nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class Admin
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . Entity::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', Entity::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.Entity::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. Entity::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NavList('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',Entity::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . Entity::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836         /**
 837          * Admin::selectBlog()
 838          * Inserts a HTML select element with choices for all blogs to which the user has access
 839          *  mode = 'blog' => shows blognames and values are blogids
 840          *  mode = 'category' => show category names and values are catids
 841          *
 842          * @param       string  $name                           name of
 843          * @param       string  $mode                           blog/category
 844          * @param       integer $selected                       category ID to be selected
 845          * @param       integer $tabindex                       tab index value
 846          * @param       integer $showNewCat                     show category to newly be created
 847          * @param       integer $iForcedBlogInclude     ID of a blog that always needs to be included,
 848          *                                              without checking if the member is on the blog team (-1 = none)
 849          * @return      void
 850          */
 851         public function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)
 852         {
 853                 global $member, $CONF;
 854
 855                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 856                 $aBlogIds = array();
 857                 if ( $iForcedBlogInclude != -1 )
 858                 {
 859                         $aBlogIds[] = intval($iForcedBlogInclude);
 860                 }
 861
 862                 if ( !$member->isAdmin() || !array_key_exists('ShowAllBlogs', $CONF) || !$CONF['ShowAllBlogs'] )
 863                 {
 864                         $query = "SELECT bnumber FROM %s,%s WHERE tblog=bnumber and tmember=%d;";
 865                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());
 866                 }
 867                 else
 868                 {
 869                         $query = "SELECT bnumber FROM %s ORDER BY bname;";
 870                         $query = sprintf($query, sql_table('blog'));
 871                 }
 872
 873                 $rblogids = sql_query($query);
 874                 while ( $o = sql_fetch_object($rblogids) )
 875                 {
 876                         if ( $o->bnumber != $iForcedBlogInclude )
 877                         {
 878                                 $aBlogIds[] = (integer) $o->bnumber;
 879                         }
 880                 }
 881                 if ( count($aBlogIds) == 0 )
 882                 {
 883                         return;
 884                 }
 885
 886                 echo "<select name=\"{$name}\" tabindex=\"{$tabindex}\">\n";
 887
 888                 // 1. select blogs (we'll create optiongroups)
 889                 // (only select those blogs that have the user on the team)
 890                 $query = "SELECT bnumber, bname FROM %s WHERE bnumber in ('%s') ORDER BY bname;";
 891                 $query = sprintf($query, sql_table('blog'), implode(',',$aBlogIds));
 892                 $blogs = sql_query($query);
 893
 894                 if ( $mode == 'category' )
 895                 {
 896                         if ( sql_num_rows($blogs) > 1 )
 897                         {
 898                                 $multipleBlogs = 1;
 899                         }
 900
 901                         while ( $oBlog = sql_fetch_object($blogs) )
 902                         {
 903                                 if ( $multipleBlogs )
 904                                 {
 905                                         echo '<optgroup label="' . Entity::hsc($oBlog->bname) . '">' . "\n";
 906                                 }
 907
 908                                 // show selection to create new category when allowed/wanted
 909                                 if ( $showNewCat )
 910                                 {
 911                                         // check if allowed to do so
 912                                         if ( $member->blogAdminRights($oBlog->bnumber) )
 913                                         {
 914                                                 echo "<option value=\"newcat-{$oBlog->bnumber}\">" . _ADD_NEWCAT . "</option>\n";
 915                                         }
 916                                 }
 917
 918                                 // 2. for each category in that blog
 919                                 $query = "SELECT cname, catid FROM %s WHERE cblog=%d ORDER BY cname ASC;";
 920                                 $query = sprintf($query, sql_table('category'), (integer) $oBlog->bnumber);
 921                                 $categories = sql_query($query);
 922                                 while ( $oCat = sql_fetch_object($categories) )
 923                                 {
 924                                         if ( $oCat->catid != $selected )
 925                                         {
 926                                         echo "<option value=\"{$oCat->catid}\" {$selectText} >" . Entity::hsc($oCat->cname) . "</option>\n";
 927                                         }
 928                                         else
 929                                         {
 930                                         echo "<option value=\"{$oCat->catid}\" selected=\"selected\" >" . Entity::hsc($oCat->cname) . "</option>\n";
 931                                         }
 932                                 }
 933
 934                                 if ( $multipleBlogs )
 935                                 {
 936                                         echo "</optgroup>\n";
 937                                 }
 938                         }
 939                 }
 940                 else
 941                 {
 942                         // blog mode
 943                         while ( $oBlog = sql_fetch_object($blogs) )
 944                         {
 945                                 if ( $oBlog->bnumber != $selected )
 946                                 {
 947                                         echo "<option value=\"{$oBlog->bnumber}\">" . Entity::hsc($oBlog->bname) . "</option>\n";
 948                                 }
 949                                 else
 950                                 {
 951                                         echo "<option value=\"{$oBlog->bnumber}\" selected=\"selected\">" . Entity::hsc($oBlog->bname) . "</option>\n";
 952                                 }
 953                         }
 954                 }
 955                 echo "</select>\n";
 956                 return;
 957         }
 958
 959     /**
 960      * @todo document this
 961      */
 962     function action_browseownitems() {
 963         global $member, $manager, $CONF;
 964
 965         $this->pagehead();
 966
 967         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 968         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 969
 970         // start index
 971         if (postVar('start'))
 972             $start = intPostVar('start');
 973         else
 974             $start = 0;
 975
 976         // amount of items to show
 977         if (postVar('amount'))
 978             $amount = intPostVar('amount');
 979         else {
 980             $amount = intval($CONF['DefaultListSize']);
 981             if ($amount < 1)
 982                 $amount = 10;
 983         }
 984
 985         $search = postVar('search');    // search through items
 986
 987         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 988                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 989                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 990
 991         if ($search)
 992             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 993
 994         $query .= ' ORDER BY itime DESC'
 995                 . " LIMIT $start,$amount";
 996
 997         $template['content'] = 'itemlist';
 998         $template['now'] = time();
 999
1000         $manager->loadClass("ENCAPSULATE");
1001         $navList = new NavList('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
1002         $navList->showBatchList('item',$query,'table',$template);
1003
1004         $this->pagefoot();
1005
1006     }
1007
1008     /**
1009      * Show all the comments for a given item
1010      * @param int $itemid
1011      */
1012     function action_itemcommentlist($itemid = '') {
1013         global $member, $manager, $CONF;
1014
1015         if ($itemid == '')
1016             $itemid = intRequestVar('itemid');
1017
1018         // only allow if user is allowed to alter item
1019         $member->canAlterItem($itemid) or $this->disallow();
1020
1021         $blogid = getBlogIdFromItemId($itemid);
1022
1023         $this->pagehead();
1024
1025         // start index
1026         if (postVar('start'))
1027             $start = intPostVar('start');
1028         else
1029             $start = 0;
1030
1031         // amount of items to show
1032         if (postVar('amount'))
1033             $amount = intPostVar('amount');
1034         else {
1035             $amount = intval($CONF['DefaultListSize']);
1036             if ($amount < 1)
1037                 $amount = 10;
1038         }
1039
1040         $search = postVar('search');
1041
1042         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
1043         echo '<h2>',_COMMENTS,'</h2>';
1044
1045         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1046
1047         if ($search)
1048             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1049
1050         $query .= ' ORDER BY ctime ASC'
1051                 . " LIMIT $start,$amount";
1052
1053         $template['content'] = 'commentlist';
1054         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1055
1056         $manager->loadClass("ENCAPSULATE");
1057         $navList = new NavList('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1058         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1059
1060         $this->pagefoot();
1061     }
1062
1063     /**
1064      * Browse own comments
1065      */
1066     function action_browseowncomments() {
1067         global $member, $manager, $CONF;
1068
1069         // start index
1070         if (postVar('start'))
1071             $start = intPostVar('start');
1072         else
1073             $start = 0;
1074
1075         // amount of items to show
1076         if (postVar('amount'))
1077             $amount = intPostVar('amount');
1078         else {
1079             $amount = intval($CONF['DefaultListSize']);
1080             if ($amount < 1)
1081                 $amount = 10;
1082         }
1083
1084         $search = postVar('search');
1085
1086
1087         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1088
1089         if ($search)
1090             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1091
1092         $query .= ' ORDER BY ctime DESC'
1093                 . " LIMIT $start,$amount";
1094
1095         $this->pagehead();
1096
1097         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1098         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1099
1100         $template['content'] = 'commentlist';
1101         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1102
1103         $manager->loadClass("ENCAPSULATE");
1104         $navList = new NavList('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1105         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1106
1107         $this->pagefoot();
1108     }
1109
1110     /**
1111      * Browse all comments for a weblog
1112      * @param int $blogid
1113      */
1114     function action_blogcommentlist($blogid = '')
1115     {
1116         global $member, $manager, $CONF;
1117
1118         if ($blogid == '')
1119             $blogid = intRequestVar('blogid');
1120         else
1121             $blogid = intval($blogid);
1122
1123         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1124
1125         // start index
1126         if (postVar('start'))
1127             $start = intPostVar('start');
1128         else
1129             $start = 0;
1130
1131         // amount of items to show
1132         if (postVar('amount'))
1133             $amount = intPostVar('amount');
1134         else {
1135             $amount = intval($CONF['DefaultListSize']);
1136             if ($amount < 1)
1137                 $amount = 10;
1138         }
1139
1140         $search = postVar('search');        // search through comments
1141
1142
1143         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1144
1145         if ($search != '')
1146             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1147
1148
1149         $query .= ' ORDER BY ctime DESC'
1150                 . " LIMIT $start,$amount";
1151
1152
1153         $blog =& $manager->getBlog($blogid);
1154
1155         $this->pagehead();
1156
1157         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1158         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1159
1160         $template['content'] = 'commentlist';
1161         $template['canAddBan'] = $member->blogAdminRights($blogid);
1162
1163         $manager->loadClass("ENCAPSULATE");
1164         $navList = new NavList('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1165         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1166
1167         $this->pagefoot();
1168     }
1169
1170         /**
1171          * Admin::action_createitem()
1172          * Provide a page to item a new item to the given blog
1173          *
1174          * @param       void
1175          * @return      void
1176          */
1177         public function action_createitem()
1178         {
1179                 global $member, $manager;
1180
1181                 $blogid = intRequestVar('blogid');
1182
1183                 // check if allowed
1184                 $member->teamRights($blogid) or $this->disallow();
1185
1186                 $memberid = $member->getID();
1187
1188                 $blog =& $manager->getBlog($blogid);
1189
1190                 $this->pagehead();
1191
1192                 // generate the add-item form
1193                 $formfactory = new PageFactory($blogid);
1194                 $formfactory->createAddForm('admin');
1195
1196                 $this->pagefoot();
1197                 return;
1198         }
1199
1200         /**
1201          * Admin::action_itemedit()
1202          *
1203          * @param       void
1204          * @return      void
1205          */
1206         public function action_itemedit()
1207         {
1208                 global $member, $manager;
1209
1210                 $itemid = intRequestVar('itemid');
1211
1212                 // only allow if user is allowed to alter item
1213                 $member->canAlterItem($itemid) or $this->disallow();
1214
1215                 $item =& $manager->getItem($itemid, 1, 1);
1216                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1217
1218                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1219
1220                 if ( $blog->convertBreaks() )
1221                 {
1222                         $item['body'] = removeBreaks($item['body']);
1223                         $item['more'] = removeBreaks($item['more']);
1224                 }
1225
1226                 // form to edit blog items
1227                 $this->pagehead();
1228                 $formfactory = new PageFactory($blog->getID());
1229                 $formfactory->createEditForm('admin', $item);
1230                 $this->pagefoot();
1231                 return;
1232         }
1233
1234     /**
1235      * @todo document this
1236      */
1237     function action_itemupdate() {
1238         global $member, $manager, $CONF;
1239
1240         $itemid = intRequestVar('itemid');
1241         $catid = postVar('catid');
1242
1243         // only allow if user is allowed to alter item
1244         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1245
1246         $actiontype = postVar('actiontype');
1247
1248         // delete actions are handled by itemdelete (which has confirmation)
1249         if ($actiontype == 'delete') {
1250             $this->action_itemdelete();
1251             return;
1252         }
1253
1254         $body   = postVar('body');
1255         $title  = postVar('title');
1256         $more   = postVar('more');
1257         $closed = intPostVar('closed');
1258         $draftid = intPostVar('draftid');
1259
1260         // default action = add now
1261         if (!$actiontype)
1262             $actiontype='addnow';
1263
1264         // create new category if needed
1265         if (strstr($catid,'newcat')) {
1266             // get blogid
1267             list($blogid) = sscanf($catid,"newcat-%d");
1268
1269             // create
1270             $blog =& $manager->getBlog($blogid);
1271             $catid = $blog->createNewCategory();
1272
1273             // show error when sth goes wrong
1274             if (!$catid)
1275                 $this->doError(_ERROR_CATCREATEFAIL);
1276         }
1277
1278         /*
1279             set some variables based on actiontype
1280
1281             actiontypes:
1282                 draft items -> addnow, addfuture, adddraft, delete
1283                 non-draft items -> edit, changedate, delete
1284
1285             variables set:
1286                 $timestamp: set to a nonzero value for future dates or date changes
1287                 $wasdraft: set to 1 when the item used to be a draft item
1288                 $publish: set to 1 when the edited item is not a draft
1289         */
1290         $blogid =  getBlogIDFromItemID($itemid);
1291         $blog   =& $manager->getBlog($blogid);
1292
1293         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1294         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1295         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1296         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1297             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1298         } else {
1299             $timestamp =0;
1300         }
1301
1302         // edit the item for real
1303         Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1304
1305         $this->updateFuturePosted($blogid);
1306
1307         if ($draftid > 0) {
1308             // delete permission is checked inside Item::delete()
1309             Item::delete($draftid);
1310         }
1311
1312         // show category edit window when we created a new category
1313         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1314         if ($catid != intPostVar('catid')) {
1315             $this->action_categoryedit(
1316                 $catid,
1317                 $blog->getID(),
1318                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1319             );
1320         } else {
1321             // TODO: set start item correctly for itemlist
1322             $this->action_itemlist(getBlogIDFromItemID($itemid));
1323         }
1324     }
1325
1326         /**
1327          * Admin::action_itemdelete()
1328          * Delete item
1329          *
1330          * @param       Void
1331          * @return      Void
1332          */
1333         function action_itemdelete()
1334         {
1335                 global $member, $manager;
1336
1337                 $itemid = intRequestVar('itemid');
1338
1339                 // only allow if user is allowed to alter item
1340                 $member->canAlterItem($itemid) or $this->disallow();
1341
1342                 if ( !$manager->existsItem($itemid,1,1) )
1343                 {
1344                         $this->error(_ERROR_NOSUCHITEM);
1345                 }
1346
1347                 $item =& $manager->getItem($itemid,1,1);
1348                 $title = Entity::hsc(strip_tags($item['title']));
1349                 $body = strip_tags($item['body']);
1350                 $body = Entity::hsc(Entity::shorten($body,300,'...'));
1351
1352                 $this->pagehead();
1353                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1354                 echo '<p>' . _CONFIRMTXT_ITEM . "</p>\n";
1355                 echo "<div class=\"note\">\n";
1356                 echo "<b>{$title}</b>\n";
1357                 echo "<br />\n";
1358                 echo "{$body}\n";
1359                 echo "</div>\n";
1360                 echo "<form method=\"post\" action=\"index.php\">\n";
1361                 echo "<div>\n";
1362                 echo "<input type=\"hidden\" name=\"action\" value=\"itemdeleteconfirm\" />\n";
1363                 echo $manager->addTicketHidden() . "\n";
1364                 echo "<input type=\"hidden\" name=\"itemid\" value=\"{$itemid}\" />\n";
1365                 echo '<input type="submit" value="' . _DELETE_CONFIRM_BTN . "\"  tabindex=\"10\" />\n";
1366                 echo "</div>\n";
1367                 echo "</form>\n";
1368                 $this->pagefoot();
1369                 return;
1370         }
1371
1372     /**
1373      * @todo document this
1374      */
1375     function action_itemdeleteconfirm() {
1376         global $member;
1377
1378         $itemid = intRequestVar('itemid');
1379
1380         // only allow if user is allowed to alter item
1381         $member->canAlterItem($itemid) or $this->disallow();
1382
1383         // get blogid first
1384         $blogid = getBlogIdFromItemId($itemid);
1385
1386         // delete item (note: some checks will be performed twice)
1387         $this->deleteOneItem($itemid);
1388
1389         $this->action_itemlist($blogid);
1390     }
1391
1392     /**
1393      * Deletes one item and returns error if something goes wrong
1394      * @param int $itemid
1395      */
1396     function deleteOneItem($itemid) {
1397         global $member, $manager;
1398
1399         // only allow if user is allowed to alter item (also checks if itemid exists)
1400         if (!$member->canAlterItem($itemid))
1401             return _ERROR_DISALLOWED;
1402
1403         // need to get blogid before the item is deleted
1404         $blogid = getBlogIDFromItemId($itemid);
1405
1406         $manager->loadClass('ITEM');
1407         Item::delete($itemid);
1408
1409         // update blog's futureposted
1410         $this->updateFuturePosted($blogid);
1411     }
1412
1413         /**
1414          * Admin::updateFuturePosted()
1415          * Update a blog's future posted flag
1416          *
1417          * @param integer $blogid
1418          * @return      void
1419          *
1420          */
1421         function updateFuturePosted($blogid)
1422         {
1423                 global $manager;
1424
1425                 $blog =& $manager->getBlog($blogid);
1426                 $currenttime = $blog->getCorrectTime(time());
1427
1428                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";
1429                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));
1430                 $result = sql_query($query);
1431
1432                 if ( sql_num_rows($result) > 0 )
1433                 {
1434                                 $blog->setFuturePost();
1435                 }
1436                 else
1437                 {
1438                                 $blog->clearFuturePost();
1439                 }
1440                 return;
1441         }
1442
1443     /**
1444      * @todo document this
1445      */
1446     function action_itemmove() {
1447         global $member, $manager;
1448
1449         $itemid = intRequestVar('itemid');
1450
1451         // only allow if user is allowed to alter item
1452         $member->canAlterItem($itemid) or $this->disallow();
1453
1454         $item =& $manager->getItem($itemid,1,1);
1455
1456         $this->pagehead();
1457         ?>
1458             <h2><?php echo _MOVE_TITLE?></h2>
1459             <form method="post" action="index.php"><div>
1460                 <input type="hidden" name="action" value="itemmoveto" />
1461                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1462
1463                 <?php
1464
1465                     $manager->addTicketHidden();
1466                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1467                 ?>
1468
1469                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1470             </div></form>
1471         <?php
1472         $this->pagefoot();
1473     }
1474
1475     /**
1476      * @todo document this
1477      */
1478     function action_itemmoveto() {
1479         global $member, $manager;
1480
1481         $itemid = intRequestVar('itemid');
1482         $catid = requestVar('catid');
1483
1484         // create new category if needed
1485         if (strstr($catid,'newcat')) {
1486             // get blogid
1487             list($blogid) = sscanf($catid,'newcat-%d');
1488
1489             // create
1490             $blog =& $manager->getBlog($blogid);
1491             $catid = $blog->createNewCategory();
1492
1493             // show error when sth goes wrong
1494             if (!$catid)
1495                 $this->doError(_ERROR_CATCREATEFAIL);
1496         }
1497
1498         // only allow if user is allowed to alter item
1499         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1500
1501         $old_blogid = getBlogIDFromItemId($itemid);
1502
1503         Item::move($itemid, $catid);
1504
1505         // set the futurePosted flag on the blog
1506         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1507
1508         // reset the futurePosted in case the item is moved from one blog to another
1509         $this->updateFuturePosted($old_blogid);
1510
1511         if ($catid != intRequestVar('catid'))
1512             $this->action_categoryedit($catid, $blog->getID());
1513         else
1514             $this->action_itemlist(getBlogIDFromCatID($catid));
1515     }
1516
1517     /**
1518      * Moves one item to a given category (category existance should be checked by caller)
1519      * errors are returned
1520      * @param int $itemid
1521      * @param int $destCatid category ID to which the item will be moved
1522      */
1523     function moveOneItem($itemid, $destCatid) {
1524         global $member;
1525
1526         // only allow if user is allowed to move item
1527         if (!$member->canUpdateItem($itemid, $destCatid))
1528             return _ERROR_DISALLOWED;
1529
1530         Item::move($itemid, $destCatid);
1531     }
1532
1533     /**
1534      * Adds a item to the chosen blog
1535      */
1536     function action_additem() {
1537         global $manager, $CONF;
1538
1539         $manager->loadClass('ITEM');
1540
1541         $result = Item::createFromRequest();
1542
1543         if ($result['status'] == 'error')
1544             $this->error($result['message']);
1545
1546         $blogid = getBlogIDFromItemID($result['itemid']);
1547         $blog =& $manager->getBlog($blogid);
1548         $btimestamp = $blog->getCorrectTime();
1549         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1550
1551         if ($result['status'] == 'newcategory') {
1552             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1553             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1554         } else {
1555             $methodName = 'action_itemList';
1556             call_user_func(array(&$this, $methodName), $blogid);
1557         }
1558     }
1559
1560         /**
1561          * Allows to edit previously made comments
1562          **/
1563         function action_commentedit() {
1564
1565                 global $member, $manager;
1566
1567                 $commentid = intRequestVar('commentid');
1568
1569                 $member->canAlterComment($commentid) or $this->disallow();
1570
1571                 $comment = Comment::getComment($commentid);
1572
1573                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1574
1575                 // change <br /> to \n
1576                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1577
1578                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1579                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1580
1581         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1582
1583         $this->pagehead();
1584
1585         ?>
1586         <h2><?php echo _EDITC_TITLE?></h2>
1587
1588         <form action="index.php" method="post"><div>
1589
1590         <input type="hidden" name="action" value="commentupdate" />
1591         <?php $manager->addTicketHidden(); ?>
1592         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1593         <table><tr>
1594             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1595         </tr><tr>
1596             <td><?php echo _EDITC_WHO?></td>
1597             <td>
1598             <?php               if ($comment['member'])
1599                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1600                 else
1601                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1602             ?>
1603             </td>
1604         </tr><tr>
1605             <td><?php echo _EDITC_WHEN?></td>
1606             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1607         </tr><tr>
1608             <td><?php echo _EDITC_HOST?></td>
1609             <td><?php echo  $comment['host']; ?></td>
1610         </tr>
1611         <tr>
1612             <td><?php echo _EDITC_URL; ?></td>
1613             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1614         </tr>
1615         <tr>
1616             <td><?php echo _EDITC_EMAIL; ?></td>
1617             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1618         </tr>
1619         <tr>
1620             <td><?php echo _EDITC_TEXT?></td>
1621             <td>
1622                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1623                     echo $comment['body'];
1624                 ?></textarea>
1625             </td>
1626         </tr><tr>
1627             <td><?php echo _EDITC_EDIT?></td>
1628             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1629         </tr></table>
1630
1631         </div></form>
1632         <?php
1633         $this->pagefoot();
1634     }
1635
1636     /**
1637      * @todo document this
1638      */
1639     function action_commentupdate() {
1640         global $member, $manager;
1641
1642         $commentid = intRequestVar('commentid');
1643
1644         $member->canAlterComment($commentid) or $this->disallow();
1645
1646         $url = postVar('url');
1647         $email = postVar('email');
1648         $body = postVar('body');
1649
1650                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1651                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1652                 # important note that '\' must be matched with '\\\\' in preg* expressions
1653
1654                 // intercept words that are too long
1655                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1656                 {
1657                         $this->error(_ERROR_COMMENT_LONGWORD);
1658                 }
1659
1660                 // check length
1661                 if (i18n::strlen($body) < 3)
1662                 {
1663                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1664                 }
1665
1666                 if (i18n::strlen($body) > 5000)
1667                 {
1668                         $this->error(_ERROR_COMMENT_TOOLONG);
1669                 }
1670
1671         // prepare body
1672         $body = Comment::prepareBody($body);
1673
1674         // call plugins
1675         $manager->notify('PreUpdateComment',array('body' => &$body));
1676
1677         $query = 'UPDATE ' . sql_table('comment')
1678                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1679                . " WHERE cnumber = " . $commentid;
1680         sql_query($query);
1681
1682         // get itemid
1683         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1684         $o = sql_fetch_object($res);
1685         $itemid = $o->citem;
1686
1687         if ($member->canAlterItem($itemid))
1688             $this->action_itemcommentlist($itemid);
1689         else
1690             $this->action_browseowncomments();
1691
1692     }
1693
1694         /**
1695          * Admin::action_commentdelete()
1696          * Update comment
1697          *
1698          * @param       Void
1699          * @return      Void
1700          */
1701         function action_commentdelete()
1702         {
1703                 global $member, $manager;
1704
1705                 $commentid = intRequestVar('commentid');
1706                 $member->canAlterComment($commentid) or $this->disallow();
1707                 $comment = Comment::getComment($commentid);
1708
1709                 $body = strip_tags($comment['body']);
1710                 $body = Entity::hsc(Entity::shorten($body, 300, '...'));
1711
1712                 if ( $comment['member'] )
1713                 {
1714                         $author = $comment['member'];
1715                 }
1716                 else
1717                 {
1718                         $author = $comment['user'];
1719                 }
1720
1721                 $this->pagehead();
1722
1723                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
1724                 echo '<p>' . _CONFIRMTXT_COMMENT . "</p>\n";
1725                 echo "<div class=\"note\">\n";
1726                 echo '<b>' . _EDITC_WHO . ":</b>{$author}<br />\n";
1727                 echo '<b>' . _EDITC_TEXT . ":</b>{$body}\n";
1728                 echo "</div>\n";
1729                 echo "<form method=\"post\" action=\"index.php\">\n";
1730                 echo "<div>\n";
1731                 echo "<input type=\"hidden\" name=\"action\" value=\"commentdeleteconfirm\" />\n";
1732                 echo $manager->addTicketHidden() . "\n";
1733                 echo "<input type=\"hidden\" name=\"commentid\" value=\"{$commentid}\" />\n";
1734                 echo '<input type="submit" tabindex="10" value="'. _DELETE_CONFIRM_BTN . "\" />\n";
1735                 echo "</div>\n";
1736                 echo "</form>\n";
1737                 $this->pagefoot();
1738                 return;
1739         }
1740
1741     /**
1742      * @todo document this
1743      */
1744     function action_commentdeleteconfirm() {
1745         global $member;
1746
1747         $commentid = intRequestVar('commentid');
1748
1749         // get item id first
1750         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1751         $o = sql_fetch_object($res);
1752         $itemid = $o->citem;
1753
1754         $error = $this->deleteOneComment($commentid);
1755         if ($error)
1756             $this->doError($error);
1757
1758         if ($member->canAlterItem($itemid))
1759             $this->action_itemcommentlist($itemid);
1760         else
1761             $this->action_browseowncomments();
1762     }
1763
1764     /**
1765      * @todo document this
1766      */
1767     function deleteOneComment($commentid) {
1768         global $member, $manager;
1769
1770         $commentid = intval($commentid);
1771
1772         if (!$member->canAlterComment($commentid))
1773             return _ERROR_DISALLOWED;
1774
1775         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1776
1777         // delete the comments associated with the item
1778         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1779         sql_query($query);
1780
1781         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1782
1783         return '';
1784     }
1785
1786     /**
1787      * Usermanagement main
1788      */
1789     function action_usermanagement() {
1790         global $member, $manager;
1791
1792         // check if allowed
1793         $member->isAdmin() or $this->disallow();
1794
1795         $this->pagehead();
1796
1797         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1798
1799         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1800
1801         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1802
1803         // show list of members with actions
1804         $query =  'SELECT *'
1805                . ' FROM '.sql_table('member');
1806         $template['content'] = 'memberlist';
1807         $template['tabindex'] = 10;
1808
1809         $manager->loadClass("ENCAPSULATE");
1810         $batch = new Batch('member');
1811         $batch->showlist($query,'table',$template);
1812
1813         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1814         ?>
1815             <form method="post" action="index.php" name="memberedit"><div>
1816
1817             <input type="hidden" name="action" value="memberadd" />
1818             <?php $manager->addTicketHidden() ?>
1819
1820             <table>
1821             <tr>
1822                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1823             </tr><tr>
1824                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1825                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1826                 </td>
1827                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1828             </tr><tr>
1829                 <td><?php echo _MEMBERS_REALNAME?></td>
1830                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1831             </tr><tr>
1832                 <td><?php echo _MEMBERS_PWD?></td>
1833                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1834             </tr><tr>
1835                 <td><?php echo _MEMBERS_REPPWD?></td>
1836                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1837             </tr><tr>
1838                 <td><?php echo _MEMBERS_EMAIL?></td>
1839                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1840             </tr><tr>
1841                 <td><?php echo _MEMBERS_URL?></td>
1842                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1843             </tr><tr>
1844                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1845                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1846             </tr><tr>
1847                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1848                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1849             </tr><tr>
1850                 <td><?php echo _MEMBERS_NOTES?></td>
1851                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1852             </tr><tr>
1853                 <td><?php echo _MEMBERS_NEW?></td>
1854                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1855             </tr></table>
1856
1857             </div></form>
1858         <?php
1859         $this->pagefoot();
1860     }
1861
1862     /**
1863      * Edit member settings
1864      */
1865     function action_memberedit() {
1866         $this->action_editmembersettings(intRequestVar('memberid'));
1867     }
1868
1869         /**
1870          * @todo document this
1871          */
1872         function action_editmembersettings($memberid = '') {
1873                 global $member, $manager, $CONF;
1874
1875                 if ($memberid == '')
1876                 {
1877                         $memberid = $member->getID();
1878                 }
1879
1880                 // check if allowed
1881                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1882
1883                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1884                 $this->pagehead($extrahead);
1885
1886                 // show message to go back to member overview (only for admins)
1887                 if ($member->isAdmin())
1888                 {
1889                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1890                 }
1891                 else
1892                 {
1893                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1894                 }
1895                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1896
1897                 $mem = Member::createFromID($memberid);
1898                 ?>
1899                 <form method="post" action="index.php" name="memberedit"><div>
1900
1901                 <input type="hidden" name="action" value="changemembersettings" />
1902                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1903                 <?php $manager->addTicketHidden() ?>
1904
1905                 <table><tr>
1906                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1907                 </tr><tr>
1908                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1909                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1910                         </td>
1911                         <td>
1912                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1913                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  Entity::hsc($mem->getDisplayName()); ?>" />
1914                         <?php } else {
1915                                 echo Entity::hsc($member->getDisplayName());
1916                            }
1917                         ?>
1918                         </td>
1919                 </tr><tr>
1920                         <td><?php echo _MEMBERS_REALNAME?></td>
1921                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  Entity::hsc($mem->getRealName()); ?>" /></td>
1922                 </tr><tr>
1923                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1924                         <td><?php echo _MEMBERS_PWD?></td>
1925                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1926                 </tr><tr>
1927                         <td><?php echo _MEMBERS_REPPWD?></td>
1928                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1929                 <?php } ?>
1930                 </tr><tr>
1931                         <td><?php echo _MEMBERS_EMAIL?>
1932                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1933                         </td>
1934                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  Entity::hsc($mem->getEmail()); ?>" /></td>
1935                 </tr><tr>
1936                         <td><?php echo _MEMBERS_URL?></td>
1937                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getURL()); ?>" /></td>
1938                 <?php // only allow to change this by super-admins
1939                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1940                    if ($member->isAdmin()) {
1941                 ?>
1942                         </tr><tr>
1943                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1944                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1945                         </tr><tr>
1946                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1947                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1948                 <?php } ?>
1949                 </tr><tr>
1950                         <td><?php echo _MEMBERS_NOTES?></td>
1951                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  Entity::hsc($mem->getNotes()); ?>" /></td>
1952                 </tr><tr>
1953                         <td><?php echo _MEMBERS_LOCALE?> <?php help('locale'); ?>
1954                         </td>
1955                         <td>
1956
1957                                 <select name="locale" tabindex="85">
1958                                 <?php
1959                                 $locales = i18n::get_available_locale_list();
1960                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1961                                 {
1962                                         echo "<option value=\"\" selected=\"selected\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1963                                 }
1964                                 else
1965                                 {
1966                                         echo "<option value=\"\">" . Entity::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1967                                 }
1968
1969                                 foreach( $locales as $locale )
1970                                 {
1971                                         if( $locale == $mem->getLocale() )
1972                                         {
1973                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1974                                         }
1975                                         else
1976                                         {
1977                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1978                                         }
1979                                 }
1980                                 ?>
1981                                 </select>
1982
1983                         </td>
1984                 </tr>
1985                 <tr>
1986                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1987                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1988                 </tr>
1989                 <?php
1990                         // plugin options
1991                         $this->_insertPluginOptions('member',$memberid);
1992                 ?>
1993                 <tr>
1994                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1995                 </tr><tr>
1996                         <td><?php echo _MEMBERS_EDIT?></td>
1997                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1998                 </tr></table>
1999
2000                 </div></form>
2001
2002                 <?php
2003                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2004
2005                         $manager->notify(
2006                                 'MemberSettingsFormExtras',
2007                                 array(
2008                                         'member' => &$mem
2009                                 )
2010                         );
2011                 $this->pagefoot();
2012         }
2013
2014     /**
2015      * @todo document this
2016      */
2017     function action_changemembersettings() {
2018         global $member, $CONF, $manager;
2019
2020         $memberid = intRequestVar('memberid');
2021
2022         // check if allowed
2023         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
2024
2025         $name           = trim(strip_tags(postVar('name')));
2026         $realname       = trim(strip_tags(postVar('realname')));
2027         $password       = postVar('password');
2028         $repeatpassword = postVar('repeatpassword');
2029         $email          = strip_tags(postVar('email'));
2030         $url            = strip_tags(postVar('url'));
2031
2032                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
2033                 # original eregi: !eregi("^https?://", $url)
2034
2035                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
2036                 if (!preg_match('#^https?://#', $url) )
2037                 {
2038                         $url = 'http://' . $url;
2039                 }
2040
2041         $admin          = postVar('admin');
2042         $canlogin       = postVar('canlogin');
2043         $notes          = strip_tags(postVar('notes'));
2044         $locale        = postVar('locale');
2045
2046         $mem = Member::createFromID($memberid);
2047
2048         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2049
2050             if (!isValidDisplayName($name))
2051                 $this->error(_ERROR_BADNAME);
2052
2053             if (($name != $mem->getDisplayName()) && Member::exists($name))
2054                 $this->error(_ERROR_NICKNAMEINUSE);
2055
2056             if ($password != $repeatpassword)
2057                 $this->error(_ERROR_PASSWORDMISMATCH);
2058
2059             if ($password && (i18n::strlen($password) < 6))
2060                 $this->error(_ERROR_PASSWORDTOOSHORT);
2061
2062             if ($password) {
2063                                 $pwdvalid = true;
2064                                 $pwderror = '';
2065                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2066                                 if (!$pwdvalid) {
2067                                         $this->error($pwderror);
2068                                 }
2069                         }
2070                 }
2071
2072                 if ( !NOTIFICATION::address_validation($email) )
2073                 {
2074                         $this->error(_ERROR_BADMAILADDRESS);
2075                 }
2076                 if ( !$realname )
2077                 {
2078                         $this->error(_ERROR_REALNAMEMISSING);
2079                 }
2080         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2081             $this->error(_ERROR_NOSUCHTRANSLATION);
2082
2083         // check if there will remain at least one site member with both the logon and admin rights
2084         // (check occurs when taking away one of these rights from such a member)
2085         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2086              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2087            )
2088         {
2089             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2090             if (sql_num_rows($r) < 2)
2091                 $this->error(_ERROR_ATLEASTONEADMIN);
2092         }
2093
2094         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2095             $mem->setDisplayName($name);
2096             if ($password)
2097                 $mem->setPassword($password);
2098         }
2099
2100         $oldEmail = $mem->getEmail();
2101
2102         $mem->setRealName($realname);
2103         $mem->setEmail($email);
2104         $mem->setURL($url);
2105         $mem->setNotes($notes);
2106         $mem->setLocale($locale);
2107
2108
2109         // only allow super-admins to make changes to the admin status
2110         if ($member->isAdmin()) {
2111             $mem->setAdmin($admin);
2112             $mem->setCanLogin($canlogin);
2113         }
2114
2115         $autosave = postVar ('autosave');
2116         $mem->setAutosave($autosave);
2117
2118         $mem->write();
2119
2120         // store plugin options
2121         $aOptions = requestArray('plugoption');
2122         NucleusPlugin::apply_plugin_options($aOptions);
2123         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2124
2125         // if email changed, generate new password
2126         if ($oldEmail != $mem->getEmail())
2127         {
2128             $mem->sendActivationLink('addresschange', $oldEmail);
2129             // logout member
2130             $mem->newCookieKey();
2131
2132             // only log out if the member being edited is the current member.
2133             if ($member->getID() == $memberid)
2134                 $member->logout();
2135             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2136             return;
2137         }
2138
2139
2140         if (  ( $mem->getID() == $member->getID() )
2141            && ( $mem->getDisplayName() != $member->getDisplayName() )
2142            ) {
2143             $mem->newCookieKey();
2144             $member->logout();
2145             $this->action_login(_MSG_LOGINAGAIN, 0);
2146         } else {
2147             $this->action_overview(_MSG_SETTINGSCHANGED);
2148         }
2149     }
2150
2151         /**
2152          * Admin::action_memberadd()
2153          *
2154          * @param       void
2155          * @return      void
2156          *
2157         */
2158         function action_memberadd()
2159         {
2160                 global $member, $manager;
2161
2162                 // check if allowed
2163                 $member->isAdmin() or $this->disallow();
2164
2165                 if ( postVar('password') != postVar('repeatpassword') )
2166                 {
2167                         $this->error(_ERROR_PASSWORDMISMATCH);
2168                 }
2169
2170                 if ( i18n::strlen(postVar('password')) < 6 )
2171                 {
2172                         $this->error(_ERROR_PASSWORDTOOSHORT);
2173                 }
2174
2175                 $res = Member::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2176                 if ( $res != 1 )
2177                 {
2178                         $this->error($res);
2179                 }
2180
2181                 // fire PostRegister event
2182                 $newmem = new Member();
2183                 $newmem->readFromName(postVar('name'));
2184                 $manager->notify('PostRegister',array('member' => &$newmem));
2185
2186                 $this->action_usermanagement();
2187                 return;
2188         }
2189
2190     /**
2191      * Account activation
2192      *
2193      * @author dekarma
2194      */
2195     function action_activate() {
2196
2197         $key = getVar('key');
2198         $this->_showActivationPage($key);
2199     }
2200
2201     /**
2202      * @todo document this
2203      */
2204     function _showActivationPage($key, $message = '')
2205     {
2206         global $manager;
2207
2208         // clean up old activation keys
2209         Member::cleanupActivationTable();
2210
2211         // get activation info
2212         $info = Member::getActivationInfo($key);
2213
2214         if (!$info)
2215             $this->error(_ERROR_ACTIVATE);
2216
2217         $mem = Member::createFromId($info->vmember);
2218
2219         if (!$mem)
2220             $this->error(_ERROR_ACTIVATE);
2221
2222         $text = '';
2223         $title = '';
2224         $bNeedsPasswordChange = true;
2225
2226         switch ($info->vtype)
2227         {
2228             case 'forgot':
2229                 $title = _ACTIVATE_FORGOT_TITLE;
2230                 $text = _ACTIVATE_FORGOT_TEXT;
2231                 break;
2232             case 'register':
2233                 $title = _ACTIVATE_REGISTER_TITLE;
2234                 $text = _ACTIVATE_REGISTER_TEXT;
2235                 break;
2236             case 'addresschange':
2237                 $title = _ACTIVATE_CHANGE_TITLE;
2238                 $text = _ACTIVATE_CHANGE_TEXT;
2239                 $bNeedsPasswordChange = false;
2240                 Member::activate($key);
2241                 break;
2242         }
2243
2244         $aVars = array(
2245             'memberName' => Entity::hsc($mem->getDisplayName())
2246         );
2247         $title = Template::fill($title, $aVars);
2248         $text = Template::fill($text, $aVars);
2249
2250         $this->pagehead();
2251
2252             echo '<h2>' , $title, '</h2>';
2253             echo '<p>' , $text, '</p>';
2254
2255             if ($message != '')
2256             {
2257                 echo '<p class="error">',$message,'</p>';
2258             }
2259
2260             if ($bNeedsPasswordChange)
2261             {
2262                 ?>
2263                     <div><form action="index.php" method="post">
2264
2265                         <input type="hidden" name="action" value="activatesetpwd" />
2266                         <?php $manager->addTicketHidden() ?>
2267                         <input type="hidden" name="key" value="<?php echo Entity::hsc($key) ?>" />
2268
2269                         <table><tr>
2270                             <td><?php echo _MEMBERS_PWD?></td>
2271                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2272                         </tr><tr>
2273                             <td><?php echo _MEMBERS_REPPWD?></td>
2274                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2275                         <?php
2276
2277                             global $manager;
2278                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2279
2280                         ?>
2281                         </tr><tr>
2282                             <td><?php echo _MEMBERS_SETPWD ?></td>
2283                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2284                         </tr></table>
2285
2286
2287                     </form></div>
2288
2289                 <?php
2290
2291             }
2292
2293         $this->pagefoot();
2294
2295     }
2296
2297     /**
2298      * Account activation - set password part
2299      *
2300      * @author dekarma
2301      */
2302     function action_activatesetpwd() {
2303
2304         $key = postVar('key');
2305
2306         // clean up old activation keys
2307         Member::cleanupActivationTable();
2308
2309         // get activation info
2310         $info = Member::getActivationInfo($key);
2311
2312         if (!$info || ($info->type == 'addresschange'))
2313             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2314
2315         $mem = Member::createFromId($info->vmember);
2316
2317         if (!$mem)
2318             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2319
2320         $password       = postVar('password');
2321         $repeatpassword = postVar('repeatpassword');
2322
2323         if ($password != $repeatpassword)
2324             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2325
2326         if ($password && (i18n::strlen($password) < 6))
2327             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2328
2329         if ($password) {
2330                         $pwdvalid = true;
2331                         $pwderror = '';
2332                         global $manager;
2333                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2334                         if (!$pwdvalid) {
2335                                 return $this->_showActivationPage($key,$pwderror);
2336                         }
2337                 }
2338
2339         $error = '';
2340
2341         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2342         if ($error != '')
2343             return $this->_showActivationPage($key, $error);
2344
2345
2346         // set password
2347         $mem->setPassword($password);
2348         $mem->write();
2349
2350         // do the activation
2351         Member::activate($key);
2352
2353         $this->pagehead();
2354             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2355             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2356         $this->pagefoot();
2357     }
2358
2359     /**
2360      * Manage team
2361      */
2362     function action_manageteam() {
2363         global $member, $manager;
2364
2365         $blogid = intRequestVar('blogid');
2366
2367         // check if allowed
2368         $member->blogAdminRights($blogid) or $this->disallow();
2369
2370         $this->pagehead();
2371
2372         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2373
2374         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2375
2376         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2377
2378
2379
2380         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2381                . ' FROM '.sql_table('member').', '.sql_table('team')
2382                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2383
2384         $template['content'] = 'teamlist';
2385         $template['tabindex'] = 10;
2386
2387         $manager->loadClass("ENCAPSULATE");
2388         $batch = new Batch('team');
2389         $batch->showlist($query, 'table', $template);
2390
2391         ?>
2392             <h3><?php echo _TEAM_ADDNEW?></h3>
2393
2394             <form method='post' action='index.php'><div>
2395
2396             <input type='hidden' name='action' value='teamaddmember' />
2397             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2398             <?php $manager->addTicketHidden() ?>
2399
2400             <table><tr>
2401                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2402                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2403                     $query =  'SELECT mname as text, mnumber as value'
2404                            . ' FROM '.sql_table('member');
2405
2406                     $template['name'] = 'memberid';
2407                     $template['tabindex'] = 10000;
2408                     showlist($query,'select',$template);
2409                 ?></td>
2410             </tr><tr>
2411                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2412                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2413             </tr><tr>
2414                 <td><?php echo _TEAM_ADD?></td>
2415                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2416             </tr></table>
2417
2418             </div></form>
2419         <?php
2420         $this->pagefoot();
2421     }
2422
2423     /**
2424      * Add member to team
2425      */
2426     function action_teamaddmember() {
2427         global $member, $manager;
2428
2429         $memberid = intPostVar('memberid');
2430         $blogid = intPostVar('blogid');
2431         $admin = intPostVar('admin');
2432
2433         // check if allowed
2434         $member->blogAdminRights($blogid) or $this->disallow();
2435
2436         $blog =& $manager->getBlog($blogid);
2437         if (!$blog->addTeamMember($memberid, $admin))
2438             $this->error(_ERROR_ALREADYONTEAM);
2439
2440         $this->action_manageteam();
2441
2442     }
2443
2444     /**
2445      * @todo document this
2446      */
2447     function action_teamdelete() {
2448         global $member, $manager;
2449
2450         $memberid = intRequestVar('memberid');
2451         $blogid = intRequestVar('blogid');
2452
2453         // check if allowed
2454         $member->blogAdminRights($blogid) or $this->disallow();
2455
2456         $teammem = Member::createFromID($memberid);
2457         $blog =& $manager->getBlog($blogid);
2458
2459         $this->pagehead();
2460         ?>
2461             <h2><?php echo _DELETE_CONFIRM?></h2>
2462
2463             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  Entity::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  Entity::hsc(strip_tags($blog->getName())) ?></b>
2464             </p>
2465
2466
2467             <form method="post" action="index.php"><div>
2468             <input type="hidden" name="action" value="teamdeleteconfirm" />
2469             <?php $manager->addTicketHidden() ?>
2470             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2471             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2472             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2473             </div></form>
2474         <?php
2475         $this->pagefoot();
2476     }
2477
2478     /**
2479      * @todo document this
2480      */
2481     function action_teamdeleteconfirm() {
2482         global $member;
2483
2484         $memberid = intRequestVar('memberid');
2485         $blogid = intRequestVar('blogid');
2486
2487         $error = $this->deleteOneTeamMember($blogid, $memberid);
2488         if ($error)
2489             $this->error($error);
2490
2491
2492         $this->action_manageteam();
2493     }
2494
2495     /**
2496      * @todo document this
2497      */
2498     function deleteOneTeamMember($blogid, $memberid) {
2499         global $member, $manager;
2500
2501         $blogid = intval($blogid);
2502         $memberid = intval($memberid);
2503
2504         // check if allowed
2505         if (!$member->blogAdminRights($blogid))
2506             return _ERROR_DISALLOWED;
2507
2508         // check if: - there remains at least one blog admin
2509         //           - (there remains at least one team member)
2510         $tmem = Member::createFromID($memberid);
2511
2512         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2513
2514         if ($tmem->isBlogAdmin($blogid)) {
2515             // check if there are more blog members left and at least one admin
2516             // (check for at least two admins before deletion)
2517             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2518             $r = sql_query($query);
2519             if (sql_num_rows($r) < 2)
2520                 return _ERROR_ATLEASTONEBLOGADMIN;
2521         }
2522
2523         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2524         sql_query($query);
2525
2526         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2527
2528         return '';
2529     }
2530
2531     /**
2532      * @todo document this
2533      */
2534     function action_teamchangeadmin() {
2535         global $member;
2536
2537         $blogid = intRequestVar('blogid');
2538         $memberid = intRequestVar('memberid');
2539
2540         // check if allowed
2541         $member->blogAdminRights($blogid) or $this->disallow();
2542
2543         $mem = Member::createFromID($memberid);
2544
2545         // don't allow when there is only one admin at this moment
2546         if ($mem->isBlogAdmin($blogid)) {
2547             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2548             if (sql_num_rows($r) == 1)
2549                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2550         }
2551
2552         if ($mem->isBlogAdmin($blogid))
2553             $newval = 0;
2554         else
2555             $newval = 1;
2556
2557         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2558         sql_query($query);
2559
2560         // only show manageteam if member did not change its own admin privileges
2561         if ($member->isBlogAdmin($blogid))
2562             $this->action_manageteam();
2563         else
2564             $this->action_overview(_MSG_ADMINCHANGED);
2565     }
2566
2567     /**
2568      * @todo document this
2569      */
2570     function action_blogsettings() {
2571         global $member, $manager;
2572
2573         $blogid = intRequestVar('blogid');
2574
2575         // check if allowed
2576         $member->blogAdminRights($blogid) or $this->disallow();
2577
2578         $blog =& $manager->getBlog($blogid);
2579
2580         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2581         $this->pagehead($extrahead);
2582
2583         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2584         ?>
2585         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2586
2587         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2588
2589         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2590         <?php
2591             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2592             $aMemberNames = array();
2593             while ($o = sql_fetch_object($res))
2594                 array_push($aMemberNames, Entity::hsc($o->mname) . ' (' . Entity::hsc($o->mrealname). ')');
2595             echo implode(',', $aMemberNames);
2596         ?>
2597         </p>
2598
2599
2600
2601         <p>
2602         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2603         </p>
2604
2605         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2606
2607         <form method="post" action="index.php"><div>
2608
2609         <input type="hidden" name="action" value="blogsettingsupdate" />
2610         <?php $manager->addTicketHidden() ?>
2611         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2612         <table><tr>
2613             <td><?php echo _EBLOG_NAME?></td>
2614             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getName()) ?>" /></td>
2615         </tr><tr>
2616             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2617                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2618             </td>
2619             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  Entity::hsc($blog->getShortName()) ?>" /></td>
2620         </tr><tr>
2621             <td><?php echo _EBLOG_DESC?></td>
2622             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  Entity::hsc($blog->getDescription()) ?>" /></td>
2623         </tr><tr>
2624             <td><?php echo _EBLOG_URL?></td>
2625             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  Entity::hsc($blog->getURL()) ?>" /></td>
2626         </tr><tr>
2627             <td><?php echo _EBLOG_DEFSKIN?>
2628                 <?php help('blogdefaultskin'); ?>
2629             </td>
2630             <td>
2631                 <?php
2632                     $query =  'SELECT sdname as text, sdnumber as value'
2633                            . ' FROM '.sql_table('skin_desc');
2634                     $template['name'] = 'defskin';
2635                     $template['selected'] = $blog->getDefaultSkin();
2636                     $template['tabindex'] = 50;
2637                     showlist($query,'select',$template);
2638                 ?>
2639
2640             </td>
2641         </tr><tr>
2642             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2643             </td>
2644             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2645         </tr><tr>
2646             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2647             </td>
2648             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2649         </tr><tr>
2650             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2651             </td>
2652             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2653         </tr><tr>
2654             <td><?php echo _EBLOG_ANONYMOUS?>
2655             </td>
2656             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2657         </tr><tr>
2658     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2659          </td>
2660          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2661       </tr><tr>
2662             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2663             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  Entity::hsc($blog->getNotifyAddress()); ?>" /></td>
2664         </tr><tr>
2665             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2666             <td>
2667                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2668                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2669                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2670                 <br />
2671                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2672                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2673                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2674                 <br />
2675                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2676                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2677                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2678             </td>
2679         </tr><tr>
2680             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2681             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  Entity::hsc($blog->getMaxComments()); ?>" /></td>
2682         </tr><tr>
2683             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2684             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  Entity::hsc($blog->getUpdateFile()) ?>" /></td>
2685         </tr><tr>
2686             <td><?php echo _EBLOG_DEFCAT?></td>
2687             <td>
2688                 <?php
2689                     $query =  'SELECT cname as text, catid as value'
2690                            . ' FROM '.sql_table('category')
2691                            . ' WHERE cblog=' . $blog->getID();
2692                     $template['name'] = 'defcat';
2693                     $template['selected'] = $blog->getDefaultCategory();
2694                     $template['tabindex'] = 110;
2695                     showlist($query,'select',$template);
2696                 ?>
2697             </td>
2698         </tr><tr>
2699             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2700                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', time()); ?></b>
2701                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::formatted_datetime('%H:%M', $blog->getCorrectTime()); ?></b>
2702                 </td>
2703             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  Entity::hsc($blog->getTimeOffset()); ?>" /></td>
2704         </tr><tr>
2705             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2706             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2707         </tr>
2708         <?php
2709             // plugin options
2710             $this->_insertPluginOptions('blog',$blogid);
2711         ?>
2712         <tr>
2713             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2714         </tr><tr>
2715             <td><?php echo _EBLOG_CHANGE?></td>
2716             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2717         </tr></table>
2718
2719         </div></form>
2720
2721         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2722
2723
2724         <?php
2725         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2726         $template['content'] = 'categorylist';
2727         $template['tabindex'] = 200;
2728
2729         $manager->loadClass("ENCAPSULATE");
2730         $batch = new Batch('category');
2731         $batch->showlist($query,'table',$template);
2732
2733         ?>
2734
2735
2736         <form action="index.php" method="post"><div>
2737         <input name="action" value="categorynew" type="hidden" />
2738         <?php $manager->addTicketHidden() ?>
2739         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2740
2741         <table><tr>
2742             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2743         </tr><tr>
2744             <td><?php echo _EBLOG_CAT_NAME?></td>
2745             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2746         </tr><tr>
2747             <td><?php echo _EBLOG_CAT_DESC?></td>
2748             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2749         </tr><tr>
2750             <td><?php echo _EBLOG_CAT_CREATE?></td>
2751             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2752         </tr></table>
2753
2754         </div></form>
2755
2756         <?php
2757
2758             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2759
2760             $manager->notify(
2761                 'BlogSettingsFormExtras',
2762                 array(
2763                     'blog' => &$blog
2764                 )
2765             );
2766
2767         $this->pagefoot();
2768     }
2769
2770     /**
2771      * @todo document this
2772      */
2773     function action_categorynew() {
2774         global $member, $manager;
2775
2776         $blogid = intRequestVar('blogid');
2777
2778         $member->blogAdminRights($blogid) or $this->disallow();
2779
2780         $cname = postVar('cname');
2781         $cdesc = postVar('cdesc');
2782
2783         if (!isValidCategoryName($cname))
2784             $this->error(_ERROR_BADCATEGORYNAME);
2785
2786         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2787         $res = sql_query($query);
2788         if (sql_num_rows($res) > 0)
2789             $this->error(_ERROR_DUPCATEGORYNAME);
2790
2791         $blog       =& $manager->getBlog($blogid);
2792         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2793
2794         $this->action_blogsettings();
2795     }
2796
2797     /**
2798      * @todo document this
2799      */
2800     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2801         global $member, $manager;
2802
2803         if ($blogid == '')
2804             $blogid = intGetVar('blogid');
2805         else
2806             $blogid = intval($blogid);
2807         if ($catid == '')
2808             $catid = intGetVar('catid');
2809         else
2810             $catid = intval($catid);
2811
2812         $member->blogAdminRights($blogid) or $this->disallow();
2813
2814         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2815         $obj = sql_fetch_object($res);
2816
2817         $cname = $obj->cname;
2818         $cdesc = $obj->cdesc;
2819
2820         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2821         $this->pagehead($extrahead);
2822
2823         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2824
2825         ?>
2826         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo Entity::hsc($cname)?>'</h2>
2827         <form method='post' action='index.php'><div>
2828         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2829         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2830         <input name="desturl" type="hidden" value="<?php echo Entity::hsc($desturl) ?>" />
2831         <input name="action" type="hidden" value="categoryupdate" />
2832         <?php $manager->addTicketHidden(); ?>
2833
2834         <table><tr>
2835             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2836         </tr><tr>
2837             <td><?php echo _EBLOG_CAT_NAME?></td>
2838             <td><input type="text" name="cname" value="<?php echo Entity::hsc($cname)?>" size="40" maxlength="40" /></td>
2839         </tr><tr>
2840             <td><?php echo _EBLOG_CAT_DESC?></td>
2841             <td><input type="text" name="cdesc" value="<?php echo Entity::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2842         </tr>
2843         <?php
2844             // insert plugin options
2845             $this->_insertPluginOptions('category',$catid);
2846         ?>
2847         <tr>
2848             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2849         </tr><tr>
2850             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2851             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2852         </tr></table>
2853
2854         </div></form>
2855         <?php
2856         $this->pagefoot();
2857     }
2858
2859     /**
2860      * @todo document this
2861      */
2862     function action_categoryupdate() {
2863         global $member, $manager;
2864
2865         $blogid = intPostVar('blogid');
2866         $catid = intPostVar('catid');
2867         $cname = postVar('cname');
2868         $cdesc = postVar('cdesc');
2869         $desturl = postVar('desturl');
2870
2871         $member->blogAdminRights($blogid) or $this->disallow();
2872
2873         if (!isValidCategoryName($cname))
2874             $this->error(_ERROR_BADCATEGORYNAME);
2875
2876         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2877         $res = sql_query($query);
2878         if (sql_num_rows($res) > 0)
2879             $this->error(_ERROR_DUPCATEGORYNAME);
2880
2881         $query =  'UPDATE '.sql_table('category').' SET'
2882                . " cname='" . sql_real_escape_string($cname) . "',"
2883                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2884                . " WHERE catid=" . $catid;
2885
2886         sql_query($query);
2887
2888         // store plugin options
2889         $aOptions = requestArray('plugoption');
2890         NucleusPlugin::apply_plugin_options($aOptions);
2891         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2892
2893
2894         if ($desturl) {
2895             redirect($desturl);
2896             exit;
2897         } else {
2898             $this->action_blogsettings();
2899         }
2900     }
2901
2902     /**
2903      * @todo document this
2904      */
2905     function action_categorydelete() {
2906         global $member, $manager;
2907
2908         $blogid = intRequestVar('blogid');
2909         $catid = intRequestVar('catid');
2910
2911         $member->blogAdminRights($blogid) or $this->disallow();
2912
2913         $blog =& $manager->getBlog($blogid);
2914
2915         // check if the category is valid
2916         if (!$blog->isValidCategory($catid))
2917             $this->error(_ERROR_NOSUCHCATEGORY);
2918
2919         // don't allow deletion of default category
2920         if ($blog->getDefaultCategory() == $catid)
2921             $this->error(_ERROR_DELETEDEFCATEGORY);
2922
2923         // check if catid is the only category left for blogid
2924         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2925         $res = sql_query($query);
2926         if (sql_num_rows($res) == 1)
2927             $this->error(_ERROR_DELETELASTCATEGORY);
2928
2929
2930         $this->pagehead();
2931         ?>
2932             <h2><?php echo _DELETE_CONFIRM?></h2>
2933
2934             <div>
2935             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  Entity::hsc($blog->getCategoryName($catid))?></b>
2936             </div>
2937
2938             <form method="post" action="index.php"><div>
2939             <input type="hidden" name="action" value="categorydeleteconfirm" />
2940             <?php $manager->addTicketHidden() ?>
2941             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2942             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2943             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2944             </div></form>
2945         <?php
2946         $this->pagefoot();
2947     }
2948
2949     /**
2950      * @todo document this
2951      */
2952     function action_categorydeleteconfirm() {
2953         global $member, $manager;
2954
2955         $blogid = intRequestVar('blogid');
2956         $catid = intRequestVar('catid');
2957
2958         $member->blogAdminRights($blogid) or $this->disallow();
2959
2960         $error = $this->deleteOneCategory($catid);
2961         if ($error)
2962             $this->error($error);
2963
2964         $this->action_blogsettings();
2965     }
2966
2967         /**
2968          * Admin::deleteOneCategory()
2969          * Delete a category by its id
2970          *
2971          * @param       String  $catid  category id for deleting
2972          * @return      Void
2973          */
2974         function deleteOneCategory($catid)
2975         {
2976                 global $manager, $member;
2977
2978                 $catid = intval($catid);
2979                 $blogid = getBlogIDFromCatID($catid);
2980
2981                 if ( !$member->blogAdminRights($blogid) )
2982                 {
2983                         return ERROR_DISALLOWED;
2984                 }
2985
2986                 // get blog
2987                 $blog =& $manager->getBlog($blogid);
2988
2989                 // check if the category is valid
2990                 if ( !$blog || !$blog->isValidCategory($catid) )
2991                 {
2992                         return _ERROR_NOSUCHCATEGORY;
2993                 }
2994
2995                 $destcatid = $blog->getDefaultCategory();
2996
2997                 // don't allow deletion of default category
2998                 if ( $blog->getDefaultCategory() == $catid )
2999                 {
3000                         return _ERROR_DELETEDEFCATEGORY;
3001                 }
3002
3003                 // check if catid is the only category left for blogid
3004                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
3005                 $res = sql_query($query);
3006                 if ( sql_num_rows($res) == 1 )
3007                 {
3008                         return _ERROR_DELETELASTCATEGORY;
3009                 }
3010
3011                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
3012
3013                 // change category for all items to the default category
3014                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
3015                 sql_query($query);
3016
3017                 // delete all associated plugin options
3018                 NucleusPlugin::delete_option_values('category', $catid);
3019
3020                 // delete category
3021                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
3022                 sql_query($query);
3023
3024                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
3025                 return;
3026         }
3027
3028         /**
3029          * Admin::action_blogsettingsupdate
3030          * Updating blog settings
3031          *
3032          * @param       Void
3033          * @return      Void
3034          */
3035         function action_blogsettingsupdate()
3036         {
3037                 global $member, $manager;
3038
3039                 $blogid = intRequestVar('blogid');
3040
3041                 $member->blogAdminRights($blogid) or $this->disallow();
3042
3043                 $blog =& $manager->getBlog($blogid);
3044
3045                 $notify_address = trim(postVar('notify'));
3046                 $shortname              = trim(postVar('shortname'));
3047                 $updatefile     = trim(postVar('update'));
3048
3049                 $notifyComment  = intPostVar('notifyComment');
3050                 $notifyVote             = intPostVar('notifyVote');
3051                 $notifyNewItem  = intPostVar('notifyNewItem');
3052
3053                 if ( $notifyComment == 0 )
3054                 {
3055                         $notifyComment = 1;
3056                 }
3057                 if ( $notifyVote == 0 )
3058                 {
3059                         $notifyVote = 1;
3060                 }
3061                 if ( $notifyNewItem == 0 )
3062                 {
3063                         $notifyNewItem = 1;
3064                 }
3065                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3066
3067                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
3068                 {
3069                         $this->error(_ERROR_BADNOTIFY);
3070                 }
3071
3072                 if ( !isValidShortName($shortname) )
3073                 {
3074                         $this->error(_ERROR_BADSHORTBLOGNAME);
3075                 }
3076
3077                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
3078                 {
3079                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3080                 }
3081                 // check if update file is writable
3082                 if ( $updatefile && !is_writeable($updatefile) )
3083                 {
3084                         $this->error(_ERROR_UPDATEFILE);
3085                 }
3086
3087                 $blog->setName(trim(postVar('name')));
3088                 $blog->setShortName($shortname);
3089                 $blog->setNotifyAddress($notify_address);
3090                 $blog->setNotifyType($notifyType);
3091                 $blog->setMaxComments(postVar('maxcomments'));
3092                 $blog->setCommentsEnabled(postVar('comments'));
3093                 $blog->setTimeOffset(postVar('timeoffset'));
3094                 $blog->setUpdateFile($updatefile);
3095                 $blog->setURL(trim(postVar('url')));
3096                 $blog->setDefaultSkin(intPostVar('defskin'));
3097                 $blog->setDescription(trim(postVar('desc')));
3098                 $blog->setPublic(postVar('public'));
3099                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3100                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3101                 $blog->setDefaultCategory(intPostVar('defcat'));
3102                 $blog->setSearchable(intPostVar('searchable'));
3103                 $blog->setEmailRequired(intPostVar('reqemail'));
3104                 $blog->writeSettings();
3105
3106                 // store plugin options
3107                 $aOptions = requestArray('plugoption');
3108                 NucleusPlugin::apply_plugin_options($aOptions);
3109                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3110
3111                 $this->action_overview(_MSG_SETTINGSCHANGED);
3112                 return;
3113         }
3114
3115     /**
3116      * @todo document this
3117      */
3118     function action_deleteblog() {
3119         global $member, $CONF, $manager;
3120
3121         $blogid = intRequestVar('blogid');
3122
3123         $member->blogAdminRights($blogid) or $this->disallow();
3124
3125         // check if blog is default blog
3126         if ($CONF['DefaultBlog'] == $blogid)
3127             $this->error(_ERROR_DELDEFBLOG);
3128
3129         $blog =& $manager->getBlog($blogid);
3130
3131         $this->pagehead();
3132         ?>
3133             <h2><?php echo _DELETE_CONFIRM?></h2>
3134
3135             <p><?php echo _WARNINGTXT_BLOGDEL?>
3136             </p>
3137
3138             <div>
3139             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  Entity::hsc($blog->getName())?></b>
3140             </div>
3141
3142             <form method="post" action="index.php"><div>
3143             <input type="hidden" name="action" value="deleteblogconfirm" />
3144             <?php $manager->addTicketHidden() ?>
3145             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3146             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3147             </div></form>
3148         <?php
3149         $this->pagefoot();
3150     }
3151
3152         /**
3153          * Admin::action_deleteblogconfirm()
3154          * Delete Blog
3155          *
3156          * @param       Void
3157          * @return      Void
3158          */
3159         function action_deleteblogconfirm()
3160         {
3161                 global $member, $CONF, $manager;
3162
3163                 $blogid = intRequestVar('blogid');
3164                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3165                 $member->blogAdminRights($blogid) or $this->disallow();
3166
3167                 // check if blog is default blog
3168                 if ( $CONF['DefaultBlog'] == $blogid )
3169                 {
3170                         $this->error(_ERROR_DELDEFBLOG);
3171                 }
3172
3173                 // delete all comments
3174                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3175                 sql_query($query);
3176
3177                 // delete all items
3178                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3179                 sql_query($query);
3180
3181                 // delete all team members
3182                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3183                 sql_query($query);
3184
3185                 // delete all bans
3186                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3187                 sql_query($query);
3188
3189                 // delete all categories
3190                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3191                 sql_query($query);
3192
3193                 // delete all associated plugin options
3194                 NucleusPlugin::delete_option_values('blog', $blogid);
3195
3196                 // delete the blog itself
3197                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3198                 sql_query($query);
3199
3200                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3201
3202                 $this->action_overview(_DELETED_BLOG);
3203                 return;
3204         }
3205
3206     /**
3207      * @todo document this
3208      */
3209     function action_memberdelete() {
3210         global $member, $manager;
3211
3212         $memberid = intRequestVar('memberid');
3213
3214         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3215
3216         $mem = Member::createFromID($memberid);
3217
3218         $this->pagehead();
3219         ?>
3220             <h2><?php echo _DELETE_CONFIRM?></h2>
3221
3222             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo Entity::hsc($mem->getDisplayName()) ?></b>
3223             </p>
3224
3225             <p>
3226             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3227             </p>
3228
3229             <form method="post" action="index.php"><div>
3230             <input type="hidden" name="action" value="memberdeleteconfirm" />
3231             <?php $manager->addTicketHidden() ?>
3232             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3233             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3234             </div></form>
3235         <?php
3236         $this->pagefoot();
3237     }
3238
3239     /**
3240      * @todo document this
3241      */
3242     function action_memberdeleteconfirm() {
3243         global $member;
3244
3245         $memberid = intRequestVar('memberid');
3246
3247         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3248
3249         $error = $this->deleteOneMember($memberid);
3250         if ($error)
3251             $this->error($error);
3252
3253         if ($member->isAdmin())
3254             $this->action_usermanagement();
3255         else
3256             $this->action_overview(_DELETED_MEMBER);
3257     }
3258
3259         /**
3260          * Admin::deleteOneMember()
3261          * Delete a member by id
3262          *
3263          * @static
3264          * @params      Integer $memberid       member id
3265          * @return      String  null string or error messages
3266          */
3267         function deleteOneMember($memberid)
3268         {
3269                 global $manager;
3270
3271                 $memberid = intval($memberid);
3272                 $mem = Member::createFromID($memberid);
3273
3274                 if ( !$mem->canBeDeleted() )
3275                 {
3276                         return _ERROR_DELETEMEMBER;
3277                 }
3278
3279                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3280
3281                 /* unlink comments from memberid */
3282                 if ( $memberid )
3283                 {
3284                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3285                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3286                         sql_query($query);
3287                 }
3288
3289                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3290                 sql_query($query);
3291
3292                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3293                 sql_query($query);
3294
3295                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3296                 sql_query($query);
3297
3298                 // delete all associated plugin options
3299                 NucleusPlugin::delete_option_values('member', $memberid);
3300
3301                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3302
3303                 return '';
3304         }
3305
3306     /**
3307      * @todo document this
3308      */
3309     function action_createnewlog() {
3310         global $member, $CONF, $manager;
3311
3312         // Only Super-Admins can do this
3313         $member->isAdmin() or $this->disallow();
3314
3315         $this->pagehead();
3316
3317         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3318         ?>
3319         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3320
3321         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3322
3323         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3324
3325         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3326
3327         <ol>
3328             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3329             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3330         </ol>
3331
3332         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3333
3334         <p>
3335         <?php echo _EBLOG_CREATE_TEXT?>
3336         </p>
3337
3338         <form method="post" action="index.php"><div>
3339
3340         <input type="hidden" name="action" value="addnewlog" />
3341         <?php $manager->addTicketHidden() ?>
3342
3343
3344         <table><tr>
3345             <td><?php echo _EBLOG_NAME?></td>
3346             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3347         </tr><tr>
3348             <td><?php echo _EBLOG_SHORTNAME?>
3349                 <?php help('shortblogname'); ?>
3350             </td>
3351             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3352         </tr><tr>
3353             <td><?php echo _EBLOG_DESC?></td>
3354             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3355         </tr><tr>
3356             <td><?php echo _EBLOG_DEFSKIN?>
3357                 <?php help('blogdefaultskin'); ?>
3358             </td>
3359             <td>
3360                 <?php
3361                     $query =  'SELECT sdname as text, sdnumber as value'
3362                            . ' FROM '.sql_table('skin_desc');
3363                     $template['name'] = 'defskin';
3364                     $template['tabindex'] = 50;
3365                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3366                     showlist($query,'select',$template);
3367                 ?>
3368             </td>
3369         </tr><tr>
3370             <td><?php echo _EBLOG_OFFSET?>
3371                 <?php help('blogtimeoffset'); ?>
3372                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::formatted_datetime('%H:%M',time()); ?></b>
3373             </td>
3374             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3375         </tr><tr>
3376             <td><?php echo _EBLOG_ADMIN?>
3377                 <?php help('teamadmin'); ?>
3378             </td>
3379             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3380         </tr><tr>
3381             <td><?php echo _EBLOG_CREATE?></td>
3382             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3383         </tr></table>
3384
3385         </div></form>
3386         <?php
3387         $this->pagefoot();
3388     }
3389
3390     /**
3391      * @todo document this
3392      */
3393     function action_addnewlog() {
3394         global $member, $manager, $CONF;
3395
3396         // Only Super-Admins can do this
3397         $member->isAdmin() or $this->disallow();
3398
3399         $bname          = trim(postVar('name'));
3400         $bshortname     = trim(postVar('shortname'));
3401         $btimeoffset    = postVar('timeoffset');
3402         $bdesc          = trim(postVar('desc'));
3403         $bdefskin       = postVar('defskin');
3404
3405         if (!isValidShortName($bshortname))
3406             $this->error(_ERROR_BADSHORTBLOGNAME);
3407
3408         if ($manager->existsBlog($bshortname))
3409             $this->error(_ERROR_DUPSHORTBLOGNAME);
3410
3411         $manager->notify(
3412             'PreAddBlog',
3413             array(
3414                 'name' => &$bname,
3415                 'shortname' => &$bshortname,
3416                 'timeoffset' => &$btimeoffset,
3417                 'description' => &$bdesc,
3418                 'defaultskin' => &$bdefskin
3419             )
3420         );
3421
3422
3423         // add slashes for sql queries
3424         $bname =        sql_real_escape_string($bname);
3425         $bshortname =   sql_real_escape_string($bshortname);
3426         $btimeoffset =  sql_real_escape_string($btimeoffset);
3427         $bdesc =        sql_real_escape_string($bdesc);
3428         $bdefskin =     sql_real_escape_string($bdefskin);
3429
3430         // create blog
3431         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3432         sql_query($query);
3433         $blogid = sql_insert_id();
3434         $blog   =& $manager->getBlog($blogid);
3435
3436         // create new category
3437         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3438         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3439         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3440         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3441 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3442 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3443         $catid = sql_insert_id();
3444
3445         // set as default category
3446         $blog->setDefaultCategory($catid);
3447         $blog->writeSettings();
3448
3449         // create team member
3450         $memberid = $member->getID();
3451         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3452         sql_query($query);
3453
3454         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3455         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3456
3457         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3458         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3459
3460
3461
3462         $manager->notify(
3463             'PostAddBlog',
3464             array(
3465                 'blog' => &$blog
3466             )
3467         );
3468
3469         $manager->notify(
3470             'PostAddCategory',
3471             array(
3472                 'blog' => &$blog,
3473                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3474                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3475                 'catid' => $catid
3476             )
3477         );
3478
3479         $this->pagehead();
3480         ?>
3481         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3482
3483         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, Entity::hsc($bname)) ?></p>
3484
3485         <ol>
3486             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, Entity::hsc($bshortname)) ?></a></li>
3487             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3488         </ol>
3489
3490         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, Entity::hsc($bshortname)) ?></a></h3>
3491
3492         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, Entity::hsc($bshortname)) ?></p>
3493 <pre><code>&lt;?php
3494
3495 $CONF['Self'] = '<b><?php echo Entity::hsc($bshortname)?>.php</b>';
3496
3497 include('<i>./config.php</i>');
3498
3499 selectBlog('<b><?php echo Entity::hsc($bshortname)?></b>');
3500 selector();
3501
3502 ?&gt;</code></pre>
3503
3504         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3505
3506         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3507
3508         <form action="index.php" method="post"><div>
3509             <input type="hidden" name="action" value="addnewlog2" />
3510             <?php $manager->addTicketHidden() ?>
3511             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3512             <table><tr>
3513                 <td><?php echo _EBLOG_URL?></td>
3514                 <td><input name="url" maxlength="100" size="40" value="<?php echo Entity::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3515             </tr><tr>
3516                 <td><?php echo _EBLOG_CREATE?></td>
3517                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3518             </tr></table>
3519         </div></form>
3520
3521         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3522
3523         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3524
3525         <form action="index.php" method="post"><div>
3526             <input type="hidden" name="action" value="addnewlog2" />
3527             <?php $manager->addTicketHidden() ?>
3528             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3529             <table><tr>
3530                 <td><?php echo _EBLOG_URL?></td>
3531                 <td><input name="url" maxlength="100" size="40" /></td>
3532             </tr><tr>
3533                 <td><?php echo _EBLOG_CREATE?></td>
3534                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3535             </tr></table>
3536         </div></form>
3537
3538         <?php       $this->pagefoot();
3539
3540     }
3541
3542     /**
3543      * @todo document this
3544      */
3545     function action_addnewlog2() {
3546         global $member, $manager;
3547
3548         $member->blogAdminRights($blogid) or $this->disallow();
3549
3550         $burl   = requestVar('url');
3551         $blogid = intRequestVar('blogid');
3552
3553         $blog =& $manager->getBlog($blogid);
3554         $blog->setURL(trim($burl));
3555         $blog->writeSettings();
3556
3557         $this->action_overview(_MSG_NEWBLOG);
3558     }
3559
3560     /**
3561      * @todo document this
3562      */
3563     function action_skinieoverview() {
3564         global $member, $DIR_LIBS, $manager;
3565
3566         $member->isAdmin() or $this->disallow();
3567
3568         // load skinie class
3569         include_once($DIR_LIBS . 'skinie.php');
3570
3571         $this->pagehead();
3572
3573         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3574
3575     ?>
3576         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3577
3578                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3579                 <?php                   global $DIR_SKINS;
3580
3581                     $candidates = SkinImport::searchForCandidates($DIR_SKINS);
3582
3583                     if (sizeof($candidates) > 0) {
3584                         ?>
3585                             <form method="post" action="index.php"><div>
3586                                 <input type="hidden" name="action" value="skinieimport" />
3587                                 <?php $manager->addTicketHidden() ?>
3588                                 <input type="hidden" name="mode" value="file" />
3589                                 <select name="skinfile" id="skinie_import_local">
3590                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3591                                         $html = Entity::hsc($skinfile);
3592                                         echo '<option value="',$html,'">',$skinname,'</option>';
3593                                     }
3594                                 ?>
3595                                 </select>
3596                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3597                             </div></form>
3598                         <?php                   } else {
3599                         echo _SKINIE_NOCANDIDATES;
3600                     }
3601                 ?>
3602                 </p>
3603
3604                 <p><em><?php echo _OR?></em></p>
3605
3606                 <form method="post" action="index.php"><p>
3607                     <?php $manager->addTicketHidden() ?>
3608                     <input type="hidden" name="action" value="skinieimport" />
3609                     <input type="hidden" name="mode" value="url" />
3610                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3611                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3612                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3613                 </p></form>
3614
3615
3616         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3617         <form method="post" action="index.php"><div>
3618             <input type="hidden" name="action" value="skinieexport" />
3619             <?php $manager->addTicketHidden() ?>
3620
3621             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3622
3623             <table><tr>
3624                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3625             </tr><tr>
3626     <?php       // show list of skins
3627         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3628         while ($skinObj = sql_fetch_object($res)) {
3629             $id = 'skinexp' . $skinObj->sdnumber;
3630             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3631             echo '<label for="',$id,'">',Entity::hsc($skinObj->sdname),'</label></td>';
3632             echo '<td>',Entity::hsc($skinObj->sddesc),'</td>';
3633             echo '</tr><tr>';
3634         }
3635
3636         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3637
3638         // show list of templates
3639         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3640         while ($templateObj = sql_fetch_object($res)) {
3641             $id = 'templateexp' . $templateObj->tdnumber;
3642             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3643             echo '<label for="',$id,'">',Entity::hsc($templateObj->tdname),'</label></td>';
3644             echo '<td>',Entity::hsc($templateObj->tddesc),'</td>';
3645             echo '</tr><tr>';
3646         }
3647
3648     ?>
3649                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3650             </tr><tr>
3651                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3652             </tr><tr>
3653                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3654             </tr><tr>
3655                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3656             </tr></table>
3657         </div></form>
3658
3659     <?php
3660         $this->pagefoot();
3661
3662     }
3663
3664     /**
3665      * @todo document this
3666      */
3667     function action_skinieimport() {
3668         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3669
3670         $member->isAdmin() or $this->disallow();
3671
3672         // load skinie class
3673         include_once($DIR_LIBS . 'skinie.php');
3674
3675         $skinFileRaw= postVar('skinfile');
3676         $mode       = postVar('mode');
3677
3678         $importer = new SkinImport();
3679
3680         // get full filename
3681         if ($mode == 'file')
3682         {
3683             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3684
3685             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3686             if (!file_exists($skinFile))
3687                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3688         } else {
3689             $skinFile = $skinFileRaw;
3690         }
3691
3692         // read only metadata
3693         $error = $importer->readFile($skinFile, 1);
3694
3695         // clashes
3696         $skinNameClashes = $importer->checkSkinNameClashes();
3697         $templateNameClashes = $importer->checkTemplateNameClashes();
3698         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3699
3700         if ($error) $this->error($error);
3701
3702         $this->pagehead();
3703
3704         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3705         ?>
3706         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3707
3708         <ul>
3709             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3710             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3711             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3712             <?php
3713                 if ($hasNameClashes)
3714                 {
3715             ?>
3716             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3717             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3718             <?php
3719                 } // if (hasNameClashes)
3720             ?>
3721         </ul>
3722
3723         <form method="post" action="index.php"><div>
3724             <input type="hidden" name="action" value="skiniedoimport" />
3725             <?php $manager->addTicketHidden() ?>
3726             <input type="hidden" name="skinfile" value="<?php echo Entity::hsc(postVar('skinfile'))?>" />
3727             <input type="hidden" name="mode" value="<?php echo Entity::hsc($mode)?>" />
3728             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3729             <?php
3730                 if ($hasNameClashes)
3731                 {
3732             ?>
3733             <br />
3734             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3735             <?php
3736                 } // if (hasNameClashes)
3737             ?>
3738         </div></form>
3739
3740
3741         <?php
3742         $this->pagefoot();
3743     }
3744
3745     /**
3746      * @todo document this
3747      */
3748     function action_skiniedoimport() {
3749         global $member, $DIR_LIBS, $DIR_SKINS;
3750
3751         $member->isAdmin() or $this->disallow();
3752
3753         // load skinie class
3754         include_once($DIR_LIBS . 'skinie.php');
3755
3756         $skinFileRaw= postVar('skinfile');
3757         $mode       = postVar('mode');
3758
3759         $allowOverwrite = intPostVar('overwrite');
3760
3761         // get full filename
3762         if ($mode == 'file')
3763         {
3764             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3765
3766             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3767             if (!file_exists($skinFile))
3768                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3769
3770         } else {
3771             $skinFile = $skinFileRaw;
3772         }
3773
3774         $importer = new SkinImport();
3775
3776         $error = $importer->readFile($skinFile);
3777
3778         if ($error)
3779             $this->error($error);
3780
3781         $error = $importer->writeToDatabase($allowOverwrite);
3782
3783         if ($error)
3784             $this->error($error);
3785
3786         $this->pagehead();
3787
3788         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3789     ?>
3790         <h2><?php echo _SKINIE_DONE?></h2>
3791
3792         <ul>
3793             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo Entity::hsc($importer->getInfo())?></p></li>
3794             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3795             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3796         </ul>
3797
3798     <?php       $this->pagefoot();
3799
3800     }
3801
3802     /**
3803      * @todo document this
3804      */
3805     function action_skinieexport() {
3806         global $member, $DIR_LIBS;
3807
3808         $member->isAdmin() or $this->disallow();
3809
3810         // load skinie class
3811         include_once($DIR_LIBS . 'skinie.php');
3812
3813         $aSkins = requestIntArray('skin');
3814         $aTemplates = requestIntArray('template');
3815
3816         if (!is_array($aTemplates)) $aTemplates = array();
3817         if (!is_array($aSkins)) $aSkins = array();
3818
3819         $skinList = array_keys($aSkins);
3820         $templateList = array_keys($aTemplates);
3821
3822         $info = postVar('info');
3823
3824         $exporter = new SkinExport();
3825         foreach ($skinList as $skinId) {
3826             $exporter->addSkin($skinId);
3827         }
3828         foreach ($templateList as $templateId) {
3829             $exporter->addTemplate($templateId);
3830         }
3831         $exporter->setInfo($info);
3832
3833         $exporter->export();
3834     }
3835
3836     /**
3837      * @todo document this
3838      */
3839     function action_templateoverview() {
3840         global $member, $manager;
3841
3842         $member->isAdmin() or $this->disallow();
3843
3844         $this->pagehead();
3845
3846         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3847
3848         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3849         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3850
3851         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3852         $template['content'] = 'templatelist';
3853         $template['tabindex'] = 10;
3854         showlist($query,'table',$template);
3855
3856         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3857
3858         ?>
3859         <form method="post" action="index.php"><div>
3860
3861         <input name="action" value="templatenew" type="hidden" />
3862         <?php $manager->addTicketHidden() ?>
3863         <table><tr>
3864             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3865             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3866         </tr><tr>
3867             <td><?php echo _TEMPLATE_DESC?></td>
3868             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3869         </tr><tr>
3870             <td><?php echo _TEMPLATE_CREATE?></td>
3871             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3872         </tr></table>
3873
3874         </div></form>
3875
3876         <?php
3877         $this->pagefoot();
3878     }
3879
3880     /**
3881      * @todo document this
3882      */
3883     function action_templateedit($msg = '') {
3884         global $member, $manager;
3885
3886         $templateid = intRequestVar('templateid');
3887
3888         $member->isAdmin() or $this->disallow();
3889
3890         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3891         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3892
3893         $this->pagehead($extrahead);
3894
3895         $templatename = Template::getNameFromId($templateid);
3896         $templatedescription = Template::getDesc($templateid);
3897         $template =& $manager->getTemplate($templatename);
3898
3899         ?>
3900         <p>
3901         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3902         </p>
3903
3904         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  Entity::hsc($templatename); ?>'</h2>
3905
3906         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3907         ?>
3908
3909         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3910
3911         <form method="post" action="index.php">
3912         <div>
3913
3914         <input type="hidden" name="action" value="templateupdate" />
3915         <?php $manager->addTicketHidden() ?>
3916         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3917
3918         <table><tr>
3919             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3920         </tr><tr>
3921             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3922             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  Entity::hsc($templatename) ?>" /></td>
3923         </tr><tr>
3924             <td><?php echo _TEMPLATE_DESC?></td>
3925             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  Entity::hsc($templatedescription) ?>" /></td>
3926         </tr><tr>
3927             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3928         </tr><tr>
3929             <td><?php echo _TEMPLATE_UPDATE?></td>
3930             <td>
3931                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3932                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3933             </td>
3934         </tr><tr>
3935             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3936 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3937     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3938     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3939     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3940     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3941     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3942 ?>
3943         </tr><tr>
3944             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3945 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3946     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3947     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3948     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3949     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3950     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3951     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3952 ?>
3953         </tr><tr>
3954             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3955 <?php
3956     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3957 ?>
3958         </tr><tr>
3959             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3960 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3961 ?>
3962         </tr><tr>
3963             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3964 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3965     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3966     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3967 ?>
3968         </tr><tr>
3969             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3970 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3971     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3972     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3973 ?>
3974         </tr><tr>
3975             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3976 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3977     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3978     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3979 ?>
3980         </tr><tr>
3981             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3982 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3983     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3984     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3985     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3986     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3987 ?>
3988         </tr><tr>
3989             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3990 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3991     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3992     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3993 ?>
3994         </tr><tr>
3995             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3996 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3997     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3998 ?>
3999         </tr><tr>
4000             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
4001 <?php
4002         $tab = 600;
4003         $pluginfields = array();
4004         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4005
4006         foreach ($pluginfields as $pfkey=>$pfvalue) {
4007             echo "</tr><tr>\n";
4008             echo '<th colspan="2">' . Entity::hen($pfkey) . "</th>\n";
4009             foreach ($pfvalue as $pffield=>$pfdesc) {
4010                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
4011             }
4012         }
4013 ?>
4014         </tr><tr>
4015             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
4016         </tr><tr>
4017             <td><?php echo _TEMPLATE_UPDATE?></td>
4018             <td>
4019                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
4020                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
4021             </td>
4022         </tr></table>
4023
4024         </div>
4025         </form>
4026         <?php
4027         $this->pagefoot();
4028     }
4029
4030     /**
4031      * @todo document this
4032      */
4033     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
4034         static $count = 1;
4035         if (!isset($template[$name])) $template[$name] = '';
4036     ?>
4037         </tr><tr>
4038             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
4039             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>
4040     <?php       $count++;
4041     }
4042
4043     /**
4044      * @todo document this
4045      */
4046     function action_templateupdate() {
4047         global $member,$manager;
4048
4049         $templateid = intRequestVar('templateid');
4050
4051         $member->isAdmin() or $this->disallow();
4052
4053         $name = postVar('tname');
4054         $desc = postVar('tdesc');
4055
4056         if (!isValidTemplateName($name))
4057             $this->error(_ERROR_BADTEMPLATENAME);
4058
4059         if ((Template::getNameFromId($templateid) != $name) && Template::exists($name))
4060             $this->error(_ERROR_DUPTEMPLATENAME);
4061
4062
4063         $name = sql_real_escape_string($name);
4064         $desc = sql_real_escape_string($desc);
4065
4066         // 1. Remove all template parts
4067         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4068         sql_query($query);
4069
4070         // 2. Update description
4071         $query =  'UPDATE '.sql_table('template_desc').' SET'
4072                . " tdname='" . $name . "',"
4073                . " tddesc='" . $desc . "'"
4074                . " WHERE tdnumber=" . $templateid;
4075         sql_query($query);
4076
4077         // 3. Add non-empty template parts
4078         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4079         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4080         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4081         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4082         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4083         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4084         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4085         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4086         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4087         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4088         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4089         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4090         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4091         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4092         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4093         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4094         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4095         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4096         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4097         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4098         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4099         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4100         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4101         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4102         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4103         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4104         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4105         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4106         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4107         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4108         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4109         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4110         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4111         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4112
4113         $pluginfields = array();
4114         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4115         foreach ($pluginfields as $pfkey=>$pfvalue) {
4116             foreach ($pfvalue as $pffield=>$pfdesc) {
4117                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4118             }
4119         }
4120
4121         // jump back to template edit
4122         $this->action_templateedit(_TEMPLATE_UPDATED);
4123
4124     }
4125
4126         /**
4127          * Admin::addToTemplate()
4128          *
4129          * @param       Integer $id     ID for template
4130          * @param       String  $partname       parts name
4131          * @param       String  $content        template contents
4132          * @return      Integer record index
4133          *
4134          */
4135         function addToTemplate($id, $partname, $content)
4136         {
4137                 // don't add empty parts:
4138                 if ( !trim($content) )
4139                 {
4140                         return -1;
4141                 }
4142
4143                 $partname = sql_real_escape_string($partname);
4144                 $content = sql_real_escape_string($content);
4145
4146                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s')";
4147                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);
4148                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4149                 return sql_insert_id();
4150         }
4151
4152     /**
4153      * @todo document this
4154      */
4155     function action_templatedelete() {
4156         global $member, $manager;
4157
4158         $member->isAdmin() or $this->disallow();
4159
4160         $templateid = intRequestVar('templateid');
4161         // TODO: check if template can be deleted
4162
4163         $this->pagehead();
4164
4165         $name = Template::getNameFromId($templateid);
4166         $desc = Template::getDesc($templateid);
4167
4168         ?>
4169             <h2><?php echo _DELETE_CONFIRM?></h2>
4170
4171             <p>
4172             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo Entity::hsc($name)?></b> (<?php echo  Entity::hsc($desc) ?>)
4173             </p>
4174
4175             <form method="post" action="index.php"><div>
4176                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4177                 <?php $manager->addTicketHidden() ?>
4178                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4179                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4180             </div></form>
4181         <?php
4182         $this->pagefoot();
4183     }
4184
4185     /**
4186      * @todo document this
4187      */
4188     function action_templatedeleteconfirm() {
4189         global $member, $manager;
4190
4191         $templateid = intRequestVar('templateid');
4192
4193         $member->isAdmin() or $this->disallow();
4194
4195         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4196
4197         // 1. delete description
4198         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4199
4200         // 2. delete parts
4201         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4202
4203         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4204
4205         $this->action_templateoverview();
4206     }
4207
4208     /**
4209      * @todo document this
4210      */
4211     function action_templatenew() {
4212         global $member;
4213
4214         $member->isAdmin() or $this->disallow();
4215
4216         $name = postVar('name');
4217         $desc = postVar('desc');
4218
4219         if (!isValidTemplateName($name))
4220             $this->error(_ERROR_BADTEMPLATENAME);
4221
4222         if (Template::exists($name))
4223             $this->error(_ERROR_DUPTEMPLATENAME);
4224
4225         $newTemplateId = Template::createNew($name, $desc);
4226
4227         $this->action_templateoverview();
4228     }
4229
4230     /**
4231      * @todo document this
4232      */
4233     function action_templateclone() {
4234         global $member;
4235
4236         $templateid = intRequestVar('templateid');
4237
4238         $member->isAdmin() or $this->disallow();
4239
4240         // 1. read old template
4241         $name = Template::getNameFromId($templateid);
4242         $desc = Template::getDesc($templateid);
4243
4244         // 2. create desc thing
4245         $name = "cloned" . $name;
4246
4247         // if a template with that name already exists:
4248         if (Template::exists($name)) {
4249             $i = 1;
4250             while (Template::exists($name . $i))
4251                 $i++;
4252             $name .= $i;
4253         }
4254
4255         $newid = Template::createNew($name, $desc);
4256
4257         // 3. create clone
4258         // go through parts of old template and add them to the new one
4259         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4260         while ($o = sql_fetch_object($res)) {
4261             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4262         }
4263
4264         $this->action_templateoverview();
4265     }
4266
4267         /**
4268          * Admin::action_skinoverview()
4269          *
4270          * @param       void
4271          * @return      void
4272          */
4273         public function action_skinoverview()
4274         {
4275                 global $member, $manager;
4276
4277                 $member->isAdmin() or $this->disallow();
4278
4279                 $this->pagehead();
4280
4281                 echo '<p><a href="index.php?action=manage">(' . _BACKTOMANAGE . ")</a></p>\n";
4282                 echo '<h2>' . _SKIN_EDIT_TITLE . "</h2>\n";
4283                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . "</h3>\n";
4284
4285                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname;';
4286                 $template['content'] = 'skinlist';
4287                 $template['tabindex'] = 10;
4288
4289                 showlist($query,'table',$template);
4290
4291                 echo '<h3>' . _SKIN_NEW_TITLE . "</h3>\n";
4292                 echo "<form method=\"post\" action=\"index.php\">\n";
4293                 echo "<div>\n";
4294                 echo "<input name=\"action\" value=\"skinnew\" type=\"hidden\" />\n";
4295
4296                 $manager->addTicketHidden() . "\n";
4297
4298                 echo "<table frame=\"box\" rules=\"all\" summary=\"skinoverview\">\n";
4299                 echo "<tr>\n";
4300                 echo "<td>" . _SKIN_NAME;
4301                 echo help('shortnames');
4302                 echo "</td>\n";
4303                 echo "<td><input name=\"name\" tabindex=\"10010\" maxlength=\"20\" size=\"20\" /></td>\n";
4304                 echo "</tr>\n";
4305                 echo "<tr>\n";
4306                 echo "<td>" . _SKIN_DESC . "</td>\n";
4307                 echo "<td><input name=\"desc\" tabindex=\"10020\" maxlength=\"200\" size=\"50\" /></td>\n";
4308                 echo "</tr>\n";
4309                 echo "<tr>\n";
4310                 echo '<td>' . _SKIN_CREATE . "</td>\n";
4311                 echo '<td><input type="submit" tabindex="10030" value="' . _SKIN_CREATE_BTN . '" onclick="return checkSubmit();" />' . "</td>\n";
4312                 echo "</tr>\n";
4313                 echo "</table>\n";
4314
4315                 echo "</div>\n";
4316                 echo "</form>\n";
4317
4318                 $this->pagefoot();
4319                 return;
4320         }
4321
4322     /**
4323      * @todo document this
4324      */
4325     function action_skinnew() {
4326         global $member;
4327
4328         $member->isAdmin() or $this->disallow();
4329
4330         $name = trim(postVar('name'));
4331         $desc = trim(postVar('desc'));
4332
4333         if (!isValidSkinName($name))
4334             $this->error(_ERROR_BADSKINNAME);
4335
4336         if (Skin::exists($name))
4337             $this->error(_ERROR_DUPSKINNAME);
4338
4339         $newId = Skin::createNew($name, $desc);
4340
4341         $this->action_skinoverview();
4342     }
4343
4344         /**
4345          * Admin::action_skinedit()
4346          * @param       void
4347          * @return      void
4348          */
4349         public function action_skinedit()
4350         {
4351                 global $member, $manager;
4352
4353                 $skinid = intRequestVar('skinid');
4354
4355                 $member->isAdmin() or $this->disallow();
4356
4357                 $skin = new SKIN($skinid);
4358                 $friendlyNames = $skin->getFriendlyNames();
4359
4360                 $this->pagehead();
4361
4362                 echo "<p>";
4363                 echo '( <a href="index.php?action=skinoverview">' . _SKIN_BACK . "</a> )";
4364                 echo "</p>\n";
4365                 echo '<h2>' . _SKIN_EDITONE_TITLE . $skin->getName() . "</h2>\n";
4366
4367                 echo '<h3>' . _SKIN_PARTS_TITLE . "</h3>\n";
4368                 echo _SKIN_PARTS_MSG . "\n";
4369                 echo "<ul>\n";
4370
4371                 $tabindex = 10;
4372                 $types = array();
4373                 foreach ( $friendlyNames as $type => $friendly_name )
4374                 {
4375                         echo "<li>\n";
4376                         echo "<a tabindex=\"{$tabindex}\" href=\"index.php?action=skinedittype&amp;skinid={$skinid}&amp;type={$type}\">";
4377                         echo $friendly_name;
4378                         echo "</a>\n";
4379                         help("skinpart{$type}");
4380                         echo "</li>\n";
4381                         $tabindex++;
4382                 }
4383                 echo "</ul>\n";
4384
4385                 $query = "SELECT stype FROM %s WHERE stype NOT IN ('%s') and sdesc=%d;";
4386                 $query = sprintf($query, sql_table('skin'), implode("', '", array_keys($friendlyNames)) , $skinid);
4387                 $res = sql_query($query);
4388
4389                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4390                 echo "<form method=\"get\" action=\"index.php\">\n";
4391                 echo "<input type=\"hidden\" name=\"action\" value=\"skinedittype\" />\n";
4392                 echo "<input type=\"hidden\" name=\"skinid\" value=\"{$skinid}\" />\n";
4393                 echo "<input type=\"text\" name=\"type\" tabindex=\"89\" size=\"20\" maxlength=\"20\" />\n";
4394                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . "\" onclick=\"return checkSubmit();\" />\n";
4395                 echo "</form>\n";
4396
4397                 if ( $res && sql_num_rows($res) > 0 )
4398                 {
4399                         $tabstart = 75;
4400
4401                         echo '<ul>';
4402                         while ( $row = sql_fetch_assoc($res) )
4403                         {
4404                                 $tabstart++;
4405                                 echo "<li>\n";
4406                                 echo "<a tabindex=\"{$tabstart}\" href=\"index.php?action=skinedittype&amp;skinid={$skinid}&amp;type=" . Entity::hsc(strtolower($row['stype'])) . "\">";
4407                                 echo Entity::hsc(ucfirst($row['stype']));
4408                                 echo "</a>\n";
4409                                 $tabstart++;
4410                                 echo "(<a tabindex=\"{$tabstart}\" href=\"index.php?action=skinremovetype&amp;skinid={$skinid}&amp;type=" . Entity::hsc(strtolower($row['stype'])) . "\">";
4411                                 echo _LISTS_DELETE;
4412                                 echo "</a>)\n";
4413                                 echo "</li>\n";
4414                         }
4415                         echo '</ul>';
4416                 }
4417
4418                 echo '<h3>' . _SKIN_GENSETTINGS_TITLE . "</h3>\n";
4419                 echo "<form method=\"post\" action=\"index.php\">\n";
4420                 echo "<div>\n";
4421                 echo "<input type=\"hidden\" name=\"action\" value=\"skineditgeneral\" />\n";
4422                 $manager->addTicketHidden() . "\n";
4423                 echo "<input type=\"hidden\" name=\"skinid\" value=\"{$skinid}\" />\n";
4424
4425                 echo '<table frame="box" rules="all" summary="' . _SKIN_GENSETTINGS_TITLE . '">' . "\n";
4426                 echo "<tr>\n";
4427                 echo '<td>';
4428                 echo _SKIN_NAME;
4429                 help('shortnames');
4430                 echo "</td>\n";
4431                 echo '<td><input type="text" name="name" tabindex="90" value="' . Entity::hsc($skin->getName()) . '" maxlength="20" size="20" />' . "</td>\n";
4432                 echo "</tr>\n";
4433                 echo "<tr>\n";
4434                 echo '<td>' . _SKIN_DESC . "</td>\n";
4435                 echo '<td><input type="text" name="desc" tabindex="100" value="' . Entity::hsc($skin->getDescription()) . '" maxlength="200" size="50" />' . "</td>\n";
4436                 echo "</tr>\n";
4437                 echo "<tr>\n";
4438                 echo '<td>' . _SKIN_TYPE . "</td>\n";
4439                 echo '<td><input type="text" name="type" tabindex="110" value="' . Entity::hsc($skin->getContentType()) . '" maxlength="40" size="20" />' . "</td>\n";
4440                 echo "</tr>\n";
4441                 echo "<tr>\n";
4442                 echo '<td>';
4443                 echo _SKIN_INCLUDE_MODE;
4444                 help('includemode');
4445                 echo "</td>\n";
4446                 echo '<td>';
4447                 $this->input_yesno('inc_mode', $skin->getIncludeMode(), 120, 'skindir', 'normal', _PARSER_INCMODE_SKINDIR, _PARSER_INCMODE_NORMAL);
4448                 echo "</td>\n";
4449                 echo "</tr>\n";
4450                 echo "<tr>\n";
4451                 echo '<td>';
4452                 echo _SKIN_INCLUDE_PREFIX;
4453                 help('includeprefix');
4454                 echo "</td>\n";
4455                 echo '<td><input type="text" name="inc_prefix" tabindex="130" value="' . Entity::hsc($skin->getIncludePrefix()) . '" maxlength="40" size="20" />' . "</td>\n";
4456                 echo "</tr>\n";
4457                 echo "<tr>\n";
4458                 echo '<td>' . _SKIN_CHANGE . "</td>\n";
4459                 echo '<td><input type="submit" tabindex="140" value="' . _SKIN_CHANGE_BTN . '" onclick="return checkSubmit();" />' . "</td>\n";
4460                 echo "</tr>\n";
4461                 echo "</table>\n";
4462
4463                 echo "</div>\n";
4464                 echo "</form>\n";
4465                 $this->pagefoot();
4466                 return;
4467         }
4468
4469     /**
4470      * @todo document this
4471      */
4472     function action_skineditgeneral() {
4473         global $member;
4474
4475         $skinid = intRequestVar('skinid');
4476
4477         $member->isAdmin() or $this->disallow();
4478
4479         $name = postVar('name');
4480         $desc = postVar('desc');
4481         $type = postVar('type');
4482         $inc_mode = postVar('inc_mode');
4483         $inc_prefix = postVar('inc_prefix');
4484
4485         $skin = new SKIN($skinid);
4486
4487         // 1. Some checks
4488         if (!isValidSkinName($name))
4489             $this->error(_ERROR_BADSKINNAME);
4490
4491         if (($skin->getName() != $name) && Skin::exists($name))
4492             $this->error(_ERROR_DUPSKINNAME);
4493
4494         if (!$type) $type = 'text/html';
4495         if (!$inc_mode) $inc_mode = 'normal';
4496
4497         // 2. Update description
4498         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4499
4500         $this->action_skinedit();
4501
4502     }
4503
4504         /**
4505          * Admin::action_skinedittype()
4506          *
4507          * @param       string  $msg    message for pageheader
4508          * @return      void
4509          */
4510         public function action_skinedittype($msg = '')
4511         {
4512                 global $member, $manager;
4513
4514                 $skinid = intRequestVar('skinid');
4515                 $type = requestVar('type');
4516
4517                 $member->isAdmin() or $this->disallow();
4518
4519                 $type = trim($type);
4520                 $type = strtolower($type);
4521
4522                 if ( !isValidShortName($type) )
4523                 {
4524                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4525                 }
4526
4527                 $skin = new SKIN($skinid);
4528                 $friendlyNames = $skin->getFriendlyNames();
4529                 if ( !array_key_exists($type, $friendlyNames) || !isset($friendlyNames[$type]) )
4530                 {
4531                         $friendlyName = ucfirst($type);
4532                 }
4533                 else
4534                 {
4535                         $friendlyName = $friendlyNames[$type];
4536                 }
4537
4538                 $this->pagehead();
4539
4540                 echo '<p>(<a href="index.php?action=skinoverview">' . _SKIN_GOBACK . "</a>)</p>\n";
4541
4542                 echo '<h2>' . _SKIN_EDITPART_TITLE . " '" . Entity::hsc($skin->getName()) . "': " . Entity::hsc($friendlyName) . "</h2>\n";
4543
4544                 if ( $msg != '')
4545                 {
4546                         echo "<p>" . _MESSAGE . ": $msg</p>\n";
4547                 }
4548
4549                 echo "<form method=\"post\" action=\"index.php\">\n";
4550                 echo "<div>\n";
4551
4552                 echo "<input type=\"hidden\" name=\"action\" value=\"skinupdate\" />\n";
4553                 $manager->addTicketHidden() . "\n";
4554                 echo "<input type=\"hidden\" name=\"skinid\" value=\"{$skinid}\" />\n";
4555                 echo "<input type=\"hidden\" name=\"type\" value=\"{$type}\" />\n";
4556
4557                 echo '<input type="submit" value="' . _SKIN_UPDATE_BTN . '" onclick="return checkSubmit();" />' . "\n";
4558                 echo '<input type="reset" value="' . _SKIN_RESET_BTN . '" />' . "\n";
4559                 echo '(skin type: ' . Entity::hsc($friendlyName) . ")\n";
4560
4561                 if ( !in_array($type, array_keys($friendlyNames)) )
4562                 {
4563                         help('skinpartspecial');
4564                 }
4565                 else
4566                 {
4567                         help('skinpart' . $type);
4568                 }
4569                 echo "<br />\n";
4570
4571                 echo "<textarea class=\"skinedit\" tabindex=\"10\" rows=\"20\" cols=\"80\" name=\"content\">\n";
4572                 echo Entity::hsc($skin->getContent($type)) . "\n";
4573                 echo "</textarea>\n";
4574
4575                 echo "<br />\n";
4576                 echo '<input type="submit" tabindex="20" value="' . _SKIN_UPDATE_BTN . '" onclick="return checkSubmit();" />' . "\n";
4577                 echo '<input type="reset" value="' . _SKIN_RESET_BTN . '" />' . "\n";
4578                 echo '(skin type: ' . Entity::hsc($friendlyName) . ")\n";
4579
4580                 echo "<br />\n";
4581                 echo "<br />\n";
4582                 echo _SKIN_ALLOWEDVARS;
4583
4584                 $actions = $skin->getAllowedActionsForType($type);
4585
4586                 sort($actions);
4587
4588                 while ($current = array_shift($actions))
4589                 {
4590                         // skip deprecated vars
4591                         if ( in_array($current, array('ifcat', 'imagetext', 'vars')) )
4592                         {
4593                                 continue;
4594                         }
4595
4596                         echo helplink("skinvar-{$current}") . "{$current}</a>\n";
4597
4598                         if ( count($actions) != 0 )
4599                         {
4600                                 echo ", ";
4601                         }
4602                 }
4603
4604                 echo "<br />\n";
4605                 echo "<br />\n";
4606                 echo _SKINEDIT_ALLOWEDBLOGS;
4607
4608                 $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4609                 showlist($query, 'table', array('content'=>'shortblognames'));
4610
4611                 echo "<br />\n";
4612                 echo _SKINEDIT_ALLOWEDTEMPLATESS;
4613
4614                 $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4615                 showlist($query, 'table', array('content'=>'shortnames'));
4616
4617                 echo "</div>\n";
4618                 echo "</form>\n";
4619
4620                 $this->pagefoot();
4621
4622                 return;
4623         }
4624
4625     /**
4626      * @todo document this
4627      */
4628     function action_skinupdate() {
4629         global $member;
4630
4631         $skinid = intRequestVar('skinid');
4632         $content = trim(postVar('content'));
4633         $type = postVar('type');
4634
4635         $member->isAdmin() or $this->disallow();
4636
4637         $skin = new SKIN($skinid);
4638         $skin->update($type, $content);
4639
4640         $this->action_skinedittype(_SKIN_UPDATED);
4641     }
4642
4643     /**
4644      * @todo document this
4645      */
4646     function action_skindelete() {
4647         global $member, $manager, $CONF;
4648
4649         $skinid = intRequestVar('skinid');
4650
4651         $member->isAdmin() or $this->disallow();
4652
4653         // don't allow default skin to be deleted
4654         if ($skinid == $CONF['BaseSkin'])
4655             $this->error(_ERROR_DEFAULTSKIN);
4656
4657         // don't allow deletion of default skins for blogs
4658         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4659         $r = sql_query($query);
4660         if ($o = sql_fetch_object($r))
4661             $this->error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));
4662
4663         $this->pagehead();
4664
4665         $skin = new SKIN($skinid);
4666         $name = $skin->getName();
4667         $desc = $skin->getDescription();
4668
4669         ?>
4670             <h2><?php echo _DELETE_CONFIRM?></h2>
4671
4672             <p>
4673                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo Entity::hsc($name) ?></b> (<?php echo  Entity::hsc($desc)?>)
4674             </p>
4675
4676             <form method="post" action="index.php"><div>
4677                 <input type="hidden" name="action" value="skindeleteconfirm" />
4678                 <?php $manager->addTicketHidden() ?>
4679                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4680                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4681             </div></form>
4682         <?php
4683         $this->pagefoot();
4684     }
4685
4686     /**
4687      * @todo document this
4688      */
4689     function action_skindeleteconfirm() {
4690         global $member, $CONF, $manager;
4691
4692         $skinid = intRequestVar('skinid');
4693
4694         $member->isAdmin() or $this->disallow();
4695
4696         // don't allow default skin to be deleted
4697         if ($skinid == $CONF['BaseSkin'])
4698             $this->error(_ERROR_DEFAULTSKIN);
4699
4700         // don't allow deletion of default skins for blogs
4701         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4702         $r = sql_query($query);
4703         if ($o = sql_fetch_object($r))
4704             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4705
4706         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4707
4708         // 1. delete description
4709         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4710
4711         // 2. delete parts
4712         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4713
4714         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4715
4716         $this->action_skinoverview();
4717     }
4718
4719         /**
4720          * Admin::action_skinremovetype()
4721          *
4722          * @param       void
4723          * @return      void
4724          */
4725         public function action_skinremovetype()
4726         {
4727                 global $member, $manager, $CONF;
4728
4729                 $skinid = intRequestVar('skinid');
4730                 $skintype = requestVar('type');
4731
4732                 if ( !isValidShortName($skintype) )
4733                 {
4734                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4735                 }
4736
4737                 $member->isAdmin() or $this->disallow();
4738
4739                 // don't allow default skinparts to be deleted
4740                 $skin = new Skin($skinid);
4741                 $friendlyNames = $skin->getFriendlyNames();
4742                 if ( in_array($skintype, array_keys($friendlyNames)) )
4743                 {
4744                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4745                 }
4746
4747                 $name = $skin->getName();
4748                 $desc = $skin->getDescription();
4749
4750                 $this->pagehead();
4751
4752                 echo '<h2>' . _DELETE_CONFIRM . "</h2>\n";
4753                 echo "<p>\n";
4754                 echo _CONFIRMTXT_SKIN_PARTS_SPECIAL;
4755                 echo Entity::hsc($skintype);
4756                 echo  '(' . Entity::hsc($name) . ')</b>';
4757                 echo ' (' . Entity::hsc($desc) . ')';
4758                 echo "</p>\n";
4759
4760                 echo "<form method=\"post\" action=\"index.php\">\n";
4761                 echo "<div>\n";
4762                 echo "<input type=\"hidden\" name=\"action\" value=\"skinremovetypeconfirm\" />\n";
4763                 $manager->addTicketHidden();
4764                 echo "<input type=\"hidden\" name=\"skinid\" value=\"{$skinid}\" />\n";
4765                 echo '<input type="hidden" name="type" value="' . Entity::hsc($skintype) . '" />' . "\n";
4766                 echo '<input type="submit" tabindex="10" value="' . _DELETE_CONFIRM_BTN . '" />' . "\n";
4767                 echo "</div>\n";
4768                 echo "</form>\n";
4769                 $this->pagefoot();
4770                 return;
4771         }
4772
4773         /**
4774          * Admin::action_skinremovetypeconfirm()
4775          *
4776          * @param       void
4777          * @return      void
4778          */
4779         public function action_skinremovetypeconfirm()
4780         {
4781                 global $member, $CONF, $manager;
4782
4783                 $skinid = intRequestVar('skinid');
4784                 $skintype = requestVar('type');
4785
4786                 if ( !isValidShortName($skintype) )
4787                 {
4788                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4789                 }
4790
4791                 $member->isAdmin() or $this->disallow();
4792
4793                 // don't allow default skinparts to be deleted
4794                 $skin = new Skin($skinid);
4795                 $friendlyNames = $skin->getFriendlyNames();
4796                 if ( in_array($skintype, array_keys($friendlyNames)) )
4797                 {
4798                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4799                 }
4800
4801                 $data = array(
4802                         'skinid'        => $skinid,
4803                         'skintype'      => $skintype
4804                 );
4805                 $manager->notify('PreDeleteSkinPart', $data);
4806
4807                 // delete part
4808                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";
4809                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);
4810                 sql_query($query);
4811
4812                 $data = array(
4813                         'skinid'        => $skinid,
4814                         'skintype'      => $skintype
4815                 );
4816                 $manager->notify('PostDeleteSkinPart', $data);
4817
4818                 $this->action_skinedit();
4819                 return;
4820         }
4821
4822     /**
4823      * @todo document this
4824      */
4825     function action_skinclone() {
4826         global $member;
4827
4828         $skinid = intRequestVar('skinid');
4829
4830         $member->isAdmin() or $this->disallow();
4831
4832         // 1. read skin to clone
4833         $skin = new SKIN($skinid);
4834
4835         $name = "clone_" . $skin->getName();
4836
4837         // if a skin with that name already exists:
4838         if (Skin::exists($name)) {
4839             $i = 1;
4840             while (Skin::exists($name . $i))
4841                 $i++;
4842             $name .= $i;
4843         }
4844
4845         // 2. create skin desc
4846         $newid = Skin::createNew(
4847             $name,
4848             $skin->getDescription(),
4849             $skin->getContentType(),
4850             $skin->getIncludeMode(),
4851             $skin->getIncludePrefix()
4852         );
4853
4854         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4855         $res = sql_query($query);
4856         while ($row = sql_fetch_assoc($res)) {
4857             $this->skinclonetype($skin, $newid, $row['stype']);
4858         }
4859
4860         $this->action_skinoverview();
4861
4862     }
4863
4864         /**
4865          * Admin::skinclonetype()
4866          *
4867          * @param       String  $skin   Skin object
4868          * @param       Integer $newid  ID for this clone
4869          * @param       String  $type   type of skin
4870          * @return      Void
4871          */
4872         function skinclonetype($skin, $newid, $type)
4873         {
4874                 $newid = intval($newid);
4875                 $content = $skin->getContent($type);
4876
4877                 if ( $content )
4878                 {
4879                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";
4880                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);
4881                         sql_query($query);
4882                 }
4883                 return;
4884         }
4885
4886         /**
4887          * Admin::action_settingsedit()
4888          *
4889          * @param       Void
4890          * @return      Void
4891          */
4892         function action_settingsedit() {
4893                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4894
4895                 $member->isAdmin() or $this->disallow();
4896
4897                 $this->pagehead();
4898
4899                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4900                 ?>
4901
4902                 <h2><?php echo _SETTINGS_TITLE?></h2>
4903
4904                 <form action="index.php" method="post">
4905                 <div>
4906
4907                 <input type="hidden" name="action" value="settingsupdate" />
4908                 <?php $manager->addTicketHidden() ?>
4909
4910                 <table><tr>
4911                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4912                 </tr><tr>
4913                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4914                         <td>
4915                                 <?php
4916                                         $query =  'SELECT bname as text, bnumber as value'
4917                                                    . ' FROM '.sql_table('blog');
4918                                         $template['name'] = 'DefaultBlog';
4919                                         $template['selected'] = $CONF['DefaultBlog'];
4920                                         $template['tabindex'] = 10;
4921                                         showlist($query,'select',$template);
4922                                 ?>
4923                         </td>
4924                 </tr><tr>
4925                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4926                         <td>
4927                                 <?php
4928                                         $query =  'SELECT sdname as text, sdnumber as value'
4929                                                    . ' FROM '.sql_table('skin_desc');
4930                                         $template['name'] = 'BaseSkin';
4931                                         $template['selected'] = $CONF['BaseSkin'];
4932                                         $template['tabindex'] = 1;
4933                                         showlist($query,'select',$template);
4934                                 ?>
4935                         </td>
4936                 </tr><tr>
4937                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4938                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  Entity::hsc($CONF['AdminEmail']) ?>" /></td>
4939                 </tr><tr>
4940                         <td><?php echo _SETTINGS_SITENAME?></td>
4941                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  Entity::hsc($CONF['SiteName']) ?>" /></td>
4942                 </tr><tr>
4943                         <td><?php echo _SETTINGS_SITEURL?></td>
4944                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  Entity::hsc($CONF['IndexURL']) ?>" /></td>
4945                 </tr><tr>
4946                         <td><?php echo _SETTINGS_ADMINURL?></td>
4947                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  Entity::hsc($CONF['AdminURL']) ?>" /></td>
4948                 </tr><tr>
4949                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4950                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  Entity::hsc($CONF['PluginURL']) ?>" /></td>
4951                 </tr><tr>
4952                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4953                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  Entity::hsc($CONF['SkinsURL']) ?>" /></td>
4954                 </tr><tr>
4955                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4956                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  Entity::hsc($CONF['ActionURL']) ?>" /></td>
4957                 </tr><tr>
4958                         <td><?php echo _SETTINGS_LOCALE?> <?php help('locale'); ?>
4959                         </td>
4960                         <td>
4961                                 <select name="Locale" tabindex="10050">
4962                         <?php
4963                                 $locales = i18n::get_available_locale_list();
4964                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4965                                 {
4966                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4967                                 }
4968                                 else
4969                                 {
4970                                         echo "<option value=\"\">en_Latn_US</option>\n";
4971                                 }
4972
4973                                 foreach ( $locales as $locale )
4974                                 {
4975                                         if ( $locale == 'en_Latn_US' )
4976                                         {
4977                                                 continue;
4978                                         }
4979                                         if ( $locale == i18n::get_current_locale() )
4980                                         {
4981                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4982                                         }
4983                                         else
4984                                         {
4985                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4986                                         }
4987                                 }
4988                         ?>
4989                         </select>
4990
4991                         </td>
4992                 </tr><tr>
4993                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4994                         </td>
4995                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4996                                         <br />
4997                                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  Entity::hsc($CONF['DisableSiteURL'])?>" />
4998                         </td>
4999                 </tr><tr>
5000                         <td><?php echo _SETTINGS_DIRS?></td>
5001                         <td><?php echo  Entity::hsc($DIR_NUCLEUS) ?>
5002                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
5003                 </tr><tr>
5004                         <td><?php echo _SETTINGS_DBLOGIN?></td>
5005                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
5006                 </tr><tr>
5007                         <td>
5008                         <?php
5009                                 echo _SETTINGS_JSTOOLBAR
5010                                 /* =_SETTINGS_DISABLEJS
5011
5012                                         I temporary changed the meaning of DisableJsTools, until I can find a good
5013                                         way to select the javascript version to use
5014
5015                                         now, its:
5016                                                 0 : IE
5017                                                 1 : all javascript disabled
5018                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
5019                                 */
5020                            ?>
5021                         </td>
5022                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
5023                                 <select name="DisableJsTools" tabindex="10075">
5024                         <?php                              $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
5025                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
5026                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
5027                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
5028                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
5029                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
5030                         ?>
5031                                 </select>
5032                         </td>
5033                 </tr><tr>
5034                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
5035                                            <td><?php
5036
5037                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
5038                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
5039
5040                                            echo ' ', _SETTINGS_URLMODE_HELP;
5041
5042                                                          ?>
5043
5044                                            </td>
5045                 </tr><tr>
5046                         <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
5047                                            <td><?php
5048
5049                                                 $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
5050
5051                                                          ?>
5052
5053                                            </td>
5054                 </tr><tr>
5055                         <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
5056                         <td>
5057                         <?php
5058                                 if (!array_key_exists('DefaultListSize',$CONF)) {
5059                                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
5060                                         $CONF['DefaultListSize'] = 10;
5061                                 }
5062                         ?>
5063                                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  Entity::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
5064                         </td>
5065                 </tr><tr>
5066                         <td><?php echo _SETTINGS_ADMINCSS?>
5067                         </td>
5068                         <td>
5069
5070                                 <select name="AdminCSS" tabindex="10080">
5071                                 <?php                      // show a dropdown list of all available admin css files
5072                                 global $DIR_NUCLEUS;
5073
5074                                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
5075
5076                                 while ($filename = readdir($dirhandle) )
5077                                 {
5078
5079                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
5080                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
5081
5082                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
5083                                         {
5084
5085                                                 $name = $matches[1];
5086                                                 echo "<option value=\"$name\"";
5087
5088                                                 if ($name == $CONF['AdminCSS'])
5089                                                 {
5090                                                         echo " selected=\"selected\"";
5091                                                 }
5092
5093                                                 echo ">$name</option>";
5094
5095                                         }
5096
5097                                 }
5098
5099                                 closedir($dirhandle);
5100
5101                                 ?>
5102                                 </select>
5103
5104                         </td>
5105                 </tr><tr>
5106                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
5107                 </tr><tr>
5108                         <td><?php echo _SETTINGS_MEDIADIR?></td>
5109                         <td><?php echo  Entity::hsc($DIR_MEDIA) ?>
5110                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
5111                                 <?php                              if (!is_dir($DIR_MEDIA))
5112                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
5113                                         if (!is_readable($DIR_MEDIA))
5114                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
5115                                         if (!is_writeable($DIR_MEDIA))
5116                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
5117                                 ?>
5118                         </td>
5119                 </tr><tr>
5120                         <td><?php echo _SETTINGS_MEDIAURL?></td>
5121                         <td>
5122                                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  Entity::hsc($CONF['MediaURL']) ?>" />
5123                         </td>
5124                 </tr><tr>
5125                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
5126                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
5127                 </tr><tr>
5128                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
5129                         <td>
5130                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  Entity::hsc($CONF['AllowedTypes']) ?>" />
5131                         </td>
5132                 </tr><tr>
5133                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
5134                         <td>
5135                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  Entity::hsc($CONF['MaxUploadSize']) ?>" />
5136                         </td>
5137                 </tr><tr>
5138                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
5139                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
5140
5141                 </tr><tr>
5142                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
5143                 </tr><tr>
5144                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
5145                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
5146                 </tr><tr>
5147                         <td><?php echo _SETTINGS_ALLOWCREATE?>
5148                                 <?php help('allowaccountcreation'); ?>
5149                         </td>
5150                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
5151                         </td>
5152                 </tr><tr>
5153                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
5154                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
5155                         </td>
5156                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
5157                         </td>
5158                 </tr><tr>
5159                         <td><?php echo _SETTINGS_MEMBERMSGS?>
5160                                 <?php help('messageservice'); ?>
5161                         </td>
5162                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
5163                         </td>
5164                 </tr><tr>
5165                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
5166                                 <?php help('messageservice'); ?>
5167                         </td>
5168                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
5169                         </td>
5170                 </tr><tr>
5171                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5172                                 <?php help('protectmemnames'); ?>
5173                         </td>
5174                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5175                         </td>
5176
5177
5178
5179                 </tr><tr>
5180                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5181                 </tr><tr>
5182                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5183                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  Entity::hsc($CONF['CookiePrefix'])?>" /></td>
5184                 </tr><tr>
5185                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5186                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  Entity::hsc($CONF['CookieDomain'])?>" /></td>
5187                 </tr><tr>
5188                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
5189                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  Entity::hsc($CONF['CookiePath'])?>" /></td>
5190                 </tr><tr>
5191                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
5192                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5193                 </tr><tr>
5194                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
5195                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5196                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5197                         </td>
5198                 </tr><tr>
5199                         <td><?php echo _SETTINGS_LASTVISIT?></td>
5200                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5201
5202
5203
5204                 </tr><tr>
5205                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5206                 </tr><tr>
5207                         <td><?php echo _SETTINGS_UPDATE?></td>
5208                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5209                 </tr></table>
5210
5211                 </div>
5212                 </form>
5213
5214                 <?php
5215                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5216
5217                         $manager->notify(
5218                                 'GeneralSettingsFormExtras',
5219                                 array()
5220                         );
5221
5222                 $this->pagefoot();
5223         }
5224
5225         /**
5226          * Admin::action_settingsupdate()
5227          * Update $CONFIG and redirect
5228          *
5229          * @param       void
5230          * @return      void
5231          */
5232         function action_settingsupdate() {
5233                 global $member, $CONF;
5234
5235                 $member->isAdmin() or $this->disallow();
5236
5237                 // check if email address for admin is valid
5238                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5239                 {
5240                         $this->error(_ERROR_BADMAILADDRESS);
5241                 }
5242
5243                 // save settings
5244                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5245                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5246                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5247                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5248                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5249                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5250                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5251                 $this->updateConfig('Locale',              postVar('Locale'));
5252                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5253                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5254                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5255                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5256                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5257                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5258                 $this->updateConfig('SiteName',          postVar('SiteName'));
5259                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5260                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5261                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5262                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5263                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5264                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5265                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5266                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5267                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5268                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5269                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5270                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5271                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5272                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5273                 $this->updateConfig('URLMode',            postVar('URLMode'));
5274                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5275                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5276                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5277                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5278
5279                 // load new config and redirect (this way, the new locale will be used is necessary)
5280                 // note that when changing cookie settings, this redirect might cause the user
5281                 // to have to log in again.
5282                 getConfig();
5283                 redirect($CONF['AdminURL'] . '?action=manage');
5284                 exit;
5285         }
5286
5287         /**
5288          * Admin::action_systemoverview()
5289          * Output system overview
5290          *
5291          * @param       void
5292          * @return      void
5293          */
5294         function action_systemoverview()
5295         {
5296                 global $member, $nucleus, $CONF;
5297
5298                 $this->pagehead();
5299
5300                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5301
5302                 if ( $member->isLoggedIn() && $member->isAdmin() )
5303                 {
5304                         // Information about the used PHP and MySQL installation
5305                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5306
5307                         // Version of PHP MySQL
5308                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5309                         echo "<thead>\n";
5310                         echo "<tr>\n";
5311                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5312                         echo "</tr>\n";
5313                         echo "</thead>\n";
5314                         echo "<tbody>\n";
5315                         echo "<tr>\n";
5316                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5317                         echo '<td>' . phpversion() . "</td>\n";
5318                         echo "</tr>\n";
5319                         echo "<tr>\n";
5320                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5321                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5322                         echo "</tr>\n";
5323                         echo "</tbody>\n";
5324                         echo "</table>\n\n";
5325
5326                         // Important PHP settings
5327                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5328                         echo "<thead>\n";
5329                         echo "<tr>\n";
5330                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5331                         echo "</tr>\n";
5332                         echo "</thead>\n";
5333                         echo "<tbody>\n";
5334                         echo "<tr>\n";
5335                         echo '<td>magic_quotes_gpc' . "</td>\n";
5336                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5337                         echo '<td>' . $mqg . "</td>\n";
5338                         echo "</tr>\n";
5339                         echo "<tr>\n";
5340                         echo '<td>magic_quotes_runtime' . "</td>\n";
5341                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5342                         echo '<td>' . $mqr . "</td>\n";
5343                         echo "</tr>\n";
5344                         echo "<tr>\n";
5345                         echo '<td>register_globals' . "</td>\n";
5346                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5347                         echo '<td>' . $rg . "</td>\n";
5348                         echo "</tr>\n";
5349                         echo "</tbody>\n";
5350                         echo "</table>\n\n";
5351
5352                         // Information about GD library
5353                         $gdinfo = gd_info();
5354                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5355                         echo "<thead>\n";
5356                         echo "<tr>\n";
5357                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5358                         echo "</tr>\n";
5359                         echo "</thead>\n";
5360                         echo "<tbody>\n";
5361                         foreach ( $gdinfo as $key=>$value )
5362                         {
5363                                 if ( is_bool($value) )
5364                                 {
5365                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5366                                 }
5367                                 else
5368                                 {
5369                                         $value = Entity::hsc($value);
5370                                 }
5371                                 echo "<tr>\n";
5372                                 echo '<td>' . $key . "</td>\n";
5373                                 echo '<td>' . $value . "</td>\n";
5374                                 echo "</tr>\n";
5375                         }
5376                         echo "</tbody>\n";
5377                         echo "</table>\n\n";
5378
5379                         // Check if special modules are loaded
5380                         ob_start();
5381                         phpinfo(INFO_MODULES);
5382                         $im = ob_get_contents();
5383                         ob_clean();
5384                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5385                         echo "<thead>\n";
5386                         echo "<tr>";
5387                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5388                         echo "</tr>\n";
5389                         echo "<tbody>\n";
5390                         echo "<tr>\n";
5391                         echo '<td>mod_rewrite' . "</td>\n";
5392                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5393                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5394                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5395                         echo '<td>' . $modrewrite . "</td>\n";
5396                         echo "</tr>\n";
5397                         echo "</tbody>\n";
5398                         echo "</table>\n\n";
5399
5400                         // Information about the used Nucleus CMS
5401                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5402                         global $nucleus;
5403                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5404                         $np = getNucleusPatchLevel();
5405                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5406                         echo "<thead>\n";
5407                         echo "<tr>\n";
5408                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5409                         echo "</tr>\n";
5410                         echo "</thead>\n";
5411                         echo "<tbody>\n";
5412                         echo "<tr>\n";
5413                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5414                         echo '<td>' . $nv . "</td>\n";
5415                         echo "</tr>\n";
5416                         echo "<tr>\n";
5417                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5418                         echo '<td>' . $np . "</td>\n";
5419                         echo "</tr>\n";
5420                         echo "</tbody>\n";
5421                         echo "</table>\n\n";
5422
5423                         // Important settings of the installation
5424                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5425                         echo "<thead>\n";
5426                         echo "<tr>\n";
5427                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5428                         echo "</tr>\n";
5429                         echo "</thead>\n";
5430                         echo "<tbody>\n";
5431                         echo "<tr>\n";
5432                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5433                         echo '<td>' . $CONF['Self'] . "</td>\n";
5434                         echo "</tr>\n";
5435                         echo "<tr>\n";
5436                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5437                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5438                         echo "</tr>\n";
5439                         echo "<tr>\n";
5440                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5441                         $ohs = $CONF['alertOnHeadersSent'] ?
5442                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5443                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5444                         echo '<td>' . $ohs . "</td>\n";
5445                         echo "</tr>\n";
5446                         echo "<tr>\n";
5447                         echo "<td>i18n::get_current_charset()</td>\n";
5448                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5449                         echo "</tr>\n";
5450                         echo "</tbody>\n";
5451                         echo "</table>\n\n";
5452
5453                         // Link to the online version test at the Nucleus CMS website
5454                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5455                         if ( $nucleus['codename'] != '')
5456                         {
5457                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5458                         }
5459                         else
5460                         {
5461                                 $codenamestring = '';
5462                         }
5463                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5464                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5465                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5466                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5467                         echo '</a>';
5468                 }
5469                 else
5470                 {
5471                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5472                 }
5473                 $this->pagefoot();
5474         }
5475
5476         /**
5477          * Admin::updateConfig()
5478          *
5479          * @param       string  $name
5480          * @param       string  $val
5481          * @return      integer return the ID in which the latest query posted
5482          */
5483         function updateConfig($name, $val)
5484         {
5485                 $name = sql_real_escape_string($name);
5486                 $val = trim(sql_real_escape_string($val));
5487
5488                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5489                 $query = sprintf($query, sql_table('config'), $val, $name);
5490                 sql_query($query) or die("Query error: " . sql_error());
5491                 return sql_insert_id();
5492         }
5493
5494         /**
5495          * Error message
5496          * @param string $msg message that will be shown
5497          */
5498         function error($msg)
5499         {
5500                 $this->pagehead();
5501
5502                 echo "<h2>Error!</h2>\n";
5503                 echo $msg;
5504                 echo "<br />\n";
5505                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5506                 $this->pagefoot();
5507                 exit;
5508         }
5509
5510         /**
5511          * Admin::disallow()
5512          * add error log and show error page
5513          *
5514          * @param       void
5515          * @return      void
5516          */
5517         function disallow()
5518         {
5519                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5520                 $this->error(_ERROR_DISALLOWED);
5521         }
5522
5523         /**
5524          * Admin::pagehead()
5525          * Output admin page head
5526          *
5527          * @param       void
5528          * @return      void
5529          */
5530         function pagehead($extrahead = '')
5531         {
5532                 global $member, $nucleus, $CONF, $manager;
5533
5534                 $manager->notify(
5535                         'AdminPrePageHead',
5536                         array(
5537                                 'extrahead' => &$extrahead,
5538                                 'action' => $this->action));
5539
5540                 $baseUrl = Entity::hsc($CONF['AdminURL']);
5541                 if ( !array_key_exists('AdminCSS',$CONF) )
5542                 {
5543                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5544                         $CONF['AdminCSS'] = 'original';
5545                 }
5546
5547                 /* HTTP 1.1 application for no caching */
5548                 header("Cache-Control: no-cache, must-revalidate");
5549                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5550
5551                 $root_element = 'html';
5552                 $charset = i18n::get_current_charset();
5553                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5554
5555                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5556                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5557                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5558                 echo "<head>\n";
5559                 echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";
5560                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5561                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5562                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5563                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5564                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5565                 echo "{$extrahead}\n";
5566                 echo "</head>\n\n";
5567                 echo "<body>\n";
5568                 echo "<div id=\"adminwrapper\">\n";
5569                 echo "<div class=\"header\">\n";
5570                 echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";
5571                 echo "</div>\n";
5572                 echo "<div id=\"container\">\n";
5573                 echo "<div id=\"content\">\n";
5574                 echo "<div class=\"loginname\">\n";
5575                 if ( $member->isLoggedIn() )
5576                 {
5577                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5578                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5579                 }
5580                 else
5581                 {
5582                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5583                 }
5584                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5585                 echo '(';
5586
5587                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5588                 {
5589                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5590                 }
5591                 else
5592                 {
5593                         $codenamestring = '';
5594                 }
5595
5596                 if ( $member->isLoggedIn() && $member->isAdmin() )
5597                 {
5598                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5599                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5600
5601                         $newestVersion = getLatestVersion();
5602                         $newestCompare = str_replace('/','.',$newestVersion);
5603                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5604                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5605                         {
5606                                 echo "<br />\n";
5607                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5608                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5609                                 echo "</a>";
5610                         }
5611                 }
5612                 else
5613                 {
5614                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5615                 }
5616                 echo ')';
5617                 echo '</div>';
5618                 return;
5619         }
5620
5621         /**
5622          * Admin::pagefoot()
5623          * Output admin page foot include quickmenu
5624          *
5625          * @param       void
5626          * @return      void
5627          */
5628         function pagefoot()
5629         {
5630                 global $action, $member, $manager;
5631
5632                 $manager->notify(
5633                         'AdminPrePageFoot',
5634                         array('action' => $this->action)
5635                 );
5636
5637                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5638                 {
5639                         echo '<h2>' . _LOGOUT . "</h2>\n";
5640                         echo "<ul>\n";
5641                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5642                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5643                         echo "</ul>\n";
5644                 }
5645
5646                 echo "<div class=\"foot\">\n";
5647                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5648                 echo '-';
5649                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5650                 echo "</div>\n";
5651
5652                 echo "<!-- content -->\n";
5653                 echo "<div id=\"quickmenu\">\n";
5654
5655                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5656                 {
5657                         echo "<ul>\n";
5658                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5659                         echo "</ul>\n";
5660
5661                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5662                         echo "<form method=\"get\" action=\"index.php\">\n";
5663                         echo "<p>\n";
5664                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5665
5666                         $showAll = requestVar('showall');
5667
5668                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5669                         {
5670                                 // Super-Admins have access to all blogs! (no add item support though)
5671                                 $query =  'SELECT bnumber as value, bname as text'
5672                                                 . ' FROM ' . sql_table('blog')
5673                                                 . ' ORDER BY bname';
5674                         }
5675                         else
5676                         {
5677                                 $query =  'SELECT bnumber as value, bname as text'
5678                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5679                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5680                                                 . ' ORDER BY bname';
5681                         }
5682                         $template['name'] = 'blogid';
5683                         $template['tabindex'] = 15000;
5684                         $template['extra'] = _QMENU_ADD_SELECT;
5685                         $template['selected'] = -1;
5686                         $template['shorten'] = 10;
5687                         $template['shortenel'] = '';
5688                         $template['javascript'] = 'onchange="return form.submit()"';
5689                         showlist($query,'select',$template);
5690
5691                         echo "</p>\n";
5692                         echo "</form>\n";
5693
5694                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5695                         echo "<ul>\n";
5696                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5697                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5698                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5699                         echo "</ul>\n";
5700
5701                         // ---- general settings ----
5702                         if ( $member->isAdmin() )
5703                         {
5704                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5705                                 echo "<ul>\n";
5706                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5707                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5708                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5709                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5710                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5711                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5712                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5713                                 echo "</ul>\n";
5714
5715                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5716                                 echo "<ul>\n";
5717                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5718                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5719                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5720                                 echo "</ul>\n";
5721                         }
5722
5723                         $aPluginExtras = array();
5724                         $manager->notify(
5725                                 'QuickMenu',
5726                                 array(
5727                                         'options' => &$aPluginExtras));
5728
5729                         if ( count($aPluginExtras) > 0 )
5730                         {
5731                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5732                                 echo "<ul>\n";
5733                                 foreach ( $aPluginExtras as $aInfo )
5734                                 {
5735                                         echo '<li><a href="' . Entity::hsc($aInfo['url']) . '" title="' . Entity::hsc($aInfo['tooltip']) . '">' . Entity::hsc($aInfo['title']) . "</a></li>\n";
5736                                 }
5737                                 echo "</ul>\n";
5738                         }
5739                 }
5740                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5741                 {
5742
5743                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5744                 }
5745                 else
5746                 {
5747                         // introduction text on login screen
5748                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5749                 }
5750
5751                 echo "<!-- quickmenu -->\n";
5752                 echo "</div>\n";
5753
5754                 echo "<!-- content -->\n";
5755                 echo "</div>\n";
5756
5757                 echo "<!-- container -->\n";
5758                 echo "</div>\n";
5759
5760                 echo "<!-- adminwrapper -->\n";
5761                 echo "</div>\n";
5762
5763                 echo "</body>\n";
5764                 echo "</html>\n";
5765                 return;
5766         }
5767
5768     /**
5769      * @todo document this
5770      */
5771     function action_regfile() {
5772         global $member, $CONF;
5773
5774         $blogid = intRequestVar('blogid');
5775
5776         $member->teamRights($blogid) or $this->disallow();
5777
5778         // header-code stolen from phpMyAdmin
5779         // REGEDIT and bookmarklet code stolen from GreyMatter
5780
5781         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5782
5783
5784         header('Content-Type: application/octetstream');
5785         header('Content-Disposition: filename="nucleus.reg"');
5786         header('Pragma: no-cache');
5787         header('Expires: 0');
5788
5789         echo "REGEDIT4\n";
5790         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5791         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5792         echo '"contexts"=hex:31';
5793     }
5794
5795     /**
5796      * @todo document this
5797      */
5798     function action_bookmarklet() {
5799         global $member, $manager;
5800
5801         $blogid = intRequestVar('blogid');
5802
5803         $member->teamRights($blogid) or $this->disallow();
5804
5805         $blog =& $manager->getBlog($blogid);
5806         $bm = getBookmarklet($blogid);
5807
5808         $this->pagehead();
5809
5810         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5811
5812         ?>
5813
5814         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5815
5816         <p>
5817         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5818         </p>
5819
5820         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5821         <p>
5822             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5823             <br />
5824             <br />
5825             <?php echo '<a href="' . Entity::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, Entity::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5826         </p>
5827
5828         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5829         <p>
5830             <?php
5831                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5832                 $url = $manager->addTicketToUrl($url);
5833             ?>
5834             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . Entity::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5835         </p>
5836
5837         <p>
5838             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5839         </p>
5840
5841         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5842         <p>
5843             <?php echo _BOOKMARKLET_DELETEBAR ?>
5844         </p>
5845
5846         <p>
5847             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5848         </p>
5849
5850         <ol>
5851             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5852             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5853             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5854             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5855             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5856         </ol>
5857
5858         <?php
5859         $this->pagefoot();
5860
5861     }
5862
5863     /**
5864      * @todo document this
5865      */
5866     function action_actionlog() {
5867         global $member, $manager;
5868
5869         $member->isAdmin() or $this->disallow();
5870
5871         $this->pagehead();
5872
5873         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5874
5875         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5876
5877         ?>
5878             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5879             <p><a href="<?php echo Entity::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5880         <?php
5881         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5882
5883         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5884         $template['content'] = 'actionlist';
5885         $amount = showlist($query,'table',$template);
5886
5887         $this->pagefoot();
5888
5889     }
5890
5891     /**
5892      * @todo document this
5893      */
5894     function action_banlist() {
5895         global $member, $manager;
5896
5897         $blogid = intRequestVar('blogid');
5898
5899         $member->blogAdminRights($blogid) or $this->disallow();
5900
5901         $blog =& $manager->getBlog($blogid);
5902
5903         $this->pagehead();
5904
5905         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5906
5907         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5908
5909         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5910         $template['content'] = 'banlist';
5911         $amount = showlist($query,'table',$template);
5912
5913         if ($amount == 0)
5914             echo _BAN_NONE;
5915
5916         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5917         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5918
5919
5920         $this->pagefoot();
5921
5922     }
5923
5924     /**
5925      * @todo document this
5926      */
5927     function action_banlistdelete() {
5928         global $member, $manager;
5929
5930         $blogid = intRequestVar('blogid');
5931         $iprange = requestVar('iprange');
5932
5933         $member->blogAdminRights($blogid) or $this->disallow();
5934
5935         $blog =& $manager->getBlog($blogid);
5936         $banBlogName =  Entity::hsc($blog->getName());
5937
5938         $this->pagehead();
5939         ?>
5940             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5941
5942             <form method="post" action="index.php">
5943
5944             <h3><?php echo _BAN_IPRANGE?></h3>
5945
5946             <p>
5947                 <?php echo _CONFIRMTXT_BAN?> <?php echo Entity::hsc($iprange) ?>
5948                 <input name="iprange" type="hidden" value="<?php echo Entity::hsc($iprange)?>" />
5949             </p>
5950
5951             <h3><?php echo _BAN_BLOGS?></h3>
5952
5953             <div>
5954                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5955                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5956                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5957                 <br />
5958                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5959             </div>
5960
5961             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5962
5963             <div>
5964                 <?php $manager->addTicketHidden() ?>
5965                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5966                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5967             </div>
5968
5969             </form>
5970         <?php
5971         $this->pagefoot();
5972     }
5973
5974     /**
5975      * @todo document this
5976      */
5977     function action_banlistdeleteconfirm() {
5978         global $member, $manager;
5979
5980         $blogid = intPostVar('blogid');
5981         $allblogs = postVar('allblogs');
5982         $iprange = postVar('iprange');
5983
5984         $member->blogAdminRights($blogid) or $this->disallow();
5985
5986         $deleted = array();
5987
5988         if (!$allblogs) {
5989             if (Ban::removeBan($blogid, $iprange))
5990                 array_push($deleted, $blogid);
5991         } else {
5992             // get blogs fot which member has admin rights
5993             $adminblogs = $member->getAdminBlogs();
5994             foreach ($adminblogs as $blogje) {
5995                 if (Ban::removeBan($blogje, $iprange))
5996                     array_push($deleted, $blogje);
5997             }
5998         }
5999
6000         if (sizeof($deleted) == 0)
6001             $this->error(_ERROR_DELETEBAN);
6002
6003         $this->pagehead();
6004
6005         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
6006         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
6007         echo "<p>"._BAN_REMOVED_TEXT."</p>";
6008
6009         echo "<ul>";
6010         foreach ($deleted as $delblog) {
6011             $b =& $manager->getBlog($delblog);
6012             echo "<li>" . Entity::hsc($b->getName()). "</li>";
6013         }
6014         echo "</ul>";
6015
6016         $this->pagefoot();
6017
6018     }
6019
6020     /**
6021      * @todo document this
6022      */
6023     function action_banlistnewfromitem() {
6024         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
6025     }
6026
6027     /**
6028      * @todo document this
6029      */
6030     function action_banlistnew($blogid = '') {
6031         global $member, $manager;
6032
6033         if ($blogid == '')
6034             $blogid = intRequestVar('blogid');
6035
6036         $ip = requestVar('ip');
6037
6038         $member->blogAdminRights($blogid) or $this->disallow();
6039
6040         $blog =& $manager->getBlog($blogid);
6041
6042         $this->pagehead();
6043         ?>
6044         <h2><?php echo _BAN_ADD_TITLE?></h2>
6045
6046
6047         <form method="post" action="index.php">
6048
6049         <h3><?php echo _BAN_IPRANGE?></h3>
6050
6051         <p><?php echo _BAN_IPRANGE_TEXT?></p>
6052
6053         <div class="note">
6054             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
6055             <?php echo _BAN_EXAMPLE_TEXT ?>
6056         </div>
6057
6058         <div>
6059         <?php
6060         if ($ip) {
6061             $iprangeVal = Entity::hsc($ip);
6062         ?>
6063             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
6064             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
6065             <br />
6066             <input name="iprange" type="radio" value="custom" id="ip_custom" />
6067             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
6068             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
6069         <?php
6070         } else {
6071             echo "<input name='iprange' value='custom' type='hidden' />";
6072             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
6073         }
6074         ?>
6075         </div>
6076
6077         <h3><?php echo _BAN_BLOGS?></h3>
6078
6079         <p><?php echo _BAN_BLOGS_TEXT?></p>
6080
6081         <div>
6082             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
6083             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo Entity::hsc($blog->getName())?>'</label>
6084             <br />
6085             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
6086         </div>
6087
6088         <h3><?php echo _BAN_REASON_TITLE?></h3>
6089
6090         <p><?php echo _BAN_REASON_TEXT?></p>
6091
6092         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
6093
6094         <h3><?php echo _BAN_ADD_TITLE?></h3>
6095
6096         <div>
6097             <input name="action" type="hidden" value="banlistadd" />
6098             <?php $manager->addTicketHidden() ?>
6099             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
6100         </div>
6101
6102         </form>
6103
6104         <?php       $this->pagefoot();
6105     }
6106
6107     /**
6108      * @todo document this
6109      */
6110     function action_banlistadd() {
6111         global $member;
6112
6113         $blogid =       intPostVar('blogid');
6114         $allblogs =     postVar('allblogs');
6115         $iprange =      postVar('iprange');
6116         if ($iprange == "custom")
6117             $iprange = postVar('customiprange');
6118         $reason =       postVar('reason');
6119
6120         $member->blogAdminRights($blogid) or $this->disallow();
6121
6122         // TODO: check IP range validity
6123
6124         if (!$allblogs) {
6125             if (!Ban::addBan($blogid, $iprange, $reason))
6126                 $this->error(_ERROR_ADDBAN);
6127         } else {
6128             // get blogs fot which member has admin rights
6129             $adminblogs = $member->getAdminBlogs();
6130             $failed = 0;
6131             foreach ($adminblogs as $blogje) {
6132                 if (!Ban::addBan($blogje, $iprange, $reason))
6133                     $failed = 1;
6134             }
6135             if ($failed)
6136                 $this->error(_ERROR_ADDBAN);
6137         }
6138
6139         $this->action_banlist();
6140
6141     }
6142
6143     /**
6144      * @todo document this
6145      */
6146     function action_clearactionlog() {
6147         global $member;
6148
6149         $member->isAdmin() or $this->disallow();
6150
6151         ActionLog::clear();
6152
6153         $this->action_manage(_MSG_ACTIONLOGCLEARED);
6154     }
6155
6156     /**
6157      * @todo document this
6158      */
6159     function action_backupoverview() {
6160         global $member, $manager;
6161
6162         $member->isAdmin() or $this->disallow();
6163
6164         $this->pagehead();
6165
6166         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6167         ?>
6168         <h2><?php echo _BACKUPS_TITLE?></h2>
6169
6170         <h3><?php echo _BACKUP_TITLE?></h3>
6171
6172         <p><?php echo _BACKUP_INTRO?></p>
6173
6174         <form method="post" action="index.php"><p>
6175         <input type="hidden" name="action" value="backupcreate" />
6176         <?php $manager->addTicketHidden() ?>
6177
6178         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
6179         <br />
6180         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
6181         <br /><br />
6182         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
6183
6184         </p></form>
6185
6186         <div class="note"><?php echo _BACKUP_NOTE?></div>
6187
6188
6189         <h3><?php echo _RESTORE_TITLE?></h3>
6190
6191         <div class="note"><?php echo _RESTORE_NOTE?></div>
6192
6193         <p><?php echo _RESTORE_INTRO?></p>
6194
6195         <form method="post" action="index.php" enctype="multipart/form-data"><p>
6196             <input type="hidden" name="action" value="backuprestore" />
6197             <?php $manager->addTicketHidden() ?>
6198             <input name="backup_file" type="file" tabindex="30" />
6199             <br /><br />
6200             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
6201             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
6202             <br /><?php echo _RESTORE_WARNING?>
6203         </p></form>
6204
6205         <?php       $this->pagefoot();
6206     }
6207
6208         /**
6209          * Admin::action_backupcreate()
6210          * create file for backup
6211          *
6212          * @param               void
6213          * @return      void
6214          *
6215          */
6216         function action_backupcreate()
6217         {
6218                 global $member, $DIR_LIBS;
6219
6220                 $member->isAdmin() or $this->disallow();
6221
6222                 // use compression ?
6223                 $useGzip = (integer) postVar('gzip');
6224
6225                 include($DIR_LIBS . 'backup.php');
6226
6227                 // try to extend time limit
6228                 // (creating/restoring dumps might take a while)
6229                 @set_time_limit(1200);
6230
6231                 Backup::do_backup($useGzip);
6232                 exit;
6233         }
6234
6235         /**
6236          * Admin::action_backuprestore()
6237          * restoring from uploaded file
6238          *
6239          * @param               void
6240          * @return      void
6241          */
6242         function action_backuprestore()
6243         {
6244                 global $member, $DIR_LIBS;
6245
6246                 $member->isAdmin() or $this->disallow();
6247
6248                 if ( intPostVar('letsgo') != 1 )
6249                 {
6250                         $this->error(_ERROR_BACKUP_NOTSURE);
6251                 }
6252
6253                 include($DIR_LIBS . 'backup.php');
6254
6255                 // try to extend time limit
6256                 // (creating/restoring dumps might take a while)
6257                 @set_time_limit(1200);
6258
6259                 $message = Backup::do_restore();
6260                 if ( $message != '' )
6261                 {
6262                         $this->error($message);
6263                 }
6264                 $this->pagehead();
6265                 echo '<h2>' . _RESTORE_COMPLETE . "</h2>\n";
6266                 $this->pagefoot();
6267                 return;
6268         }
6269
6270         /**
6271          * Admin::action_pluginlist()
6272          * output the list of installed plugins
6273          *
6274          * @param       void
6275          * @return      void
6276          *
6277          */
6278         function action_pluginlist()
6279         {
6280                 global $DIR_PLUGINS, $member, $manager;
6281
6282                 // check if allowed
6283                 $member->isAdmin() or $this->disallow();
6284
6285                 $this->pagehead();
6286
6287                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6288
6289                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6290
6291                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6292
6293                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6294
6295                 $template['content'] = 'pluginlist';
6296                 $template['tabindex'] = 10;
6297                 showlist($query, 'table', $template);
6298
6299                 echo '<h3>' . _PLUGS_TITLE_UPDATE . "</h3>\n";
6300                 echo '<p>' . _PLUGS_TEXT_UPDATE . "</p>\n";
6301                 echo '<form method="post" action="index.php">' . "\n";
6302                 echo "<div>\n";
6303                 echo '<input type="hidden" name="action" value="pluginupdate" />' . "\n";
6304                 $manager->addTicketHidden();
6305                 echo '<input type="submit" value="' . _PLUGS_BTN_UPDATE . '" tabindex="20" />' . "\n";
6306                 echo "</div>\n";
6307                 echo "</form>\n";
6308
6309                 echo '<h3>' . _PLUGS_TITLE_NEW . "</h3>\n";
6310
6311                 // find a list of possibly non-installed plugins
6312                 $candidates = array();
6313                 $dirhandle = opendir($DIR_PLUGINS);
6314
6315                 while ( $filename = readdir($dirhandle) )
6316                 {
6317                         if ( preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6318                         {
6319                                 $name = $matches[1];
6320
6321                                 // only show in list when not yet installed
6322                                 $query = 'SELECT * FROM %s WHERE pfile = "NP_%s"';
6323                                 $query = sprintf($query, sql_table('plugin'), sql_real_escape_string($name));
6324                                 $res = sql_query($query);
6325
6326                                 if ( sql_num_rows($res) == 0 )
6327                                 {
6328                                         array_push($candidates, $name);
6329                                 }
6330                         }
6331                 }
6332
6333                 closedir($dirhandle);
6334
6335                 if ( sizeof($candidates) > 0 )
6336                 {
6337                         echo '<p>' . _PLUGS_ADD_TEXT . "</p>\n";
6338
6339                         echo '<form method="post" action="index.php">' . "\n";
6340                         echo "<div>\n";
6341                         echo '<input type="hidden" name="action" value="pluginadd" />' . "\n";
6342                         $manager->addTicketHidden();
6343                         echo '<select name="filename" tabindex="30">' . "\n";
6344
6345                         foreach ( $candidates as $name )
6346                         {
6347                                 echo '<option value="NP_',$name,'">',Entity::hsc($name),'</option>';
6348                         }
6349
6350                         echo "</select>\n";
6351                         echo '<input type="submit" tabindex="40" value="' . _PLUGS_BTN_INSTALL ."\" />\n";
6352                         echo "</div>\n";
6353                         echo "</form>\n";
6354                 }
6355                 else
6356                 {
6357                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6358                 }
6359
6360                 $this->pagefoot();
6361                 return;
6362         }
6363
6364     /**
6365      * @todo document this
6366      */
6367     function action_pluginhelp() {
6368         global $member, $manager, $DIR_PLUGINS, $CONF;
6369
6370         // check if allowed
6371         $member->isAdmin() or $this->disallow();
6372
6373         $plugid = intGetVar('plugid');
6374
6375         if (!$manager->pidInstalled($plugid))
6376             $this->error(_ERROR_NOSUCHPLUGIN);
6377
6378         $plugName = getPluginNameFromPid($plugid);
6379
6380         $this->pagehead();
6381
6382         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6383
6384         echo '<h2>',_PLUGS_HELP_TITLE,': ',Entity::hsc($plugName),'</h2>';
6385
6386         $plug =& $manager->getPlugin($plugName);
6387         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6388
6389         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6390             @readfile($helpFile);
6391         } else {
6392             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6393             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6394         }
6395
6396
6397         $this->pagefoot();
6398     }
6399
6400         /**
6401          * Admin::action_pluginadd()
6402          *
6403          * @param       Void
6404          * @return      Void
6405          *
6406          */
6407         function action_pluginadd()
6408         {
6409                 global $member, $manager, $DIR_PLUGINS;
6410
6411                 // check if allowed
6412                 $member->isAdmin() or $this->disallow();
6413
6414                 $name = postVar('filename');
6415
6416                 if ( $manager->pluginInstalled($name) )
6417                 {
6418                         $this->error(_ERROR_DUPPLUGIN);
6419                 }
6420
6421                 if ( !checkPlugin($name) )
6422                 {
6423                         $this->error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');
6424                 }
6425
6426                 // get number of currently installed plugins
6427                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6428                 $numCurrent = sql_num_rows($res);
6429
6430                 // plugin will be added as last one in the list
6431                 $newOrder = $numCurrent + 1;
6432
6433                 $manager->notify(
6434                         'PreAddPlugin',
6435                         array(
6436                                 'file' => &$name
6437                         )
6438                 );
6439
6440                 // do this before calling getPlugin (in case the plugin id is used there)
6441                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6442                 sql_query($query);
6443                 $iPid = sql_insert_id();
6444
6445                 $manager->clearCachedInfo('installedPlugins');
6446
6447                 // Load the plugin for condition checking and instalation
6448                 $plugin =& $manager->getPlugin($name);
6449
6450                 // check if it got loaded (could have failed)
6451                 if ( !$plugin )
6452                 {
6453                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6454                         $manager->clearCachedInfo('installedPlugins');
6455                         $this->error(_ERROR_PLUGIN_LOAD);
6456                 }
6457
6458                 // check if plugin needs a newer Nucleus version
6459                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )
6460                 {
6461                         // uninstall plugin again...
6462                         $this->deleteOnePlugin($plugin->getID());
6463
6464                         // ...and show error
6465                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));
6466                 }
6467
6468                 // check if plugin needs a newer Nucleus version
6469                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )
6470                 {
6471                         // uninstall plugin again...
6472                         $this->deleteOnePlugin($plugin->getID());
6473
6474                         // ...and show error
6475                         $this->error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6476                 }
6477
6478                 $pluginList = $plugin->getPluginDep();
6479                 foreach ( $pluginList as $pluginName )
6480                 {
6481                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6482                         if (sql_num_rows($res) == 0)
6483                         {
6484                                 // uninstall plugin again...
6485                                 $this->deleteOnePlugin($plugin->getID());
6486                                 $this->error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));
6487                         }
6488                 }
6489
6490                 // call the install method of the plugin
6491                 $plugin->install();
6492
6493                 $manager->notify(
6494                         'PostAddPlugin',
6495                         array(
6496                                 'plugin' => &$plugin
6497                         )
6498                 );
6499
6500                 // update all events
6501                 $this->action_pluginupdate();
6502                 return;
6503         }
6504
6505         /**
6506          * ADMIN:action_pluginupdate():
6507          *
6508          * @param       Void
6509          * @return      Void
6510          *
6511          */
6512         function action_pluginupdate()
6513         {
6514                 global $member, $manager, $CONF;
6515
6516                 // check if allowed
6517                 $member->isAdmin() or $this->disallow();
6518
6519                 // delete everything from plugin_events
6520                 sql_query('DELETE FROM '.sql_table('plugin_event'));
6521
6522                 // loop over all installed plugins
6523                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6524                 while ( $o = sql_fetch_object($res) )
6525                 {
6526                         $pid = $o->pid;
6527                         $plug =& $manager->getPlugin($o->pfile);
6528                         if ( $plug )
6529                         {
6530                                 $eventList = $plug->getEventList();
6531                                 foreach ( $eventList as $eventName )
6532                                 {
6533                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";
6534                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));
6535                                         sql_query($query);
6536                                 }
6537                         }
6538                 }
6539                 redirect($CONF['AdminURL'] . '?action=pluginlist');
6540                 return;
6541         }
6542
6543     /**
6544      * @todo document this
6545      */
6546     function action_plugindelete() {
6547         global $member, $manager;
6548
6549         // check if allowed
6550         $member->isAdmin() or $this->disallow();
6551
6552         $pid = intGetVar('plugid');
6553
6554         if (!$manager->pidInstalled($pid))
6555             $this->error(_ERROR_NOSUCHPLUGIN);
6556
6557         $this->pagehead();
6558         ?>
6559             <h2><?php echo _DELETE_CONFIRM?></h2>
6560
6561             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6562
6563             <form method="post" action="index.php"><div>
6564             <?php $manager->addTicketHidden() ?>
6565             <input type="hidden" name="action" value="plugindeleteconfirm" />
6566             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6567             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6568             </div></form>
6569         <?php
6570         $this->pagefoot();
6571     }
6572
6573     /**
6574      * @todo document this
6575      */
6576     function action_plugindeleteconfirm() {
6577         global $member, $manager, $CONF;
6578
6579         // check if allowed
6580         $member->isAdmin() or $this->disallow();
6581
6582         $pid = intPostVar('plugid');
6583
6584         $error = $this->deleteOnePlugin($pid, 1);
6585         if ($error) {
6586             $this->error($error);
6587         }
6588
6589         redirect($CONF['AdminURL'] . '?action=pluginlist');
6590 //              $this->action_pluginlist();
6591     }
6592
6593     /**
6594      * @todo document this
6595      */
6596     function deleteOnePlugin($pid, $callUninstall = 0) {
6597         global $manager;
6598
6599         $pid = intval($pid);
6600
6601         if (!$manager->pidInstalled($pid))
6602             return _ERROR_NOSUCHPLUGIN;
6603
6604         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6605
6606 /*              // call the unInstall method of the plugin
6607         if ($callUninstall) {
6608             $plugin =& $manager->getPlugin($name);
6609             if ($plugin) $plugin->unInstall();
6610         }*/
6611
6612         // check dependency before delete
6613         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6614         while($o = sql_fetch_object($res)) {
6615             $plug =& $manager->getPlugin($o->pfile);
6616             if ($plug)
6617             {
6618                 $depList = $plug->getPluginDep();
6619                 foreach ($depList as $depName)
6620                 {
6621                     if ($name == $depName)
6622                     {
6623                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6624                     }
6625                 }
6626             }
6627         }
6628
6629         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6630
6631         // call the unInstall method of the plugin
6632         if ($callUninstall) {
6633             $plugin =& $manager->getPlugin($name);
6634             if ($plugin) $plugin->unInstall();
6635         }
6636
6637         // delete all subscriptions
6638         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6639
6640         // delete all options
6641         // get OIDs from plugin_option_desc
6642         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6643         $aOIDs = array();
6644         while ($o = sql_fetch_object($res)) {
6645             array_push($aOIDs, $o->oid);
6646         }
6647
6648         // delete from plugin_option and plugin_option_desc
6649         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6650         if (count($aOIDs) > 0)
6651             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6652
6653         // update order numbers
6654         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6655         $o = sql_fetch_object($res);
6656         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6657
6658         // delete row
6659         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6660
6661         $manager->clearCachedInfo('installedPlugins');
6662         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6663
6664         return '';
6665     }
6666
6667     /**
6668      * @todo document this
6669      */
6670     function action_pluginup() {
6671         global $member, $manager, $CONF;
6672
6673         // check if allowed
6674         $member->isAdmin() or $this->disallow();
6675
6676         $plugid = intGetVar('plugid');
6677
6678         if (!$manager->pidInstalled($plugid))
6679             $this->error(_ERROR_NOSUCHPLUGIN);
6680
6681         // 1. get old order number
6682         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6683         $o = sql_fetch_object($res);
6684         $oldOrder = $o->porder;
6685
6686         // 2. calculate new order number
6687         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6688
6689         // 3. update plug numbers
6690         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6691         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6692
6693         //$this->action_pluginlist();
6694         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6695         redirect($CONF['AdminURL'] . '?action=pluginlist');
6696     }
6697
6698     /**
6699      * @todo document this
6700      */
6701     function action_plugindown() {
6702         global $member, $manager, $CONF;
6703
6704         // check if allowed
6705         $member->isAdmin() or $this->disallow();
6706
6707         $plugid = intGetVar('plugid');
6708         if (!$manager->pidInstalled($plugid))
6709             $this->error(_ERROR_NOSUCHPLUGIN);
6710
6711         // 1. get old order number
6712         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6713         $o = sql_fetch_object($res);
6714         $oldOrder = $o->porder;
6715
6716         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6717         $maxOrder = sql_num_rows($res);
6718
6719         // 2. calculate new order number
6720         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6721
6722         // 3. update plug numbers
6723         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6724         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6725
6726         //$this->action_pluginlist();
6727         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6728         redirect($CONF['AdminURL'] . '?action=pluginlist');
6729     }
6730
6731         /**
6732          * Admin::action_pluginoptions()
6733          *
6734          * Output Plugin option page
6735          *
6736          * @access      public
6737          * @param       string $message message when fallbacked
6738          * @return      void
6739          *
6740          */
6741         public function action_pluginoptions($message = '')
6742         {
6743                 global $member, $manager;
6744
6745                 // check if allowed
6746                 $member->isAdmin() or $this->disallow();
6747
6748                 $pid = (integer) requestVar('plugid');
6749                 if ( !$manager->pidInstalled($pid) )
6750                 {
6751                         $this->error(_ERROR_NOSUCHPLUGIN);
6752                 }
6753
6754                 $pname = getPluginNameFromPid($pid);
6755
6756                 /* just for including translation */
6757                 $manager->getPlugin($pname);
6758
6759                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6760                 $this->pagehead($extrahead);
6761                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6762                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($pname)) . "</h2>\n";
6763
6764                 if ( isset($message) )
6765                 {
6766                         echo $message;
6767                 }
6768
6769                 echo "<form action=\"index.php\" method=\"post\">\n";
6770                 echo "<div>\n";
6771                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6772                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6773                 $manager->addTicketHidden();
6774
6775                 $aOptions = array();
6776                 $aOIDs = array();
6777                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6778                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6779                 $result = sql_query($query);
6780                 while ( $object = sql_fetch_object($result) )
6781                 {
6782                         array_push($aOIDs, $object->oid);
6783                         $aOptions[$object->oid] = array(
6784                                                 'oid' => $object->oid,
6785                                                 'value' => $object->odef,
6786                                                 'name' => $object->oname,
6787                                                 'description' => $object->odesc,
6788                                                 'type' => $object->otype,
6789                                                 'typeinfo' => $object->oextra,
6790                                                 'contextid' => 0
6791                         );
6792                 }
6793                 // fill out actual values
6794                 if ( count($aOIDs) > 0 )
6795                 {
6796                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6797                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6798                         $result = sql_query($query);
6799                         while ( $object = sql_fetch_object($result) )
6800                         {
6801                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6802                         }
6803                 }
6804
6805                 // call plugins
6806                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6807                 $manager->notify('PrePluginOptionsEdit',$data);
6808
6809                 $template['content'] = 'plugoptionlist';
6810                 $amount = showlist($aOptions,'table',$template);
6811                 if ( $amount == 0 )
6812                 {
6813                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6814                 }
6815                 echo "</div>\n";
6816                 echo "</form>\n";
6817                 $this->pagefoot();
6818
6819                 return;
6820         }
6821
6822         /**
6823          * Admin::action_pluginoptionsupdate()
6824          *
6825          * Update plugin options and fallback to plugin option page
6826          *
6827          * @access      public
6828          * @param       void
6829          * @return      void
6830          */
6831         public function action_pluginoptionsupdate()
6832         {
6833                 global $member, $manager;
6834
6835                 // check if allowed
6836                 $member->isAdmin() or $this->disallow();
6837
6838                 $pid = (integer) requestVar('plugid');
6839                 if ( !$manager->pidInstalled($pid) )
6840                 {
6841                         $this->error(_ERROR_NOSUCHPLUGIN);
6842                 }
6843
6844                 $aOptions = requestArray('plugoption');
6845                 NucleusPlugin::apply_plugin_options($aOptions);
6846
6847                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6848
6849                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6850                 return;
6851         }
6852
6853         /**
6854          * Admin::_insertPluginOptions()
6855          *
6856          * Output plugin option field
6857          *
6858          * @access      public
6859          * @param string        $context        plugin option context
6860          * @param integer       $contextid      plugin option context id
6861          * @return      void
6862          */
6863         public function _insertPluginOptions($context, $contextid = 0)
6864         {
6865                 // get all current values for this contextid
6866                 // (note: this might contain doubles for overlapping contextids)
6867                 $aIdToValue = array();
6868                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6869                 while ( $object = sql_fetch_object($res) )
6870                 {
6871                         $aIdToValue[$object->oid] = $object->ovalue;
6872                 }
6873
6874                 // get list of oids per pid
6875                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6876                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6877                 $res = sql_query($query);
6878                 $aOptions = array();
6879                 while ( $object = sql_fetch_object($res) )
6880                 {
6881                         if (in_array($object->oid, array_keys($aIdToValue)))
6882                         {
6883                                 $value = $aIdToValue[$object->oid];
6884                         }
6885                         else
6886                         {
6887                                 $value = $object->odef;
6888                         }
6889
6890                         array_push($aOptions, array(
6891                                 'pid' => $object->pid,
6892                                 'pfile' => $object->pfile,
6893                                 'oid' => $object->oid,
6894                                 'value' => $value,
6895                                 'name' => $object->oname,
6896                                 'description' => $object->odesc,
6897                                 'type' => $object->otype,
6898                                 'typeinfo' => $object->oextra,
6899                                 'contextid' => $contextid,
6900                                 'extra' => ''));
6901                 }
6902
6903                 global $manager;
6904                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6905
6906                 $iPrevPid = -1;
6907                 foreach ($aOptions as $aOption)
6908                 {
6909                         // new plugin?
6910                         if ( $iPrevPid != $aOption['pid'] )
6911                         {
6912                                 $iPrevPid = $aOption['pid'];
6913                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6914                                 {
6915                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6916                                 }
6917                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, Entity::hsc($aOption['pfile'])).'</th></tr>';
6918                         }
6919
6920                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6921                         if ( @$meta['access'] != 'hidden' )
6922                         {
6923                                 echo '<tr>';
6924                                 listplug_plugOptionRow($aOption);
6925                                 echo '</tr>';
6926                         }
6927                 }
6928                 return;
6929         }
6930
6931         /**
6932          * Admin::input_yesno()
6933          * Output input elements with radio attribute for yes/no options
6934          *
6935          * @param       string  $name   name attribute
6936          * @param       string  $value_current  current value attribute
6937          * @param       integer $tabindex       tab index
6938          * @param       string  $value_yes      value attribute for yes option
6939          * @param       string  $value_no       value attribute for no option
6940          * @param       string  $text_yes       child text element for yes option
6941          * @param       string  $text_no        child text element for no option
6942          * @param       boolean $isAdmin        have admin right or not
6943          * @return      void
6944          */
6945         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6946         {
6947                 $id = preg_replace('#\[|\]#', '-', $name);
6948                 $id_yes = $id . $value_yes;
6949                 $id_no  = $id . $value_no;
6950
6951                 /* yes option */
6952                 echo '<input type="radio" id="' . Entity::hsc($id_yes) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_yes) . '"';
6953                 if ( $name=="admin" )
6954                 {
6955                         echo ' onclick="selectCanLogin(true);"';
6956                 }
6957                 if ( $value_current == $value_yes )
6958                 {
6959                         echo " tabindex='$tabindex' checked='checked'";
6960                 }
6961                 echo " />\n";
6962                 echo '<label for="' . Entity::hsc($id_yes) . '">' . Entity::hsc($text_yes) . "</label>\n";
6963
6964                 /* no option */
6965                 echo '<input type="radio" id="' . Entity::hsc($id_no) . '" name="' . Entity::hsc($name) . '" value="' . Entity::hsc($value_no) . '"';
6966                 if ( $name=="admin" )
6967                 {
6968                         echo ' onclick="selectCanLogin(false);"';
6969                 }
6970                 if ( $value_current != $value_yes )
6971                 {
6972                         echo " tabindex='$tabindex' checked='checked'";
6973                 }
6974                 if ($isAdmin && $name=="canlogin")
6975                 {
6976                         echo ' disabled="disabled"';
6977                 }
6978                 echo " />\n";
6979                 echo '<label for="' . Entity::hsc($id_no) . '">' . Entity::hsc($text_no) . "</label>\n";
6980
6981                 return;
6982         }
6983 }