nucleus/libs/ADMIN.php

   1 <?php
   2 /**
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18  */
  19
  20 if ( !function_exists('requestVar') ) exit;
  21 require_once dirname(__FILE__) . '/showlist.php';
  22
  23 class Admin
  24 {
  25         static private $skin;
  26
  27         static public $action;
  28         static public $aOptions;
  29         static public $blog;
  30         static public $contents;
  31         static public $extrahead;
  32         static public $headMess;
  33         static public $passvar;
  34
  35         static private $skinless_actions = array(
  36                 'plugindeleteconfirm',
  37                 'pluginoptionsupdate',
  38                 'blogsettingsupdate',
  39                 'settingsupdate',
  40                 'addnewlog2',
  41                 'additem',
  42                 'banlistnewfromitem',
  43                 'itemdeleteconfirm',
  44                 'itemupdate',
  45                 'changemembersettings',
  46                 'clearactionlog',
  47                 'memberedit',
  48                 'login',
  49
  50                 'skinremovetypeconfirm',
  51                 'skinclone',
  52                 'skindeleteconfirm',
  53                 'skinnew',
  54                 'skineditgeneral',
  55                 'skinupdate',
  56
  57                 'skinieexport',
  58
  59                 'templateupdate',
  60                 'templatedeleteconfirm',
  61                 'templatenew',
  62                 'templateclone',
  63
  64                 'adminskinremovetypeconfirm',
  65                 'adminskinclone',
  66                 'adminskindeleteconfirm',
  67                 'adminskinnew',
  68                 'adminskineditgeneral',
  69                 'adminskinupdate',
  70
  71                 'adminskinieexport',
  72
  73                 'admintemplateupdate',
  74                 'admintemplatedeleteconfirm',
  75                 'admintemplatenew',
  76                 'admintemplateclone'
  77         );
  78
  79         static private $ticketless_actions = array(
  80                 'showlogin',
  81                 'login',
  82                 'overview',
  83                 'itemlist',
  84                 'blogcommentlist',
  85                 'bookmarklet',
  86                 'blogsettings',
  87                 'banlist',
  88                 'createaccount',
  89                 'deleteblog',
  90                 'editmembersettings',
  91                 'createaccount',
  92                 'forgotpassword',
  93                 'browseowncomments',
  94                 'createitem',
  95                 'browseownitems',
  96                 'itemedit',
  97                 'itemmove',
  98                 'categoryedit',
  99                 'categorydelete',
 100                 'manage',
 101                 'actionlog',
 102                 'settingsedit',
 103                 'backupoverview',
 104                 'pluginlist',
 105                 'createnewlog',
 106                 'usermanagement',
 107                 'itemcommentlist',
 108                 'commentedit',
 109                 'commentdelete',
 110                 'banlistnewfromitem',
 111                 'banlistdelete',
 112                 'itemdelete',
 113                 'manageteam',
 114                 'teamdelete',
 115                 'banlistnew',
 116                 'memberedit',
 117                 'memberdelete',
 118                 'pluginhelp',
 119                 'pluginoptions',
 120                 'plugindelete',
 121
 122                 'activate',
 123                 'systemoverview',
 124                 'activatesetpwd',
 125
 126                 'skinoverview',
 127                 'skinclone',
 128                 'skindelete',
 129                 'skinedit',
 130                 'skinedittype',
 131                 'skinnew',
 132                 'skinremovetype',
 133
 134                 'skinieoverview',
 135
 136                 'templateoverview',
 137                 'templateclone',
 138                 'templateedit',
 139                 'templatedelete',
 140
 141                 'adminskinoverview',
 142                 'adminskinclone',
 143                 'adminskindelete',
 144                 'adminskinedit',
 145                 'adminskinedittype',
 146                 'adminskinnew',
 147                 'adminskinremovetype',
 148
 149                 'adminskinieoverview',
 150
 151                 'admintemplateoverview',
 152                 'admintemplateclone',
 153                 'admintemplateedit',
 154                 'admintemplatedelete'
 155         );
 156
 157         /**
 158          * NOTE: This is for condition of admin/normal skin actions
 159          */
 160         static public $adminskin_actions = array(
 161                 /* ticketless */
 162                 'adminskinoverview',
 163                 'adminskinclone',
 164                 'adminskindelete',
 165                 'adminskinedit',
 166                 'adminskinedittype',
 167                 'adminskinnew',
 168                 'adminskinremovetype',
 169
 170                 'adminskinieoverview',
 171
 172                 'admintemplateoverview',
 173                 'admintemplateclone',
 174                 'admintemplateedit',
 175                 'admintemplatedelete',
 176
 177                 /* ticket needed */
 178                 'adminskineditgeneral',
 179                 'adminskinupdate',
 180                 'adminskindeleteconfirm',
 181                 'adminskinremovetypeconfirm',
 182
 183                 'adminskinieoverview',
 184                 'adminskiniedoimport',
 185                 'adminskinieexport',
 186                 'adminskinieimport',
 187
 188                 'admintemplatenew',
 189                 'admintemplatedeleteconfirm',
 190                 'admintemplateupdate'
 191         );
 192
 193         static public function initialize()
 194         {
 195                 global $CONF, $manager, $member;
 196
 197                 /* NOTE: 1. decide which skinid to use */
 198                 $skinid = $CONF['AdminSkin'];
 199                 if ( $member->isLoggedIn() )
 200                 {
 201                         $memskin = $member->getAdminSkin();
 202                         if ( $memskin && Skin::existsID($memskin))
 203                         {
 204                                 $skinid = $memskin;
 205                         }
 206                 }
 207
 208                 /* NOTE: 2. make an instance of skin object */
 209                 if ( !Skin::existsID($skinid) )
 210                 {
 211                         return FALSE;
 212                 }
 213
 214                 /* NOTE: 3. initializing each members */
 215                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
 216                 self::$action           = '';
 217                 self::$extrahead        = '';
 218                 self::$passvar          = '';
 219                 self::$headMess         = '';
 220                 self::$aOptions         = '';
 221                 return TRUE;
 222         }
 223
 224         /**
 225          * Admin::action()
 226          * Executes an action
 227          *
 228          * @param       string  $action action to be performed
 229          * @return      void
 230          */
 231         static public function action($action)
 232         {
 233                 global $CONF, $manager, $member;
 234
 235                 /* 1. decide action name */
 236                 $customAction = postvar('customaction');
 237                 if ( empty($customAction) )
 238                 {
 239                         $alias = array(
 240                                 'login' => 'overview',
 241                                 ''              => 'overview',
 242                         );
 243                 }
 244                 else
 245                 {
 246                         $alias = array(
 247                                 'login' => $customAction,
 248                                 ''              => $customAction
 249                         );
 250                 }
 251                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )
 252                 {
 253                         $action = $alias[$action];
 254                 }
 255                 $method_name = "action_{$action}";
 256                 self::$action = strtolower($action);
 257
 258                 /* 2. check ticket-needed action */
 259                 if ( !in_array(self::$action, self::$ticketless_actions) && !$manager->checkTicket() )
 260                 {
 261                         self::error(_ERROR_BADTICKET);
 262                         return;
 263                 }
 264
 265                 /* 3. parse according to the action */
 266                 else if ( method_exists('Admin', $method_name) )
 267                 {
 268                         call_user_func(array(__CLASS__, $method_name));
 269                         return;
 270                 }
 271                 /* 4. parse special admin skin */
 272                 elseif ( in_array(self::$action, self::$skinless_actions) )
 273                 {
 274                         /* TODO: need to be implemented or not?
 275                         self::action_parseSpecialskin();
 276                         */
 277                 }
 278                 else
 279                 {
 280                         self::error(_BADACTION . ENTITY::hsc($action));
 281                         return;
 282                 }
 283
 284                 return;
 285         }
 286
 287         /**
 288          * Action::action_showlogin()
 289          *
 290          * @param       void
 291          * @return      void
 292          */
 293         static private function action_showlogin()
 294         {
 295                 global $error;
 296                 self::action_login($error);
 297                 return;
 298         }
 299
 300         /**
 301          * Action::action_login()
 302          *
 303          * @param       string  $msg            message for pageheader
 304          * @param       integer $passvars       ???
 305          */
 306         static private function action_login($msg = '', $passvars = 1)
 307         {
 308                 global $member;
 309
 310                 // skip to overview when allowed
 311                 if ( $member->isLoggedIn() && $member->canLogin() )
 312                 {
 313                         self::action_overview();
 314                         return;
 315                 }
 316
 317                 /* TODO: needless variable??? */
 318                 self::$passvar = $passvars;
 319                 if ( $msg )
 320                 {
 321                         self::$headMess = $msg;
 322                 }
 323
 324                 self::$skin->parse('showlogin');
 325         }
 326
 327         /**
 328          * Action::action_overview()
 329          * provides a screen with the overview of the actions available
 330          *
 331          * @param       string  $msg    message for pageheader
 332          * @return      void
 333          */
 334         static private function action_overview($msg = '')
 335         {
 336                 if ( $msg )
 337                 {
 338                         self::$headMess = $msg;
 339                 }
 340
 341                 self::$skin->parse('overview');
 342                 return;
 343         }
 344
 345         /**
 346          * Admin::action_manage()
 347          *
 348          * @param       string  $msg    message for pageheader
 349          * @retrn       void
 350          */
 351         static private function action_manage($msg = '')
 352         {
 353                 global $member;
 354
 355                 if ( $msg )
 356                 {
 357                         self::$headMess = $msg;
 358                 }
 359                 $member->isAdmin() or self::disallow();
 360
 361                 self::$skin->parse('manage');
 362                 return;
 363         }
 364
 365         /**
 366          * Action::action_itemlist()
 367          *
 368          * @param       integer id for weblod
 369          * @return      void
 370          */
 371         static private function action_itemlist($blogid = '')
 372         {
 373                 global $member, $manager, $CONF;
 374
 375                 if ( $blogid == '' )
 376                 {
 377                         $blogid = intRequestVar('blogid');
 378                 }
 379
 380                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 381
 382                 self::$skin->parse('itemlist');
 383                 return;
 384         }
 385
 386         /**
 387          * Action::action_batchitem()
 388          *
 389          * @param       void
 390          * @return      void
 391          */
 392         static private function action_batchitem()
 393         {
 394                 global $member, $manager;
 395
 396                 $member->isLoggedIn() or self::disallow();
 397
 398                 $selected       = requestIntArray('batch');
 399                 $action         = requestVar('batchaction');
 400
 401                 if ( !is_array($selected) || sizeof($selected) == 0 )
 402                 {
 403                         self::error(_BATCH_NOSELECTION);
 404                         return;
 405                 }
 406
 407                 // On move: when no destination blog/category chosen, show choice now
 408                 $destCatid = intRequestVar('destcatid');
 409                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )
 410                 {
 411                         self::batchMoveSelectDestination('item', $selected);
 412                 }
 413
 414                 // On delete: check if confirmation has been given
 415                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 416                 {
 417                         self::batchAskDeleteConfirmation('item', $selected);
 418                 }
 419
 420                 self::$skin->parse('batchitem');
 421                 return;
 422         }
 423
 424         /**
 425          * Action::action_batchcomment()
 426          *
 427          * @param       void
 428          * @return      void
 429          */
 430         static private function action_batchcomment()
 431         {
 432                 global $member;
 433
 434                 $member->isLoggedIn() or self::disallow();
 435
 436                 $selected       = requestIntArray('batch');
 437                 $action         = requestVar('batchaction');
 438
 439                 // Show error when no items were selected
 440                 if ( !is_array($selected) || sizeof($selected) == 0 )
 441                 {
 442                         self::error(_BATCH_NOSELECTION);
 443                         return;
 444                 }
 445
 446                 // On delete: check if confirmation has been given
 447                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 448                 {
 449                         self::batchAskDeleteConfirmation('comment', $selected);
 450                 }
 451
 452                 self::$skin->parse('batchcomment');
 453                 return;
 454         }
 455
 456         /**
 457          * Admin::action_batchmember()
 458          *
 459          * @param       void
 460          * @return      void
 461          */
 462         static private function action_batchmember()
 463         {
 464                 global $member;
 465
 466                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();
 467
 468                 $selected       = requestIntArray('batch');
 469                 $action         = requestVar('batchaction');
 470
 471                 // Show error when no members selected
 472                 if ( !is_array($selected) || sizeof($selected) == 0 )
 473                 {
 474                         self::error(_BATCH_NOSELECTION);
 475                         return;
 476                 }
 477
 478                 // On delete: check if confirmation has been given
 479                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 480                 {
 481                         self::batchAskDeleteConfirmation('member',$selected);
 482                 }
 483
 484                 self::$skin->parse('batchmember');
 485                 return;
 486         }
 487
 488         /**
 489          * Admin::action_batchteam()
 490          *
 491          * @param       void
 492          * @return      void
 493          */
 494         static private function action_batchteam()
 495         {
 496                 global $member;
 497
 498                 $blogid = intRequestVar('blogid');
 499
 500                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();
 501
 502                 $selected       = requestIntArray('batch');
 503                 $action         = requestVar('batchaction');
 504
 505                 if ( !is_array($selected) || sizeof($selected) == 0 )
 506                 {
 507                         self::error(_BATCH_NOSELECTION);
 508                         return;
 509                 }
 510
 511                 // On delete: check if confirmation has been given
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 513                 {
 514                         self::batchAskDeleteConfirmation('team',$selected);
 515                 }
 516
 517                 self::$skin->parse('batchteam');
 518                 return;
 519         }
 520
 521         /**
 522          * Admin::action_batchcategory()
 523          *
 524          * @param       void
 525          * @return      void
 526          */
 527         static private function action_batchcategory()
 528         {
 529                 global $member, $manager;
 530
 531                 $member->isLoggedIn() or self::disallow();
 532
 533                 $selected       = requestIntArray('batch');
 534                 $action         = requestVar('batchaction');
 535
 536                 if ( !is_array($selected) || sizeof($selected) == 0 )
 537                 {
 538                         self::error(_BATCH_NOSELECTION);
 539                         return;
 540                 }
 541
 542                 // On move: when no destination blog chosen, show choice now
 543                 $destBlogId = intRequestVar('destblogid');
 544                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )
 545                 {
 546                         self::batchMoveCategorySelectDestination('category', $selected);
 547                 }
 548
 549                 // On delete: check if confirmation has been given
 550                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )
 551                 {
 552                         self::batchAskDeleteConfirmation('category', $selected);
 553                 }
 554
 555                 self::$skin->parse('batchcategory');
 556                 return;
 557         }
 558
 559         /**
 560          * Admin::batchMoveSelectDestination()
 561          *
 562          * @param       string  $type   type of batch action
 563          * @param       integer $ids    needless???
 564          * @return      void
 565          *
 566          * TODO: remove needless argument
 567          */
 568         static private function batchMoveSelectDestination($type, $ids)
 569         {
 570                 $_POST['batchmove'] = $type;
 571                 self::$skin->parse('batchmove');
 572                 return;
 573         }
 574
 575         /**
 576          * Admin::batchMoveCategorySelectDestination()
 577          *
 578          * @param       string  $type   type of batch action
 579          * @param       integer $ids    needless???
 580          * @return      void
 581          *
 582          * TODO: remove needless argument
 583          */
 584         static private function batchMoveCategorySelectDestination($type, $ids)
 585         {
 586                 $_POST['batchmove'] = $type;
 587                 global $manager;
 588                 self::$skin->parse('batchmovecat');
 589                 return;
 590         }
 591
 592         /**
 593          * Admin::batchAskDeleteConfirmation()
 594          *
 595          * @param       string  $type   type of batch action
 596          * @param       integer $ids    needless???
 597          * @return      void
 598          *
 599          * TODO: remove needless argument
 600          */
 601         static private function batchAskDeleteConfirmation($type, $ids)
 602         {
 603                 self::$skin->parse('batchdelete');
 604                 return;
 605         }
 606
 607         /**
 608          * Admin::action_browseownitems()
 609          *
 610          * @param       void
 611          * @return      void
 612          */
 613         static private function action_browseownitems()
 614         {
 615                 global $member, $manager, $CONF;
 616
 617                 self::$skin->parse('browseownitems');
 618                 return;
 619         }
 620
 621         /**
 622          * Admin::action_itemcommentlist()
 623          * Show all the comments for a given item
 624          *
 625          * @param       integer $itemid ID for item
 626          * @return      void
 627          */
 628         static private function action_itemcommentlist($itemid = '')
 629         {
 630                 global $member, $manager, $CONF;
 631
 632                 if ( $itemid == '' )
 633                 {
 634                         $itemid = intRequestVar('itemid');
 635                 }
 636
 637                 // only allow if user is allowed to alter item
 638                 $member->canAlterItem($itemid) or self::disallow();
 639
 640                 $item =& $manager->getItem($itemid, 1, 1);
 641                 $_REQUEST['itemid'] = $item['itemid'];
 642                 $_REQUEST['blogid'] = $item['blogid'];
 643
 644                 self::$skin->parse('itemcommentlist');
 645                 return;
 646         }
 647
 648         /**
 649          * Admin::action_browseowncomments()
 650          * Browse own comments
 651          *
 652          * @param       void
 653          * @return      void
 654          */
 655         static private function action_browseowncomments()
 656         {
 657                 self::$skin->parse('browseowncomments');
 658                 return;
 659         }
 660
 661         /**
 662          * Admin::action_blogcommentlist()
 663          * Browse all comments for a weblog
 664          *
 665          * @param       integer $blogid ID for weblog
 666          * @return      void
 667          */
 668         static private function action_blogcommentlist($blogid = '')
 669         {
 670                 global $member, $manager, $CONF;
 671
 672                 if ( $blogid == '' )
 673                 {
 674                         $blogid = intRequestVar('blogid');
 675                 }
 676                 else
 677                 {
 678                         $blogid = intval($blogid);
 679                 }
 680
 681                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();
 682
 683                 /* TODO: we consider to use the other way insterad of this */
 684                 $_REQUEST['blogid'] = $blogid;
 685
 686                 self::$skin->parse('blogcommentlist');
 687                 return;
 688         }
 689
 690         /**
 691          * Admin::action_createaccount()
 692          *
 693          * @param       void
 694          * @return      void
 695          */
 696         static private function action_createaccount()
 697         {
 698                 global $CONF;
 699
 700                 if ( $CONF['AllowMemberCreate'] != 1 )
 701                 {
 702                         self::$skin->parse('createaccountdisable');
 703                         return;
 704                 }
 705
 706                 $name = '';
 707                 $realname ='';
 708                 $email = '';
 709                 $url = '';
 710
 711                 $contents = array(
 712                         'name'          => '',
 713                         'realname'      => '',
 714                         'email'         => '',
 715                         'url'           => ''
 716                 );
 717
 718                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )
 719                 {
 720                         $action = new Action();
 721                         $message = $action->createAccount();
 722                         if ( $message === 1 )
 723                         {
 724                                 self::$headMess = $message;
 725                                 self::$skin->parse('createaccountsuccess');
 726                                 return;
 727                         }
 728
 729                         /* TODO: validation */
 730                         if ( array_key_exists('name', $_POST) )
 731                         {
 732                                 $contents['name'] = $_POST['name'];
 733                         }
 734                         if ( array_key_exists('realname', $_POST) )
 735                         {
 736                                 $contents['realname'] = $_POST['realname'];
 737                         }
 738                         if ( array_key_exists('email', $_POST) )
 739                         {
 740                                 $contents['email'] = $_POST['email'];
 741                         }
 742                         if ( array_key_exists('url', $_POST) )
 743                         {
 744                                 $contents['url'] = $_POST['url'];
 745                         }
 746
 747                         self::$contents = $contents;
 748
 749                 }
 750
 751                 self::$skin->parse('createaccountinput');
 752                 return;
 753         }
 754
 755         /**
 756          * Admin::action_createitem()
 757          * Provide a page to item a new item to the given blog
 758          *
 759          * @param       void
 760          * @return      void
 761          */
 762         static private function action_createitem()
 763         {
 764                 global $member, $manager;
 765
 766                 $blogid = intRequestVar('blogid');
 767
 768                 // check if allowed
 769                 $member->teamRights($blogid) or self::disallow();
 770
 771                 $blog =& $manager->getBlog($blogid);
 772                 $contents = array();
 773
 774                 $data = array(
 775                         'blog'          => &$blog,
 776                         'contents'      => &$contents
 777                 );
 778                 $manager->notify('PreAddItemForm', $data);
 779
 780                 if ( $blog->convertBreaks() )
 781                 {
 782                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )
 783                         {
 784                                 $contents['body'] = removeBreaks($contents['body']);
 785                         }
 786                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )
 787                         {
 788                                 $contents['more'] = removeBreaks($contents['more']);
 789                         }
 790                 }
 791
 792                 self::$blog = &$blog;
 793                 self::$contents = &$contents;
 794
 795                 self::$skin->parse('createitem');
 796                 return;
 797         }
 798
 799         /**
 800          * Admin::action_itemedit()
 801          *
 802          * @param       void
 803          * @return      void
 804          */
 805         static private function action_itemedit()
 806         {
 807                 global $member, $manager;
 808
 809                 $itemid = intRequestVar('itemid');
 810
 811                 // only allow if user is allowed to alter item
 812                 $member->canAlterItem($itemid) or self::disallow();
 813
 814                 $item =& $manager->getItem($itemid, 1, 1);
 815                 $blog =& $manager->getBlog($item['blogid']);
 816                 $data = array('blog'=> $blog, 'item' => $item);
 817                 $manager->notify('PrepareItemForEdit', $data);
 818
 819                 if ( $blog->convertBreaks() )
 820                 {
 821                         if ( array_key_exists('body', $item) && !empty($item['body']) )
 822                         {
 823                                 $item['body'] = removeBreaks($item['body']);
 824                         }
 825                         if ( array_key_exists('more', $item) && !empty($item['more']) )
 826                         {
 827                                 $item['more'] = removeBreaks($item['more']);
 828                         }
 829                 }
 830
 831                 self::$blog = &$blog;
 832                 self::$contents = &$item;
 833
 834                 self::$skin->parse('itemedit');
 835                 return;
 836         }
 837
 838         /**
 839          * Admin::action_itemupdate()
 840          *
 841          * @param       void
 842          * @return      void
 843          */
 844         static private function action_itemupdate()
 845         {
 846                 global $member, $manager, $CONF;
 847
 848                 $itemid = intRequestVar('itemid');
 849                 $catid  = postVar('catid');
 850
 851                 // only allow if user is allowed to alter item
 852                 $member->canUpdateItem($itemid, $catid) or self::disallow();
 853
 854                 $actiontype = postVar('actiontype');
 855
 856                 // delete actions are handled by itemdelete (which has confirmation)
 857                 if ( $actiontype == 'delete' )
 858                 {
 859                         self::action_itemdelete();
 860                         return;
 861                 }
 862
 863                 $body           = postVar('body');
 864                 $title          = postVar('title');
 865                 $more           = postVar('more');
 866                 $closed         = intPostVar('closed');
 867                 $draftid        = intPostVar('draftid');
 868
 869                 // default action = add now
 870                 if ( !$actiontype )
 871                 {
 872                         $actiontype='addnow';
 873                 }
 874
 875                 // create new category if needed
 876                 if ( i18n::strpos($catid,'newcat') === 0 )
 877                 {
 878                         // get blogid
 879                         list($blogid) = sscanf($catid,"newcat-%d");
 880
 881                         // create
 882                         $blog =& $manager->getBlog($blogid);
 883                         $catid = $blog->createNewCategory();
 884
 885                         // show error when sth goes wrong
 886                         if ( !$catid )
 887                         {
 888                                 self::doError(_ERROR_CATCREATEFAIL);
 889                         }
 890                 }
 891
 892                 /**
 893                  * set some variables based on actiontype
 894                  *
 895                  * actiontypes:
 896                  *      draft items -> addnow, addfuture, adddraft, delete
 897                  *      non-draft items -> edit, changedate, delete
 898                  *
 899                  * variables set:
 900                  *      $timestamp: set to a nonzero value for future dates or date changes
 901                  *      $wasdraft: set to 1 when the item used to be a draft item
 902                  *      $publish: set to 1 when the edited item is not a draft
 903                  */
 904                 $blogid =  getBlogIDFromItemID($itemid);
 905                 $blog =& $manager->getBlog($blogid);
 906
 907                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');
 908                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
 909                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
 910                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )
 911                 {
 912                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
 913                 }
 914                 else
 915                 {
 916                         $timestamp =0;
 917                 }
 918
 919                 // edit the item for real
 920                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
 921
 922                 self::updateFuturePosted($blogid);
 923
 924                 if ( $draftid > 0 )
 925                 {
 926                         // delete permission is checked inside Item::delete()
 927                         Item::delete($draftid);
 928                 }
 929
 930                 if ( $catid != intPostVar('catid') )
 931                 {
 932                         self::action_categoryedit(
 933                                 $catid,
 934                                 $blog->getID(),
 935                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
 936                         );
 937                 }
 938                 else
 939                 {
 940                         // TODO: set start item correctly for itemlist
 941                         $item =& $manager->getitem($itemid, 1, 1);
 942                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";
 943                         $query = sprintf($query, sql_table('item'), $item['timestamp']);
 944                         $cnt  = DB::getValue($query);
 945                         $_REQUEST['start'] = $cnt + 1;
 946                         self::action_itemlist(getBlogIDFromItemID($itemid));
 947                 }
 948                 return;
 949         }
 950
 951         /**
 952          * Admin::action_itemdelete()
 953          * Delete item
 954          *
 955          * @param       Void
 956          * @return      Void
 957          */
 958         static private function action_itemdelete()
 959         {
 960                 global $member, $manager;
 961
 962                 $itemid = intRequestVar('itemid');
 963
 964                 // only allow if user is allowed to alter item
 965                 $member->canAlterItem($itemid) or self::disallow();
 966
 967                 if ( !$manager->existsItem($itemid,1,1) )
 968                 {
 969                         self::error(_ERROR_NOSUCHITEM);
 970                         return;
 971                 }
 972
 973                 self::$skin->parse('itemdelete');
 974                 return;
 975         }
 976
 977         /**
 978          * Admin::action_itemdeleteconfirm()
 979          *
 980          * @param       void
 981          * @return      void
 982          */
 983         static private function action_itemdeleteconfirm()
 984         {
 985                 global $member, $manager;
 986
 987                 $itemid = intRequestVar('itemid');
 988
 989                 // only allow if user is allowed to alter item
 990                 $member->canAlterItem($itemid) or self::disallow();
 991
 992                 // get item first
 993                 $item =& $manager->getItem($itemid, 1, 1);
 994
 995                 // delete item (note: some checks will be performed twice)
 996                 self::deleteOneItem($item['itemid']);
 997
 998                 self::action_itemlist($item['blogid']);
 999                 return;
1000         }
1001
1002         /**
1003          * Admin::deleteOneItem()
1004          * Deletes one item and returns error if something goes wrong
1005          *
1006          * @param       integer $itemid ID for item
1007          * @return      void
1008          */
1009         static public function deleteOneItem($itemid)
1010         {
1011                 global $member, $manager;
1012
1013                 // only allow if user is allowed to alter item (also checks if itemid exists)
1014                 if ( !$member->canAlterItem($itemid) )
1015                 {
1016                         return _ERROR_DISALLOWED;
1017                 }
1018
1019                 // need to get blogid before the item is deleted
1020                 $item =& $manager->getItem($itemid, 1, 1);
1021
1022                 $manager->loadClass('ITEM');
1023                 Item::delete($item['itemid']);
1024
1025                 // update blog's futureposted
1026                 self::updateFuturePosted($item['itemid']);
1027                 return;
1028         }
1029
1030         /**
1031          * Admin::updateFuturePosted()
1032          * Update a blog's future posted flag
1033          *
1034          * @param integer $blogid
1035          * @return      void
1036          */
1037         static private function updateFuturePosted($blogid)
1038         {
1039                 global $manager;
1040
1041                 $blogid                 =  intval($blogid);
1042                 $blog                   =& $manager->getBlog($blogid);
1043                 $currenttime    =  $blog->getCorrectTime(time());
1044
1045                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1046                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1047                 $result = DB::getResult($query);
1048
1049                 if ( $result->rowCount() > 0 )
1050                 {
1051                                 $blog->setFuturePost();
1052                 }
1053                 else
1054                 {
1055                                 $blog->clearFuturePost();
1056                 }
1057                 return;
1058         }
1059
1060         /**
1061          * Admin::action_itemmove()
1062          *
1063          * @param       void
1064          * @return      void
1065          */
1066         static private function action_itemmove()
1067         {
1068                 global $member, $manager;
1069
1070                 $itemid = intRequestVar('itemid');
1071
1072                 $member->canAlterItem($itemid) or self::disallow();
1073
1074                 self::$skin->parse('itemmove');
1075                 return;
1076         }
1077
1078         /**
1079          * Admin::action_itemmoveto()
1080          *
1081          * @param       void
1082          * @return      void
1083          */
1084         static private function action_itemmoveto()
1085         {
1086                 global $member, $manager;
1087
1088                 $itemid = intRequestVar('itemid');
1089                 $catid = requestVar('catid');
1090
1091                 // create new category if needed
1092                 if ( i18n::strpos($catid,'newcat') === 0 )
1093                 {
1094                         // get blogid
1095                         list($blogid) = sscanf($catid,'newcat-%d');
1096
1097                         // create
1098                         $blog =& $manager->getBlog($blogid);
1099                         $catid = $blog->createNewCategory();
1100
1101                         // show error when sth goes wrong
1102                         if ( !$catid )
1103                         {
1104                                 self::doError(_ERROR_CATCREATEFAIL);
1105                         }
1106                 }
1107
1108                 // only allow if user is allowed to alter item
1109                 $member->canUpdateItem($itemid, $catid) or self::disallow();
1110
1111                 $old_blogid = getBlogIDFromItemId($itemid);
1112
1113                 Item::move($itemid, $catid);
1114
1115                 // set the futurePosted flag on the blog
1116                 self::updateFuturePosted(getBlogIDFromItemId($itemid));
1117
1118                 // reset the futurePosted in case the item is moved from one blog to another
1119                 self::updateFuturePosted($old_blogid);
1120
1121                 if ( $catid != intRequestVar('catid') )
1122                 {
1123                         self::action_categoryedit($catid, $blog->getID());
1124                 }
1125                 else
1126                 {
1127                         self::action_itemlist(getBlogIDFromCatID($catid));
1128                 }
1129                 return;
1130         }
1131
1132         /**
1133          * Admin::moveOneItem()
1134          * Moves one item to a given category (category existance should be checked by caller)
1135          * errors are returned
1136          *
1137          * @param       integer $itemid         ID for item
1138          * @param       integer $destCatid      ID for category to which the item will be moved
1139          * @return      void
1140          */
1141         static public function moveOneItem($itemid, $destCatid)
1142         {
1143                 global $member;
1144
1145                 // only allow if user is allowed to move item
1146                 if ( !$member->canUpdateItem($itemid, $destCatid) )
1147                 {
1148                         return _ERROR_DISALLOWED;
1149                 }
1150
1151                 Item::move($itemid, $destCatid);
1152                 return;
1153         }
1154
1155         /**
1156          * Admin::action_additem()
1157          * Adds a item to the chosen blog
1158          *
1159          * @param       void
1160          * @return      void
1161          */
1162         static private function action_additem()
1163         {
1164                 global $manager, $CONF;
1165
1166                 $manager->loadClass('ITEM');
1167
1168                 $result = Item::createFromRequest();
1169
1170                 if ( $result['status'] == 'error' )
1171                 {
1172                         self::error($result['message']);
1173                         return;
1174                 }
1175
1176                 $item =& $manager->getItem($result['itemid'], 0, 0);
1177
1178                 if ( $result['status'] == 'newcategory' )
1179                 {
1180                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);
1181                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);
1182                 }
1183                 else
1184                 {
1185                         $methodName = 'action_itemlist';
1186                         self::action_itemlist($item['blogid']);
1187                 }
1188                 return;
1189         }
1190
1191         /**
1192          * Admin::action_commentedit()
1193          * Allows to edit previously made comments
1194          *
1195          * @param       void
1196          * @return      void
1197          */
1198         static private function action_commentedit()
1199         {
1200                 global $member, $manager;
1201
1202                 $commentid = intRequestVar('commentid');
1203
1204                 $member->canAlterComment($commentid) or self::disallow();
1205
1206                 $comment = Comment::getComment($commentid);
1207                 $data = array('comment' => &$comment);
1208                 $manager->notify('PrepareCommentForEdit', $data);
1209
1210                 self::$contents = $comment;
1211                 self::$skin->parse('commentedit');
1212                 return;
1213         }
1214
1215         /**
1216          * Admin::action_commentupdate()
1217          *
1218          * @param       void
1219          * @return      void
1220          */
1221         static private function action_commentupdate()
1222         {
1223                 global $member, $manager;
1224
1225                 $commentid = intRequestVar('commentid');
1226
1227                 $member->canAlterComment($commentid) or self::disallow();
1228
1229                 $url    = postVar('url');
1230                 $email  = postVar('email');
1231                 $body   = postVar('body');
1232
1233                 // intercept words that are too long
1234                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1235                 {
1236                         self::error(_ERROR_COMMENT_LONGWORD);
1237                         return;
1238                 }
1239
1240                 // check length
1241                 if ( i18n::strlen($body) < 3 )
1242                 {
1243                         self::error(_ERROR_COMMENT_NOCOMMENT);
1244                         return;
1245                 }
1246
1247                 if ( i18n::strlen($body) > 5000 )
1248                 {
1249                         self::error(_ERROR_COMMENT_TOOLONG);
1250                         return;
1251                 }
1252
1253                 // prepare body
1254                 $body = Comment::prepareBody($body);
1255
1256                 // call plugins
1257                 $data = array(
1258                         'body' => &$body
1259                 );
1260                 $manager->notify('PreUpdateComment', $data);
1261
1262                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";
1263                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);
1264                 DB::execute($query);
1265
1266                 // get itemid
1267                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1268                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1269
1270                 $itemid = DB::getValue($query);
1271
1272                 if ( $member->canAlterItem($itemid) )
1273                 {
1274                         self::action_itemcommentlist($itemid);
1275                 }
1276                 else
1277                 {
1278                         self::action_browseowncomments();
1279                 }
1280                 return;
1281         }
1282
1283         /**
1284          * Admin::action_commentdelete()
1285          * Update comment
1286          *
1287          * @param       void
1288          * @return      void
1289          */
1290         static private function action_commentdelete()
1291         {
1292                 global $member, $manager;
1293
1294                 $commentid = intRequestVar('commentid');
1295                 $member->canAlterComment($commentid) or self::disallow();
1296
1297                 self::$skin->parse('commentdelete');
1298                 return;
1299         }
1300
1301         /**
1302          * Admin::action_commentdeleteconfirm()
1303          *
1304          * @param       void
1305          * @return      void
1306          */
1307         static private function action_commentdeleteconfirm()
1308         {
1309                 global $member;
1310
1311                 $commentid = intRequestVar('commentid');
1312
1313                 // get item id first
1314                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";
1315                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1316
1317                 $itemid = DB::getValue($query);
1318
1319                 $error = self::deleteOneComment($commentid);
1320                 if ( $error )
1321                 {
1322                         self::doError($error);
1323                 }
1324
1325                 if ( $member->canAlterItem($itemid) )
1326                 {
1327                         self::action_itemcommentlist($itemid);
1328                 }
1329                 else
1330                 {
1331                         self::action_browseowncomments();
1332                 }
1333                 return;
1334         }
1335
1336         /**
1337          * Admin::deleteOneComment()
1338          *
1339          * @param       integer $commentid      ID for comment
1340          * @return      void
1341          */
1342         static public function deleteOneComment($commentid)
1343         {
1344                 global $member, $manager;
1345
1346                 $commentid = (integer) $commentid;
1347
1348                 if ( !$member->canAlterComment($commentid) )
1349                 {
1350                         return _ERROR_DISALLOWED;
1351                 }
1352
1353                 $data = array(
1354                         'commentid' => $commentid
1355                 );
1356
1357                 $manager->notify('PreDeleteComment', $data);
1358
1359                 // delete the comments associated with the item
1360                 $query = "DELETE FROM %s WHERE cnumber=%d;";
1361                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);
1362                 DB::execute($query);
1363
1364                 $data = array(
1365                         'commentid' => $commentid
1366                 );
1367
1368                 $manager->notify('PostDeleteComment', $data);
1369
1370                 return '';
1371         }
1372
1373         /**
1374          * Admin::action_usermanagement()
1375          * Usermanagement main
1376          *
1377          * @param       void
1378          * @return      void
1379          */
1380         static private function action_usermanagement()
1381         {
1382                 global $member, $manager;
1383
1384                 // check if allowed
1385                 $member->isAdmin() or self::disallow();
1386
1387                 self::$skin->parse('usermanagement');
1388                 return;
1389         }
1390
1391         /**
1392          * Admin::action_memberedit()
1393          * Edit member settings
1394          *
1395          * @param       void
1396          * @return      void
1397          */
1398         static private function action_memberedit()
1399         {
1400                 self::action_editmembersettings(intRequestVar('memberid'));
1401                 return;
1402         }
1403
1404         /**
1405          * Admin::action_editmembersettings()
1406          *
1407          * @param       integer $memberid       ID for member
1408          * @return      void
1409          *
1410          */
1411         static private function action_editmembersettings($memberid = '')
1412         {
1413                 global $member, $manager, $CONF;
1414
1415                 if ( $memberid == '' )
1416                 {
1417                         $memberid = $member->getID();
1418                 }
1419
1420                 /* TODO: we should consider to use the other way insterad of this */
1421                 $_REQUEST['memberid'] = $memberid;
1422
1423                 // check if allowed
1424                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1425
1426                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
1427
1428                 self::$skin->parse('editmembersettings');
1429                 return;
1430         }
1431
1432         /**
1433          * Admin::action_changemembersettings()
1434          *
1435          * @param       void
1436          * @return      void
1437          */
1438         static private function action_changemembersettings()
1439         {
1440                 global $member, $CONF, $manager;
1441
1442                 $memberid = intRequestVar('memberid');
1443
1444                 // check if allowed
1445                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
1446
1447                 $name                   = trim(strip_tags(postVar('name')));
1448                 $realname               = trim(strip_tags(postVar('realname')));
1449                 $password               = postVar('password');
1450                 $repeatpassword = postVar('repeatpassword');
1451                 $email                  = strip_tags(postVar('email'));
1452                 $url                    = strip_tags(postVar('url'));
1453                 $adminskin              = intPostVar('adminskin');
1454                 $bookmarklet    = intPostVar('bookmarklet');
1455
1456                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1457                 if ( !preg_match('#^https?://#', $url) )
1458                 {
1459                         $url = 'http://' . $url;
1460                 }
1461
1462                 $admin          = postVar('admin');
1463                 $canlogin       = postVar('canlogin');
1464                 $notes          = strip_tags(postVar('notes'));
1465                 $locale         = postVar('locale');
1466
1467                 $mem =& $manager->getMember($memberid);
1468
1469                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1470                 {
1471                         if ( !isValidDisplayName($name) )
1472                         {
1473                                 self::error(_ERROR_BADNAME);
1474                                 return;
1475                         }
1476
1477                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )
1478                         {
1479                                 self::error(_ERROR_NICKNAMEINUSE);
1480                                 return;
1481                         }
1482
1483                         if ( $password != $repeatpassword )
1484                         {
1485                                 self::error(_ERROR_PASSWORDMISMATCH);
1486                                 return;
1487                         }
1488
1489                         if ( $password && (i18n::strlen($password) < 6) )
1490                         {
1491                                 self::error(_ERROR_PASSWORDTOOSHORT);
1492                                 return;
1493                         }
1494
1495                         if ( $password )
1496                         {
1497                                 $pwdvalid = true;
1498                                 $pwderror = '';
1499
1500                                 $data = array(
1501                                         'password'     => $password,
1502                                         'errormessage' => &$pwderror,
1503                                         'valid'        => &$pwdvalid
1504                                 );
1505                                 $manager->notify('PrePasswordSet', $data);
1506
1507                                 if ( !$pwdvalid )
1508                                 {
1509                                         self::error($pwderror);
1510                                         return;
1511                                 }
1512                         }
1513                 }
1514
1515                 if ( !NOTIFICATION::address_validation($email) )
1516                 {
1517                         self::error(_ERROR_BADMAILADDRESS);
1518                         return;
1519                 }
1520                 if ( !$realname )
1521                 {
1522                         self::error(_ERROR_REALNAMEMISSING);
1523                         return;
1524                 }
1525                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
1526                 {
1527                         self::error(_ERROR_NOSUCHTRANSLATION);
1528                         return;
1529                 }
1530
1531                 // check if there will remain at least one site member with both the logon and admin rights
1532                 // (check occurs when taking away one of these rights from such a member)
1533                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1534                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1535                         )
1536                 {
1537                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1538                         if ( $r->rowCount() < 2 )
1539                         {
1540                                 self::error(_ERROR_ATLEASTONEADMIN);
1541                                 return;
1542                         }
1543                 }
1544
1545                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )
1546                 {
1547                         $mem->setDisplayName($name);
1548                         if ( $password )
1549                         {
1550                                 $mem->setPassword($password);
1551                         }
1552                 }
1553
1554                 $oldEmail = $mem->getEmail();
1555
1556                 $mem->setRealName($realname);
1557                 $mem->setEmail($email);
1558                 $mem->setURL($url);
1559                 $mem->setNotes($notes);
1560                 $mem->setLocale($locale);
1561                 $mem->setAdminSkin($adminskin);
1562                 $mem->setBookmarklet($bookmarklet);
1563
1564                 // only allow super-admins to make changes to the admin status
1565                 if ( $member->isAdmin() )
1566                 {
1567                         $mem->setAdmin($admin);
1568                         $mem->setCanLogin($canlogin);
1569                 }
1570
1571                 $autosave = postVar('autosave');
1572                 $mem->setAutosave($autosave);
1573
1574                 $mem->write();
1575
1576                 // store plugin options
1577                 $aOptions = requestArray('plugoption');
1578                 NucleusPlugin::apply_plugin_options($aOptions);
1579                 $data = array(
1580                         'context'  => 'member',
1581                         'memberid' => $memberid,
1582                         'member'   => &$mem
1583                 );
1584                 $manager->notify('PostPluginOptionsUpdate', $data);
1585
1586                 // if email changed, generate new password
1587                 if ( $oldEmail != $mem->getEmail() )
1588                 {
1589                         $mem->sendActivationLink('addresschange', $oldEmail);
1590                         // logout member
1591                         $mem->newCookieKey();
1592
1593                         // only log out if the member being edited is the current member.
1594                         if ( $member->getID() == $memberid )
1595                         {
1596                                 $member->logout();
1597                         }
1598                         self::action_login(_MSG_ACTIVATION_SENT, 0);
1599                         return;
1600                 }
1601
1602                 if ( ($mem->getID() == $member->getID())
1603                         && ($mem->getDisplayName() != $member->getDisplayName()) )
1604                 {
1605                         $mem->newCookieKey();
1606                         $member->logout();
1607                         self::action_login(_MSG_LOGINAGAIN, 0);
1608                 }
1609                 else
1610                 {
1611                         self::action_overview(_MSG_SETTINGSCHANGED);
1612                 }
1613                 return;
1614         }
1615
1616         /**
1617          * Admin::action_memberadd()
1618          *
1619          * @param       void
1620          * @return      void
1621          *
1622          */
1623         static private function action_memberadd()
1624         {
1625                 global $member, $manager;
1626
1627                 // check if allowed
1628                 $member->isAdmin() or self::disallow();
1629
1630                 if ( postVar('password') != postVar('repeatpassword') )
1631                 {
1632                         self::error(_ERROR_PASSWORDMISMATCH);
1633                         return;
1634                 }
1635
1636                 if ( i18n::strlen(postVar('password')) < 6 )
1637                 {
1638                         self::error(_ERROR_PASSWORDTOOSHORT);
1639                         return;
1640                 }
1641
1642                 $res = Member::create(
1643                         postVar('name'),
1644                         postVar('realname'),
1645                         postVar('password'),
1646                         postVar('email'),
1647                         postVar('url'),
1648                         postVar('admin'),
1649                         postVar('canlogin'),
1650                         postVar('notes')
1651                 );
1652
1653                 if ( $res != 1 )
1654                 {
1655                         self::error($res);
1656                         return;
1657                 }
1658
1659                 // fire PostRegister event
1660                 $newmem = new Member();
1661                 $newmem->readFromName(postVar('name'));
1662                 $data = array(
1663                         'member' => &$newmem
1664                 );
1665                 $manager->notify('PostRegister', $data);
1666
1667                 self::action_usermanagement();
1668                 return;
1669         }
1670
1671         /**
1672          * Admin::action_forgotpassword()
1673          *
1674          * @param       void
1675          * @return      void
1676          */
1677         static private function action_forgotpassword()
1678         {
1679                 self::$skin->parse('forgotpassword');
1680                 return;
1681         }
1682
1683         /**
1684          * Admin::action_activate()
1685          * Account activation
1686          *
1687          * @param       void
1688          * @return      void
1689          */
1690         static private function action_activate()
1691         {
1692                 $key = getVar('key');
1693                 self::showActivationPage($key);
1694                 return;
1695         }
1696
1697         /**
1698          * Admin::showActivationPage()
1699          *
1700          * @param       void
1701          * @return      void
1702          */
1703         static private function showActivationPage($key, $message = '')
1704         {
1705                 global $manager;
1706
1707                 // clean up old activation keys
1708                 Member::cleanupActivationTable();
1709
1710                 // get activation info
1711                 $info = Member::getActivationInfo($key);
1712
1713                 if ( !$info )
1714                 {
1715                         self::error(_ERROR_ACTIVATE);
1716                         return;
1717                 }
1718
1719                 $mem =& $manager->getMember($info->vmember);
1720
1721                 if ( !$mem )
1722                 {
1723                         self::error(_ERROR_ACTIVATE);
1724                         return;
1725                 }
1726
1727                 /* TODO: we should consider to use the other way insterad of this */
1728                 $_POST['ackey']                                 = $key;
1729                 $_POST['bNeedsPasswordChange']  = TRUE;
1730
1731                 self::$headMess = $message;
1732                 self::$skin->parse('activate');
1733                 return;
1734         }
1735
1736         /**
1737          * Admin::action_activatesetpwd()
1738          * Account activation - set password part
1739          *
1740          * @param       void
1741          * @return      void
1742          */
1743         static private function action_activatesetpwd()
1744         {
1745                 global $manager;
1746                 $key = postVar('key');
1747
1748                 // clean up old activation keys
1749                 Member::cleanupActivationTable();
1750
1751                 // get activation info
1752                 $info = Member::getActivationInfo($key);
1753
1754                 if ( !$info || ($info->type == 'addresschange') )
1755                 {
1756                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1757                 }
1758
1759                 $mem =& $manager->getMember($info->vmember);
1760
1761                 if ( !$mem )
1762                 {
1763                         return self::showActivationPage($key, _ERROR_ACTIVATE);
1764                 }
1765
1766                 $password               = postVar('password');
1767                 $repeatpassword = postVar('repeatpassword');
1768
1769                 if ( $password != $repeatpassword )
1770                 {
1771                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);
1772                 }
1773
1774                 if ( $password && (i18n::strlen($password) < 6) )
1775                 {
1776                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
1777                 }
1778
1779                 if ( $password )
1780                 {
1781                         $pwdvalid = true;
1782                         $pwderror = '';
1783
1784                         $data = array(
1785                                 'password'              => $password,
1786                                 'errormessage'  => &$pwderror,
1787                                 'valid'                 => &$pwdvalid
1788                         );
1789                         $manager->notify('PrePasswordSet', $data);
1790                         if ( !$pwdvalid )
1791                         {
1792                                 return self::showActivationPage($key,$pwderror);
1793                         }
1794                 }
1795
1796                 $error = '';
1797
1798                 $data = array(
1799                         'type'   => 'activation',
1800                         'member' => $mem,
1801                         'error'  => &$error
1802                 );
1803                 $manager->notify('ValidateForm', $data);
1804                 if ( $error != '' )
1805                 {
1806                         return self::showActivationPage($key, $error);
1807                 }
1808
1809                 // set password
1810                 $mem->setPassword($password);
1811                 $mem->write();
1812
1813                 // do the activation
1814                 Member::activate($key);
1815
1816                 self::$skin->parse('activatesetpwd');
1817                 return;
1818         }
1819
1820         /**
1821          * Admin::action_manageteam()
1822          * Manage team
1823          *
1824          * @param       void
1825          * @return      void
1826          */
1827         static private function action_manageteam()
1828         {
1829                 global $member, $manager;
1830
1831                 $blogid = intRequestVar('blogid');
1832
1833                 // check if allowed
1834                 $member->blogAdminRights($blogid) or self::disallow();
1835
1836                 self::$skin->parse('manageteam');
1837                 return;
1838         }
1839
1840         /**
1841          * Admin::action_teamaddmember()
1842          * Add member to team
1843          *
1844          * @param       void
1845          * @return      void
1846          */
1847         static private function action_teamaddmember()
1848         {
1849                 global $member, $manager;
1850
1851                 $memberid       = intPostVar('memberid');
1852                 $blogid         = intPostVar('blogid');
1853                 $admin          = intPostVar('admin');
1854
1855                 // check if allowed
1856                 $member->blogAdminRights($blogid) or self::disallow();
1857
1858                 $blog =& $manager->getBlog($blogid);
1859                 if ( !$blog->addTeamMember($memberid, $admin) )
1860                 {
1861                         self::error(_ERROR_ALREADYONTEAM);
1862                         return;
1863                 }
1864
1865                 self::action_manageteam();
1866                 return;
1867         }
1868
1869         /**
1870          * Admin::action_teamdelete()
1871          *
1872          * @param       void
1873          * @return      void
1874          */
1875         static private function action_teamdelete()
1876         {
1877                 global $member, $manager;
1878
1879                 $memberid       = intRequestVar('memberid');
1880                 $blogid         = intRequestVar('blogid');
1881
1882                 // check if allowed
1883                 $member->blogAdminRights($blogid) or self::disallow();
1884
1885                 $teammem =& $manager->getMember($memberid);
1886                 $blog =& $manager->getBlog($blogid);
1887
1888                 self::$skin->parse('teamdelete');
1889                 return;
1890         }
1891
1892         /**
1893          * Admin::action_teamdeleteconfirm()
1894          *
1895          * @param       void
1896          * @return      void
1897          */
1898         static private function action_teamdeleteconfirm()
1899         {
1900                 global $member;
1901
1902                 $memberid = intRequestVar('memberid');
1903                 $blogid = intRequestVar('blogid');
1904
1905                 $error = self::deleteOneTeamMember($blogid, $memberid);
1906                 if ( $error )
1907                 {
1908                         self::error($error);
1909                         return;
1910                 }
1911                 self::action_manageteam();
1912                 return;
1913         }
1914
1915         /**
1916          * Admin::deleteOneTeamMember()
1917          *
1918          * @param       void
1919          * @return      void
1920          */
1921         static public function deleteOneTeamMember($blogid, $memberid)
1922         {
1923                 global $member, $manager;
1924
1925                 $blogid   = intval($blogid);
1926                 $memberid = intval($memberid);
1927
1928                 // check if allowed
1929                 if ( !$member->blogAdminRights($blogid) )
1930                 {
1931                         return _ERROR_DISALLOWED;
1932                 }
1933
1934                 // check if: - there remains at least one blog admin
1935                 //           - (there remains at least one team member)
1936                 $tmem =& $manager->getMember($memberid);
1937
1938
1939                 $data = array(
1940                         'member' => &$tmem,
1941                         'blogid' => $blogid
1942                 );
1943                 $manager->notify('PreDeleteTeamMember', $data);
1944
1945                 if ( $tmem->isBlogAdmin($blogid) )
1946                 {
1947                         /* TODO: why we did double check? */
1948                         // check if there are more blog members left and at least one admin
1949                         // (check for at least two admins before deletion)
1950                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";
1951                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1952                         $r     = DB::getResult($query);
1953                         if ( $r->rowCount() < 2 )
1954                         {
1955                                 return _ERROR_ATLEASTONEBLOGADMIN;
1956                         }
1957                 }
1958
1959                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";
1960                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);
1961                 DB::execute($query);
1962
1963                 $data = array(
1964                         'member' => &$tmem,
1965                         'blogid' => $blogid
1966                 );
1967                 $manager->notify('PostDeleteTeamMember', $data);
1968
1969                 return '';
1970         }
1971
1972         /**
1973          * Admin::action_teamchangeadmin()
1974          *
1975          * @param       void
1976          * @return      void
1977          */
1978         static private function action_teamchangeadmin()
1979         {
1980                 global $manager, $member;
1981
1982                 $blogid         = intRequestVar('blogid');
1983                 $memberid       = intRequestVar('memberid');
1984
1985                 // check if allowed
1986                 $member->blogAdminRights($blogid) or self::disallow();
1987
1988                 $mem =& $manager->getMember($memberid);
1989
1990                 // don't allow when there is only one admin at this moment
1991                 if ( $mem->isBlogAdmin($blogid) )
1992                 {
1993                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";
1994                         $query = sprintf($query, sql_table('team'), (integer) $blogid);
1995                         $r = DB::getResult($query);
1996                         if ( $r->rowCount() == 1 )
1997                         {
1998                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);
1999                                 return;
2000                         }
2001                 }
2002
2003                 if ( $mem->isBlogAdmin($blogid) )
2004                 {
2005                         $newval = 0;
2006                 }
2007                 else
2008                 {
2009                         $newval = 1;
2010                 }
2011
2012                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";
2013                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);
2014                 DB::execute($query);
2015
2016                 // only show manageteam if member did not change its own admin privileges
2017                 if ( $member->isBlogAdmin($blogid) )
2018                 {
2019                         self::action_manageteam();
2020                 }
2021                 else
2022                 {
2023                         self::action_overview(_MSG_ADMINCHANGED);
2024                 }
2025                 return;
2026         }
2027
2028         /**
2029          * Admin::action_blogsettings()
2030          *
2031          * @param       void
2032          * @return      void
2033          */
2034         static private function action_blogsettings()
2035         {
2036                 global $member, $manager;
2037
2038                 $blogid = intRequestVar('blogid');
2039
2040                 // check if allowed
2041                 $member->blogAdminRights($blogid) or self::disallow();
2042
2043                 $blog =& $manager->getBlog($blogid);
2044
2045                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2046
2047                 self::$skin->parse('blogsettings');
2048                 return;
2049         }
2050
2051         /**
2052          * Admin::action_categorynew()
2053          *
2054          * @param       void
2055          * @return      void
2056          */
2057         static private function action_categorynew()
2058         {
2059                 global $member, $manager;
2060
2061                 $blogid = intRequestVar('blogid');
2062
2063                 $member->blogAdminRights($blogid) or self::disallow();
2064
2065                 $cname = postVar('cname');
2066                 $cdesc = postVar('cdesc');
2067
2068                 if ( !isValidCategoryName($cname) )
2069                 {
2070                         self::error(_ERROR_BADCATEGORYNAME);
2071                         return;
2072                 }
2073
2074                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";
2075                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);
2076                 $res = DB::getResult($query);
2077                 if ( $res->rowCount() > 0 )
2078                 {
2079                         self::error(_ERROR_DUPCATEGORYNAME);
2080                         return;
2081                 }
2082
2083                 $blog           =& $manager->getBlog($blogid);
2084                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2085
2086                 self::action_blogsettings();
2087                 return;
2088         }
2089
2090         /**
2091          * Admin::action_categoryedit()
2092          *
2093          * @param       void
2094          * @return      void
2095          */
2096         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')
2097         {
2098                 global $member, $manager;
2099
2100                 if ( $blogid == '' )
2101                 {
2102                         $blogid = intGetVar('blogid');
2103                 }
2104                 else
2105                 {
2106                         $blogid = intval($blogid);
2107                 }
2108                 if ( $catid == '' )
2109                 {
2110                         $catid = intGetVar('catid');
2111                 }
2112                 else
2113                 {
2114                         $catid = intval($catid);
2115                 }
2116
2117                 /* TODO: we should consider to use the other way insterad of this */
2118                 $_REQUEST['blogid']             = $blogid;
2119                 $_REQUEST['catid']              = $catid;
2120                 $_REQUEST['desturl']    = $desturl;
2121                 $member->blogAdminRights($blogid) or self::disallow();
2122
2123                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
2124
2125                 self::$skin->parse('categoryedit');
2126                 return;
2127         }
2128
2129         /**
2130          * Admin::action_categoryupdate()
2131          *
2132          * @param       void
2133          * @return      void
2134          */
2135         static private function action_categoryupdate()
2136         {
2137                 global $member, $manager;
2138
2139                 $blogid         = intPostVar('blogid');
2140                 $catid          = intPostVar('catid');
2141                 $cname          = postVar('cname');
2142                 $cdesc          = postVar('cdesc');
2143                 $desturl        = postVar('desturl');
2144
2145                 $member->blogAdminRights($blogid) or self::disallow();
2146
2147                 if ( !isValidCategoryName($cname) )
2148                 {
2149                         self::error(_ERROR_BADCATEGORYNAME);
2150                         return;
2151                 }
2152
2153                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";
2154                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);
2155                 $res    = DB::getResult($query);
2156                 if ( $res->rowCount() > 0 )
2157                 {
2158                         self::error(_ERROR_DUPCATEGORYNAME);
2159                         return;
2160                 }
2161
2162                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";
2163                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);
2164                 DB::execute($query);
2165
2166                 // store plugin options
2167                 $aOptions = requestArray('plugoption');
2168                 NucleusPlugin::apply_plugin_options($aOptions);
2169                 $data = array(
2170                         'context'       => 'category',
2171                         'catid'         => $catid
2172                 );
2173                 $manager->notify('PostPluginOptionsUpdate', $data);
2174
2175                 if ( $desturl )
2176                 {
2177                         redirect($desturl);
2178                         return;
2179                 }
2180
2181                 self::action_blogsettings();
2182
2183                 return;
2184         }
2185
2186         /**
2187          * Admin::action_categorydelete()
2188          *
2189          * @param       void
2190          * @return      void
2191          */
2192         static private function action_categorydelete()
2193         {
2194                 global $member, $manager;
2195
2196                 $blogid = intRequestVar('blogid');
2197                 $catid  = intRequestVar('catid');
2198
2199                 $member->blogAdminRights($blogid) or self::disallow();
2200
2201                 $blog =& $manager->getBlog($blogid);
2202
2203                 // check if the category is valid
2204                 if ( !$blog->isValidCategory($catid) )
2205                 {
2206                         self::error(_ERROR_NOSUCHCATEGORY);
2207                         return;
2208                 }
2209
2210                 // don't allow deletion of default category
2211                 if ( $blog->getDefaultCategory() == $catid )
2212                 {
2213                         self::error(_ERROR_DELETEDEFCATEGORY);
2214                         return;
2215                 }
2216
2217                 // check if catid is the only category left for blogid
2218                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2219                 $query = sprintf($query, sql_table('category'), $blogid);
2220                 $res = DB::getResult($query);
2221                 if ( $res->rowCount() == 1 )
2222                 {
2223                         self::error(_ERROR_DELETELASTCATEGORY);
2224                         return;
2225                 }
2226
2227                 self::$skin->parse('categorydelete');
2228                 return;
2229         }
2230
2231         /**
2232          * Admin::action_categorydeleteconfirm()
2233          *
2234          * @param       void
2235          * @return      void
2236          */
2237         static private function action_categorydeleteconfirm()
2238         {
2239                 global $member, $manager;
2240
2241                 $blogid = intRequestVar('blogid');
2242                 $catid  = intRequestVar('catid');
2243
2244                 $member->blogAdminRights($blogid) or self::disallow();
2245
2246                 $error = self::deleteOneCategory($catid);
2247                 if ( $error )
2248                 {
2249                         self::error($error);
2250                         return;
2251                 }
2252
2253                 self::action_blogsettings();
2254                 return;
2255         }
2256
2257         /**
2258          * Admin::deleteOneCategory()
2259          * Delete a category by its id
2260          *
2261          * @param       String  $catid  category id for deleting
2262          * @return      Void
2263          */
2264         static public function deleteOneCategory($catid)
2265         {
2266                 global $manager, $member;
2267
2268                 $catid  = intval($catid);
2269                 $blogid = getBlogIDFromCatID($catid);
2270
2271                 if ( !$member->blogAdminRights($blogid) )
2272                 {
2273                         return ERROR_DISALLOWED;
2274                 }
2275
2276                 // get blog
2277                 $blog =& $manager->getBlog($blogid);
2278
2279                 // check if the category is valid
2280                 if ( !$blog || !$blog->isValidCategory($catid) )
2281                 {
2282                         return _ERROR_NOSUCHCATEGORY;
2283                 }
2284
2285                 $destcatid = $blog->getDefaultCategory();
2286
2287                 // don't allow deletion of default category
2288                 if ( $blog->getDefaultCategory() == $catid )
2289                 {
2290                         return _ERROR_DELETEDEFCATEGORY;
2291                 }
2292
2293                 // check if catid is the only category left for blogid
2294                 $query = "SELECT catid FROM %s WHERE cblog=%d;";
2295                 $query = sprintf($query, sql_table('category'), (integer) $blogid);
2296
2297                 $res = DB::getResult($query);
2298                 if ( $res->rowCount() == 1 )
2299                 {
2300                         return _ERROR_DELETELASTCATEGORY;
2301                 }
2302
2303                 $data = array('catid' => $catid);
2304                 $manager->notify('PreDeleteCategory', $data);
2305
2306                 // change category for all items to the default category
2307                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";
2308                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);
2309                 DB::execute($query);
2310
2311                 // delete all associated plugin options
2312                 NucleusPlugin::delete_option_values('category', (integer) $catid);
2313
2314                 // delete category
2315                 $query = "DELETE FROM %s WHERE catid=%d;";
2316                 $query = sprintf($query, sql_table('category'), (integer) $catid);
2317                 DB::execute($query);
2318
2319                 $data = array('catid' => $catid);
2320                 $manager->notify('PostDeleteCategory', $data);
2321                 return;
2322         }
2323
2324         /**
2325          * Admin::moveOneCategory()
2326          * Delete a category by its id
2327          *
2328          * @param       int     $catid          category id for move
2329          * @param       int     $destblogid     blog id for destination
2330          * @return      void
2331          */
2332         static public function moveOneCategory($catid, $destblogid)
2333         {
2334                 global $manager, $member;
2335                 $catid      = intval($catid);
2336                 $destblogid = intval($destblogid);
2337                 $blogid     = getBlogIDFromCatID($catid);
2338                 // mover should have admin rights on both blogs
2339                 if (!$member->blogAdminRights($blogid)) {
2340                         return _ERROR_DISALLOWED;
2341                 }
2342                 if (!$member->blogAdminRights($destblogid)) {
2343                         return _ERROR_DISALLOWED;
2344                 }
2345                 // cannot move to self
2346                 if ($blogid == $destblogid) {
2347                         return _ERROR_MOVETOSELF;
2348                 }
2349                 // get blogs
2350                 $blog     =& $manager->getBlog($blogid);
2351                 $destblog =& $manager->getBlog($destblogid);
2352                 // check if the category is valid
2353                 if (!$blog || !$blog->isValidCategory($catid)) {
2354                         return _ERROR_NOSUCHCATEGORY;
2355                 }
2356                 // don't allow default category to be moved
2357                 if ($blog->getDefaultCategory() == $catid) {
2358                         return _ERROR_MOVEDEFCATEGORY;
2359                 }
2360                 $manager->notify(
2361                                 'PreMoveCategory',
2362                                 array(
2363                                                 'catid'      => &$catid,
2364                                                 'sourceblog' => &$blog,
2365                                                 'destblog'   => &$destblog
2366                                 )
2367                 );
2368                 // update comments table (cblog)
2369                 $query = 'SELECT '
2370                 . '    inumber '
2371                 . 'FROM '
2372                 .      sql_table('item') . ' '
2373                 . 'WHERE '
2374                 . '    icat = %d';
2375                 $items = sql_query(sprintf($query, $catid));
2376                 while ($oItem = sql_fetch_object($items)) {
2377                         $query = 'UPDATE '
2378                         .      sql_table('comment') . ' '
2379                         . 'SET '
2380                         . '    cblog = %d' . ' '
2381                         . 'WHERE '
2382                         . '    citem = %d';
2383                         sql_query(sprintf($query, $destblogid, $oItem->inumber));
2384                 }
2385
2386                 // update items (iblog)
2387                 $query = 'UPDATE '
2388                 .      sql_table('item') . ' '
2389                 . 'SET '
2390                 . '    iblog = %d '
2391                 . 'WHERE '
2392                 . '    icat = %d';
2393                 sql_query(sprintf($query, $destblogid, $catid));
2394
2395                 // move category
2396                 $query = 'UPDATE '
2397                 .      sql_table('category') . ' '
2398                 . 'SET '
2399                 . '    cblog = %d' . ' '
2400                 . 'WHERE '
2401                 . '    catid = %d';
2402                 sql_query(sprintf($query, $destblogid, $catid));
2403                 $manager->notify(
2404                                 'PostMoveCategory',
2405                                 array(
2406                                                 'catid'      => &$catid,
2407                                                 'sourceblog' => &$blog,
2408                                                 'destblog'   => $destblog
2409                                 )
2410                 );
2411                 return;
2412         }
2413
2414         /**
2415          * Admin::action_blogsettingsupdate
2416          * Updating blog settings
2417          *
2418          * @param       Void
2419          * @return      Void
2420          */
2421         static private function action_blogsettingsupdate()
2422         {
2423                 global $member, $manager;
2424
2425                 $blogid = intRequestVar('blogid');
2426
2427                 $member->blogAdminRights($blogid) or self::disallow();
2428
2429                 $blog =& $manager->getBlog($blogid);
2430
2431                 $notify_address = trim(postVar('notify'));
2432                 $shortname              = trim(postVar('shortname'));
2433                 $updatefile             = trim(postVar('update'));
2434
2435                 $notifyComment  = intPostVar('notifyComment');
2436                 $notifyVote             = intPostVar('notifyVote');
2437                 $notifyNewItem  = intPostVar('notifyNewItem');
2438
2439                 if ( $notifyComment == 0 )
2440                 {
2441                         $notifyComment = 1;
2442                 }
2443                 if ( $notifyVote == 0 )
2444                 {
2445                         $notifyVote = 1;
2446                 }
2447                 if ( $notifyNewItem == 0 )
2448                 {
2449                         $notifyNewItem = 1;
2450                 }
2451                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2452
2453                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2454                 {
2455                         self::error(_ERROR_BADNOTIFY);
2456                         return;
2457                 }
2458
2459                 if ( !isValidShortName($shortname) )
2460                 {
2461                         self::error(_ERROR_BADSHORTBLOGNAME);
2462                         return;
2463                 }
2464
2465                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2466                 {
2467                         self::error(_ERROR_DUPSHORTBLOGNAME);
2468                         return;
2469                 }
2470                 // check if update file is writable
2471                 if ( $updatefile && !is_writeable($updatefile) )
2472                 {
2473                         self::error(_ERROR_UPDATEFILE);
2474                         return;
2475                 }
2476
2477                 $blog->setName(trim(postVar('name')));
2478                 $blog->setShortName($shortname);
2479                 $blog->setNotifyAddress($notify_address);
2480                 $blog->setNotifyType($notifyType);
2481                 $blog->setMaxComments(postVar('maxcomments'));
2482                 $blog->setCommentsEnabled(postVar('comments'));
2483                 $blog->setTimeOffset(postVar('timeoffset'));
2484                 $blog->setUpdateFile($updatefile);
2485                 $blog->setURL(trim(postVar('url')));
2486                 $blog->setDefaultSkin(intPostVar('defskin'));
2487                 $blog->setDescription(trim(postVar('desc')));
2488                 $blog->setPublic(postVar('public'));
2489                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2490                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2491                 $blog->setDefaultCategory(intPostVar('defcat'));
2492                 $blog->setSearchable(intPostVar('searchable'));
2493                 $blog->setEmailRequired(intPostVar('reqemail'));
2494                 $blog->writeSettings();
2495
2496                 // store plugin options
2497                 $aOptions = requestArray('plugoption');
2498                 NucleusPlugin::apply_plugin_options($aOptions);
2499
2500                 $data = array(
2501                         'context' => 'blog',
2502                         'blogid'  => $blogid,
2503                         'blog'    => &$blog
2504                 );
2505                 $manager->notify('PostPluginOptionsUpdate', $data);
2506
2507                 self::action_overview(_MSG_SETTINGSCHANGED);
2508                 return;
2509         }
2510
2511         /**
2512          * Admin::action_deleteblog()
2513          *
2514          * @param       void
2515          * @return      void
2516          */
2517         static private function action_deleteblog()
2518         {
2519                 global $member, $CONF, $manager;
2520
2521                 $blogid = intRequestVar('blogid');
2522
2523                 $member->blogAdminRights($blogid) or self::disallow();
2524
2525                 // check if blog is default blog
2526                 if ( $CONF['DefaultBlog'] == $blogid )
2527                 {
2528                         self::error(_ERROR_DELDEFBLOG);
2529                         return;
2530                 }
2531
2532                 $blog =& $manager->getBlog($blogid);
2533
2534                 self::$skin->parse('deleteblog');
2535                 return;
2536         }
2537
2538         /**
2539          * Admin::action_deleteblogconfirm()
2540          * Delete Blog
2541          *
2542          * @param       Void
2543          * @return      Void
2544          */
2545         static private function action_deleteblogconfirm()
2546         {
2547                 global $member, $CONF, $manager;
2548
2549                 $blogid = intRequestVar('blogid');
2550
2551                 $data = array('blogid' => $blogid);
2552                 $manager->notify('PreDeleteBlog', $data);
2553
2554                 $member->blogAdminRights($blogid) or self::disallow();
2555
2556                 // check if blog is default blog
2557                 if ( $CONF['DefaultBlog'] == $blogid )
2558                 {
2559                         self::error(_ERROR_DELDEFBLOG);
2560                         return;
2561                 }
2562
2563                 // delete all comments
2564                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;
2565                 DB::execute($query);
2566
2567                 // delete all items
2568                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;
2569                 DB::execute($query);
2570
2571                 // delete all team members
2572                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;
2573                 DB::execute($query);
2574
2575                 // delete all bans
2576                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;
2577                 DB::execute($query);
2578
2579                 // delete all categories
2580                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;
2581                 DB::execute($query);
2582
2583                 // delete all associated plugin options
2584                 NucleusPlugin::delete_option_values('blog', $blogid);
2585
2586                 // delete the blog itself
2587                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;
2588                 DB::execute($query);
2589
2590                 $data = array('blogid' => $blogid);
2591                 $manager->notify('PostDeleteBlog', $data);
2592
2593                 self::action_overview(_DELETED_BLOG);
2594                 return;
2595         }
2596
2597         /**
2598          * Admin::action_memberdelete()
2599          *
2600          * @param       void
2601          * @return      void
2602          */
2603         static private function action_memberdelete()
2604         {
2605                 global $member, $manager;
2606
2607                 $memberid = intRequestVar('memberid');
2608
2609                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2610
2611                 $mem =& $manager->getMember($memberid);
2612
2613                 self::$skin->parse('memberdelete');
2614                 return;
2615         }
2616
2617         /**
2618          * Admin::action_memberdeleteconfirm()
2619          *
2620          * @param       void
2621          * @return      void
2622          */
2623         static private function action_memberdeleteconfirm()
2624         {
2625                 global $member;
2626
2627                 $memberid = intRequestVar('memberid');
2628
2629                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();
2630
2631                 $error = self::deleteOneMember($memberid);
2632                 if ( $error )
2633                 {
2634                         self::error($error);
2635                         return;
2636                 }
2637
2638                 if ( $member->isAdmin() )
2639                 {
2640                         self::action_usermanagement();
2641                         return;
2642                 }
2643                 else
2644                 {
2645                         self::action_overview(_DELETED_MEMBER);
2646                         return;
2647                 }
2648                 return;
2649         }
2650
2651         /**
2652          * Admin::deleteOneMember()
2653          * Delete a member by id
2654          *
2655          * @static
2656          * @params      Integer $memberid       member id
2657          * @return      String  null string or error messages
2658          */
2659         static public function deleteOneMember($memberid)
2660         {
2661                 global $manager;
2662
2663                 $memberid = intval($memberid);
2664                 $mem =& $manager->getMember($memberid);
2665
2666                 if ( !$mem->canBeDeleted() )
2667                 {
2668                         return _ERROR_DELETEMEMBER;
2669                 }
2670
2671                 $data = array('member' => &$mem);
2672                 $manager->notify('PreDeleteMember', $data);
2673
2674                 /* unlink comments from memberid */
2675                 if ( $memberid )
2676                 {
2677                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";
2678                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);
2679                         DB::execute($query);
2680                 }
2681
2682                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;
2683                 DB::execute($query);
2684
2685                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;
2686                 DB::execute($query);
2687
2688                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;
2689                 DB::execute($query);
2690
2691                 // delete all associated plugin options
2692                 NucleusPlugin::delete_option_values('member', $memberid);
2693
2694                 $data = array('member' => &$mem);
2695                 $manager->notify('PostDeleteMember', $data);
2696
2697                 return '';
2698         }
2699
2700         /**
2701          * Admin::action_createnewlog()
2702          *
2703          * @param       void
2704          * @return      void
2705          */
2706         static private function action_createnewlog()
2707         {
2708                 global $member, $CONF, $manager;
2709
2710                 // Only Super-Admins can do this
2711                 $member->isAdmin() or self::disallow();
2712
2713                 self::$skin->parse('createnewlog');
2714                 return;
2715         }
2716
2717         /**
2718          * Admin::action_addnewlog()
2719          *
2720          * @param       void
2721          * @return      void
2722          */
2723         static private function action_addnewlog()
2724         {
2725                 global $member, $manager, $CONF;
2726
2727                 // Only Super-Admins can do this
2728                 $member->isAdmin() or self::disallow();
2729
2730                 $bname                  = trim(postVar('name'));
2731                 $bshortname             = trim(postVar('shortname'));
2732                 $btimeoffset    = postVar('timeoffset');
2733                 $bdesc                  = trim(postVar('desc'));
2734                 $bdefskin               = postVar('defskin');
2735
2736                 if ( !isValidShortName($bshortname) )
2737                 {
2738                         self::error(_ERROR_BADSHORTBLOGNAME);
2739                         return;
2740                 }
2741
2742                 if ( $manager->existsBlog($bshortname) )
2743                 {
2744                         self::error(_ERROR_DUPSHORTBLOGNAME);
2745                         return;
2746                 }
2747
2748                 $data = array(
2749                         'name'        => &$bname,
2750                         'shortname'   => &$bshortname,
2751                         'timeoffset'  => &$btimeoffset,
2752                         'description' => &$bdesc,
2753                         'defaultskin' => &$bdefskin
2754                 );
2755                 $manager->notify('PreAddBlog', $data);
2756
2757                 // add slashes for sql queries
2758                 $bname                  = DB::quoteValue($bname);
2759                 $bshortname             = DB::quoteValue($bshortname);
2760                 $btimeoffset    = DB::quoteValue($btimeoffset);
2761                 $bdesc                  = DB::quoteValue($bdesc);
2762                 $bdefskin               = DB::quoteValue($bdefskin);
2763
2764                 // create blog
2765                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";
2766                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);
2767                 DB::execute($query);
2768
2769                 $blogid = DB::getInsertId();
2770                 $blog   =& $manager->getBlog($blogid);
2771
2772                 // create new category
2773                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);
2774                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);
2775
2776                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';
2777                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));
2778                 $catid = DB::getInsertId();
2779
2780                 // set as default category
2781                 $blog->setDefaultCategory($catid);
2782                 $blog->writeSettings();
2783
2784                 // create team member
2785                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";
2786                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);
2787                 DB::execute($query);
2788
2789                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
2790                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');
2791
2792                 $blog->additem(
2793                         $blog->getDefaultCategory(),
2794                         $itemdeftitle,$itemdefbody,
2795                         '',
2796                         $blogid,
2797                         $member->getID(),
2798                         $blog->getCorrectTime(),
2799                         0,
2800                         0,
2801                         0
2802                 );
2803
2804                 $data = array('blog' => &$blog);
2805                 $manager->notify('PostAddBlog', $data);
2806
2807                 $data = array(
2808                         'blog'                  => &$blog,
2809                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,
2810                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,
2811                         'catid'                 => $catid
2812                 );
2813                 $manager->notify('PostAddCategory', $data);
2814
2815                 /* TODO: we should consider to use the other way insterad of this */
2816                 $_REQUEST['blogid'] = $blogid;
2817                 $_REQUEST['catid']  = $catid;
2818                 self::$skin->parse('addnewlog');
2819                 return;
2820         }
2821
2822         /**
2823          * Admin::action_addnewlog2()
2824          *
2825          * @param       void
2826          * @return      void
2827          */
2828         static private function action_addnewlog2()
2829         {
2830                 global $member, $manager;
2831                 $blogid = intRequestVar('blogid');
2832
2833                 $member->blogAdminRights($blogid) or self::disallow();
2834
2835                 $burl = requestVar('url');
2836
2837                 $blog =& $manager->getBlog($blogid);
2838                 $blog->setURL(trim($burl));
2839                 $blog->writeSettings();
2840
2841                 self::action_overview(_MSG_NEWBLOG);
2842                 return;
2843         }
2844
2845         /**
2846          * Admin::action_skinieoverview()
2847          *
2848          * @param       void
2849          * @return      void
2850          */
2851         static private function action_skinieoverview()
2852         {
2853                 global $member, $DIR_LIBS, $manager;
2854
2855                 $member->isAdmin() or self::disallow();
2856
2857                 include_once($DIR_LIBS . 'skinie.php');
2858
2859                 self::$skin->parse('skinieoverview');
2860                 return;
2861         }
2862
2863         /**
2864          * Admin::action_skinieimport()
2865          *
2866          * @param       void
2867          * @return      void
2868          */
2869         static private function action_skinieimport()
2870         {
2871                 global $member;
2872
2873                 $member->isAdmin() or self::disallow();
2874
2875                 $skinFileRaw = postVar('skinfile');
2876                 $mode = postVar('mode');
2877
2878                 $error = self::skinieimport($mode, $skinFileRaw);
2879                 if ( $error )
2880                 {
2881                         self::error($error);
2882                         return;
2883                 }
2884
2885                 self::$skin->parse('skinieimport');
2886                 return;
2887         }
2888
2889         /**
2890          * Admin::action_skiniedoimport()
2891          *
2892          * @param       void
2893          * @return      void
2894          */
2895         static private function action_skiniedoimport()
2896         {
2897                 global $member, $DIR_LIBS, $DIR_SKINS;
2898
2899                 $member->isAdmin() or self::disallow();
2900
2901                 // load skinie class
2902                 include_once($DIR_LIBS . 'skinie.php');
2903
2904                 $mode = postVar('mode');
2905                 $skinFileRaw = postVar('skinfile');
2906                 $allowOverwrite = intPostVar('overwrite');
2907
2908                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
2909                 if ( $error )
2910                 {
2911                         self::error($msg);
2912                         return;
2913                 }
2914
2915                 self::$skin->parse('skiniedoimport');
2916                 return;
2917         }
2918
2919         /**
2920          * Admin::action_skinieexport()
2921          *
2922          * @param       void
2923          * @return      void
2924          */
2925         static private function action_skinieexport()
2926         {
2927                 global $member;
2928
2929                 $member->isAdmin() or self::disallow();
2930
2931                 $aSkins = requestIntArray('skin');
2932                 $aTemplates = requestIntArray('template');
2933                 $info = postVar('info');
2934
2935                 self::skinieexport($aSkins, $aTemplates, $info);
2936
2937                 return;
2938         }
2939
2940         /**
2941          * Admin::action_templateoverview()
2942          *
2943          * @param       void
2944          * @return      void
2945          */
2946         static private function action_templateoverview()
2947         {
2948                 global $member, $manager;
2949
2950                 $member->isAdmin() or self::disallow();
2951
2952                 self::$skin->parse('templateoverview');
2953                 return;
2954         }
2955
2956         /**
2957          * Admin::action_templateedit()
2958          *
2959          * @param       string  $msg    message for pageheader
2960          * @return      void
2961          */
2962         static private function action_templateedit($msg = '')
2963         {
2964                 global $member, $manager;
2965                 if ( $msg )
2966                 {
2967                         self::$headMess = $msg;
2968                 }
2969
2970                 $templateid = intRequestVar('templateid');
2971
2972                 $member->isAdmin() or self::disallow();
2973
2974                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";
2975                 self::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";
2976
2977                 self::$skin->parse('templateedit');
2978                 return;
2979         }
2980
2981         /**
2982          * Admin::action_templateupdate()
2983          *
2984          * @param       void
2985          * @return      void
2986          */
2987         static private function action_templateupdate()
2988         {
2989                 global $member,$manager;
2990
2991                 $templateid = intRequestVar('templateid');
2992
2993                 $member->isAdmin() or self::disallow();
2994
2995                 $name = postVar('tname');
2996                 $desc = postVar('tdesc');
2997
2998                 if ( !isValidTemplateName($name) )
2999                 {
3000                         self::error(_ERROR_BADTEMPLATENAME);
3001                         return;
3002                 }
3003
3004                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3005                 {
3006                         self::error(_ERROR_DUPTEMPLATENAME);
3007                         return;
3008                 }
3009
3010                 // 1. Remove all template parts
3011                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3012                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3013                 DB::execute($query);
3014
3015                 // 2. Update description
3016                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3017                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3018                 DB::execute($query);
3019
3020                 // 3. Add non-empty template parts
3021                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));
3022                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));
3023                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));
3024                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));
3025                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));
3026                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));
3027                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));
3028                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));
3029                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));
3030                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));
3031                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));
3032                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));
3033                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));
3034                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));
3035                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));
3036                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));
3037                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3038                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));
3039                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));
3040                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));
3041                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));
3042                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));
3043                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));
3044                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));
3045                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));
3046                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));
3047                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));
3048                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));
3049                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));
3050                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));
3051                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3052                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));
3053                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));
3054                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));
3055
3056                 $data = array('fields' => array());
3057                 $manager->notify('TemplateExtraFields', $data);
3058                 foreach ( $data['fields'] as $pfkey=>$pfvalue )
3059                 {
3060                         foreach ( $pfvalue as $pffield => $pfdesc )
3061                         {
3062                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3063                         }
3064                 }
3065
3066                 // jump back to template edit
3067                 self::action_templateedit(_TEMPLATE_UPDATED);
3068                 return;
3069         }
3070
3071         /**
3072          * Admin::addToTemplate()
3073          *
3074          * @param       Integer $id     ID for template
3075          * @param       String  $partname       parts name
3076          * @param       String  $content        template contents
3077          * @return      Integer record index
3078          *
3079          */
3080         static private function addToTemplate($id, $partname, $content)
3081         {
3082                 // don't add empty parts:
3083                 if ( !trim($content) )
3084                 {
3085                         return -1;
3086                 }
3087
3088                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";
3089                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));
3090                 if ( DB::execute($query) === FALSE )
3091                 {
3092                         $err = DB::getError();
3093                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
3094                 }
3095                 return DB::getInsertId();
3096         }
3097
3098         /**
3099          * Admin::action_templatedelete()
3100          *
3101          * @param       void
3102          * @return      void
3103          */
3104         static private function action_templatedelete()
3105         {
3106                 global $member, $manager;
3107
3108                 $member->isAdmin() or self::disallow();
3109
3110                 $templateid = intRequestVar('templateid');
3111                 // TODO: check if template can be deleted
3112
3113                 self::$skin->parse('templatedelete');
3114                 return;
3115         }
3116
3117         /**
3118          * Admin::action_templatedeleteconfirm()
3119          *
3120          * @param       void
3121          * @return      void
3122          */
3123         static private function action_templatedeleteconfirm()
3124         {
3125                 global $member, $manager;
3126
3127                 $templateid = intRequestVar('templateid');
3128
3129                 $member->isAdmin() or self::disallow();
3130
3131                 $data = array('templateid' => $templateid);
3132                 $manager->notify('PreDeleteTemplate', $data);
3133
3134                 // 1. delete description
3135                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);
3136
3137                 // 2. delete parts
3138                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);
3139
3140
3141                 $data = array('templateid' => $templateid);
3142                 $manager->notify('PostDeleteTemplate', $data);
3143
3144                 self::action_templateoverview();
3145                 return;
3146         }
3147
3148         /**
3149          * Admin::action_templatenew()
3150          *
3151          * @param       void
3152          * @return      void
3153          */
3154         static private function action_templatenew()
3155         {
3156                 global $member;
3157
3158                 $member->isAdmin() or self::disallow();
3159
3160                 $name = postVar('name');
3161                 $desc = postVar('desc');
3162
3163                 if ( !isValidTemplateName($name) )
3164                 {
3165                         self::error(_ERROR_BADTEMPLATENAME);
3166                         return;
3167                 }
3168
3169                 if ( Template::exists($name) )
3170                 {
3171                         self::error(_ERROR_DUPTEMPLATENAME);
3172                         return;
3173                 }
3174
3175                 $newTemplateId = Template::createNew($name, $desc);
3176
3177                 self::action_templateoverview();
3178                 return;
3179         }
3180
3181         /**
3182          * Admin::action_templateclone()
3183          *
3184          * @param       void
3185          * @return      void
3186          */
3187         static private function action_templateclone()
3188         {
3189                 global $member;
3190
3191                 $templateid = intRequestVar('templateid');
3192
3193                 $member->isAdmin() or self::disallow();
3194
3195                 // 1. read old template
3196                 $name = Template::getNameFromId($templateid);
3197                 $desc = Template::getDesc($templateid);
3198
3199                 // 2. create desc thing
3200                 $name = "cloned" . $name;
3201
3202                 // if a template with that name already exists:
3203                 if ( Template::exists($name) )
3204                 {
3205                         $i = 1;
3206                         while (Template::exists($name . $i))
3207                         {
3208                                 $i++;
3209                         }
3210                         $name .= $i;
3211                 }
3212
3213                 $newid = Template::createNew($name, $desc);
3214
3215                 // 3. create clone
3216                 // go through parts of old template and add them to the new one
3217                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3218                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3219
3220                 $res = DB::getResult($query);
3221                 foreach ( $res as $row)
3222                 {
3223                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3224                 }
3225
3226                 self::action_templateoverview();
3227                 return;
3228         }
3229
3230         /**
3231          * Admin::action_admintemplateoverview()
3232          *
3233          * @param       void
3234          * @return      void
3235          */
3236         static private function action_admintemplateoverview()
3237         {
3238                 global $member;
3239                 $member->isAdmin() or self::disallow();
3240                 self::$skin->parse('admntemplateoverview');
3241                 return;
3242         }
3243
3244         /**
3245          * Admin::action_admintemplateedit()
3246          *
3247          * @param       string  $msg    message for pageheader
3248          * @return      void
3249          */
3250         static private function action_admintemplateedit($msg = '')
3251         {
3252                 global $member, $manager;
3253                 if ( $msg )
3254                 {
3255                         self::$headMess = $msg;
3256                 }
3257                 $member->isAdmin() or self::disallow();
3258
3259                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";
3260                 self::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";
3261
3262                 self::$skin->parse('admintemplateedit');
3263                 return;
3264         }
3265
3266         /**
3267          * Admin::action_admintemplateupdate()
3268          *
3269          * @param       void
3270          * @return      void
3271          */
3272         static private function action_admintemplateupdate()
3273         {
3274                 global $member, $manager;
3275                 $templateid = intRequestVar('templateid');
3276                 $member->isAdmin() or self::disallow();
3277                 $name = postVar('tname');
3278                 $desc = postVar('tdesc');
3279
3280                 if ( !isValidTemplateName($name) )
3281                 {
3282                         self::error(_ERROR_BADTEMPLATENAME);
3283                         return;
3284                 }
3285
3286                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )
3287                 {
3288                         self::error(_ERROR_DUPTEMPLATENAME);
3289                         return;
3290                 }
3291
3292                 // 1. Remove all template parts
3293                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3294                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3295                 DB::execute($query);
3296
3297                 // 2. Update description
3298                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";
3299                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);
3300                 DB::execute($query);
3301
3302                 // 3. Add non-empty template parts
3303                 self::addToTemplate($templateid, 'NORMALSKINLIST_HEAD',                                         postVar('NORMALSKINLIST_HEAD'));
3304                 self::addToTemplate($templateid, 'NORMALSKINLIST_BODY',                                         postVar('NORMALSKINLIST_BODY'));
3305                 self::addToTemplate($templateid, 'NORMALSKINLIST_FOOT',                                         postVar('NORMALSKINLIST_FOOT'));
3306                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                           postVar('ADMIN_CUSTOMHELPLINK_ICON'));
3307                 self::addToTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                         postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));
3308                 self::addToTemplate($templateid, 'ADMIN_BLOGLINK',                                                      postVar('ADMIN_BLOGLINK'));
3309                 self::addToTemplate($templateid, 'ADMIN_BATCHLIST',                                                     postVar('ADMIN_BATCHLIST'));
3310                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                       postVar('ACTIVATE_FORGOT_TITLE'));
3311                 self::addToTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                        postVar('ACTIVATE_FORGOT_TEXT'));
3312                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                     postVar('ACTIVATE_REGISTER_TITLE'));
3313                 self::addToTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                      postVar('ACTIVATE_REGISTER_TEXT'));
3314                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                       postVar('ACTIVATE_CHANGE_TITLE'));
3315                 self::addToTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                        postVar('ACTIVATE_CHANGE_TEXT'));
3316                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                            postVar('TEMPLATE_EDIT_EXPLUGNAME'));
3317                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                      postVar('TEMPLATE_EDIT_ROW_HEAD'));
3318                 self::addToTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                      postVar('TEMPLATE_EDIT_ROW_TAIL'));
3319                 self::addToTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                        postVar('SPECIALSKINLIST_HEAD'));
3320                 self::addToTemplate($templateid, 'SPECIALSKINLIST_BODY',                                        postVar('SPECIALSKINLIST_BODY'));
3321                 self::addToTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                        postVar('SPECIALSKINLIST_FOOT'));
3322                 self::addToTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                       postVar('SYSTEMINFO_GDSETTINGS'));
3323                 self::addToTemplate($templateid, 'BANLIST_DELETED_LIST',                                        postVar('BANLIST_DELETED_LIST'));
3324                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                     postVar('INSERT_PLUGOPTION_TITLE'));
3325                 self::addToTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                      postVar('INSERT_PLUGOPTION_BODY'));
3326                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                           postVar('INPUTYESNO_TEMPLATE_ADMIN'));
3327                 self::addToTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                          postVar('INPUTYESNO_TEMPLATE_NORMAL'));
3328                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                          postVar('ADMIN_SPECIALSKINLIST_HEAD'));
3329                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                          postVar('ADMIN_SPECIALSKINLIST_BODY'));
3330                 self::addToTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                          postVar('ADMIN_SPECIALSKINLIST_FOOT'));
3331                 self::addToTemplate($templateid, 'SKINIE_EXPORT_LIST',                                          postVar('SKINIE_EXPORT_LIST'));
3332                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                       postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));
3333                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                       postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));
3334                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                       postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));
3335                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                        postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));
3336                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                        postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));
3337                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                        postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));
3338                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));
3339                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));
3340                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));
3341                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));
3342                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));
3343                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));
3344                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));
3345                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));
3346                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));
3347                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));
3348                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));
3349                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));
3350                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));
3351                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));
3352                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));
3353                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));
3354                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));
3355                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));
3356                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));
3357                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));
3358                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));
3359                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));
3360                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));
3361                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));
3362                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));
3363                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));
3364                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));
3365                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));
3366                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));
3367                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));
3368                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));
3369                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));
3370                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));
3371                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));
3372                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));
3373                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));
3374                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));
3375                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));
3376                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));
3377                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));
3378                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',       postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));
3379                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));
3380                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));
3381                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));
3382                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));
3383                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));
3384                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));
3385                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));
3386                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));
3387                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));
3388                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));
3389                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));
3390                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));
3391                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));
3392                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));
3393                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));
3394                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));
3395                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));
3396                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));
3397                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));
3398                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));
3399                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));
3400                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));
3401                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));
3402                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));
3403                 self::addToTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',       postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));
3404                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                      postVar('PLUGIN_QUICKMENU_TITLE'));
3405                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                       postVar('PLUGIN_QUICKMENU_HEAD'));
3406                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                       postVar('PLUGIN_QUICKMENU_BODY'));
3407                 self::addToTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                       postVar('PLUGIN_QUICKMENU_FOOT'));
3408
3409                 $data = array('fields' => array());
3410                 $manager->notify('AdminTemplateExtraFields', $data);
3411                 foreach ( $data['fields'] as $pfkey => $pfvalue )
3412                 {
3413                         foreach ( $pfvalue as $pffield => $pfdesc )
3414                         {
3415                                 self::addToTemplate($templateid, $pffield, postVar($pffield));
3416                         }
3417                 }
3418
3419                 // jump back to template edit
3420                 self::action_admintemplateedit(_TEMPLATE_UPDATED);
3421                 return;
3422         }
3423
3424         /**
3425          * Admin::action_admintemplatedelete()
3426          *
3427          * @param       void
3428          * @return      void
3429          */
3430         static private function action_admintemplatedelete()
3431         {
3432                 global $member, $manager;
3433                 $member->isAdmin() or self::disallow();
3434
3435                 // TODO: check if template can be deleted
3436                 self::$skin->parse('admintemplatedelete');
3437                 return;
3438         }
3439
3440         /**
3441          * Admin::action_admintemplatedeleteconfirm()
3442          *
3443          * @param       void
3444          * @return      void
3445          */
3446         static private function action_admintemplatedeleteconfirm()
3447         {
3448                 global $member, $manager;
3449
3450                 $templateid = intRequestVar('templateid');
3451                 $member->isAdmin() or self::disallow();
3452
3453                 $data = array('templateid' => $templateid);
3454                 $manager->notify('PreDeleteAdminTemplate', $data);
3455
3456                 // 1. delete description
3457                 $query = "DELETE FROM %s WHERE tdnumber=%s;";
3458                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);
3459                 DB::execute($query);
3460
3461                 // 2. delete parts
3462                 $query = "DELETE FROM %s WHERE tdesc=%d;";
3463                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3464                 DB::execute($query);
3465
3466                 $data = array('templateid' => $templateid);
3467                 $manager->notify('PostDeleteAdminTemplate', $data);
3468
3469                 self::action_admintemplateoverview();
3470                 return;
3471         }
3472
3473         /**
3474          * Admin::action_admintemplatenew()
3475          *
3476          * @param       void
3477          * @return      void
3478          */
3479         static private function action_admintemplatenew()
3480         {
3481                 global $member;
3482                 $member->isAdmin() or self::disallow();
3483                 $name = postVar('name');
3484                 $desc = postVar('desc');
3485
3486                 if ( !isValidTemplateName($name) )
3487                 {
3488                         self::error(_ERROR_BADTEMPLATENAME);
3489                         return;
3490                 }
3491                 else if ( !preg_match('#^admin/#', $name) )
3492                 {
3493                         self::error(_ERROR_BADADMINTEMPLATENAME);
3494                         return;
3495                 }
3496                 else if ( Template::exists($name) )
3497                 {
3498                         self::error(_ERROR_DUPTEMPLATENAME);
3499                         return;
3500                 }
3501
3502                 $newTemplateId = Template::createNew($name, $desc);
3503                 self::action_admintemplateoverview();
3504                 return;
3505         }
3506
3507         /**
3508          * Admin::action_admintemplateclone()
3509          *
3510          * @param       void
3511          * @return      void
3512          */
3513         static private function action_admintemplateclone()
3514         {
3515                 global $member;
3516                 $templateid = intRequestVar('templateid');
3517                 $member->isAdmin() or self::disallow();
3518
3519                 // 1. read old template
3520                 $name = Template::getNameFromId($templateid);
3521                 $desc = Template::getDesc($templateid);
3522
3523                 // 2. create desc thing
3524                 $name = $name . "cloned";
3525
3526                 // if a template with that name already exists:
3527                 if ( Template::exists($name) )
3528                 {
3529                         $i = 1;
3530                         while ( Template::exists($name . $i) )
3531                         {
3532                                 $i++;
3533                         }
3534                         $name .= $i;
3535                 }
3536
3537                 $newid = Template::createNew($name, $desc);
3538
3539                 // 3. create clone
3540                 // go through parts of old template and add them to the new one
3541                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";
3542                 $query = sprintf($query, sql_table('template'), (integer) $templateid);
3543
3544                 $res = DB::getResult($query);
3545                 foreach ( $res as $row )
3546                 {
3547                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);
3548                 }
3549
3550                 self::action_admintemplateoverview();
3551                 return;
3552         }
3553
3554         /**
3555          * Admin::action_skinoverview()
3556          *
3557          * @param       void
3558          * @return      void
3559          */
3560         static private function action_skinoverview()
3561         {
3562                 global $member, $manager;
3563
3564                 $member->isAdmin() or self::disallow();
3565
3566                 self::$skin->parse('skinoverview');
3567                 return;
3568         }
3569
3570         /**
3571          * Admin::action_skinnew()
3572          *
3573          * @param       void
3574          * @return      void
3575          */
3576         static private function action_skinnew()
3577         {
3578                 global $member;
3579
3580                 $member->isAdmin() or self::disallow();
3581
3582                 $name = trim(postVar('name'));
3583                 $desc = trim(postVar('desc'));
3584
3585                 if ( !isValidSkinName($name) )
3586                 {
3587                         self::error(_ERROR_BADSKINNAME);
3588                         return;
3589                 }
3590                 else if ( SKIN::exists($name) )
3591                 {
3592                         self::error(_ERROR_DUPSKINNAME);
3593                         return;
3594                 }
3595
3596                 SKIN::createNew($name, $desc);
3597
3598                 self::action_skinoverview();
3599                 return;
3600         }
3601
3602         /**
3603          * Admin::action_skinedit()
3604          *
3605          * @param       void
3606          * @return      void
3607          */
3608         static private function action_skinedit()
3609         {
3610                 global $member;
3611
3612                 $member->isAdmin() or self::disallow();
3613
3614                 self::$skin->parse('skinedit');
3615                 return;
3616         }
3617
3618         /**
3619          * Admin::action_skineditgeneral()
3620          *
3621          * @param       void
3622          * @return      void
3623          */
3624         static private function action_skineditgeneral()
3625         {
3626                 global $member;
3627
3628                 $skinid = intRequestVar('skinid');
3629
3630                 $member->isAdmin() or self::disallow();
3631
3632                 $error = self::skineditgeneral($skinid);
3633                 if ( $error )
3634                 {
3635                         self::error($error);
3636                         return;
3637                 }
3638
3639                 self::action_skinedit();
3640                 return;
3641         }
3642
3643         static private function action_skinedittype($msg = '')
3644         {
3645                 global $member;
3646
3647                 $member->isAdmin() or self::disallow();
3648
3649                 if ( $msg )
3650                 {
3651                         self::$headMess = $msg;
3652                 }
3653
3654                 $type = requestVar('type');
3655                 $type = trim($type);
3656                 $type = strtolower($type);
3657
3658                 if ( !isValidShortName($type) )
3659                 {
3660                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3661                         return;
3662                 }
3663
3664                 self::$skin->parse('skinedittype');
3665                 return;
3666         }
3667
3668         /**
3669          * Admin::action_skinupdate()
3670          *
3671          * @param       void
3672          * @return      void
3673          */
3674         static private function action_skinupdate()
3675         {
3676                 global $manager, $member;
3677
3678                 $skinid = intRequestVar('skinid');
3679                 $content = trim(postVar('content'));
3680                 $type = postVar('type');
3681
3682                 $member->isAdmin() or self::disallow();
3683
3684                 $skin =& $manager->getSKIN($skinid);
3685                 $skin->update($type, $content);
3686
3687                 self::action_skinedittype(_SKIN_UPDATED);
3688                 return;
3689         }
3690
3691         /**
3692          * Admin::action_skindelete()
3693          *
3694          * @param       void
3695          * @return      void
3696          */
3697         static private function action_skindelete()
3698         {
3699                 global $CONF, $member;
3700
3701                 $member->isAdmin() or self::disallow();
3702
3703                 $skinid = intRequestVar('skinid');
3704
3705                 // don't allow default skin to be deleted
3706                 if ( $skinid == $CONF['BaseSkin'] )
3707                 {
3708                         self::error(_ERROR_DEFAULTSKIN);
3709                         return;
3710                 }
3711
3712                 // don't allow deletion of default skins for blogs
3713                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";
3714                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3715
3716                 $name = DB::getValue($query);
3717                 if ( $name )
3718                 {
3719                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3720                         return;
3721                 }
3722
3723                 self::$skin->parse('skindelete');
3724                 return;
3725         }
3726
3727         /**
3728          * Admin::action_skindeleteconfirm()
3729          *
3730          * @param       void
3731          * @return      void
3732          */
3733         static private function action_skindeleteconfirm()
3734         {
3735                 global $member, $CONF;
3736
3737                 $member->isAdmin() or self::disallow();
3738
3739                 $skinid = intRequestVar('skinid');
3740
3741                 // don't allow default skin to be deleted
3742                 if ( $skinid == $CONF['BaseSkin'] )
3743                 {
3744                         self::error(_ERROR_DEFAULTSKIN);
3745                         return;
3746                 }
3747
3748                 // don't allow deletion of default skins for blogs
3749                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";
3750                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);
3751
3752                 $name = DB::getValue($query);
3753                 if ( $name )
3754                                 {
3755                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));
3756                         return;
3757                 }
3758
3759                 self::skindeleteconfirm($skinid);
3760
3761                 self::action_skinoverview();
3762                 return;
3763         }
3764
3765         /**
3766          * Admin::action_skinremovetype()
3767          *
3768          * @param       void
3769          * @return      void
3770          */
3771         static private function action_skinremovetype()
3772         {
3773                 global $member, $CONF;
3774
3775                 $member->isAdmin() or self::disallow();
3776
3777                 $skinid = intRequestVar('skinid');
3778                 $skintype = requestVar('type');
3779
3780                 if ( !isValidShortName($skintype) )
3781                 {
3782                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
3783                         return;
3784                 }
3785
3786                 self::$skin->parse('skinremovetype');
3787                 return;
3788         }
3789
3790         /**
3791          * Admin::action_skinremovetypeconfirm()
3792          *
3793          * @param       void
3794          * @return      void
3795          */
3796         static private function action_skinremovetypeconfirm()
3797         {
3798                 global $member;
3799
3800                 $member->isAdmin() or self::disallow();
3801
3802                 $skinid = intRequestVar('skinid');
3803                 $skintype = requestVar('type');
3804
3805                 $error = self::skinremovetypeconfirm($skinid, $skintype);
3806                 if ( $error )
3807                 {
3808                         self::error($error);
3809                         return;
3810                 }
3811
3812                 self::action_skinedit();
3813                 return;
3814         }
3815
3816         /**
3817          * Admin::action_skinclone()
3818          *
3819          * @param       void
3820          * @return      void
3821          */
3822         static private function action_skinclone()
3823         {
3824                 global $member;
3825
3826                 $member->isAdmin() or self::disallow();
3827
3828                 $skinid = intRequestVar('skinid');
3829
3830                 self::skinclone($skinid);
3831
3832                 self::action_skinoverview();
3833                 return;
3834         }
3835
3836         /**
3837          * Admin::action_adminskinoverview()
3838          *
3839          * @param       void
3840          * @return      void
3841          */
3842         static private function action_adminskinoverview()
3843         {
3844                 global $member;
3845
3846                 $member->isAdmin() or self::disallow();
3847
3848                 self::$skin->parse('adminskinoverview');
3849                 return;
3850         }
3851
3852         /**
3853          * Admin::action_adminskinnew()
3854          *
3855          * @param       void
3856          * @return      void
3857          */
3858         static private function action_adminskinnew()
3859         {
3860                 global $member;
3861
3862                 $member->isAdmin() or self::disallow();
3863
3864                 $name = trim(postVar('name'));
3865                 $desc = trim(postVar('desc'));
3866
3867                 if ( !isValidSkinName($name) )
3868                 {
3869                         self::error(_ERROR_BADSKINNAME);
3870                         return;
3871                 }
3872                 else if ( !preg_match('#^admin/#', $name) )
3873                 {
3874                         self::error(_ERROR_BADADMINSKINNAME);
3875                         return;
3876                 }
3877                 else if ( Skin::exists($name) )
3878                 {
3879                         self::error(_ERROR_DUPSKINNAME);
3880                         return;
3881                 }
3882
3883                 Skin::createNew($name, $desc);
3884
3885                 self::action_adminskinoverview();
3886                 return;
3887         }
3888
3889         /**
3890          * Admin::action_adminskinedit()
3891          *
3892          * @param       void
3893          * @return      void
3894          */
3895         static private function action_adminskinedit()
3896         {
3897                 global $member;
3898
3899                 $member->isAdmin() or self::disallow();
3900
3901                 self::$skin->parse('adminskinedit');
3902
3903                 return;
3904         }
3905
3906         /**
3907          * Admin::action_adminskineditgeneral()
3908          *
3909          * @param       void
3910          * @return      void
3911          */
3912         static private function action_adminskineditgeneral()
3913         {
3914                 global $member;
3915
3916                 $skinid = intRequestVar('skinid');
3917
3918                 $member->isAdmin() or self::disallow();
3919
3920                 $error = self::skineditgeneral($skinid, 'AdminActions');
3921                 if ( $error )
3922                 {
3923                         self::error($error);
3924                         return;
3925                 }
3926
3927                 self::action_adminskinedit();
3928                 return;
3929         }
3930
3931         /**
3932          * Admin::action_adminskinedittype()
3933          *
3934          * @param       string  $msg    message for pageheader
3935          * @return      void
3936          */
3937         static private function action_adminskinedittype($msg = '')
3938         {
3939                 global $member;
3940
3941                 $member->isAdmin() or self::disallow();
3942
3943                 if ( $msg )
3944                 {
3945                         self::$headMess = $msg;
3946                 }
3947                 $type = requestVar('type');
3948                 $type = trim($type);
3949                 $type = strtolower($type);
3950
3951                 if ( !isValidShortName($type) )
3952                 {
3953                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
3954                         return;
3955                 }
3956
3957                 self::$skin->parse('adminskinedittype');
3958                 return;
3959         }
3960
3961         /**
3962          * Admin::action_adminskinupdate()
3963          *
3964          * @param       void
3965          * @return      void
3966          */
3967         static private function action_adminskinupdate()
3968         {
3969                 global $manager, $member;
3970
3971                 $skinid = intRequestVar('skinid');
3972                 $content = trim(postVar('content'));
3973                 $type = postVar('type');
3974
3975                 $member->isAdmin() or self::disallow();
3976
3977                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');
3978                 $skin->update($type, $content);
3979
3980                 self::action_adminskinedittype(_SKIN_UPDATED);
3981                 return;
3982         }
3983
3984         /**
3985          * Admin::action_adminskindelete()
3986          *
3987          * @param       void
3988          * @return      void
3989          */
3990         static private function action_adminskindelete()
3991         {
3992                 global $CONF, $member;
3993
3994                 $member->isAdmin() or self::disallow();
3995
3996                 $skinid = intRequestVar('skinid');
3997
3998                 // don't allow default skin to be deleted
3999                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
4000                 {
4001                         self::error(_ERROR_DEFAULTSKIN);
4002                         return;
4003                 }
4004
4005                 /* don't allow if someone use it as a default*/
4006                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4007                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4008
4009                 $members = array();
4010                 while ( $row = $res->fetch() ) {
4011                         $members[] = $row['mrealname'];
4012                 }
4013                 if ( count($members) )
4014                 {
4015                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4016                         return;
4017                 }
4018
4019                 self::$skin->parse('adminskindelete');
4020                 return;
4021         }
4022
4023         /**
4024          * Admin::action_adminskindeleteconfirm()
4025          *
4026          * @param       void
4027          * @return      void
4028          */
4029         static private function action_adminskindeleteconfirm()
4030         {
4031                 global $member, $CONF;
4032
4033                 $member->isAdmin() or self::disallow();
4034
4035                 $skinid = intRequestVar('skinid');
4036
4037                 // don't allow default skin to be deleted
4038                 if ( $skinid == $CONF['AdminSkin'] || $skinid == $CONF['BookmarkletSkin'] )
4039                 {
4040                         self::error(_ERROR_DEFAULTSKIN);
4041                         return;
4042                 }
4043
4044                 /* don't allow if someone use it as a default*/
4045                 $query = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d;';
4046                 $res = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));
4047
4048                 $members = array();
4049                 while ( $row = $res->fetch() ) {
4050                         $members[] = $row['mrealname'];
4051                 }
4052                 if ( count($members) )
4053                 {
4054                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));
4055                         return;
4056                 }
4057
4058                 self::skindeleteconfirm($skinid);
4059
4060                 self::action_adminskinoverview();
4061                 return;
4062         }
4063
4064         /**
4065          * Admin::action_adminskinremovetype()
4066          *
4067          * @param       void
4068          * @return      void
4069          */
4070         static private function action_adminskinremovetype()
4071         {
4072                 global $member, $CONF;
4073
4074                 $member->isAdmin() or self::disallow();
4075
4076                 $skinid = intRequestVar('skinid');
4077                 $skintype = requestVar('type');
4078
4079                 if ( !isValidShortName($skintype) )
4080                 {
4081                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4082                         return;
4083                 }
4084
4085                 self::$skin->parse('adminskinremovetype');
4086                 return;
4087         }
4088
4089         /**
4090          * Admin::action_adminskinremovetypeconfirm()
4091          *
4092          * @param       void
4093          * @return      void
4094          */
4095         static private function action_adminskinremovetypeconfirm()
4096         {
4097                 global $member;
4098
4099                 $member->isAdmin() or self::disallow();
4100
4101                 $skinid = intRequestVar('skinid');
4102                 $skintype = requestVar('type');
4103
4104                 $error = self::skinremovetypeconfirm($skinid, $skintype);
4105                 if ( $error )
4106                 {
4107                         self::error($error);
4108                         return;
4109                 }
4110
4111                 self::action_adminskinedit();
4112                 return;
4113         }
4114
4115         /**
4116          * Admin::action_adminskinclone()
4117          *
4118          * @param       void
4119          * @return      void
4120          */
4121         static private function action_adminskinclone()
4122         {
4123                 global $member;
4124
4125                 $member->isAdmin() or self::disallow();
4126
4127                 $skinid = intRequestVar('skinid');
4128
4129                 self::skinclone($skinid, 'AdminActions');
4130
4131                 self::action_adminskinoverview();
4132                 return;
4133         }
4134
4135         /**
4136          * Admin::action_adminskinieoverview()
4137          *
4138          * @param       void
4139          * @return      void
4140          */
4141         static private function action_adminskinieoverview()
4142         {
4143                 global $member;
4144
4145                 $member->isAdmin() or self::disallow();
4146
4147                 self::$skin->parse('adminskinieoverview');
4148                 return;
4149         }
4150
4151         /**
4152          * Admin::action_adminskinieimport()
4153          *
4154          * @param       void
4155          * @return      void
4156          */
4157         static private function action_adminskinieimport()
4158         {
4159                 global $member;
4160
4161                 $member->isAdmin() or self::disallow();
4162
4163                 $skinFileRaw = postVar('skinfile');
4164                 $mode = postVar('mode');
4165
4166                 $error = self::skinieimport($mode, $skinFileRaw);
4167                 if ( $error )
4168                 {
4169                         self::error($error);
4170                         return;
4171                 }
4172
4173                 if ( !is_object(self::$skin) )
4174                 {
4175                         self::action_adminskiniedoimport();
4176                 }
4177                 else
4178                 {
4179                         self::$skin->parse('adminskinieimport');
4180                 }
4181                 return;
4182         }
4183
4184         /**
4185          * Admin::action_adminskiniedoimport()
4186          *
4187          * @param       void
4188          * @return      void
4189          */
4190         static private function action_adminskiniedoimport()
4191         {
4192                 global $DIR_SKINS, $member;
4193
4194                 $member->isAdmin() or self::disallow();
4195
4196                 $mode = postVar('mode');
4197                 $skinFileRaw = postVar('skinfile');
4198                 $allowOverwrite = intPostVar('overwrite');
4199
4200                 $error = self::skiniedoimport($mode, $skinFileRaw, $allowOverwrite);
4201                 if ( $error )
4202                 {
4203                         self::error($error);
4204                         return;
4205                 }
4206
4207                 if ( !is_object(self::$skin) )
4208                 {
4209                         global $DIR_SKINS;
4210                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";
4211                         $query  = sprintf($query, sql_table('skin_desc'));
4212                         $res    = intval(DB::getValue($query));
4213                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";
4214                         $query  = sprintf($query, sql_table('config'), $res);
4215                         DB::execute($query);
4216                         $skin   = new Skin(0, 'AdminActions', 'AdminSkin');
4217                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');
4218                 }
4219                 else
4220                 {
4221                         self::$skin->parse('adminskiniedoimport');
4222                 }
4223                 return;
4224         }
4225
4226         /**
4227          * Admin::action_adminskinieexport()
4228          *
4229          * @param       void
4230          * @return      void
4231          */
4232         static private function action_adminskinieexport()
4233         {
4234                 global $member;
4235
4236                 $member->isAdmin() or self::disallow();
4237
4238                 // load skinie class
4239                 $aSkins = requestIntArray('skin');
4240                 $aTemplates = requestIntArray('template');
4241                 $info = postVar('info');
4242
4243                 self::skinieexport($aSkins, $aTemplates, $info);
4244
4245                 return;
4246         }
4247
4248         /**
4249          * Admin::action_settingsedit()
4250          *
4251          * @param       Void
4252          * @return      Void
4253          */
4254         static private function action_settingsedit()
4255         {
4256                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4257
4258                 $member->isAdmin() or self::disallow();
4259
4260                 self::$skin->parse('settingsedit');
4261                 return;
4262         }
4263
4264         /**
4265          * Admin::action_settingsupdate()
4266          * Update $CONFIG and redirect
4267          *
4268          * @param       void
4269          * @return      void
4270          */
4271         static private function action_settingsupdate()
4272         {
4273                 global $member, $CONF;
4274
4275                 $member->isAdmin() or self::disallow();
4276
4277                 // check if email address for admin is valid
4278                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
4279                 {
4280                         self::error(_ERROR_BADMAILADDRESS);
4281                         return;
4282                 }
4283
4284                 // save settings
4285                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));
4286                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));
4287                 self::updateConfig('IndexURL',                  postVar('IndexURL'));
4288                 self::updateConfig('AdminURL',                  postVar('AdminURL'));
4289                 self::updateConfig('PluginURL',                 postVar('PluginURL'));
4290                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));
4291                 self::updateConfig('ActionURL',                 postVar('ActionURL'));
4292                 self::updateConfig('Locale',                    postVar('Locale'));
4293                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));
4294                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));
4295                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));
4296                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));
4297                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));
4298                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));
4299                 self::updateConfig('SiteName',                  postVar('SiteName'));
4300                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));
4301                 self::updateConfig('DisableSite',               postVar('DisableSite'));
4302                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));
4303                 self::updateConfig('LastVisit',                 postVar('LastVisit'));
4304                 self::updateConfig('MediaURL',                  postVar('MediaURL'));
4305                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));
4306                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));
4307                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));
4308                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));
4309                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));
4310                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));
4311                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));
4312                 self::updateConfig('CookiePath',                postVar('CookiePath'));
4313                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));
4314                 self::updateConfig('URLMode',                   postVar('URLMode'));
4315                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));
4316                 self::updateConfig('DebugVars',                 postVar('DebugVars'));
4317                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));
4318                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));
4319                 self::updateConfig('AdminSkin',                 postVar('adminskin'));
4320                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));
4321
4322                 // load new config and redirect (this way, the new locale will be used is necessary)
4323                 // note that when changing cookie settings, this redirect might cause the user
4324                 // to have to log in again.
4325                 getConfig();
4326                 redirect($CONF['AdminURL'] . '?action=manage');
4327                 return;
4328         }
4329
4330         /**
4331          * Admin::action_systemoverview()
4332          * Output system overview
4333          *
4334          * @param       void
4335          * @return      void
4336          */
4337         static private function action_systemoverview()
4338         {
4339                 self::$skin->parse('systemoverview');
4340                 return;
4341         }
4342
4343         /**
4344          * Admin::updateConfig()
4345          *
4346          * @param       string  $name
4347          * @param       string  $val
4348          * @return      integer return the ID in which the latest query posted
4349          */
4350         static private function updateConfig($name, $val)
4351         {
4352                 $query = "UPDATE %s SET value=%s WHERE name=%s";
4353                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));
4354                 if ( DB::execute($query) === FALSE )
4355                 {
4356                         $err = DB::getError();
4357                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);
4358                 }
4359                 return DB::getInsertId();
4360         }
4361
4362         /**
4363          * Admin::error()
4364          * Error message
4365          *
4366          * @param       string  $msg    message that will be shown
4367          * @return      void
4368          */
4369         static public function error($msg)
4370         {
4371                 self::$headMess = $msg;
4372                 self::$skin->parse('adminerrorpage');
4373                 return;
4374         }
4375
4376         /**
4377          * Admin::disallow()
4378          * add error log and show error page
4379          *
4380          * @param       void
4381          * @return      void
4382          */
4383         static public function disallow()
4384         {
4385                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4386                 self::error(_ERROR_DISALLOWED);
4387                 return;
4388         }
4389
4390         /**
4391          * Admin::action_PluginAdmin()
4392          * Output pluginadmin
4393          *
4394          * @param       string  $skinContents
4395          * @param       string  $extrahead
4396          * @return      void
4397          */
4398         static public function action_PluginAdmin($skinContents, $extrahead = '')
4399         {
4400                 self::$extrahead .= $extrahead;
4401                 self::$skin->parse('pluginadmin', $skinContents);
4402                 return;
4403         }
4404
4405         /**
4406          * Admin::action_bookmarklet()
4407          *
4408          * @param       void
4409          * @return      void
4410          */
4411         static private function action_bookmarklet()
4412         {
4413                 global $member, $manager;
4414
4415                 $blogid = intRequestVar('blogid');
4416                 $member->teamRights($blogid) or self::disallow();
4417
4418                 self::$skin->parse('bookmarklet');
4419                 return;
4420         }
4421
4422         /**
4423          * Admin::action_actionlog()
4424          *
4425          * @param       void
4426          * @return      void
4427          */
4428         static private function action_actionlog()
4429         {
4430                 global $member, $manager;
4431
4432                 $member->isAdmin() or self::disallow();
4433
4434                 self::$skin->parse('actionlog');
4435                 return;
4436         }
4437
4438         /**
4439          * Admin::action_banlist()
4440          *
4441          * @param       void
4442          * @return      void
4443          */
4444         static private function action_banlist()
4445         {
4446                 global $member, $manager;
4447
4448                 $blogid = intRequestVar('blogid');
4449                 $member->blogAdminRights($blogid) or self::disallow();
4450
4451                 self::$skin->parse('banlist');
4452                 return;
4453         }
4454
4455         /**
4456          * Admin::action_banlistdelete()
4457          *
4458          * @param       void
4459          * @return      void
4460          */
4461         static private function action_banlistdelete()
4462         {
4463                 global $member, $manager;
4464
4465                 $blogid = intRequestVar('blogid');
4466                 $member->blogAdminRights($blogid) or self::disallow();
4467
4468                 self::$skin->parse('banlistdelete');
4469                 return;
4470         }
4471
4472         /**
4473          * Admin::action_banlistdeleteconfirm()
4474          *
4475          * @param       void
4476          * @return      void
4477          */
4478         static private function action_banlistdeleteconfirm()
4479         {
4480                 global $member, $manager;
4481
4482                 $blogid         = intPostVar('blogid');
4483                 $allblogs       = postVar('allblogs');
4484                 $iprange        = postVar('iprange');
4485
4486                 $member->blogAdminRights($blogid) or self::disallow();
4487
4488                 $deleted = array();
4489
4490                 if ( !$allblogs )
4491                 {
4492                         if ( Ban::removeBan($blogid, $iprange) )
4493                         {
4494                                 $deleted[] = $blogid;
4495                         }
4496                 }
4497                 else
4498                 {
4499                         // get blogs fot which member has admin rights
4500                         $adminblogs = $member->getAdminBlogs();
4501                         foreach ($adminblogs as $blogje)
4502                         {
4503                                 if ( Ban::removeBan($blogje, $iprange) )
4504                                 {
4505                                         $deleted[] = $blogje;
4506                                 }
4507                         }
4508                 }
4509
4510                 if ( sizeof($deleted) == 0 )
4511                 {
4512                         self::error(_ERROR_DELETEBAN);
4513                         return;
4514                 }
4515
4516                 /* TODO: we should use other ways */
4517                 $_REQUEST['delblogs'] = $deleted;
4518
4519                 self::$skin->parse('banlistdeleteconfirm');
4520                 return;
4521         }
4522
4523         /**
4524          * Admin::action_banlistnewfromitem()
4525          *
4526          * @param       void
4527          * @return      void
4528          */
4529         static private function action_banlistnewfromitem()
4530         {
4531                 global $manager;
4532
4533                 $itemid = intRequestVar('itemid');
4534                 $item =& $manager->getItem($itemid, 1, 1);
4535                 self::action_banlistnew($item['blogid']);
4536                 return;
4537         }
4538
4539         /**
4540          * Admin::action_banlistnew()
4541          *
4542          * @param       integer $blogid ID for weblog
4543          * @return      void
4544          */
4545         static private function action_banlistnew($blogid = '')
4546         {
4547                 global $member, $manager;
4548
4549                 if ( $blogid == '' )
4550                 {
4551                         $blogid = intRequestVar('blogid');
4552                 }
4553
4554                 $ip = requestVar('ip');
4555
4556                 $member->blogAdminRights($blogid) or self::disallow();
4557
4558                 /* TODO: we should consider to use the other way instead of this */
4559                 $_REQUEST['blogid'] = $blogid;
4560
4561                 self::$skin->parse('banlistnew');
4562
4563                 return;
4564         }
4565
4566         /**
4567          * Admin::action_banlistadd()
4568          *
4569          * @param       void
4570          * @return      void
4571          */
4572         static private function action_banlistadd()
4573         {
4574                 global $member;
4575
4576                 $blogid         = intPostVar('blogid');
4577                 $allblogs       = postVar('allblogs');
4578                 $iprange        = postVar('iprange');
4579
4580                 if ( $iprange == "custom" )
4581                 {
4582                         $iprange = postVar('customiprange');
4583                 }
4584                 $reason   = postVar('reason');
4585
4586                 $member->blogAdminRights($blogid) or self::disallow();
4587
4588                 // TODO: check IP range validity
4589
4590                 if ( !$allblogs )
4591                 {
4592                         if ( !Ban::addBan($blogid, $iprange, $reason) )
4593                         {
4594                                 self::error(_ERROR_ADDBAN);
4595                                 return;
4596                         }
4597                 }
4598                 else
4599                 {
4600                         // get blogs fot which member has admin rights
4601                         $adminblogs = $member->getAdminBlogs();
4602                         $failed = 0;
4603                         foreach ($adminblogs as $blogje)
4604                         {
4605                                 if ( !Ban::addBan($blogje, $iprange, $reason) )
4606                                 {
4607                                         $failed = 1;
4608                                 }
4609                         }
4610                         if ( $failed )
4611                         {
4612                                 self::error(_ERROR_ADDBAN);
4613                                 return;
4614                         }
4615                 }
4616                 self::action_banlist();
4617                 return;
4618         }
4619
4620         /**
4621          * Admin::action_clearactionlog()
4622          *
4623          * @param       void
4624          * @return      void
4625          */
4626         static private function action_clearactionlog()
4627         {
4628                 global $member;
4629
4630                 $member->isAdmin() or self::disallow();
4631
4632                 ActionLog::clear();
4633
4634                 self::action_manage(_MSG_ACTIONLOGCLEARED);
4635                 return;
4636         }
4637
4638         /**
4639          * Admin::action_backupoverview()
4640          *
4641          * @param       void
4642          * @return      void
4643          */
4644         static private function action_backupoverview()
4645         {
4646                 global $member, $manager;
4647
4648                 $member->isAdmin() or self::disallow();
4649
4650                 self::$skin->parse('backupoverview');
4651                 return;
4652         }
4653
4654         /**
4655          * Admin::action_backupcreate()
4656          * create file for backup
4657          *
4658          * @param               void
4659          * @return      void
4660          *
4661          */
4662         static private function action_backupcreate()
4663         {
4664                 global $member, $DIR_LIBS;
4665
4666                 $member->isAdmin() or self::disallow();
4667
4668                 // use compression ?
4669                 $useGzip = (integer) postVar('gzip');
4670
4671                 include($DIR_LIBS . 'backup.php');
4672
4673                 // try to extend time limit
4674                 // (creating/restoring dumps might take a while)
4675                 @set_time_limit(1200);
4676
4677                 Backup::do_backup($useGzip);
4678                 return;
4679         }
4680
4681         /**
4682          * Admin::action_backuprestore()
4683          * restoring from uploaded file
4684          *
4685          * @param               void
4686          * @return      void
4687          */
4688         static private function action_backuprestore()
4689         {
4690                 global $member, $DIR_LIBS;
4691
4692                 $member->isAdmin() or self::disallow();
4693
4694                 if ( intPostVar('letsgo') != 1 )
4695                 {
4696                         self::error(_ERROR_BACKUP_NOTSURE);
4697                         return;
4698                 }
4699
4700                 include($DIR_LIBS . 'backup.php');
4701
4702                 // try to extend time limit
4703                 // (creating/restoring dumps might take a while)
4704                 @set_time_limit(1200);
4705
4706                 $message = Backup::do_restore();
4707                 if ( $message != '' )
4708                 {
4709                         self::error($message);
4710                         return;
4711                 }
4712                 self::$skin->parse('backuprestore');
4713                 return;
4714         }
4715
4716         /**
4717          * Admin::action_pluginlist()
4718          * output the list of installed plugins
4719          *
4720          * @param       void
4721          * @return      void
4722          *
4723          */
4724         static private function action_pluginlist()
4725         {
4726                 global $DIR_PLUGINS, $member, $manager;
4727
4728                 // check if allowed
4729                 $member->isAdmin() or self::disallow();
4730
4731                 self::$skin->parse('pluginlist');
4732                 return;
4733         }
4734
4735         /**
4736          * Admin::action_pluginhelp()
4737          *
4738          * @param       void
4739          * @return      void
4740          */
4741         static private function action_pluginhelp()
4742         {
4743                 global $member, $manager, $DIR_PLUGINS, $CONF;
4744
4745                 // check if allowed
4746                 $member->isAdmin() or self::disallow();
4747
4748                 $plugid = intGetVar('plugid');
4749
4750                 if ( !$manager->pidInstalled($plugid) )
4751                 {
4752                         self::error(_ERROR_NOSUCHPLUGIN);
4753                         return;
4754                 }
4755
4756                 self::$skin->parse('pluginhelp');
4757                 return;
4758         }
4759
4760         /**
4761          * Admin::action_pluginadd()
4762          *
4763          * @param       Void
4764          * @return      Void
4765          *
4766          */
4767         static private function action_pluginadd()
4768         {
4769                 global $member, $manager, $DIR_PLUGINS;
4770
4771                 // check if allowed
4772                 $member->isAdmin() or self::disallow();
4773
4774                 $name = postVar('filename');
4775
4776                 if ( $manager->pluginInstalled($name) )
4777                 {
4778                         self::error(_ERROR_DUPPLUGIN);
4779                         return;
4780                 }
4781
4782                 if ( !checkPlugin($name) )
4783                 {
4784                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
4785                         return;
4786                 }
4787
4788                 // get number of currently installed plugins
4789                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
4790                 $numCurrent = $res->rowCount();
4791
4792                 // plugin will be added as last one in the list
4793                 $newOrder = $numCurrent + 1;
4794
4795                 $data = array('file' => &$name);
4796                 $manager->notify('PreAddPlugin', $data);
4797
4798                 // do this before calling getPlugin (in case the plugin id is used there)
4799                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";
4800                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));
4801                 DB::execute($query);
4802                 $iPid = DB::getInsertId();
4803
4804                 $manager->clearCachedInfo('installedPlugins');
4805
4806                 // Load the plugin for condition checking and instalation
4807                 $plugin =& $manager->getPlugin($name);
4808
4809                 // check if it got loaded (could have failed)
4810                 if ( !$plugin )
4811                 {
4812                         $query = "DELETE FROM %s WHERE pid=%d;";
4813                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);
4814
4815                         DB::execute($query);
4816
4817                         $manager->clearCachedInfo('installedPlugins');
4818                         self::error(_ERROR_PLUGIN_LOAD);
4819                         return;
4820                 }
4821
4822                 // check if plugin needs a newer Nucleus version
4823                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
4824                 {
4825                         // uninstall plugin again...
4826                         self::deleteOnePlugin($plugin->getID());
4827
4828                         // ...and show error
4829                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
4830                         return;
4831                 }
4832
4833                 // check if plugin needs a newer Nucleus version
4834                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
4835                 {
4836                         // uninstall plugin again...
4837                         self::deleteOnePlugin($plugin->getID());
4838
4839                         // ...and show error
4840                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
4841                         return;
4842                 }
4843
4844                 $pluginList = $plugin->getPluginDep();
4845                 foreach ( $pluginList as $pluginName )
4846                 {
4847                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));
4848                         if ($res->rowCount() == 0)
4849                         {
4850                                 // uninstall plugin again...
4851                                 self::deleteOnePlugin($plugin->getID());
4852                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
4853                                 return;
4854                         }
4855                 }
4856
4857                 // call the install method of the plugin
4858                 $plugin->install();
4859
4860                 $data = array('plugin' => &$plugin);
4861                 $manager->notify('PostAddPlugin', $data);
4862
4863                 // update all events
4864                 self::action_pluginupdate();
4865                 return;
4866         }
4867
4868         /**
4869          * ADMIN:action_pluginupdate():
4870          *
4871          * @param       Void
4872          * @return      Void
4873          *
4874          */
4875         static private function action_pluginupdate()
4876         {
4877                 global $member, $manager, $CONF;
4878
4879                 // check if allowed
4880                 $member->isAdmin() or self::disallow();
4881
4882                 // delete everything from plugin_events
4883                 DB::execute('DELETE FROM '.sql_table('plugin_event'));
4884
4885                 // loop over all installed plugins
4886                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));
4887                 foreach ( $res as $row )
4888                 {
4889                         $pid  =  $row['pid'];
4890                         $plug =& $manager->getPlugin($row['pfile']);
4891                         if ( $plug )
4892                         {
4893                                 $eventList = $plug->getEventList();
4894                                 foreach ( $eventList as $eventName )
4895                                 {
4896                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";
4897                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));
4898                                         DB::execute($query);
4899                                 }
4900                         }
4901                 }
4902                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4903                 return;
4904         }
4905
4906         /**
4907          * Admin::action_plugindelete()
4908          *
4909          * @param       void
4910          * @return      void
4911          */
4912         static private function action_plugindelete()
4913         {
4914                 global $member, $manager;
4915
4916                 // check if allowed
4917                 $member->isAdmin() or self::disallow();
4918
4919                 $pid = intGetVar('plugid');
4920
4921                 if ( !$manager->pidInstalled($pid) )
4922                 {
4923                         self::error(_ERROR_NOSUCHPLUGIN);
4924                         return;
4925                 }
4926
4927                 self::$skin->parse('plugindelete');
4928                 return;
4929         }
4930
4931         /**
4932          * Admin::action_plugindeleteconfirm()
4933          *
4934          * @param       void
4935          * @return      void
4936          */
4937         static private function action_plugindeleteconfirm()
4938         {
4939                 global $member, $manager, $CONF;
4940
4941                 // check if allowed
4942                 $member->isAdmin() or self::disallow();
4943
4944                 $pid = intPostVar('plugid');
4945
4946                 $error = self::deleteOnePlugin($pid, 1);
4947                 if ( $error )
4948                 {
4949                         self::error($error);
4950                         return;
4951                 }
4952
4953                 redirect($CONF['AdminURL'] . '?action=pluginlist');
4954                 return;
4955         }
4956
4957         /**
4958          * Admin::deleteOnePlugin()
4959          *
4960          * @param       integer $pid
4961          * @param       boolean $callUninstall
4962          * @return      string  empty or message if failed
4963          */
4964         static public function deleteOnePlugin($pid, $callUninstall = 0)
4965         {
4966                 global $manager;
4967
4968                 $pid = intval($pid);
4969
4970                 if ( !$manager->pidInstalled($pid) )
4971                 {
4972                         return _ERROR_NOSUCHPLUGIN;
4973                 }
4974
4975                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";
4976                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);
4977                 $name = DB::getValue($query);
4978
4979                 // check dependency before delete
4980                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));
4981                 foreach ( $res as $row )
4982                 {
4983                         $plug =& $manager->getPlugin($row['pfile']);
4984                         if ( $plug )
4985                         {
4986                                 $depList = $plug->getPluginDep();
4987                                 foreach ( $depList as $depName )
4988                                 {
4989                                         if ( $name == $depName )
4990                                         {
4991                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);
4992                                         }
4993                                 }
4994                         }
4995                 }
4996
4997                 $data = array('plugid' => $pid);
4998                 $manager->notify('PreDeletePlugin', $data);
4999
5000                 // call the unInstall method of the plugin
5001                 if ( $callUninstall )
5002                 {
5003                         $plugin =& $manager->getPlugin($name);
5004                         if ( $plugin )
5005                         {
5006                                 $plugin->unInstall();
5007                         }
5008                 }
5009
5010                 // delete all subscriptions
5011                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);
5012
5013                 // delete all options
5014                 // get OIDs from plugin_option_desc
5015                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5016                 $aOIDs = array();
5017                 foreach ( $res as $row )
5018                 {
5019                         array_push($aOIDs, $row['oid']);
5020                 }
5021
5022                 // delete from plugin_option and plugin_option_desc
5023                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5024                 if (count($aOIDs) > 0)
5025                 {
5026                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');
5027                 }
5028
5029                 // update order numbers
5030                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5031                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);
5032
5033                 // delete row
5034                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);
5035
5036                 $manager->clearCachedInfo('installedPlugins');
5037                 $data = array('plugid' => $pid);
5038                 $manager->notify('PostDeletePlugin', $data);
5039
5040                 return '';
5041         }
5042
5043         /**
5044          * Admin::action_pluginup()
5045          *
5046          * @param       void
5047          * @return      void
5048          */
5049         static private function action_pluginup()
5050         {
5051                 global $member, $manager, $CONF;
5052
5053                 // check if allowed
5054                 $member->isAdmin() or self::disallow();
5055
5056                 $plugid = intGetVar('plugid');
5057
5058                 if ( !$manager->pidInstalled($plugid) )
5059                 {
5060                         self::error(_ERROR_NOSUCHPLUGIN);
5061                         return;
5062                 }
5063
5064                 // 1. get old order number
5065                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5066
5067                 // 2. calculate new order number
5068                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5069
5070                 // 3. update plug numbers
5071                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5072                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5073
5074                 //self::action_pluginlist();
5075                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5076                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5077                 return;
5078         }
5079
5080         /**
5081          * Admin::action_plugindown()
5082          *
5083          * @param       void
5084          * @return      void
5085          */
5086         static private function action_plugindown()
5087         {
5088                 global $member, $manager, $CONF;
5089
5090                 // check if allowed
5091                 $member->isAdmin() or self::disallow();
5092
5093                 $plugid = intGetVar('plugid');
5094                 if ( !$manager->pidInstalled($plugid) )
5095                 {
5096                         self::error(_ERROR_NOSUCHPLUGIN);
5097                         return;
5098                 }
5099
5100                 // 1. get old order number
5101                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);
5102
5103                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));
5104                 $maxOrder = $res->rowCount();
5105
5106                 // 2. calculate new order number
5107                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
5108
5109                 // 3. update plug numbers
5110                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);
5111                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);
5112
5113                 //self::action_pluginlist();
5114                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.
5115                 redirect($CONF['AdminURL'] . '?action=pluginlist');
5116                 return;
5117         }
5118
5119         /**
5120          * Admin::action_pluginoptions()
5121          *
5122          * Output Plugin option page
5123          *
5124          * @access      public
5125          * @param       string $message message when fallbacked
5126          * @return      void
5127          *
5128          */
5129         static private function action_pluginoptions($message = '')
5130         {
5131                 global $member, $manager;
5132
5133                 // check if allowed
5134                 $member->isAdmin() or self::disallow();
5135
5136                 $pid = intRequestVar('plugid');
5137                 if ( !$manager->pidInstalled($pid) )
5138                 {
5139                         self::error(_ERROR_NOSUCHPLUGIN);
5140                         return;
5141                 }
5142
5143                 if ( isset($message) )
5144                 {
5145                         self::$headMess = $message;
5146                 }
5147                 $plugname       = $manager->getPluginNameFromPid($pid);
5148                 $plugin         = $manager->getPlugin($plugname);
5149                 self::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";
5150
5151                 self::$skin->parse('pluginoptions');
5152                 return;
5153         }
5154
5155         /**
5156          * Admin::action_pluginoptionsupdate()
5157          *
5158          * Update plugin options and fallback to plugin option page
5159          *
5160          * @access      public
5161          * @param       void
5162          * @return      void
5163          */
5164         static private function action_pluginoptionsupdate()
5165         {
5166                 global $member, $manager;
5167
5168                 // check if allowed
5169                 $member->isAdmin() or self::disallow();
5170
5171                 $pid = intRequestVar('plugid');
5172
5173                 if ( !$manager->pidInstalled($pid) )
5174                 {
5175                         self::error(_ERROR_NOSUCHPLUGIN);
5176                         return;
5177                 }
5178
5179                 $aOptions = requestArray('plugoption');
5180                 NucleusPlugin::apply_plugin_options($aOptions);
5181
5182                 $data = array(
5183                         'context'       => 'global',
5184                         'plugid'        => $pid
5185                 );
5186                 $manager->notify('PostPluginOptionsUpdate', $data);
5187
5188                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
5189                 return;
5190         }
5191
5192         /**
5193          * Admin::skineditgeneral()
5194          *
5195          * @param       integer $skinid
5196          * @param       string  $handler
5197          * @return      string  empty or message if failed
5198          */
5199         static private function skineditgeneral($skinid, $handler='')
5200         {
5201                 global $manager;
5202
5203                 $name = postVar('name');
5204                 $desc = postVar('desc');
5205                 $type = postVar('type');
5206                 $inc_mode = postVar('inc_mode');
5207                 $inc_prefix = postVar('inc_prefix');
5208
5209                 $skin =& $manager->getSkin($skinid, $handler);
5210
5211                 // 1. Some checks
5212                 if ( !isValidSkinName($name) )
5213                 {
5214                         return _ERROR_BADSKINNAME;
5215                 }
5216
5217                 if ( ($skin->getName() != $name) && SKIN::exists($name) )
5218                 {
5219                         return _ERROR_DUPSKINNAME;
5220                 }
5221
5222                 if ( !$type )
5223                 {
5224                         $type = 'text/html';
5225                 }
5226
5227                 if ( !$inc_mode )
5228                 {
5229                         $inc_mode = 'normal';
5230                 }
5231
5232                 // 2. Update description
5233                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
5234
5235                 return '';
5236         }
5237         /**
5238          * Admin::skindeleteconfirm()
5239          *
5240          * @param       integer $skinid
5241          * @return      void
5242          */
5243         static private function skindeleteconfirm($skinid)
5244         {
5245                 global $manager;
5246
5247                 if ( !in_array(self::$action, self::$adminskin_actions) )
5248                 {
5249                         $event_identifier = 'Skin';
5250                 }
5251                 else
5252                 {
5253                         $event_identifier = 'AdminSkin';
5254                 }
5255
5256                 $data = array('skinid' => $skinid);
5257                 $manager->notify("PreDelete{$event_identifier}", $data);
5258
5259                 // 1. delete description
5260                 $query = "DELETE FROM %s WHERE sdnumber=%d;";
5261                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);
5262                 DB::execute($query);
5263
5264                 // 2. delete parts
5265                 $query = "DELETE FROM %s WHERE sdesc=%d;";
5266                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5267                 DB::execute($query);
5268
5269                 $manager->notify("PostDelete{$event_identifier}", $data);
5270
5271                 return;
5272         }
5273
5274         /**
5275          * Admin::skinremovetypeconfirm()
5276          *
5277          * @param       integer $skinid
5278          * @param       string  $skintype
5279          * @return      string  empty or message if failed
5280          */
5281         static private function skinremovetypeconfirm($skinid, $skintype)
5282         {
5283                 global $manager;
5284
5285                 if ( !in_array(self::$action, self::$adminskin_actions) )
5286                 {
5287                         $event_identifier = 'Skin';
5288                 }
5289                 else
5290                 {
5291                         $event_identifier = 'AdminSkin';
5292                 }
5293
5294                 if ( !isValidShortName($skintype) )
5295                 {
5296                         return _ERROR_SKIN_PARTS_SPECIAL_DELETE;
5297                 }
5298
5299                 $data = array(
5300                         'skinid'        => $skinid,
5301                         'skintype'      => $skintype
5302                 );
5303                 $manager->notify("PreDelete{$event_identifier}Part", $data);
5304
5305                 // delete part
5306                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s;';
5307                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );
5308                 DB::execute($query);
5309
5310                 $data = array(
5311                         'skinid'        => $skinid,
5312                         'skintype'      => $skintype
5313                 );
5314                 $manager->notify("PostDelete{$event_identifier}Part", $data);
5315
5316                 return '';
5317         }
5318
5319         /**
5320          * Admin::skinclone()
5321          *
5322          * @param       integer $skinid
5323          * @param       string  $handler
5324          * @return      void
5325          */
5326         static private function skinclone($skinid, $handler='')
5327         {
5328                 global $manager;
5329
5330                 // 1. read skin to clone
5331                 $skin =& $manager->getSkin($skinid, $handler);
5332                 $name = "{$skin->getName()}_clone";
5333
5334                 // if a skin with that name already exists:
5335                 if ( Skin::exists($name) )
5336                 {
5337                         $i = 1;
5338                         while ( Skin::exists($name . $i) )
5339                         {
5340                                 $i++;
5341                         }
5342                         $name .= $i;
5343                 }
5344
5345                 // 2. create skin desc
5346                 $newid = Skin::createNew(
5347                         $name,
5348                         $skin->getDescription(),
5349                         $skin->getContentType(),
5350                         $skin->getIncludeMode(),
5351                         $skin->getIncludePrefix()
5352                 );
5353
5354                 // 3. clone
5355                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";
5356                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);
5357
5358                 $res = DB::getResult($query);
5359                 foreach ( $res as $row )
5360                 {
5361                         $content = $skin->getContentFromDB($row['stype']);
5362                         if ( $content )
5363                         {
5364                                 $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";
5365                                 $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($row['stype']));
5366                                 DB::execute($query);
5367                         }
5368                 }
5369                 return;
5370         }
5371
5372         /**
5373          * Admin::skinieimport()
5374          *
5375          * @param       string  $mode
5376          * @param       string  $skinFileRaw
5377          * @return      string  empty or message if failed
5378          */
5379         static private function skinieimport($mode, $skinFileRaw)
5380         {
5381                 global $DIR_LIBS, $DIR_SKINS;
5382
5383                 // load skinie class
5384                 include_once($DIR_LIBS . 'skinie.php');
5385
5386                 $importer = new SkinImport();
5387
5388                 // get full filename
5389                 if ( $mode == 'file' )
5390                 {
5391                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5392                 }
5393                 else
5394                 {
5395                         $skinFile = $skinFileRaw;
5396                 }
5397
5398                 // read only metadata
5399                 $error = $importer->readFile($skinFile, 1);
5400                 if ( $error )
5401                 {
5402                         unset($importer);
5403                         return $error;
5404                 }
5405
5406                 self::$contents['mode']         = $mode;
5407                 self::$contents['skinfile']     = $skinFileRaw;
5408                 self::$contents['skininfo']     = $importer->getInfo();
5409                 self::$contents['skinnames']    = $importer->getSkinNames();
5410                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5411
5412                 // clashes
5413                 $skinNameClashes                = $importer->checkSkinNameClashes();
5414                 $templateNameClashes    = $importer->checkTemplateNameClashes();
5415                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
5416
5417                 self::$contents['skinclashes'] = $skinNameClashes;
5418                 self::$contents['tpltclashes'] = $templateNameClashes;
5419                 self::$contents['nameclashes'] = $hasNameClashes ? 1 : 0;
5420
5421                 unset($importer);
5422                 return '';
5423         }
5424
5425         /**
5426          * Admin::skinieedoimport()
5427          *
5428          * @param       string  $mode
5429          * @param       string  $skinFileRaw
5430          * @param       boolean $allowOverwrite
5431          * @return      string  empty   or message if failed
5432          */
5433         static private function skiniedoimport($mode, $skinFileRaw, $allowOverwrite)
5434         {
5435                 global $DIR_LIBS, $DIR_SKINS;
5436
5437                 // load skinie class
5438                 include_once($DIR_LIBS . 'skinie.php');
5439
5440                 $importer = new SkinImport();
5441
5442                 // get full filename
5443                 if ( $mode == 'file' )
5444                 {
5445                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
5446                 }
5447                 else
5448                 {
5449                         $skinFile = $skinFileRaw;
5450                 }
5451
5452                 $error = $importer->readFile($skinFile);
5453                 if ( $error )
5454                 {
5455                         unset($importer);
5456                         return $error;
5457                 }
5458
5459                 $error = $importer->writeToDatabase($allowOverwrite);
5460                 if ( $error )
5461                 {
5462                         unset($importer);
5463                         return $error;
5464                 }
5465
5466                 self::$contents['mode']         = $mode;
5467                 self::$contents['skinfile']     = $skinFileRaw;
5468                 self::$contents['skininfo']     = $importer->getInfo();
5469                 self::$contents['skinnames']    = $importer->getSkinNames();
5470                 self::$contents['tpltnames']    = $importer->getTemplateNames();
5471
5472                 unset($importer);
5473                 return '';
5474         }
5475
5476         /**
5477          * Admin::skinieexport()
5478          *
5479          * @param       array   $aSkins
5480          * @param       array   $aTemplates
5481          * @param       string  $info
5482          * @return      void
5483          */
5484         static private function skinieexport($aSkins, $aTemplates, $info)
5485         {
5486                 global $DIR_LIBS;
5487
5488                 // load skinie class
5489                 include_once($DIR_LIBS . 'skinie.php');
5490
5491                 if ( !is_array($aSkins) )
5492                 {
5493                         $aSkins = array();
5494                 }
5495
5496                 if (!is_array($aTemplates))
5497                 {
5498                         $aTemplates = array();
5499                 }
5500
5501                 $skinList = array_keys($aSkins);
5502                 $templateList = array_keys($aTemplates);
5503
5504                 $exporter = new SkinExport();
5505                 foreach ( $skinList as $skinId )
5506                 {
5507                         $exporter->addSkin($skinId);
5508                 }
5509                 foreach ( $templateList as $templateId )
5510                 {
5511                         $exporter->addTemplate($templateId);
5512                 }
5513                 $exporter->setInfo($info);
5514                 $exporter->export();
5515
5516                 return;
5517         }
5518
5519         /**
5520          * Admin::action_parseSpecialskin()
5521          *
5522          * @param       void
5523          * @return      void
5524          */
5525         static private function action_parseSpecialskin()
5526         {
5527                 self::$skin->parse(self::$action);
5528                 return;
5529         }
5530 }