nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1626 2012-01-09 15:46:54Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN {
  28
  29     /**
  30      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  31      */
  32     var $action;
  33
  34     /**
  35      * Class constructor
  36      */
  37     function ADMIN() {
  38
  39     }
  40
  41     /**
  42      * Executes an action
  43      *
  44      * @param string $action action to be performed
  45      */
  46     function action($action) {
  47         global $CONF, $manager;
  48
  49         // list of action aliases
  50         $alias = array(
  51             'login' => 'overview',
  52             '' => 'overview'
  53         );
  54
  55         if (isset($alias[$action]))
  56             $action = $alias[$action];
  57
  58         $methodName = 'action_' . $action;
  59
  60         $this->action = strtolower($action);
  61
  62         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  63         // is an action that requires user interaction before something is actually done)
  64         // all safe actions are in this array:
  65         $aActionsNotToCheck = array(
  66             'showlogin',
  67             'login',
  68             'overview',
  69             'itemlist',
  70             'blogcommentlist',
  71             'bookmarklet',
  72             'blogsettings',
  73             'banlist',
  74             'deleteblog',
  75             'editmembersettings',
  76             'browseownitems',
  77             'browseowncomments',
  78             'createitem',
  79             'itemedit',
  80             'itemmove',
  81             'categoryedit',
  82             'categorydelete',
  83             'manage',
  84             'actionlog',
  85             'settingsedit',
  86             'backupoverview',
  87             'pluginlist',
  88             'createnewlog',
  89             'usermanagement',
  90             'skinoverview',
  91             'templateoverview',
  92             'skinieoverview',
  93             'itemcommentlist',
  94             'commentedit',
  95             'commentdelete',
  96             'banlistnewfromitem',
  97             'banlistdelete',
  98             'itemdelete',
  99             'manageteam',
 100             'teamdelete',
 101             'banlistnew',
 102             'memberedit',
 103             'memberdelete',
 104             'pluginhelp',
 105             'pluginoptions',
 106             'plugindelete',
 107             'skinedittype',
 108             'skinremovetype',
 109             'skindelete',
 110             'skinedit',
 111             'templateedit',
 112             'templatedelete',
 113             'activate',
 114             'systemoverview'
 115         );
 116 /*
 117         // the rest of the actions needs to be checked
 118         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 119 */
 120         if (!in_array($this->action, $aActionsNotToCheck))
 121         {
 122             if (!$manager->checkTicket())
 123                 $this->error(_ERROR_BADTICKET);
 124         }
 125
 126         if (method_exists($this, $methodName))
 127             call_user_func(array(&$this, $methodName));
 128         else
 129             $this->error(_BADACTION . i18n::hsc(" ($action)"));
 130
 131     }
 132
 133     /**
 134      * @todo document this
 135      */
 136     function action_showlogin() {
 137         global $error;
 138         $this->action_login($error);
 139     }
 140
 141     /**
 142      * @todo document this
 143      */
 144     function action_login($msg = '', $passvars = 1) {
 145         global $member;
 146
 147         // skip to overview when allowed
 148         if ($member->isLoggedIn() && $member->canLogin()) {
 149             $this->action_overview();
 150             exit;
 151         }
 152
 153         $this->pagehead();
 154
 155         echo '<h2>', _LOGIN ,'</h2>';
 156         if ($msg) echo _MESSAGE , ': ', i18n::hsc($msg);
 157         ?>
 158
 159         <form action="index.php" method="post"><p>
 160         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 161         <br />
 162         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 163         <br />
 164         <input name="action" value="login" type="hidden" />
 165         <br />
 166         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 167         <br />
 168         <small>
 169             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 170             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 171         </small>
 172         <?php           // pass through vars
 173
 174             $oldaction = postVar('oldaction');
 175             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 176                 passRequestVars();
 177             }
 178
 179
 180         ?>
 181         </p></form>
 182         <?php       $this->pagefoot();
 183     }
 184
 185
 186     /**
 187      * provides a screen with the overview of the actions available
 188      * @todo document parameter
 189      */
 190     function action_overview($msg = '') {
 191         global $member;
 192
 193         $this->pagehead();
 194
 195         if ($msg)
 196             echo _MESSAGE , ': ', $msg;
 197
 198         /* ---- add items ---- */
 199         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 200
 201         $showAll = requestVar('showall');
 202
 203         if (($member->isAdmin()) && ($showAll == 'yes')) {
 204             // Super-Admins have access to all blogs! (no add item support though)
 205             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 206                    . ' FROM ' . sql_table('blog')
 207                    . ' ORDER BY bname';
 208         } else {
 209             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 210                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 211                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 212                    . ' ORDER BY bname';
 213         }
 214         $template['content'] = 'bloglist';
 215         $template['superadmin'] = $member->isAdmin();
 216         $amount = showlist($query,'table',$template);
 217
 218         if (($showAll != 'yes') && ($member->isAdmin())) {
 219             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 220             if ($total > $amount)
 221                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 222         }
 223
 224         if ($amount == 0)
 225             echo _OVERVIEW_NOBLOGS;
 226
 227         if ($amount != 0) {
 228             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 229             $query =  'SELECT ititle, inumber, bshortname'
 230                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 231                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 232             $template['content'] = 'draftlist';
 233             $amountdrafts = showlist($query, 'table', $template);
 234             if ($amountdrafts == 0)
 235                 echo _OVERVIEW_NODRAFTS;
 236         }
 237
 238                 if ($amount != 0) {
 239                         $yrBlogs = $member->getAdminBlogs();
 240                         if ($showAll != 'yes') {
 241                                 $admBlogs = array();
 242                                 foreach ($yrBlogs as $value) {
 243                                         if ($member->isBlogAdmin(intval($value))) {
 244                                                 $admBlogs[] = intval($value);
 245                                         }
 246                                 }
 247                                 $yrBlogs = $admBlogs;
 248                         }
 249
 250                         if (count($yrBlogs) > 0) {
 251                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 252                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 253                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 254                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 255                                            . ' ORDER BY iblog ASC';
 256                                 $template['content'] = 'otherdraftlist';
 257                                 $amountdrafts = showlist($query, 'table', $template);
 258                                 if ($amountdrafts == 0)
 259                                         echo _OVERVIEW_NODRAFTS;
 260                         }
 261         }
 262
 263         /* ---- user settings ---- */
 264         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 265         echo '<ul>';
 266         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 267         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 268         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 269         echo '</ul>';
 270
 271         /* ---- general settings ---- */
 272         if ($member->isAdmin()) {
 273             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 274             echo '<ul>';
 275             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 276             echo '</ul>';
 277         }
 278
 279
 280         $this->pagefoot();
 281     }
 282
 283     /**
 284      * Returns a link to a weblog
 285      * @param object BLOG
 286      */
 287     function bloglink(&$blog) {
 288         return '<a href="'.i18n::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. i18n::hsc( $blog->getName() ) .'</a>';
 289     }
 290
 291     /**
 292      * @todo document this
 293      */
 294     function action_manage($msg = '') {
 295         global $member;
 296
 297         $member->isAdmin() or $this->disallow();
 298
 299         $this->pagehead();
 300
 301         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 302
 303         if ($msg)
 304             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 305
 306
 307         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 308
 309         echo '<ul>';
 310         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 311         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 312         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 313         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 314         echo '</ul>';
 315
 316         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 317         echo '<ul>';
 318         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 319         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 320         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 321         echo '</ul>';
 322
 323         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 324         echo '<ul>';
 325         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 326         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 327         echo '</ul>';
 328
 329         $this->pagefoot();
 330     }
 331
 332     /**
 333      * @todo document this
 334      */
 335     function action_itemlist($blogid = '') {
 336         global $member, $manager, $CONF;
 337
 338         if ($blogid == '')
 339             $blogid = intRequestVar('blogid');
 340
 341         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 342
 343         $this->pagehead();
 344         $blog =& $manager->getBlog($blogid);
 345
 346         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 347         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 348
 349         // start index
 350         if (postVar('start'))
 351             $start = intPostVar('start');
 352         else
 353             $start = 0;
 354
 355         if ($start == 0)
 356             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 357
 358         // amount of items to show
 359         if (postVar('amount'))
 360             $amount = intPostVar('amount');
 361         else {
 362             $amount = intval($CONF['DefaultListSize']);
 363             if ($amount < 1)
 364                 $amount = 10;
 365         }
 366
 367         $search = postVar('search');    // search through items
 368
 369         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 370                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 371                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 372
 373         if ($search)
 374             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 375
 376         // non-blog-admins can only edit/delete their own items
 377         if (!$member->blogAdminRights($blogid))
 378             $query .= ' and iauthor=' . $member->getID();
 379
 380
 381         $query .= ' ORDER BY itime DESC'
 382                 . " LIMIT $start,$amount";
 383
 384         $template['content'] = 'itemlist';
 385         $template['now'] = $blog->getCorrectTime(time());
 386
 387         $manager->loadClass("ENCAPSULATE");
 388         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 389         $navList->showBatchList('item',$query,'table',$template);
 390
 391
 392         $this->pagefoot();
 393     }
 394
 395     /**
 396      * @todo document this
 397      */
 398     function action_batchitem() {
 399         global $member, $manager;
 400
 401         // check if logged in
 402         $member->isLoggedIn() or $this->disallow();
 403
 404         // more precise check will be done for each performed operation
 405
 406         // get array of itemids from request
 407         $selected = requestIntArray('batch');
 408         $action = requestVar('batchaction');
 409
 410         // Show error when no items were selected
 411         if (!is_array($selected) || sizeof($selected) == 0)
 412             $this->error(_BATCH_NOSELECTION);
 413
 414         // On move: when no destination blog/category chosen, show choice now
 415         $destCatid = intRequestVar('destcatid');
 416         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 417             $this->batchMoveSelectDestination('item',$selected);
 418
 419         // On delete: check if confirmation has been given
 420         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 421             $this->batchAskDeleteConfirmation('item',$selected);
 422
 423         $this->pagehead();
 424
 425         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 426         echo '<h2>',_BATCH_ITEMS,'</h2>';
 427         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 428         echo '<ul>';
 429
 430
 431         // walk over all itemids and perform action
 432         foreach ($selected as $itemid) {
 433             $itemid = intval($itemid);
 434             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 435
 436             // perform action, display errors if needed
 437             switch($action) {
 438                 case 'delete':
 439                     $error = $this->deleteOneItem($itemid);
 440                     break;
 441                 case 'move':
 442                     $error = $this->moveOneItem($itemid, $destCatid);
 443                     break;
 444                 default:
 445                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 446             }
 447
 448             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 449             echo '</li>';
 450         }
 451
 452         echo '</ul>';
 453         echo '<b>',_BATCH_DONE,'</b>';
 454
 455         $this->pagefoot();
 456
 457
 458     }
 459
 460     /**
 461      * @todo document this
 462      */
 463     function action_batchcomment() {
 464         global $member;
 465
 466         // check if logged in
 467         $member->isLoggedIn() or $this->disallow();
 468
 469         // more precise check will be done for each performed operation
 470
 471         // get array of itemids from request
 472         $selected = requestIntArray('batch');
 473         $action = requestVar('batchaction');
 474
 475         // Show error when no items were selected
 476         if (!is_array($selected) || sizeof($selected) == 0)
 477             $this->error(_BATCH_NOSELECTION);
 478
 479         // On delete: check if confirmation has been given
 480         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 481             $this->batchAskDeleteConfirmation('comment',$selected);
 482
 483         $this->pagehead();
 484
 485         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 486         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 487         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 488         echo '<ul>';
 489
 490         // walk over all itemids and perform action
 491         foreach ($selected as $commentid) {
 492             $commentid = intval($commentid);
 493             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 494
 495             // perform action, display errors if needed
 496             switch($action) {
 497                 case 'delete':
 498                     $error = $this->deleteOneComment($commentid);
 499                     break;
 500                 default:
 501                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 502             }
 503
 504             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 505             echo '</li>';
 506         }
 507
 508         echo '</ul>';
 509         echo '<b>',_BATCH_DONE,'</b>';
 510
 511         $this->pagefoot();
 512
 513
 514     }
 515
 516     /**
 517      * @todo document this
 518      */
 519     function action_batchmember() {
 520         global $member;
 521
 522         // check if logged in and admin
 523         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 524
 525         // get array of itemids from request
 526         $selected = requestIntArray('batch');
 527         $action = requestVar('batchaction');
 528
 529         // Show error when no members selected
 530         if (!is_array($selected) || sizeof($selected) == 0)
 531             $this->error(_BATCH_NOSELECTION);
 532
 533         // On delete: check if confirmation has been given
 534         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 535             $this->batchAskDeleteConfirmation('member',$selected);
 536
 537         $this->pagehead();
 538
 539         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 540         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 541         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 542         echo '<ul>';
 543
 544         // walk over all itemids and perform action
 545         foreach ($selected as $memberid) {
 546             $memberid = intval($memberid);
 547             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 548
 549             // perform action, display errors if needed
 550             switch($action) {
 551                 case 'delete':
 552                     $error = $this->deleteOneMember($memberid);
 553                     break;
 554                 case 'setadmin':
 555                     // always succeeds
 556                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 557                     $error = '';
 558                     break;
 559                 case 'unsetadmin':
 560                     // there should always remain at least one super-admin
 561                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 562                     if (sql_num_rows($r) < 2)
 563                         $error = _ERROR_ATLEASTONEADMIN;
 564                     else
 565                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 566                     break;
 567                 default:
 568                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 569             }
 570
 571             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 572             echo '</li>';
 573         }
 574
 575         echo '</ul>';
 576         echo '<b>',_BATCH_DONE,'</b>';
 577
 578         $this->pagefoot();
 579
 580
 581     }
 582
 583     /**
 584      * @todo document this
 585      */
 586     function action_batchteam() {
 587         global $member;
 588
 589         $blogid = intRequestVar('blogid');
 590
 591         // check if logged in and admin
 592         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 593
 594         // get array of itemids from request
 595         $selected = requestIntArray('batch');
 596         $action = requestVar('batchaction');
 597
 598         // Show error when no members selected
 599         if (!is_array($selected) || sizeof($selected) == 0)
 600             $this->error(_BATCH_NOSELECTION);
 601
 602         // On delete: check if confirmation has been given
 603         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 604             $this->batchAskDeleteConfirmation('team',$selected);
 605
 606         $this->pagehead();
 607
 608         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 609
 610         echo '<h2>',_BATCH_TEAM,'</h2>';
 611         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 612         echo '<ul>';
 613
 614         // walk over all itemids and perform action
 615         foreach ($selected as $memberid) {
 616             $memberid = intval($memberid);
 617             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 618
 619             // perform action, display errors if needed
 620             switch($action) {
 621                 case 'delete':
 622                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 623                     break;
 624                 case 'setadmin':
 625                     // always succeeds
 626                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 627                     $error = '';
 628                     break;
 629                 case 'unsetadmin':
 630                     // there should always remain at least one admin
 631                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 632                     if (sql_num_rows($r) < 2)
 633                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 634                     else
 635                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 636                     break;
 637                 default:
 638                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 639             }
 640
 641             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 642             echo '</li>';
 643         }
 644
 645         echo '</ul>';
 646         echo '<b>',_BATCH_DONE,'</b>';
 647
 648         $this->pagefoot();
 649
 650
 651     }
 652
 653     /**
 654      * @todo document this
 655      */
 656     function action_batchcategory() {
 657         global $member, $manager;
 658
 659         // check if logged in
 660         $member->isLoggedIn() or $this->disallow();
 661
 662         // more precise check will be done for each performed operation
 663
 664         // get array of itemids from request
 665         $selected = requestIntArray('batch');
 666         $action = requestVar('batchaction');
 667
 668         // Show error when no items were selected
 669         if (!is_array($selected) || sizeof($selected) == 0)
 670             $this->error(_BATCH_NOSELECTION);
 671
 672         // On move: when no destination blog chosen, show choice now
 673         $destBlogId = intRequestVar('destblogid');
 674         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 675             $this->batchMoveCategorySelectDestination('category',$selected);
 676
 677         // On delete: check if confirmation has been given
 678         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 679             $this->batchAskDeleteConfirmation('category',$selected);
 680
 681         $this->pagehead();
 682
 683         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 684         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 685         echo '<p>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b></p>';
 686         echo '<ul>';
 687
 688         // walk over all itemids and perform action
 689         foreach ($selected as $catid) {
 690             $catid = intval($catid);
 691             echo '<li>',_BATCH_EXECUTING,' <b>',i18n::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 692
 693             // perform action, display errors if needed
 694             switch($action) {
 695                 case 'delete':
 696                     $error = $this->deleteOneCategory($catid);
 697                     break;
 698                 case 'move':
 699                     $error = $this->moveOneCategory($catid, $destBlogId);
 700                     break;
 701                 default:
 702                     $error = _BATCH_UNKNOWN . i18n::hsc($action);
 703             }
 704
 705             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 706             echo '</li>';
 707         }
 708
 709         echo '</ul>';
 710         echo '<b>',_BATCH_DONE,'</b>';
 711
 712         $this->pagefoot();
 713
 714     }
 715
 716     /**
 717      * @todo document this
 718      */
 719     function batchMoveSelectDestination($type, $ids) {
 720         global $manager;
 721         $this->pagehead();
 722         ?>
 723         <h2><?php echo _MOVE_TITLE?></h2>
 724         <form method="post" action="index.php"><div>
 725
 726             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 727             <input type="hidden" name="batchaction" value="move" />
 728             <?php
 729                 $manager->addTicketHidden();
 730
 731                 // insert selected item numbers
 732                 $idx = 0;
 733                 foreach ($ids as $id)
 734                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 735
 736                 // show blog/category selection list
 737                 $this->selectBlogCategory('destcatid');
 738
 739             ?>
 740
 741
 742             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 743
 744         </div></form>
 745         <?php       $this->pagefoot();
 746         exit;
 747     }
 748
 749     /**
 750      * @todo document this
 751      */
 752     function batchMoveCategorySelectDestination($type, $ids) {
 753         global $manager;
 754         $this->pagehead();
 755         ?>
 756         <h2><?php echo _MOVECAT_TITLE?></h2>
 757         <form method="post" action="index.php"><div>
 758
 759             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 760             <input type="hidden" name="batchaction" value="move" />
 761             <?php
 762                 $manager->addTicketHidden();
 763
 764                 // insert selected item numbers
 765                 $idx = 0;
 766                 foreach ($ids as $id)
 767                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 768
 769                 // show blog/category selection list
 770                 $this->selectBlog('destblogid');
 771
 772             ?>
 773
 774
 775             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 776
 777         </div></form>
 778         <?php       $this->pagefoot();
 779         exit;
 780     }
 781
 782     /**
 783      * @todo document this
 784      */
 785     function batchAskDeleteConfirmation($type, $ids) {
 786         global $manager;
 787
 788         $this->pagehead();
 789         ?>
 790         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 791         <form method="post" action="index.php"><div>
 792
 793             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 794             <?php $manager->addTicketHidden() ?>
 795             <input type="hidden" name="batchaction" value="delete" />
 796             <input type="hidden" name="confirmation" value="yes" />
 797             <?php               // insert selected item numbers
 798                 $idx = 0;
 799                 foreach ($ids as $id)
 800                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 801
 802                 // add hidden vars for team & comment
 803                 if ($type == 'team')
 804                 {
 805                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 806                 }
 807                 if ($type == 'comment')
 808                 {
 809                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 810                 }
 811
 812             ?>
 813
 814             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 815
 816         </div></form>
 817         <?php       $this->pagefoot();
 818         exit;
 819     }
 820
 821
 822     /**
 823      * Inserts a HTML select element with choices for all categories to which the current
 824      * member has access
 825      * @see function selectBlog
 826      */
 827     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 828         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 829     }
 830
 831     /**
 832      * Inserts a HTML select element with choices for all blogs to which the user has access
 833      *      mode = 'blog' => shows blognames and values are blogids
 834      *      mode = 'category' => show category names and values are catids
 835      *
 836      * @param $iForcedBlogInclude
 837      *      ID of a blog that always needs to be included, without checking if the
 838      *      member is on the blog team (-1 = none)
 839      * @todo document parameters
 840      */
 841     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 842         global $member, $CONF;
 843
 844         // 0. get IDs of blogs to which member can post items (+ forced blog)
 845         $aBlogIds = array();
 846         if ($iForcedBlogInclude != -1)
 847             $aBlogIds[] = intval($iForcedBlogInclude);
 848
 849         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 850             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 851         else
 852             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 853         $rblogids = sql_query($queryBlogs);
 854         while ($o = sql_fetch_object($rblogids))
 855             if ($o->bnumber != $iForcedBlogInclude)
 856                 $aBlogIds[] = intval($o->bnumber);
 857
 858         if (count($aBlogIds) == 0)
 859             return;
 860
 861         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 862
 863         // 1. select blogs (we'll create optiongroups)
 864         // (only select those blogs that have the user on the team)
 865         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 866         $blogs = sql_query($queryBlogs);
 867         if ($mode == 'category') {
 868             if (sql_num_rows($blogs) > 1)
 869                 $multipleBlogs = 1;
 870
 871             while ($oBlog = sql_fetch_object($blogs)) {
 872                 if ($multipleBlogs)
 873                     echo '<optgroup label="',i18n::hsc($oBlog->bname),'">';
 874
 875                 // show selection to create new category when allowed/wanted
 876                 if ($showNewCat) {
 877                     // check if allowed to do so
 878                     if ($member->blogAdminRights($oBlog->bnumber))
 879                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 880                 }
 881
 882                 // 2. for each category in that blog
 883                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 884                 while ($oCat = sql_fetch_object($categories)) {
 885                     if ($oCat->catid == $selected)
 886                         $selectText = ' selected="selected" ';
 887                     else
 888                         $selectText = '';
 889                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',i18n::hsc($oCat->cname),'</option>';
 890                 }
 891
 892                 if ($multipleBlogs)
 893                     echo '</optgroup>';
 894             }
 895         } else {
 896             // blog mode
 897             while ($oBlog = sql_fetch_object($blogs)) {
 898                 echo '<option value="',$oBlog->bnumber,'"';
 899                 if ($oBlog->bnumber == $selected)
 900                     echo ' selected="selected"';
 901                 echo'>',i18n::hsc($oBlog->bname),'</option>';
 902             }
 903         }
 904         echo '</select>';
 905
 906     }
 907
 908     /**
 909      * @todo document this
 910      */
 911     function action_browseownitems() {
 912         global $member, $manager, $CONF;
 913
 914         $this->pagehead();
 915
 916         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 917         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 918
 919         // start index
 920         if (postVar('start'))
 921             $start = intPostVar('start');
 922         else
 923             $start = 0;
 924
 925         // amount of items to show
 926         if (postVar('amount'))
 927             $amount = intPostVar('amount');
 928         else {
 929             $amount = intval($CONF['DefaultListSize']);
 930             if ($amount < 1)
 931                 $amount = 10;
 932         }
 933
 934         $search = postVar('search');    // search through items
 935
 936         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 937                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 938                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 939
 940         if ($search)
 941             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 942
 943         $query .= ' ORDER BY itime DESC'
 944                 . " LIMIT $start,$amount";
 945
 946         $template['content'] = 'itemlist';
 947         $template['now'] = time();
 948
 949         $manager->loadClass("ENCAPSULATE");
 950         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 951         $navList->showBatchList('item',$query,'table',$template);
 952
 953         $this->pagefoot();
 954
 955     }
 956
 957     /**
 958      * Show all the comments for a given item
 959      * @param int $itemid
 960      */
 961     function action_itemcommentlist($itemid = '') {
 962         global $member, $manager, $CONF;
 963
 964         if ($itemid == '')
 965             $itemid = intRequestVar('itemid');
 966
 967         // only allow if user is allowed to alter item
 968         $member->canAlterItem($itemid) or $this->disallow();
 969
 970         $blogid = getBlogIdFromItemId($itemid);
 971
 972         $this->pagehead();
 973
 974         // start index
 975         if (postVar('start'))
 976             $start = intPostVar('start');
 977         else
 978             $start = 0;
 979
 980         // amount of items to show
 981         if (postVar('amount'))
 982             $amount = intPostVar('amount');
 983         else {
 984             $amount = intval($CONF['DefaultListSize']);
 985             if ($amount < 1)
 986                 $amount = 10;
 987         }
 988
 989         $search = postVar('search');
 990
 991         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 992         echo '<h2>',_COMMENTS,'</h2>';
 993
 994         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
 995
 996         if ($search)
 997             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
 998
 999         $query .= ' ORDER BY ctime ASC'
1000                 . " LIMIT $start,$amount";
1001
1002         $template['content'] = 'commentlist';
1003         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1004
1005         $manager->loadClass("ENCAPSULATE");
1006         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1007         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1008
1009         $this->pagefoot();
1010     }
1011
1012     /**
1013      * Browse own comments
1014      */
1015     function action_browseowncomments() {
1016         global $member, $manager, $CONF;
1017
1018         // start index
1019         if (postVar('start'))
1020             $start = intPostVar('start');
1021         else
1022             $start = 0;
1023
1024         // amount of items to show
1025         if (postVar('amount'))
1026             $amount = intPostVar('amount');
1027         else {
1028             $amount = intval($CONF['DefaultListSize']);
1029             if ($amount < 1)
1030                 $amount = 10;
1031         }
1032
1033         $search = postVar('search');
1034
1035
1036         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1037
1038         if ($search)
1039             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1040
1041         $query .= ' ORDER BY ctime DESC'
1042                 . " LIMIT $start,$amount";
1043
1044         $this->pagehead();
1045
1046         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1047         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1048
1049         $template['content'] = 'commentlist';
1050         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1051
1052         $manager->loadClass("ENCAPSULATE");
1053         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1054         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1055
1056         $this->pagefoot();
1057     }
1058
1059     /**
1060      * Browse all comments for a weblog
1061      * @param int $blogid
1062      */
1063     function action_blogcommentlist($blogid = '')
1064     {
1065         global $member, $manager, $CONF;
1066
1067         if ($blogid == '')
1068             $blogid = intRequestVar('blogid');
1069         else
1070             $blogid = intval($blogid);
1071
1072         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1073
1074         // start index
1075         if (postVar('start'))
1076             $start = intPostVar('start');
1077         else
1078             $start = 0;
1079
1080         // amount of items to show
1081         if (postVar('amount'))
1082             $amount = intPostVar('amount');
1083         else {
1084             $amount = intval($CONF['DefaultListSize']);
1085             if ($amount < 1)
1086                 $amount = 10;
1087         }
1088
1089         $search = postVar('search');        // search through comments
1090
1091
1092         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1093
1094         if ($search != '')
1095             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1096
1097
1098         $query .= ' ORDER BY ctime DESC'
1099                 . " LIMIT $start,$amount";
1100
1101
1102         $blog =& $manager->getBlog($blogid);
1103
1104         $this->pagehead();
1105
1106         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1107         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1108
1109         $template['content'] = 'commentlist';
1110         $template['canAddBan'] = $member->blogAdminRights($blogid);
1111
1112         $manager->loadClass("ENCAPSULATE");
1113         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1114         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1115
1116         $this->pagefoot();
1117     }
1118
1119     /**
1120      * Provide a page to item a new item to the given blog
1121      */
1122     function action_createitem() {
1123         global $member, $manager;
1124
1125         $blogid = intRequestVar('blogid');
1126
1127         // check if allowed
1128         $member->teamRights($blogid) or $this->disallow();
1129
1130         $memberid = $member->getID();
1131
1132         $blog =& $manager->getBlog($blogid);
1133
1134         $this->pagehead();
1135
1136         // generate the add-item form
1137         $formfactory = new PAGEFACTORY($blogid);
1138         $formfactory->createAddForm('admin');
1139
1140         $this->pagefoot();
1141     }
1142
1143     /**
1144      * @todo document this
1145      */
1146     function action_itemedit()
1147         {
1148                 global $member, $manager;
1149
1150                 $itemid = intRequestVar('itemid');
1151
1152                 // only allow if user is allowed to alter item
1153                 $member->canAlterItem($itemid) or $this->disallow();
1154
1155                 $item =& $manager->getItem($itemid, 1, 1);
1156                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1157
1158                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1159
1160                 if ($blog->convertBreaks())
1161                 {
1162                         $item['body'] = removeBreaks($item['body']);
1163                         $item['more'] = removeBreaks($item['more']);
1164                 }
1165
1166                 // form to edit blog items
1167                 $this->pagehead();
1168                 $formfactory = new PAGEFACTORY($blog->getID());
1169                 $formfactory->createEditForm('admin', $item);
1170                 $this->pagefoot();
1171     }
1172
1173     /**
1174      * @todo document this
1175      */
1176     function action_itemupdate() {
1177         global $member, $manager, $CONF;
1178
1179         $itemid = intRequestVar('itemid');
1180         $catid = postVar('catid');
1181
1182         // only allow if user is allowed to alter item
1183         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1184
1185         $actiontype = postVar('actiontype');
1186
1187         // delete actions are handled by itemdelete (which has confirmation)
1188         if ($actiontype == 'delete') {
1189             $this->action_itemdelete();
1190             return;
1191         }
1192
1193         $body   = postVar('body');
1194         $title  = postVar('title');
1195         $more   = postVar('more');
1196         $closed = intPostVar('closed');
1197         $draftid = intPostVar('draftid');
1198
1199         // default action = add now
1200         if (!$actiontype)
1201             $actiontype='addnow';
1202
1203         // create new category if needed
1204         if (strstr($catid,'newcat')) {
1205             // get blogid
1206             list($blogid) = sscanf($catid,"newcat-%d");
1207
1208             // create
1209             $blog =& $manager->getBlog($blogid);
1210             $catid = $blog->createNewCategory();
1211
1212             // show error when sth goes wrong
1213             if (!$catid)
1214                 $this->doError(_ERROR_CATCREATEFAIL);
1215         }
1216
1217         /*
1218             set some variables based on actiontype
1219
1220             actiontypes:
1221                 draft items -> addnow, addfuture, adddraft, delete
1222                 non-draft items -> edit, changedate, delete
1223
1224             variables set:
1225                 $timestamp: set to a nonzero value for future dates or date changes
1226                 $wasdraft: set to 1 when the item used to be a draft item
1227                 $publish: set to 1 when the edited item is not a draft
1228         */
1229         $blogid =  getBlogIDFromItemID($itemid);
1230         $blog   =& $manager->getBlog($blogid);
1231
1232         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1233         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1234         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1235         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1236             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1237         } else {
1238             $timestamp =0;
1239         }
1240
1241         // edit the item for real
1242         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1243
1244         $this->updateFuturePosted($blogid);
1245
1246         if ($draftid > 0) {
1247             // delete permission is checked inside ITEM::delete()
1248             ITEM::delete($draftid);
1249         }
1250
1251         // show category edit window when we created a new category
1252         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1253         if ($catid != intPostVar('catid')) {
1254             $this->action_categoryedit(
1255                 $catid,
1256                 $blog->getID(),
1257                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1258             );
1259         } else {
1260             // TODO: set start item correctly for itemlist
1261             $this->action_itemlist(getBlogIDFromItemID($itemid));
1262         }
1263     }
1264
1265     /**
1266      * @todo document this
1267      */
1268     function action_itemdelete() {
1269         global $member, $manager;
1270
1271         $itemid = intRequestVar('itemid');
1272
1273         // only allow if user is allowed to alter item
1274         $member->canAlterItem($itemid) or $this->disallow();
1275
1276         if (!$manager->existsItem($itemid,1,1))
1277             $this->error(_ERROR_NOSUCHITEM);
1278
1279         $item =& $manager->getItem($itemid,1,1);
1280         $title = i18n::hsc(strip_tags($item['title']));
1281         $body = strip_tags($item['body']);
1282         $body = i18n::hsc(shorten($body,300,'...'));
1283
1284         $this->pagehead();
1285         ?>
1286             <h2><?php echo _DELETE_CONFIRM?></h2>
1287
1288             <p><?php echo _CONFIRMTXT_ITEM?></p>
1289
1290             <div class="note">
1291                 <b>"<?php echo  $title ?>"</b>
1292                 <br />
1293                 <?php echo $body?>
1294             </div>
1295
1296             <form method="post" action="index.php"><div>
1297                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1298                 <?php $manager->addTicketHidden() ?>
1299                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1300                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1301             </div></form>
1302         <?php
1303         $this->pagefoot();
1304     }
1305
1306     /**
1307      * @todo document this
1308      */
1309     function action_itemdeleteconfirm() {
1310         global $member;
1311
1312         $itemid = intRequestVar('itemid');
1313
1314         // only allow if user is allowed to alter item
1315         $member->canAlterItem($itemid) or $this->disallow();
1316
1317         // get blogid first
1318         $blogid = getBlogIdFromItemId($itemid);
1319
1320         // delete item (note: some checks will be performed twice)
1321         $this->deleteOneItem($itemid);
1322
1323         $this->action_itemlist($blogid);
1324     }
1325
1326     /**
1327      * Deletes one item and returns error if something goes wrong
1328      * @param int $itemid
1329      */
1330     function deleteOneItem($itemid) {
1331         global $member, $manager;
1332
1333         // only allow if user is allowed to alter item (also checks if itemid exists)
1334         if (!$member->canAlterItem($itemid))
1335             return _ERROR_DISALLOWED;
1336
1337         // need to get blogid before the item is deleted
1338         $blogid = getBlogIDFromItemId($itemid);
1339
1340         $manager->loadClass('ITEM');
1341         ITEM::delete($itemid);
1342
1343         // update blog's futureposted
1344         $this->updateFuturePosted($blogid);
1345     }
1346
1347     /**
1348      * Update a blog's future posted flag
1349      * @param int $blogid
1350      */
1351     function updateFuturePosted($blogid) {
1352         global $manager;
1353
1354         $blog =& $manager->getBlog($blogid);
1355         $currenttime = $blog->getCorrectTime(time());
1356         $result = sql_query("SELECT * FROM ".sql_table('item').
1357             " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1358         if (sql_num_rows($result) > 0) {
1359                 $blog->setFuturePost();
1360         }
1361         else {
1362                 $blog->clearFuturePost();
1363         }
1364     }
1365
1366     /**
1367      * @todo document this
1368      */
1369     function action_itemmove() {
1370         global $member, $manager;
1371
1372         $itemid = intRequestVar('itemid');
1373
1374         // only allow if user is allowed to alter item
1375         $member->canAlterItem($itemid) or $this->disallow();
1376
1377         $item =& $manager->getItem($itemid,1,1);
1378
1379         $this->pagehead();
1380         ?>
1381             <h2><?php echo _MOVE_TITLE?></h2>
1382             <form method="post" action="index.php"><div>
1383                 <input type="hidden" name="action" value="itemmoveto" />
1384                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1385
1386                 <?php
1387
1388                     $manager->addTicketHidden();
1389                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1390                 ?>
1391
1392                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1393             </div></form>
1394         <?php
1395         $this->pagefoot();
1396     }
1397
1398     /**
1399      * @todo document this
1400      */
1401     function action_itemmoveto() {
1402         global $member, $manager;
1403
1404         $itemid = intRequestVar('itemid');
1405         $catid = requestVar('catid');
1406
1407         // create new category if needed
1408         if (strstr($catid,'newcat')) {
1409             // get blogid
1410             list($blogid) = sscanf($catid,'newcat-%d');
1411
1412             // create
1413             $blog =& $manager->getBlog($blogid);
1414             $catid = $blog->createNewCategory();
1415
1416             // show error when sth goes wrong
1417             if (!$catid)
1418                 $this->doError(_ERROR_CATCREATEFAIL);
1419         }
1420
1421         // only allow if user is allowed to alter item
1422         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1423
1424         $old_blogid = getBlogIDFromItemId($itemid);
1425
1426         ITEM::move($itemid, $catid);
1427
1428         // set the futurePosted flag on the blog
1429         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1430
1431         // reset the futurePosted in case the item is moved from one blog to another
1432         $this->updateFuturePosted($old_blogid);
1433
1434         if ($catid != intRequestVar('catid'))
1435             $this->action_categoryedit($catid, $blog->getID());
1436         else
1437             $this->action_itemlist(getBlogIDFromCatID($catid));
1438     }
1439
1440     /**
1441      * Moves one item to a given category (category existance should be checked by caller)
1442      * errors are returned
1443      * @param int $itemid
1444      * @param int $destCatid category ID to which the item will be moved
1445      */
1446     function moveOneItem($itemid, $destCatid) {
1447         global $member;
1448
1449         // only allow if user is allowed to move item
1450         if (!$member->canUpdateItem($itemid, $destCatid))
1451             return _ERROR_DISALLOWED;
1452
1453         ITEM::move($itemid, $destCatid);
1454     }
1455
1456     /**
1457      * Adds a item to the chosen blog
1458      */
1459     function action_additem() {
1460         global $manager, $CONF;
1461
1462         $manager->loadClass('ITEM');
1463
1464         $result = ITEM::createFromRequest();
1465
1466         if ($result['status'] == 'error')
1467             $this->error($result['message']);
1468
1469         $blogid = getBlogIDFromItemID($result['itemid']);
1470         $blog =& $manager->getBlog($blogid);
1471         $btimestamp = $blog->getCorrectTime();
1472         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1473
1474         if ($result['status'] == 'newcategory') {
1475             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1476             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1477         } else {
1478             $methodName = 'action_itemList';
1479             call_user_func(array(&$this, $methodName), $blogid);
1480         }
1481     }
1482
1483         /**
1484          * Allows to edit previously made comments
1485          **/
1486         function action_commentedit() {
1487
1488                 global $member, $manager;
1489
1490                 $commentid = intRequestVar('commentid');
1491
1492                 $member->canAlterComment($commentid) or $this->disallow();
1493
1494                 $comment = COMMENT::getComment($commentid);
1495
1496                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1497
1498                 // change <br /> to \n
1499                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1500
1501                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1502                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1503
1504         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1505
1506         $this->pagehead();
1507
1508         ?>
1509         <h2><?php echo _EDITC_TITLE?></h2>
1510
1511         <form action="index.php" method="post"><div>
1512
1513         <input type="hidden" name="action" value="commentupdate" />
1514         <?php $manager->addTicketHidden(); ?>
1515         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1516         <table><tr>
1517             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1518         </tr><tr>
1519             <td><?php echo _EDITC_WHO?></td>
1520             <td>
1521             <?php               if ($comment['member'])
1522                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1523                 else
1524                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1525             ?>
1526             </td>
1527         </tr><tr>
1528             <td><?php echo _EDITC_WHEN?></td>
1529             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1530         </tr><tr>
1531             <td><?php echo _EDITC_HOST?></td>
1532             <td><?php echo  $comment['host']; ?></td>
1533         </tr>
1534         <tr>
1535             <td><?php echo _EDITC_URL; ?></td>
1536             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1537         </tr>
1538         <tr>
1539             <td><?php echo _EDITC_EMAIL; ?></td>
1540             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1541         </tr>
1542         <tr>
1543             <td><?php echo _EDITC_TEXT?></td>
1544             <td>
1545                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1546                     echo $comment['body'];
1547                 ?></textarea>
1548             </td>
1549         </tr><tr>
1550             <td><?php echo _EDITC_EDIT?></td>
1551             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1552         </tr></table>
1553
1554         </div></form>
1555         <?php
1556         $this->pagefoot();
1557     }
1558
1559     /**
1560      * @todo document this
1561      */
1562     function action_commentupdate() {
1563         global $member, $manager;
1564
1565         $commentid = intRequestVar('commentid');
1566
1567         $member->canAlterComment($commentid) or $this->disallow();
1568
1569         $url = postVar('url');
1570         $email = postVar('email');
1571         $body = postVar('body');
1572
1573                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1574                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1575                 # important note that '\' must be matched with '\\\\' in preg* expressions
1576
1577                 // intercept words that are too long
1578                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1579                 {
1580                         $this->error(_ERROR_COMMENT_LONGWORD);
1581                 }
1582
1583                 // check length
1584                 if (i18n::strlen($body) < 3)
1585                 {
1586                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1587                 }
1588
1589                 if (i18n::strlen($body) > 5000)
1590                 {
1591                         $this->error(_ERROR_COMMENT_TOOLONG);
1592                 }
1593
1594         // prepare body
1595         $body = COMMENT::prepareBody($body);
1596
1597         // call plugins
1598         $manager->notify('PreUpdateComment',array('body' => &$body));
1599
1600         $query = 'UPDATE ' . sql_table('comment')
1601                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1602                . " WHERE cnumber = " . $commentid;
1603         sql_query($query);
1604
1605         // get itemid
1606         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1607         $o = sql_fetch_object($res);
1608         $itemid = $o->citem;
1609
1610         if ($member->canAlterItem($itemid))
1611             $this->action_itemcommentlist($itemid);
1612         else
1613             $this->action_browseowncomments();
1614
1615     }
1616
1617     /**
1618      * @todo document this
1619      */
1620     function action_commentdelete() {
1621         global $member, $manager;
1622
1623         $commentid = intRequestVar('commentid');
1624
1625         $member->canAlterComment($commentid) or $this->disallow();
1626
1627         $comment = COMMENT::getComment($commentid);
1628
1629         $body = strip_tags($comment['body']);
1630         $body = i18n::hsc(shorten($body, 300, '...'));
1631
1632         if ($comment['member'])
1633             $author = $comment['member'];
1634         else
1635             $author = $comment['user'];
1636
1637         $this->pagehead();
1638         ?>
1639
1640             <h2><?php echo _DELETE_CONFIRM?></h2>
1641
1642             <p><?php echo _CONFIRMTXT_COMMENT?></p>
1643
1644             <div class="note">
1645             <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1646             <br />
1647             <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1648             </div>
1649
1650             <form method="post" action="index.php"><div>
1651                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1652                 <?php $manager->addTicketHidden() ?>
1653                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1654                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1655             </div></form>
1656         <?php
1657         $this->pagefoot();
1658     }
1659
1660     /**
1661      * @todo document this
1662      */
1663     function action_commentdeleteconfirm() {
1664         global $member;
1665
1666         $commentid = intRequestVar('commentid');
1667
1668         // get item id first
1669         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1670         $o = sql_fetch_object($res);
1671         $itemid = $o->citem;
1672
1673         $error = $this->deleteOneComment($commentid);
1674         if ($error)
1675             $this->doError($error);
1676
1677         if ($member->canAlterItem($itemid))
1678             $this->action_itemcommentlist($itemid);
1679         else
1680             $this->action_browseowncomments();
1681     }
1682
1683     /**
1684      * @todo document this
1685      */
1686     function deleteOneComment($commentid) {
1687         global $member, $manager;
1688
1689         $commentid = intval($commentid);
1690
1691         if (!$member->canAlterComment($commentid))
1692             return _ERROR_DISALLOWED;
1693
1694         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1695
1696         // delete the comments associated with the item
1697         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1698         sql_query($query);
1699
1700         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1701
1702         return '';
1703     }
1704
1705     /**
1706      * Usermanagement main
1707      */
1708     function action_usermanagement() {
1709         global $member, $manager;
1710
1711         // check if allowed
1712         $member->isAdmin() or $this->disallow();
1713
1714         $this->pagehead();
1715
1716         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1717
1718         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1719
1720         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1721
1722         // show list of members with actions
1723         $query =  'SELECT *'
1724                . ' FROM '.sql_table('member');
1725         $template['content'] = 'memberlist';
1726         $template['tabindex'] = 10;
1727
1728         $manager->loadClass("ENCAPSULATE");
1729         $batch = new BATCH('member');
1730         $batch->showlist($query,'table',$template);
1731
1732         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1733         ?>
1734             <form method="post" action="index.php" name="memberedit"><div>
1735
1736             <input type="hidden" name="action" value="memberadd" />
1737             <?php $manager->addTicketHidden() ?>
1738
1739             <table>
1740             <tr>
1741                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1742             </tr><tr>
1743                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1744                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1745                 </td>
1746                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1747             </tr><tr>
1748                 <td><?php echo _MEMBERS_REALNAME?></td>
1749                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1750             </tr><tr>
1751                 <td><?php echo _MEMBERS_PWD?></td>
1752                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1753             </tr><tr>
1754                 <td><?php echo _MEMBERS_REPPWD?></td>
1755                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1756             </tr><tr>
1757                 <td><?php echo _MEMBERS_EMAIL?></td>
1758                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1759             </tr><tr>
1760                 <td><?php echo _MEMBERS_URL?></td>
1761                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1762             </tr><tr>
1763                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1764                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1765             </tr><tr>
1766                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1767                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1768             </tr><tr>
1769                 <td><?php echo _MEMBERS_NOTES?></td>
1770                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1771             </tr><tr>
1772                 <td><?php echo _MEMBERS_NEW?></td>
1773                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1774             </tr></table>
1775
1776             </div></form>
1777         <?php
1778         $this->pagefoot();
1779     }
1780
1781     /**
1782      * Edit member settings
1783      */
1784     function action_memberedit() {
1785         $this->action_editmembersettings(intRequestVar('memberid'));
1786     }
1787
1788         /**
1789          * @todo document this
1790          */
1791         function action_editmembersettings($memberid = '') {
1792                 global $member, $manager, $CONF;
1793
1794                 if ($memberid == '')
1795                 {
1796                         $memberid = $member->getID();
1797                 }
1798
1799                 // check if allowed
1800                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1801
1802                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1803                 $this->pagehead($extrahead);
1804
1805                 // show message to go back to member overview (only for admins)
1806                 if ($member->isAdmin())
1807                 {
1808                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1809                 }
1810                 else
1811                 {
1812                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1813                 }
1814                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1815
1816                 $mem = MEMBER::createFromID($memberid);
1817                 ?>
1818                 <form method="post" action="index.php" name="memberedit"><div>
1819
1820                 <input type="hidden" name="action" value="changemembersettings" />
1821                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1822                 <?php $manager->addTicketHidden() ?>
1823
1824                 <table><tr>
1825                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1826                 </tr><tr>
1827                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1828                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1829                         </td>
1830                         <td>
1831                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1832                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  i18n::hsc($mem->getDisplayName()); ?>" />
1833                         <?php } else {
1834                                 echo i18n::hsc($member->getDisplayName());
1835                            }
1836                         ?>
1837                         </td>
1838                 </tr><tr>
1839                         <td><?php echo _MEMBERS_REALNAME?></td>
1840                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  i18n::hsc($mem->getRealName()); ?>" /></td>
1841                 </tr><tr>
1842                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1843                         <td><?php echo _MEMBERS_PWD?></td>
1844                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1845                 </tr><tr>
1846                         <td><?php echo _MEMBERS_REPPWD?></td>
1847                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1848                 <?php } ?>
1849                 </tr><tr>
1850                         <td><?php echo _MEMBERS_EMAIL?>
1851                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1852                         </td>
1853                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  i18n::hsc($mem->getEmail()); ?>" /></td>
1854                 </tr><tr>
1855                         <td><?php echo _MEMBERS_URL?></td>
1856                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  i18n::hsc($mem->getURL()); ?>" /></td>
1857                 <?php // only allow to change this by super-admins
1858                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1859                    if ($member->isAdmin()) {
1860                 ?>
1861                         </tr><tr>
1862                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1863                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1864                         </tr><tr>
1865                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1866                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1867                 <?php } ?>
1868                 </tr><tr>
1869                         <td><?php echo _MEMBERS_NOTES?></td>
1870                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  i18n::hsc($mem->getNotes()); ?>" /></td>
1871                 </tr><tr>
1872                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1873                         </td>
1874                         <td>
1875
1876                                 <select name="deflang" tabindex="85">
1877                                 <?php
1878                                 $locales = i18n::get_available_locale_list();
1879                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1880                                 {
1881                                         echo "<option value=\"\" selected=\"selected\">" . i18n::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1882                                 }
1883                                 else
1884                                 {
1885                                         echo "<option value=\"\">" . i18n::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1886                                 }
1887
1888                                 foreach( $locales as $locale )
1889                                 {
1890                                         if( $locale == $mem->getLocale() )
1891                                         {
1892                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1893                                         }
1894                                         else
1895                                         {
1896                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1897                                         }
1898                                 }
1899                                 ?>
1900                                 </select>
1901
1902                         </td>
1903                 </tr>
1904                 <tr>
1905                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1906                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1907                 </tr>
1908                 <?php
1909                         // plugin options
1910                         $this->_insertPluginOptions('member',$memberid);
1911                 ?>
1912                 <tr>
1913                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1914                 </tr><tr>
1915                         <td><?php echo _MEMBERS_EDIT?></td>
1916                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1917                 </tr></table>
1918
1919                 </div></form>
1920
1921                 <?php
1922                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1923
1924                         $manager->notify(
1925                                 'MemberSettingsFormExtras',
1926                                 array(
1927                                         'member' => &$mem
1928                                 )
1929                         );
1930                 $this->pagefoot();
1931         }
1932
1933     /**
1934      * @todo document this
1935      */
1936     function action_changemembersettings() {
1937         global $member, $CONF, $manager;
1938
1939         $memberid = intRequestVar('memberid');
1940
1941         // check if allowed
1942         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1943
1944         $name           = trim(strip_tags(postVar('name')));
1945         $realname       = trim(strip_tags(postVar('realname')));
1946         $password       = postVar('password');
1947         $repeatpassword = postVar('repeatpassword');
1948         $email          = strip_tags(postVar('email'));
1949         $url            = strip_tags(postVar('url'));
1950
1951                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1952                 # original eregi: !eregi("^https?://", $url)
1953
1954                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1955                 if (!preg_match('#^https?://#', $url) )
1956                 {
1957                         $url = 'http://' . $url;
1958                 }
1959
1960         $admin          = postVar('admin');
1961         $canlogin       = postVar('canlogin');
1962         $notes          = strip_tags(postVar('notes'));
1963         $locale        = postVar('deflang');
1964
1965         $mem = MEMBER::createFromID($memberid);
1966
1967         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1968
1969             if (!isValidDisplayName($name))
1970                 $this->error(_ERROR_BADNAME);
1971
1972             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1973                 $this->error(_ERROR_NICKNAMEINUSE);
1974
1975             if ($password != $repeatpassword)
1976                 $this->error(_ERROR_PASSWORDMISMATCH);
1977
1978             if ($password && (i18n::strlen($password) < 6))
1979                 $this->error(_ERROR_PASSWORDTOOSHORT);
1980
1981             if ($password) {
1982                                 $pwdvalid = true;
1983                                 $pwderror = '';
1984                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
1985                                 if (!$pwdvalid) {
1986                                         $this->error($pwderror);
1987                                 }
1988                         }
1989                 }
1990
1991                 if ( !isValidMailAddress($email) )
1992                 {
1993                         $this->error(_ERROR_BADMAILADDRESS);
1994                 }
1995                 if ( !$realname )
1996                 {
1997                         $this->error(_ERROR_REALNAMEMISSING);
1998                 }
1999         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2000             $this->error(_ERROR_NOSUCHLANGUAGE);
2001
2002         // check if there will remain at least one site member with both the logon and admin rights
2003         // (check occurs when taking away one of these rights from such a member)
2004         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2005              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2006            )
2007         {
2008             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2009             if (sql_num_rows($r) < 2)
2010                 $this->error(_ERROR_ATLEASTONEADMIN);
2011         }
2012
2013         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2014             $mem->setDisplayName($name);
2015             if ($password)
2016                 $mem->setPassword($password);
2017         }
2018
2019         $oldEmail = $mem->getEmail();
2020
2021         $mem->setRealName($realname);
2022         $mem->setEmail($email);
2023         $mem->setURL($url);
2024         $mem->setNotes($notes);
2025         $mem->setLocale($locale);
2026
2027
2028         // only allow super-admins to make changes to the admin status
2029         if ($member->isAdmin()) {
2030             $mem->setAdmin($admin);
2031             $mem->setCanLogin($canlogin);
2032         }
2033
2034         $autosave = postVar ('autosave');
2035         $mem->setAutosave($autosave);
2036
2037         $mem->write();
2038
2039         // store plugin options
2040         $aOptions = requestArray('plugoption');
2041         NucleusPlugin::_applyPluginOptions($aOptions);
2042         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2043
2044         // if email changed, generate new password
2045         if ($oldEmail != $mem->getEmail())
2046         {
2047             $mem->sendActivationLink('addresschange', $oldEmail);
2048             // logout member
2049             $mem->newCookieKey();
2050
2051             // only log out if the member being edited is the current member.
2052             if ($member->getID() == $memberid)
2053                 $member->logout();
2054             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2055             return;
2056         }
2057
2058
2059         if (  ( $mem->getID() == $member->getID() )
2060            && ( $mem->getDisplayName() != $member->getDisplayName() )
2061            ) {
2062             $mem->newCookieKey();
2063             $member->logout();
2064             $this->action_login(_MSG_LOGINAGAIN, 0);
2065         } else {
2066             $this->action_overview(_MSG_SETTINGSCHANGED);
2067         }
2068     }
2069
2070     /**
2071      * @todo document this
2072      */
2073     function action_memberadd() {
2074         global $member, $manager;
2075
2076         // check if allowed
2077         $member->isAdmin() or $this->disallow();
2078
2079         if (postVar('password') != postVar('repeatpassword'))
2080             $this->error(_ERROR_PASSWORDMISMATCH);
2081         if (i18n::strlen(postVar('password')) < 6)
2082             $this->error(_ERROR_PASSWORDTOOSHORT);
2083
2084         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2085         if ($res != 1)
2086             $this->error($res);
2087
2088         // fire PostRegister event
2089         $newmem = new MEMBER();
2090         $newmem->readFromName(postVar('name'));
2091         $manager->notify('PostRegister',array('member' => &$newmem));
2092
2093         $this->action_usermanagement();
2094     }
2095
2096     /**
2097      * Account activation
2098      *
2099      * @author dekarma
2100      */
2101     function action_activate() {
2102
2103         $key = getVar('key');
2104         $this->_showActivationPage($key);
2105     }
2106
2107     /**
2108      * @todo document this
2109      */
2110     function _showActivationPage($key, $message = '')
2111     {
2112         global $manager;
2113
2114         // clean up old activation keys
2115         MEMBER::cleanupActivationTable();
2116
2117         // get activation info
2118         $info = MEMBER::getActivationInfo($key);
2119
2120         if (!$info)
2121             $this->error(_ERROR_ACTIVATE);
2122
2123         $mem = MEMBER::createFromId($info->vmember);
2124
2125         if (!$mem)
2126             $this->error(_ERROR_ACTIVATE);
2127
2128         $text = '';
2129         $title = '';
2130         $bNeedsPasswordChange = true;
2131
2132         switch ($info->vtype)
2133         {
2134             case 'forgot':
2135                 $title = _ACTIVATE_FORGOT_TITLE;
2136                 $text = _ACTIVATE_FORGOT_TEXT;
2137                 break;
2138             case 'register':
2139                 $title = _ACTIVATE_REGISTER_TITLE;
2140                 $text = _ACTIVATE_REGISTER_TEXT;
2141                 break;
2142             case 'addresschange':
2143                 $title = _ACTIVATE_CHANGE_TITLE;
2144                 $text = _ACTIVATE_CHANGE_TEXT;
2145                 $bNeedsPasswordChange = false;
2146                 MEMBER::activate($key);
2147                 break;
2148         }
2149
2150         $aVars = array(
2151             'memberName' => i18n::hsc($mem->getDisplayName())
2152         );
2153         $title = TEMPLATE::fill($title, $aVars);
2154         $text = TEMPLATE::fill($text, $aVars);
2155
2156         $this->pagehead();
2157
2158             echo '<h2>' , $title, '</h2>';
2159             echo '<p>' , $text, '</p>';
2160
2161             if ($message != '')
2162             {
2163                 echo '<p class="error">',$message,'</p>';
2164             }
2165
2166             if ($bNeedsPasswordChange)
2167             {
2168                 ?>
2169                     <div><form action="index.php" method="post">
2170
2171                         <input type="hidden" name="action" value="activatesetpwd" />
2172                         <?php $manager->addTicketHidden() ?>
2173                         <input type="hidden" name="key" value="<?php echo i18n::hsc($key) ?>" />
2174
2175                         <table><tr>
2176                             <td><?php echo _MEMBERS_PWD?></td>
2177                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2178                         </tr><tr>
2179                             <td><?php echo _MEMBERS_REPPWD?></td>
2180                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2181                         <?php
2182
2183                             global $manager;
2184                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2185
2186                         ?>
2187                         </tr><tr>
2188                             <td><?php echo _MEMBERS_SETPWD ?></td>
2189                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2190                         </tr></table>
2191
2192
2193                     </form></div>
2194
2195                 <?php
2196
2197             }
2198
2199         $this->pagefoot();
2200
2201     }
2202
2203     /**
2204      * Account activation - set password part
2205      *
2206      * @author dekarma
2207      */
2208     function action_activatesetpwd() {
2209
2210         $key = postVar('key');
2211
2212         // clean up old activation keys
2213         MEMBER::cleanupActivationTable();
2214
2215         // get activation info
2216         $info = MEMBER::getActivationInfo($key);
2217
2218         if (!$info || ($info->type == 'addresschange'))
2219             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2220
2221         $mem = MEMBER::createFromId($info->vmember);
2222
2223         if (!$mem)
2224             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2225
2226         $password       = postVar('password');
2227         $repeatpassword = postVar('repeatpassword');
2228
2229         if ($password != $repeatpassword)
2230             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2231
2232         if ($password && (i18n::strlen($password) < 6))
2233             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2234
2235         if ($password) {
2236                         $pwdvalid = true;
2237                         $pwderror = '';
2238                         global $manager;
2239                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2240                         if (!$pwdvalid) {
2241                                 return $this->_showActivationPage($key,$pwderror);
2242                         }
2243                 }
2244
2245         $error = '';
2246
2247         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2248         if ($error != '')
2249             return $this->_showActivationPage($key, $error);
2250
2251
2252         // set password
2253         $mem->setPassword($password);
2254         $mem->write();
2255
2256         // do the activation
2257         MEMBER::activate($key);
2258
2259         $this->pagehead();
2260             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2261             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2262         $this->pagefoot();
2263     }
2264
2265     /**
2266      * Manage team
2267      */
2268     function action_manageteam() {
2269         global $member, $manager;
2270
2271         $blogid = intRequestVar('blogid');
2272
2273         // check if allowed
2274         $member->blogAdminRights($blogid) or $this->disallow();
2275
2276         $this->pagehead();
2277
2278         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2279
2280         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2281
2282         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2283
2284
2285
2286         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2287                . ' FROM '.sql_table('member').', '.sql_table('team')
2288                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2289
2290         $template['content'] = 'teamlist';
2291         $template['tabindex'] = 10;
2292
2293         $manager->loadClass("ENCAPSULATE");
2294         $batch = new BATCH('team');
2295         $batch->showlist($query, 'table', $template);
2296
2297         ?>
2298             <h3><?php echo _TEAM_ADDNEW?></h3>
2299
2300             <form method='post' action='index.php'><div>
2301
2302             <input type='hidden' name='action' value='teamaddmember' />
2303             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2304             <?php $manager->addTicketHidden() ?>
2305
2306             <table><tr>
2307                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2308                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2309                     $query =  'SELECT mname as text, mnumber as value'
2310                            . ' FROM '.sql_table('member');
2311
2312                     $template['name'] = 'memberid';
2313                     $template['tabindex'] = 10000;
2314                     showlist($query,'select',$template);
2315                 ?></td>
2316             </tr><tr>
2317                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2318                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2319             </tr><tr>
2320                 <td><?php echo _TEAM_ADD?></td>
2321                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2322             </tr></table>
2323
2324             </div></form>
2325         <?php
2326         $this->pagefoot();
2327     }
2328
2329     /**
2330      * Add member to team
2331      */
2332     function action_teamaddmember() {
2333         global $member, $manager;
2334
2335         $memberid = intPostVar('memberid');
2336         $blogid = intPostVar('blogid');
2337         $admin = intPostVar('admin');
2338
2339         // check if allowed
2340         $member->blogAdminRights($blogid) or $this->disallow();
2341
2342         $blog =& $manager->getBlog($blogid);
2343         if (!$blog->addTeamMember($memberid, $admin))
2344             $this->error(_ERROR_ALREADYONTEAM);
2345
2346         $this->action_manageteam();
2347
2348     }
2349
2350     /**
2351      * @todo document this
2352      */
2353     function action_teamdelete() {
2354         global $member, $manager;
2355
2356         $memberid = intRequestVar('memberid');
2357         $blogid = intRequestVar('blogid');
2358
2359         // check if allowed
2360         $member->blogAdminRights($blogid) or $this->disallow();
2361
2362         $teammem = MEMBER::createFromID($memberid);
2363         $blog =& $manager->getBlog($blogid);
2364
2365         $this->pagehead();
2366         ?>
2367             <h2><?php echo _DELETE_CONFIRM?></h2>
2368
2369             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  i18n::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  i18n::hsc(strip_tags($blog->getName())) ?></b>
2370             </p>
2371
2372
2373             <form method="post" action="index.php"><div>
2374             <input type="hidden" name="action" value="teamdeleteconfirm" />
2375             <?php $manager->addTicketHidden() ?>
2376             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2377             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2378             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2379             </div></form>
2380         <?php
2381         $this->pagefoot();
2382     }
2383
2384     /**
2385      * @todo document this
2386      */
2387     function action_teamdeleteconfirm() {
2388         global $member;
2389
2390         $memberid = intRequestVar('memberid');
2391         $blogid = intRequestVar('blogid');
2392
2393         $error = $this->deleteOneTeamMember($blogid, $memberid);
2394         if ($error)
2395             $this->error($error);
2396
2397
2398         $this->action_manageteam();
2399     }
2400
2401     /**
2402      * @todo document this
2403      */
2404     function deleteOneTeamMember($blogid, $memberid) {
2405         global $member, $manager;
2406
2407         $blogid = intval($blogid);
2408         $memberid = intval($memberid);
2409
2410         // check if allowed
2411         if (!$member->blogAdminRights($blogid))
2412             return _ERROR_DISALLOWED;
2413
2414         // check if: - there remains at least one blog admin
2415         //           - (there remains at least one team member)
2416         $tmem = MEMBER::createFromID($memberid);
2417
2418         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2419
2420         if ($tmem->isBlogAdmin($blogid)) {
2421             // check if there are more blog members left and at least one admin
2422             // (check for at least two admins before deletion)
2423             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2424             $r = sql_query($query);
2425             if (sql_num_rows($r) < 2)
2426                 return _ERROR_ATLEASTONEBLOGADMIN;
2427         }
2428
2429         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2430         sql_query($query);
2431
2432         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2433
2434         return '';
2435     }
2436
2437     /**
2438      * @todo document this
2439      */
2440     function action_teamchangeadmin() {
2441         global $member;
2442
2443         $blogid = intRequestVar('blogid');
2444         $memberid = intRequestVar('memberid');
2445
2446         // check if allowed
2447         $member->blogAdminRights($blogid) or $this->disallow();
2448
2449         $mem = MEMBER::createFromID($memberid);
2450
2451         // don't allow when there is only one admin at this moment
2452         if ($mem->isBlogAdmin($blogid)) {
2453             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2454             if (sql_num_rows($r) == 1)
2455                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2456         }
2457
2458         if ($mem->isBlogAdmin($blogid))
2459             $newval = 0;
2460         else
2461             $newval = 1;
2462
2463         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2464         sql_query($query);
2465
2466         // only show manageteam if member did not change its own admin privileges
2467         if ($member->isBlogAdmin($blogid))
2468             $this->action_manageteam();
2469         else
2470             $this->action_overview(_MSG_ADMINCHANGED);
2471     }
2472
2473     /**
2474      * @todo document this
2475      */
2476     function action_blogsettings() {
2477         global $member, $manager;
2478
2479         $blogid = intRequestVar('blogid');
2480
2481         // check if allowed
2482         $member->blogAdminRights($blogid) or $this->disallow();
2483
2484         $blog =& $manager->getBlog($blogid);
2485
2486         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2487         $this->pagehead($extrahead);
2488
2489         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2490         ?>
2491         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2492
2493         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2494
2495         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2496         <?php
2497             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2498             $aMemberNames = array();
2499             while ($o = sql_fetch_object($res))
2500                 array_push($aMemberNames, i18n::hsc($o->mname) . ' (' . i18n::hsc($o->mrealname). ')');
2501             echo implode(',', $aMemberNames);
2502         ?>
2503         </p>
2504
2505
2506
2507         <p>
2508         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2509         </p>
2510
2511         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2512
2513         <form method="post" action="index.php"><div>
2514
2515         <input type="hidden" name="action" value="blogsettingsupdate" />
2516         <?php $manager->addTicketHidden() ?>
2517         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2518         <table><tr>
2519             <td><?php echo _EBLOG_NAME?></td>
2520             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  i18n::hsc($blog->getName()) ?>" /></td>
2521         </tr><tr>
2522             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2523                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2524             </td>
2525             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  i18n::hsc($blog->getShortName()) ?>" /></td>
2526         </tr><tr>
2527             <td><?php echo _EBLOG_DESC?></td>
2528             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  i18n::hsc($blog->getDescription()) ?>" /></td>
2529         </tr><tr>
2530             <td><?php echo _EBLOG_URL?></td>
2531             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  i18n::hsc($blog->getURL()) ?>" /></td>
2532         </tr><tr>
2533             <td><?php echo _EBLOG_DEFSKIN?>
2534                 <?php help('blogdefaultskin'); ?>
2535             </td>
2536             <td>
2537                 <?php
2538                     $query =  'SELECT sdname as text, sdnumber as value'
2539                            . ' FROM '.sql_table('skin_desc');
2540                     $template['name'] = 'defskin';
2541                     $template['selected'] = $blog->getDefaultSkin();
2542                     $template['tabindex'] = 50;
2543                     showlist($query,'select',$template);
2544                 ?>
2545
2546             </td>
2547         </tr><tr>
2548             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2549             </td>
2550             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2551         </tr><tr>
2552             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2553             </td>
2554             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2555         </tr><tr>
2556             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2557             </td>
2558             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2559         </tr><tr>
2560             <td><?php echo _EBLOG_ANONYMOUS?>
2561             </td>
2562             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2563         </tr><tr>
2564     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2565          </td>
2566          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2567       </tr><tr>
2568             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2569             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  i18n::hsc($blog->getNotifyAddress()); ?>" /></td>
2570         </tr><tr>
2571             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2572             <td>
2573                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2574                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2575                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2576                 <br />
2577                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2578                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2579                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2580                 <br />
2581                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2582                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2583                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2584             </td>
2585         </tr><tr>
2586             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2587             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  i18n::hsc($blog->getMaxComments()); ?>" /></td>
2588         </tr><tr>
2589             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2590             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  i18n::hsc($blog->getUpdateFile()) ?>" /></td>
2591         </tr><tr>
2592             <td><?php echo _EBLOG_DEFCAT?></td>
2593             <td>
2594                 <?php
2595                     $query =  'SELECT cname as text, catid as value'
2596                            . ' FROM '.sql_table('category')
2597                            . ' WHERE cblog=' . $blog->getID();
2598                     $template['name'] = 'defcat';
2599                     $template['selected'] = $blog->getDefaultCategory();
2600                     $template['tabindex'] = 110;
2601                     showlist($query,'select',$template);
2602                 ?>
2603             </td>
2604         </tr><tr>
2605             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2606                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2607                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2608                 </td>
2609             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  i18n::hsc($blog->getTimeOffset()); ?>" /></td>
2610         </tr><tr>
2611             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2612             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2613         </tr>
2614         <?php
2615             // plugin options
2616             $this->_insertPluginOptions('blog',$blogid);
2617         ?>
2618         <tr>
2619             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2620         </tr><tr>
2621             <td><?php echo _EBLOG_CHANGE?></td>
2622             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2623         </tr></table>
2624
2625         </div></form>
2626
2627         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2628
2629
2630         <?php
2631         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2632         $template['content'] = 'categorylist';
2633         $template['tabindex'] = 200;
2634
2635         $manager->loadClass("ENCAPSULATE");
2636         $batch = new BATCH('category');
2637         $batch->showlist($query,'table',$template);
2638
2639         ?>
2640
2641
2642         <form action="index.php" method="post"><div>
2643         <input name="action" value="categorynew" type="hidden" />
2644         <?php $manager->addTicketHidden() ?>
2645         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2646
2647         <table><tr>
2648             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2649         </tr><tr>
2650             <td><?php echo _EBLOG_CAT_NAME?></td>
2651             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2652         </tr><tr>
2653             <td><?php echo _EBLOG_CAT_DESC?></td>
2654             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2655         </tr><tr>
2656             <td><?php echo _EBLOG_CAT_CREATE?></td>
2657             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2658         </tr></table>
2659
2660         </div></form>
2661
2662         <?php
2663
2664             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2665
2666             $manager->notify(
2667                 'BlogSettingsFormExtras',
2668                 array(
2669                     'blog' => &$blog
2670                 )
2671             );
2672
2673         $this->pagefoot();
2674     }
2675
2676     /**
2677      * @todo document this
2678      */
2679     function action_categorynew() {
2680         global $member, $manager;
2681
2682         $blogid = intRequestVar('blogid');
2683
2684         $member->blogAdminRights($blogid) or $this->disallow();
2685
2686         $cname = postVar('cname');
2687         $cdesc = postVar('cdesc');
2688
2689         if (!isValidCategoryName($cname))
2690             $this->error(_ERROR_BADCATEGORYNAME);
2691
2692         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2693         $res = sql_query($query);
2694         if (sql_num_rows($res) > 0)
2695             $this->error(_ERROR_DUPCATEGORYNAME);
2696
2697         $blog       =& $manager->getBlog($blogid);
2698         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2699
2700         $this->action_blogsettings();
2701     }
2702
2703     /**
2704      * @todo document this
2705      */
2706     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2707         global $member, $manager;
2708
2709         if ($blogid == '')
2710             $blogid = intGetVar('blogid');
2711         else
2712             $blogid = intval($blogid);
2713         if ($catid == '')
2714             $catid = intGetVar('catid');
2715         else
2716             $catid = intval($catid);
2717
2718         $member->blogAdminRights($blogid) or $this->disallow();
2719
2720         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2721         $obj = sql_fetch_object($res);
2722
2723         $cname = $obj->cname;
2724         $cdesc = $obj->cdesc;
2725
2726         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2727         $this->pagehead($extrahead);
2728
2729         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2730
2731         ?>
2732         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo i18n::hsc($cname)?>'</h2>
2733         <form method='post' action='index.php'><div>
2734         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2735         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2736         <input name="desturl" type="hidden" value="<?php echo i18n::hsc($desturl) ?>" />
2737         <input name="action" type="hidden" value="categoryupdate" />
2738         <?php $manager->addTicketHidden(); ?>
2739
2740         <table><tr>
2741             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2742         </tr><tr>
2743             <td><?php echo _EBLOG_CAT_NAME?></td>
2744             <td><input type="text" name="cname" value="<?php echo i18n::hsc($cname)?>" size="40" maxlength="40" /></td>
2745         </tr><tr>
2746             <td><?php echo _EBLOG_CAT_DESC?></td>
2747             <td><input type="text" name="cdesc" value="<?php echo i18n::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2748         </tr>
2749         <?php
2750             // insert plugin options
2751             $this->_insertPluginOptions('category',$catid);
2752         ?>
2753         <tr>
2754             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2755         </tr><tr>
2756             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2757             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2758         </tr></table>
2759
2760         </div></form>
2761         <?php
2762         $this->pagefoot();
2763     }
2764
2765     /**
2766      * @todo document this
2767      */
2768     function action_categoryupdate() {
2769         global $member, $manager;
2770
2771         $blogid = intPostVar('blogid');
2772         $catid = intPostVar('catid');
2773         $cname = postVar('cname');
2774         $cdesc = postVar('cdesc');
2775         $desturl = postVar('desturl');
2776
2777         $member->blogAdminRights($blogid) or $this->disallow();
2778
2779         if (!isValidCategoryName($cname))
2780             $this->error(_ERROR_BADCATEGORYNAME);
2781
2782         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2783         $res = sql_query($query);
2784         if (sql_num_rows($res) > 0)
2785             $this->error(_ERROR_DUPCATEGORYNAME);
2786
2787         $query =  'UPDATE '.sql_table('category').' SET'
2788                . " cname='" . sql_real_escape_string($cname) . "',"
2789                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2790                . " WHERE catid=" . $catid;
2791
2792         sql_query($query);
2793
2794         // store plugin options
2795         $aOptions = requestArray('plugoption');
2796         NucleusPlugin::_applyPluginOptions($aOptions);
2797         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2798
2799
2800         if ($desturl) {
2801             redirect($desturl);
2802             exit;
2803         } else {
2804             $this->action_blogsettings();
2805         }
2806     }
2807
2808     /**
2809      * @todo document this
2810      */
2811     function action_categorydelete() {
2812         global $member, $manager;
2813
2814         $blogid = intRequestVar('blogid');
2815         $catid = intRequestVar('catid');
2816
2817         $member->blogAdminRights($blogid) or $this->disallow();
2818
2819         $blog =& $manager->getBlog($blogid);
2820
2821         // check if the category is valid
2822         if (!$blog->isValidCategory($catid))
2823             $this->error(_ERROR_NOSUCHCATEGORY);
2824
2825         // don't allow deletion of default category
2826         if ($blog->getDefaultCategory() == $catid)
2827             $this->error(_ERROR_DELETEDEFCATEGORY);
2828
2829         // check if catid is the only category left for blogid
2830         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2831         $res = sql_query($query);
2832         if (sql_num_rows($res) == 1)
2833             $this->error(_ERROR_DELETELASTCATEGORY);
2834
2835
2836         $this->pagehead();
2837         ?>
2838             <h2><?php echo _DELETE_CONFIRM?></h2>
2839
2840             <div>
2841             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  i18n::hsc($blog->getCategoryName($catid))?></b>
2842             </div>
2843
2844             <form method="post" action="index.php"><div>
2845             <input type="hidden" name="action" value="categorydeleteconfirm" />
2846             <?php $manager->addTicketHidden() ?>
2847             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2848             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2849             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2850             </div></form>
2851         <?php
2852         $this->pagefoot();
2853     }
2854
2855     /**
2856      * @todo document this
2857      */
2858     function action_categorydeleteconfirm() {
2859         global $member, $manager;
2860
2861         $blogid = intRequestVar('blogid');
2862         $catid = intRequestVar('catid');
2863
2864         $member->blogAdminRights($blogid) or $this->disallow();
2865
2866         $error = $this->deleteOneCategory($catid);
2867         if ($error)
2868             $this->error($error);
2869
2870         $this->action_blogsettings();
2871     }
2872
2873     /**
2874      * @todo document this
2875      */
2876     function deleteOneCategory($catid) {
2877         global $manager, $member;
2878
2879         $catid = intval($catid);
2880
2881         $blogid = getBlogIDFromCatID($catid);
2882
2883         if (!$member->blogAdminRights($blogid))
2884             return ERROR_DISALLOWED;
2885
2886         // get blog
2887         $blog =& $manager->getBlog($blogid);
2888
2889         // check if the category is valid
2890         if (!$blog || !$blog->isValidCategory($catid))
2891             return _ERROR_NOSUCHCATEGORY;
2892
2893         $destcatid = $blog->getDefaultCategory();
2894
2895         // don't allow deletion of default category
2896         if ($blog->getDefaultCategory() == $catid)
2897             return _ERROR_DELETEDEFCATEGORY;
2898
2899         // check if catid is the only category left for blogid
2900         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2901         $res = sql_query($query);
2902         if (sql_num_rows($res) == 1)
2903             return _ERROR_DELETELASTCATEGORY;
2904
2905         $manager->notify('PreDeleteCategory', array('catid' => $catid));
2906
2907         // change category for all items to the default category
2908         $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2909         sql_query($query);
2910
2911         // delete all associated plugin options
2912         NucleusPlugin::_deleteOptionValues('category', $catid);
2913
2914         // delete category
2915         $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2916         sql_query($query);
2917
2918         $manager->notify('PostDeleteCategory', array('catid' => $catid));
2919
2920     }
2921
2922     /**
2923      * @todo document this
2924      */
2925     function moveOneCategory($catid, $destblogid) {
2926         global $manager, $member;
2927
2928         $catid = intval($catid);
2929         $destblogid = intval($destblogid);
2930
2931         $blogid = getBlogIDFromCatID($catid);
2932
2933         // mover should have admin rights on both blogs
2934         if (!$member->blogAdminRights($blogid))
2935             return _ERROR_DISALLOWED;
2936         if (!$member->blogAdminRights($destblogid))
2937             return _ERROR_DISALLOWED;
2938
2939         // cannot move to self
2940         if ($blogid == $destblogid)
2941             return _ERROR_MOVETOSELF;
2942
2943         // get blogs
2944         $blog =& $manager->getBlog($blogid);
2945         $destblog =& $manager->getBlog($destblogid);
2946
2947         // check if the category is valid
2948         if (!$blog || !$blog->isValidCategory($catid))
2949             return _ERROR_NOSUCHCATEGORY;
2950
2951         // don't allow default category to be moved
2952         if ($blog->getDefaultCategory() == $catid)
2953             return _ERROR_MOVEDEFCATEGORY;
2954
2955         $manager->notify(
2956             'PreMoveCategory',
2957             array(
2958                 'catid' => &$catid,
2959                 'sourceblog' => &$blog,
2960                 'destblog' => &$destblog
2961             )
2962         );
2963
2964         // update comments table (cblog)
2965         $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2966         $items = sql_query($query);
2967         while ($oItem = sql_fetch_object($items)) {
2968             sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2969         }
2970
2971         // update items (iblog)
2972         $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2973         sql_query($query);
2974
2975         // move category
2976         $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2977         sql_query($query);
2978
2979         $manager->notify(
2980             'PostMoveCategory',
2981             array(
2982                 'catid' => &$catid,
2983                 'sourceblog' => &$blog,
2984                 'destblog' => $destblog
2985             )
2986         );
2987
2988     }
2989
2990         /**
2991          * @todo document this
2992          */
2993         function action_blogsettingsupdate()
2994         {
2995                 global $member, $manager;
2996
2997                 $blogid = intRequestVar('blogid');
2998
2999                 $member->blogAdminRights($blogid) or $this->disallow();
3000
3001                 $blog =& $manager->getBlog($blogid);
3002
3003                 $notify         = trim(postVar('notify'));
3004                 $shortname              = trim(postVar('shortname'));
3005                 $updatefile     = trim(postVar('update'));
3006
3007                 $notifyComment  = intPostVar('notifyComment');
3008                 $notifyVote             = intPostVar('notifyVote');
3009                 $notifyNewItem  = intPostVar('notifyNewItem');
3010
3011                 if ($notifyComment == 0)
3012                 {
3013                         $notifyComment = 1;
3014                 }
3015                 if ($notifyVote == 0)
3016                 {
3017                         $notifyVote = 1;
3018                 }
3019                 if ($notifyNewItem == 0)
3020                 {
3021                         $notifyNewItem = 1;
3022                 }
3023                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
3024
3025                 if ($notify)
3026                 {
3027                         $not = new NOTIFICATION($notify);
3028                         if (!$not->validAddresses())
3029                         {
3030                                 $this->error(_ERROR_BADNOTIFY);
3031                         }
3032                 }
3033
3034                 if (!isValidShortName($shortname))
3035                 {
3036                         $this->error(_ERROR_BADSHORTBLOGNAME);
3037                 }
3038
3039                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
3040                 {
3041                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3042                 }
3043                 // check if update file is writable
3044                 if ($updatefile && !is_writeable($updatefile))
3045                 {
3046                         $this->error(_ERROR_UPDATEFILE);
3047                 }
3048
3049                 $blog->setName(trim(postVar('name')));
3050                 $blog->setShortName($shortname);
3051                 $blog->setNotifyAddress($notify);
3052                 $blog->setNotifyType($notifyType);
3053                 $blog->setMaxComments(postVar('maxcomments'));
3054                 $blog->setCommentsEnabled(postVar('comments'));
3055                 $blog->setTimeOffset(postVar('timeoffset'));
3056                 $blog->setUpdateFile($updatefile);
3057                 $blog->setURL(trim(postVar('url')));
3058                 $blog->setDefaultSkin(intPostVar('defskin'));
3059                 $blog->setDescription(trim(postVar('desc')));
3060                 $blog->setPublic(postVar('public'));
3061                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3062                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3063                 $blog->setDefaultCategory(intPostVar('defcat'));
3064                 $blog->setSearchable(intPostVar('searchable'));
3065                 $blog->setEmailRequired(intPostVar('reqemail'));
3066                 $blog->writeSettings();
3067
3068                 // store plugin options
3069                 $aOptions = requestArray('plugoption');
3070                 NucleusPlugin::_applyPluginOptions($aOptions);
3071                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3072
3073                 $this->action_overview(_MSG_SETTINGSCHANGED);
3074         }
3075
3076     /**
3077      * @todo document this
3078      */
3079     function action_deleteblog() {
3080         global $member, $CONF, $manager;
3081
3082         $blogid = intRequestVar('blogid');
3083
3084         $member->blogAdminRights($blogid) or $this->disallow();
3085
3086         // check if blog is default blog
3087         if ($CONF['DefaultBlog'] == $blogid)
3088             $this->error(_ERROR_DELDEFBLOG);
3089
3090         $blog =& $manager->getBlog($blogid);
3091
3092         $this->pagehead();
3093         ?>
3094             <h2><?php echo _DELETE_CONFIRM?></h2>
3095
3096             <p><?php echo _WARNINGTXT_BLOGDEL?>
3097             </p>
3098
3099             <div>
3100             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  i18n::hsc($blog->getName())?></b>
3101             </div>
3102
3103             <form method="post" action="index.php"><div>
3104             <input type="hidden" name="action" value="deleteblogconfirm" />
3105             <?php $manager->addTicketHidden() ?>
3106             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3107             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3108             </div></form>
3109         <?php
3110         $this->pagefoot();
3111     }
3112
3113     /**
3114      * @todo document this
3115      */
3116     function action_deleteblogconfirm() {
3117         global $member, $CONF, $manager;
3118
3119         $blogid = intRequestVar('blogid');
3120
3121         $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3122
3123         $member->blogAdminRights($blogid) or $this->disallow();
3124
3125         // check if blog is default blog
3126         if ($CONF['DefaultBlog'] == $blogid)
3127             $this->error(_ERROR_DELDEFBLOG);
3128
3129         // delete all comments
3130         $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3131         sql_query($query);
3132
3133         // delete all items
3134         $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3135         sql_query($query);
3136
3137         // delete all team members
3138         $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3139         sql_query($query);
3140
3141         // delete all bans
3142         $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3143         sql_query($query);
3144
3145         // delete all categories
3146         $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3147         sql_query($query);
3148
3149         // delete all associated plugin options
3150         NucleusPlugin::_deleteOptionValues('blog', $blogid);
3151
3152         // delete the blog itself
3153         $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3154         sql_query($query);
3155
3156         $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3157
3158         $this->action_overview(_DELETED_BLOG);
3159     }
3160
3161     /**
3162      * @todo document this
3163      */
3164     function action_memberdelete() {
3165         global $member, $manager;
3166
3167         $memberid = intRequestVar('memberid');
3168
3169         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3170
3171         $mem = MEMBER::createFromID($memberid);
3172
3173         $this->pagehead();
3174         ?>
3175             <h2><?php echo _DELETE_CONFIRM?></h2>
3176
3177             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo i18n::hsc($mem->getDisplayName()) ?></b>
3178             </p>
3179
3180             <p>
3181             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3182             </p>
3183
3184             <form method="post" action="index.php"><div>
3185             <input type="hidden" name="action" value="memberdeleteconfirm" />
3186             <?php $manager->addTicketHidden() ?>
3187             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3188             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3189             </div></form>
3190         <?php
3191         $this->pagefoot();
3192     }
3193
3194     /**
3195      * @todo document this
3196      */
3197     function action_memberdeleteconfirm() {
3198         global $member;
3199
3200         $memberid = intRequestVar('memberid');
3201
3202         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3203
3204         $error = $this->deleteOneMember($memberid);
3205         if ($error)
3206             $this->error($error);
3207
3208         if ($member->isAdmin())
3209             $this->action_usermanagement();
3210         else
3211             $this->action_overview(_DELETED_MEMBER);
3212     }
3213
3214     /**
3215      * @static
3216      * @todo document this
3217      */
3218     function deleteOneMember($memberid) {
3219         global $manager;
3220
3221         $memberid = intval($memberid);
3222         $mem = MEMBER::createFromID($memberid);
3223
3224         if (!$mem->canBeDeleted())
3225             return _ERROR_DELETEMEMBER;
3226
3227         $manager->notify('PreDeleteMember', array('member' => &$mem));
3228
3229         /* unlink comments from memberid */
3230         if ($memberid) {
3231             $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. sql_real_escape_string($mem->getDisplayName())
3232                         .'" WHERE cmember='.$memberid;
3233             sql_query($query);
3234         }
3235
3236         $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3237         sql_query($query);
3238
3239         $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3240         sql_query($query);
3241
3242         $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3243         sql_query($query);
3244
3245         // delete all associated plugin options
3246         NucleusPlugin::_deleteOptionValues('member', $memberid);
3247
3248         $manager->notify('PostDeleteMember', array('member' => &$mem));
3249
3250         return '';
3251     }
3252
3253     /**
3254      * @todo document this
3255      */
3256     function action_createnewlog() {
3257         global $member, $CONF, $manager;
3258
3259         // Only Super-Admins can do this
3260         $member->isAdmin() or $this->disallow();
3261
3262         $this->pagehead();
3263
3264         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3265         ?>
3266         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3267
3268         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3269
3270         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3271
3272         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3273
3274         <ol>
3275             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3276             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3277         </ol>
3278
3279         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3280
3281         <p>
3282         <?php echo _EBLOG_CREATE_TEXT?>
3283         </p>
3284
3285         <form method="post" action="index.php"><div>
3286
3287         <input type="hidden" name="action" value="addnewlog" />
3288         <?php $manager->addTicketHidden() ?>
3289
3290
3291         <table><tr>
3292             <td><?php echo _EBLOG_NAME?></td>
3293             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3294         </tr><tr>
3295             <td><?php echo _EBLOG_SHORTNAME?>
3296                 <?php help('shortblogname'); ?>
3297             </td>
3298             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3299         </tr><tr>
3300             <td><?php echo _EBLOG_DESC?></td>
3301             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3302         </tr><tr>
3303             <td><?php echo _EBLOG_DEFSKIN?>
3304                 <?php help('blogdefaultskin'); ?>
3305             </td>
3306             <td>
3307                 <?php
3308                     $query =  'SELECT sdname as text, sdnumber as value'
3309                            . ' FROM '.sql_table('skin_desc');
3310                     $template['name'] = 'defskin';
3311                     $template['tabindex'] = 50;
3312                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3313                     showlist($query,'select',$template);
3314                 ?>
3315             </td>
3316         </tr><tr>
3317             <td><?php echo _EBLOG_OFFSET?>
3318                 <?php help('blogtimeoffset'); ?>
3319                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3320             </td>
3321             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3322         </tr><tr>
3323             <td><?php echo _EBLOG_ADMIN?>
3324                 <?php help('teamadmin'); ?>
3325             </td>
3326             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3327         </tr><tr>
3328             <td><?php echo _EBLOG_CREATE?></td>
3329             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3330         </tr></table>
3331
3332         </div></form>
3333         <?php
3334         $this->pagefoot();
3335     }
3336
3337     /**
3338      * @todo document this
3339      */
3340     function action_addnewlog() {
3341         global $member, $manager, $CONF;
3342
3343         // Only Super-Admins can do this
3344         $member->isAdmin() or $this->disallow();
3345
3346         $bname          = trim(postVar('name'));
3347         $bshortname     = trim(postVar('shortname'));
3348         $btimeoffset    = postVar('timeoffset');
3349         $bdesc          = trim(postVar('desc'));
3350         $bdefskin       = postVar('defskin');
3351
3352         if (!isValidShortName($bshortname))
3353             $this->error(_ERROR_BADSHORTBLOGNAME);
3354
3355         if ($manager->existsBlog($bshortname))
3356             $this->error(_ERROR_DUPSHORTBLOGNAME);
3357
3358         $manager->notify(
3359             'PreAddBlog',
3360             array(
3361                 'name' => &$bname,
3362                 'shortname' => &$bshortname,
3363                 'timeoffset' => &$btimeoffset,
3364                 'description' => &$bdesc,
3365                 'defaultskin' => &$bdefskin
3366             )
3367         );
3368
3369
3370         // add slashes for sql queries
3371         $bname =        sql_real_escape_string($bname);
3372         $bshortname =   sql_real_escape_string($bshortname);
3373         $btimeoffset =  sql_real_escape_string($btimeoffset);
3374         $bdesc =        sql_real_escape_string($bdesc);
3375         $bdefskin =     sql_real_escape_string($bdefskin);
3376
3377         // create blog
3378         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3379         sql_query($query);
3380         $blogid = sql_insert_id();
3381         $blog   =& $manager->getBlog($blogid);
3382
3383         // create new category
3384         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3385         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3386         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3387         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3388 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3389 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3390         $catid = sql_insert_id();
3391
3392         // set as default category
3393         $blog->setDefaultCategory($catid);
3394         $blog->writeSettings();
3395
3396         // create team member
3397         $memberid = $member->getID();
3398         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3399         sql_query($query);
3400
3401         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3402         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3403
3404         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3405         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3406
3407
3408
3409         $manager->notify(
3410             'PostAddBlog',
3411             array(
3412                 'blog' => &$blog
3413             )
3414         );
3415
3416         $manager->notify(
3417             'PostAddCategory',
3418             array(
3419                 'blog' => &$blog,
3420                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3421                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3422                 'catid' => $catid
3423             )
3424         );
3425
3426         $this->pagehead();
3427         ?>
3428         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3429
3430         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, i18n::hsc($bname)) ?></p>
3431
3432         <ol>
3433             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, i18n::hsc($bshortname)) ?></a></li>
3434             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3435         </ol>
3436
3437         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, i18n::hsc($bshortname)) ?></a></h3>
3438
3439         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, i18n::hsc($bshortname)) ?></p>
3440 <pre><code>&lt;?php
3441
3442 $CONF['Self'] = '<b><?php echo i18n::hsc($bshortname)?>.php</b>';
3443
3444 include('<i>./config.php</i>');
3445
3446 selectBlog('<b><?php echo i18n::hsc($bshortname)?></b>');
3447 selector();
3448
3449 ?&gt;</code></pre>
3450
3451         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3452
3453         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3454
3455         <form action="index.php" method="post"><div>
3456             <input type="hidden" name="action" value="addnewlog2" />
3457             <?php $manager->addTicketHidden() ?>
3458             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3459             <table><tr>
3460                 <td><?php echo _EBLOG_URL?></td>
3461                 <td><input name="url" maxlength="100" size="40" value="<?php echo i18n::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3462             </tr><tr>
3463                 <td><?php echo _EBLOG_CREATE?></td>
3464                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3465             </tr></table>
3466         </div></form>
3467
3468         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3469
3470         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3471
3472         <form action="index.php" method="post"><div>
3473             <input type="hidden" name="action" value="addnewlog2" />
3474             <?php $manager->addTicketHidden() ?>
3475             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3476             <table><tr>
3477                 <td><?php echo _EBLOG_URL?></td>
3478                 <td><input name="url" maxlength="100" size="40" /></td>
3479             </tr><tr>
3480                 <td><?php echo _EBLOG_CREATE?></td>
3481                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3482             </tr></table>
3483         </div></form>
3484
3485         <?php       $this->pagefoot();
3486
3487     }
3488
3489     /**
3490      * @todo document this
3491      */
3492     function action_addnewlog2() {
3493         global $member, $manager;
3494
3495         $member->blogAdminRights($blogid) or $this->disallow();
3496
3497         $burl   = requestVar('url');
3498         $blogid = intRequestVar('blogid');
3499
3500         $blog =& $manager->getBlog($blogid);
3501         $blog->setURL(trim($burl));
3502         $blog->writeSettings();
3503
3504         $this->action_overview(_MSG_NEWBLOG);
3505     }
3506
3507     /**
3508      * @todo document this
3509      */
3510     function action_skinieoverview() {
3511         global $member, $DIR_LIBS, $manager;
3512
3513         $member->isAdmin() or $this->disallow();
3514
3515         // load skinie class
3516         include_once($DIR_LIBS . 'skinie.php');
3517
3518         $this->pagehead();
3519
3520         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3521
3522     ?>
3523         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3524
3525                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3526                 <?php                   global $DIR_SKINS;
3527
3528                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3529
3530                     if (sizeof($candidates) > 0) {
3531                         ?>
3532                             <form method="post" action="index.php"><div>
3533                                 <input type="hidden" name="action" value="skinieimport" />
3534                                 <?php $manager->addTicketHidden() ?>
3535                                 <input type="hidden" name="mode" value="file" />
3536                                 <select name="skinfile" id="skinie_import_local">
3537                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3538                                         $html = i18n::hsc($skinfile);
3539                                         echo '<option value="',$html,'">',$skinname,'</option>';
3540                                     }
3541                                 ?>
3542                                 </select>
3543                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3544                             </div></form>
3545                         <?php                   } else {
3546                         echo _SKINIE_NOCANDIDATES;
3547                     }
3548                 ?>
3549                 </p>
3550
3551                 <p><em><?php echo _OR?></em></p>
3552
3553                 <form method="post" action="index.php"><p>
3554                     <?php $manager->addTicketHidden() ?>
3555                     <input type="hidden" name="action" value="skinieimport" />
3556                     <input type="hidden" name="mode" value="url" />
3557                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3558                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3559                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3560                 </p></form>
3561
3562
3563         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3564         <form method="post" action="index.php"><div>
3565             <input type="hidden" name="action" value="skinieexport" />
3566             <?php $manager->addTicketHidden() ?>
3567
3568             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3569
3570             <table><tr>
3571                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3572             </tr><tr>
3573     <?php       // show list of skins
3574         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3575         while ($skinObj = sql_fetch_object($res)) {
3576             $id = 'skinexp' . $skinObj->sdnumber;
3577             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3578             echo '<label for="',$id,'">',i18n::hsc($skinObj->sdname),'</label></td>';
3579             echo '<td>',i18n::hsc($skinObj->sddesc),'</td>';
3580             echo '</tr><tr>';
3581         }
3582
3583         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3584
3585         // show list of templates
3586         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3587         while ($templateObj = sql_fetch_object($res)) {
3588             $id = 'templateexp' . $templateObj->tdnumber;
3589             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3590             echo '<label for="',$id,'">',i18n::hsc($templateObj->tdname),'</label></td>';
3591             echo '<td>',i18n::hsc($templateObj->tddesc),'</td>';
3592             echo '</tr><tr>';
3593         }
3594
3595     ?>
3596                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3597             </tr><tr>
3598                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3599             </tr><tr>
3600                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3601             </tr><tr>
3602                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3603             </tr></table>
3604         </div></form>
3605
3606     <?php
3607         $this->pagefoot();
3608
3609     }
3610
3611     /**
3612      * @todo document this
3613      */
3614     function action_skinieimport() {
3615         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3616
3617         $member->isAdmin() or $this->disallow();
3618
3619         // load skinie class
3620         include_once($DIR_LIBS . 'skinie.php');
3621
3622         $skinFileRaw= postVar('skinfile');
3623         $mode       = postVar('mode');
3624
3625         $importer = new SKINIMPORT();
3626
3627         // get full filename
3628         if ($mode == 'file')
3629         {
3630             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3631
3632             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3633             if (!file_exists($skinFile))
3634                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3635         } else {
3636             $skinFile = $skinFileRaw;
3637         }
3638
3639         // read only metadata
3640         $error = $importer->readFile($skinFile, 1);
3641
3642         // clashes
3643         $skinNameClashes = $importer->checkSkinNameClashes();
3644         $templateNameClashes = $importer->checkTemplateNameClashes();
3645         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3646
3647         if ($error) $this->error($error);
3648
3649         $this->pagehead();
3650
3651         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3652         ?>
3653         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3654
3655         <ul>
3656             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo i18n::hsc($importer->getInfo())?></p></li>
3657             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3658             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3659             <?php
3660                 if ($hasNameClashes)
3661                 {
3662             ?>
3663             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3664             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3665             <?php
3666                 } // if (hasNameClashes)
3667             ?>
3668         </ul>
3669
3670         <form method="post" action="index.php"><div>
3671             <input type="hidden" name="action" value="skiniedoimport" />
3672             <?php $manager->addTicketHidden() ?>
3673             <input type="hidden" name="skinfile" value="<?php echo i18n::hsc(postVar('skinfile'))?>" />
3674             <input type="hidden" name="mode" value="<?php echo i18n::hsc($mode)?>" />
3675             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3676             <?php
3677                 if ($hasNameClashes)
3678                 {
3679             ?>
3680             <br />
3681             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3682             <?php
3683                 } // if (hasNameClashes)
3684             ?>
3685         </div></form>
3686
3687
3688         <?php
3689         $this->pagefoot();
3690     }
3691
3692     /**
3693      * @todo document this
3694      */
3695     function action_skiniedoimport() {
3696         global $member, $DIR_LIBS, $DIR_SKINS;
3697
3698         $member->isAdmin() or $this->disallow();
3699
3700         // load skinie class
3701         include_once($DIR_LIBS . 'skinie.php');
3702
3703         $skinFileRaw= postVar('skinfile');
3704         $mode       = postVar('mode');
3705
3706         $allowOverwrite = intPostVar('overwrite');
3707
3708         // get full filename
3709         if ($mode == 'file')
3710         {
3711             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3712
3713             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3714             if (!file_exists($skinFile))
3715                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3716
3717         } else {
3718             $skinFile = $skinFileRaw;
3719         }
3720
3721         $importer = new SKINIMPORT();
3722
3723         $error = $importer->readFile($skinFile);
3724
3725         if ($error)
3726             $this->error($error);
3727
3728         $error = $importer->writeToDatabase($allowOverwrite);
3729
3730         if ($error)
3731             $this->error($error);
3732
3733         $this->pagehead();
3734
3735         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3736     ?>
3737         <h2><?php echo _SKINIE_DONE?></h2>
3738
3739         <ul>
3740             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo i18n::hsc($importer->getInfo())?></p></li>
3741             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3742             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3743         </ul>
3744
3745     <?php       $this->pagefoot();
3746
3747     }
3748
3749     /**
3750      * @todo document this
3751      */
3752     function action_skinieexport() {
3753         global $member, $DIR_LIBS;
3754
3755         $member->isAdmin() or $this->disallow();
3756
3757         // load skinie class
3758         include_once($DIR_LIBS . 'skinie.php');
3759
3760         $aSkins = requestIntArray('skin');
3761         $aTemplates = requestIntArray('template');
3762
3763         if (!is_array($aTemplates)) $aTemplates = array();
3764         if (!is_array($aSkins)) $aSkins = array();
3765
3766         $skinList = array_keys($aSkins);
3767         $templateList = array_keys($aTemplates);
3768
3769         $info = postVar('info');
3770
3771         $exporter = new SKINEXPORT();
3772         foreach ($skinList as $skinId) {
3773             $exporter->addSkin($skinId);
3774         }
3775         foreach ($templateList as $templateId) {
3776             $exporter->addTemplate($templateId);
3777         }
3778         $exporter->setInfo($info);
3779
3780         $exporter->export();
3781     }
3782
3783     /**
3784      * @todo document this
3785      */
3786     function action_templateoverview() {
3787         global $member, $manager;
3788
3789         $member->isAdmin() or $this->disallow();
3790
3791         $this->pagehead();
3792
3793         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3794
3795         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3796         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3797
3798         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3799         $template['content'] = 'templatelist';
3800         $template['tabindex'] = 10;
3801         showlist($query,'table',$template);
3802
3803         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3804
3805         ?>
3806         <form method="post" action="index.php"><div>
3807
3808         <input name="action" value="templatenew" type="hidden" />
3809         <?php $manager->addTicketHidden() ?>
3810         <table><tr>
3811             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3812             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3813         </tr><tr>
3814             <td><?php echo _TEMPLATE_DESC?></td>
3815             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3816         </tr><tr>
3817             <td><?php echo _TEMPLATE_CREATE?></td>
3818             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3819         </tr></table>
3820
3821         </div></form>
3822
3823         <?php
3824         $this->pagefoot();
3825     }
3826
3827     /**
3828      * @todo document this
3829      */
3830     function action_templateedit($msg = '') {
3831         global $member, $manager;
3832
3833         $templateid = intRequestVar('templateid');
3834
3835         $member->isAdmin() or $this->disallow();
3836
3837         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3838         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3839
3840         $this->pagehead($extrahead);
3841
3842         $templatename = TEMPLATE::getNameFromId($templateid);
3843         $templatedescription = TEMPLATE::getDesc($templateid);
3844         $template =& $manager->getTemplate($templatename);
3845
3846         ?>
3847         <p>
3848         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3849         </p>
3850
3851         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  i18n::hsc($templatename); ?>'</h2>
3852
3853         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3854         ?>
3855
3856         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3857
3858         <form method="post" action="index.php">
3859         <div>
3860
3861         <input type="hidden" name="action" value="templateupdate" />
3862         <?php $manager->addTicketHidden() ?>
3863         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3864
3865         <table><tr>
3866             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3867         </tr><tr>
3868             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3869             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  i18n::hsc($templatename) ?>" /></td>
3870         </tr><tr>
3871             <td><?php echo _TEMPLATE_DESC?></td>
3872             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  i18n::hsc($templatedescription) ?>" /></td>
3873         </tr><tr>
3874             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3875         </tr><tr>
3876             <td><?php echo _TEMPLATE_UPDATE?></td>
3877             <td>
3878                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3879                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3880             </td>
3881         </tr><tr>
3882             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3883 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3884     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3885     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3886     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3887     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3888     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3889 ?>
3890         </tr><tr>
3891             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3892 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3893     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3894     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3895     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3896     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3897     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3898     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3899 ?>
3900         </tr><tr>
3901             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3902 <?php
3903     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3904 ?>
3905         </tr><tr>
3906             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3907 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3908 ?>
3909         </tr><tr>
3910             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3911 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3912     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3913     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3914 ?>
3915         </tr><tr>
3916             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3917 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3918     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3919     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3920 ?>
3921         </tr><tr>
3922             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3923 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3924     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3925     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3926 ?>
3927         </tr><tr>
3928             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3929 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3930     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3931     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3932     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3933     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3934 ?>
3935         </tr><tr>
3936             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3937 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3938     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3939     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3940 ?>
3941         </tr><tr>
3942             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3943 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3944     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3945 ?>
3946         </tr><tr>
3947             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3948 <?php
3949         $tab = 600;
3950         $pluginfields = array();
3951         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3952
3953         foreach ($pluginfields as $pfkey=>$pfvalue) {
3954             echo "</tr><tr>\n";
3955             echo '<th colspan="2">' . i18n::hen($pfkey) . "</th>\n";
3956             foreach ($pfvalue as $pffield=>$pfdesc) {
3957                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3958             }
3959         }
3960 ?>
3961         </tr><tr>
3962             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3963         </tr><tr>
3964             <td><?php echo _TEMPLATE_UPDATE?></td>
3965             <td>
3966                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3967                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3968             </td>
3969         </tr></table>
3970
3971         </div>
3972         </form>
3973         <?php
3974         $this->pagefoot();
3975     }
3976
3977     /**
3978      * @todo document this
3979      */
3980     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3981         static $count = 1;
3982         if (!isset($template[$name])) $template[$name] = '';
3983     ?>
3984         </tr><tr>
3985             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3986             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  i18n::hsc($template[$name]); ?></textarea></td>
3987     <?php       $count++;
3988     }
3989
3990     /**
3991      * @todo document this
3992      */
3993     function action_templateupdate() {
3994         global $member,$manager;
3995
3996         $templateid = intRequestVar('templateid');
3997
3998         $member->isAdmin() or $this->disallow();
3999
4000         $name = postVar('tname');
4001         $desc = postVar('tdesc');
4002
4003         if (!isValidTemplateName($name))
4004             $this->error(_ERROR_BADTEMPLATENAME);
4005
4006         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
4007             $this->error(_ERROR_DUPTEMPLATENAME);
4008
4009
4010         $name = sql_real_escape_string($name);
4011         $desc = sql_real_escape_string($desc);
4012
4013         // 1. Remove all template parts
4014         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
4015         sql_query($query);
4016
4017         // 2. Update description
4018         $query =  'UPDATE '.sql_table('template_desc').' SET'
4019                . " tdname='" . $name . "',"
4020                . " tddesc='" . $desc . "'"
4021                . " WHERE tdnumber=" . $templateid;
4022         sql_query($query);
4023
4024         // 3. Add non-empty template parts
4025         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
4026         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
4027         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
4028         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
4029         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
4030         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
4031         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
4032         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
4033         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
4034         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
4035         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4036         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4037         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4038         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4039         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4040         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4041         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4042         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4043         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4044         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4045         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4046         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4047         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4048         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4049         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4050         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4051         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4052         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4053         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4054         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4055         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4056         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4057         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4058         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4059
4060         $pluginfields = array();
4061         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4062         foreach ($pluginfields as $pfkey=>$pfvalue) {
4063             foreach ($pfvalue as $pffield=>$pfdesc) {
4064                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4065             }
4066         }
4067
4068         // jump back to template edit
4069         $this->action_templateedit(_TEMPLATE_UPDATED);
4070
4071     }
4072
4073     /**
4074      * @todo document this
4075      */
4076     function addToTemplate($id, $partname, $content) {
4077         $partname = sql_real_escape_string($partname);
4078         $content = sql_real_escape_string($content);
4079
4080         $id = intval($id);
4081
4082         // don't add empty parts:
4083         if (!trim($content)) return -1;
4084
4085         $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
4086                . "VALUES ($id, '$partname', '$content')";
4087         sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4088         return sql_insert_id();
4089     }
4090
4091     /**
4092      * @todo document this
4093      */
4094     function action_templatedelete() {
4095         global $member, $manager;
4096
4097         $member->isAdmin() or $this->disallow();
4098
4099         $templateid = intRequestVar('templateid');
4100         // TODO: check if template can be deleted
4101
4102         $this->pagehead();
4103
4104         $name = TEMPLATE::getNameFromId($templateid);
4105         $desc = TEMPLATE::getDesc($templateid);
4106
4107         ?>
4108             <h2><?php echo _DELETE_CONFIRM?></h2>
4109
4110             <p>
4111             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo i18n::hsc($name)?></b> (<?php echo  i18n::hsc($desc) ?>)
4112             </p>
4113
4114             <form method="post" action="index.php"><div>
4115                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4116                 <?php $manager->addTicketHidden() ?>
4117                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4118                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4119             </div></form>
4120         <?php
4121         $this->pagefoot();
4122     }
4123
4124     /**
4125      * @todo document this
4126      */
4127     function action_templatedeleteconfirm() {
4128         global $member, $manager;
4129
4130         $templateid = intRequestVar('templateid');
4131
4132         $member->isAdmin() or $this->disallow();
4133
4134         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4135
4136         // 1. delete description
4137         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4138
4139         // 2. delete parts
4140         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4141
4142         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4143
4144         $this->action_templateoverview();
4145     }
4146
4147     /**
4148      * @todo document this
4149      */
4150     function action_templatenew() {
4151         global $member;
4152
4153         $member->isAdmin() or $this->disallow();
4154
4155         $name = postVar('name');
4156         $desc = postVar('desc');
4157
4158         if (!isValidTemplateName($name))
4159             $this->error(_ERROR_BADTEMPLATENAME);
4160
4161         if (TEMPLATE::exists($name))
4162             $this->error(_ERROR_DUPTEMPLATENAME);
4163
4164         $newTemplateId = TEMPLATE::createNew($name, $desc);
4165
4166         $this->action_templateoverview();
4167     }
4168
4169     /**
4170      * @todo document this
4171      */
4172     function action_templateclone() {
4173         global $member;
4174
4175         $templateid = intRequestVar('templateid');
4176
4177         $member->isAdmin() or $this->disallow();
4178
4179         // 1. read old template
4180         $name = TEMPLATE::getNameFromId($templateid);
4181         $desc = TEMPLATE::getDesc($templateid);
4182
4183         // 2. create desc thing
4184         $name = "cloned" . $name;
4185
4186         // if a template with that name already exists:
4187         if (TEMPLATE::exists($name)) {
4188             $i = 1;
4189             while (TEMPLATE::exists($name . $i))
4190                 $i++;
4191             $name .= $i;
4192         }
4193
4194         $newid = TEMPLATE::createNew($name, $desc);
4195
4196         // 3. create clone
4197         // go through parts of old template and add them to the new one
4198         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4199         while ($o = sql_fetch_object($res)) {
4200             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4201         }
4202
4203         $this->action_templateoverview();
4204     }
4205
4206     /**
4207      * @todo document this
4208      */
4209     function action_skinoverview() {
4210         global $member, $manager;
4211
4212         $member->isAdmin() or $this->disallow();
4213
4214         $this->pagehead();
4215
4216         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4217
4218         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4219
4220         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4221
4222         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4223         $template['content'] = 'skinlist';
4224         $template['tabindex'] = 10;
4225         showlist($query,'table',$template);
4226
4227         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4228
4229         ?>
4230         <form method="post" action="index.php">
4231         <div>
4232
4233         <input name="action" value="skinnew" type="hidden" />
4234         <?php $manager->addTicketHidden() ?>
4235         <table><tr>
4236             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4237             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4238         </tr><tr>
4239             <td><?php echo _SKIN_DESC?></td>
4240             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4241         </tr><tr>
4242             <td><?php echo _SKIN_CREATE?></td>
4243             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4244         </tr></table>
4245
4246         </div>
4247         </form>
4248
4249         <?php
4250         $this->pagefoot();
4251     }
4252
4253     /**
4254      * @todo document this
4255      */
4256     function action_skinnew() {
4257         global $member;
4258
4259         $member->isAdmin() or $this->disallow();
4260
4261         $name = trim(postVar('name'));
4262         $desc = trim(postVar('desc'));
4263
4264         if (!isValidSkinName($name))
4265             $this->error(_ERROR_BADSKINNAME);
4266
4267         if (SKIN::exists($name))
4268             $this->error(_ERROR_DUPSKINNAME);
4269
4270         $newId = SKIN::createNew($name, $desc);
4271
4272         $this->action_skinoverview();
4273     }
4274
4275     /**
4276      * @todo document this
4277      */
4278     function action_skinedit() {
4279         global $member, $manager;
4280
4281         $skinid = intRequestVar('skinid');
4282
4283         $member->isAdmin() or $this->disallow();
4284
4285         $skin = new SKIN($skinid);
4286
4287         $this->pagehead();
4288         ?>
4289         <p>
4290             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4291         </p>
4292         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4293
4294         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4295         <?php echo _SKIN_PARTS_MSG?>
4296         <ul>
4297             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4298             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4299             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4300             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4301             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4302             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4303             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4304             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4305         </ul>
4306
4307         <?php
4308
4309         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4310         $res = sql_query($query);
4311
4312         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4313         echo '<form method="get" action="index.php">' . "\r\n";
4314         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4315         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4316         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4317         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4318         echo '</form>' . "\r\n";
4319
4320         if ($res && sql_num_rows($res) > 0) {
4321             echo '<ul>';
4322             $tabstart = 75;
4323
4324             while ($row = sql_fetch_assoc($res)) {
4325                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . i18n::hsc(strtolower($row['stype'])) . '">' . i18n::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . i18n::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4326             }
4327
4328             echo '</ul>';
4329         }
4330
4331         ?>
4332
4333         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4334         <form method="post" action="index.php">
4335         <div>
4336
4337         <input type="hidden" name="action" value="skineditgeneral" />
4338         <?php $manager->addTicketHidden() ?>
4339         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4340         <table><tr>
4341             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4342             <td><input name="name" tabindex="90" value="<?php echo  i18n::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4343         </tr><tr>
4344             <td><?php echo _SKIN_DESC?></td>
4345             <td><input name="desc" tabindex="100" value="<?php echo  i18n::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4346         </tr><tr>
4347             <td><?php echo _SKIN_TYPE?></td>
4348             <td><input name="type" tabindex="110" value="<?php echo  i18n::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4349         </tr><tr>
4350             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4351             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4352         </tr><tr>
4353             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4354             <td><input name="inc_prefix" tabindex="130" value="<?php echo  i18n::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4355         </tr><tr>
4356             <td><?php echo _SKIN_CHANGE?></td>
4357             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4358         </tr></table>
4359
4360         </div>
4361         </form>
4362
4363
4364         <?php       $this->pagefoot();
4365     }
4366
4367     /**
4368      * @todo document this
4369      */
4370     function action_skineditgeneral() {
4371         global $member;
4372
4373         $skinid = intRequestVar('skinid');
4374
4375         $member->isAdmin() or $this->disallow();
4376
4377         $name = postVar('name');
4378         $desc = postVar('desc');
4379         $type = postVar('type');
4380         $inc_mode = postVar('inc_mode');
4381         $inc_prefix = postVar('inc_prefix');
4382
4383         $skin = new SKIN($skinid);
4384
4385         // 1. Some checks
4386         if (!isValidSkinName($name))
4387             $this->error(_ERROR_BADSKINNAME);
4388
4389         if (($skin->getName() != $name) && SKIN::exists($name))
4390             $this->error(_ERROR_DUPSKINNAME);
4391
4392         if (!$type) $type = 'text/html';
4393         if (!$inc_mode) $inc_mode = 'normal';
4394
4395         // 2. Update description
4396         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4397
4398         $this->action_skinedit();
4399
4400     }
4401
4402     /**
4403      * @todo document this
4404      */
4405     function action_skinedittype($msg = '') {
4406         global $member, $manager;
4407
4408         $skinid = intRequestVar('skinid');
4409         $type = requestVar('type');
4410
4411         $member->isAdmin() or $this->disallow();
4412
4413         $type = trim($type);
4414         $type = strtolower($type);
4415
4416         if (!isValidShortName($type)) {
4417             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4418         }
4419
4420         $skin = new SKIN($skinid);
4421
4422         $friendlyNames = SKIN::getFriendlyNames();
4423
4424         $this->pagehead();
4425         ?>
4426         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4427
4428         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo i18n::hsc($skin->getName()) ?>': <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4429
4430         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4431         ?>
4432
4433
4434         <form method="post" action="index.php">
4435         <div>
4436
4437         <input type="hidden" name="action" value="skinupdate" />
4438         <?php $manager->addTicketHidden() ?>
4439         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4440         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4441
4442         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4443         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4444         (skin type: <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4445         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4446             help('skinpart' . $type);
4447         } else {
4448             help('skinpartspecial');
4449         }?>
4450         <br />
4451
4452         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  i18n::hsc($skin->getContent($type)) ?></textarea>
4453
4454         <br />
4455         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4456         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4457         (skin type: <?php echo i18n::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4458
4459         <br /><br />
4460         <?php echo _SKIN_ALLOWEDVARS?>
4461         <?php           $actions = SKIN::getAllowedActionsForType($type);
4462
4463             sort($actions);
4464
4465             while ($current = array_shift($actions)) {
4466                 // skip deprecated vars
4467                 if ($current == 'ifcat') continue;
4468                 if ($current == 'imagetext') continue;
4469                 if ($current == 'vars') continue;
4470
4471                 echo helplink('skinvar-' . $current) . "$current</a>";
4472                 if (count($actions) != 0) echo ", ";
4473             }
4474         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4475         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4476         showlist($query,'table',array('content'=>'shortblognames'));
4477         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4478         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4479         showlist($query,'table',array('content'=>'shortnames'));
4480         echo '</div></form>';
4481         $this->pagefoot();
4482     }
4483
4484     /**
4485      * @todo document this
4486      */
4487     function action_skinupdate() {
4488         global $member;
4489
4490         $skinid = intRequestVar('skinid');
4491         $content = trim(postVar('content'));
4492         $type = postVar('type');
4493
4494         $member->isAdmin() or $this->disallow();
4495
4496         $skin = new SKIN($skinid);
4497         $skin->update($type, $content);
4498
4499         $this->action_skinedittype(_SKIN_UPDATED);
4500     }
4501
4502     /**
4503      * @todo document this
4504      */
4505     function action_skindelete() {
4506         global $member, $manager, $CONF;
4507
4508         $skinid = intRequestVar('skinid');
4509
4510         $member->isAdmin() or $this->disallow();
4511
4512         // don't allow default skin to be deleted
4513         if ($skinid == $CONF['BaseSkin'])
4514             $this->error(_ERROR_DEFAULTSKIN);
4515
4516         // don't allow deletion of default skins for blogs
4517         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4518         $r = sql_query($query);
4519         if ($o = sql_fetch_object($r))
4520             $this->error(_ERROR_SKINDEFDELETE . i18n::hsc($o->bname));
4521
4522         $this->pagehead();
4523
4524         $skin = new SKIN($skinid);
4525         $name = $skin->getName();
4526         $desc = $skin->getDescription();
4527
4528         ?>
4529             <h2><?php echo _DELETE_CONFIRM?></h2>
4530
4531             <p>
4532                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo i18n::hsc($name) ?></b> (<?php echo  i18n::hsc($desc)?>)
4533             </p>
4534
4535             <form method="post" action="index.php"><div>
4536                 <input type="hidden" name="action" value="skindeleteconfirm" />
4537                 <?php $manager->addTicketHidden() ?>
4538                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4539                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4540             </div></form>
4541         <?php
4542         $this->pagefoot();
4543     }
4544
4545     /**
4546      * @todo document this
4547      */
4548     function action_skindeleteconfirm() {
4549         global $member, $CONF, $manager;
4550
4551         $skinid = intRequestVar('skinid');
4552
4553         $member->isAdmin() or $this->disallow();
4554
4555         // don't allow default skin to be deleted
4556         if ($skinid == $CONF['BaseSkin'])
4557             $this->error(_ERROR_DEFAULTSKIN);
4558
4559         // don't allow deletion of default skins for blogs
4560         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4561         $r = sql_query($query);
4562         if ($o = sql_fetch_object($r))
4563             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4564
4565         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4566
4567         // 1. delete description
4568         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4569
4570         // 2. delete parts
4571         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4572
4573         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4574
4575         $this->action_skinoverview();
4576     }
4577
4578     /**
4579      * @todo document this
4580      */
4581     function action_skinremovetype() {
4582         global $member, $manager, $CONF;
4583
4584         $skinid = intRequestVar('skinid');
4585         $skintype = requestVar('type');
4586
4587         if (!isValidShortName($skintype)) {
4588             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4589         }
4590
4591         $member->isAdmin() or $this->disallow();
4592
4593         // don't allow default skinparts to be deleted
4594         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4595             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4596         }
4597
4598         $this->pagehead();
4599
4600         $skin = new SKIN($skinid);
4601         $name = $skin->getName();
4602         $desc = $skin->getDescription();
4603
4604         ?>
4605             <h2><?php echo _DELETE_CONFIRM?></h2>
4606
4607             <p>
4608                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo i18n::hsc($skintype); ?> (<?php echo i18n::hsc($name); ?>)</b> (<?php echo  i18n::hsc($desc)?>)
4609             </p>
4610
4611             <form method="post" action="index.php"><div>
4612                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4613                 <?php $manager->addTicketHidden() ?>
4614                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4615                 <input type="hidden" name="type" value="<?php echo i18n::hsc($skintype); ?>" />
4616                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4617             </div></form>
4618         <?php
4619         $this->pagefoot();
4620     }
4621
4622     /**
4623      * @todo document this
4624      */
4625     function action_skinremovetypeconfirm() {
4626         global $member, $CONF, $manager;
4627
4628         $skinid = intRequestVar('skinid');
4629         $skintype = requestVar('type');
4630
4631         if (!isValidShortName($skintype)) {
4632             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4633         }
4634
4635         $member->isAdmin() or $this->disallow();
4636
4637         // don't allow default skinparts to be deleted
4638         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4639             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4640         }
4641
4642         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4643
4644         // delete part
4645         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4646
4647         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4648
4649         $this->action_skinedit();
4650     }
4651
4652     /**
4653      * @todo document this
4654      */
4655     function action_skinclone() {
4656         global $member;
4657
4658         $skinid = intRequestVar('skinid');
4659
4660         $member->isAdmin() or $this->disallow();
4661
4662         // 1. read skin to clone
4663         $skin = new SKIN($skinid);
4664
4665         $name = "clone_" . $skin->getName();
4666
4667         // if a skin with that name already exists:
4668         if (SKIN::exists($name)) {
4669             $i = 1;
4670             while (SKIN::exists($name . $i))
4671                 $i++;
4672             $name .= $i;
4673         }
4674
4675         // 2. create skin desc
4676         $newid = SKIN::createNew(
4677             $name,
4678             $skin->getDescription(),
4679             $skin->getContentType(),
4680             $skin->getIncludeMode(),
4681             $skin->getIncludePrefix()
4682         );
4683
4684
4685         // 3. clone
4686         /*
4687         $this->skinclonetype($skin, $newid, 'index');
4688         $this->skinclonetype($skin, $newid, 'item');
4689         $this->skinclonetype($skin, $newid, 'archivelist');
4690         $this->skinclonetype($skin, $newid, 'archive');
4691         $this->skinclonetype($skin, $newid, 'search');
4692         $this->skinclonetype($skin, $newid, 'error');
4693         $this->skinclonetype($skin, $newid, 'member');
4694         $this->skinclonetype($skin, $newid, 'imagepopup');
4695         */
4696
4697         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4698         $res = sql_query($query);
4699         while ($row = sql_fetch_assoc($res)) {
4700             $this->skinclonetype($skin, $newid, $row['stype']);
4701         }
4702
4703         $this->action_skinoverview();
4704
4705     }
4706
4707     /**
4708      * @todo document this
4709      */
4710     function skinclonetype($skin, $newid, $type) {
4711         $newid = intval($newid);
4712         $content = $skin->getContent($type);
4713         if ($content) {
4714             $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
4715             sql_query($query);
4716         }
4717     }
4718
4719     /**
4720      * @todo document this
4721      */
4722     function action_settingsedit() {
4723         global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4724
4725         $member->isAdmin() or $this->disallow();
4726
4727         $this->pagehead();
4728
4729         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4730         ?>
4731
4732         <h2><?php echo _SETTINGS_TITLE?></h2>
4733
4734         <form action="index.php" method="post">
4735         <div>
4736
4737         <input type="hidden" name="action" value="settingsupdate" />
4738         <?php $manager->addTicketHidden() ?>
4739
4740         <table><tr>
4741             <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4742         </tr><tr>
4743             <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4744             <td>
4745                 <?php
4746                     $query =  'SELECT bname as text, bnumber as value'
4747                            . ' FROM '.sql_table('blog');
4748                     $template['name'] = 'DefaultBlog';
4749                     $template['selected'] = $CONF['DefaultBlog'];
4750                     $template['tabindex'] = 10;
4751                     showlist($query,'select',$template);
4752                 ?>
4753             </td>
4754         </tr><tr>
4755             <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4756             <td>
4757                 <?php
4758                     $query =  'SELECT sdname as text, sdnumber as value'
4759                            . ' FROM '.sql_table('skin_desc');
4760                     $template['name'] = 'BaseSkin';
4761                     $template['selected'] = $CONF['BaseSkin'];
4762                     $template['tabindex'] = 1;
4763                     showlist($query,'select',$template);
4764                 ?>
4765             </td>
4766         </tr><tr>
4767             <td><?php echo _SETTINGS_ADMINMAIL?></td>
4768             <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  i18n::hsc($CONF['AdminEmail']) ?>" /></td>
4769         </tr><tr>
4770             <td><?php echo _SETTINGS_SITENAME?></td>
4771             <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  i18n::hsc($CONF['SiteName']) ?>" /></td>
4772         </tr><tr>
4773             <td><?php echo _SETTINGS_SITEURL?></td>
4774             <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  i18n::hsc($CONF['IndexURL']) ?>" /></td>
4775         </tr><tr>
4776             <td><?php echo _SETTINGS_ADMINURL?></td>
4777             <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  i18n::hsc($CONF['AdminURL']) ?>" /></td>
4778         </tr><tr>
4779             <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4780             <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  i18n::hsc($CONF['PluginURL']) ?>" /></td>
4781         </tr><tr>
4782             <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4783             <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  i18n::hsc($CONF['SkinsURL']) ?>" /></td>
4784         </tr><tr>
4785             <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4786             <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  i18n::hsc($CONF['ActionURL']) ?>" /></td>
4787         </tr><tr>
4788             <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4789             </td>
4790             <td>
4791                 <select name="Language" tabindex="10050">
4792                         <?php
4793                                 $locales = i18n::get_available_locale_list();
4794                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4795                                 {
4796                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4797                                 }
4798                                 else
4799                                 {
4800                                         echo "<option value=\"\">en_Latn_US</option>\n";
4801                                 }
4802
4803                                 foreach ( $locales as $locale )
4804                                 {
4805                                         if ( $locale == 'en_Latn_US' )
4806                                         {
4807                                                 continue;
4808                                         }
4809                                         if ( $locale == i18n::get_current_locale() )
4810                                         {
4811                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4812                                         }
4813                                         else
4814                                         {
4815                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4816                                         }
4817                                 }
4818                         ?>
4819                         </select>
4820
4821             </td>
4822         </tr><tr>
4823             <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4824             </td>
4825             <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4826                     <br />
4827                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  i18n::hsc($CONF['DisableSiteURL'])?>" />
4828             </td>
4829         </tr><tr>
4830             <td><?php echo _SETTINGS_DIRS?></td>
4831             <td><?php echo  i18n::hsc($DIR_NUCLEUS) ?>
4832                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4833         </tr><tr>
4834             <td><?php echo _SETTINGS_DBLOGIN?></td>
4835             <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4836         </tr><tr>
4837             <td>
4838             <?php
4839                 echo _SETTINGS_JSTOOLBAR
4840                 /* =_SETTINGS_DISABLEJS
4841
4842                     I temporary changed the meaning of DisableJsTools, until I can find a good
4843                     way to select the javascript version to use
4844
4845                     now, its:
4846                         0 : IE
4847                         1 : all javascript disabled
4848                         2 : 'simpler' javascript (for mozilla/opera/mac)
4849                 */
4850                ?>
4851             </td>
4852             <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4853                 <select name="DisableJsTools" tabindex="10075">
4854             <?php                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4855                     echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4856                     $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4857                     echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4858                     $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4859                     echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4860             ?>
4861                 </select>
4862             </td>
4863         </tr><tr>
4864             <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4865                        <td><?php
4866
4867                        $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4868                               'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4869
4870                        echo ' ', _SETTINGS_URLMODE_HELP;
4871
4872                              ?>
4873
4874                        </td>
4875         </tr><tr>
4876             <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4877                        <td><?php
4878
4879                         $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4880
4881                              ?>
4882
4883                        </td>
4884         </tr><tr>
4885             <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4886             <td>
4887             <?php
4888                 if (!array_key_exists('DefaultListSize',$CONF)) {
4889                     sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4890                     $CONF['DefaultListSize'] = 10;
4891                 }
4892             ?>
4893                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  i18n::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4894             </td>
4895         </tr><tr>
4896             <td><?php echo _SETTINGS_ADMINCSS?>
4897             </td>
4898             <td>
4899
4900                 <select name="AdminCSS" tabindex="10080">
4901                 <?php               // show a dropdown list of all available admin css files
4902                 global $DIR_NUCLEUS;
4903
4904                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4905
4906                                 while ($filename = readdir($dirhandle) )
4907                                 {
4908
4909                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4910                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4911
4912                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4913                                         {
4914
4915                                                 $name = $matches[1];
4916                                                 echo "<option value=\"$name\"";
4917
4918                                                 if ($name == $CONF['AdminCSS'])
4919                                                 {
4920                                                         echo " selected=\"selected\"";
4921                                                 }
4922
4923                                                 echo ">$name</option>";
4924
4925                                         }
4926
4927                                 }
4928
4929                                 closedir($dirhandle);
4930
4931                                 ?>
4932                                 </select>
4933
4934             </td>
4935         </tr><tr>
4936             <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4937         </tr><tr>
4938             <td><?php echo _SETTINGS_MEDIADIR?></td>
4939             <td><?php echo  i18n::hsc($DIR_MEDIA) ?>
4940                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4941                 <?php                   if (!is_dir($DIR_MEDIA))
4942                         echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4943                     if (!is_readable($DIR_MEDIA))
4944                         echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4945                     if (!is_writeable($DIR_MEDIA))
4946                         echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4947                 ?>
4948             </td>
4949         </tr><tr>
4950             <td><?php echo _SETTINGS_MEDIAURL?></td>
4951             <td>
4952                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  i18n::hsc($CONF['MediaURL']) ?>" />
4953             </td>
4954         </tr><tr>
4955             <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4956             <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4957         </tr><tr>
4958             <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4959             <td>
4960                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  i18n::hsc($CONF['AllowedTypes']) ?>" />
4961             </td>
4962         </tr><tr>
4963             <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4964             <td>
4965                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  i18n::hsc($CONF['MaxUploadSize']) ?>" />
4966             </td>
4967         </tr><tr>
4968             <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4969             <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4970
4971         </tr><tr>
4972             <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4973         </tr><tr>
4974             <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4975             <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4976         </tr><tr>
4977             <td><?php echo _SETTINGS_ALLOWCREATE?>
4978                 <?php help('allowaccountcreation'); ?>
4979             </td>
4980             <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4981             </td>
4982         </tr><tr>
4983             <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4984                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4985             </td>
4986             <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4987             </td>
4988         </tr><tr>
4989             <td><?php echo _SETTINGS_MEMBERMSGS?>
4990                 <?php help('messageservice'); ?>
4991             </td>
4992             <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4993             </td>
4994         </tr><tr>
4995             <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4996                 <?php help('messageservice'); ?>
4997             </td>
4998             <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4999             </td>
5000         </tr><tr>
5001             <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
5002                 <?php help('protectmemnames'); ?>
5003             </td>
5004             <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
5005             </td>
5006
5007
5008
5009         </tr><tr>
5010             <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
5011         </tr><tr>
5012             <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
5013             <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  i18n::hsc($CONF['CookiePrefix'])?>" /></td>
5014         </tr><tr>
5015             <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
5016             <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  i18n::hsc($CONF['CookieDomain'])?>" /></td>
5017         </tr><tr>
5018             <td><?php echo _SETTINGS_COOKIEPATH?></td>
5019             <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  i18n::hsc($CONF['CookiePath'])?>" /></td>
5020         </tr><tr>
5021             <td><?php echo _SETTINGS_COOKIESECURE?></td>
5022             <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
5023         </tr><tr>
5024             <td><?php echo _SETTINGS_COOKIELIFE?></td>
5025             <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
5026                               1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
5027             </td>
5028         </tr><tr>
5029             <td><?php echo _SETTINGS_LASTVISIT?></td>
5030             <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
5031
5032
5033
5034         </tr><tr>
5035             <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5036         </tr><tr>
5037             <td><?php echo _SETTINGS_UPDATE?></td>
5038             <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5039         </tr></table>
5040
5041         </div>
5042         </form>
5043
5044         <?php
5045             echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5046
5047             $manager->notify(
5048                 'GeneralSettingsFormExtras',
5049                 array()
5050             );
5051
5052         $this->pagefoot();
5053     }
5054
5055         /**
5056          * @todo document this
5057          */
5058         function action_settingsupdate() {
5059                 global $member, $CONF;
5060
5061                 $member->isAdmin() or $this->disallow();
5062
5063                 // check if email address for admin is valid
5064                 if ( !isValidMailAddress(postVar('AdminEmail')) )
5065                 {
5066                         $this->error(_ERROR_BADMAILADDRESS);
5067                 }
5068
5069                 // save settings
5070                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5071                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5072                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5073                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5074                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5075                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5076                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5077                 $this->updateConfig('Language',            postVar('Language'));
5078                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5079                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5080                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5081                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5082                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5083                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5084                 $this->updateConfig('SiteName',          postVar('SiteName'));
5085                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5086                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5087                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5088                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5089                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5090                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5091                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5092                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5093                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5094                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5095                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5096                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5097                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5098                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5099                 $this->updateConfig('URLMode',            postVar('URLMode'));
5100                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5101                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5102                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5103                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5104
5105                 // load new config and redirect (this way, the new language will be used is necessary)
5106                 // note that when changing cookie settings, this redirect might cause the user
5107                 // to have to log in again.
5108                 getConfig();
5109                 redirect($CONF['AdminURL'] . '?action=manage');
5110                 exit;
5111         }
5112
5113     /**
5114      *  Give an overview over the used system
5115      */
5116     function action_systemoverview() {
5117         global $member, $nucleus, $CONF;
5118
5119         $this->pagehead();
5120
5121         echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5122
5123         if ($member->isLoggedIn() && $member->isAdmin()) {
5124
5125             // Information about the used PHP and MySQL installation
5126             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n";
5127
5128             // Version of PHP MySQL
5129             echo "<table>\n";
5130             echo "\t<tr>\n";
5131             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5132             echo "\t</tr><tr>\n";
5133             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5134             echo "\t\t" . '<td>' . phpversion() . "</td>\n";
5135             echo "\t</tr><tr>\n";
5136             echo "\t\t" . '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5137             echo "\t\t" . '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5138             echo "\t</tr>";
5139             echo "</table>\n";
5140
5141             // Important PHP settings
5142             echo "<table>\n";
5143             echo "\t<tr>\n";
5144             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5145             echo "\t</tr><tr>\n";
5146             echo "\t\t" . '<td width="50%">magic_quotes_gpc' . "</td>\n";
5147             $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5148             echo "\t\t" . '<td>' . $mqg . "</td>\n";
5149             echo "\t</tr><tr>\n";
5150             echo "\t\t" . '<td>magic_quotes_runtime' . "</td>\n";
5151             $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5152             echo "\t\t" . '<td>' . $mqr . "</td>\n";
5153             echo "\t</tr><tr>\n";
5154             echo "\t\t" . '<td>register_globals' . "</td>\n";
5155             $rg = ini_get('register_globals') ? 'On' : 'Off';
5156             echo "\t\t" . '<td>' . $rg . "</td>\n";
5157             echo "\t</tr>";
5158             echo "</table>\n";
5159
5160             // Information about GD library
5161             $gdinfo = gd_info();
5162             echo "<table>\n";
5163             echo "\t<tr>";
5164             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5165             echo "\t</tr>\n";
5166             foreach ($gdinfo as $key=>$value) {
5167                 if (is_bool($value)) {
5168                     $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5169                 } else {
5170                     $value = i18n::hsc($value);
5171                 }
5172                 echo "\t<tr>";
5173                 echo "\t\t" . '<td width="50%">' . $key . "</td>\n";
5174                 echo "\t\t" . '<td>' . $value . "</td>\n";
5175                 echo "\t</tr>\n";
5176             }
5177             echo "</table>\n";
5178
5179             // Check if special modules are loaded
5180             ob_start();
5181             phpinfo(INFO_MODULES);
5182             $im = ob_get_contents();
5183             ob_clean();
5184             echo "<table>\n";
5185             echo "\t<tr>";
5186             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5187             echo "\t</tr><tr>\n";
5188             echo "\t\t" . '<td width="50%">mod_rewrite' . "</td>\n";
5189             $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5190                         _ADMIN_SYSTEMOVERVIEW_ENABLE :
5191                         _ADMIN_SYSTEMOVERVIEW_DISABLE;
5192             echo "\t\t" . '<td>' . $modrewrite . "</td>\n";
5193             echo "\t</tr>\n";
5194             echo "</table>\n";
5195
5196             // Information about the used Nucleus CMS
5197             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5198             global $nucleus;
5199             $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5200             $np = getNucleusPatchLevel();
5201             echo "<table>\n";
5202             echo "\t<tr>";
5203             echo "\t\t" . '<th colspan="2">Nucleus CMS' . "</th>\n";
5204             echo "\t</tr><tr>\n";
5205             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5206             echo "\t\t" . '<td>' . $nv . "</td>\n";
5207             echo "\t</tr><tr>\n";
5208             echo "\t\t" . '<td width="50%">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5209             echo "\t\t" . '<td>' . $np . "</td>\n";
5210             echo "\t</tr>\n";
5211             echo "</table>\n";
5212
5213             // Important settings of the installation
5214             echo "<table>\n";
5215             echo "\t<tr>";
5216             echo "\t\t" . '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5217             echo "\t</tr><tr>\n";
5218             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'Self']</td>\n";
5219             echo "\t\t" . '<td>' . $CONF['Self'] . "</td>\n";
5220             echo "\t</tr><tr>\n";
5221             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'ItemURL']</td>\n";
5222             echo "\t\t" . '<td>' . $CONF['ItemURL'] . "</td>\n";
5223             echo "\t</tr><tr>\n";
5224             echo "\t\t" . '<td width="50%">' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5225             $ohs = $CONF['alertOnHeadersSent'] ?
5226                         _ADMIN_SYSTEMOVERVIEW_ENABLE :
5227                         _ADMIN_SYSTEMOVERVIEW_DISABLE;
5228             echo "\t\t" . '<td>' . $ohs . "</td>\n";
5229             echo "\t</tr>\n";
5230             echo "</table>\n";
5231
5232             // Link to the online version test at the Nucleus CMS website
5233             echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5234             if ($nucleus['codename'] != '') {
5235                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5236             } else {
5237                 $codenamestring = '';
5238             }
5239             echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5240             $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5241             echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5242             echo 'Nucleus CMS ' . $nv . $codenamestring;
5243             echo '</a>';
5244         //echo '<br />';
5245         }
5246         else {
5247             echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5248         }
5249
5250         $this->pagefoot();
5251     }
5252
5253     /**
5254      * @todo document this
5255      */
5256     function updateConfig($name, $val) {
5257         $name = sql_real_escape_string($name);
5258         $val = trim(sql_real_escape_string($val));
5259
5260         $query = 'UPDATE '.sql_table('config')
5261                . " SET value='$val'"
5262                . " WHERE name='$name'";
5263
5264         sql_query($query) or die("Query error: " . sql_error());
5265         return sql_insert_id();
5266     }
5267
5268     /**
5269      * Error message
5270      * @param string $msg message that will be shown
5271      */
5272     function error($msg) {
5273         $this->pagehead();
5274         ?>
5275         <h2>Error!</h2>
5276         <?php       echo $msg;
5277         echo "<br />";
5278         echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
5279         $this->pagefoot();
5280         exit;
5281     }
5282
5283     /**
5284      * @todo document this
5285      */
5286     function disallow() {
5287         ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5288
5289         $this->error(_ERROR_DISALLOWED);
5290     }
5291
5292     /**
5293      * @todo document this
5294      */
5295     function pagehead($extrahead = '') {
5296         global $member, $nucleus, $CONF, $manager;
5297
5298         $manager->notify(
5299             'AdminPrePageHead',
5300             array(
5301                 'extrahead' => &$extrahead,
5302                 'action' => $this->action
5303             )
5304         );
5305
5306         $baseUrl = i18n::hsc($CONF['AdminURL']);
5307                 if (!array_key_exists('AdminCSS',$CONF))
5308                 {
5309                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5310                         $CONF['AdminCSS'] = 'original';
5311                 }
5312
5313         ?>
5314         <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
5315         <html <?php echo _HTML_XML_NAME_SPACE_AND_LANG_CODE; ?>>
5316         <head>
5317             <meta http-equiv="Content-Type" content="text/html; charset=<?php echo i18n::get_current_charset() ?>" />
5318             <title><?php echo i18n::hsc($CONF['SiteName'])?> - Admin</title>
5319             <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin_<?php echo $CONF["AdminCSS"]?>.css" />
5320             <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
5321             href="<?php echo $baseUrl?>styles/addedit.css" />
5322
5323             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
5324             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
5325             <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
5326
5327       <meta http-equiv='Pragma' content='no-cache' />
5328       <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
5329       <meta http-equiv='Expires' content='-1' />
5330
5331             <?php echo $extrahead?>
5332         </head>
5333         <body>
5334         <div id="adminwrapper">
5335         <div class="header">
5336         <h1><?php echo i18n::hsc($CONF['SiteName'])?></h1>
5337         </div>
5338         <div id="container">
5339         <div id="content">
5340         <div class="loginname">
5341         <?php           if ($member->isLoggedIn())
5342                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
5343                     ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
5344                     . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5345             else
5346                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
5347
5348             echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
5349
5350             echo '<br />(';
5351
5352             $codenamestring = ($nucleus['codename']!='')? ' &quot;'.$nucleus['codename'].'&quot;':'';
5353
5354             if ($member->isLoggedIn() && $member->isAdmin()) {
5355                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5356                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5357                 $newestVersion = getLatestVersion();
5358                 $newestCompare = str_replace('/','.',$newestVersion);
5359                 $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5360                 if ($newestVersion && version_compare($newestCompare,$currentVersion) > 0) {
5361                     echo '<br /><a style="color:red" href="http://nucleuscms.org/upgrade.php" title="'._ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE.'">'._ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT.$newestVersion.'</a>';
5362                 }
5363             } else {
5364                 echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5365             }
5366             echo ')';
5367         echo '</div>';
5368     }
5369
5370     /**
5371      * @todo document this
5372      */
5373     function pagefoot() {
5374         global $action, $member, $manager;
5375
5376         $manager->notify(
5377             'AdminPrePageFoot',
5378             array(
5379                 'action' => $this->action
5380             )
5381         );
5382
5383         if ($member->isLoggedIn() && ($action != 'showlogin')) {
5384             ?>
5385             <h2><?php echo  _LOGOUT ?></h2>
5386             <ul>
5387                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5388                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5389             </ul>
5390             <?php       }
5391         ?>
5392             <div class="foot">
5393                 <a href="<?php echo _ADMINPAGEFOOT_OFFICIALURL ?>">Nucleus CMS</a> &copy; 2002-<?php echo date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT; ?>
5394                 -
5395                 <a href="<?php echo _ADMINPAGEFOOT_DONATEURL ?>"><?php echo _ADMINPAGEFOOT_DONATE ?></a>
5396             </div>
5397
5398             </div><!-- content -->
5399
5400             <div id="quickmenu">
5401
5402                 <?php               // ---- user settings ----
5403                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5404                     echo '<ul>';
5405                     echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5406                     echo '</ul>';
5407
5408                     echo '<h2>',_QMENU_ADD,'</h2>';
5409                     echo '<form method="get" action="index.php"><div>';
5410                     echo '<input type="hidden" name="action" value="createitem" />';
5411
5412                         $showAll = requestVar('showall');
5413                         if (($member->isAdmin()) && ($showAll == 'yes')) {
5414                             // Super-Admins have access to all blogs! (no add item support though)
5415                             $query =  'SELECT bnumber as value, bname as text'
5416                                    . ' FROM ' . sql_table('blog')
5417                                    . ' ORDER BY bname';
5418                         } else {
5419                             $query =  'SELECT bnumber as value, bname as text'
5420                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5421                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5422                                    . ' ORDER BY bname';
5423                         }
5424                         $template['name'] = 'blogid';
5425                         $template['tabindex'] = 15000;
5426                         $template['extra'] = _QMENU_ADD_SELECT;
5427                         $template['selected'] = -1;
5428                         $template['shorten'] = 10;
5429                         $template['shortenel'] = '';
5430                         $template['javascript'] = 'onchange="return form.submit()"';
5431                         showlist($query,'select',$template);
5432
5433                     echo '</div></form>';
5434
5435                     echo '<h2>' . $member->getDisplayName(). '</h2>';
5436                     echo '<ul>';
5437                     echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . '</a></li>';
5438                     echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . '</a></li>';
5439                     echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . '</a></li>';
5440                     echo '</ul>';
5441
5442
5443
5444
5445                     // ---- general settings ----
5446                     if ($member->isAdmin()) {
5447
5448                         echo '<h2>',_QMENU_MANAGE,'</h2>';
5449
5450                         echo '<ul>';
5451                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . '</a></li>';
5452                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . '</a></li>';
5453                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . '</a></li>';
5454                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . '</a></li>';
5455                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . '</a></li>';
5456                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . '</a></li>';
5457                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . '</a></li>';
5458                         echo '</ul>';
5459
5460                         echo '<h2>',_QMENU_LAYOUT,'</h2>';
5461                         echo '<ul>';
5462                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . '</a></li>';
5463                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . '</a></li>';
5464                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . '</a></li>';
5465                         echo '</ul>';
5466
5467                     }
5468
5469                     $aPluginExtras = array();
5470                     $manager->notify(
5471                         'QuickMenu',
5472                         array(
5473                             'options' => &$aPluginExtras
5474                         )
5475                     );
5476                     if (count($aPluginExtras) > 0)
5477                     {
5478                         echo '<h2>', _QMENU_PLUGINS, '</h2>';
5479                         echo '<ul>';
5480                         foreach ($aPluginExtras as $aInfo)
5481                         {
5482                             echo '<li><a href="'.i18n::hsc($aInfo['url']).'" title="'.i18n::hsc($aInfo['tooltip']).'">'.i18n::hsc($aInfo['title']).'</a></li>';
5483                         }
5484                         echo '</ul>';
5485                     }
5486
5487                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5488
5489                     echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5490                 } else {
5491                     // introduction text on login screen
5492                     echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5493                 }
5494                 ?>
5495             </div>
5496
5497             <!-- content / quickmenu container -->
5498             <div class="clear"></div>    <!-- new -->
5499             </div>
5500
5501             <!-- adminwrapper -->    <!-- new -->
5502             </div>     <!-- new -->
5503             </body>
5504             </html>
5505         <?php   }
5506
5507     /**
5508      * @todo document this
5509      */
5510     function action_regfile() {
5511         global $member, $CONF;
5512
5513         $blogid = intRequestVar('blogid');
5514
5515         $member->teamRights($blogid) or $this->disallow();
5516
5517         // header-code stolen from phpMyAdmin
5518         // REGEDIT and bookmarklet code stolen from GreyMatter
5519
5520         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5521
5522
5523         header('Content-Type: application/octetstream');
5524         header('Content-Disposition: filename="nucleus.reg"');
5525         header('Pragma: no-cache');
5526         header('Expires: 0');
5527
5528         echo "REGEDIT4\n";
5529         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5530         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5531         echo '"contexts"=hex:31';
5532     }
5533
5534     /**
5535      * @todo document this
5536      */
5537     function action_bookmarklet() {
5538         global $member, $manager;
5539
5540         $blogid = intRequestVar('blogid');
5541
5542         $member->teamRights($blogid) or $this->disallow();
5543
5544         $blog =& $manager->getBlog($blogid);
5545         $bm = getBookmarklet($blogid);
5546
5547         $this->pagehead();
5548
5549         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5550
5551         ?>
5552
5553         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5554
5555         <p>
5556         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5557         </p>
5558
5559         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5560         <p>
5561             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5562             <br />
5563             <br />
5564             <?php echo '<a href="' . i18n::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, i18n::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5565         </p>
5566
5567         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5568         <p>
5569             <?php
5570                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5571                 $url = $manager->addTicketToUrl($url);
5572             ?>
5573             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . i18n::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5574         </p>
5575
5576         <p>
5577             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5578         </p>
5579
5580         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5581         <p>
5582             <?php echo _BOOKMARKLET_DELETEBAR ?>
5583         </p>
5584
5585         <p>
5586             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5587         </p>
5588
5589         <ol>
5590             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5591             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5592             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5593             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5594             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5595         </ol>
5596
5597         <?php
5598         $this->pagefoot();
5599
5600     }
5601
5602     /**
5603      * @todo document this
5604      */
5605     function action_actionlog() {
5606         global $member, $manager;
5607
5608         $member->isAdmin() or $this->disallow();
5609
5610         $this->pagehead();
5611
5612         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5613
5614         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5615
5616         ?>
5617             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5618             <p><a href="<?php echo i18n::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5619         <?php
5620         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5621
5622         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5623         $template['content'] = 'actionlist';
5624         $amount = showlist($query,'table',$template);
5625
5626         $this->pagefoot();
5627
5628     }
5629
5630     /**
5631      * @todo document this
5632      */
5633     function action_banlist() {
5634         global $member, $manager;
5635
5636         $blogid = intRequestVar('blogid');
5637
5638         $member->blogAdminRights($blogid) or $this->disallow();
5639
5640         $blog =& $manager->getBlog($blogid);
5641
5642         $this->pagehead();
5643
5644         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5645
5646         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5647
5648         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5649         $template['content'] = 'banlist';
5650         $amount = showlist($query,'table',$template);
5651
5652         if ($amount == 0)
5653             echo _BAN_NONE;
5654
5655         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5656         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5657
5658
5659         $this->pagefoot();
5660
5661     }
5662
5663     /**
5664      * @todo document this
5665      */
5666     function action_banlistdelete() {
5667         global $member, $manager;
5668
5669         $blogid = intRequestVar('blogid');
5670         $iprange = requestVar('iprange');
5671
5672         $member->blogAdminRights($blogid) or $this->disallow();
5673
5674         $blog =& $manager->getBlog($blogid);
5675         $banBlogName =  i18n::hsc($blog->getName());
5676
5677         $this->pagehead();
5678         ?>
5679             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5680
5681             <form method="post" action="index.php">
5682
5683             <h3><?php echo _BAN_IPRANGE?></h3>
5684
5685             <p>
5686                 <?php echo _CONFIRMTXT_BAN?> <?php echo i18n::hsc($iprange) ?>
5687                 <input name="iprange" type="hidden" value="<?php echo i18n::hsc($iprange)?>" />
5688             </p>
5689
5690             <h3><?php echo _BAN_BLOGS?></h3>
5691
5692             <div>
5693                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5694                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5695                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5696                 <br />
5697                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5698             </div>
5699
5700             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5701
5702             <div>
5703                 <?php $manager->addTicketHidden() ?>
5704                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5705                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5706             </div>
5707
5708             </form>
5709         <?php
5710         $this->pagefoot();
5711     }
5712
5713     /**
5714      * @todo document this
5715      */
5716     function action_banlistdeleteconfirm() {
5717         global $member, $manager;
5718
5719         $blogid = intPostVar('blogid');
5720         $allblogs = postVar('allblogs');
5721         $iprange = postVar('iprange');
5722
5723         $member->blogAdminRights($blogid) or $this->disallow();
5724
5725         $deleted = array();
5726
5727         if (!$allblogs) {
5728             if (BAN::removeBan($blogid, $iprange))
5729                 array_push($deleted, $blogid);
5730         } else {
5731             // get blogs fot which member has admin rights
5732             $adminblogs = $member->getAdminBlogs();
5733             foreach ($adminblogs as $blogje) {
5734                 if (BAN::removeBan($blogje, $iprange))
5735                     array_push($deleted, $blogje);
5736             }
5737         }
5738
5739         if (sizeof($deleted) == 0)
5740             $this->error(_ERROR_DELETEBAN);
5741
5742         $this->pagehead();
5743
5744         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5745         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5746         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5747
5748         echo "<ul>";
5749         foreach ($deleted as $delblog) {
5750             $b =& $manager->getBlog($delblog);
5751             echo "<li>" . i18n::hsc($b->getName()). "</li>";
5752         }
5753         echo "</ul>";
5754
5755         $this->pagefoot();
5756
5757     }
5758
5759     /**
5760      * @todo document this
5761      */
5762     function action_banlistnewfromitem() {
5763         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5764     }
5765
5766     /**
5767      * @todo document this
5768      */
5769     function action_banlistnew($blogid = '') {
5770         global $member, $manager;
5771
5772         if ($blogid == '')
5773             $blogid = intRequestVar('blogid');
5774
5775         $ip = requestVar('ip');
5776
5777         $member->blogAdminRights($blogid) or $this->disallow();
5778
5779         $blog =& $manager->getBlog($blogid);
5780
5781         $this->pagehead();
5782         ?>
5783         <h2><?php echo _BAN_ADD_TITLE?></h2>
5784
5785
5786         <form method="post" action="index.php">
5787
5788         <h3><?php echo _BAN_IPRANGE?></h3>
5789
5790         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5791
5792         <div class="note">
5793             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5794             <?php echo _BAN_EXAMPLE_TEXT ?>
5795         </div>
5796
5797         <div>
5798         <?php
5799         if ($ip) {
5800             $iprangeVal = i18n::hsc($ip);
5801         ?>
5802             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5803             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5804             <br />
5805             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5806             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5807             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5808         <?php
5809         } else {
5810             echo "<input name='iprange' value='custom' type='hidden' />";
5811             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5812         }
5813         ?>
5814         </div>
5815
5816         <h3><?php echo _BAN_BLOGS?></h3>
5817
5818         <p><?php echo _BAN_BLOGS_TEXT?></p>
5819
5820         <div>
5821             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5822             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo i18n::hsc($blog->getName())?>'</label>
5823             <br />
5824             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5825         </div>
5826
5827         <h3><?php echo _BAN_REASON_TITLE?></h3>
5828
5829         <p><?php echo _BAN_REASON_TEXT?></p>
5830
5831         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5832
5833         <h3><?php echo _BAN_ADD_TITLE?></h3>
5834
5835         <div>
5836             <input name="action" type="hidden" value="banlistadd" />
5837             <?php $manager->addTicketHidden() ?>
5838             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5839         </div>
5840
5841         </form>
5842
5843         <?php       $this->pagefoot();
5844     }
5845
5846     /**
5847      * @todo document this
5848      */
5849     function action_banlistadd() {
5850         global $member;
5851
5852         $blogid =       intPostVar('blogid');
5853         $allblogs =     postVar('allblogs');
5854         $iprange =      postVar('iprange');
5855         if ($iprange == "custom")
5856             $iprange = postVar('customiprange');
5857         $reason =       postVar('reason');
5858
5859         $member->blogAdminRights($blogid) or $this->disallow();
5860
5861         // TODO: check IP range validity
5862
5863         if (!$allblogs) {
5864             if (!BAN::addBan($blogid, $iprange, $reason))
5865                 $this->error(_ERROR_ADDBAN);
5866         } else {
5867             // get blogs fot which member has admin rights
5868             $adminblogs = $member->getAdminBlogs();
5869             $failed = 0;
5870             foreach ($adminblogs as $blogje) {
5871                 if (!BAN::addBan($blogje, $iprange, $reason))
5872                     $failed = 1;
5873             }
5874             if ($failed)
5875                 $this->error(_ERROR_ADDBAN);
5876         }
5877
5878         $this->action_banlist();
5879
5880     }
5881
5882     /**
5883      * @todo document this
5884      */
5885     function action_clearactionlog() {
5886         global $member;
5887
5888         $member->isAdmin() or $this->disallow();
5889
5890         ACTIONLOG::clear();
5891
5892         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5893     }
5894
5895     /**
5896      * @todo document this
5897      */
5898     function action_backupoverview() {
5899         global $member, $manager;
5900
5901         $member->isAdmin() or $this->disallow();
5902
5903         $this->pagehead();
5904
5905         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5906         ?>
5907         <h2><?php echo _BACKUPS_TITLE?></h2>
5908
5909         <h3><?php echo _BACKUP_TITLE?></h3>
5910
5911         <p><?php echo _BACKUP_INTRO?></p>
5912
5913         <form method="post" action="index.php"><p>
5914         <input type="hidden" name="action" value="backupcreate" />
5915         <?php $manager->addTicketHidden() ?>
5916
5917         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5918         <br />
5919         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5920         <br /><br />
5921         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5922
5923         </p></form>
5924
5925         <div class="note"><?php echo _BACKUP_NOTE?></div>
5926
5927
5928         <h3><?php echo _RESTORE_TITLE?></h3>
5929
5930         <div class="note"><?php echo _RESTORE_NOTE?></div>
5931
5932         <p><?php echo _RESTORE_INTRO?></p>
5933
5934         <form method="post" action="index.php" enctype="multipart/form-data"><p>
5935             <input type="hidden" name="action" value="backuprestore" />
5936             <?php $manager->addTicketHidden() ?>
5937             <input name="backup_file" type="file" tabindex="30" />
5938             <br /><br />
5939             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5940             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5941             <br /><?php echo _RESTORE_WARNING?>
5942         </p></form>
5943
5944         <?php       $this->pagefoot();
5945     }
5946
5947     /**
5948      * @todo document this
5949      */
5950     function action_backupcreate() {
5951         global $member, $DIR_LIBS;
5952
5953         $member->isAdmin() or $this->disallow();
5954
5955         // use compression ?
5956         $useGzip = intval(postVar('gzip'));
5957
5958         include($DIR_LIBS . 'backup.php');
5959
5960         // try to extend time limit
5961         // (creating/restoring dumps might take a while)
5962         @set_time_limit(1200);
5963
5964         $bu = new Backup();
5965         $bu->do_backup($useGzip);
5966         exit;
5967     }
5968
5969     /**
5970      * @todo document this
5971      */
5972     function action_backuprestore() {
5973         global $member, $DIR_LIBS;
5974
5975         $member->isAdmin() or $this->disallow();
5976
5977         if (intPostVar('letsgo') != 1)
5978             $this->error(_ERROR_BACKUP_NOTSURE);
5979
5980         include($DIR_LIBS . 'backup.php');
5981
5982         // try to extend time limit
5983         // (creating/restoring dumps might take a while)
5984         @set_time_limit(1200);
5985
5986         $bu = new Backup();
5987         $message = $bu->do_restore();
5988         if ($message != '')
5989             $this->error($message);
5990
5991         $this->pagehead();
5992         ?>
5993         <h2><?php echo _RESTORE_COMPLETE?></h2>
5994         <?php       $this->pagefoot();
5995
5996     }
5997
5998     /**
5999      * @todo document this
6000      */
6001     function action_pluginlist() {
6002         global $member, $manager;
6003
6004         // check if allowed
6005         $member->isAdmin() or $this->disallow();
6006
6007         $this->pagehead();
6008
6009         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6010
6011         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6012
6013         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6014
6015
6016         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6017
6018         $template['content'] = 'pluginlist';
6019         $template['tabindex'] = 10;
6020         showlist($query, 'table', $template);
6021
6022 ?>
6023                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6024
6025                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6026
6027                         <form method="post" action="index.php"><div>
6028                                 <input type="hidden" name="action" value="pluginupdate" />
6029                                 <?php $manager->addTicketHidden() ?>
6030                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6031                         </div></form>
6032
6033                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6034
6035 <?php
6036                 // find a list of possibly non-installed plugins
6037                 $candidates = array();
6038
6039                 global $DIR_PLUGINS;
6040
6041                 $dirhandle = opendir($DIR_PLUGINS);
6042
6043                 while ($filename = readdir($dirhandle) )
6044                 {
6045
6046                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6047                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6048
6049                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6050                         {
6051
6052                                 $name = $matches[1];
6053                                 // only show in list when not yet installed
6054                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6055
6056                                 if (sql_num_rows($res) == 0)
6057                                 {
6058                                         array_push($candidates, $name);
6059                                 }
6060
6061                         }
6062
6063                 }
6064
6065                 closedir($dirhandle);
6066
6067                 if (sizeof($candidates) > 0)
6068                 {
6069 ?>
6070                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6071
6072                         <form method='post' action='index.php'><div>
6073                                 <input type='hidden' name='action' value='pluginadd' />
6074                                 <?php $manager->addTicketHidden() ?>
6075                                 <select name="filename" tabindex="30">
6076 <?php
6077                         foreach($candidates as $name)
6078                         {
6079                                 echo '<option value="NP_',$name,'">',i18n::hsc($name),'</option>';
6080                         }
6081 ?>
6082                                 </select>
6083                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6084                         </div></form>
6085
6086 <?php
6087                 }
6088                 else
6089                 {
6090                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6091                 }
6092
6093                 $this->pagefoot();
6094
6095         }
6096
6097     /**
6098      * @todo document this
6099      */
6100     function action_pluginhelp() {
6101         global $member, $manager, $DIR_PLUGINS, $CONF;
6102
6103         // check if allowed
6104         $member->isAdmin() or $this->disallow();
6105
6106         $plugid = intGetVar('plugid');
6107
6108         if (!$manager->pidInstalled($plugid))
6109             $this->error(_ERROR_NOSUCHPLUGIN);
6110
6111         $plugName = getPluginNameFromPid($plugid);
6112
6113         $this->pagehead();
6114
6115         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6116
6117         echo '<h2>',_PLUGS_HELP_TITLE,': ',i18n::hsc($plugName),'</h2>';
6118
6119         $plug =& $manager->getPlugin($plugName);
6120         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6121
6122         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6123             @readfile($helpFile);
6124         } else {
6125             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6126             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6127         }
6128
6129
6130         $this->pagefoot();
6131     }
6132
6133     /**
6134      * @todo document this
6135      */
6136     function action_pluginadd() {
6137         global $member, $manager, $DIR_PLUGINS;
6138
6139         // check if allowed
6140         $member->isAdmin() or $this->disallow();
6141
6142         $name = postVar('filename');
6143
6144         if ($manager->pluginInstalled($name))
6145             $this->error(_ERROR_DUPPLUGIN);
6146         if (!checkPlugin($name))
6147             $this->error(_ERROR_PLUGFILEERROR . ' (' . i18n::hsc($name) . ')');
6148
6149         // get number of currently installed plugins
6150         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6151         $numCurrent = sql_num_rows($res);
6152
6153         // plugin will be added as last one in the list
6154         $newOrder = $numCurrent + 1;
6155
6156         $manager->notify(
6157             'PreAddPlugin',
6158             array(
6159                 'file' => &$name
6160             )
6161         );
6162
6163         // do this before calling getPlugin (in case the plugin id is used there)
6164         $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6165         sql_query($query);
6166         $iPid = sql_insert_id();
6167
6168         $manager->clearCachedInfo('installedPlugins');
6169
6170         // Load the plugin for condition checking and instalation
6171         $plugin =& $manager->getPlugin($name);
6172
6173         // check if it got loaded (could have failed)
6174         if (!$plugin)
6175         {
6176             sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6177             $manager->clearCachedInfo('installedPlugins');
6178             $this->error(_ERROR_PLUGIN_LOAD);
6179         }
6180
6181         // check if plugin needs a newer Nucleus version
6182         if (getNucleusVersion() < $plugin->getMinNucleusVersion())
6183         {
6184             // uninstall plugin again...
6185             $this->deleteOnePlugin($plugin->getID());
6186
6187             // ...and show error
6188             $this->error(_ERROR_NUCLEUSVERSIONREQ . i18n::hsc($plugin->getMinNucleusVersion()));
6189         }
6190
6191         // check if plugin needs a newer Nucleus version
6192         if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
6193         {
6194             // uninstall plugin again...
6195             $this->deleteOnePlugin($plugin->getID());
6196
6197             // ...and show error
6198             $this->error(_ERROR_NUCLEUSVERSIONREQ . i18n::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6199         }
6200
6201         $pluginList = $plugin->getPluginDep();
6202         foreach ($pluginList as $pluginName)
6203         {
6204
6205             $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6206             if (sql_num_rows($res) == 0)
6207             {
6208                 // uninstall plugin again...
6209                 $this->deleteOnePlugin($plugin->getID());
6210
6211                 $this->error(sprintf(_ERROR_INSREQPLUGIN, i18n::hsc($pluginName)));
6212             }
6213         }
6214
6215         // call the install method of the plugin
6216         $plugin->install();
6217
6218         $manager->notify(
6219             'PostAddPlugin',
6220             array(
6221                 'plugin' => &$plugin
6222             )
6223         );
6224
6225         // update all events
6226         $this->action_pluginupdate();
6227     }
6228
6229     /**
6230      * @todo document this
6231      */
6232     function action_pluginupdate() {
6233         global $member, $manager, $CONF;
6234
6235         // check if allowed
6236         $member->isAdmin() or $this->disallow();
6237
6238         // delete everything from plugin_events
6239         sql_query('DELETE FROM '.sql_table('plugin_event'));
6240
6241         // loop over all installed plugins
6242         $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6243         while($o = sql_fetch_object($res)) {
6244             $pid = $o->pid;
6245             $plug =& $manager->getPlugin($o->pfile);
6246             if ($plug)
6247             {
6248                 $eventList = $plug->getEventList();
6249                 foreach ($eventList as $eventName)
6250                     sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
6251             }
6252         }
6253
6254         redirect($CONF['AdminURL'] . '?action=pluginlist');
6255 //              $this->action_pluginlist();
6256     }
6257
6258     /**
6259      * @todo document this
6260      */
6261     function action_plugindelete() {
6262         global $member, $manager;
6263
6264         // check if allowed
6265         $member->isAdmin() or $this->disallow();
6266
6267         $pid = intGetVar('plugid');
6268
6269         if (!$manager->pidInstalled($pid))
6270             $this->error(_ERROR_NOSUCHPLUGIN);
6271
6272         $this->pagehead();
6273         ?>
6274             <h2><?php echo _DELETE_CONFIRM?></h2>
6275
6276             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6277
6278             <form method="post" action="index.php"><div>
6279             <?php $manager->addTicketHidden() ?>
6280             <input type="hidden" name="action" value="plugindeleteconfirm" />
6281             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6282             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6283             </div></form>
6284         <?php
6285         $this->pagefoot();
6286     }
6287
6288     /**
6289      * @todo document this
6290      */
6291     function action_plugindeleteconfirm() {
6292         global $member, $manager, $CONF;
6293
6294         // check if allowed
6295         $member->isAdmin() or $this->disallow();
6296
6297         $pid = intPostVar('plugid');
6298
6299         $error = $this->deleteOnePlugin($pid, 1);
6300         if ($error) {
6301             $this->error($error);
6302         }
6303
6304         redirect($CONF['AdminURL'] . '?action=pluginlist');
6305 //              $this->action_pluginlist();
6306     }
6307
6308     /**
6309      * @todo document this
6310      */
6311     function deleteOnePlugin($pid, $callUninstall = 0) {
6312         global $manager;
6313
6314         $pid = intval($pid);
6315
6316         if (!$manager->pidInstalled($pid))
6317             return _ERROR_NOSUCHPLUGIN;
6318
6319         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6320
6321 /*              // call the unInstall method of the plugin
6322         if ($callUninstall) {
6323             $plugin =& $manager->getPlugin($name);
6324             if ($plugin) $plugin->unInstall();
6325         }*/
6326
6327         // check dependency before delete
6328         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6329         while($o = sql_fetch_object($res)) {
6330             $plug =& $manager->getPlugin($o->pfile);
6331             if ($plug)
6332             {
6333                 $depList = $plug->getPluginDep();
6334                 foreach ($depList as $depName)
6335                 {
6336                     if ($name == $depName)
6337                     {
6338                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6339                     }
6340                 }
6341             }
6342         }
6343
6344         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6345
6346         // call the unInstall method of the plugin
6347         if ($callUninstall) {
6348             $plugin =& $manager->getPlugin($name);
6349             if ($plugin) $plugin->unInstall();
6350         }
6351
6352         // delete all subscriptions
6353         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6354
6355         // delete all options
6356         // get OIDs from plugin_option_desc
6357         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6358         $aOIDs = array();
6359         while ($o = sql_fetch_object($res)) {
6360             array_push($aOIDs, $o->oid);
6361         }
6362
6363         // delete from plugin_option and plugin_option_desc
6364         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6365         if (count($aOIDs) > 0)
6366             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6367
6368         // update order numbers
6369         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6370         $o = sql_fetch_object($res);
6371         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6372
6373         // delete row
6374         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6375
6376         $manager->clearCachedInfo('installedPlugins');
6377         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6378
6379         return '';
6380     }
6381
6382     /**
6383      * @todo document this
6384      */
6385     function action_pluginup() {
6386         global $member, $manager, $CONF;
6387
6388         // check if allowed
6389         $member->isAdmin() or $this->disallow();
6390
6391         $plugid = intGetVar('plugid');
6392
6393         if (!$manager->pidInstalled($plugid))
6394             $this->error(_ERROR_NOSUCHPLUGIN);
6395
6396         // 1. get old order number
6397         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6398         $o = sql_fetch_object($res);
6399         $oldOrder = $o->porder;
6400
6401         // 2. calculate new order number
6402         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6403
6404         // 3. update plug numbers
6405         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6406         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6407
6408         //$this->action_pluginlist();
6409         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6410         redirect($CONF['AdminURL'] . '?action=pluginlist');
6411     }
6412
6413     /**
6414      * @todo document this
6415      */
6416     function action_plugindown() {
6417         global $member, $manager, $CONF;
6418
6419         // check if allowed
6420         $member->isAdmin() or $this->disallow();
6421
6422         $plugid = intGetVar('plugid');
6423         if (!$manager->pidInstalled($plugid))
6424             $this->error(_ERROR_NOSUCHPLUGIN);
6425
6426         // 1. get old order number
6427         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6428         $o = sql_fetch_object($res);
6429         $oldOrder = $o->porder;
6430
6431         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6432         $maxOrder = sql_num_rows($res);
6433
6434         // 2. calculate new order number
6435         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6436
6437         // 3. update plug numbers
6438         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6439         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6440
6441         //$this->action_pluginlist();
6442         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6443         redirect($CONF['AdminURL'] . '?action=pluginlist');
6444     }
6445
6446     /**
6447      * @todo document this
6448      */
6449     function action_pluginoptions($message = '') {
6450         global $member, $manager;
6451
6452         // check if allowed
6453         $member->isAdmin() or $this->disallow();
6454
6455         $pid = intRequestVar('plugid');
6456         if (!$manager->pidInstalled($pid))
6457             $this->error(_ERROR_NOSUCHPLUGIN);
6458
6459         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6460         $pluginName = i18n::hsc(getPluginNameFromPid($pid));
6461         $this->pagehead($extrahead);
6462
6463         ?>
6464             <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6465
6466             <h2><?php echo sprintf(_PLUGIN_OPTIONS_TITLE, $pluginName) ?></h2>
6467
6468             <?php if  ($message) echo $message?>
6469
6470             <form action="index.php" method="post">
6471             <div>
6472                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6473                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6474
6475         <?php
6476
6477         $manager->addTicketHidden();
6478
6479         $aOptions = array();
6480         $aOIDs = array();
6481         $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6482         $r = sql_query($query);
6483         while ($o = sql_fetch_object($r)) {
6484             array_push($aOIDs, $o->oid);
6485             $aOptions[$o->oid] = array(
6486                         'oid' => $o->oid,
6487                         'value' => $o->odef,
6488                         'name' => $o->oname,
6489                         'description' => $o->odesc,
6490                         'type' => $o->otype,
6491                         'typeinfo' => $o->oextra,
6492                         'contextid' => 0
6493             );
6494         }
6495         // fill out actual values
6496         if (count($aOIDs) > 0) {
6497             $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6498             while ($o = sql_fetch_object($r))
6499                 $aOptions[$o->oid]['value'] = $o->ovalue;
6500         }
6501
6502         // call plugins
6503         $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6504
6505         $template['content'] = 'plugoptionlist';
6506         $amount = showlist($aOptions,'table',$template);
6507         if ($amount == 0)
6508             echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6509
6510         ?>
6511             </div>
6512             </form>
6513         <?php       $this->pagefoot();
6514
6515
6516
6517     }
6518
6519     /**
6520      * @todo document this
6521      */
6522     function action_pluginoptionsupdate() {
6523         global $member, $manager;
6524
6525         // check if allowed
6526         $member->isAdmin() or $this->disallow();
6527
6528         $pid = intRequestVar('plugid');
6529         if (!$manager->pidInstalled($pid))
6530             $this->error(_ERROR_NOSUCHPLUGIN);
6531
6532         $aOptions = requestArray('plugoption');
6533         NucleusPlugin::_applyPluginOptions($aOptions);
6534
6535         $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6536
6537         $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6538     }
6539
6540     /**
6541      * @static
6542      * @todo document this
6543      */
6544     function _insertPluginOptions($context, $contextid = 0) {
6545         // get all current values for this contextid
6546         // (note: this might contain doubles for overlapping contextids)
6547         $aIdToValue = array();
6548         $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6549         while ($o = sql_fetch_object($res)) {
6550             $aIdToValue[$o->oid] = $o->ovalue;
6551         }
6552
6553         // get list of oids per pid
6554         $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6555                . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6556         $res = sql_query($query);
6557         $aOptions = array();
6558         while ($o = sql_fetch_object($res)) {
6559             if (in_array($o->oid, array_keys($aIdToValue)))
6560                 $value = $aIdToValue[$o->oid];
6561             else
6562                 $value = $o->odef;
6563
6564             array_push($aOptions, array(
6565                 'pid' => $o->pid,
6566                 'pfile' => $o->pfile,
6567                 'oid' => $o->oid,
6568                 'value' => $value,
6569                 'name' => $o->oname,
6570                 'description' => $o->odesc,
6571                 'type' => $o->otype,
6572                 'typeinfo' => $o->oextra,
6573                 'contextid' => $contextid,
6574                 'extra' => ''
6575             ));
6576         }
6577
6578         global $manager;
6579         $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6580
6581
6582         $iPrevPid = -1;
6583         foreach ($aOptions as $aOption) {
6584
6585             // new plugin?
6586             if ($iPrevPid != $aOption['pid']) {
6587                 $iPrevPid = $aOption['pid'];
6588                 if (!defined('_PLUGIN_OPTIONS_TITLE')) {
6589                     define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6590                 }
6591                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, i18n::hsc($aOption['pfile'])).'</th></tr>';
6592             }
6593
6594             $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6595             if (@$meta['access'] != 'hidden') {
6596                 echo '<tr>';
6597                 listplug_plugOptionRow($aOption);
6598                 echo '</tr>';
6599             }
6600
6601         }
6602
6603
6604     }
6605
6606     /**
6607      * Helper functions to create option forms etc.
6608      * @todo document parameters
6609      */
6610     function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO, $isAdmin = 0) {
6611         $id = i18n::hsc($name);
6612         $id = str_replace('[','-',$id);
6613         $id = str_replace(']','-',$id);
6614         $id1 = $id . i18n::hsc($value1);
6615         $id2 = $id . i18n::hsc($value2);
6616
6617         if ($name=="admin") {
6618             echo '<input onclick="selectCanLogin(true);" type="radio" name="', i18n::hsc($name),'" value="', i18n::hsc($value1),'" ';
6619         } else {
6620             echo '<input type="radio" name="', i18n::hsc($name),'" value="', i18n::hsc($value1),'" ';
6621         }
6622
6623             if ($checkedval == $value1)
6624                 echo "tabindex='$tabindex' checked='checked'";
6625             echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6626         echo ' ';
6627         if ($name=="admin") {
6628             echo '<input onclick="selectCanLogin(false);" type="radio" name="', i18n::hsc($name),'" value="', i18n::hsc($value2),'" ';
6629         } else {
6630             echo '<input type="radio" name="', i18n::hsc($name),'" value="', i18n::hsc($value2),'" ';
6631         }
6632             if ($checkedval != $value1)
6633                 echo "tabindex='$tabindex' checked='checked'";
6634             if ($isAdmin && $name=="canlogin")
6635                 echo ' disabled="disabled"';
6636             echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6637     }
6638
6639 } // class ADMIN
6640
6641 ?>