1649                         postVar('canlogin'),
1650                         postVar('notes')
1651                 );
1652
1653                 if ( $res != 1 )
1654                 {
1655                         self::error($res);
1656                         return;
1657                 }
1658
1659                 // fire PostRegister event
1660                 $newmem = new Member();
1661                 $newmem->readFromName(postVar('name'));
1662                 $data = array(
1663                         'member' => &$newmem
1664                 );
1665                 $manager->notify('PostRegister', $data);
1666
1667                 self::action_usermanagement();
1668                 return;
1669         }
1670
1671         /**
1672          * Admin::action_forgotpassword()
1673          *
1674          * @param       void
1675          * @return      void
1676          */
1677         static private function action_forgotpassword()
1678         {
1679                 self::$skin->parse('forgotpassword');
1680                 return;
1681         }
1682
1683         /**
1684          * Admin::action_activate()
1685          * Account activation
1686          *
1687          * @param       void
1688          * @return      void
1689          */
1690         static private function action_activate()
1691         {
1692                 $key = getVar('key');
1693                 self::showActivationPage($key);
1694                 return;
1695         }
1696
1697         /**
1698          * Admin::showActivationPage()
1699          *
1700          * @param       void
1701          * @return      void
1702          */
1703         static private function showActivationPage($key, $message = '')
1704         {
1705                 global $manager;
1706
1707                 // clean up old activation keys
1708                 Member::cleanupActivationTable();
1709
1710                 // get activation info
1711                 $info = Member::getActivationInfo($key);
1712
1713                 if ( !$info )
1714                 {
1715                         self::error(_ERROR_ACTIVATE);
1716                         return;
1717                 }
1718
1719                 $mem =& $manager->getMember($info->vmember);
1720
1721                 if ( !$mem )
1722                 {
1723                         self::error(_ERROR_ACTIVATE);
1724                         return;
1725                 }
1726
1727                 /* TODO: we should consider to use the other way insterad of this */
1728                 $_POST['ackey']                                 = $key;
1729                 $_POST['bNeedsPasswordChange']  = TRUE;
1730
1731                 self::$headMess = $message;
1732                 self::$skin->parse('activate');
1733                 return;
1734         }
1735
1736         /**
1737          * Admin::action_activatesetpwd()
1738          * Account activation - set password part
1739          *
1740          * @param       void
1741          * @return      void
1742          */
1743         static private function action_activatesetpwd()
1744         {
1745                 global $manager;
1746                 $key = postVar('key');
1747
1748                 // clean up old activation keys
1749                 Member::cleanupActivationTable();
1750
1751                 // get activation info
1752                 $info = Member::getActivationInfo($key);
1753
1754                 if ( !$info || ($info->type == 'addresschange') )
1755                 {
1756                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1757                 }
1758
1759                 $mem =& $manager->getMember($info->vmember);
1760
1761                 if ( !$mem )
1762                 {
1763                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1764                 }
1765
1766                 $password               = postVar('password');
1767                 $repeatpassword = postVar('repeatpassword');
1768
1769                 if ( $password != $repeatpassword )
1770                 {
1771                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);
1772                 }
1773
1774                 if ( $password && (i18n::strlen($password) < 6) )
1775                 {
1776                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
1777                 }
1778
1779                 if ( $password )
1780                 {
1781                         $pwdvalid = true;
1782                         $pwderror = '';
1783
1784                         $data = array(
1785                                 'password'              => $password,
1786                                 'errormessage'  => &$pwderror,
1787                                 'valid'                 => &$pwdvalid
1788                         );
1789                         $manager->notify('PrePasswordSet', $data);
1790                         if ( !$pwdvalid )
1791                         {
1792                                 return self::showActivationPage($key,$pwderror);
1793                         }
1794                 }
1795
1796                 $error = '';
1797
1798                 $data = array(
1799                         'type'   => 'activation',
1800                         'member' => $mem,
1801                         'error'  => &$error
1802                 );
1803                 $manager->notify('ValidateForm', $data);
1804                 if ( $error != '' )
1805                 {
1806                         return self::showActivationPage($key, $error);
1807                 }
1808
1809                 // set password
1810                 $mem->setPassword($password);
1811                 $mem->write();
1812
1813                 // do the activation
1814                 Member::activate($key);
1815
1816                 self::$skin->parse('activatesetpwd');
1817                 return;
1818         }
1819
1820         /**
1821          * Admin::action_manageteam()
1822          * Manage team
1823          *
1824          * @param       void
1825          * @return      void
1826          */
1827         static private function action_manageteam()
1828         {
1829                 global $member, $manager;
1830
1831                 $blogid = intRequestVar('blogid');
1832
1833                 // check if allowed
1834                 $member->blogAdminRights($blogid) or self::disallow();
1835
1836                 self::$skin->parse('manageteam');
1837                 return;
1838         }
1839
1840         /**
1841          * Admin::action_teamaddmember()
1842          * Add member to team
1843          *
1844          * @param       void
1845          * @return      void
1846          */
1847         static private function action_teamaddmember()
1848         {
1849                 global $member, $manager;
1850
1851                 $memberid       = intPostVar('memberid');
1852                 $blogid         = intPostVar('blogid');
1853                 $admin          = intPostVar('admin');
1854
1855                 // check if allowed
1856                 $member->blogAdminRights($blogid) or self::disallow();
1857
1858                 $blog =& $manager->getBlog($blogid);
1859                 if ( !$blog->addTeamMember($memberid, $admin) )
1860                 {
1861                         self::error(_ERROR_ALREADYONTEAM);
1862                         return;
1863                 }
1864
1865                 self::action_manageteam();
1866                 return;
1867         }
1868
1869         /**
1870          * Admin::action_teamdelete()
1871          *
1872          * @param       void
1873          * @return      void
1874          */
1875         static private function action_teamdelete()
1876         {
1877                 global $member, $manager;
1878
1879                 $memberid       = intRequestVar('memberid');
1880                 $blogid         = intRequestVar('blogid');
1881
1882                 // check if allowed
1883                 $member->blogAdminRights($blogid) or self::disallow();
1884
1885                 $teammem =& $manager->getMember($memberid);
1886                 $blog =& $manager->getBlog($blogid);
1887
1888                 self::$skin->parse('teamdelete');
1889                 return;
1890         }
1891
1892         /**
1893          * Admin::action_teamdeleteconfirm()
1894          *
1895          * @param       void
1896          * @return      void
1897          */
1898         static private function action_teamdeleteconfirm()
1899         {
1900                 global $member;
1901
1902                 $memberid = intRequestVar('memberid');
1903                 $blogid = intRequestVar('blogid');
1904
1905                 $error = self::deleteOneTeamMember($blogid, $memberid);
1906                 if ( $error )
1907                 {
1908                         self::error($error);
1909                         return;
1910                 }
1911                 self::action_manageteam();
1912                 return;
1913         }
1914
1915         /**
1916          * Admin::deleteOneTeamMember()
1917          *
1918          * @param       void
1919          * @return      void
1920          */
1921         static public function deleteOneTeamMember($blogid, $memberid)
1922         {
1923                 global $member, $manager;
1924
1925                 $blogid   = intval($blogid);
1926                 $memberid = intval($memberid);
1927
1928                 // check if allowed
1929                 if ( !$member->blogAdminRights($blogid) )
1930                 {
1931                         return _ERROR_DISALLOWED;
1932                 }
1933
1934                 // check if: - there remains at least one blog admin
1935                 //           - (there remains at least one team member)
1936                 $tmem =& $manager->getMember($memberid);
1937
1938
1939                 $data = array(
1940                         'member' => &$tmem,
1941                         'blogid' => $blogid
1942                 );
1943                 $manager->notify('PreDeleteTeamMember', $data);
1944
1945                 if ( $tmem->isBlogAdmin($blogid) )
1946                 {
1947                         /* TODO: why we did double check? */
1948                         // check if there are more blog members left and at least one admin
1949                         // (check for at least two admins before deletion)
1950                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";
1951                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1952                         $r     = DB::getResult($query);
1953                         if ( $r->rowCount() < 2 )
1954                         {
1955                                 return _ERROR_ATLEASTONEBLOGADMIN;
1956                         }
1957                 }
1958
1959                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";
1960                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);
1961                 DB::execute($query);
1962
1963                 $data = array(
1964                         'member' => &$tmem,
1965                         'blogid' => $blogid
1966                 );
1967                 $manager->notify('PostDeleteTeamMember', $data);
1968
1969                 return '';
1970         }
1971
1972         /**
1973          * Admin::action_teamchangeadmin()
1974          *
1975          * @param       void
1976          * @return      void
1977          */
1978         static private function action_teamchangeadmin()
1979         {
1980                 global $manager, $member;
1981
1982                 $blogid         = intRequestVar('blogid');
1983                 $memberid       = intRequestVar('memberid');
1984
1985                 // check if allowed
1986                 $member->blogAdminRights($blogid) or self::disallow();
1987
1988                 $mem =& $manager->getMember($memberid);
1989
1990                 // don't allow when there is only one admin at this moment
1991                 if ( $mem->isBlogAdmin($blogid) )
1992                 {
1993                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";
1994                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1995                         $r = DB::getResult($query);
1996                         if ( $r->rowCount() == 1 )
1997                         {
1998                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);
1999                                 return;
2000                         }
2001                 }
2002
2003                 if ( $mem->isBlogAdmin($blogid) )
2004                 {
2005                         $newval = 0;
2006                 }
2007                 else
2008                 {
2009                         $newval = 1;
2010                 }
2011
2012                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";
2013                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);
2014                 DB::execute($query);
2015
2016                 // only show manageteam if member did not change its own admin privileges
2017                 if ( $member->isBlogAdmin($blogid) )
2018                 {
2019                         self::action_manageteam();
2020                 }
2021                 else
2022                 {
2023                         self::action_overview(_MSG_ADMINCHANGED);
2024                 }
2025                 return;
2026         }
2027
2028         /**
2029          * Admin::action_blogsettings()
2030          *
2031          * @param       void
2032          * @return      void
2033          */
2034         static private function action_blogsettings()
2035         {
2036                 global $member, $manager;
2037
2038                 $blogid = intRequestVar('blogid');
2039
2040                 // check if allowed
2041                 $member->blogAdminRights($blogid) or self::disallow();
2042
2043                 $blog =& $manager->getBlog($blogid);
2044
2045                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2046
2047                 self::$skin->parse('blogsettings');
2048                 return;
2049         }
2050
2051         /**
2052          * Admin::action_categorynew()
2053          *
2054          * @param       void
2055          * @return      void
2056          */
2057         static private function action_categorynew()
2058         {
2059                 global $member, $manager;
2060
2061                 $blogid = intRequestVar('blogid');
2062
2063                 $member->blogAdminRights($blogid) or self::disallow();
2064
2065                 $cname = postVar('cname');
2066                 $cdesc = postVar('cdesc');
2067
2068                 if ( !isValidCategoryName($cname) )
2069                 {
2070                         self::error(_ERROR_BADCATEGORYNAME);
2071                         return;
2072                 }
2073
2074                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";
2075                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);
2076                 $res = DB::getResult($query);
2077                 if ( $res->rowCount() > 0 )
2078                 {
2079                         self::error(_ERROR_DUPCATEGORYNAME);
2080                         return;
2081                 }
2082
2083                 $blog           =& $manager->getBlog($blogid);
2084                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2085
2086                 self::action_blogsettings();
2087                 return;
2088         }
2089
2090         /**
2091          * Admin::action_categoryedit()
2092          *
2093          * @param       void
2094          * @return      void
2095          */
2096         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')
2097         {
2098                 global $member, $manager;
2099
2100                 if ( $blogid == '' )
2101                 {
2102                         $blogid = intGetVar('blogid');
2103                 }
2104                 else
2105                 {
2106                         $blogid = intval($blogid);
2107                 }
2108                 if ( $catid == '' )
2109                 {
2110                         $catid = intGetVar('catid');
2111                 }
2112                 else
2113                 {
2114                         $catid = intval($catid);
2115                 }
2116
2117                 /* TODO: we should consider to use the other way insterad of this */
2118                 $_REQUEST['blogid']             = $blogid;
2119                 $_REQUEST['catid']              = $catid;
2120                 $_REQUEST['desturl']    = $desturl;
2121                 $member->blogAdminRights($blogid) or self::disallow();
2122
2123                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2124
2125                 self::$skin->parse('categoryedit');
2126                 return;
2127         }
2128
2129         /**
2130          * Admin::action_categoryupdate()
2131          *
2132          * @param       void
2133          * @return      void
2134          */
2135         static private function action_categoryupdate()
2136         {
2137                 global $member, $manager;
2138
2139                 $blogid         = intPostVar('blogid');
2140                 $catid          = intPostVar('catid');
2141                 $cname          = postVar('cname');
2142                 $cdesc          = postVar('cdesc');
2143                 $desturl        = postVar('desturl');
2144
2145                 $member->blogAdminRights($blogid) or self::disallow();
2146
2147                 if ( !isValidCategoryName($cname) )
2148                 {
2149                         self::error(_ERROR_BADCATEGORYNAME);
2150                         return;
2151                 }
2152
2153                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";
2154                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);
2155                 $res    = DB::getResult($query);
2156                 if ( $res->rowCount() > 0 )
2157                 {
2158                         self::error(_ERROR_DUPCATEGORYNAME);
2159                         return;
2160                 }
2161
2162                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";
2163                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);
2164                 DB::execute($query);
2165
2166                 // store plugin options
2167                 $aOptions = requestArray('plugoption');
2168                 NucleusPlugin::apply_plugin_options($aOptions);
2169                 $data = array(
2170                         'context'       => 'category',
2171                         'catid'         => $catid
2172                 );
2173                 $manager->notify('PostPluginOptionsUpdate', $data);
2174
2175                 if ( $desturl )
2176                 {
2177                         redirect($desturl);
2178                         return;
2179                 }
2180
2181                 self::action_blogsettings();
2182
2183                 return;
2184         }
2185
2186         /**
2187          * Admin::action_categorydelete()
2188          *
2189          * @param       void
2190          * @return      void
2191          */
2192         static private function action_categorydelete()
2193         {
2194                 global $member, $manager;
2195
2196                 $blogid = intRequestVar('blogid');
2197                 $catid  = intRequestVar('catid');
2198
2199                 $member->blogAdminRights($blogid) or self::disallow();
2200
2201                 $blog =& $manager->getBlog($blogid);
2202
2203                 // check if the category is valid
2204                 if ( !$blog->isValidCategory($catid) )
2205                 {
2206                         self::error(_ERROR_NOSUCHCATEGORY);
2207                         return;
2208                 }
2209
2210                 // don't allow deletion of default category
2211                 if ( $blog->getDefaultCategory() == $catid )
2212                 {
2213                         self::error(_ERROR_DELETEDEFCATEGORY);
2214                         return;
2215                 }
2216
2217                 // check if catid is the only category left for blogid
2218                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2219                 $query = sprintf($query, sql_table('category'), $blogid);
2220                 $res = DB::getResult($query);
2221                 if ( $res->rowCount() == 1 )
2222                 {
2223                         self::error(_ERROR_DELETELASTCATEGORY);
2224                         return;
2225                 }
2226
2227                 self::$skin->parse('categorydelete');
2228                 return;
2229         }
2230
2231         /**
2232          * Admin::action_categorydeleteconfirm()
2233          *
2234          * @param       void
2235          * @return      void
2236          */
2237         static private function action_categorydeleteconfirm()
2238         {
2239                 global $member, $manager;
2240
2241                 $blogid = intRequestVar('blogid');
2242                 $catid  = intRequestVar('catid');
2243
2244                 $member->blogAdminRights($blogid) or self::disallow();
2245
2246                 $error = self::deleteOneCategory($catid);
2247                 if ( $error )
2248                 {
2249                         self::error($error);
2250                         return;
2251                 }
2252
2253                 self::action_blogsettings();
2254                 return;
2255         }
2256
2257         /**
2258          * Admin::deleteOneCategory()
2259          * Delete a category by its id
2260          *
2261          * @param       String  $catid  category id for deleting
2262          * @return      Void
2263          */
2264         static public function deleteOneCategory($catid)
2265         {
2266                 global $manager, $member;
2267
2268                 $catid  = intval($catid);
2269                 $blogid = getBlogIDFromCatID($catid);
2270
2271                 if ( !$member->blogAdminRights($blogid) )
2272                 {
2273                         return ERROR_DISALLOWED;
2274                 }
2275
2276                 // get blog
2277                 $blog =& $manager->getBlog($blogid);
2278
2279                 // check if the category is valid
2280                 if ( !$blog || !$blog->isValidCategory($catid) )
2281                 {
2282                         return _ERROR_NOSUCHCATEGORY;
2283                 }
2284
2285                 $destcatid = $blog->getDefaultCategory();
2286
2287                 // don't allow deletion of default category
2288                 if ( $blog->getDefaultCategory() == $catid )
2289                 {
2290                         return _ERROR_DELETEDEFCATEGORY;
2291                 }
2292
2293                 // check if catid is the only category left for blogid
2294                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2295                 $query = sprintf($query, sql_table('category'), (integer) $blogid);
2296
2297                 $res = DB::getResult($query);
2298                 if ( $res->rowCount() == 1 )
2299                 {
2300                         return _ERROR_DELETELASTCATEGORY;
2301                 }
2302
2303                 $data = array('catid' => $catid);
2304                 $manager->notify('PreDeleteCategory', $data);
2305
2306                 // change category for all items to the default category
2307                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";
2308                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);
2309                 DB::execute($query);
2310
2311                 // delete all associated plugin options
2312                 NucleusPlugin::delete_option_values('category', (integer) $catid);
2313
2314                 // delete category
2315                 $query = "DELETE FROM %s WHERE catid=%d;";
2316                 $query = sprintf($query, sql_table('category'), (integer) $catid);
2317                 DB::execute($query);
2318
2319                 $data = array('catid' => $catid);
2320                 $manager->notify('PostDeleteCategory', $data);
2321                 return;
2322         }
2323
2324         /**
2325          * Admin::moveOneCategory()
2326          * Delete a category by its id
2327          *
2328          * @param       int     $catid          category id for move
2329          * @param       int     $destblogid     blog id for destination
2330          * @return      void
2331          */
2332         static public function moveOneCategory($catid, $destblogid)
2333         {
2334                 global $manager, $member;
2335                 $catid      = intval($catid);
2336                 $destblogid = intval($destblogid);
2337                 $blogid     = getBlogIDFromCatID($catid);
2338                 // mover should have admin rights on both blogs
2339                 if (!$member->blogAdminRights($blogid)) {
2340                         return _ERROR_DISALLOWED;
2341                 }
2342                 if (!$member->blogAdminRights($destblogid)) {
2343                         return _ERROR_DISALLOWED;
2344                 }
2345                 // cannot move to self
2346                 if ($blogid == $destblogid) {
2347                         return _ERROR_MOVETOSELF;
2348                 }
2349                 // get blogs
2350                 $blog     =& $manager->getBlog($blogid);
2351                 $destblog =& $manager->getBlog($destblogid);
2352                 // check if the category is valid
2353                 if (!$blog || !$blog->isValidCategory($catid)) {
2354                         return _ERROR_NOSUCHCATEGORY;
2355                 }
2356                 // don't allow default category to be moved
2357                 if ($blog->getDefaultCategory() == $catid) {
2358                         return _ERROR_MOVEDEFCATEGORY;
2359                 }
2360                 $data = array(
2361                         'catid'                 => &$catid,
2362                         'sourceblog'    => &$blog,
2363                         'destblog'              => &$destblog
2364                 );
2365                 $manager->notify('PreMoveCategory', $data);
2366                 // update comments table (cblog)
2367                 $query = 'SELECT '
2368                 . '    inumber '
2369                 . 'FROM '
2370                 .      sql_table('item') . ' '
2371                 . 'WHERE '
2372                 . '    icat = %d';
2373                 $items = sql_query(sprintf($query, $catid));
2374                 while ($oItem = sql_fetch_object($items)) {
2375                         $query = 'UPDATE '
2376                         .      sql_table('comment') . ' '
2377                         . 'SET '
2378                         . '    cblog = %d' . ' '
2379                         . 'WHERE '
2380                         . '    citem = %d';
2381                         sql_query(sprintf($query, $destblogid, $oItem->inumber));
2382                 }
2383
2384                 // update items (iblog)
2385                 $query = 'UPDATE '
2386                 .      sql_table('item') . ' '
2387                 . 'SET '
2388                 . '    iblog = %d '
2389                 . 'WHERE '
2390                 . '    icat = %d';
2391                 sql_query(sprintf($query, $destblogid, $catid));
2392
2393                 // move category
2394                 $query = 'UPDATE '
2395                 .      sql_table('category') . ' '
2396                 . 'SET '
2397                 . '    cblog = %d' . ' '
2398                 . 'WHERE '
2399                 . '    catid = %d';
2400                 sql_query(sprintf($query, $destblogid, $catid));
2401
2402                 $data = array(
2403                         'catid'                 => &$catid,
2404                         'sourceblog'    => &$blog,
2405                         'destblog'              =>  $destblog
2406                 );
2407                 $manager->notify('PostMoveCategory', $data);
2408                 return;
2409         }
2410
2411         /**
2412          * Admin::action_blogsettingsupdate
2413          * Updating blog settings
2414          *
2415          * @param       Void
2416          * @return      Void
2417          */
2418         static private function action_blogsettingsupdate()
2419         {
2420                 global $member, $manager;
2421
2422                 $blogid = intRequestVar('blogid');
2423
2424                 $member->blogAdminRights($blogid) or self::disallow();
2425
2426                 $blog =& $manager->getBlog($blogid);
2427
2428                 $notify_address = trim(postVar('notify'));
2429                 $shortname              = trim(postVar('shortname'));
2430                 $updatefile             = trim(postVar('update'));
2431
2432                 $notifyComment  = intPostVar('notifyComment');
2433                 $notifyVote             = intPostVar('notifyVote');
2434                 $notifyNewItem  = intPostVar('notifyNewItem');
2435
2436                 if ( $notifyComment == 0 )
2437                 {
2438                         $notifyComment = 1;
2439                 }
2440                 if ( $notifyVote == 0 )
2441                 {
2442                         $notifyVote = 1;
2443                 }
2444                 if ( $notifyNewItem == 0 )
2445                 {
2446                         $notifyNewItem = 1;
2447                 }
2448                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2449
2450                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2451                 {
2452                         self::error(_ERROR_BADNOTIFY);
2453                         return;
2454                 }
2455
2456                 if ( !isValidShortName($shortname) )
2457                 {
2458                         self::error(_ERROR_BADSHORTBLOGNAME);
2459                         return;
2460                 }
2461
2462                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2463                 {
2464                         self::error(_ERROR_DUPSHORTBLOGNAME);
2465                         return;
2466                 }
2467                 // check if update file is writable
2468                 if ( $updatefile && !is_writeable($updatefile) )
2469                 {
2470                         self::error(_ERROR_UPDATEFILE);
2471                         return;
2472                 }
2473
2474                 $blog->setName(trim(postVar('name')));
2475                 $blog->setShortName($shortname);
2476                 $blog->setNotifyAddress($notify_address);
2477                 $blog->setNotifyType($notifyType);
2478                 $blog->setMaxComments(postVar('maxcomments'));
2479                 $blog->setCommentsEnabled(postVar('comments'));
2480                 $blog->setTimeOffset(postVar('timeoffset'));
2481                 $blog->setUpdateFile($updatefile);
2482                 $blog->setURL(trim(postVar('url')));
2483                 $blog->setDefaultSkin(intPostVar('defskin'));
2484                 $blog->setDescription(trim(postVar('desc')));
2485                 $blog->setPublic(postVar('public'));
2486                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2487                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2488                 $blog->setDefaultCategory(intPostVar('defcat'));
2489                 $blog->setSearchable(intPostVar('searchable'));
2490                 $blog->setEmailRequired(intPostVar('reqemail'));
2491                 $blog->writeSettings();
2492
2493                 // store plugin options
2494                 $aOptions = requestArray('plugoption');
2495                 NucleusPlugin::apply_plugin_options($aOptions);
2496
2497                 $data = array(
2498                         'context' => 'blog',
2499                         'blogid'  => $blogid,
2500                         'blog'    => &$blog
2501                 );
2502                 $manager->notify('PostPluginOptionsUpdate', $data);
2503
2504                 self::action_overview(_MSG_SETTINGSCHANGED);
2505                 return;
2506         }
2507
2508         /**
2509          * Admin::action_deleteblog()
2510          *
2511          * @param       void
2512          * @return      void
2513          */
2514         static private function action_deleteblog()
2515         {
2516                 global $member, $CONF, $manager;
2517
2518                 $blogid = intRequestVar('blogid');
2519
2520                 $member->blogAdminRights($blogid) or self::disallow();
2521
2522                 // check if blog is default blog
2523                 if ( $CONF['DefaultBlog'] == $blogid )
2524                 {
2525                         self::error(_ERROR_DELDEFBLOG);
2526                         return;
2527                 }
2528
2529                 $blog =& $manager->getBlog($blogid);
2530
2531                 self::$skin->parse('deleteblog');
2532                 return;
2533         }
2534
2535         /**
2536          * Admin::action_deleteblogconfirm()
2537          * Delete Blog
2538          *
2539          * @param       Void
2540          * @return      Void
2541          */
2542         static private function action_deleteblogconfirm()
2543         {
2544                 global $member, $CONF, $manager;
2545
2546                 $blogid = intRequestVar('blogid');
2547
2548                 $data = array('blogid' => $blogid);
2549                 $manager->notify('PreDeleteBlog', $data);
2550
2551                 $member->blogAdminRights($blogid) or self::disallow();
2552
2553                 // check if blog is default blog
2554                 if ( $CONF['DefaultBlog'] == $blogid )
2555                 {
2556                         self::error(_ERROR_DELDEFBLOG);
2557                         return;
2558                 }
2559
2560                 // delete all comments
2561                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;
2562                 DB::execute($query);
2563
2564                 // delete all items
2565                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;
2566                 DB::execute($query);
2567
2568                 // delete all team members
2569                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;
2570                 DB::execute($query);
2571
2572                 // delete all bans
2573                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;
2574                 DB::execute($query);
2575
2576                 // delete all categories
2577                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;
2578                 DB::execute($query);
2579
2580                 // delete all associated plugin options
2581                 NucleusPlugin::delete_option_values('blog', $blogid);
2582
2583                 // delete the blog itself
2584                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;
2585                 DB::execute($query);
2586
2587                 $data = array('blogid' => $blogid);
2588                 $manager->notify('PostDeleteBlog', $data);
2589
2590                 self::action_overview(_DELETED_BLOG);
2591                 return;
2592         }
2593
2594         /**
2595          * Admin::action_memberdelete()
2596          *
2597          * @param       void
2598          * @return      void
2599          */
2600         static private function action_memberdelete()
2601         {
2602                 global $member, $manager;
2603
2604                 $memberid = intRequestVar('memberid');
2605
2606                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2607
2608                 $mem =& $manager->getMember($memberid);
2609
2610                 self::$skin->parse('memberdelete');
2611                 return;
2612         }
2613
2614         /**
2615          * Admin::action_memberdeleteconfirm()
2616          *
2617          * @param       void
2618          * @return      void
2619          */
2620         static private function action_memberdeleteconfirm()
2621         {
2622                 global $member;
2623
2624                 $memberid = intRequestVar('memberid');
2625
2626                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2627
2628                 $error = self::deleteOneMember($memberid);
2629                 if ( $error )
2630                 {
2631                         self::error($error);
2632                         return;
2633                 }
2634
2635                 if ( $member->isAdmin() )
2636                 {
2637                         self::action_usermanagement();
2638                         return;
2639                 }
2640                 else
2641                 {
2642                         self::action_overview(_DELETED_MEMBER);
2643                         return;
2644                 }
2645                 return;
2646         }
2647
2648         /**
2649          * Admin::deleteOneMember()
2650          * Delete a member by id
2651          *
2652          * @static
2653          * @params      Integer $memberid       member id
2654          * @return      String  null string or error messages
2655          */
2656         static public function deleteOneMember($memberid)
2657         {
2658                 global $manager;
2659
2660                 $memberid = intval($memberid);
2661                 $mem =& $manager->getMember($memberid);
2662
2663                 if ( !$mem->canBeDeleted() )
2664                 {
2665                         return _ERROR_DELETEMEMBER;
2666                 }
2667
2668                 $data = array('member' => &$mem);
2669                 $manager->notify('PreDeleteMember', $data);
2670
2671                 /* unlink comments from memberid */
2672                 if ( $memberid )
2673                 {
2674                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";
2675                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);
2676                         DB::execute($query);
2677                 }
2678
2679                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;
2680                 DB::execute($query);
2681
2682                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;
2683                 DB::execute($query);
2684
2685                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;
2686                 DB::execute($query);
2687
2688                 // delete all associated plugin options
2689                 NucleusPlugin::delete_option_values('member', $memberid);
2690
2691                 $data = array('member' => &$mem);
2692                 $manager->notify('PostDeleteMember', $data);
2693
2694                 return '';
2695         }
2696
2697         /**
2698          * Admin::action_createnewlog()
2699          *
2700          * @param       void
2701          * @return      void
2702          */
2703         static private function action_createnewlog()
2704         {
2705                 global $member, $CONF, $manager;
2706
2707                 // Only Super-Admins can do this
2708                 $member->isAdmin() or self::disallow();
2709
2710                 self::$skin->parse('createnewlog');
2711                 return;
2712         }
2713
2714         /**
2715          * Admin::action_addnewlog()
2716          *
2717          * @param       void
2718          * @return      void
2719          */
2720         static private function action_addnewlog()
2721         {
2722                 global $member, $manager, $CONF;
2723
2724                 // Only Super-Admins can do this
2725                 $member->isAdmin() or self::disallow();
2726
2727                 $bname                  = trim(postVar('name'));
2728                 $bshortname             = trim(postVar('shortname'));
2729                 $btimeoffset    = postVar('timeoffset');
2730                 $bdesc                  = trim(postVar('desc'));
2731                 $bdefskin               = postVar('defskin');
2732
2733                 if ( !isValidShortName($bshortname) )
2734                 {
2735                         self::error(_ERROR_BADSHORTBLOGNAME);
2736                         return;
2737                 }
2738
2739                 if ( $manager->existsBlog($bshortname) )
2740                 {
2741                         self::error(_ERROR_DUPSHORTBLOGNAME);
2742                         return;
2743                 }
2744
2745                 $data = array(
2746                         'name'        => &$bname,
2747                         'shortname'   => &$bshortname,
2748                         'timeoffset'  => &$btimeoffset,
2749                         'description' => &$bdesc,
2750                         'defaultskin' => &$bdefskin
2751                 );
2752                 $manager->notify('PreAddBlog', $data);
2753
2754                 // add slashes for sql queries
2755                 $bname                  = DB::quoteValue($bname);
2756                 $bshortname             = DB::quoteValue($bshortname);
2757                 $btimeoffset    = DB::quoteValue($btimeoffset);
2758                 $bdesc                  = DB::quoteValue($bdesc);
2759                 $bdefskin               = DB::quoteValue($bdefskin);
2760
2761                 // create blog
2762                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";
2763                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);
2764                 DB::execute($query);
2765
2766                 $blogid = DB::getInsertId();
2767                 $blog   =& $manager->getBlog($blogid);
2768
2769                 // create new category
2770                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);
2771                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);
2772
2773                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';
2774                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));
2775                 $catid = DB::getInsertId();
2776
2777                 // set as default category
2778                 $blog->setDefaultCategory($catid);
2779                 $blog->writeSettings();
2780
2781                 // create team member
2782                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";
2783                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);
2784                 DB::execute($query);
2785
2786                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
2787                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');
2788
2789                 $blog->additem(
2790                         $blog->getDefaultCategory(),
2791                         $itemdeftitle,$itemdefbody,
2792                         '',
2793                         $blogid,
2794                         $member->getID(),
2795                         $blog->getCorrectTime(),
2796                         0,
2797                         0,
2798                         0
2799                 );
2800
2801                 $data = array('blog' => &$blog);
2802                 $manager->notify('PostAddBlog', $data);
2803
2804                 $data = array(
2805                         'blog'                  => &$blog,
2806                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,
2807                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,
2808                         'catid'                 => $catid
2809                 );
2810                 $manager->notify('PostAddCategory', $data);
2811
2812                 /* TODO: we should consider to use the other way insterad of this */
2813                 $_REQUEST['blogid'] = $blogid;
2814                 $_REQUEST['catid']  = $catid;
2815                 self::$skin->parse('addnewlog');
2816                 return;
2817         }
2818
2819         /**
2820          * Admin::action_addnewlog2()
2821          *
2822          * @param       void
2823          * @return      void
2824          */
2825         static private function action_addnewlog2()
2826         {
2827                 global $member, $manager;
2828                 $blogid = intRequestVar('blogid');
2829
2830                 $member->blogAdminRights($blogid) or self::disallow();
2831
2832                 $burl = requestVar('url');
2833
2834                 $blog =& $manager->getBlog($blogid);
2835                 $blog->setURL(trim($burl));
2836                 $blog->writeSettings();
2837
2838                 self::action_overview(_MSG_NEWBLOG);
2839                 return;
2840         }
2841
2842         /**
2843          * Admin::action_skinieoverview()
2844          *
2845          * @param       void
2846          * @return      void
2847          */
2848         static private function action_skinieoverview()
2849         {
2850                 global $member, $DIR_LIBS, $manager;
2851
2852                 $member->isAdmin() or self::disallow();
2853
2854                 include_once($DIR_LIBS . 'skinie.php');
2855
2856                 self::$skin->parse('skinieoverview');
2857                 return;
2858         }
2859
2860         /**
2861          * Admin::action_skinieimport()
2862          *
2863          * @param       void
2864          * @return      void
2865          */
2866         static private function action_skinieimport()
2867         {
2868                 global $member;
2869
2870                 $member->isAdmin() or self::disallow();
2871
2872                 $skinFileRaw = postVar('skinfile');
2873                 $mode = postVar('mode');
2874
2875                 $error = self::skinieimport($mode, $skinFileRaw);
2876                 if ( $error )
2877                 {
2878                         self::error($error);
2879                         return;
2880                 }
2881
2882                 self::$skin->parse('skinieimport');
2883                 return;
2884         }
2885
2886         /**
2887          * Admin::action_skiniedoimport()
2888          *
2889          * @param       void
2890          * @return      void
2891          */
2892         static private function action_skiniedoimport()
2893         {
2894                 global $member, $DIR_LIBS, $DIR_SKINS;
2895
2896                 $member->isAdmin() or self::disallow();
2897
2898                 // load skinie class
2899                 include_once($DIR_LIBS . 'skinie.php');
2900
2901                 $mode = postVar('mode');
2902                 $skinFileRaw = postVar('skinfile');
2903                 $allowOverwrite = intPostVar('overwrite');
2904
2905                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
2906                 if ( $error )
2907                 {
2908                         self::error($msg);
2909                         return;
2910                 }
2911
2912                 self::$skin->parse('skiniedoimport');
2913                 return;
2914         }
2915
2916         /**
2917          * Admin::action_skinieexport()
2918          *
2919          * @param       void
2920          * @return      void
2921          */
2922         static private function action_skinieexport()
2923         {
2924                 global $member;
2925
2926                 $member->isAdmin() or self::disallow();
2927
2928                 $aSkins = requestIntArray('skin');
2929                 $aTemplates = requestIntArray('template');
2930                 $info = postVar('info');
2931
2932                 self::skinieexport($aSkins, $aTemplates, $info);
2933
2934                 return;
2935         }
2936
2937         /**
2938          * Admin::action_templateoverview()
2939          *
2940          * @param       void
2941          * @return      void
2942          */
2943         static private function action_templateoverview()
2944         {
2945                 global $member, $manager;
2946
2947                 $member->isAdmin() or self::disallow();
2948
2949                 self::$skin->parse('templateoverview');
2950                 return;
2951         }
2952
2953         /**
2954          * Admin::action_templateedit()
2955          *
2956          * @param       string  $msg    message for pageheader
2957          * @return      void
2958          */
2959         static private function action_templateedit($msg = '')
2960         {
2961                 global $member, $manager;
2962                 if ( $msg )
2963                 {
2964                         self::$headMess = $msg;
2965                 }
2966
2967                 $templateid = intRequestVar('templateid');
2968
2969                 $member->isAdmin() or self::disallow();
2970
2971                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/templateEdit.js)%>\"></script>\n";
2972                 self::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";
2973
2974                 self::$skin->parse('templateedit');
2975                 return;
2976         }
2977
2978         /**
2979          * Admin::action_templateupdate()
2980          *
2981          * @param       void
2982          * @return      void
2983          */
2984         static private function action_templateupdate()
2985         {
2986                 global $member,$manager;
2987
2988                 $templateid = intRequestVar('templateid');
2989
2990                 $member->isAdmin() or self::disallow();
2991
2992                 $name = postVar('tname');
2993                 $desc = postVar('tdesc');
2994
2995                 if ( !isValidTemplateName($name) )
2996                 {
2997                         self::error(_ERROR_BADTEMPLATENAME);
2998                         return;
2999                 }
3000
3001                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3002                 {
3003                         self::error(_ERROR_DUPTEMPLATENAME);
3004                         return;
3005                 }
3006
3007                 // 1. Remove all template parts
3008                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3009                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3010                 DB::execute($query);
3011
3012                 // 2. Update description
3013                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3014                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3015                 DB::execute($query);
3016
3017                 // 3. Add non-empty template parts
3018                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));
3019                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));
3020                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));
3021                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));
3022                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));
3023                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));
3024                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));
3025                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));
3026                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));
3027                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));
3028                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));
3029                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));
3030                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));
3031                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));
3032                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));
3033                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));
3034                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3035                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));
3036                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));
3037                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));
3038                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));
3039                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));
3040                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));
3041                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));
3042                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));
3043                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));
3044                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));
3045                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));
3046                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));
3047                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3048                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));
3049                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));
3050                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));
3051
3052                 $data = array('fields' => array());
3053                 $manager->notify('TemplateExtraFields', $data);
3054                 foreach ( $data['fields'] as $pfkey=>$pfvalue )
3055                 {
3056                         foreach ( $pfvalue as $pffield => $pfdesc )
3057                         {
3058                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3059                         }
3060                 }
3061
3062                 // jump back to template edit
3063                 self::action_templateedit(_TEMPLATE_UPDATED);
3064                 return;
3065         }
3066
3067         /**
3068          * Admin::addToTemplate()
3069          *
3070          * @param       Integer $id     ID for template
3071          * @param       String  $partname       parts name
3072          * @param       String  $content        template contents
3073          * @return      Integer record index
3074          *
3075          */
3076         static private function addToTemplate($id, $partname, $content)
3077         {
3078                 // don't add empty parts:
3079                 if ( !trim($content) )
3080                 {
3081                         return -1;
3082                 }
3083
3084                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";
3085                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));
3086                 if ( DB::execute($query) === FALSE )
3087                 {
3088                         $err = DB::getError();
3089                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
3090                 }
3091                 return DB::getInsertId();
3092         }
3093
3094         /**
3095          * Admin::action_templatedelete()
3096          *
3097          * @param       void
3098          * @return      void
3099          */
3100         static private function action_templatedelete()
3101         {
3102                 global $member, $manager;
3103
3104                 $member->isAdmin() or self::disallow();
3105
3106                 $templateid = intRequestVar('templateid');
3107                 // TODO: check if template can be deleted
3108
3109                 self::$skin->parse('templatedelete');
3110                 return;
3111         }
3112
3113         /**
3114          * Admin::action_templatedeleteconfirm()
3115          *
3116          * @param       void
3117          * @return      void
3118          */
3119         static private function action_templatedeleteconfirm()
3120         {
3121                 global $member, $manager;
3122
3123                 $templateid = intRequestVar('templateid');
3124
3125                 $member->isAdmin() or self::disallow();
3126
3127                 $data = array('templateid' => $templateid);
3128                 $manager->notify('PreDeleteTemplate', $data);
3129
3130                 // 1. delete description
3131                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);
3132
3133                 // 2. delete parts
3134                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);
3135
3136
3137                 $data = array('templateid' => $templateid);
3138                 $manager->notify('PostDeleteTemplate', $data);
3139
3140                 self::action_templateoverview();
3141                 return;
3142         }
3143
3144         /**
3145          * Admin::action_templatenew()
3146          *
3147          * @param       void
3148          * @return      void
3149          */
3150         static private function action_templatenew()
3151         {
3152                 global $member;
3153
3154                 $member->isAdmin() or self::disallow();
3155
3156                 $name = postVar('name');
3157                 $desc = postVar('desc');
3158
3159                 if ( !isValidTemplateName($name) )
3160                 {
3161                         self::error(_ERROR_BADTEMPLATENAME);
3162                         return;
3163                 }
3164
3165                 if ( Template::exists($name) )
3166                 {
3167                         self::error(_ERROR_DUPTEMPLATENAME);
3168                         return;
3169                 }
3170
3171                 $newTemplateId = Template::createNew($name, $desc);
3172
3173                 self::action_templateoverview();
3174                 return;
3175         }
3176
3177         /**
3178          * Admin::action_templateclone()
3179          *
3180          * @param       void
3181          * @return      void
3182          */
3183         static private function action_templateclone()
3184         {
3185                 global $member;
3186
3187                 $templateid = intRequestVar('templateid');
3188
3189                 $member->isAdmin() or self::disallow();
3190
3191                 // 1. read old template
3192                 $name = Template::getNameFromId($templateid);
3193                 $desc = Template::getDesc($templateid);
3194
3195                 // 2. create desc thing
3196                 $name = "cloned" . $name;
3197
3198                 // if a template with that name already exists:
3199                 if ( Template::exists($name) )
3200                 {
3201                         $i = 1;
3202                         while (Template::exists($name . $i))
3203                         {
3204                                 $i++;
3205                         }
3206                         $name .= $i;
3207                 }
3208
3209                 $newid = Template::createNew($name, $desc);
3210
3211                 // 3. create clone
3212                 // go through parts of old template and add them to the new one
3213                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3214                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3215
3216                 $res = DB::getResult($query);
3217                 foreach ( $res as $row)
3218                 {
3219                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3220                 }
3221
3222                 self::action_templateoverview();
3223                 return;
3224         }
3225
3226         /**
3227          * Admin::action_admintemplateoverview()
3228          *
3229          * @param       void
3230          * @return      void
3231          */
3232         static private function action_admintemplateoverview()
3233         {
3234                 global $member;
3235                 $member->isAdmin() or self::disallow();
3236                 self::$skin->parse('admntemplateoverview');
3237                 return;
3238         }
3239
3240         /**
3241          * Admin::action_admintemplateedit()
3242          *
3243          * @param       string  $msg    message for pageheader
3244          * @return      void
3245          */
3246         static private function action_admintemplateedit($msg = '')
3247         {
3248                 global $member, $manager;
3249                 if ( $msg )
3250                 {
3251                         self::$headMess = $msg;
3252                 }
3253                 $member->isAdmin() or self::disallow();
3254
3255                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/templateEdit.js)%>\"></script>\n";
3256                 self::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";
3257
3258                 self::$skin->parse('admintemplateedit');
3259                 return;
3260         }
3261
3262         /**
3263          * Admin::action_admintemplateupdate()
3264          *
3265          * @param       void
3266          * @return      void
3267          */
3268         static private function action_admintemplateupdate()
3269         {
3270                 global $member, $manager;
3271                 $templateid = intRequestVar('templateid');
3272                 $member->isAdmin() or self::disallow();
3273                 $name = postVar('tname');
3274                 $desc = postVar('tdesc');
3275
3276                 if ( !isValidTemplateName($name) )
3277                 {
3278                         self::error(_ERROR_BADTEMPLATENAME);
3279                         return;
3280                 }
3281
3282                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3283                 {
3284                         self::error(_ERROR_DUPTEMPLATENAME);
3285                         return;
3286                 }
3287
3288                 // 1. Remove all template parts
3289                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3290                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3291                 DB::execute($query);
3292
3293                 // 2. Update description
3294                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3295                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3296                 DB::execute($query);
3297
3298                 // 3. Add non-empty template parts
3299                 self::addToTemplate($templateid, 'NORMALSKINLIST_HEAD',                                         postVar('NORMALSKINLIST_HEAD'));
3300                 self::addToTemplate($templateid, 'NORMALSKINLIST_BODY',                                         postVar('NORMALSKINLIST_BODY'));
3301                 self::addToTemplate($templateid, 'NORMALSKINLIST_FOOT',                                         postVar('NORMALSKINLIST_FOOT'));
3302                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                           postVar('ADMIN_CUSTOMHELPLINK_ICON'));
3303                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                         postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));
3304                 self::addToTemplate($templateid, 'ADMIN_BLOGLINK',                                                      postVar('ADMIN_BLOGLINK'));
3305                 self::addToTemplate($templateid, 'ADMIN_BATCHLIST',                                                     postVar('ADMIN_BATCHLIST'));
3306                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                       postVar('ACTIVATE_FORGOT_TITLE'));
3307                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                        postVar('ACTIVATE_FORGOT_TEXT'));
3308                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                     postVar('ACTIVATE_REGISTER_TITLE'));
3309                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                      postVar('ACTIVATE_REGISTER_TEXT'));
3310                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                       postVar('ACTIVATE_CHANGE_TITLE'));
3311                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                        postVar('ACTIVATE_CHANGE_TEXT'));
3312                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                            postVar('TEMPLATE_EDIT_EXPLUGNAME'));
3313                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                      postVar('TEMPLATE_EDIT_ROW_HEAD'));
3314                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                      postVar('TEMPLATE_EDIT_ROW_TAIL'));
3315                 self::addToTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                        postVar('SPECIALSKINLIST_HEAD'));
3316                 self::addToTemplate($templateid, 'SPECIALSKINLIST_BODY',                                        postVar('SPECIALSKINLIST_BODY'));
3317                 self::addToTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                        postVar('SPECIALSKINLIST_FOOT'));
3318                 self::addToTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                       postVar('SYSTEMINFO_GDSETTINGS'));
3319                 self::addToTemplate($templateid, 'BANLIST_DELETED_LIST',                                        postVar('BANLIST_DELETED_LIST'));
3320                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                     postVar('INSERT_PLUGOPTION_TITLE'));
3321                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                      postVar('INSERT_PLUGOPTION_BODY'));
3322                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                           postVar('INPUTYESNO_TEMPLATE_ADMIN'));
3323                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                          postVar('INPUTYESNO_TEMPLATE_NORMAL'));
3324                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                          postVar('ADMIN_SPECIALSKINLIST_HEAD'));
3325                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                          postVar('ADMIN_SPECIALSKINLIST_BODY'));
3326                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                          postVar('ADMIN_SPECIALSKINLIST_FOOT'));
3327                 self::addToTemplate($templateid, 'SKINIE_EXPORT_LIST',                                          postVar('SKINIE_EXPORT_LIST'));
3328                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                       postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));
3329                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                       postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));
3330                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                       postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));
3331                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                        postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));
3332                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                        postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));
3333                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                        postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));
3334                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));
3335                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));
3336                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));
3337                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));
3338                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));
3339                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));
3340                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));
3341                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));
3342                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));
3343                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));
3344                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));
3345                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));
3346                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));
3347                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));
3348                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));
3349                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));
3350                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));
3351                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));
3352                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));
3353                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));
3354                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));
3355                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));
3356                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));
3357                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));
3358                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));
3359                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));
3360                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));
3361                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));
3362                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));
3363                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));
3364                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));
3365                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));
3366                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));
3367                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));
3368                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));
3369                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));
3370                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));
3371                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));
3372                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));
3373                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));
3374                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));
3375                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));
3376                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));
3377                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));
3378                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));
3379                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));
3380                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));
3381                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));
3382                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));
3383                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));
3384                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));
3385                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));
3386                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));
3387                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));
3388                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));
3389                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));
3390                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));
3391                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));
3392                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));
3393                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));
3394                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));
3395                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));
3396                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));
3397                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));
3398                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));
3399                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));
3400                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_NAVILIST',            postVar('SHOWLIST_LISTPLUG_TABLE_NAVILIST'));
3401                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                      postVar('PLUGIN_QUICKMENU_TITLE'));
3402                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                       postVar('PLUGIN_QUICKMENU_HEAD'));
3403                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                       postVar('PLUGIN_QUICKMENU_BODY'));
3404                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                       postVar('PLUGIN_QUICKMENU_FOOT'));
3405
3406                 $data = array('fields' => array());
3407                 $manager->notify('AdminTemplateExtraFields', $data);
3408                 foreach ( $data['fields'] as $pfkey => $pfvalue )
3409                 {
3410                         foreach ( $pfvalue as $pffield => $pfdesc )
3411                         {
3412                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3413                         }
3414                 }
3415
3416                 // jump back to template edit
3417                 self::action_admintemplateedit(_TEMPLATE_UPDATED);
3418                 return;
3419         }
3420
3421         /**
3422          * Admin::action_admintemplatedelete()
3423          *
3424          * @param       void
3425          * @return      void
3426          */
3427         static private function action_admintemplatedelete()
3428         {
3429                 global $member, $manager;
3430                 $member->isAdmin() or self::disallow();
3431
3432                 // TODO: check if template can be deleted
3433                 self::$skin->parse('admintemplatedelete');
3434                 return;
3435         }
3436
3437         /**
3438          * Admin::action_admintemplatedeleteconfirm()
3439          *
3440          * @param       void
3441          * @return      void
3442          */
3443         static private function action_admintemplatedeleteconfirm()
3444         {
3445                 global $member, $manager;
3446
3447                 $templateid = intRequestVar('templateid');
3448                 $member->isAdmin() or self::disallow();
3449
3450                 $data = array('templateid' => $templateid);
3451                 $manager->notify('PreDeleteAdminTemplate', $data);
3452
3453                 // 1. delete description
3454                 $query = "DELETE FROM %s WHERE tdnumber=%s;";
3455                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);
3456                 DB::execute($query);
3457
3458                 // 2. delete parts
3459                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3460                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3461                 DB::execute($query);
3462
3463                 $data = array('templateid' => $templateid);
3464                 $manager->notify('PostDeleteAdminTemplate', $data);
3465
3466                 self::action_admintemplateoverview();
3467                 return;
3468         }
3469
3470         /**
3471          * Admin::action_admintemplatenew()
3472          *
3473          * @param       void
3474          * @return      void
3475          */
3476         static private function action_admintemplatenew()
3477         {
3478                 global $member;
3479                 $member->isAdmin() or self::disallow();
3480                 $name = postVar('name');
3481                 $desc = postVar('desc');
3482
3483                 if ( !isValidTemplateName($name) )
3484                 {
3485                         self::error(_ERROR_BADTEMPLATENAME);
3486                         return;
3487                 }
3488                 else if ( !preg_match('#^admin/#', $name) )
3489                 {
3490                         self::error(_ERROR_BADADMINTEMPLATENAME);
3491                         return;
3492                 }
3493                 else if ( Template::exists($name) )
3494                 {
3495                         self::error(_ERROR_DUPTEMPLATENAME);
3496                         return;
3497                 }
3498
3499                 $newTemplateId = Template::createNew($name, $desc);
3500                 self::action_admintemplateoverview();
3501                 return;
3502         }
3503
3504         /**
3505          * Admin::action_admintemplateclone()
3506          *
3507          * @param       void
3508          * @return      void
3509          */
3510         static private function action_admintemplateclone()
3511         {
3512                 global $member;
3513                 $templateid = intRequestVar('templateid');
3514                 $member->isAdmin() or self::disallow();
3515
3516                 // 1. read old template
3517                 $name = Template::getNameFromId($templateid);
3518                 $desc = Template::getDesc($templateid);
3519
3520                 // 2. create desc thing
3521                 $name = $name . "cloned";
3522
3523                 // if a template with that name already exists:
3524                 if ( Template::exists($name) )
3525                 {
3526                         $i = 1;
3527                         while ( Template::exists($name . $i) )
3528                         {
3529                                 $i++;
3530                         }
3531                         $name .= $i;
3532                 }
3533
3534                 $newid = Template::createNew($name, $desc);
3535
3536                 // 3. create clone
3537                 // go through parts of old template and add them to the new one
3538                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3539                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3540
3541                 $res = DB::getResult($query);
3542                 foreach ( $res as $row )
3543                 {
3544                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3545                 }
3546
3547                 self::action_admintemplateoverview();
3548                 return;
3549         }
3550
3551         /**
3552          * Admin::action_skinoverview()
3553          *
3554          * @param       void
3555          * @return      void
3556          */
3557         static private function action_skinoverview()
3558         {
3559                 global $member, $manager;
3560
3561                 $member->isAdmin() or self::disallow();
3562
3563                 self::$skin->parse('skinoverview');
3564                 return;
3565         }
3566
3567         /**
3568          * Admin::action_skinnew()
3569          *
3570          * @param       void
3571          * @return      void
3572          */
3573         static private function action_skinnew()
3574         {
3575                 global $member;
3576
3577                 $member->isAdmin() or self::disallow();
3578
3579                 $name = trim(postVar('name'));
3580                 $desc = trim(postVar('desc'));
3581
3582                 if ( !isValidSkinName($name) )
3583                 {
3584                         self::error(_ERROR_BADSKINNAME);
3585                         return;
3586                 }
3587                 else if ( SKIN::exists($name) )
3588                 {
3589                         self::error(_ERROR_DUPSKINNAME);
3590                         return;
3591                 }
3592
3593                 SKIN::createNew($name, $desc);
3594
3595                 self::action_skinoverview();
3596                 return;
3597         }
3598
3599         /**
3600          * Admin::action_skinedit()
3601          *
3602          * @param       void
3603          * @return      void
3604          */
3605         static private function action_skinedit()
3606         {
3607                 global $member;
3608
3609                 $member->isAdmin() or self::disallow();
3610
3611                 self::$skin->parse('skinedit');
3612                 return;
3613         }
3614
3615         /**
3616          * Admin::action_skineditgeneral()
3617          *
3618          * @param       void
3619          * @return      void
3620          */
3621         static private function action_skineditgeneral()
3622         {
3623                 global $member;
3624
3625                 $skinid = intRequestVar('skinid');
3626
3627                 $member->isAdmin() or self::disallow();
3628
3629                 $error = self::skineditgeneral($skinid);
3630                 if ( $error )
3631                 {
3632                         self::error($error);
3633                         return;
3634                 }
3635
3636                 self::action_skinedit();
3637                 return;
3638         }
3639
3640         static private function action_skinedittype($msg = '')
3641         {
3642                 global $member;
3643
3644                 $member->isAdmin() or self::disallow();
3645
3646                 if ( $msg )
3647                 {
3648                         self::$headMess = $msg;
3649                 }
3650
3651                 $type = requestVar('type');
3652                 $type = trim($type);
3653                 $type = strtolower($type);
3654
3655                 if ( !isValidShortName($type) )
3656                 {
3657                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3658                         return;
3659                 }
3660
3661                 self::$skin->parse('skinedittype');
3662                 return;
3663         }
3664
3665         /**
3666          * Admin::action_skinupdate()
3667          *
3668          * @param       void
3669          * @return      void
3670          */
3671         static private function action_skinupdate()
3672         {
3673                 global $manager, $member;
3674
3675                 $skinid = intRequestVar('skinid');
3676                 $content = trim(postVar('content'));
3677                 $type = postVar('type');
3678
3679                 $member->isAdmin() or self::disallow();
3680
3681                 $skin =& $manager->getSKIN($skinid);
3682                 $skin->update($type, $content);
3683
3684                 self::action_skinedittype(_SKIN_UPDATED);
3685                 return;
3686         }
3687
3688         /**
3689          * Admin::action_skindelete()
3690          *
3691          * @param       void
3692          * @return      void
3693          */
3694         static private function action_skindelete()
3695         {
3696                 global $CONF, $member;
3697
3698                 $member->isAdmin() or self::disallow();
3699
3700                 $skinid = intRequestVar('skinid');
3701
3702                 // don't allow default skin to be deleted
3703                 if ( $skinid == $CONF['BaseSkin'] )
3704                 {
3705                         self::error(_ERROR_DEFAULTSKIN);
3706                         return;
3707                 }
3708
3709                 // don't allow deletion of default skins for blogs
3710                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";
3711                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3712
3713                 $name = DB::getValue($query);
3714                 if ( $name )
3715                 {
3716                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3717                         return;
3718                 }
3719
3720                 self::$skin->parse('skindelete');
3721                 return;
3722         }
3723
3724         /**
3725          * Admin::action_skindeleteconfirm()
3726          *
3727          * @param       void
3728          * @return      void
3729          */
3730         static private function action_skindeleteconfirm()
3731         {
3732                 global $member, $CONF;
3733
3734                 $member->isAdmin() or self::disallow();
3735
3736                 $skinid = intRequestVar('skinid');
3737
3738                 // don't allow default skin to be deleted
3739                 if ( $skinid == $CONF['BaseSkin'] )
3740                 {
3741                         self::error(_ERROR_DEFAULTSKIN);
3742                         return;
3743                 }
3744
3745                 // don't allow deletion of default skins for blogs
3746                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";
3747                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3748
3749                 $name = DB::getValue($query);
3750                 if ( $name )
3751                                 {
3752                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3753                         return;
3754                 }
3755
3756                 self::skindeleteconfirm($skinid);
3757
3758                 self::action_skinoverview();
3759                 return;
3760         }
3761
3762         /**
3763          * Admin::action_skinremovetype()
3764          *
3765          * @param       void
3766          * @return      void
3767          */
3768         static private function action_skinremovetype()
3769         {
3770                 global $member, $CONF;
3771
3772                 $member->isAdmin() or self::disallow();
3773
3774                 $skinid = intRequestVar('skinid');
3775                 $skintype = requestVar('type');
3776
3777                 if ( !isValidShortName($skintype) )
3778                 {
3779                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
3780                         return;
3781                 }
3782
3783                 self::$skin->parse('skinremovetype');
3784                 return;
3785         }
3786
3787         /**
3788          * Admin::action_skinremovetypeconfirm()
3789          *
3790          * @param       void
3791          * @return      void
3792          */
3793         static private function action_skinremovetypeconfirm()
3794         {
3795                 global $member;
3796
3797                 $member->isAdmin() or self::disallow();
3798
3799                 $skinid = intRequestVar('skinid');
3800                 $skintype = requestVar('type');
3801
3802                 $error = self::skinremovetypeconfirm($skinid, $skintype);
3803                 if ( $error )
3804                 {
3805                         self::error($error);
3806                         return;
3807                 }
3808
3809                 self::action_skinedit();
3810                 return;
3811         }
3812
3813         /**
3814          * Admin::action_skinclone()
3815          *
3816          * @param       void
3817          * @return      void
3818          */
3819         static private function action_skinclone()
3820         {
3821                 global $member;
3822
3823                 $member->isAdmin() or self::disallow();
3824
3825                 $skinid = intRequestVar('skinid');
3826
3827                 self::skinclone($skinid);
3828
3829                 self::action_skinoverview();
3830                 return;
3831         }
3832
3833         /**
3834          * Admin::action_adminskinoverview()
3835          *
3836          * @param       void
3837          * @return      void
3838          */
3839         static private function action_adminskinoverview()
3840         {
3841                 global $member;
3842
3843                 $member->isAdmin() or self::disallow();
3844
3845                 self::$skin->parse('adminskinoverview');
3846                 return;
3847         }
3848
3849         /**
3850          * Admin::action_adminskinnew()
3851          *
3852          * @param       void
3853          * @return      void
3854          */
3855         static private function action_adminskinnew()
3856         {
3857                 global $member;
3858
3859                 $member->isAdmin() or self::disallow();
3860
3861                 $name = trim(postVar('name'));
3862                 $desc = trim(postVar('desc'));
3863
3864                 if ( !isValidSkinName($name) )
3865                 {
3866                         self::error(_ERROR_BADSKINNAME);
3867                         return;
3868                 }
3869                 else if ( !preg_match('#^admin/#', $name) )
3870                 {
3871                         self::error(_ERROR_BADADMINSKINNAME);
3872                         return;
3873                 }
3874                 else if ( Skin::exists($name) )
3875                 {
3876                         self::error(_ERROR_DUPSKINNAME);
3877                         return;
3878                 }
3879
3880                 Skin::createNew($name, $desc);
3881
3882                 self::action_adminskinoverview();
3883                 return;
3884         }
3885
3886         /**
3887          * Admin::action_adminskinedit()
3888          *
3889          * @param       void
3890          * @return      void
3891          */
3892         static private function action_adminskinedit()
3893         {
3894                 global $member;
3895
3896                 $member->isAdmin() or self::disallow();
3897
3898                 self::$skin->parse('adminskinedit');
3899
3900                 return;
3901         }
3902
3903         /**
3904          * Admin::action_adminskineditgeneral()
3905          *
3906          * @param       void
3907          * @return      void
3908          */
3909         static private function action_adminskineditgeneral()
3910         {
3911                 global $member;
3912
3913                 $skinid = intRequestVar('skinid');
3914
3915                 $member->isAdmin() or self::disallow();
3916
3917                 $error = self::skineditgeneral($skinid, 'AdminActions');
3918                 if ( $error )
3919                 {
3920                         self::error($error);
3921                         return;
3922                 }
3923
3924                 self::action_adminskinedit();
3925                 return;
3926         }
3927
3928         /**
3929          * Admin::action_adminskinedittype()
3930          *
3931          * @param       string  $msg    message for pageheader
3932          * @return      void
3933          */
3934         static private function action_adminskinedittype($msg = '')
3935         {
3936                 global $member;
3937
3938                 $member->isAdmin() or self::disallow();
3939
3940                 if ( $msg )
3941                 {
3942                         self::$headMess = $msg;
3943                 }
3944                 $type = requestVar('type');
3945                 $type = trim($type);
3946                 $type = strtolower($type);
3947
3948                 if ( !isValidShortName($type) )
3949                 {
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3951                         return;
3952                 }
3953
3954                 self::$skin->parse('adminskinedittype');
3955                 return;
3956         }
3957
3958         /**
3959          * Admin::action_adminskinupdate()
3960          *
3961          * @param       void
3962          * @return      void
3963          */
3964         static private function action_adminskinupdate()
3965         {
3966                 global $manager, $member;
3967
3968                 $skinid = intRequestVar('skinid');
3969                 $content = trim(postVar('content'));
3970                 $type = postVar('type');
3971
3972                 $member->isAdmin() or self::disallow();
3973
3974                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
3975                 $skin->update($type, $content);
3976
3977                 self::action_adminskinedittype(_SKIN_UPDATED);
3978                 return;
3979         }
3980
3981         /**
3982          * Admin::action_adminskindelete()
3983          *
3984          * @param       void
3985          * @return      void
3986          */
3987         static private function action_adminskindelete()
3988         {
3989                 global $CONF, $member;
3990
3991                 $member->isAdmin() or self::disallow();
3992
3993                 $skinid = intRequestVar('skinid');
3994
3995                 // don't allow default skin to be deleted
3996                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
3997                 {
3998                         self::error(_ERROR_DEFAULTSKIN);
3999                         return;
4000                 }
4001
4002                 /* don't allow if someone use it as a default*/
4003                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4004                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4005
4006                 $members = array();
4007                 while ( $row = $res->fetch() ) {
4008                         $members[] = $row['mrealname'];
4009                 }
4010                 if ( count($members) )
4011                 {
4012                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4013                         return;
4014                 }
4015
4016                 self::$skin->parse('adminskindelete');
4017                 return;
4018         }
4019
4020         /**
4021          * Admin::action_adminskindeleteconfirm()
4022          *
4023          * @param       void
4024          * @return      void
4025          */
4026         static private function action_adminskindeleteconfirm()
4027         {
4028                 global $member, $CONF;
4029
4030                 $member->isAdmin() or self::disallow();
4031
4032                 $skinid = intRequestVar('skinid');
4033
4034                 // don't allow default skin to be deleted
4035                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
4036                 {
4037                         self::error(_ERROR_DEFAULTSKIN);
4038                         return;
4039                 }
4040
4041                 /* don't allow if someone use it as a default*/
4042                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4043                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4044
4045                 $members = array();
4046                 while ( $row = $res->fetch() ) {
4047                         $members[] = $row['mrealname'];
4048                 }
4049                 if ( count($members) )
4050                 {
4051                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4052                         return;
4053                 }
4054
4055                 self::skindeleteconfirm($skinid);
4056
4057                 self::action_adminskinoverview();
4058                 return;
4059         }
4060
4061         /**
4062          * Admin::action_adminskinremovetype()
4063          *
4064          * @param       void
4065          * @return      void
4066          */
4067         static private function action_adminskinremovetype()
4068         {
4069                 global $member, $CONF;
4070
4071                 $member->isAdmin() or self::disallow();
4072
4073                 $skinid = intRequestVar('skinid');
4074                 $skintype = requestVar('type');
4075
4076                 if ( !isValidShortName($skintype) )
4077                 {
4078                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4079                         return;
4080                 }
4081
4082                 self::$skin->parse('adminskinremovetype');
4083                 return;
4084         }
4085
4086         /**
4087          * Admin::action_adminskinremovetypeconfirm()
4088          *
4089          * @param       void
4090          * @return      void
4091          */
4092         static private function action_adminskinremovetypeconfirm()
4093         {
4094                 global $member;
4095
4096                 $member->isAdmin() or self::disallow();
4097
4098                 $skinid = intRequestVar('skinid');
4099                 $skintype = requestVar('type');
4100
4101                 $error = self::skinremovetypeconfirm($skinid, $skintype);
4102                 if ( $error )
4103                 {
4104                         self::error($error);
4105                         return;
4106                 }
4107
4108                 self::action_adminskinedit();
4109                 return;
4110         }
4111
4112         /**
4113          * Admin::action_adminskinclone()
4114          *
4115          * @param       void
4116          * @return      void
4117          */
4118         static private function action_adminskinclone()
4119         {
4120                 global $member;
4121
4122                 $member->isAdmin() or self::disallow();
4123
4124                 $skinid = intRequestVar('skinid');
4125
4126                 self::skinclone($skinid, 'AdminActions');
4127
4128                 self::action_adminskinoverview();
4129                 return;
4130         }
4131
4132         /**
4133          * Admin::action_adminskinieoverview()
4134          *
4135          * @param       void
4136          * @return      void
4137          */
4138         static private function action_adminskinieoverview()
4139         {
4140                 global $member;
4141
4142                 $member->isAdmin() or self::disallow();
4143
4144                 self::$skin->parse('adminskinieoverview');
4145                 return;
4146         }
4147
4148         /**
4149          * Admin::action_adminskinieimport()
4150          *
4151          * @param       void
4152          * @return      void
4153          */
4154         static private function action_adminskinieimport()
4155         {
4156                 global $member;
4157
4158                 $member->isAdmin() or self::disallow();
4159
4160                 $skinFileRaw = postVar('skinfile');
4161                 $mode = postVar('mode');
4162
4163                 $error = self::skinieimport($mode, $skinFileRaw);
4164                 if ( $error )
4165                 {
4166                         self::error($error);
4167                         return;
4168                 }
4169
4170                 if ( !is_object(self::$skin) )
4171                 {
4172                         self::action_adminskiniedoimport();
4173                 }
4174                 else
4175                 {
4176                         self::$skin->parse('adminskinieimport');
4177                 }
4178                 return;
4179         }
4180
4181         /**
4182          * Admin::action_adminskiniedoimport()
4183          *
4184          * @param       void
4185          * @return      void
4186          */
4187         static private function action_adminskiniedoimport()
4188         {
4189                 global $DIR_SKINS, $member, $CONF;
4190
4191                 $member->isAdmin() or self::disallow();
4192
4193                 $mode = postVar('mode');
4194                 $skinFileRaw = postVar('skinfile');
4195                 $allowOverwrite = intPostVar('overwrite');
4196
4197                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
4198                 if ( $error )
4199                 {
4200                         self::error($error);
4201                         return;
4202                 }
4203
4204                 if ( !is_object(self::$skin) )
4205                 {
4206                         global $DIR_SKINS;
4207                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";
4208                         $query  = sprintf($query, sql_table('skin_desc'));
4209                         $res    = intval(DB::getValue($query));
4210                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";
4211                         $query  = sprintf($query, sql_table('config'), $res);
4212                         DB::execute($query);
4213                         if ( $res )
4214                         {
4215                                 redirect($CONF['AdminURL']);
4216                                 exit;
4217                         }
4218                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');
4219                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');
4220                 }
4221                 else
4222                 {
4223                         self::$skin->parse('adminskiniedoimport');
4224                 }
4225                 return;
4226         }
4227
4228         /**
4229          * Admin::action_adminskinieexport()
4230          *
4231          * @param       void
4232          * @return      void
4233          */
4234         static private function action_adminskinieexport()
4235         {
4236                 global $member;
4237
4238                 $member->isAdmin() or self::disallow();
4239
4240                 // load skinie class
4241                 $aSkins = requestIntArray('skin');
4242                 $aTemplates = requestIntArray('template');
4243                 $info = postVar('info');
4244
4245                 self::skinieexport($aSkins, $aTemplates, $info);
4246
4247                 return;
4248         }
4249
4250         /**
4251          * Admin::action_settingsedit()
4252          *
4253          * @param       Void
4254          * @return      Void
4255          */
4256         static private function action_settingsedit()
4257         {
4258                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4259
4260                 $member->isAdmin() or self::disallow();
4261
4262                 self::$skin->parse('settingsedit');
4263                 return;
4264         }
4265
4266         /**
4267          * Admin::action_settingsupdate()
4268          * Update $CONFIG and redirect
4269          *
4270          * @param       void
4271          * @return      void
4272          */
4273         static private function action_settingsupdate()
4274         {
4275                 global $member, $CONF;
4276
4277                 $member->isAdmin() or self::disallow();
4278
4279                 // check if email address for admin is valid
4280                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
4281                 {
4282                         self::error(_ERROR_BADMAILADDRESS);
4283                         return;
4284                 }
4285
4286                 // save settings
4287                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));
4288                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));
4289                 self::updateConfig('IndexURL',                  postVar('IndexURL'));
4290                 self::updateConfig('AdminURL',                  postVar('AdminURL'));
4291                 self::updateConfig('PluginURL',                 postVar('PluginURL'));
4292                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));
4293                 self::updateConfig('ActionURL',                 postVar('ActionURL'));
4294                 self::updateConfig('Locale',                    postVar('Locale'));
4295                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));
4296                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));
4297                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));
4298                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));
4299                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));
4300                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));
4301                 self::updateConfig('SiteName',                  postVar('SiteName'));
4302                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));
4303                 self::updateConfig('DisableSite',               postVar('DisableSite'));
4304                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));
4305                 self::updateConfig('LastVisit',                 postVar('LastVisit'));
4306                 self::updateConfig('MediaURL',                  postVar('MediaURL'));
4307                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));
4308                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));
4309                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));
4310                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));
4311                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));
4312                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));
4313                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));
4314                 self::updateConfig('CookiePath',                postVar('CookiePath'));
4315                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));
4316                 self::updateConfig('URLMode',                   postVar('URLMode'));
4317                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));
4318                 self::updateConfig('DebugVars',                 postVar('DebugVars'));
4319                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));
4320                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));
4321                 self::updateConfig('AdminSkin',                 postVar('adminskin'));
4322                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));
4323
4324                 // load new config and redirect (this way, the new locale will be used is necessary)
4325                 // note that when changing cookie settings, this redirect might cause the user
4326                 // to have to log in again.
4327                 getConfig();
4328                 redirect($CONF['AdminURL'] . '?action=manage');
4329                 return;
4330         }
4331
4332         /**
4333          * Admin::action_systemoverview()
4334          * Output system overview
4335          *
4336          * @param       void
4337          * @return      void
4338          */
4339         static private function action_systemoverview()
4340         {
4341                 self::$skin->parse('systemoverview');
4342                 return;
4343         }
4344
4345         /**
4346          * Admin::updateConfig()
4347          *
4348          * @param       string  $name
4349          * @param       string  $val
4350          * @return      integer return the ID in which the latest query posted
4351          */
4352         static private function updateConfig($name, $val)
4353         {
4354                 $query = "UPDATE %s SET value=%s WHERE name=%s";
4355                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));
4356                 if ( DB::execute($query) === FALSE )
4357                 {
4358                         $err = DB::getError();
4359                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
4360                 }
4361                 return DB::getInsertId();
4362         }
4363
4364         /**
4365          * Admin::error()
4366          * Error message
4367          *
4368          * @param       string  $msg    message that will be shown
4369          * @return      void
4370          */
4371         static public function error($msg)
4372         {
4373                 self::$headMess = $msg;
4374                 self::$skin->parse('adminerrorpage');
4375                 return;
4376         }
4377
4378         /**
4379          * Admin::disallow()
4380          * add error log and show error page
4381          *
4382          * @param       void
4383          * @return      void
4384          */
4385         static public function disallow()
4386         {
4387                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4388                 self::error(_ERROR_DISALLOWED);
4389                 return;
4390         }
4391
4392         /**
4393          * Admin::action_PluginAdmin()
4394          * Output pluginadmin
4395          *
4396          * @param       string  $skinContents
4397          * @param       string  $extrahead
4398          * @return      void
4399          */
4400         static public function action_PluginAdmin($skinContents, $extrahead = '')
4401         {
4402                 self::$extrahead .= $extrahead;
4403                 self::$skin->parse('pluginadmin', $skinContents);
4404                 return;
4405         }
4406
4407         /**
4408          * Admin::action_bookmarklet()
4409          *
4410          * @param       void
4411          * @return      void
4412          */
4413         static private function action_bookmarklet()
4414         {
4415                 global $member, $manager;
4416
4417                 $blogid = intRequestVar('blogid');
4418                 $member->teamRights($blogid) or self::disallow();
4419
4420                 self::$skin->parse('bookmarklet');
4421                 return;
4422         }
4423
4424         /**
4425          * Admin::action_actionlog()
4426          *
4427          * @param       void
4428          * @return      void
4429          */
4430         static private function action_actionlog()
4431         {
4432                 global $member, $manager;
4433
4434                 $member->isAdmin() or self::disallow();
4435
4436                 self::$skin->parse('actionlog');
4437                 return;
4438         }
4439
4440         /**
4441          * Admin::action_banlist()
4442          *
4443          * @param       void
4444          * @return      void
4445          */
4446         static private function action_banlist()
4447         {
4448                 global $member, $manager;
4449
4450                 $blogid = intRequestVar('blogid');
4451                 $member->blogAdminRights($blogid) or self::disallow();
4452
4453                 self::$skin->parse('banlist');
4454                 return;
4455         }
4456
4457         /**
4458          * Admin::action_banlistdelete()
4459          *
4460          * @param       void
4461          * @return      void
4462          */
4463         static private function action_banlistdelete()
4464         {
4465                 global $member, $manager;
4466
4467                 $blogid = intRequestVar('blogid');
4468                 $member->blogAdminRights($blogid) or self::disallow();
4469
4470                 self::$skin->parse('banlistdelete');
4471                 return;
4472         }
4473
4474         /**
4475          * Admin::action_banlistdeleteconfirm()
4476          *
4477          * @param       void
4478          * @return      void
4479          */
4480         static private function action_banlistdeleteconfirm()
4481         {
4482                 global $member, $manager;
4483
4484                 $blogid         = intPostVar('blogid');
4485                 $allblogs       = postVar('allblogs');
4486                 $iprange        = postVar('iprange');
4487
4488                 $member->blogAdminRights($blogid) or self::disallow();
4489
4490                 $deleted = array();
4491
4492                 if ( !$allblogs )
4493                 {
4494                         if ( Ban::removeBan($blogid, $iprange) )
4495                         {
4496                                 $deleted[] = $blogid;
4497                         }
4498                 }
4499                 else
4500                 {
4501                         // get blogs fot which member has admin rights
4502                         $adminblogs = $member->getAdminBlogs();
4503                         foreach ($adminblogs as $blogje)
4504                         {
4505                                 if ( Ban::removeBan($blogje, $iprange) )
4506                                 {
4507                                         $deleted[] = $blogje;
4508                                 }
4509                         }
4510                 }
4511
4512                 if ( sizeof($deleted) == 0 )
4513                 {
4514                         self::error(_ERROR_DELETEBAN);
4515                         return;
4516                 }
4517
4518                 /* TODO: we should use other ways */
4519                 $_REQUEST['delblogs'] = $deleted;
4520
4521                 self::$skin->parse('banlistdeleteconfirm');
4522                 return;
4523         }
4524
4525         /**
4526          * Admin::action_banlistnewfromitem()
4527          *
4528          * @param       void
4529          * @return      void
4530          */
4531         static private function action_banlistnewfromitem()
4532         {
4533                 global $manager;
4534
4535                 $itemid = intRequestVar('itemid');
4536                 $item =& $manager->getItem($itemid, 1, 1);
4537                 self::action_banlistnew($item['blogid']);
4538                 return;
4539         }
4540
4541         /**
4542          * Admin::action_banlistnew()
4543          *
4544          * @param       integer $blogid ID for weblog
4545          * @return      void
4546          */
4547         static private function action_banlistnew($blogid = '')
4548         {
4549                 global $member, $manager;
4550
4551                 if ( $blogid == '' )
4552                 {
4553                         $blogid = intRequestVar('blogid');
4554                 }
4555
4556                 $ip = requestVar('ip');
4557
4558                 $member->blogAdminRights($blogid) or self::disallow();
4559
4560                 /* TODO: we should consider to use the other way instead of this */
4561                 $_REQUEST['blogid'] = $blogid;
4562
4563                 self::$skin->parse('banlistnew');
4564
4565                 return;
4566         }
4567
4568         /**
4569          * Admin::action_banlistadd()
4570          *
4571          * @param       void
4572          * @return      void
4573          */
4574         static private function action_banlistadd()
4575         {
4576                 global $member;
4577
4578                 $blogid         = intPostVar('blogid');
4579                 $allblogs       = postVar('allblogs');
4580                 $iprange        = postVar('iprange');
4581
4582                 if ( $iprange == "custom" )
4583                 {
4584                         $iprange = postVar('customiprange');
4585                 }
4586                 $reason   = postVar('reason');
4587
4588                 $member->blogAdminRights($blogid) or self::disallow();
4589
4590                 // TODO: check IP range validity
4591
4592                 if ( !$allblogs )
4593                 {
4594                         if ( !Ban::addBan($blogid, $iprange, $reason) )
4595                         {
4596                                 self::error(_ERROR_ADDBAN);
4597                                 return;
4598                         }
4599                 }
4600                 else
4601                 {
4602                         // get blogs fot which member has admin rights
4603                         $adminblogs = $member->getAdminBlogs();
4604                         $failed = 0;
4605                         foreach ($adminblogs as $blogje)
4606                         {
4607                                 if ( !Ban::addBan($blogje, $iprange, $reason) )
4608                                 {
4609                                         $failed = 1;
4610                                 }
4611                         }
4612                         if ( $failed )
4613                         {
4614                                 self::error(_ERROR_ADDBAN);
4615                                 return;
4616                         }
4617                 }
4618                 self::action_banlist();
4619                 return;
4620         }
4621
4622         /**
4623          * Admin::action_clearactionlog()
4624          *
4625          * @param       void
4626          * @return      void
4627          */
4628         static private function action_clearactionlog()
4629         {
4630                 global $member;
4631
4632                 $member->isAdmin() or self::disallow();
4633
4634                 ActionLog::clear();
4635
4636                 self::action_manage(_MSG_ACTIONLOGCLEARED);
4637                 return;
4638         }
4639
4640         /**
4641          * Admin::action_backupoverview()
4642          *
4643          * @param       void
4644          * @return      void
4645          */
4646         static private function action_backupoverview()
4647         {
4648                 global $member, $manager;
4649
4650                 $member->isAdmin() or self::disallow();
4651
4652                 self::$skin->parse('backupoverview');
4653                 return;
4654         }
4655
4656         /**
4657          * Admin::action_backupcreate()
4658          * create file for backup
4659          *
4660          * @param               void
4661          * @return      void
4662          *
4663          */
4664         static private function action_backupcreate()
4665         {
4666                 global $member, $DIR_LIBS;
4667
4668                 $member->isAdmin() or self::disallow();
4669
4670                 // use compression ?
4671                 $useGzip = (integer) postVar('gzip');
4672
4673                 include($DIR_LIBS . 'backup.php');
4674
4675                 // try to extend time limit
4676                 // (creating/restoring dumps might take a while)
4677                 @set_time_limit(1200);
4678
4679                 Backup::do_backup($useGzip);
4680                 return;
4681         }
4682
4683         /**
4684          * Admin::action_backuprestore()
4685          * restoring from uploaded file
4686          *
4687          * @param               void
4688          * @return      void
4689          */
4690         static private function action_backuprestore()
4691         {
4692                 global $member, $DIR_LIBS;
4693
4694                 $member->isAdmin() or self::disallow();
4695
4696                 if ( intPostVar('letsgo') != 1 )
4697                 {
4698                         self::error(_ERROR_BACKUP_NOTSURE);
4699                         return;
4700                 }
4701
4702                 include($DIR_LIBS . 'backup.php');
4703
4704                 // try to extend time limit
4705                 // (creating/restoring dumps might take a while)
4706                 @set_time_limit(1200);
4707
4708                 $message = Backup::do_restore();
4709                 if ( $message != '' )
4710                 {
4711                         self::error($message);
4712                         return;
4713                 }
4714                 self::$skin->parse('backuprestore');
4715                 return;
4716         }
4717
4718         /**
4719          * Admin::action_pluginlist()
4720          * output the list of installed plugins
4721          *
4722          * @param       void
4723          * @return      void
4724          *
4725          */
4726         static private function action_pluginlist()
4727         {
4728                 global $DIR_PLUGINS, $member, $manager;
4729
4730                 // check if allowed
4731                 $member->isAdmin() or self::disallow();
4732
4733                 self::$skin->parse('pluginlist');
4734                 return;
4735         }
4736
4737         /**
4738          * Admin::action_pluginhelp()
4739          *
4740          * @param       void
4741          * @return      void
4742          */
4743         static private function action_pluginhelp()
4744         {
4745                 global $member, $manager, $DIR_PLUGINS, $CONF;
4746
4747                 // check if allowed
4748                 $member->isAdmin() or self::disallow();
4749
4750                 $plugid = intGetVar('plugid');
4751
4752                 if ( !$manager->pidInstalled($plugid) )
4753                 {
4754                         self::error(_ERROR_NOSUCHPLUGIN);
4755                         return;
4756                 }
4757
4758                 self::$skin->parse('pluginhelp');
4759                 return;
4760         }
4761
4762         /**
4763          * Admin::action_pluginadd()
4764          *
4765          * @param       Void
4766          * @return      Void
4767          *
4768          */
4769         static private function action_pluginadd()
4770         {
4771                 global $member, $manager, $DIR_PLUGINS;
4772
4773                 // check if allowed
4774                 $member->isAdmin() or self::disallow();
4775
4776                 $name = postVar('filename');
4777
4778                 if ( $manager->pluginInstalled($name) )
4779                 {
4780                         self::error(_ERROR_DUPPLUGIN);
4781                         return;
4782                 }
4783
4784                 if ( !checkPlugin($name) )
4785                 {
4786                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
4787                         return;
4788                 }
4789
4790                 // get number of currently installed plugins
4791                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
4792                 $numCurrent = $res->rowCount();
4793
4794                 // plugin will be added as last one in the list
4795                 $newOrder = $numCurrent + 1;
4796
4797                 $data = array('file' => &$name);
4798                 $manager->notify('PreAddPlugin', $data);
4799
4800                 // do this before calling getPlugin (in case the plugin id is used there)
4801                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";
4802                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));
4803                 DB::execute($query);
4804                 $iPid = DB::getInsertId();
4805
4806                 $manager->clearCachedInfo('installedPlugins');
4807
4808                 // Load the plugin for condition checking and instalation
4809                 $plugin =& $manager->getPlugin($name);
4810
4811                 // check if it got loaded (could have failed)
4812                 if ( !$plugin )
4813                 {
4814                         $query = "DELETE FROM %s WHERE pid=%d;";
4815                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);
4816
4817                         DB::execute($query);
4818
4819                         $manager->clearCachedInfo('installedPlugins');
4820                         self::error(_ERROR_PLUGIN_LOAD);
4821                         return;
4822                 }
4823
4824                 // check if plugin needs a newer Nucleus version
4825                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
4826                 {
4827                         // uninstall plugin again...
4828                         self::deleteOnePlugin($plugin->getID());
4829
4830                         // ...and show error
4831                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
4832                         return;
4833                 }
4834
4835                 // check if plugin needs a newer Nucleus version
4836                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
4837                 {
4838                         // uninstall plugin again...
4839                         self::deleteOnePlugin($plugin->getID());
4840
4841                         // ...and show error
4842                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
4843                         return;
4844                 }
4845
4846                 $pluginList = $plugin->getPluginDep();
4847                 foreach ( $pluginList as $pluginName )
4848                 {
4849                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));
4850                         if ($res->rowCount() == 0)
4851                         {
4852                                 // uninstall plugin again...
4853                                 self::deleteOnePlugin($plugin->getID());
4854                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
4855                                 return;
4856                         }
4857                 }
4858
4859                 // call the install method of the plugin
4860                 $plugin->install();
4861
4862                 $data = array('plugin' => &$plugin);
4863                 $manager->notify('PostAddPlugin', $data);
4864
4865                 // update all events
4866                 self::action_pluginupdate();
4867                 return;
4868         }
4869
4870         /**
4871          * ADMIN:action_pluginupdate():
4872          *
4873          * @param       Void
4874          * @return      Void
4875          *
4876          */
4877         static private function action_pluginupdate()
4878         {
4879                 global $member, $manager, $CONF;
4880
4881                 // check if allowed
4882                 $member->isAdmin() or self::disallow();
4883
4884                 // delete everything from plugin_events
4885                 DB::execute('DELETE FROM '.sql_table('plugin_event'));
4886
4887                 // loop over all installed plugins
4888                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));
4889                 foreach ( $res as $row )
4890                 {
4891                         $pid  =  $row['pid'];
4892                         $plug =& $manager->getPlugin($row['pfile']);
4893                         if ( $plug )
4894                         {
4895                                 $eventList = $plug->getEventList();
4896                                 foreach ( $eventList as $eventName )
4897                                 {
4898                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";
4899                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));
4900                                         DB::execute($query);
4901                                 }
4902                         }
4903                 }
4904                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4905                 return;
4906         }
4907
4908         /**
4909          * Admin::action_plugindelete()
4910          *
4911          * @param       void
4912          * @return      void
4913          */
4914         static private function action_plugindelete()
4915         {
4916                 global $member, $manager;
4917
4918                 // check if allowed
4919                 $member->isAdmin() or self::disallow();
4920
4921                 $pid = intGetVar('plugid');
4922
4923                 if ( !$manager->pidInstalled($pid) )
4924                 {
4925                         self::error(_ERROR_NOSUCHPLUGIN);
4926                         return;
4927                 }
4928
4929                 self::$skin->parse('plugindelete');
4930                 return;
4931         }
4932
4933         /**
4934          * Admin::action_plugindeleteconfirm()
4935          *
4936          * @param       void
4937          * @return      void
4938          */
4939         static private function action_plugindeleteconfirm()
4940         {
4941                 global $member, $manager, $CONF;
4942
4943                 // check if allowed
4944                 $member->isAdmin() or self::disallow();
4945
4946                 $pid = intPostVar('plugid');
4947
4948                 $error = self::deleteOnePlugin($pid, 1);
4949                 if ( $error )
4950                 {
4951                         self::error($error);
4952                         return;
4953                 }
4954
4955                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4956                 return;
4957         }
4958
4959         /**
4960          * Admin::deleteOnePlugin()
4961          *
4962          * @param       integer $pid
4963          * @param       boolean $callUninstall
4964          * @return      string  empty or message if failed
4965          */
4966         static public function deleteOnePlugin($pid, $callUninstall = 0)
4967         {
4968                 global $manager;
4969
4970                 $pid = intval($pid);
4971
4972                 if ( !$manager->pidInstalled($pid) )
4973                 {
4974                         return _ERROR_NOSUCHPLUGIN;
4975                 }
4976
4977                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";
4978                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);
4979                 $name = DB::getValue($query);
4980
4981                 // check dependency before delete
4982                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));
4983                 foreach ( $res as $row )
4984                 {
4985                         $plug =& $manager->getPlugin($row['pfile']);
4986                         if ( $plug )
4987                         {
4988                                 $depList = $plug->getPluginDep();
4989                                 foreach ( $depList as $depName )
4990                                 {
4991                                         if ( $name == $depName )
4992                                         {
4993                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);
4994                                         }
4995                                 }
4996                         }
4997                 }
4998
4999                 $data = array('plugid' => $pid);
5000                 $manager->notify('PreDeletePlugin', $data);
5001
5002                 // call the unInstall method of the plugin
5003                 if ( $callUninstall )
5004                 {
5005                         $plugin =& $manager->getPlugin($name);
5006                         if ( $plugin )
5007                         {
5008                                 $plugin->unInstall();
5009                         }
5010                 }
5011
5012                 // delete all subscriptions
5013                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);
5014
5015                 // delete all options
5016                 // get OIDs from plugin_option_desc
5017                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5018                 $aOIDs = array();
5019                 foreach ( $res as $row )
5020                 {
5021                         array_push($aOIDs, $row['oid']);
5022                 }
5023
5024                 // delete from plugin_option and plugin_option_desc
5025                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5026                 if (count($aOIDs) > 0)
5027                 {
5028                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');
5029                 }
5030
5031                 // update order numbers
5032                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5033                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);
5034
5035                 // delete row
5036                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5037
5038                 $manager->clearCachedInfo('installedPlugins');
5039                 $data = array('plugid' => $pid);
5040                 $manager->notify('PostDeletePlugin', $data);
5041
5042                 return '';
5043         }
5044
5045         /**
5046          * Admin::action_pluginup()
5047          *
5048          * @param       void
5049          * @return      void
5050          */
5051         static private function action_pluginup()
5052         {
5053                 global $member, $manager, $CONF;
5054
5055                 // check if allowed
5056                 $member->isAdmin() or self::disallow();
5057
5058                 $plugid = intGetVar('plugid');
5059
5060                 if ( !$manager->pidInstalled($plugid) )
5061                 {
5062                         self::error(_ERROR_NOSUCHPLUGIN);
5063                         return;
5064                 }
5065
5066                 // 1. get old order number
5067                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5068
5069                 // 2. calculate new order number
5070                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5071
5072                 // 3. update plug numbers
5073                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5074                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5075
5076                 //self::action_pluginlist();
5077                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5078                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5079                 return;
5080         }
5081
5082         /**
5083          * Admin::action_plugindown()
5084          *
5085          * @param       void
5086          * @return      void
5087          */
5088         static private function action_plugindown()
5089         {
5090                 global $member, $manager, $CONF;
5091
5092                 // check if allowed
5093                 $member->isAdmin() or self::disallow();
5094
5095                 $plugid = intGetVar('plugid');
5096                 if ( !$manager->pidInstalled($plugid) )
5097                 {
5098                         self::error(_ERROR_NOSUCHPLUGIN);
5099                         return;
5100                 }
5101
5102                 // 1. get old order number
5103                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5104
5105                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
5106                 $maxOrder = $res->rowCount();
5107
5108                 // 2. calculate new order number
5109                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
5110
5111                 // 3. update plug numbers
5112                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5113                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5114
5115                 //self::action_pluginlist();
5116                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5117                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5118                 return;
5119         }
5120
5121         /**
5122          * Admin::action_pluginoptions()
5123          *
5124          * Output Plugin option page
5125          *
5126          * @access      public
5127          * @param       string $message message when fallbacked
5128          * @return      void
5129          *
5130          */
5131         static private function action_pluginoptions($message = '')
5132         {
5133                 global $member, $manager;
5134
5135                 // check if allowed
5136                 $member->isAdmin() or self::disallow();
5137
5138                 $pid = intRequestVar('plugid');
5139                 if ( !$manager->pidInstalled($pid) )
5140                 {
5141                         self::error(_ERROR_NOSUCHPLUGIN);
5142                         return;
5143                 }
5144
5145                 if ( isset($message) )
5146                 {
5147                         self::$headMess = $message;
5148                 }
5149                 $plugname       = $manager->getPluginNameFromPid($pid);
5150                 $plugin         = $manager->getPlugin($plugname);
5151                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
5152
5153                 self::$skin->parse('pluginoptions');
5154                 return;
5155         }
5156
5157         /**
5158          * Admin::action_pluginoptionsupdate()
5159          *
5160          * Update plugin options and fallback to plugin option page
5161          *
5162          * @access      public
5163          * @param       void
5164          * @return      void
5165          */
5166         static private function action_pluginoptionsupdate()
5167         {
5168                 global $member, $manager;
5169
5170                 // check if allowed
5171                 $member->isAdmin() or self::disallow();
5172
5173                 $pid = intRequestVar('plugid');
5174
5175                 if ( !$manager->pidInstalled($pid) )
5176                 {
5177                         self::error(_ERROR_NOSUCHPLUGIN);
5178                         return;
5179                 }
5180
5181                 $aOptions = requestArray('plugoption');
5182                 NucleusPlugin::apply_plugin_options($aOptions);
5183
5184                 $data = array(
5185                         'context'       => 'global',
5186                         'plugid'        => $pid
5187                 );
5188                 $manager->notify('PostPluginOptionsUpdate', $data);
5189
5190                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
5191                 return;
5192         }
5193
5194         /**
5195          * Admin::skineditgeneral()
5196          *
5197          * @param       integer $skinid
5198          * @param       string  $handler
5199          * @return      string  empty or message if failed
5200          */
5201         static private function skineditgeneral($skinid, $handler='')
5202         {
5203                 global $manager;
5204
5205                 $name = postVar('name');
5206                 $desc = postVar('desc');
5207                 $type = postVar('type');
5208                 $inc_mode = postVar('inc_mode');
5209                 $inc_prefix = postVar('inc_prefix');
5210
5211                 $skin =& $manager->getSkin($skinid, $handler);
5212
5213                 // 1. Some checks
5214                 if ( !isValidSkinName($name) )
5215                 {
5216                         return _ERROR_BADSKINNAME;
5217                 }
5218
5219                 if ( ($skin->getName() != $name) && SKIN::exists($name) )
5220                 {
5221                         return _ERROR_DUPSKINNAME;
5222                 }
5223
5224                 if ( !$type )
5225                 {
5226                         $type = 'text/html';
5227                 }
5228
5229                 if ( !$inc_mode )
5230                 {
5231                         $inc_mode = 'normal';
5232                 }
5233
5234                 // 2. Update description
5235                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
5236
5237                 return '';
5238         }
5239         /**
5240          * Admin::skindeleteconfirm()
5241          *
5242          * @param       integer $skinid
5243          * @return      void
5244          */
5245         static private function skindeleteconfirm($skinid)
5246         {
5247                 global $manager;
5248
5249                 if ( !in_array(self::$action, self::$adminskin_actions) )
5250                 {
5251                         $event_identifier = 'Skin';
5252                 }
5253                 else
5254                 {
5255                         $event_identifier = 'AdminSkin';
5256                 }
5257
5258                 $data = array('skinid' => $skinid);
5259                 $manager->notify("PreDelete{$event_identifier}", $data);
5260
5261                 // 1. delete description
5262                 $query = "DELETE FROM %s WHERE sdnumber=%d;";
5263                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);
5264                 DB::execute($query);
5265
5266                 // 2. delete parts
5267                 $query = "DELETE FROM %s WHERE sdesc=%d;";
5268                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5269                 DB::execute($query);
5270
5271                 $manager->notify("PostDelete{$event_identifier}", $data);
5272
5273                 return;
5274         }
5275
5276         /**
5277          * Admin::skinremovetypeconfirm()
5278          *
5279          * @param       integer $skinid
5280          * @param       string  $skintype
5281          * @return      string  empty or message if failed
5282          */
5283         static private function skinremovetypeconfirm($skinid, $skintype)
5284         {
5285                 global $manager;
5286
5287                 if ( !in_array(self::$action, self::$adminskin_actions) )
5288                 {
5289                         $event_identifier = 'Skin';
5290                 }
5291                 else
5292                 {
5293                         $event_identifier = 'AdminSkin';
5294                 }
5295
5296                 if ( !isValidShortName($skintype) )
5297                 {
5298                         return _ERROR_SKIN_PARTS_SPECIAL_DELETE;
5299                 }
5300
5301                 $data = array(
5302                         'skinid'        => $skinid,
5303                         'skintype'      => $skintype
5304                 );
5305                 $manager->notify("PreDelete{$event_identifier}Part", $data);
5306
5307                 // delete part
5308                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s;';
5309                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );
5310                 DB::execute($query);
5311
5312                 $data = array(
5313                         'skinid'        => $skinid,
5314                         'skintype'      => $skintype
5315                 );
5316                 $manager->notify("PostDelete{$event_identifier}Part", $data);
5317
5318                 return '';
5319         }
5320
5321         /**
5322          * Admin::skinclone()
5323          *
5324          * @param       integer $skinid
5325          * @param       string  $handler
5326          * @return      void
5327          */
5328         static private function skinclone($skinid, $handler='')
5329         {
5330                 global $manager;
5331
5332                 // 1. read skin to clone
5333                 $skin =& $manager->getSkin($skinid, $handler);
5334                 $name = "{$skin->getName()}_clone";
5335
5336                 // if a skin with that name already exists:
5337                 if ( Skin::exists($name) )
5338                 {
5339                         $i = 1;
5340                         while ( Skin::exists($name . $i) )
5341                         {
5342                                 $i++;
5343                         }
5344                         $name .= $i;
5345                 }
5346
5347                 // 2. create skin desc
5348                 $newid = Skin::createNew(
5349                         $name,
5350                         $skin->getDescription(),
5351                         $skin->getContentType(),
5352                         $skin->getIncludeMode(),
5353                         $skin->getIncludePrefix()
5354                 );
5355
5356                 // 3. clone
5357                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";
5358                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5359
5360                 $res = DB::getResult($query);
5361                 foreach ( $res as $row )
5362                 {
5363                         $content = $skin->getContentFromDB($row['stype']);
5364                         if ( $content )
5365                         {
5366                                 $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";
5367                                 $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($row['stype']));
5368                                 DB::execute($query);
5369                         }
5370                 }
5371                 return;
5372         }
5373
5374         /**
5375          * Admin::skinieimport()
5376          *
5377          * @param       string  $mode
5378          * @param       string  $skinFileRaw
5379          * @return      string  empty or message if failed
5380          */
5381         static private function skinieimport($mode, $skinFileRaw)
5382         {
5383                 global $DIR_LIBS, $DIR_SKINS;
5384
5385                 // load skinie class
5386                 include_once($DIR_LIBS . 'skinie.php');
5387
5388                 $importer = new SkinImport();
5389
5390                 // get full filename
5391                 if ( $mode == 'file' )
5392                 {
5393                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5394                 }
5395                 else
5396                 {
5397                         $skinFile = $skinFileRaw;
5398                 }
5399
5400                 // read only metadata
5401                 $error = $importer->readFile($skinFile, 1);
5402                 if ( $error )
5403                 {
5404                         unset($importer);
5405                         return $error;
5406                 }
5407
5408                 self::$contents['mode']         = $mode;
5409                 self::$contents['skinfile']     = $skinFileRaw;
5410                 self::$contents['skininfo']     = $importer->getInfo();
5411                 self::$contents['skinnames']    = $importer->getSkinNames();
5412                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5413
5414                 // clashes
5415                 $skinNameClashes                = $importer->checkSkinNameClashes();
5416                 $templateNameClashes    = $importer->checkTemplateNameClashes();
5417                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
5418
5419                 self::$contents['skinclashes'] = $skinNameClashes;
5420                 self::$contents['tpltclashes'] = $templateNameClashes;
5421                 self::$contents['nameclashes'] = $hasNameClashes ? 1 : 0;
5422
5423                 unset($importer);
5424                 return '';
5425         }
5426
5427         /**
5428          * Admin::skinieedoimport()
5429          *
5430          * @param       string  $mode
5431          * @param       string  $skinFileRaw
5432          * @param       boolean $allowOverwrite
5433          * @return      string  empty   or message if failed
5434          */
5435         static private function skiniedoimport($mode, $skinFileRaw, $allowOverwrite)
5436         {
5437                 global $DIR_LIBS, $DIR_SKINS;
5438
5439                 // load skinie class
5440                 include_once($DIR_LIBS . 'skinie.php');
5441
5442                 $importer = new SkinImport();
5443
5444                 // get full filename
5445                 if ( $mode == 'file' )
5446                 {
5447                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5448                 }
5449                 else
5450                 {
5451                         $skinFile = $skinFileRaw;
5452                 }
5453
5454                 $error = $importer->readFile($skinFile);
5455                 if ( $error )
5456                 {
5457                         unset($importer);
5458                         return $error;
5459                 }
5460
5461                 $error = $importer->writeToDatabase($allowOverwrite);
5462                 if ( $error )
5463                 {
5464                         unset($importer);
5465                         return $error;
5466                 }
5467
5468                 self::$contents['mode']         = $mode;
5469                 self::$contents['skinfile']     = $skinFileRaw;
5470                 self::$contents['skininfo']     = $importer->getInfo();
5471                 self::$contents['skinnames']    = $importer->getSkinNames();
5472                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5473
5474                 unset($importer);
5475                 return '';
5476         }
5477
5478         /**
5479          * Admin::skinieexport()
5480          *
5481          * @param       array   $aSkins
5482          * @param       array   $aTemplates
5483          * @param       string  $info
5484          * @return      void
5485          */
5486         static private function skinieexport($aSkins, $aTemplates, $info)
5487         {
5488                 global $DIR_LIBS;
5489
5490                 // load skinie class
5491                 include_once($DIR_LIBS . 'skinie.php');
5492
5493                 if ( !is_array($aSkins) )
5494                 {
5495                         $aSkins = array();
5496                 }
5497
5498                 if (!is_array($aTemplates))
5499                 {
5500                         $aTemplates = array();
5501                 }
5502
5503                 $skinList = array_keys($aSkins);
5504                 $templateList = array_keys($aTemplates);
5505
5506                 $exporter = new SkinExport();
5507                 foreach ( $skinList as $skinId )
5508                 {
5509                         $exporter->addSkin($skinId);
5510                 }
5511                 foreach ( $templateList as $templateId )
5512                 {
5513                         $exporter->addTemplate($templateId);
5514                 }
5515                 $exporter->setInfo($info);
5516                 $exporter->export();
5517
5518                 return;
5519         }
5520
5521         /**
5522          * Admin::action_parseSpecialskin()
5523          *
5524          * @param       void
5525          * @return      void
5526          */
5527         static private function action_parseSpecialskin()
5528         {
5529                 self::$skin->parse(self::$action);
5530                 return;
5531         }
5532 }