nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . ENTITY::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', ENTITY::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.ENTITY::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. ENTITY::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',ENTITY::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',ENTITY::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',ENTITY::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124     /**
1125      * Provide a page to item a new item to the given blog
1126      */
1127     function action_createitem() {
1128         global $member, $manager;
1129
1130         $blogid = intRequestVar('blogid');
1131
1132         // check if allowed
1133         $member->teamRights($blogid) or $this->disallow();
1134
1135         $memberid = $member->getID();
1136
1137         $blog =& $manager->getBlog($blogid);
1138
1139         $this->pagehead();
1140
1141         // generate the add-item form
1142         $formfactory = new PAGEFACTORY($blogid);
1143         $formfactory->createAddForm('admin');
1144
1145         $this->pagefoot();
1146     }
1147
1148     /**
1149      * @todo document this
1150      */
1151     function action_itemedit()
1152         {
1153                 global $member, $manager;
1154
1155                 $itemid = intRequestVar('itemid');
1156
1157                 // only allow if user is allowed to alter item
1158                 $member->canAlterItem($itemid) or $this->disallow();
1159
1160                 $item =& $manager->getItem($itemid, 1, 1);
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1162
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1164
1165                 if ($blog->convertBreaks())
1166                 {
1167                         $item['body'] = removeBreaks($item['body']);
1168                         $item['more'] = removeBreaks($item['more']);
1169                 }
1170
1171                 // form to edit blog items
1172                 $this->pagehead();
1173                 $formfactory = new PAGEFACTORY($blog->getID());
1174                 $formfactory->createEditForm('admin', $item);
1175                 $this->pagefoot();
1176     }
1177
1178     /**
1179      * @todo document this
1180      */
1181     function action_itemupdate() {
1182         global $member, $manager, $CONF;
1183
1184         $itemid = intRequestVar('itemid');
1185         $catid = postVar('catid');
1186
1187         // only allow if user is allowed to alter item
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1189
1190         $actiontype = postVar('actiontype');
1191
1192         // delete actions are handled by itemdelete (which has confirmation)
1193         if ($actiontype == 'delete') {
1194             $this->action_itemdelete();
1195             return;
1196         }
1197
1198         $body   = postVar('body');
1199         $title  = postVar('title');
1200         $more   = postVar('more');
1201         $closed = intPostVar('closed');
1202         $draftid = intPostVar('draftid');
1203
1204         // default action = add now
1205         if (!$actiontype)
1206             $actiontype='addnow';
1207
1208         // create new category if needed
1209         if (strstr($catid,'newcat')) {
1210             // get blogid
1211             list($blogid) = sscanf($catid,"newcat-%d");
1212
1213             // create
1214             $blog =& $manager->getBlog($blogid);
1215             $catid = $blog->createNewCategory();
1216
1217             // show error when sth goes wrong
1218             if (!$catid)
1219                 $this->doError(_ERROR_CATCREATEFAIL);
1220         }
1221
1222         /*
1223             set some variables based on actiontype
1224
1225             actiontypes:
1226                 draft items -> addnow, addfuture, adddraft, delete
1227                 non-draft items -> edit, changedate, delete
1228
1229             variables set:
1230                 $timestamp: set to a nonzero value for future dates or date changes
1231                 $wasdraft: set to 1 when the item used to be a draft item
1232                 $publish: set to 1 when the edited item is not a draft
1233         */
1234         $blogid =  getBlogIDFromItemID($itemid);
1235         $blog   =& $manager->getBlog($blogid);
1236
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1242         } else {
1243             $timestamp =0;
1244         }
1245
1246         // edit the item for real
1247         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1248
1249         $this->updateFuturePosted($blogid);
1250
1251         if ($draftid > 0) {
1252             // delete permission is checked inside ITEM::delete()
1253             ITEM::delete($draftid);
1254         }
1255
1256         // show category edit window when we created a new category
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1258         if ($catid != intPostVar('catid')) {
1259             $this->action_categoryedit(
1260                 $catid,
1261                 $blog->getID(),
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1263             );
1264         } else {
1265             // TODO: set start item correctly for itemlist
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));
1267         }
1268     }
1269
1270         /**
1271          * ADMIN::action_itemdelete()
1272          * Delete item
1273          *
1274          * @param       Void
1275          * @return      Void
1276          */
1277         function action_itemdelete()
1278         {
1279                 global $member, $manager;
1280
1281                 $itemid = intRequestVar('itemid');
1282
1283                 // only allow if user is allowed to alter item
1284                 $member->canAlterItem($itemid) or $this->disallow();
1285
1286                 if ( !$manager->existsItem($itemid,1,1) )
1287                 {
1288                         $this->error(_ERROR_NOSUCHITEM);
1289                 }
1290
1291                 $item =& $manager->getItem($itemid,1,1);
1292                 $title = ENTITY::hsc(strip_tags($item['title']));
1293                 $body = strip_tags($item['body']);
1294                 $body = ENTITY::hsc(ENTITY::shorten($body,300,'...'));
1295
1296                 $this->pagehead();
1297                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1298                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";
1299                 echo "<div class=\"note\">\n";
1300                 echo "<b>{$title}</b>\n";
1301                 echo "<br />\n";
1302                 echo "{$body}\n";
1303                 echo "</div>\n";
1304                 echo "<form method=\"post\" action=\"index.php\">\n";
1305                 echo "<div>\n";
1306                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";
1307                 echo $manager->addTicketHidden() . "\n";
1308                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";
1309                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";
1310                 echo "</div>\n";
1311                 echo "</form>\n";
1312                 $this->pagefoot();
1313                 return;
1314         }
1315
1316     /**
1317      * @todo document this
1318      */
1319     function action_itemdeleteconfirm() {
1320         global $member;
1321
1322         $itemid = intRequestVar('itemid');
1323
1324         // only allow if user is allowed to alter item
1325         $member->canAlterItem($itemid) or $this->disallow();
1326
1327         // get blogid first
1328         $blogid = getBlogIdFromItemId($itemid);
1329
1330         // delete item (note: some checks will be performed twice)
1331         $this->deleteOneItem($itemid);
1332
1333         $this->action_itemlist($blogid);
1334     }
1335
1336     /**
1337      * Deletes one item and returns error if something goes wrong
1338      * @param int $itemid
1339      */
1340     function deleteOneItem($itemid) {
1341         global $member, $manager;
1342
1343         // only allow if user is allowed to alter item (also checks if itemid exists)
1344         if (!$member->canAlterItem($itemid))
1345             return _ERROR_DISALLOWED;
1346
1347         // need to get blogid before the item is deleted
1348         $blogid = getBlogIDFromItemId($itemid);
1349
1350         $manager->loadClass('ITEM');
1351         ITEM::delete($itemid);
1352
1353         // update blog's futureposted
1354         $this->updateFuturePosted($blogid);
1355     }
1356
1357         /**
1358          * ADMIN::updateFuturePosted()
1359          * Update a blog's future posted flag
1360          *
1361          * @param integer $blogid
1362          * @return      void
1363          *
1364          */
1365         function updateFuturePosted($blogid)
1366         {
1367                 global $manager;
1368
1369                 $blog =& $manager->getBlog($blogid);
1370                 $currenttime = $blog->getCorrectTime(time());
1371
1372                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1373                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1374                 $result = sql_query($query);
1375
1376                 if ( sql_num_rows($result) > 0 )
1377                 {
1378                         $blog->setFuturePost();
1379                 }
1380                 else
1381                 {
1382                         $blog->clearFuturePost();
1383                 }
1384                 return;
1385         }
1386
1387     /**
1388      * @todo document this
1389      */
1390     function action_itemmove() {
1391         global $member, $manager;
1392
1393         $itemid = intRequestVar('itemid');
1394
1395         // only allow if user is allowed to alter item
1396         $member->canAlterItem($itemid) or $this->disallow();
1397
1398         $item =& $manager->getItem($itemid,1,1);
1399
1400         $this->pagehead();
1401         ?>
1402             <h2><?php echo _MOVE_TITLE?></h2>
1403             <form method="post" action="index.php"><div>
1404                 <input type="hidden" name="action" value="itemmoveto" />
1405                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1406
1407                 <?php
1408
1409                     $manager->addTicketHidden();
1410                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1411                 ?>
1412
1413                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1414             </div></form>
1415         <?php
1416         $this->pagefoot();
1417     }
1418
1419     /**
1420      * @todo document this
1421      */
1422     function action_itemmoveto() {
1423         global $member, $manager;
1424
1425         $itemid = intRequestVar('itemid');
1426         $catid = requestVar('catid');
1427
1428         // create new category if needed
1429         if (strstr($catid,'newcat')) {
1430             // get blogid
1431             list($blogid) = sscanf($catid,'newcat-%d');
1432
1433             // create
1434             $blog =& $manager->getBlog($blogid);
1435             $catid = $blog->createNewCategory();
1436
1437             // show error when sth goes wrong
1438             if (!$catid)
1439                 $this->doError(_ERROR_CATCREATEFAIL);
1440         }
1441
1442         // only allow if user is allowed to alter item
1443         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1444
1445         $old_blogid = getBlogIDFromItemId($itemid);
1446
1447         ITEM::move($itemid, $catid);
1448
1449         // set the futurePosted flag on the blog
1450         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1451
1452         // reset the futurePosted in case the item is moved from one blog to another
1453         $this->updateFuturePosted($old_blogid);
1454
1455         if ($catid != intRequestVar('catid'))
1456             $this->action_categoryedit($catid, $blog->getID());
1457         else
1458             $this->action_itemlist(getBlogIDFromCatID($catid));
1459     }
1460
1461     /**
1462      * Moves one item to a given category (category existance should be checked by caller)
1463      * errors are returned
1464      * @param int $itemid
1465      * @param int $destCatid category ID to which the item will be moved
1466      */
1467     function moveOneItem($itemid, $destCatid) {
1468         global $member;
1469
1470         // only allow if user is allowed to move item
1471         if (!$member->canUpdateItem($itemid, $destCatid))
1472             return _ERROR_DISALLOWED;
1473
1474         ITEM::move($itemid, $destCatid);
1475     }
1476
1477     /**
1478      * Adds a item to the chosen blog
1479      */
1480     function action_additem() {
1481         global $manager, $CONF;
1482
1483         $manager->loadClass('ITEM');
1484
1485         $result = ITEM::createFromRequest();
1486
1487         if ($result['status'] == 'error')
1488             $this->error($result['message']);
1489
1490         $blogid = getBlogIDFromItemID($result['itemid']);
1491         $blog =& $manager->getBlog($blogid);
1492         $btimestamp = $blog->getCorrectTime();
1493         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1494
1495         if ($result['status'] == 'newcategory') {
1496             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1497             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1498         } else {
1499             $methodName = 'action_itemList';
1500             call_user_func(array(&$this, $methodName), $blogid);
1501         }
1502     }
1503
1504         /**
1505          * Allows to edit previously made comments
1506          **/
1507         function action_commentedit() {
1508
1509                 global $member, $manager;
1510
1511                 $commentid = intRequestVar('commentid');
1512
1513                 $member->canAlterComment($commentid) or $this->disallow();
1514
1515                 $comment = COMMENT::getComment($commentid);
1516
1517                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1518
1519                 // change <br /> to \n
1520                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1521
1522                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1523                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1524
1525         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1526
1527         $this->pagehead();
1528
1529         ?>
1530         <h2><?php echo _EDITC_TITLE?></h2>
1531
1532         <form action="index.php" method="post"><div>
1533
1534         <input type="hidden" name="action" value="commentupdate" />
1535         <?php $manager->addTicketHidden(); ?>
1536         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1537         <table><tr>
1538             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1539         </tr><tr>
1540             <td><?php echo _EDITC_WHO?></td>
1541             <td>
1542             <?php               if ($comment['member'])
1543                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1544                 else
1545                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1546             ?>
1547             </td>
1548         </tr><tr>
1549             <td><?php echo _EDITC_WHEN?></td>
1550             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1551         </tr><tr>
1552             <td><?php echo _EDITC_HOST?></td>
1553             <td><?php echo  $comment['host']; ?></td>
1554         </tr>
1555         <tr>
1556             <td><?php echo _EDITC_URL; ?></td>
1557             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1558         </tr>
1559         <tr>
1560             <td><?php echo _EDITC_EMAIL; ?></td>
1561             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1562         </tr>
1563         <tr>
1564             <td><?php echo _EDITC_TEXT?></td>
1565             <td>
1566                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1567                     echo $comment['body'];
1568                 ?></textarea>
1569             </td>
1570         </tr><tr>
1571             <td><?php echo _EDITC_EDIT?></td>
1572             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1573         </tr></table>
1574
1575         </div></form>
1576         <?php
1577         $this->pagefoot();
1578     }
1579
1580     /**
1581      * @todo document this
1582      */
1583     function action_commentupdate() {
1584         global $member, $manager;
1585
1586         $commentid = intRequestVar('commentid');
1587
1588         $member->canAlterComment($commentid) or $this->disallow();
1589
1590         $url = postVar('url');
1591         $email = postVar('email');
1592         $body = postVar('body');
1593
1594                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1595                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1596                 # important note that '\' must be matched with '\\\\' in preg* expressions
1597
1598                 // intercept words that are too long
1599                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1600                 {
1601                         $this->error(_ERROR_COMMENT_LONGWORD);
1602                 }
1603
1604                 // check length
1605                 if (i18n::strlen($body) < 3)
1606                 {
1607                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1608                 }
1609
1610                 if (i18n::strlen($body) > 5000)
1611                 {
1612                         $this->error(_ERROR_COMMENT_TOOLONG);
1613                 }
1614
1615         // prepare body
1616         $body = COMMENT::prepareBody($body);
1617
1618         // call plugins
1619         $manager->notify('PreUpdateComment',array('body' => &$body));
1620
1621         $query = 'UPDATE ' . sql_table('comment')
1622                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1623                . " WHERE cnumber = " . $commentid;
1624         sql_query($query);
1625
1626         // get itemid
1627         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1628         $o = sql_fetch_object($res);
1629         $itemid = $o->citem;
1630
1631         if ($member->canAlterItem($itemid))
1632             $this->action_itemcommentlist($itemid);
1633         else
1634             $this->action_browseowncomments();
1635
1636     }
1637
1638         /**
1639          * ADMIN::action_commentdelete()
1640          * Update comment
1641          *
1642          * @param       Void
1643          * @return      Void
1644          */
1645         function action_commentdelete()
1646         {
1647                 global $member, $manager;
1648
1649                 $commentid = intRequestVar('commentid');
1650                 $member->canAlterComment($commentid) or $this->disallow();
1651                 $comment = COMMENT::getComment($commentid);
1652
1653                 $body = strip_tags($comment['body']);
1654                 $body = ENTITY::hsc(ENTITY::shorten($body, 300, '...'));
1655
1656                 if ( $comment['member'] )
1657                 {
1658                         $author = $comment['member'];
1659                 }
1660                 else
1661                 {
1662                         $author = $comment['user'];
1663                 }
1664
1665                 $this->pagehead();
1666
1667                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1668                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";
1669                 echo "<div class=\"note\">\n";
1670                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";
1671                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";
1672                 echo "</div>\n";
1673                 echo "<form method=\"post\" action=\"index.php\">\n";
1674                 echo "<div>\n";
1675                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";
1676                 echo $manager->addTicketHidden() . "\n";
1677                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";
1678                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";
1679                 echo "</div>\n";
1680                 echo "</form>\n";
1681                 $this->pagefoot();
1682                 return;
1683         }
1684
1685     /**
1686      * @todo document this
1687      */
1688     function action_commentdeleteconfirm() {
1689         global $member;
1690
1691         $commentid = intRequestVar('commentid');
1692
1693         // get item id first
1694         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1695         $o = sql_fetch_object($res);
1696         $itemid = $o->citem;
1697
1698         $error = $this->deleteOneComment($commentid);
1699         if ($error)
1700             $this->doError($error);
1701
1702         if ($member->canAlterItem($itemid))
1703             $this->action_itemcommentlist($itemid);
1704         else
1705             $this->action_browseowncomments();
1706     }
1707
1708     /**
1709      * @todo document this
1710      */
1711     function deleteOneComment($commentid) {
1712         global $member, $manager;
1713
1714         $commentid = intval($commentid);
1715
1716         if (!$member->canAlterComment($commentid))
1717             return _ERROR_DISALLOWED;
1718
1719         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1720
1721         // delete the comments associated with the item
1722         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1723         sql_query($query);
1724
1725         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1726
1727         return '';
1728     }
1729
1730     /**
1731      * Usermanagement main
1732      */
1733     function action_usermanagement() {
1734         global $member, $manager;
1735
1736         // check if allowed
1737         $member->isAdmin() or $this->disallow();
1738
1739         $this->pagehead();
1740
1741         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1742
1743         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1744
1745         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1746
1747         // show list of members with actions
1748         $query =  'SELECT *'
1749                . ' FROM '.sql_table('member');
1750         $template['content'] = 'memberlist';
1751         $template['tabindex'] = 10;
1752
1753         $manager->loadClass("ENCAPSULATE");
1754         $batch = new BATCH('member');
1755         $batch->showlist($query,'table',$template);
1756
1757         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1758         ?>
1759             <form method="post" action="index.php" name="memberedit"><div>
1760
1761             <input type="hidden" name="action" value="memberadd" />
1762             <?php $manager->addTicketHidden() ?>
1763
1764             <table>
1765             <tr>
1766                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1767             </tr><tr>
1768                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1769                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1770                 </td>
1771                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1772             </tr><tr>
1773                 <td><?php echo _MEMBERS_REALNAME?></td>
1774                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1775             </tr><tr>
1776                 <td><?php echo _MEMBERS_PWD?></td>
1777                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1778             </tr><tr>
1779                 <td><?php echo _MEMBERS_REPPWD?></td>
1780                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1781             </tr><tr>
1782                 <td><?php echo _MEMBERS_EMAIL?></td>
1783                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1784             </tr><tr>
1785                 <td><?php echo _MEMBERS_URL?></td>
1786                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1787             </tr><tr>
1788                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1789                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1790             </tr><tr>
1791                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1792                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1793             </tr><tr>
1794                 <td><?php echo _MEMBERS_NOTES?></td>
1795                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1796             </tr><tr>
1797                 <td><?php echo _MEMBERS_NEW?></td>
1798                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1799             </tr></table>
1800
1801             </div></form>
1802         <?php
1803         $this->pagefoot();
1804     }
1805
1806     /**
1807      * Edit member settings
1808      */
1809     function action_memberedit() {
1810         $this->action_editmembersettings(intRequestVar('memberid'));
1811     }
1812
1813         /**
1814          * @todo document this
1815          */
1816         function action_editmembersettings($memberid = '') {
1817                 global $member, $manager, $CONF;
1818
1819                 if ($memberid == '')
1820                 {
1821                         $memberid = $member->getID();
1822                 }
1823
1824                 // check if allowed
1825                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1826
1827                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1828                 $this->pagehead($extrahead);
1829
1830                 // show message to go back to member overview (only for admins)
1831                 if ($member->isAdmin())
1832                 {
1833                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1834                 }
1835                 else
1836                 {
1837                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1838                 }
1839                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1840
1841                 $mem = MEMBER::createFromID($memberid);
1842                 ?>
1843                 <form method="post" action="index.php" name="memberedit"><div>
1844
1845                 <input type="hidden" name="action" value="changemembersettings" />
1846                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1847                 <?php $manager->addTicketHidden() ?>
1848
1849                 <table><tr>
1850                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1851                 </tr><tr>
1852                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1853                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1854                         </td>
1855                         <td>
1856                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1857                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  ENTITY::hsc($mem->getDisplayName()); ?>" />
1858                         <?php } else {
1859                                 echo ENTITY::hsc($member->getDisplayName());
1860                            }
1861                         ?>
1862                         </td>
1863                 </tr><tr>
1864                         <td><?php echo _MEMBERS_REALNAME?></td>
1865                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  ENTITY::hsc($mem->getRealName()); ?>" /></td>
1866                 </tr><tr>
1867                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1868                         <td><?php echo _MEMBERS_PWD?></td>
1869                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1870                 </tr><tr>
1871                         <td><?php echo _MEMBERS_REPPWD?></td>
1872                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1873                 <?php } ?>
1874                 </tr><tr>
1875                         <td><?php echo _MEMBERS_EMAIL?>
1876                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1877                         </td>
1878                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($mem->getEmail()); ?>" /></td>
1879                 </tr><tr>
1880                         <td><?php echo _MEMBERS_URL?></td>
1881                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getURL()); ?>" /></td>
1882                 <?php // only allow to change this by super-admins
1883                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1884                    if ($member->isAdmin()) {
1885                 ?>
1886                         </tr><tr>
1887                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1888                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1889                         </tr><tr>
1890                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1891                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1892                 <?php } ?>
1893                 </tr><tr>
1894                         <td><?php echo _MEMBERS_NOTES?></td>
1895                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getNotes()); ?>" /></td>
1896                 </tr><tr>
1897                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>
1898                         </td>
1899                         <td>
1900
1901                                 <select name="locale" tabindex="85">
1902                                 <?php
1903                                 $locales = i18n::get_available_locale_list();
1904                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1905                                 {
1906                                         echo "<option value=\"\" selected=\"selected\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1907                                 }
1908                                 else
1909                                 {
1910                                         echo "<option value=\"\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1911                                 }
1912
1913                                 foreach( $locales as $locale )
1914                                 {
1915                                         if( $locale == $mem->getLocale() )
1916                                         {
1917                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1918                                         }
1919                                         else
1920                                         {
1921                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1922                                         }
1923                                 }
1924                                 ?>
1925                                 </select>
1926
1927                         </td>
1928                 </tr>
1929                 <tr>
1930                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1931                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1932                 </tr>
1933                 <?php
1934                         // plugin options
1935                         $this->_insertPluginOptions('member',$memberid);
1936                 ?>
1937                 <tr>
1938                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1939                 </tr><tr>
1940                         <td><?php echo _MEMBERS_EDIT?></td>
1941                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1942                 </tr></table>
1943
1944                 </div></form>
1945
1946                 <?php
1947                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1948
1949                         $manager->notify(
1950                                 'MemberSettingsFormExtras',
1951                                 array(
1952                                         'member' => &$mem
1953                                 )
1954                         );
1955                 $this->pagefoot();
1956         }
1957
1958     /**
1959      * @todo document this
1960      */
1961     function action_changemembersettings() {
1962         global $member, $CONF, $manager;
1963
1964         $memberid = intRequestVar('memberid');
1965
1966         // check if allowed
1967         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1968
1969         $name           = trim(strip_tags(postVar('name')));
1970         $realname       = trim(strip_tags(postVar('realname')));
1971         $password       = postVar('password');
1972         $repeatpassword = postVar('repeatpassword');
1973         $email          = strip_tags(postVar('email'));
1974         $url            = strip_tags(postVar('url'));
1975
1976                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1977                 # original eregi: !eregi("^https?://", $url)
1978
1979                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1980                 if (!preg_match('#^https?://#', $url) )
1981                 {
1982                         $url = 'http://' . $url;
1983                 }
1984
1985         $admin          = postVar('admin');
1986         $canlogin       = postVar('canlogin');
1987         $notes          = strip_tags(postVar('notes'));
1988         $locale        = postVar('locale');
1989
1990         $mem = MEMBER::createFromID($memberid);
1991
1992         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1993
1994             if (!isValidDisplayName($name))
1995                 $this->error(_ERROR_BADNAME);
1996
1997             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1998                 $this->error(_ERROR_NICKNAMEINUSE);
1999
2000             if ($password != $repeatpassword)
2001                 $this->error(_ERROR_PASSWORDMISMATCH);
2002
2003             if ($password && (i18n::strlen($password) < 6))
2004                 $this->error(_ERROR_PASSWORDTOOSHORT);
2005
2006             if ($password) {
2007                                 $pwdvalid = true;
2008                                 $pwderror = '';
2009                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2010                                 if (!$pwdvalid) {
2011                                         $this->error($pwderror);
2012                                 }
2013                         }
2014                 }
2015
2016                 if ( !NOTIFICATION::address_validation($email) )
2017                 {
2018                         $this->error(_ERROR_BADMAILADDRESS);
2019                 }
2020                 if ( !$realname )
2021                 {
2022                         $this->error(_ERROR_REALNAMEMISSING);
2023                 }
2024         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2025             $this->error(_ERROR_NOSUCHTRANSLATION);
2026
2027         // check if there will remain at least one site member with both the logon and admin rights
2028         // (check occurs when taking away one of these rights from such a member)
2029         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2030              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2031            )
2032         {
2033             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2034             if (sql_num_rows($r) < 2)
2035                 $this->error(_ERROR_ATLEASTONEADMIN);
2036         }
2037
2038         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2039             $mem->setDisplayName($name);
2040             if ($password)
2041                 $mem->setPassword($password);
2042         }
2043
2044         $oldEmail = $mem->getEmail();
2045
2046         $mem->setRealName($realname);
2047         $mem->setEmail($email);
2048         $mem->setURL($url);
2049         $mem->setNotes($notes);
2050         $mem->setLocale($locale);
2051
2052
2053         // only allow super-admins to make changes to the admin status
2054         if ($member->isAdmin()) {
2055             $mem->setAdmin($admin);
2056             $mem->setCanLogin($canlogin);
2057         }
2058
2059         $autosave = postVar ('autosave');
2060         $mem->setAutosave($autosave);
2061
2062         $mem->write();
2063
2064         // store plugin options
2065         $aOptions = requestArray('plugoption');
2066         NucleusPlugin::apply_plugin_options($aOptions);
2067         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2068
2069         // if email changed, generate new password
2070         if ($oldEmail != $mem->getEmail())
2071         {
2072             $mem->sendActivationLink('addresschange', $oldEmail);
2073             // logout member
2074             $mem->newCookieKey();
2075
2076             // only log out if the member being edited is the current member.
2077             if ($member->getID() == $memberid)
2078                 $member->logout();
2079             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2080             return;
2081         }
2082
2083
2084         if (  ( $mem->getID() == $member->getID() )
2085            && ( $mem->getDisplayName() != $member->getDisplayName() )
2086            ) {
2087             $mem->newCookieKey();
2088             $member->logout();
2089             $this->action_login(_MSG_LOGINAGAIN, 0);
2090         } else {
2091             $this->action_overview(_MSG_SETTINGSCHANGED);
2092         }
2093     }
2094
2095     /**
2096      * @todo document this
2097      */
2098     function action_memberadd() {
2099         global $member, $manager;
2100
2101         // check if allowed
2102         $member->isAdmin() or $this->disallow();
2103
2104         if (postVar('password') != postVar('repeatpassword'))
2105             $this->error(_ERROR_PASSWORDMISMATCH);
2106         if (i18n::strlen(postVar('password')) < 6)
2107             $this->error(_ERROR_PASSWORDTOOSHORT);
2108
2109         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2110         if ($res != 1)
2111             $this->error($res);
2112
2113         // fire PostRegister event
2114         $newmem = new MEMBER();
2115         $newmem->readFromName(postVar('name'));
2116         $manager->notify('PostRegister',array('member' => &$newmem));
2117
2118         $this->action_usermanagement();
2119     }
2120
2121     /**
2122      * Account activation
2123      *
2124      * @author dekarma
2125      */
2126     function action_activate() {
2127
2128         $key = getVar('key');
2129         $this->_showActivationPage($key);
2130     }
2131
2132     /**
2133      * @todo document this
2134      */
2135     function _showActivationPage($key, $message = '')
2136     {
2137         global $manager;
2138
2139         // clean up old activation keys
2140         MEMBER::cleanupActivationTable();
2141
2142         // get activation info
2143         $info = MEMBER::getActivationInfo($key);
2144
2145         if (!$info)
2146             $this->error(_ERROR_ACTIVATE);
2147
2148         $mem = MEMBER::createFromId($info->vmember);
2149
2150         if (!$mem)
2151             $this->error(_ERROR_ACTIVATE);
2152
2153         $text = '';
2154         $title = '';
2155         $bNeedsPasswordChange = true;
2156
2157         switch ($info->vtype)
2158         {
2159             case 'forgot':
2160                 $title = _ACTIVATE_FORGOT_TITLE;
2161                 $text = _ACTIVATE_FORGOT_TEXT;
2162                 break;
2163             case 'register':
2164                 $title = _ACTIVATE_REGISTER_TITLE;
2165                 $text = _ACTIVATE_REGISTER_TEXT;
2166                 break;
2167             case 'addresschange':
2168                 $title = _ACTIVATE_CHANGE_TITLE;
2169                 $text = _ACTIVATE_CHANGE_TEXT;
2170                 $bNeedsPasswordChange = false;
2171                 MEMBER::activate($key);
2172                 break;
2173         }
2174
2175         $aVars = array(
2176             'memberName' => ENTITY::hsc($mem->getDisplayName())
2177         );
2178         $title = TEMPLATE::fill($title, $aVars);
2179         $text = TEMPLATE::fill($text, $aVars);
2180
2181         $this->pagehead();
2182
2183             echo '<h2>' , $title, '</h2>';
2184             echo '<p>' , $text, '</p>';
2185
2186             if ($message != '')
2187             {
2188                 echo '<p class="error">',$message,'</p>';
2189             }
2190
2191             if ($bNeedsPasswordChange)
2192             {
2193                 ?>
2194                     <div><form action="index.php" method="post">
2195
2196                         <input type="hidden" name="action" value="activatesetpwd" />
2197                         <?php $manager->addTicketHidden() ?>
2198                         <input type="hidden" name="key" value="<?php echo ENTITY::hsc($key) ?>" />
2199
2200                         <table><tr>
2201                             <td><?php echo _MEMBERS_PWD?></td>
2202                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2203                         </tr><tr>
2204                             <td><?php echo _MEMBERS_REPPWD?></td>
2205                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2206                         <?php
2207
2208                             global $manager;
2209                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2210
2211                         ?>
2212                         </tr><tr>
2213                             <td><?php echo _MEMBERS_SETPWD ?></td>
2214                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2215                         </tr></table>
2216
2217
2218                     </form></div>
2219
2220                 <?php
2221
2222             }
2223
2224         $this->pagefoot();
2225
2226     }
2227
2228     /**
2229      * Account activation - set password part
2230      *
2231      * @author dekarma
2232      */
2233     function action_activatesetpwd() {
2234
2235         $key = postVar('key');
2236
2237         // clean up old activation keys
2238         MEMBER::cleanupActivationTable();
2239
2240         // get activation info
2241         $info = MEMBER::getActivationInfo($key);
2242
2243         if (!$info || ($info->type == 'addresschange'))
2244             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2245
2246         $mem = MEMBER::createFromId($info->vmember);
2247
2248         if (!$mem)
2249             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2250
2251         $password       = postVar('password');
2252         $repeatpassword = postVar('repeatpassword');
2253
2254         if ($password != $repeatpassword)
2255             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2256
2257         if ($password && (i18n::strlen($password) < 6))
2258             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2259
2260         if ($password) {
2261                         $pwdvalid = true;
2262                         $pwderror = '';
2263                         global $manager;
2264                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2265                         if (!$pwdvalid) {
2266                                 return $this->_showActivationPage($key,$pwderror);
2267                         }
2268                 }
2269
2270         $error = '';
2271
2272         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2273         if ($error != '')
2274             return $this->_showActivationPage($key, $error);
2275
2276
2277         // set password
2278         $mem->setPassword($password);
2279         $mem->write();
2280
2281         // do the activation
2282         MEMBER::activate($key);
2283
2284         $this->pagehead();
2285             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2286             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2287         $this->pagefoot();
2288     }
2289
2290     /**
2291      * Manage team
2292      */
2293     function action_manageteam() {
2294         global $member, $manager;
2295
2296         $blogid = intRequestVar('blogid');
2297
2298         // check if allowed
2299         $member->blogAdminRights($blogid) or $this->disallow();
2300
2301         $this->pagehead();
2302
2303         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2304
2305         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2306
2307         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2308
2309
2310
2311         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2312                . ' FROM '.sql_table('member').', '.sql_table('team')
2313                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2314
2315         $template['content'] = 'teamlist';
2316         $template['tabindex'] = 10;
2317
2318         $manager->loadClass("ENCAPSULATE");
2319         $batch = new BATCH('team');
2320         $batch->showlist($query, 'table', $template);
2321
2322         ?>
2323             <h3><?php echo _TEAM_ADDNEW?></h3>
2324
2325             <form method='post' action='index.php'><div>
2326
2327             <input type='hidden' name='action' value='teamaddmember' />
2328             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2329             <?php $manager->addTicketHidden() ?>
2330
2331             <table><tr>
2332                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2333                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2334                     $query =  'SELECT mname as text, mnumber as value'
2335                            . ' FROM '.sql_table('member');
2336
2337                     $template['name'] = 'memberid';
2338                     $template['tabindex'] = 10000;
2339                     showlist($query,'select',$template);
2340                 ?></td>
2341             </tr><tr>
2342                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2343                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2344             </tr><tr>
2345                 <td><?php echo _TEAM_ADD?></td>
2346                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2347             </tr></table>
2348
2349             </div></form>
2350         <?php
2351         $this->pagefoot();
2352     }
2353
2354     /**
2355      * Add member to team
2356      */
2357     function action_teamaddmember() {
2358         global $member, $manager;
2359
2360         $memberid = intPostVar('memberid');
2361         $blogid = intPostVar('blogid');
2362         $admin = intPostVar('admin');
2363
2364         // check if allowed
2365         $member->blogAdminRights($blogid) or $this->disallow();
2366
2367         $blog =& $manager->getBlog($blogid);
2368         if (!$blog->addTeamMember($memberid, $admin))
2369             $this->error(_ERROR_ALREADYONTEAM);
2370
2371         $this->action_manageteam();
2372
2373     }
2374
2375     /**
2376      * @todo document this
2377      */
2378     function action_teamdelete() {
2379         global $member, $manager;
2380
2381         $memberid = intRequestVar('memberid');
2382         $blogid = intRequestVar('blogid');
2383
2384         // check if allowed
2385         $member->blogAdminRights($blogid) or $this->disallow();
2386
2387         $teammem = MEMBER::createFromID($memberid);
2388         $blog =& $manager->getBlog($blogid);
2389
2390         $this->pagehead();
2391         ?>
2392             <h2><?php echo _DELETE_CONFIRM?></h2>
2393
2394             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  ENTITY::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  ENTITY::hsc(strip_tags($blog->getName())) ?></b>
2395             </p>
2396
2397
2398             <form method="post" action="index.php"><div>
2399             <input type="hidden" name="action" value="teamdeleteconfirm" />
2400             <?php $manager->addTicketHidden() ?>
2401             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2402             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2403             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2404             </div></form>
2405         <?php
2406         $this->pagefoot();
2407     }
2408
2409     /**
2410      * @todo document this
2411      */
2412     function action_teamdeleteconfirm() {
2413         global $member;
2414
2415         $memberid = intRequestVar('memberid');
2416         $blogid = intRequestVar('blogid');
2417
2418         $error = $this->deleteOneTeamMember($blogid, $memberid);
2419         if ($error)
2420             $this->error($error);
2421
2422
2423         $this->action_manageteam();
2424     }
2425
2426     /**
2427      * @todo document this
2428      */
2429     function deleteOneTeamMember($blogid, $memberid) {
2430         global $member, $manager;
2431
2432         $blogid = intval($blogid);
2433         $memberid = intval($memberid);
2434
2435         // check if allowed
2436         if (!$member->blogAdminRights($blogid))
2437             return _ERROR_DISALLOWED;
2438
2439         // check if: - there remains at least one blog admin
2440         //           - (there remains at least one team member)
2441         $tmem = MEMBER::createFromID($memberid);
2442
2443         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2444
2445         if ($tmem->isBlogAdmin($blogid)) {
2446             // check if there are more blog members left and at least one admin
2447             // (check for at least two admins before deletion)
2448             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2449             $r = sql_query($query);
2450             if (sql_num_rows($r) < 2)
2451                 return _ERROR_ATLEASTONEBLOGADMIN;
2452         }
2453
2454         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2455         sql_query($query);
2456
2457         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2458
2459         return '';
2460     }
2461
2462     /**
2463      * @todo document this
2464      */
2465     function action_teamchangeadmin() {
2466         global $member;
2467
2468         $blogid = intRequestVar('blogid');
2469         $memberid = intRequestVar('memberid');
2470
2471         // check if allowed
2472         $member->blogAdminRights($blogid) or $this->disallow();
2473
2474         $mem = MEMBER::createFromID($memberid);
2475
2476         // don't allow when there is only one admin at this moment
2477         if ($mem->isBlogAdmin($blogid)) {
2478             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2479             if (sql_num_rows($r) == 1)
2480                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2481         }
2482
2483         if ($mem->isBlogAdmin($blogid))
2484             $newval = 0;
2485         else
2486             $newval = 1;
2487
2488         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2489         sql_query($query);
2490
2491         // only show manageteam if member did not change its own admin privileges
2492         if ($member->isBlogAdmin($blogid))
2493             $this->action_manageteam();
2494         else
2495             $this->action_overview(_MSG_ADMINCHANGED);
2496     }
2497
2498     /**
2499      * @todo document this
2500      */
2501     function action_blogsettings() {
2502         global $member, $manager;
2503
2504         $blogid = intRequestVar('blogid');
2505
2506         // check if allowed
2507         $member->blogAdminRights($blogid) or $this->disallow();
2508
2509         $blog =& $manager->getBlog($blogid);
2510
2511         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2512         $this->pagehead($extrahead);
2513
2514         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2515         ?>
2516         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2517
2518         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2519
2520         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2521         <?php
2522             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2523             $aMemberNames = array();
2524             while ($o = sql_fetch_object($res))
2525                 array_push($aMemberNames, ENTITY::hsc($o->mname) . ' (' . ENTITY::hsc($o->mrealname). ')');
2526             echo implode(',', $aMemberNames);
2527         ?>
2528         </p>
2529
2530
2531
2532         <p>
2533         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2534         </p>
2535
2536         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2537
2538         <form method="post" action="index.php"><div>
2539
2540         <input type="hidden" name="action" value="blogsettingsupdate" />
2541         <?php $manager->addTicketHidden() ?>
2542         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2543         <table><tr>
2544             <td><?php echo _EBLOG_NAME?></td>
2545             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getName()) ?>" /></td>
2546         </tr><tr>
2547             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2548                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2549             </td>
2550             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  ENTITY::hsc($blog->getShortName()) ?>" /></td>
2551         </tr><tr>
2552             <td><?php echo _EBLOG_DESC?></td>
2553             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  ENTITY::hsc($blog->getDescription()) ?>" /></td>
2554         </tr><tr>
2555             <td><?php echo _EBLOG_URL?></td>
2556             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($blog->getURL()) ?>" /></td>
2557         </tr><tr>
2558             <td><?php echo _EBLOG_DEFSKIN?>
2559                 <?php help('blogdefaultskin'); ?>
2560             </td>
2561             <td>
2562                 <?php
2563                     $query =  'SELECT sdname as text, sdnumber as value'
2564                            . ' FROM '.sql_table('skin_desc');
2565                     $template['name'] = 'defskin';
2566                     $template['selected'] = $blog->getDefaultSkin();
2567                     $template['tabindex'] = 50;
2568                     showlist($query,'select',$template);
2569                 ?>
2570
2571             </td>
2572         </tr><tr>
2573             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2574             </td>
2575             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2576         </tr><tr>
2577             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2578             </td>
2579             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2580         </tr><tr>
2581             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2582             </td>
2583             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2584         </tr><tr>
2585             <td><?php echo _EBLOG_ANONYMOUS?>
2586             </td>
2587             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2588         </tr><tr>
2589     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2590          </td>
2591          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2592       </tr><tr>
2593             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2594             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  ENTITY::hsc($blog->getNotifyAddress()); ?>" /></td>
2595         </tr><tr>
2596             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2597             <td>
2598                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2599                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2600                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2601                 <br />
2602                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2603                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2604                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2605                 <br />
2606                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2607                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2608                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2609             </td>
2610         </tr><tr>
2611             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2612             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  ENTITY::hsc($blog->getMaxComments()); ?>" /></td>
2613         </tr><tr>
2614             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2615             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getUpdateFile()) ?>" /></td>
2616         </tr><tr>
2617             <td><?php echo _EBLOG_DEFCAT?></td>
2618             <td>
2619                 <?php
2620                     $query =  'SELECT cname as text, catid as value'
2621                            . ' FROM '.sql_table('category')
2622                            . ' WHERE cblog=' . $blog->getID();
2623                     $template['name'] = 'defcat';
2624                     $template['selected'] = $blog->getDefaultCategory();
2625                     $template['tabindex'] = 110;
2626                     showlist($query,'select',$template);
2627                 ?>
2628             </td>
2629         </tr><tr>
2630             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2631                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2632                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2633                 </td>
2634             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  ENTITY::hsc($blog->getTimeOffset()); ?>" /></td>
2635         </tr><tr>
2636             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2637             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2638         </tr>
2639         <?php
2640             // plugin options
2641             $this->_insertPluginOptions('blog',$blogid);
2642         ?>
2643         <tr>
2644             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2645         </tr><tr>
2646             <td><?php echo _EBLOG_CHANGE?></td>
2647             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2648         </tr></table>
2649
2650         </div></form>
2651
2652         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2653
2654
2655         <?php
2656         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2657         $template['content'] = 'categorylist';
2658         $template['tabindex'] = 200;
2659
2660         $manager->loadClass("ENCAPSULATE");
2661         $batch = new BATCH('category');
2662         $batch->showlist($query,'table',$template);
2663
2664         ?>
2665
2666
2667         <form action="index.php" method="post"><div>
2668         <input name="action" value="categorynew" type="hidden" />
2669         <?php $manager->addTicketHidden() ?>
2670         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2671
2672         <table><tr>
2673             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2674         </tr><tr>
2675             <td><?php echo _EBLOG_CAT_NAME?></td>
2676             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2677         </tr><tr>
2678             <td><?php echo _EBLOG_CAT_DESC?></td>
2679             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2680         </tr><tr>
2681             <td><?php echo _EBLOG_CAT_CREATE?></td>
2682             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2683         </tr></table>
2684
2685         </div></form>
2686
2687         <?php
2688
2689             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2690
2691             $manager->notify(
2692                 'BlogSettingsFormExtras',
2693                 array(
2694                     'blog' => &$blog
2695                 )
2696             );
2697
2698         $this->pagefoot();
2699     }
2700
2701     /**
2702      * @todo document this
2703      */
2704     function action_categorynew() {
2705         global $member, $manager;
2706
2707         $blogid = intRequestVar('blogid');
2708
2709         $member->blogAdminRights($blogid) or $this->disallow();
2710
2711         $cname = postVar('cname');
2712         $cdesc = postVar('cdesc');
2713
2714         if (!isValidCategoryName($cname))
2715             $this->error(_ERROR_BADCATEGORYNAME);
2716
2717         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2718         $res = sql_query($query);
2719         if (sql_num_rows($res) > 0)
2720             $this->error(_ERROR_DUPCATEGORYNAME);
2721
2722         $blog       =& $manager->getBlog($blogid);
2723         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2724
2725         $this->action_blogsettings();
2726     }
2727
2728     /**
2729      * @todo document this
2730      */
2731     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2732         global $member, $manager;
2733
2734         if ($blogid == '')
2735             $blogid = intGetVar('blogid');
2736         else
2737             $blogid = intval($blogid);
2738         if ($catid == '')
2739             $catid = intGetVar('catid');
2740         else
2741             $catid = intval($catid);
2742
2743         $member->blogAdminRights($blogid) or $this->disallow();
2744
2745         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2746         $obj = sql_fetch_object($res);
2747
2748         $cname = $obj->cname;
2749         $cdesc = $obj->cdesc;
2750
2751         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2752         $this->pagehead($extrahead);
2753
2754         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2755
2756         ?>
2757         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo ENTITY::hsc($cname)?>'</h2>
2758         <form method='post' action='index.php'><div>
2759         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2760         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2761         <input name="desturl" type="hidden" value="<?php echo ENTITY::hsc($desturl) ?>" />
2762         <input name="action" type="hidden" value="categoryupdate" />
2763         <?php $manager->addTicketHidden(); ?>
2764
2765         <table><tr>
2766             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2767         </tr><tr>
2768             <td><?php echo _EBLOG_CAT_NAME?></td>
2769             <td><input type="text" name="cname" value="<?php echo ENTITY::hsc($cname)?>" size="40" maxlength="40" /></td>
2770         </tr><tr>
2771             <td><?php echo _EBLOG_CAT_DESC?></td>
2772             <td><input type="text" name="cdesc" value="<?php echo ENTITY::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2773         </tr>
2774         <?php
2775             // insert plugin options
2776             $this->_insertPluginOptions('category',$catid);
2777         ?>
2778         <tr>
2779             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2780         </tr><tr>
2781             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2782             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2783         </tr></table>
2784
2785         </div></form>
2786         <?php
2787         $this->pagefoot();
2788     }
2789
2790     /**
2791      * @todo document this
2792      */
2793     function action_categoryupdate() {
2794         global $member, $manager;
2795
2796         $blogid = intPostVar('blogid');
2797         $catid = intPostVar('catid');
2798         $cname = postVar('cname');
2799         $cdesc = postVar('cdesc');
2800         $desturl = postVar('desturl');
2801
2802         $member->blogAdminRights($blogid) or $this->disallow();
2803
2804         if (!isValidCategoryName($cname))
2805             $this->error(_ERROR_BADCATEGORYNAME);
2806
2807         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2808         $res = sql_query($query);
2809         if (sql_num_rows($res) > 0)
2810             $this->error(_ERROR_DUPCATEGORYNAME);
2811
2812         $query =  'UPDATE '.sql_table('category').' SET'
2813                . " cname='" . sql_real_escape_string($cname) . "',"
2814                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2815                . " WHERE catid=" . $catid;
2816
2817         sql_query($query);
2818
2819         // store plugin options
2820         $aOptions = requestArray('plugoption');
2821         NucleusPlugin::apply_plugin_options($aOptions);
2822         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2823
2824
2825         if ($desturl) {
2826             redirect($desturl);
2827             exit;
2828         } else {
2829             $this->action_blogsettings();
2830         }
2831     }
2832
2833     /**
2834      * @todo document this
2835      */
2836     function action_categorydelete() {
2837         global $member, $manager;
2838
2839         $blogid = intRequestVar('blogid');
2840         $catid = intRequestVar('catid');
2841
2842         $member->blogAdminRights($blogid) or $this->disallow();
2843
2844         $blog =& $manager->getBlog($blogid);
2845
2846         // check if the category is valid
2847         if (!$blog->isValidCategory($catid))
2848             $this->error(_ERROR_NOSUCHCATEGORY);
2849
2850         // don't allow deletion of default category
2851         if ($blog->getDefaultCategory() == $catid)
2852             $this->error(_ERROR_DELETEDEFCATEGORY);
2853
2854         // check if catid is the only category left for blogid
2855         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2856         $res = sql_query($query);
2857         if (sql_num_rows($res) == 1)
2858             $this->error(_ERROR_DELETELASTCATEGORY);
2859
2860
2861         $this->pagehead();
2862         ?>
2863             <h2><?php echo _DELETE_CONFIRM?></h2>
2864
2865             <div>
2866             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  ENTITY::hsc($blog->getCategoryName($catid))?></b>
2867             </div>
2868
2869             <form method="post" action="index.php"><div>
2870             <input type="hidden" name="action" value="categorydeleteconfirm" />
2871             <?php $manager->addTicketHidden() ?>
2872             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2873             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2874             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2875             </div></form>
2876         <?php
2877         $this->pagefoot();
2878     }
2879
2880     /**
2881      * @todo document this
2882      */
2883     function action_categorydeleteconfirm() {
2884         global $member, $manager;
2885
2886         $blogid = intRequestVar('blogid');
2887         $catid = intRequestVar('catid');
2888
2889         $member->blogAdminRights($blogid) or $this->disallow();
2890
2891         $error = $this->deleteOneCategory($catid);
2892         if ($error)
2893             $this->error($error);
2894
2895         $this->action_blogsettings();
2896     }
2897
2898         /**
2899          * ADMIN::deleteOneCategory()
2900          * Delete a category by its id
2901          *
2902          * @param       String  $catid  category id for deleting
2903          * @return      Void
2904          */
2905         function deleteOneCategory($catid)
2906         {
2907                 global $manager, $member;
2908
2909                 $catid = intval($catid);
2910                 $blogid = getBlogIDFromCatID($catid);
2911
2912                 if ( !$member->blogAdminRights($blogid) )
2913                 {
2914                         return ERROR_DISALLOWED;
2915                 }
2916
2917                 // get blog
2918                 $blog =& $manager->getBlog($blogid);
2919
2920                 // check if the category is valid
2921                 if ( !$blog || !$blog->isValidCategory($catid) )
2922                 {
2923                         return _ERROR_NOSUCHCATEGORY;
2924                 }
2925
2926                 $destcatid = $blog->getDefaultCategory();
2927
2928                 // don't allow deletion of default category
2929                 if ( $blog->getDefaultCategory() == $catid )
2930                 {
2931                         return _ERROR_DELETEDEFCATEGORY;
2932                 }
2933
2934                 // check if catid is the only category left for blogid
2935                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2936                 $res = sql_query($query);
2937                 if ( sql_num_rows($res) == 1 )
2938                 {
2939                         return _ERROR_DELETELASTCATEGORY;
2940                 }
2941
2942                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2943
2944                 // change category for all items to the default category
2945                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2946                 sql_query($query);
2947
2948                 // delete all associated plugin options
2949                 NucleusPlugin::delete_option_values('category', $catid);
2950
2951                 // delete category
2952                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2953                 sql_query($query);
2954
2955                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2956                 return;
2957         }
2958
2959         /**
2960          * ADMIN::action_blogsettingsupdate
2961          * Updating blog settings
2962          *
2963          * @param       Void
2964          * @return      Void
2965          */
2966         function action_blogsettingsupdate()
2967         {
2968                 global $member, $manager;
2969
2970                 $blogid = intRequestVar('blogid');
2971
2972                 $member->blogAdminRights($blogid) or $this->disallow();
2973
2974                 $blog =& $manager->getBlog($blogid);
2975
2976                 $notify_address = trim(postVar('notify'));
2977                 $shortname              = trim(postVar('shortname'));
2978                 $updatefile     = trim(postVar('update'));
2979
2980                 $notifyComment  = intPostVar('notifyComment');
2981                 $notifyVote             = intPostVar('notifyVote');
2982                 $notifyNewItem  = intPostVar('notifyNewItem');
2983
2984                 if ( $notifyComment == 0 )
2985                 {
2986                         $notifyComment = 1;
2987                 }
2988                 if ( $notifyVote == 0 )
2989                 {
2990                         $notifyVote = 1;
2991                 }
2992                 if ( $notifyNewItem == 0 )
2993                 {
2994                         $notifyNewItem = 1;
2995                 }
2996                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2997
2998                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2999                 {
3000                         $this->error(_ERROR_BADNOTIFY);
3001                 }
3002
3003                 if ( !isValidShortName($shortname) )
3004                 {
3005                         $this->error(_ERROR_BADSHORTBLOGNAME);
3006                 }
3007
3008                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
3009                 {
3010                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3011                 }
3012                 // check if update file is writable
3013                 if ( $updatefile && !is_writeable($updatefile) )
3014                 {
3015                         $this->error(_ERROR_UPDATEFILE);
3016                 }
3017
3018                 $blog->setName(trim(postVar('name')));
3019                 $blog->setShortName($shortname);
3020                 $blog->setNotifyAddress($notify_address);
3021                 $blog->setNotifyType($notifyType);
3022                 $blog->setMaxComments(postVar('maxcomments'));
3023                 $blog->setCommentsEnabled(postVar('comments'));
3024                 $blog->setTimeOffset(postVar('timeoffset'));
3025                 $blog->setUpdateFile($updatefile);
3026                 $blog->setURL(trim(postVar('url')));
3027                 $blog->setDefaultSkin(intPostVar('defskin'));
3028                 $blog->setDescription(trim(postVar('desc')));
3029                 $blog->setPublic(postVar('public'));
3030                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3031                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3032                 $blog->setDefaultCategory(intPostVar('defcat'));
3033                 $blog->setSearchable(intPostVar('searchable'));
3034                 $blog->setEmailRequired(intPostVar('reqemail'));
3035                 $blog->writeSettings();
3036
3037                 // store plugin options
3038                 $aOptions = requestArray('plugoption');
3039                 NucleusPlugin::apply_plugin_options($aOptions);
3040                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3041
3042                 $this->action_overview(_MSG_SETTINGSCHANGED);
3043                 return;
3044         }
3045
3046     /**
3047      * @todo document this
3048      */
3049     function action_deleteblog() {
3050         global $member, $CONF, $manager;
3051
3052         $blogid = intRequestVar('blogid');
3053
3054         $member->blogAdminRights($blogid) or $this->disallow();
3055
3056         // check if blog is default blog
3057         if ($CONF['DefaultBlog'] == $blogid)
3058             $this->error(_ERROR_DELDEFBLOG);
3059
3060         $blog =& $manager->getBlog($blogid);
3061
3062         $this->pagehead();
3063         ?>
3064             <h2><?php echo _DELETE_CONFIRM?></h2>
3065
3066             <p><?php echo _WARNINGTXT_BLOGDEL?>
3067             </p>
3068
3069             <div>
3070             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  ENTITY::hsc($blog->getName())?></b>
3071             </div>
3072
3073             <form method="post" action="index.php"><div>
3074             <input type="hidden" name="action" value="deleteblogconfirm" />
3075             <?php $manager->addTicketHidden() ?>
3076             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3077             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3078             </div></form>
3079         <?php
3080         $this->pagefoot();
3081     }
3082
3083         /**
3084          * ADMIN::action_deleteblogconfirm()
3085          * Delete Blog
3086          *
3087          * @param       Void
3088          * @return      Void
3089          */
3090         function action_deleteblogconfirm()
3091         {
3092                 global $member, $CONF, $manager;
3093
3094                 $blogid = intRequestVar('blogid');
3095                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3096                 $member->blogAdminRights($blogid) or $this->disallow();
3097
3098                 // check if blog is default blog
3099                 if ( $CONF['DefaultBlog'] == $blogid )
3100                 {
3101                         $this->error(_ERROR_DELDEFBLOG);
3102                 }
3103
3104                 // delete all comments
3105                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3106                 sql_query($query);
3107
3108                 // delete all items
3109                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3110                 sql_query($query);
3111
3112                 // delete all team members
3113                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3114                 sql_query($query);
3115
3116                 // delete all bans
3117                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3118                 sql_query($query);
3119
3120                 // delete all categories
3121                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3122                 sql_query($query);
3123
3124                 // delete all associated plugin options
3125                 NucleusPlugin::delete_option_values('blog', $blogid);
3126
3127                 // delete the blog itself
3128                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3129                 sql_query($query);
3130
3131                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3132
3133                 $this->action_overview(_DELETED_BLOG);
3134                 return;
3135         }
3136
3137     /**
3138      * @todo document this
3139      */
3140     function action_memberdelete() {
3141         global $member, $manager;
3142
3143         $memberid = intRequestVar('memberid');
3144
3145         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3146
3147         $mem = MEMBER::createFromID($memberid);
3148
3149         $this->pagehead();
3150         ?>
3151             <h2><?php echo _DELETE_CONFIRM?></h2>
3152
3153             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo ENTITY::hsc($mem->getDisplayName()) ?></b>
3154             </p>
3155
3156             <p>
3157             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3158             </p>
3159
3160             <form method="post" action="index.php"><div>
3161             <input type="hidden" name="action" value="memberdeleteconfirm" />
3162             <?php $manager->addTicketHidden() ?>
3163             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3164             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3165             </div></form>
3166         <?php
3167         $this->pagefoot();
3168     }
3169
3170     /**
3171      * @todo document this
3172      */
3173     function action_memberdeleteconfirm() {
3174         global $member;
3175
3176         $memberid = intRequestVar('memberid');
3177
3178         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3179
3180         $error = $this->deleteOneMember($memberid);
3181         if ($error)
3182             $this->error($error);
3183
3184         if ($member->isAdmin())
3185             $this->action_usermanagement();
3186         else
3187             $this->action_overview(_DELETED_MEMBER);
3188     }
3189
3190         /**
3191          * ADMIN::deleteOneMember()
3192          * Delete a member by id
3193          *
3194          * @static
3195          * @params      Integer $memberid       member id
3196          * @return      String  null string or error messages
3197          */
3198         function deleteOneMember($memberid)
3199         {
3200                 global $manager;
3201
3202                 $memberid = intval($memberid);
3203                 $mem = MEMBER::createFromID($memberid);
3204
3205                 if ( !$mem->canBeDeleted() )
3206                 {
3207                         return _ERROR_DELETEMEMBER;
3208                 }
3209
3210                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3211
3212                 /* unlink comments from memberid */
3213                 if ( $memberid )
3214                 {
3215                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3216                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3217                         sql_query($query);
3218                 }
3219
3220                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3221                 sql_query($query);
3222
3223                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3224                 sql_query($query);
3225
3226                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3227                 sql_query($query);
3228
3229                 // delete all associated plugin options
3230                 NucleusPlugin::delete_option_values('member', $memberid);
3231
3232                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3233
3234                 return '';
3235         }
3236
3237     /**
3238      * @todo document this
3239      */
3240     function action_createnewlog() {
3241         global $member, $CONF, $manager;
3242
3243         // Only Super-Admins can do this
3244         $member->isAdmin() or $this->disallow();
3245
3246         $this->pagehead();
3247
3248         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3249         ?>
3250         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3251
3252         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3253
3254         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3255
3256         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3257
3258         <ol>
3259             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3260             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3261         </ol>
3262
3263         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3264
3265         <p>
3266         <?php echo _EBLOG_CREATE_TEXT?>
3267         </p>
3268
3269         <form method="post" action="index.php"><div>
3270
3271         <input type="hidden" name="action" value="addnewlog" />
3272         <?php $manager->addTicketHidden() ?>
3273
3274
3275         <table><tr>
3276             <td><?php echo _EBLOG_NAME?></td>
3277             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3278         </tr><tr>
3279             <td><?php echo _EBLOG_SHORTNAME?>
3280                 <?php help('shortblogname'); ?>
3281             </td>
3282             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3283         </tr><tr>
3284             <td><?php echo _EBLOG_DESC?></td>
3285             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3286         </tr><tr>
3287             <td><?php echo _EBLOG_DEFSKIN?>
3288                 <?php help('blogdefaultskin'); ?>
3289             </td>
3290             <td>
3291                 <?php
3292                     $query =  'SELECT sdname as text, sdnumber as value'
3293                            . ' FROM '.sql_table('skin_desc');
3294                     $template['name'] = 'defskin';
3295                     $template['tabindex'] = 50;
3296                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3297                     showlist($query,'select',$template);
3298                 ?>
3299             </td>
3300         </tr><tr>
3301             <td><?php echo _EBLOG_OFFSET?>
3302                 <?php help('blogtimeoffset'); ?>
3303                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3304             </td>
3305             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3306         </tr><tr>
3307             <td><?php echo _EBLOG_ADMIN?>
3308                 <?php help('teamadmin'); ?>
3309             </td>
3310             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3311         </tr><tr>
3312             <td><?php echo _EBLOG_CREATE?></td>
3313             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3314         </tr></table>
3315
3316         </div></form>
3317         <?php
3318         $this->pagefoot();
3319     }
3320
3321     /**
3322      * @todo document this
3323      */
3324     function action_addnewlog() {
3325         global $member, $manager, $CONF;
3326
3327         // Only Super-Admins can do this
3328         $member->isAdmin() or $this->disallow();
3329
3330         $bname          = trim(postVar('name'));
3331         $bshortname     = trim(postVar('shortname'));
3332         $btimeoffset    = postVar('timeoffset');
3333         $bdesc          = trim(postVar('desc'));
3334         $bdefskin       = postVar('defskin');
3335
3336         if (!isValidShortName($bshortname))
3337             $this->error(_ERROR_BADSHORTBLOGNAME);
3338
3339         if ($manager->existsBlog($bshortname))
3340             $this->error(_ERROR_DUPSHORTBLOGNAME);
3341
3342         $manager->notify(
3343             'PreAddBlog',
3344             array(
3345                 'name' => &$bname,
3346                 'shortname' => &$bshortname,
3347                 'timeoffset' => &$btimeoffset,
3348                 'description' => &$bdesc,
3349                 'defaultskin' => &$bdefskin
3350             )
3351         );
3352
3353
3354         // add slashes for sql queries
3355         $bname =        sql_real_escape_string($bname);
3356         $bshortname =   sql_real_escape_string($bshortname);
3357         $btimeoffset =  sql_real_escape_string($btimeoffset);
3358         $bdesc =        sql_real_escape_string($bdesc);
3359         $bdefskin =     sql_real_escape_string($bdefskin);
3360
3361         // create blog
3362         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3363         sql_query($query);
3364         $blogid = sql_insert_id();
3365         $blog   =& $manager->getBlog($blogid);
3366
3367         // create new category
3368         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3369         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3370         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3371         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3372 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3373 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3374         $catid = sql_insert_id();
3375
3376         // set as default category
3377         $blog->setDefaultCategory($catid);
3378         $blog->writeSettings();
3379
3380         // create team member
3381         $memberid = $member->getID();
3382         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3383         sql_query($query);
3384
3385         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3386         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3387
3388         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3389         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3390
3391
3392
3393         $manager->notify(
3394             'PostAddBlog',
3395             array(
3396                 'blog' => &$blog
3397             )
3398         );
3399
3400         $manager->notify(
3401             'PostAddCategory',
3402             array(
3403                 'blog' => &$blog,
3404                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3405                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3406                 'catid' => $catid
3407             )
3408         );
3409
3410         $this->pagehead();
3411         ?>
3412         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3413
3414         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, ENTITY::hsc($bname)) ?></p>
3415
3416         <ol>
3417             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, ENTITY::hsc($bshortname)) ?></a></li>
3418             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3419         </ol>
3420
3421         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, ENTITY::hsc($bshortname)) ?></a></h3>
3422
3423         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, ENTITY::hsc($bshortname)) ?></p>
3424 <pre><code>&lt;?php
3425
3426 $CONF['Self'] = '<b><?php echo ENTITY::hsc($bshortname)?>.php</b>';
3427
3428 include('<i>./config.php</i>');
3429
3430 selectBlog('<b><?php echo ENTITY::hsc($bshortname)?></b>');
3431 selector();
3432
3433 ?&gt;</code></pre>
3434
3435         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3436
3437         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3438
3439         <form action="index.php" method="post"><div>
3440             <input type="hidden" name="action" value="addnewlog2" />
3441             <?php $manager->addTicketHidden() ?>
3442             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3443             <table><tr>
3444                 <td><?php echo _EBLOG_URL?></td>
3445                 <td><input name="url" maxlength="100" size="40" value="<?php echo ENTITY::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3446             </tr><tr>
3447                 <td><?php echo _EBLOG_CREATE?></td>
3448                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3449             </tr></table>
3450         </div></form>
3451
3452         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3453
3454         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3455
3456         <form action="index.php" method="post"><div>
3457             <input type="hidden" name="action" value="addnewlog2" />
3458             <?php $manager->addTicketHidden() ?>
3459             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3460             <table><tr>
3461                 <td><?php echo _EBLOG_URL?></td>
3462                 <td><input name="url" maxlength="100" size="40" /></td>
3463             </tr><tr>
3464                 <td><?php echo _EBLOG_CREATE?></td>
3465                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3466             </tr></table>
3467         </div></form>
3468
3469         <?php       $this->pagefoot();
3470
3471     }
3472
3473     /**
3474      * @todo document this
3475      */
3476     function action_addnewlog2() {
3477         global $member, $manager;
3478
3479         $member->blogAdminRights($blogid) or $this->disallow();
3480
3481         $burl   = requestVar('url');
3482         $blogid = intRequestVar('blogid');
3483
3484         $blog =& $manager->getBlog($blogid);
3485         $blog->setURL(trim($burl));
3486         $blog->writeSettings();
3487
3488         $this->action_overview(_MSG_NEWBLOG);
3489     }
3490
3491     /**
3492      * @todo document this
3493      */
3494     function action_skinieoverview() {
3495         global $member, $DIR_LIBS, $manager;
3496
3497         $member->isAdmin() or $this->disallow();
3498
3499         // load skinie class
3500         include_once($DIR_LIBS . 'skinie.php');
3501
3502         $this->pagehead();
3503
3504         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3505
3506     ?>
3507         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3508
3509                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3510                 <?php                   global $DIR_SKINS;
3511
3512                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3513
3514                     if (sizeof($candidates) > 0) {
3515                         ?>
3516                             <form method="post" action="index.php"><div>
3517                                 <input type="hidden" name="action" value="skinieimport" />
3518                                 <?php $manager->addTicketHidden() ?>
3519                                 <input type="hidden" name="mode" value="file" />
3520                                 <select name="skinfile" id="skinie_import_local">
3521                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3522                                         $html = ENTITY::hsc($skinfile);
3523                                         echo '<option value="',$html,'">',$skinname,'</option>';
3524                                     }
3525                                 ?>
3526                                 </select>
3527                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3528                             </div></form>
3529                         <?php                   } else {
3530                         echo _SKINIE_NOCANDIDATES;
3531                     }
3532                 ?>
3533                 </p>
3534
3535                 <p><em><?php echo _OR?></em></p>
3536
3537                 <form method="post" action="index.php"><p>
3538                     <?php $manager->addTicketHidden() ?>
3539                     <input type="hidden" name="action" value="skinieimport" />
3540                     <input type="hidden" name="mode" value="url" />
3541                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3542                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3543                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3544                 </p></form>
3545
3546
3547         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3548         <form method="post" action="index.php"><div>
3549             <input type="hidden" name="action" value="skinieexport" />
3550             <?php $manager->addTicketHidden() ?>
3551
3552             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3553
3554             <table><tr>
3555                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3556             </tr><tr>
3557     <?php       // show list of skins
3558         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3559         while ($skinObj = sql_fetch_object($res)) {
3560             $id = 'skinexp' . $skinObj->sdnumber;
3561             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3562             echo '<label for="',$id,'">',ENTITY::hsc($skinObj->sdname),'</label></td>';
3563             echo '<td>',ENTITY::hsc($skinObj->sddesc),'</td>';
3564             echo '</tr><tr>';
3565         }
3566
3567         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3568
3569         // show list of templates
3570         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3571         while ($templateObj = sql_fetch_object($res)) {
3572             $id = 'templateexp' . $templateObj->tdnumber;
3573             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3574             echo '<label for="',$id,'">',ENTITY::hsc($templateObj->tdname),'</label></td>';
3575             echo '<td>',ENTITY::hsc($templateObj->tddesc),'</td>';
3576             echo '</tr><tr>';
3577         }
3578
3579     ?>
3580                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3581             </tr><tr>
3582                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3583             </tr><tr>
3584                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3585             </tr><tr>
3586                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3587             </tr></table>
3588         </div></form>
3589
3590     <?php
3591         $this->pagefoot();
3592
3593     }
3594
3595     /**
3596      * @todo document this
3597      */
3598     function action_skinieimport() {
3599         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3600
3601         $member->isAdmin() or $this->disallow();
3602
3603         // load skinie class
3604         include_once($DIR_LIBS . 'skinie.php');
3605
3606         $skinFileRaw= postVar('skinfile');
3607         $mode       = postVar('mode');
3608
3609         $importer = new SKINIMPORT();
3610
3611         // get full filename
3612         if ($mode == 'file')
3613         {
3614             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3615
3616             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3617             if (!file_exists($skinFile))
3618                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3619         } else {
3620             $skinFile = $skinFileRaw;
3621         }
3622
3623         // read only metadata
3624         $error = $importer->readFile($skinFile, 1);
3625
3626         // clashes
3627         $skinNameClashes = $importer->checkSkinNameClashes();
3628         $templateNameClashes = $importer->checkTemplateNameClashes();
3629         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3630
3631         if ($error) $this->error($error);
3632
3633         $this->pagehead();
3634
3635         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3636         ?>
3637         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3638
3639         <ul>
3640             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3641             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3642             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3643             <?php
3644                 if ($hasNameClashes)
3645                 {
3646             ?>
3647             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3648             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3649             <?php
3650                 } // if (hasNameClashes)
3651             ?>
3652         </ul>
3653
3654         <form method="post" action="index.php"><div>
3655             <input type="hidden" name="action" value="skiniedoimport" />
3656             <?php $manager->addTicketHidden() ?>
3657             <input type="hidden" name="skinfile" value="<?php echo ENTITY::hsc(postVar('skinfile'))?>" />
3658             <input type="hidden" name="mode" value="<?php echo ENTITY::hsc($mode)?>" />
3659             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3660             <?php
3661                 if ($hasNameClashes)
3662                 {
3663             ?>
3664             <br />
3665             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3666             <?php
3667                 } // if (hasNameClashes)
3668             ?>
3669         </div></form>
3670
3671
3672         <?php
3673         $this->pagefoot();
3674     }
3675
3676     /**
3677      * @todo document this
3678      */
3679     function action_skiniedoimport() {
3680         global $member, $DIR_LIBS, $DIR_SKINS;
3681
3682         $member->isAdmin() or $this->disallow();
3683
3684         // load skinie class
3685         include_once($DIR_LIBS . 'skinie.php');
3686
3687         $skinFileRaw= postVar('skinfile');
3688         $mode       = postVar('mode');
3689
3690         $allowOverwrite = intPostVar('overwrite');
3691
3692         // get full filename
3693         if ($mode == 'file')
3694         {
3695             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3696
3697             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3698             if (!file_exists($skinFile))
3699                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3700
3701         } else {
3702             $skinFile = $skinFileRaw;
3703         }
3704
3705         $importer = new SKINIMPORT();
3706
3707         $error = $importer->readFile($skinFile);
3708
3709         if ($error)
3710             $this->error($error);
3711
3712         $error = $importer->writeToDatabase($allowOverwrite);
3713
3714         if ($error)
3715             $this->error($error);
3716
3717         $this->pagehead();
3718
3719         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3720     ?>
3721         <h2><?php echo _SKINIE_DONE?></h2>
3722
3723         <ul>
3724             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3725             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3726             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3727         </ul>
3728
3729     <?php       $this->pagefoot();
3730
3731     }
3732
3733     /**
3734      * @todo document this
3735      */
3736     function action_skinieexport() {
3737         global $member, $DIR_LIBS;
3738
3739         $member->isAdmin() or $this->disallow();
3740
3741         // load skinie class
3742         include_once($DIR_LIBS . 'skinie.php');
3743
3744         $aSkins = requestIntArray('skin');
3745         $aTemplates = requestIntArray('template');
3746
3747         if (!is_array($aTemplates)) $aTemplates = array();
3748         if (!is_array($aSkins)) $aSkins = array();
3749
3750         $skinList = array_keys($aSkins);
3751         $templateList = array_keys($aTemplates);
3752
3753         $info = postVar('info');
3754
3755         $exporter = new SKINEXPORT();
3756         foreach ($skinList as $skinId) {
3757             $exporter->addSkin($skinId);
3758         }
3759         foreach ($templateList as $templateId) {
3760             $exporter->addTemplate($templateId);
3761         }
3762         $exporter->setInfo($info);
3763
3764         $exporter->export();
3765     }
3766
3767     /**
3768      * @todo document this
3769      */
3770     function action_templateoverview() {
3771         global $member, $manager;
3772
3773         $member->isAdmin() or $this->disallow();
3774
3775         $this->pagehead();
3776
3777         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3778
3779         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3780         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3781
3782         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3783         $template['content'] = 'templatelist';
3784         $template['tabindex'] = 10;
3785         showlist($query,'table',$template);
3786
3787         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3788
3789         ?>
3790         <form method="post" action="index.php"><div>
3791
3792         <input name="action" value="templatenew" type="hidden" />
3793         <?php $manager->addTicketHidden() ?>
3794         <table><tr>
3795             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3796             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3797         </tr><tr>
3798             <td><?php echo _TEMPLATE_DESC?></td>
3799             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3800         </tr><tr>
3801             <td><?php echo _TEMPLATE_CREATE?></td>
3802             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3803         </tr></table>
3804
3805         </div></form>
3806
3807         <?php
3808         $this->pagefoot();
3809     }
3810
3811     /**
3812      * @todo document this
3813      */
3814     function action_templateedit($msg = '') {
3815         global $member, $manager;
3816
3817         $templateid = intRequestVar('templateid');
3818
3819         $member->isAdmin() or $this->disallow();
3820
3821         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3822         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3823
3824         $this->pagehead($extrahead);
3825
3826         $templatename = TEMPLATE::getNameFromId($templateid);
3827         $templatedescription = TEMPLATE::getDesc($templateid);
3828         $template =& $manager->getTemplate($templatename);
3829
3830         ?>
3831         <p>
3832         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3833         </p>
3834
3835         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  ENTITY::hsc($templatename); ?>'</h2>
3836
3837         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3838         ?>
3839
3840         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3841
3842         <form method="post" action="index.php">
3843         <div>
3844
3845         <input type="hidden" name="action" value="templateupdate" />
3846         <?php $manager->addTicketHidden() ?>
3847         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3848
3849         <table><tr>
3850             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3851         </tr><tr>
3852             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3853             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  ENTITY::hsc($templatename) ?>" /></td>
3854         </tr><tr>
3855             <td><?php echo _TEMPLATE_DESC?></td>
3856             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  ENTITY::hsc($templatedescription) ?>" /></td>
3857         </tr><tr>
3858             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3859         </tr><tr>
3860             <td><?php echo _TEMPLATE_UPDATE?></td>
3861             <td>
3862                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3863                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3864             </td>
3865         </tr><tr>
3866             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3867 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3868     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3869     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3870     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3871     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3872     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3873 ?>
3874         </tr><tr>
3875             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3876 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3877     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3878     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3879     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3880     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3881     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3882     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3883 ?>
3884         </tr><tr>
3885             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3886 <?php
3887     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3888 ?>
3889         </tr><tr>
3890             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3891 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3892 ?>
3893         </tr><tr>
3894             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3895 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3896     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3897     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3898 ?>
3899         </tr><tr>
3900             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3901 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3902     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3903     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3904 ?>
3905         </tr><tr>
3906             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3907 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3908     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3909     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3910 ?>
3911         </tr><tr>
3912             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3913 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3914     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3915     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3916     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3917     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3918 ?>
3919         </tr><tr>
3920             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3921 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3922     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3923     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3924 ?>
3925         </tr><tr>
3926             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3927 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3928     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3929 ?>
3930         </tr><tr>
3931             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3932 <?php
3933         $tab = 600;
3934         $pluginfields = array();
3935         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3936
3937         foreach ($pluginfields as $pfkey=>$pfvalue) {
3938             echo "</tr><tr>\n";
3939             echo '<th colspan="2">' . ENTITY::hen($pfkey) . "</th>\n";
3940             foreach ($pfvalue as $pffield=>$pfdesc) {
3941                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3942             }
3943         }
3944 ?>
3945         </tr><tr>
3946             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3947         </tr><tr>
3948             <td><?php echo _TEMPLATE_UPDATE?></td>
3949             <td>
3950                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3951                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3952             </td>
3953         </tr></table>
3954
3955         </div>
3956         </form>
3957         <?php
3958         $this->pagefoot();
3959     }
3960
3961     /**
3962      * @todo document this
3963      */
3964     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3965         static $count = 1;
3966         if (!isset($template[$name])) $template[$name] = '';
3967     ?>
3968         </tr><tr>
3969             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3970             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  ENTITY::hsc($template[$name]); ?></textarea></td>
3971     <?php       $count++;
3972     }
3973
3974     /**
3975      * @todo document this
3976      */
3977     function action_templateupdate() {
3978         global $member,$manager;
3979
3980         $templateid = intRequestVar('templateid');
3981
3982         $member->isAdmin() or $this->disallow();
3983
3984         $name = postVar('tname');
3985         $desc = postVar('tdesc');
3986
3987         if (!isValidTemplateName($name))
3988             $this->error(_ERROR_BADTEMPLATENAME);
3989
3990         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3991             $this->error(_ERROR_DUPTEMPLATENAME);
3992
3993
3994         $name = sql_real_escape_string($name);
3995         $desc = sql_real_escape_string($desc);
3996
3997         // 1. Remove all template parts
3998         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3999         sql_query($query);
4000
4001         // 2. Update description
4002         $query =  'UPDATE '.sql_table('template_desc').' SET'
4003                . " tdname='" . $name . "',"
4004                . " tddesc='" . $desc . "'"
4005                . " WHERE tdnumber=" . $templateid;
4006         sql_query($query);
4007
4008         // 3. Add non-empty template parts
4009         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4010         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4011         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4012         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4013         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4014         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4015         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4016         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4017         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4018         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4019         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4020         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4021         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4022         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4023         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4024         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4025         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4026         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4027         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4028         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4029         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4030         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4031         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4032         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4033         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4034         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4035         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4036         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4037         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4038         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4039         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4040         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4041         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4042         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4043
4044         $pluginfields = array();
4045         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4046         foreach ($pluginfields as $pfkey=>$pfvalue) {
4047             foreach ($pfvalue as $pffield=>$pfdesc) {
4048                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4049             }
4050         }
4051
4052         // jump back to template edit
4053         $this->action_templateedit(_TEMPLATE_UPDATED);
4054
4055     }
4056
4057         /**
4058          * ADMIN::addToTemplate()
4059          *
4060          * @param       Integer $id     ID for template
4061          * @param       String  $partname       parts name
4062          * @param       String  $content        template contents
4063          * @return      Integer record index
4064          *
4065          */
4066         function addToTemplate($id, $partname, $content)
4067         {
4068                 // don't add empty parts:
4069                 if ( !trim($content) )
4070                 {
4071                         return -1;
4072                 }
4073
4074                 $partname = sql_real_escape_string($partname);
4075                 $content = sql_real_escape_string($content);
4076
4077                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";
4078                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);
4079                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4080                 return sql_insert_id();
4081         }
4082
4083     /**
4084      * @todo document this
4085      */
4086     function action_templatedelete() {
4087         global $member, $manager;
4088
4089         $member->isAdmin() or $this->disallow();
4090
4091         $templateid = intRequestVar('templateid');
4092         // TODO: check if template can be deleted
4093
4094         $this->pagehead();
4095
4096         $name = TEMPLATE::getNameFromId($templateid);
4097         $desc = TEMPLATE::getDesc($templateid);
4098
4099         ?>
4100             <h2><?php echo _DELETE_CONFIRM?></h2>
4101
4102             <p>
4103             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo ENTITY::hsc($name)?></b> (<?php echo  ENTITY::hsc($desc) ?>)
4104             </p>
4105
4106             <form method="post" action="index.php"><div>
4107                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4108                 <?php $manager->addTicketHidden() ?>
4109                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4110                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4111             </div></form>
4112         <?php
4113         $this->pagefoot();
4114     }
4115
4116     /**
4117      * @todo document this
4118      */
4119     function action_templatedeleteconfirm() {
4120         global $member, $manager;
4121
4122         $templateid = intRequestVar('templateid');
4123
4124         $member->isAdmin() or $this->disallow();
4125
4126         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4127
4128         // 1. delete description
4129         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4130
4131         // 2. delete parts
4132         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4133
4134         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4135
4136         $this->action_templateoverview();
4137     }
4138
4139     /**
4140      * @todo document this
4141      */
4142     function action_templatenew() {
4143         global $member;
4144
4145         $member->isAdmin() or $this->disallow();
4146
4147         $name = postVar('name');
4148         $desc = postVar('desc');
4149
4150         if (!isValidTemplateName($name))
4151             $this->error(_ERROR_BADTEMPLATENAME);
4152
4153         if (TEMPLATE::exists($name))
4154             $this->error(_ERROR_DUPTEMPLATENAME);
4155
4156         $newTemplateId = TEMPLATE::createNew($name, $desc);
4157
4158         $this->action_templateoverview();
4159     }
4160
4161     /**
4162      * @todo document this
4163      */
4164     function action_templateclone() {
4165         global $member;
4166
4167         $templateid = intRequestVar('templateid');
4168
4169         $member->isAdmin() or $this->disallow();
4170
4171         // 1. read old template
4172         $name = TEMPLATE::getNameFromId($templateid);
4173         $desc = TEMPLATE::getDesc($templateid);
4174
4175         // 2. create desc thing
4176         $name = "cloned" . $name;
4177
4178         // if a template with that name already exists:
4179         if (TEMPLATE::exists($name)) {
4180             $i = 1;
4181             while (TEMPLATE::exists($name . $i))
4182                 $i++;
4183             $name .= $i;
4184         }
4185
4186         $newid = TEMPLATE::createNew($name, $desc);
4187
4188         // 3. create clone
4189         // go through parts of old template and add them to the new one
4190         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4191         while ($o = sql_fetch_object($res)) {
4192             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4193         }
4194
4195         $this->action_templateoverview();
4196     }
4197
4198     /**
4199      * @todo document this
4200      */
4201     function action_skinoverview() {
4202         global $member, $manager;
4203
4204         $member->isAdmin() or $this->disallow();
4205
4206         $this->pagehead();
4207
4208         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4209
4210         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4211
4212         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4213
4214         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4215         $template['content'] = 'skinlist';
4216         $template['tabindex'] = 10;
4217         showlist($query,'table',$template);
4218
4219         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4220
4221         ?>
4222         <form method="post" action="index.php">
4223         <div>
4224
4225         <input name="action" value="skinnew" type="hidden" />
4226         <?php $manager->addTicketHidden() ?>
4227         <table><tr>
4228             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4229             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4230         </tr><tr>
4231             <td><?php echo _SKIN_DESC?></td>
4232             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4233         </tr><tr>
4234             <td><?php echo _SKIN_CREATE?></td>
4235             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4236         </tr></table>
4237
4238         </div>
4239         </form>
4240
4241         <?php
4242         $this->pagefoot();
4243     }
4244
4245     /**
4246      * @todo document this
4247      */
4248     function action_skinnew() {
4249         global $member;
4250
4251         $member->isAdmin() or $this->disallow();
4252
4253         $name = trim(postVar('name'));
4254         $desc = trim(postVar('desc'));
4255
4256         if (!isValidSkinName($name))
4257             $this->error(_ERROR_BADSKINNAME);
4258
4259         if (SKIN::exists($name))
4260             $this->error(_ERROR_DUPSKINNAME);
4261
4262         $newId = SKIN::createNew($name, $desc);
4263
4264         $this->action_skinoverview();
4265     }
4266
4267     /**
4268      * @todo document this
4269      */
4270     function action_skinedit() {
4271         global $member, $manager;
4272
4273         $skinid = intRequestVar('skinid');
4274
4275         $member->isAdmin() or $this->disallow();
4276
4277         $skin = new SKIN($skinid);
4278
4279         $this->pagehead();
4280         ?>
4281         <p>
4282             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4283         </p>
4284         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4285
4286         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4287         <?php echo _SKIN_PARTS_MSG?>
4288         <ul>
4289             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4290             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4291             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4292             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4293             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4294             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4295             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4296             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4297         </ul>
4298
4299         <?php
4300
4301         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4302         $res = sql_query($query);
4303
4304         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4305         echo '<form method="get" action="index.php">' . "\r\n";
4306         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4307         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4308         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4309         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4310         echo '</form>' . "\r\n";
4311
4312         if ($res && sql_num_rows($res) > 0) {
4313             echo '<ul>';
4314             $tabstart = 75;
4315
4316             while ($row = sql_fetch_assoc($res)) {
4317                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">' . ENTITY::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4318             }
4319
4320             echo '</ul>';
4321         }
4322
4323         ?>
4324
4325         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4326         <form method="post" action="index.php">
4327         <div>
4328
4329         <input type="hidden" name="action" value="skineditgeneral" />
4330         <?php $manager->addTicketHidden() ?>
4331         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4332         <table><tr>
4333             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4334             <td><input name="name" tabindex="90" value="<?php echo  ENTITY::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4335         </tr><tr>
4336             <td><?php echo _SKIN_DESC?></td>
4337             <td><input name="desc" tabindex="100" value="<?php echo  ENTITY::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4338         </tr><tr>
4339             <td><?php echo _SKIN_TYPE?></td>
4340             <td><input name="type" tabindex="110" value="<?php echo  ENTITY::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4341         </tr><tr>
4342             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4343             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4344         </tr><tr>
4345             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4346             <td><input name="inc_prefix" tabindex="130" value="<?php echo  ENTITY::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4347         </tr><tr>
4348             <td><?php echo _SKIN_CHANGE?></td>
4349             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4350         </tr></table>
4351
4352         </div>
4353         </form>
4354
4355
4356         <?php       $this->pagefoot();
4357     }
4358
4359     /**
4360      * @todo document this
4361      */
4362     function action_skineditgeneral() {
4363         global $member;
4364
4365         $skinid = intRequestVar('skinid');
4366
4367         $member->isAdmin() or $this->disallow();
4368
4369         $name = postVar('name');
4370         $desc = postVar('desc');
4371         $type = postVar('type');
4372         $inc_mode = postVar('inc_mode');
4373         $inc_prefix = postVar('inc_prefix');
4374
4375         $skin = new SKIN($skinid);
4376
4377         // 1. Some checks
4378         if (!isValidSkinName($name))
4379             $this->error(_ERROR_BADSKINNAME);
4380
4381         if (($skin->getName() != $name) && SKIN::exists($name))
4382             $this->error(_ERROR_DUPSKINNAME);
4383
4384         if (!$type) $type = 'text/html';
4385         if (!$inc_mode) $inc_mode = 'normal';
4386
4387         // 2. Update description
4388         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4389
4390         $this->action_skinedit();
4391
4392     }
4393
4394     /**
4395      * @todo document this
4396      */
4397     function action_skinedittype($msg = '') {
4398         global $member, $manager;
4399
4400         $skinid = intRequestVar('skinid');
4401         $type = requestVar('type');
4402
4403         $member->isAdmin() or $this->disallow();
4404
4405         $type = trim($type);
4406         $type = strtolower($type);
4407
4408         if (!isValidShortName($type)) {
4409             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4410         }
4411
4412         $skin = new SKIN($skinid);
4413
4414         $friendlyNames = SKIN::getFriendlyNames();
4415
4416         $this->pagehead();
4417         ?>
4418         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4419
4420         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo ENTITY::hsc($skin->getName()) ?>': <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4421
4422         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4423         ?>
4424
4425
4426         <form method="post" action="index.php">
4427         <div>
4428
4429         <input type="hidden" name="action" value="skinupdate" />
4430         <?php $manager->addTicketHidden() ?>
4431         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4432         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4433
4434         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4435         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4436         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4437         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4438             help('skinpart' . $type);
4439         } else {
4440             help('skinpartspecial');
4441         }?>
4442         <br />
4443
4444         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  ENTITY::hsc($skin->getContent($type)) ?></textarea>
4445
4446         <br />
4447         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4448         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4449         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4450
4451         <br /><br />
4452         <?php echo _SKIN_ALLOWEDVARS?>
4453         <?php           $actions = SKIN::getAllowedActionsForType($type);
4454
4455             sort($actions);
4456
4457             while ($current = array_shift($actions)) {
4458                 // skip deprecated vars
4459                 if ($current == 'ifcat') continue;
4460                 if ($current == 'imagetext') continue;
4461                 if ($current == 'vars') continue;
4462
4463                 echo helplink('skinvar-' . $current) . "$current</a>";
4464                 if (count($actions) != 0) echo ", ";
4465             }
4466         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4467         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4468         showlist($query,'table',array('content'=>'shortblognames'));
4469         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4470         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4471         showlist($query,'table',array('content'=>'shortnames'));
4472         echo '</div></form>';
4473         $this->pagefoot();
4474     }
4475
4476     /**
4477      * @todo document this
4478      */
4479     function action_skinupdate() {
4480         global $member;
4481
4482         $skinid = intRequestVar('skinid');
4483         $content = trim(postVar('content'));
4484         $type = postVar('type');
4485
4486         $member->isAdmin() or $this->disallow();
4487
4488         $skin = new SKIN($skinid);
4489         $skin->update($type, $content);
4490
4491         $this->action_skinedittype(_SKIN_UPDATED);
4492     }
4493
4494     /**
4495      * @todo document this
4496      */
4497     function action_skindelete() {
4498         global $member, $manager, $CONF;
4499
4500         $skinid = intRequestVar('skinid');
4501
4502         $member->isAdmin() or $this->disallow();
4503
4504         // don't allow default skin to be deleted
4505         if ($skinid == $CONF['BaseSkin'])
4506             $this->error(_ERROR_DEFAULTSKIN);
4507
4508         // don't allow deletion of default skins for blogs
4509         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4510         $r = sql_query($query);
4511         if ($o = sql_fetch_object($r))
4512             $this->error(_ERROR_SKINDEFDELETE . ENTITY::hsc($o->bname));
4513
4514         $this->pagehead();
4515
4516         $skin = new SKIN($skinid);
4517         $name = $skin->getName();
4518         $desc = $skin->getDescription();
4519
4520         ?>
4521             <h2><?php echo _DELETE_CONFIRM?></h2>
4522
4523             <p>
4524                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo ENTITY::hsc($name) ?></b> (<?php echo  ENTITY::hsc($desc)?>)
4525             </p>
4526
4527             <form method="post" action="index.php"><div>
4528                 <input type="hidden" name="action" value="skindeleteconfirm" />
4529                 <?php $manager->addTicketHidden() ?>
4530                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4531                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4532             </div></form>
4533         <?php
4534         $this->pagefoot();
4535     }
4536
4537     /**
4538      * @todo document this
4539      */
4540     function action_skindeleteconfirm() {
4541         global $member, $CONF, $manager;
4542
4543         $skinid = intRequestVar('skinid');
4544
4545         $member->isAdmin() or $this->disallow();
4546
4547         // don't allow default skin to be deleted
4548         if ($skinid == $CONF['BaseSkin'])
4549             $this->error(_ERROR_DEFAULTSKIN);
4550
4551         // don't allow deletion of default skins for blogs
4552         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4553         $r = sql_query($query);
4554         if ($o = sql_fetch_object($r))
4555             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4556
4557         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4558
4559         // 1. delete description
4560         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4561
4562         // 2. delete parts
4563         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4564
4565         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4566
4567         $this->action_skinoverview();
4568     }
4569
4570     /**
4571      * @todo document this
4572      */
4573     function action_skinremovetype() {
4574         global $member, $manager, $CONF;
4575
4576         $skinid = intRequestVar('skinid');
4577         $skintype = requestVar('type');
4578
4579         if (!isValidShortName($skintype)) {
4580             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4581         }
4582
4583         $member->isAdmin() or $this->disallow();
4584
4585         // don't allow default skinparts to be deleted
4586         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4587             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4588         }
4589
4590         $this->pagehead();
4591
4592         $skin = new SKIN($skinid);
4593         $name = $skin->getName();
4594         $desc = $skin->getDescription();
4595
4596         ?>
4597             <h2><?php echo _DELETE_CONFIRM?></h2>
4598
4599             <p>
4600                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo ENTITY::hsc($skintype); ?> (<?php echo ENTITY::hsc($name); ?>)</b> (<?php echo  ENTITY::hsc($desc)?>)
4601             </p>
4602
4603             <form method="post" action="index.php"><div>
4604                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4605                 <?php $manager->addTicketHidden() ?>
4606                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4607                 <input type="hidden" name="type" value="<?php echo ENTITY::hsc($skintype); ?>" />
4608                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4609             </div></form>
4610         <?php
4611         $this->pagefoot();
4612     }
4613
4614     /**
4615      * @todo document this
4616      */
4617     function action_skinremovetypeconfirm() {
4618         global $member, $CONF, $manager;
4619
4620         $skinid = intRequestVar('skinid');
4621         $skintype = requestVar('type');
4622
4623         if (!isValidShortName($skintype)) {
4624             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4625         }
4626
4627         $member->isAdmin() or $this->disallow();
4628
4629         // don't allow default skinparts to be deleted
4630         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4631             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4632         }
4633
4634         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4635
4636         // delete part
4637         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4638
4639         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4640
4641         $this->action_skinedit();
4642     }
4643
4644     /**
4645      * @todo document this
4646      */
4647     function action_skinclone() {
4648         global $member;
4649
4650         $skinid = intRequestVar('skinid');
4651
4652         $member->isAdmin() or $this->disallow();
4653
4654         // 1. read skin to clone
4655         $skin = new SKIN($skinid);
4656
4657         $name = "clone_" . $skin->getName();
4658
4659         // if a skin with that name already exists:
4660         if (SKIN::exists($name)) {
4661             $i = 1;
4662             while (SKIN::exists($name . $i))
4663                 $i++;
4664             $name .= $i;
4665         }
4666
4667         // 2. create skin desc
4668         $newid = SKIN::createNew(
4669             $name,
4670             $skin->getDescription(),
4671             $skin->getContentType(),
4672             $skin->getIncludeMode(),
4673             $skin->getIncludePrefix()
4674         );
4675
4676
4677         // 3. clone
4678         /*
4679         $this->skinclonetype($skin, $newid, 'index');
4680         $this->skinclonetype($skin, $newid, 'item');
4681         $this->skinclonetype($skin, $newid, 'archivelist');
4682         $this->skinclonetype($skin, $newid, 'archive');
4683         $this->skinclonetype($skin, $newid, 'search');
4684         $this->skinclonetype($skin, $newid, 'error');
4685         $this->skinclonetype($skin, $newid, 'member');
4686         $this->skinclonetype($skin, $newid, 'imagepopup');
4687         */
4688
4689         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4690         $res = sql_query($query);
4691         while ($row = sql_fetch_assoc($res)) {
4692             $this->skinclonetype($skin, $newid, $row['stype']);
4693         }
4694
4695         $this->action_skinoverview();
4696
4697     }
4698
4699         /**
4700          * ADMIN::skinclonetype()
4701          *
4702          * @param       String  $skin   Skin object
4703          * @param       Integer $newid  ID for this clone
4704          * @param       String  $type   type of skin
4705          * @return      Void
4706          */
4707         function skinclonetype($skin, $newid, $type)
4708         {
4709                 $newid = intval($newid);
4710                 $content = $skin->getContent($type);
4711
4712                 if ( $content )
4713                 {
4714                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";
4715                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);
4716                         sql_query($query);
4717                 }
4718                 return;
4719         }
4720
4721         /**
4722          * ADMIN::action_settingsedit()
4723          *
4724          * @param       Void
4725          * @return      Void
4726          */
4727         function action_settingsedit() {
4728                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4729
4730                 $member->isAdmin() or $this->disallow();
4731
4732                 $this->pagehead();
4733
4734                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4735                 ?>
4736
4737                 <h2><?php echo _SETTINGS_TITLE?></h2>
4738
4739                 <form action="index.php" method="post">
4740                 <div>
4741
4742                 <input type="hidden" name="action" value="settingsupdate" />
4743                 <?php $manager->addTicketHidden() ?>
4744
4745                 <table><tr>
4746                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4747                 </tr><tr>
4748                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4749                         <td>
4750                                 <?php
4751                                         $query =  'SELECT bname as text, bnumber as value'
4752                                                    . ' FROM '.sql_table('blog');
4753                                         $template['name'] = 'DefaultBlog';
4754                                         $template['selected'] = $CONF['DefaultBlog'];
4755                                         $template['tabindex'] = 10;
4756                                         showlist($query,'select',$template);
4757                                 ?>
4758                         </td>
4759                 </tr><tr>
4760                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4761                         <td>
4762                                 <?php
4763                                         $query =  'SELECT sdname as text, sdnumber as value'
4764                                                    . ' FROM '.sql_table('skin_desc');
4765                                         $template['name'] = 'BaseSkin';
4766                                         $template['selected'] = $CONF['BaseSkin'];
4767                                         $template['tabindex'] = 1;
4768                                         showlist($query,'select',$template);
4769                                 ?>
4770                         </td>
4771                 </tr><tr>
4772                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4773                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminEmail']) ?>" /></td>
4774                 </tr><tr>
4775                         <td><?php echo _SETTINGS_SITENAME?></td>
4776                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  ENTITY::hsc($CONF['SiteName']) ?>" /></td>
4777                 </tr><tr>
4778                         <td><?php echo _SETTINGS_SITEURL?></td>
4779                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  ENTITY::hsc($CONF['IndexURL']) ?>" /></td>
4780                 </tr><tr>
4781                         <td><?php echo _SETTINGS_ADMINURL?></td>
4782                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminURL']) ?>" /></td>
4783                 </tr><tr>
4784                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4785                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  ENTITY::hsc($CONF['PluginURL']) ?>" /></td>
4786                 </tr><tr>
4787                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4788                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  ENTITY::hsc($CONF['SkinsURL']) ?>" /></td>
4789                 </tr><tr>
4790                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4791                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  ENTITY::hsc($CONF['ActionURL']) ?>" /></td>
4792                 </tr><tr>
4793                         <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>
4794                         </td>
4795                         <td>
4796                                 <select name="Locale" tabindex="10050">
4797                         <?php
4798                                 $locales = i18n::get_available_locale_list();
4799                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4800                                 {
4801                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4802                                 }
4803                                 else
4804                                 {
4805                                         echo "<option value=\"\">en_Latn_US</option>\n";
4806                                 }
4807
4808                                 foreach ( $locales as $locale )
4809                                 {
4810                                         if ( $locale == 'en_Latn_US' )
4811                                         {
4812                                                 continue;
4813                                         }
4814                                         if ( $locale == i18n::get_current_locale() )
4815                                         {
4816                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4817                                         }
4818                                         else
4819                                         {
4820                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4821                                         }
4822                                 }
4823                         ?>
4824                         </select>
4825
4826                         </td>
4827                 </tr><tr>
4828                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4829                         </td>
4830                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4831                                         <br />
4832                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  ENTITY::hsc($CONF['DisableSiteURL'])?>" />
4833                         </td>
4834                 </tr><tr>
4835                         <td><?php echo _SETTINGS_DIRS?></td>
4836                         <td><?php echo  ENTITY::hsc($DIR_NUCLEUS) ?>
4837                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4838                 </tr><tr>
4839                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4840                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4841                 </tr><tr>
4842                         <td>
4843                         <?php
4844                                 echo _SETTINGS_JSTOOLBAR
4845                                 /* =_SETTINGS_DISABLEJS
4846
4847                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4848                                         way to select the javascript version to use
4849
4850                                         now, its:
4851                                                 0 : IE
4852                                                 1 : all javascript disabled
4853                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4854                                 */
4855                            ?>
4856                         </td>
4857                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4858                                 <select name="DisableJsTools" tabindex="10075">
4859                         <?php                              $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4860                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4861                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4862                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4863                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4864                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4865                         ?>
4866                                 </select>
4867                         </td>
4868                 </tr><tr>
4869                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4870                                            <td><?php
4871
4872                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4873                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4874
4875                                            echo ' ', _SETTINGS_URLMODE_HELP;
4876
4877                                                          ?>
4878
4879                                            </td>
4880                 </tr><tr>
4881                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4882                                            <td><?php
4883
4884                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4885
4886                                                          ?>
4887
4888                                            </td>
4889                 </tr><tr>
4890                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4891                         <td>
4892                         <?php
4893                                 if (!array_key_exists('DefaultListSize',$CONF)) {
4894                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4895                                         $CONF['DefaultListSize'] = 10;
4896                                 }
4897                         ?>
4898                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  ENTITY::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4899                         </td>
4900                 </tr><tr>
4901                         <td><?php echo _SETTINGS_ADMINCSS?>
4902                         </td>
4903                         <td>
4904
4905                                 <select name="AdminCSS" tabindex="10080">
4906                                 <?php                      // show a dropdown list of all available admin css files
4907                                 global $DIR_NUCLEUS;
4908
4909                                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4910
4911                                 while ($filename = readdir($dirhandle) )
4912                                 {
4913
4914                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4915                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4916
4917                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4918                                         {
4919
4920                                                 $name = $matches[1];
4921                                                 echo "<option value=\"$name\"";
4922
4923                                                 if ($name == $CONF['AdminCSS'])
4924                                                 {
4925                                                         echo " selected=\"selected\"";
4926                                                 }
4927
4928                                                 echo ">$name</option>";
4929
4930                                         }
4931
4932                                 }
4933
4934                                 closedir($dirhandle);
4935
4936                                 ?>
4937                                 </select>
4938
4939                         </td>
4940                 </tr><tr>
4941                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4942                 </tr><tr>
4943                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4944                         <td><?php echo  ENTITY::hsc($DIR_MEDIA) ?>
4945                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4946                                 <?php                              if (!is_dir($DIR_MEDIA))
4947                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4948                                         if (!is_readable($DIR_MEDIA))
4949                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4950                                         if (!is_writeable($DIR_MEDIA))
4951                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4952                                 ?>
4953                         </td>
4954                 </tr><tr>
4955                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4956                         <td>
4957                                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  ENTITY::hsc($CONF['MediaURL']) ?>" />
4958                         </td>
4959                 </tr><tr>
4960                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4961                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4962                 </tr><tr>
4963                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4964                         <td>
4965                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  ENTITY::hsc($CONF['AllowedTypes']) ?>" />
4966                         </td>
4967                 </tr><tr>
4968                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4969                         <td>
4970                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  ENTITY::hsc($CONF['MaxUploadSize']) ?>" />
4971                         </td>
4972                 </tr><tr>
4973                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4974                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4975
4976                 </tr><tr>
4977                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4978                 </tr><tr>
4979                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4980                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4981                 </tr><tr>
4982                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4983                                 <?php help('allowaccountcreation'); ?>
4984                         </td>
4985                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4986                         </td>
4987                 </tr><tr>
4988                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4989                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4990                         </td>
4991                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4992                         </td>
4993                 </tr><tr>
4994                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4995                                 <?php help('messageservice'); ?>
4996                         </td>
4997                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4998                         </td>
4999                 </tr><tr>
5000                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
5001                                 <?php help('messageservice'); ?>
5002                         </td>
5003                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5004                         </td>
5005                 </tr><tr>
5006                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5007                                 <?php help('protectmemnames'); ?>
5008                         </td>
5009                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5010                         </td>
5011
5012
5013
5014                 </tr><tr>
5015                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5016                 </tr><tr>
5017                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5018                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePrefix'])?>" /></td>
5019                 </tr><tr>
5020                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5021                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  ENTITY::hsc($CONF['CookieDomain'])?>" /></td>
5022                 </tr><tr>
5023                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
5024                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePath'])?>" /></td>
5025                 </tr><tr>
5026                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
5027                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5028                 </tr><tr>
5029                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
5030                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5031                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5032                         </td>
5033                 </tr><tr>
5034                         <td><?php echo _SETTINGS_LASTVISIT?></td>
5035                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5036
5037
5038
5039                 </tr><tr>
5040                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5041                 </tr><tr>
5042                         <td><?php echo _SETTINGS_UPDATE?></td>
5043                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5044                 </tr></table>
5045
5046                 </div>
5047                 </form>
5048
5049                 <?php
5050                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5051
5052                         $manager->notify(
5053                                 'GeneralSettingsFormExtras',
5054                                 array()
5055                         );
5056
5057                 $this->pagefoot();
5058         }
5059
5060         /**
5061          * ADMIN::action_settingsupdate()
5062          * Update $CONFIG and redirect
5063          *
5064          * @param       void
5065          * @return      void
5066          */
5067         function action_settingsupdate() {
5068                 global $member, $CONF;
5069
5070                 $member->isAdmin() or $this->disallow();
5071
5072                 // check if email address for admin is valid
5073                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5074                 {
5075                         $this->error(_ERROR_BADMAILADDRESS);
5076                 }
5077
5078                 // save settings
5079                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5080                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5081                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5082                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5083                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5084                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5085                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5086                 $this->updateConfig('Locale',              postVar('Locale'));
5087                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5088                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5089                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5090                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5091                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5092                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5093                 $this->updateConfig('SiteName',          postVar('SiteName'));
5094                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5095                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5096                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5097                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5098                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5099                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5100                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5101                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5102                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5103                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5104                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5105                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5106                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5107                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5108                 $this->updateConfig('URLMode',            postVar('URLMode'));
5109                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5110                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5111                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5112                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5113
5114                 // load new config and redirect (this way, the new locale will be used is necessary)
5115                 // note that when changing cookie settings, this redirect might cause the user
5116                 // to have to log in again.
5117                 getConfig();
5118                 redirect($CONF['AdminURL'] . '?action=manage');
5119                 exit;
5120         }
5121
5122         /**
5123          * ADMIN::action_systemoverview()
5124          * Output system overview
5125          *
5126          * @param       void
5127          * @return      void
5128          */
5129         function action_systemoverview()
5130         {
5131                 global $member, $nucleus, $CONF;
5132
5133                 $this->pagehead();
5134
5135                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5136
5137                 if ( $member->isLoggedIn() && $member->isAdmin() )
5138                 {
5139                         // Information about the used PHP and MySQL installation
5140                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5141
5142                         // Version of PHP MySQL
5143                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5144                         echo "<thead>\n";
5145                         echo "<tr>\n";
5146                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5147                         echo "</tr>\n";
5148                         echo "</thead>\n";
5149                         echo "<tbody>\n";
5150                         echo "<tr>\n";
5151                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5152                         echo '<td>' . phpversion() . "</td>\n";
5153                         echo "</tr>\n";
5154                         echo "<tr>\n";
5155                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5156                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5157                         echo "</tr>\n";
5158                         echo "</tbody>\n";
5159                         echo "</table>\n\n";
5160
5161                         // Important PHP settings
5162                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5163                         echo "<thead>\n";
5164                         echo "<tr>\n";
5165                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5166                         echo "</tr>\n";
5167                         echo "</thead>\n";
5168                         echo "<tbody>\n";
5169                         echo "<tr>\n";
5170                         echo '<td>magic_quotes_gpc' . "</td>\n";
5171                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5172                         echo '<td>' . $mqg . "</td>\n";
5173                         echo "</tr>\n";
5174                         echo "<tr>\n";
5175                         echo '<td>magic_quotes_runtime' . "</td>\n";
5176                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5177                         echo '<td>' . $mqr . "</td>\n";
5178                         echo "</tr>\n";
5179                         echo "<tr>\n";
5180                         echo '<td>register_globals' . "</td>\n";
5181                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5182                         echo '<td>' . $rg . "</td>\n";
5183                         echo "</tr>\n";
5184                         echo "</tbody>\n";
5185                         echo "</table>\n\n";
5186
5187                         // Information about GD library
5188                         $gdinfo = gd_info();
5189                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5190                         echo "<thead>\n";
5191                         echo "<tr>\n";
5192                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5193                         echo "</tr>\n";
5194                         echo "</thead>\n";
5195                         echo "<tbody>\n";
5196                         foreach ( $gdinfo as $key=>$value )
5197                         {
5198                                 if ( is_bool($value) )
5199                                 {
5200                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5201                                 }
5202                                 else
5203                                 {
5204                                         $value = ENTITY::hsc($value);
5205                                 }
5206                                 echo "<tr>\n";
5207                                 echo '<td>' . $key . "</td>\n";
5208                                 echo '<td>' . $value . "</td>\n";
5209                                 echo "</tr>\n";
5210                         }
5211                         echo "</tbody>\n";
5212                         echo "</table>\n\n";
5213
5214                         // Check if special modules are loaded
5215                         ob_start();
5216                         phpinfo(INFO_MODULES);
5217                         $im = ob_get_contents();
5218                         ob_clean();
5219                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5220                         echo "<thead>\n";
5221                         echo "<tr>";
5222                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5223                         echo "</tr>\n";
5224                         echo "<tbody>\n";
5225                         echo "<tr>\n";
5226                         echo '<td>mod_rewrite' . "</td>\n";
5227                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5228                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5229                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5230                         echo '<td>' . $modrewrite . "</td>\n";
5231                         echo "</tr>\n";
5232                         echo "</tbody>\n";
5233                         echo "</table>\n\n";
5234
5235                         // Information about the used Nucleus CMS
5236                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5237                         global $nucleus;
5238                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5239                         $np = getNucleusPatchLevel();
5240                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5241                         echo "<thead>\n";
5242                         echo "<tr>\n";
5243                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5244                         echo "</tr>\n";
5245                         echo "</thead>\n";
5246                         echo "<tbody>\n";
5247                         echo "<tr>\n";
5248                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5249                         echo '<td>' . $nv . "</td>\n";
5250                         echo "</tr>\n";
5251                         echo "<tr>\n";
5252                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5253                         echo '<td>' . $np . "</td>\n";
5254                         echo "</tr>\n";
5255                         echo "</tbody>\n";
5256                         echo "</table>\n\n";
5257
5258                         // Important settings of the installation
5259                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5260                         echo "<thead>\n";
5261                         echo "<tr>\n";
5262                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5263                         echo "</tr>\n";
5264                         echo "</thead>\n";
5265                         echo "<tbody>\n";
5266                         echo "<tr>\n";
5267                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5268                         echo '<td>' . $CONF['Self'] . "</td>\n";
5269                         echo "</tr>\n";
5270                         echo "<tr>\n";
5271                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5272                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5273                         echo "</tr>\n";
5274                         echo "<tr>\n";
5275                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5276                         $ohs = $CONF['alertOnHeadersSent'] ?
5277                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5278                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5279                         echo '<td>' . $ohs . "</td>\n";
5280                         echo "</tr>\n";
5281                         echo "<tr>\n";
5282                         echo "<td>i18n::get_current_charset()</td>\n";
5283                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5284                         echo "</tr>\n";
5285                         echo "</tbody>\n";
5286                         echo "</table>\n\n";
5287
5288                         // Link to the online version test at the Nucleus CMS website
5289                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5290                         if ( $nucleus['codename'] != '')
5291                         {
5292                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5293                         }
5294                         else
5295                         {
5296                                 $codenamestring = '';
5297                         }
5298                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5299                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5300                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5301                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5302                         echo '</a>';
5303                 }
5304                 else
5305                 {
5306                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5307                 }
5308                 $this->pagefoot();
5309         }
5310
5311         /**
5312          * ADMIN::updateConfig()
5313          *
5314          * @param       string  $name
5315          * @param       string  $val
5316          * @return      integer return the ID in which the latest query posted
5317          */
5318         function updateConfig($name, $val)
5319         {
5320                 $name = sql_real_escape_string($name);
5321                 $val = trim(sql_real_escape_string($val));
5322
5323                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5324                 $query = sprintf($query, sql_table('config'), $val, $name);
5325                 sql_query($query) or die("Query error: " . sql_error());
5326                 return sql_insert_id();
5327         }
5328
5329         /**
5330          * Error message
5331          * @param string $msg message that will be shown
5332          */
5333         function error($msg)
5334         {
5335                 $this->pagehead();
5336
5337                 echo "<h2>Error!</h2>\n";
5338                 echo $msg;
5339                 echo "<br />\n";
5340                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5341                 $this->pagefoot();
5342                 exit;
5343         }
5344
5345         /**
5346          * ADMIN::disallow()
5347          * add error log and show error page
5348          *
5349          * @param       void
5350          * @return      void
5351          */
5352         function disallow()
5353         {
5354                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5355                 $this->error(_ERROR_DISALLOWED);
5356         }
5357
5358         /**
5359          * ADMIN::pagehead()
5360          * Output admin page head
5361          *
5362          * @param       void
5363          * @return      void
5364          */
5365         function pagehead($extrahead = '')
5366         {
5367                 global $member, $nucleus, $CONF, $manager;
5368
5369                 $manager->notify(
5370                         'AdminPrePageHead',
5371                         array(
5372                                 'extrahead' => &$extrahead,
5373                                 'action' => $this->action));
5374
5375                 $baseUrl = ENTITY::hsc($CONF['AdminURL']);
5376                 if ( !array_key_exists('AdminCSS',$CONF) )
5377                 {
5378                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5379                         $CONF['AdminCSS'] = 'original';
5380                 }
5381
5382                 /* HTTP 1.1 application for no caching */
5383                 header("Cache-Control: no-cache, must-revalidate");
5384                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5385
5386                 $root_element = 'html';
5387                 $charset = i18n::get_current_charset();
5388                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5389
5390                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5391                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5392                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5393                 echo "<head>\n";
5394                 echo '<title>' . ENTITY::hsc($CONF['SiteName']) . " - Admin</title>\n";
5395                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5396                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5397                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5398                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5399                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5400                 echo "{$extrahead}\n";
5401                 echo "</head>\n\n";
5402                 echo "<body>\n";
5403                 echo "<div id=\"adminwrapper\">\n";
5404                 echo "<div class=\"header\">\n";
5405                 echo '<h1>' . ENTITY::hsc($CONF['SiteName']) . "</h1>\n";
5406                 echo "</div>\n";
5407                 echo "<div id=\"container\">\n";
5408                 echo "<div id=\"content\">\n";
5409                 echo "<div class=\"loginname\">\n";
5410                 if ( $member->isLoggedIn() )
5411                 {
5412                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5413                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5414                 }
5415                 else
5416                 {
5417                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5418                 }
5419                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5420                 echo '(';
5421
5422                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5423                 {
5424                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5425                 }
5426                 else
5427                 {
5428                         $codenamestring = '';
5429                 }
5430
5431                 if ( $member->isLoggedIn() && $member->isAdmin() )
5432                 {
5433                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5434                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5435
5436                         $newestVersion = getLatestVersion();
5437                         $newestCompare = str_replace('/','.',$newestVersion);
5438                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5439                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5440                         {
5441                                 echo "<br />\n";
5442                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5443                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5444                                 echo "</a>";
5445                         }
5446                 }
5447                 else
5448                 {
5449                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5450                 }
5451                 echo ')';
5452                 echo '</div>';
5453                 return;
5454         }
5455
5456         /**
5457          * ADMIN::pagefoot()
5458          * Output admin page foot include quickmenu
5459          *
5460          * @param       void
5461          * @return      void
5462          */
5463         function pagefoot()
5464         {
5465                 global $action, $member, $manager;
5466
5467                 $manager->notify(
5468                         'AdminPrePageFoot',
5469                         array('action' => $this->action)
5470                 );
5471
5472                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5473                 {
5474                         echo '<h2>' . _LOGOUT . "</h2>\n";
5475                         echo "<ul>\n";
5476                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5477                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5478                         echo "</ul>\n";
5479                 }
5480
5481                 echo "<div class=\"foot\">\n";
5482                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5483                 echo '-';
5484                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5485                 echo "</div>\n";
5486
5487                 echo "<!-- content -->\n";
5488                 echo "<div id=\"quickmenu\">\n";
5489
5490                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5491                 {
5492                         echo "<ul>\n";
5493                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5494                         echo "</ul>\n";
5495
5496                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5497                         echo "<form method=\"get\" action=\"index.php\">\n";
5498                         echo "<p>\n";
5499                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5500
5501                         $showAll = requestVar('showall');
5502
5503                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5504                         {
5505                                 // Super-Admins have access to all blogs! (no add item support though)
5506                                 $query =  'SELECT bnumber as value, bname as text'
5507                                                 . ' FROM ' . sql_table('blog')
5508                                                 . ' ORDER BY bname';
5509                         }
5510                         else
5511                         {
5512                                 $query =  'SELECT bnumber as value, bname as text'
5513                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5514                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5515                                                 . ' ORDER BY bname';
5516                         }
5517                         $template['name'] = 'blogid';
5518                         $template['tabindex'] = 15000;
5519                         $template['extra'] = _QMENU_ADD_SELECT;
5520                         $template['selected'] = -1;
5521                         $template['shorten'] = 10;
5522                         $template['shortenel'] = '';
5523                         $template['javascript'] = 'onchange="return form.submit()"';
5524                         showlist($query,'select',$template);
5525
5526                         echo "</p>\n";
5527                         echo "</form>\n";
5528
5529                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5530                         echo "<ul>\n";
5531                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5532                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5533                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5534                         echo "</ul>\n";
5535
5536                         // ---- general settings ----
5537                         if ( $member->isAdmin() )
5538                         {
5539                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5540                                 echo "<ul>\n";
5541                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5542                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5543                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5544                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5545                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5546                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5547                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5548                                 echo "</ul>\n";
5549
5550                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5551                                 echo "<ul>\n";
5552                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5553                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5554                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5555                                 echo "</ul>\n";
5556                         }
5557
5558                         $aPluginExtras = array();
5559                         $manager->notify(
5560                                 'QuickMenu',
5561                                 array(
5562                                         'options' => &$aPluginExtras));
5563
5564                         if ( count($aPluginExtras) > 0 )
5565                         {
5566                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5567                                 echo "<ul>\n";
5568                                 foreach ( $aPluginExtras as $aInfo )
5569                                 {
5570                                         echo '<li><a href="' . ENTITY::hsc($aInfo['url']) . '" title="' . ENTITY::hsc($aInfo['tooltip']) . '">' . ENTITY::hsc($aInfo['title']) . "</a></li>\n";
5571                                 }
5572                                 echo "</ul>\n";
5573                         }
5574                 }
5575                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5576                 {
5577
5578                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5579                 }
5580                 else
5581                 {
5582                         // introduction text on login screen
5583                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5584                 }
5585
5586                 echo "<!-- quickmenu -->\n";
5587                 echo "</div>\n";
5588
5589                 echo "<!-- content -->\n";
5590                 echo "</div>\n";
5591
5592                 echo "<!-- container -->\n";
5593                 echo "</div>\n";
5594
5595                 echo "<!-- adminwrapper -->\n";
5596                 echo "</div>\n";
5597
5598                 echo "</body>\n";
5599                 echo "</html>\n";
5600                 return;
5601         }
5602
5603     /**
5604      * @todo document this
5605      */
5606     function action_regfile() {
5607         global $member, $CONF;
5608
5609         $blogid = intRequestVar('blogid');
5610
5611         $member->teamRights($blogid) or $this->disallow();
5612
5613         // header-code stolen from phpMyAdmin
5614         // REGEDIT and bookmarklet code stolen from GreyMatter
5615
5616         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5617
5618
5619         header('Content-Type: application/octetstream');
5620         header('Content-Disposition: filename="nucleus.reg"');
5621         header('Pragma: no-cache');
5622         header('Expires: 0');
5623
5624         echo "REGEDIT4\n";
5625         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5626         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5627         echo '"contexts"=hex:31';
5628     }
5629
5630     /**
5631      * @todo document this
5632      */
5633     function action_bookmarklet() {
5634         global $member, $manager;
5635
5636         $blogid = intRequestVar('blogid');
5637
5638         $member->teamRights($blogid) or $this->disallow();
5639
5640         $blog =& $manager->getBlog($blogid);
5641         $bm = getBookmarklet($blogid);
5642
5643         $this->pagehead();
5644
5645         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5646
5647         ?>
5648
5649         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5650
5651         <p>
5652         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5653         </p>
5654
5655         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5656         <p>
5657             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5658             <br />
5659             <br />
5660             <?php echo '<a href="' . ENTITY::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, ENTITY::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5661         </p>
5662
5663         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5664         <p>
5665             <?php
5666                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5667                 $url = $manager->addTicketToUrl($url);
5668             ?>
5669             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . ENTITY::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5670         </p>
5671
5672         <p>
5673             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5674         </p>
5675
5676         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5677         <p>
5678             <?php echo _BOOKMARKLET_DELETEBAR ?>
5679         </p>
5680
5681         <p>
5682             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5683         </p>
5684
5685         <ol>
5686             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5687             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5688             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5689             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5690             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5691         </ol>
5692
5693         <?php
5694         $this->pagefoot();
5695
5696     }
5697
5698     /**
5699      * @todo document this
5700      */
5701     function action_actionlog() {
5702         global $member, $manager;
5703
5704         $member->isAdmin() or $this->disallow();
5705
5706         $this->pagehead();
5707
5708         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5709
5710         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5711
5712         ?>
5713             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5714             <p><a href="<?php echo ENTITY::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5715         <?php
5716         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5717
5718         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5719         $template['content'] = 'actionlist';
5720         $amount = showlist($query,'table',$template);
5721
5722         $this->pagefoot();
5723
5724     }
5725
5726     /**
5727      * @todo document this
5728      */
5729     function action_banlist() {
5730         global $member, $manager;
5731
5732         $blogid = intRequestVar('blogid');
5733
5734         $member->blogAdminRights($blogid) or $this->disallow();
5735
5736         $blog =& $manager->getBlog($blogid);
5737
5738         $this->pagehead();
5739
5740         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5741
5742         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5743
5744         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5745         $template['content'] = 'banlist';
5746         $amount = showlist($query,'table',$template);
5747
5748         if ($amount == 0)
5749             echo _BAN_NONE;
5750
5751         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5752         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5753
5754
5755         $this->pagefoot();
5756
5757     }
5758
5759     /**
5760      * @todo document this
5761      */
5762     function action_banlistdelete() {
5763         global $member, $manager;
5764
5765         $blogid = intRequestVar('blogid');
5766         $iprange = requestVar('iprange');
5767
5768         $member->blogAdminRights($blogid) or $this->disallow();
5769
5770         $blog =& $manager->getBlog($blogid);
5771         $banBlogName =  ENTITY::hsc($blog->getName());
5772
5773         $this->pagehead();
5774         ?>
5775             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5776
5777             <form method="post" action="index.php">
5778
5779             <h3><?php echo _BAN_IPRANGE?></h3>
5780
5781             <p>
5782                 <?php echo _CONFIRMTXT_BAN?> <?php echo ENTITY::hsc($iprange) ?>
5783                 <input name="iprange" type="hidden" value="<?php echo ENTITY::hsc($iprange)?>" />
5784             </p>
5785
5786             <h3><?php echo _BAN_BLOGS?></h3>
5787
5788             <div>
5789                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5790                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5791                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5792                 <br />
5793                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5794             </div>
5795
5796             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5797
5798             <div>
5799                 <?php $manager->addTicketHidden() ?>
5800                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5801                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5802             </div>
5803
5804             </form>
5805         <?php
5806         $this->pagefoot();
5807     }
5808
5809     /**
5810      * @todo document this
5811      */
5812     function action_banlistdeleteconfirm() {
5813         global $member, $manager;
5814
5815         $blogid = intPostVar('blogid');
5816         $allblogs = postVar('allblogs');
5817         $iprange = postVar('iprange');
5818
5819         $member->blogAdminRights($blogid) or $this->disallow();
5820
5821         $deleted = array();
5822
5823         if (!$allblogs) {
5824             if (BAN::removeBan($blogid, $iprange))
5825                 array_push($deleted, $blogid);
5826         } else {
5827             // get blogs fot which member has admin rights
5828             $adminblogs = $member->getAdminBlogs();
5829             foreach ($adminblogs as $blogje) {
5830                 if (BAN::removeBan($blogje, $iprange))
5831                     array_push($deleted, $blogje);
5832             }
5833         }
5834
5835         if (sizeof($deleted) == 0)
5836             $this->error(_ERROR_DELETEBAN);
5837
5838         $this->pagehead();
5839
5840         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5841         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5842         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5843
5844         echo "<ul>";
5845         foreach ($deleted as $delblog) {
5846             $b =& $manager->getBlog($delblog);
5847             echo "<li>" . ENTITY::hsc($b->getName()). "</li>";
5848         }
5849         echo "</ul>";
5850
5851         $this->pagefoot();
5852
5853     }
5854
5855     /**
5856      * @todo document this
5857      */
5858     function action_banlistnewfromitem() {
5859         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5860     }
5861
5862     /**
5863      * @todo document this
5864      */
5865     function action_banlistnew($blogid = '') {
5866         global $member, $manager;
5867
5868         if ($blogid == '')
5869             $blogid = intRequestVar('blogid');
5870
5871         $ip = requestVar('ip');
5872
5873         $member->blogAdminRights($blogid) or $this->disallow();
5874
5875         $blog =& $manager->getBlog($blogid);
5876
5877         $this->pagehead();
5878         ?>
5879         <h2><?php echo _BAN_ADD_TITLE?></h2>
5880
5881
5882         <form method="post" action="index.php">
5883
5884         <h3><?php echo _BAN_IPRANGE?></h3>
5885
5886         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5887
5888         <div class="note">
5889             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5890             <?php echo _BAN_EXAMPLE_TEXT ?>
5891         </div>
5892
5893         <div>
5894         <?php
5895         if ($ip) {
5896             $iprangeVal = ENTITY::hsc($ip);
5897         ?>
5898             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5899             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5900             <br />
5901             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5902             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5903             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5904         <?php
5905         } else {
5906             echo "<input name='iprange' value='custom' type='hidden' />";
5907             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5908         }
5909         ?>
5910         </div>
5911
5912         <h3><?php echo _BAN_BLOGS?></h3>
5913
5914         <p><?php echo _BAN_BLOGS_TEXT?></p>
5915
5916         <div>
5917             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5918             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo ENTITY::hsc($blog->getName())?>'</label>
5919             <br />
5920             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5921         </div>
5922
5923         <h3><?php echo _BAN_REASON_TITLE?></h3>
5924
5925         <p><?php echo _BAN_REASON_TEXT?></p>
5926
5927         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5928
5929         <h3><?php echo _BAN_ADD_TITLE?></h3>
5930
5931         <div>
5932             <input name="action" type="hidden" value="banlistadd" />
5933             <?php $manager->addTicketHidden() ?>
5934             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5935         </div>
5936
5937         </form>
5938
5939         <?php       $this->pagefoot();
5940     }
5941
5942     /**
5943      * @todo document this
5944      */
5945     function action_banlistadd() {
5946         global $member;
5947
5948         $blogid =       intPostVar('blogid');
5949         $allblogs =     postVar('allblogs');
5950         $iprange =      postVar('iprange');
5951         if ($iprange == "custom")
5952             $iprange = postVar('customiprange');
5953         $reason =       postVar('reason');
5954
5955         $member->blogAdminRights($blogid) or $this->disallow();
5956
5957         // TODO: check IP range validity
5958
5959         if (!$allblogs) {
5960             if (!BAN::addBan($blogid, $iprange, $reason))
5961                 $this->error(_ERROR_ADDBAN);
5962         } else {
5963             // get blogs fot which member has admin rights
5964             $adminblogs = $member->getAdminBlogs();
5965             $failed = 0;
5966             foreach ($adminblogs as $blogje) {
5967                 if (!BAN::addBan($blogje, $iprange, $reason))
5968                     $failed = 1;
5969             }
5970             if ($failed)
5971                 $this->error(_ERROR_ADDBAN);
5972         }
5973
5974         $this->action_banlist();
5975
5976     }
5977
5978     /**
5979      * @todo document this
5980      */
5981     function action_clearactionlog() {
5982         global $member;
5983
5984         $member->isAdmin() or $this->disallow();
5985
5986         ACTIONLOG::clear();
5987
5988         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5989     }
5990
5991     /**
5992      * @todo document this
5993      */
5994     function action_backupoverview() {
5995         global $member, $manager;
5996
5997         $member->isAdmin() or $this->disallow();
5998
5999         $this->pagehead();
6000
6001         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6002         ?>
6003         <h2><?php echo _BACKUPS_TITLE?></h2>
6004
6005         <h3><?php echo _BACKUP_TITLE?></h3>
6006
6007         <p><?php echo _BACKUP_INTRO?></p>
6008
6009         <form method="post" action="index.php"><p>
6010         <input type="hidden" name="action" value="backupcreate" />
6011         <?php $manager->addTicketHidden() ?>
6012
6013         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
6014         <br />
6015         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
6016         <br /><br />
6017         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
6018
6019         </p></form>
6020
6021         <div class="note"><?php echo _BACKUP_NOTE?></div>
6022
6023
6024         <h3><?php echo _RESTORE_TITLE?></h3>
6025
6026         <div class="note"><?php echo _RESTORE_NOTE?></div>
6027
6028         <p><?php echo _RESTORE_INTRO?></p>
6029
6030         <form method="post" action="index.php" enctype="multipart/form-data"><p>
6031             <input type="hidden" name="action" value="backuprestore" />
6032             <?php $manager->addTicketHidden() ?>
6033             <input name="backup_file" type="file" tabindex="30" />
6034             <br /><br />
6035             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6036             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6037             <br /><?php echo _RESTORE_WARNING?>
6038         </p></form>
6039
6040         <?php       $this->pagefoot();
6041     }
6042
6043     /**
6044      * @todo document this
6045      */
6046     function action_backupcreate() {
6047         global $member, $DIR_LIBS;
6048
6049         $member->isAdmin() or $this->disallow();
6050
6051         // use compression ?
6052         $useGzip = intval(postVar('gzip'));
6053
6054         include($DIR_LIBS . 'backup.php');
6055
6056         // try to extend time limit
6057         // (creating/restoring dumps might take a while)
6058         @set_time_limit(1200);
6059
6060         $bu = new Backup();
6061         $bu->do_backup($useGzip);
6062         exit;
6063     }
6064
6065     /**
6066      * @todo document this
6067      */
6068     function action_backuprestore() {
6069         global $member, $DIR_LIBS;
6070
6071         $member->isAdmin() or $this->disallow();
6072
6073         if (intPostVar('letsgo') != 1)
6074             $this->error(_ERROR_BACKUP_NOTSURE);
6075
6076         include($DIR_LIBS . 'backup.php');
6077
6078         // try to extend time limit
6079         // (creating/restoring dumps might take a while)
6080         @set_time_limit(1200);
6081
6082         $bu = new Backup();
6083         $message = $bu->do_restore();
6084         if ($message != '')
6085             $this->error($message);
6086
6087         $this->pagehead();
6088         ?>
6089         <h2><?php echo _RESTORE_COMPLETE?></h2>
6090         <?php       $this->pagefoot();
6091
6092     }
6093
6094     /**
6095      * @todo document this
6096      */
6097     function action_pluginlist() {
6098         global $member, $manager;
6099
6100         // check if allowed
6101         $member->isAdmin() or $this->disallow();
6102
6103         $this->pagehead();
6104
6105         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6106
6107         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6108
6109         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6110
6111
6112         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6113
6114         $template['content'] = 'pluginlist';
6115         $template['tabindex'] = 10;
6116         showlist($query, 'table', $template);
6117
6118 ?>
6119                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6120
6121                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6122
6123                         <form method="post" action="index.php"><div>
6124                                 <input type="hidden" name="action" value="pluginupdate" />
6125                                 <?php $manager->addTicketHidden() ?>
6126                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6127                         </div></form>
6128
6129                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6130
6131 <?php
6132                 // find a list of possibly non-installed plugins
6133                 $candidates = array();
6134
6135                 global $DIR_PLUGINS;
6136
6137                 $dirhandle = opendir($DIR_PLUGINS);
6138
6139                 while ($filename = readdir($dirhandle) )
6140                 {
6141
6142                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6143                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6144
6145                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6146                         {
6147
6148                                 $name = $matches[1];
6149                                 // only show in list when not yet installed
6150                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6151
6152                                 if (sql_num_rows($res) == 0)
6153                                 {
6154                                         array_push($candidates, $name);
6155                                 }
6156
6157                         }
6158
6159                 }
6160
6161                 closedir($dirhandle);
6162
6163                 if (sizeof($candidates) > 0)
6164                 {
6165 ?>
6166                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6167
6168                         <form method='post' action='index.php'><div>
6169                                 <input type='hidden' name='action' value='pluginadd' />
6170                                 <?php $manager->addTicketHidden() ?>
6171                                 <select name="filename" tabindex="30">
6172 <?php
6173                         foreach($candidates as $name)
6174                         {
6175                                 echo '<option value="NP_',$name,'">',ENTITY::hsc($name),'</option>';
6176                         }
6177 ?>
6178                                 </select>
6179                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6180                         </div></form>
6181
6182 <?php
6183                 }
6184                 else
6185                 {
6186                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6187                 }
6188
6189                 $this->pagefoot();
6190
6191         }
6192
6193     /**
6194      * @todo document this
6195      */
6196     function action_pluginhelp() {
6197         global $member, $manager, $DIR_PLUGINS, $CONF;
6198
6199         // check if allowed
6200         $member->isAdmin() or $this->disallow();
6201
6202         $plugid = intGetVar('plugid');
6203
6204         if (!$manager->pidInstalled($plugid))
6205             $this->error(_ERROR_NOSUCHPLUGIN);
6206
6207         $plugName = getPluginNameFromPid($plugid);
6208
6209         $this->pagehead();
6210
6211         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6212
6213         echo '<h2>',_PLUGS_HELP_TITLE,': ',ENTITY::hsc($plugName),'</h2>';
6214
6215         $plug =& $manager->getPlugin($plugName);
6216         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6217
6218         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6219             @readfile($helpFile);
6220         } else {
6221             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6222             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6223         }
6224
6225
6226         $this->pagefoot();
6227     }
6228
6229         /**
6230          * ADMIN::action_pluginadd()
6231          *
6232          * @param       Void
6233          * @return      Void
6234          *
6235          */
6236         function action_pluginadd()
6237         {
6238                 global $member, $manager, $DIR_PLUGINS;
6239
6240                 // check if allowed
6241                 $member->isAdmin() or $this->disallow();
6242
6243                 $name = postVar('filename');
6244
6245                 if ( $manager->pluginInstalled($name) )
6246                 {
6247                         $this->error(_ERROR_DUPPLUGIN);
6248                 }
6249
6250                 if ( !checkPlugin($name) )
6251                 {
6252                         $this->error(_ERROR_PLUGFILEERROR . ' (' . ENTITY::hsc($name) . ')');
6253                 }
6254
6255                 // get number of currently installed plugins
6256                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6257                 $numCurrent = sql_num_rows($res);
6258
6259                 // plugin will be added as last one in the list
6260                 $newOrder = $numCurrent + 1;
6261
6262                 $manager->notify(
6263                         'PreAddPlugin',
6264                         array(
6265                                 'file' => &$name
6266                         )
6267                 );
6268
6269                 // do this before calling getPlugin (in case the plugin id is used there)
6270                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6271                 sql_query($query);
6272                 $iPid = sql_insert_id();
6273
6274                 $manager->clearCachedInfo('installedPlugins');
6275
6276                 // Load the plugin for condition checking and instalation
6277                 $plugin =& $manager->getPlugin($name);
6278
6279                 // check if it got loaded (could have failed)
6280                 if ( !$plugin )
6281                 {
6282                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6283                         $manager->clearCachedInfo('installedPlugins');
6284                         $this->error(_ERROR_PLUGIN_LOAD);
6285                 }
6286
6287                 // check if plugin needs a newer Nucleus version
6288                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
6289                 {
6290                         // uninstall plugin again...
6291                         $this->deleteOnePlugin($plugin->getID());
6292
6293                         // ...and show error
6294                         $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc($plugin->getMinNucleusVersion()));
6295                 }
6296
6297                 // check if plugin needs a newer Nucleus version
6298                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
6299                 {
6300                         // uninstall plugin again...
6301                         $this->deleteOnePlugin($plugin->getID());
6302
6303                         // ...and show error
6304                         $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6305                 }
6306
6307                 $pluginList = $plugin->getPluginDep();
6308                 foreach ( $pluginList as $pluginName )
6309                 {
6310                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6311                         if (sql_num_rows($res) == 0)
6312                         {
6313                                 // uninstall plugin again...
6314                                 $this->deleteOnePlugin($plugin->getID());
6315                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, ENTITY::hsc($pluginName)));
6316                         }
6317                 }
6318
6319                 // call the install method of the plugin
6320                 $plugin->install();
6321
6322                 $manager->notify(
6323                         'PostAddPlugin',
6324                         array(
6325                                 'plugin' => &$plugin
6326                         )
6327                 );
6328
6329                 // update all events
6330                 $this->action_pluginupdate();
6331                 return;
6332         }
6333
6334         /**
6335          * ADMIN:action_pluginupdate():
6336          *
6337          * @param       Void
6338          * @return      Void
6339          *
6340          */
6341         function action_pluginupdate()
6342         {
6343                 global $member, $manager, $CONF;
6344
6345                 // check if allowed
6346                 $member->isAdmin() or $this->disallow();
6347
6348                 // delete everything from plugin_events
6349                 sql_query('DELETE FROM '.sql_table('plugin_event'));
6350
6351                 // loop over all installed plugins
6352                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6353                 while ( $o = sql_fetch_object($res) )
6354                 {
6355                         $pid = $o->pid;
6356                         $plug =& $manager->getPlugin($o->pfile);
6357                         if ( $plug )
6358                         {
6359                                 $eventList = $plug->getEventList();
6360                                 foreach ( $eventList as $eventName )
6361                                 {
6362                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";
6363                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));
6364                                         sql_query($query);
6365                                 }
6366                         }
6367                 }
6368                 redirect($CONF['AdminURL'] . '?action=pluginlist');
6369                 return;
6370         }
6371
6372     /**
6373      * @todo document this
6374      */
6375     function action_plugindelete() {
6376         global $member, $manager;
6377
6378         // check if allowed
6379         $member->isAdmin() or $this->disallow();
6380
6381         $pid = intGetVar('plugid');
6382
6383         if (!$manager->pidInstalled($pid))
6384             $this->error(_ERROR_NOSUCHPLUGIN);
6385
6386         $this->pagehead();
6387         ?>
6388             <h2><?php echo _DELETE_CONFIRM?></h2>
6389
6390             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6391
6392             <form method="post" action="index.php"><div>
6393             <?php $manager->addTicketHidden() ?>
6394             <input type="hidden" name="action" value="plugindeleteconfirm" />
6395             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6396             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6397             </div></form>
6398         <?php
6399         $this->pagefoot();
6400     }
6401
6402     /**
6403      * @todo document this
6404      */
6405     function action_plugindeleteconfirm() {
6406         global $member, $manager, $CONF;
6407
6408         // check if allowed
6409         $member->isAdmin() or $this->disallow();
6410
6411         $pid = intPostVar('plugid');
6412
6413         $error = $this->deleteOnePlugin($pid, 1);
6414         if ($error) {
6415             $this->error($error);
6416         }
6417
6418         redirect($CONF['AdminURL'] . '?action=pluginlist');
6419 //              $this->action_pluginlist();
6420     }
6421
6422     /**
6423      * @todo document this
6424      */
6425     function deleteOnePlugin($pid, $callUninstall = 0) {
6426         global $manager;
6427
6428         $pid = intval($pid);
6429
6430         if (!$manager->pidInstalled($pid))
6431             return _ERROR_NOSUCHPLUGIN;
6432
6433         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6434
6435 /*              // call the unInstall method of the plugin
6436         if ($callUninstall) {
6437             $plugin =& $manager->getPlugin($name);
6438             if ($plugin) $plugin->unInstall();
6439         }*/
6440
6441         // check dependency before delete
6442         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6443         while($o = sql_fetch_object($res)) {
6444             $plug =& $manager->getPlugin($o->pfile);
6445             if ($plug)
6446             {
6447                 $depList = $plug->getPluginDep();
6448                 foreach ($depList as $depName)
6449                 {
6450                     if ($name == $depName)
6451                     {
6452                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6453                     }
6454                 }
6455             }
6456         }
6457
6458         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6459
6460         // call the unInstall method of the plugin
6461         if ($callUninstall) {
6462             $plugin =& $manager->getPlugin($name);
6463             if ($plugin) $plugin->unInstall();
6464         }
6465
6466         // delete all subscriptions
6467         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6468
6469         // delete all options
6470         // get OIDs from plugin_option_desc
6471         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6472         $aOIDs = array();
6473         while ($o = sql_fetch_object($res)) {
6474             array_push($aOIDs, $o->oid);
6475         }
6476
6477         // delete from plugin_option and plugin_option_desc
6478         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6479         if (count($aOIDs) > 0)
6480             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6481
6482         // update order numbers
6483         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6484         $o = sql_fetch_object($res);
6485         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6486
6487         // delete row
6488         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6489
6490         $manager->clearCachedInfo('installedPlugins');
6491         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6492
6493         return '';
6494     }
6495
6496     /**
6497      * @todo document this
6498      */
6499     function action_pluginup() {
6500         global $member, $manager, $CONF;
6501
6502         // check if allowed
6503         $member->isAdmin() or $this->disallow();
6504
6505         $plugid = intGetVar('plugid');
6506
6507         if (!$manager->pidInstalled($plugid))
6508             $this->error(_ERROR_NOSUCHPLUGIN);
6509
6510         // 1. get old order number
6511         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6512         $o = sql_fetch_object($res);
6513         $oldOrder = $o->porder;
6514
6515         // 2. calculate new order number
6516         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6517
6518         // 3. update plug numbers
6519         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6520         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6521
6522         //$this->action_pluginlist();
6523         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6524         redirect($CONF['AdminURL'] . '?action=pluginlist');
6525     }
6526
6527     /**
6528      * @todo document this
6529      */
6530     function action_plugindown() {
6531         global $member, $manager, $CONF;
6532
6533         // check if allowed
6534         $member->isAdmin() or $this->disallow();
6535
6536         $plugid = intGetVar('plugid');
6537         if (!$manager->pidInstalled($plugid))
6538             $this->error(_ERROR_NOSUCHPLUGIN);
6539
6540         // 1. get old order number
6541         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6542         $o = sql_fetch_object($res);
6543         $oldOrder = $o->porder;
6544
6545         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6546         $maxOrder = sql_num_rows($res);
6547
6548         // 2. calculate new order number
6549         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6550
6551         // 3. update plug numbers
6552         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6553         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6554
6555         //$this->action_pluginlist();
6556         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6557         redirect($CONF['AdminURL'] . '?action=pluginlist');
6558     }
6559
6560         /**
6561          * ADMIN::action_pluginoptions()
6562          *
6563          * Output Plugin option page
6564          *
6565          * @access      public
6566          * @param       string $message message when fallbacked
6567          * @return      void
6568          *
6569          */
6570         public function action_pluginoptions($message = '')
6571         {
6572                 global $member, $manager;
6573
6574                 // check if allowed
6575                 $member->isAdmin() or $this->disallow();
6576
6577                 $pid = (integer) requestVar('plugid');
6578                 if ( !$manager->pidInstalled($pid) )
6579                 {
6580                         $this->error(_ERROR_NOSUCHPLUGIN);
6581                 }
6582
6583                 $pname = getPluginNameFromPid($pid);
6584
6585                 /* just for including translation */
6586                 $manager->getPlugin($pname);
6587
6588                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6589                 $this->pagehead($extrahead);
6590                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6591                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($pname)) . "</h2>\n";
6592
6593                 if ( isset($message) )
6594                 {
6595                         echo $message;
6596                 }
6597
6598                 echo "<form action=\"index.php\" method=\"post\">\n";
6599                 echo "<div>\n";
6600                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6601                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6602                 $manager->addTicketHidden();
6603
6604                 $aOptions = array();
6605                 $aOIDs = array();
6606                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6607                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6608                 $result = sql_query($query);
6609                 while ( $object = sql_fetch_object($result) )
6610                 {
6611                         array_push($aOIDs, $object->oid);
6612                         $aOptions[$object->oid] = array(
6613                                                 'oid' => $object->oid,
6614                                                 'value' => $object->odef,
6615                                                 'name' => $object->oname,
6616                                                 'description' => $object->odesc,
6617                                                 'type' => $object->otype,
6618                                                 'typeinfo' => $object->oextra,
6619                                                 'contextid' => 0
6620                         );
6621                 }
6622                 // fill out actual values
6623                 if ( count($aOIDs) > 0 )
6624                 {
6625                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6626                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6627                         $result = sql_query($query);
6628                         while ( $object = sql_fetch_object($result) )
6629                         {
6630                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6631                         }
6632                 }
6633
6634                 // call plugins
6635                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6636                 $manager->notify('PrePluginOptionsEdit',$data);
6637
6638                 $template['content'] = 'plugoptionlist';
6639                 $amount = showlist($aOptions,'table',$template);
6640                 if ( $amount == 0 )
6641                 {
6642                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6643                 }
6644                 echo "</div>\n";
6645                 echo "</form>\n";
6646                 $this->pagefoot();
6647
6648                 return;
6649         }
6650
6651         /**
6652          * ADMIN::action_pluginoptionsupdate()
6653          *
6654          * Update plugin options and fallback to plugin option page
6655          *
6656          * @access      public
6657          * @param       void
6658          * @return      void
6659          */
6660         public function action_pluginoptionsupdate()
6661         {
6662                 global $member, $manager;
6663
6664                 // check if allowed
6665                 $member->isAdmin() or $this->disallow();
6666
6667                 $pid = (integer) requestVar('plugid');
6668                 if ( !$manager->pidInstalled($pid) )
6669                 {
6670                         $this->error(_ERROR_NOSUCHPLUGIN);
6671                 }
6672
6673                 $aOptions = requestArray('plugoption');
6674                 NucleusPlugin::apply_plugin_options($aOptions);
6675
6676                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6677
6678                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6679                 return;
6680         }
6681
6682         /**
6683          * ADMIN::_insertPluginOptions()
6684          *
6685          * Output plugin option field
6686          *
6687          * @access      public
6688          * @param string        $context        plugin option context
6689          * @param integer       $contextid      plugin option context id
6690          * @return      void
6691          */
6692         public function _insertPluginOptions($context, $contextid = 0)
6693         {
6694                 // get all current values for this contextid
6695                 // (note: this might contain doubles for overlapping contextids)
6696                 $aIdToValue = array();
6697                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6698                 while ( $object = sql_fetch_object($res) )
6699                 {
6700                         $aIdToValue[$object->oid] = $object->ovalue;
6701                 }
6702
6703                 // get list of oids per pid
6704                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6705                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6706                 $res = sql_query($query);
6707                 $aOptions = array();
6708                 while ( $object = sql_fetch_object($res) )
6709                 {
6710                         if (in_array($object->oid, array_keys($aIdToValue)))
6711                         {
6712                                 $value = $aIdToValue[$object->oid];
6713                         }
6714                         else
6715                         {
6716                                 $value = $object->odef;
6717                         }
6718
6719                         array_push($aOptions, array(
6720                                 'pid' => $object->pid,
6721                                 'pfile' => $object->pfile,
6722                                 'oid' => $object->oid,
6723                                 'value' => $value,
6724                                 'name' => $object->oname,
6725                                 'description' => $object->odesc,
6726                                 'type' => $object->otype,
6727                                 'typeinfo' => $object->oextra,
6728                                 'contextid' => $contextid,
6729                                 'extra' => ''));
6730                 }
6731
6732                 global $manager;
6733                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6734
6735                 $iPrevPid = -1;
6736                 foreach ($aOptions as $aOption)
6737                 {
6738                         // new plugin?
6739                         if ( $iPrevPid != $aOption['pid'] )
6740                         {
6741                                 $iPrevPid = $aOption['pid'];
6742                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6743                                 {
6744                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6745                                 }
6746                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($aOption['pfile'])).'</th></tr>';
6747                         }
6748
6749                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6750                         if ( @$meta['access'] != 'hidden' )
6751                         {
6752                                 echo '<tr>';
6753                                 listplug_plugOptionRow($aOption);
6754                                 echo '</tr>';
6755                         }
6756                 }
6757                 return;
6758         }
6759
6760         /**
6761          * ADMIN::input_yesno()
6762          * Output input elements with radio attribute for yes/no options
6763          *
6764          * @param       string  $name   name attribute
6765          * @param       string  $value_current  current value attribute
6766          * @param       integer $tabindex       tab index
6767          * @param       string  $value_yes      value attribute for yes option
6768          * @param       string  $value_no       value attribute for no option
6769          * @param       string  $text_yes       child text element for yes option
6770          * @param       string  $text_no        child text element for no option
6771          * @param       boolean $isAdmin        have admin right or not
6772          * @return      void
6773          */
6774         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6775         {
6776                 $id = preg_replace('#\[|\]#', '-', $name);
6777                 $id_yes = $id . $value_yes;
6778                 $id_no  = $id . $value_no;
6779
6780                 /* yes option */
6781                 echo '<input type="radio" id="' . ENTITY::hsc($id_yes) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_yes) . '"';
6782                 if ( $name=="admin" )
6783                 {
6784                         echo ' onclick="selectCanLogin(true);"';
6785                 }
6786                 if ( $value_current == $value_yes )
6787                 {
6788                         echo " tabindex='$tabindex' checked='checked'";
6789                 }
6790                 echo " />\n";
6791                 echo '<label for="' . ENTITY::hsc($id_yes) . '">' . ENTITY::hsc($text_yes) . "</label>\n";
6792
6793                 /* no option */
6794                 echo '<input type="radio" id="' . ENTITY::hsc($id_no) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_no) . '"';
6795                 if ( $name=="admin" )
6796                 {
6797                         echo ' onclick="selectCanLogin(false);"';
6798                 }
6799                 if ( $value_current != $value_yes )
6800                 {
6801                         echo " tabindex='$tabindex' checked='checked'";
6802                 }
6803                 if ($isAdmin && $name=="canlogin")
6804                 {
6805                         echo ' disabled="disabled"';
6806                 }
6807                 echo " />\n";
6808                 echo '<label for="' . ENTITY::hsc($id_no) . '">' . ENTITY::hsc($text_no) . "</label>\n";
6809
6810                 return;
6811         }
6812 }