nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $extrahead;\r
  35         static private $passvar;\r
  36         static private $aOptions;\r
  37 \r
  38         /**\r
  39          * Admin::$edit_actions\r
  40          */\r
  41         static private $edit_actions = array(\r
  42                 'adminskinoverview',\r
  43                 'adminskinieoverview',\r
  44                 'adminskinedittype',\r
  45                 'adminskinremovetype',\r
  46                 'adminskindelete',\r
  47                 'adminskinedit',\r
  48                 'adminskinieimport',\r
  49                 'adminskiniedoimport',\r
  50                 'admintemplateedit',\r
  51                 'admintemplateoverview',\r
  52                 'admintemplatedelete'\r
  53                 );\r
  54 \r
  55                 /**\r
  56                  * Admin::$skinless_actions\r
  57                  */\r
  58                 static private $skinless_actions = array(\r
  59                 'plugindeleteconfirm',\r
  60                 'pluginoptionsupdate',\r
  61                 'skinremovetypeconfirm',\r
  62                 'skinclone',\r
  63                 'skindeleteconfirm',\r
  64                 'skinnew',\r
  65                 'skineditgeneral',\r
  66                 'skinieexport',\r
  67                 'skinupdate',\r
  68                 'templateupdate',\r
  69                 'templatedeleteconfirm',\r
  70                 'templatenew',\r
  71                 'templateclone',\r
  72                 'adminskinremovetypeconfirm',\r
  73                 'adminskinclone',\r
  74                 'adminskindeleteconfirm',\r
  75                 'adminskinnew',\r
  76                 'adminskineditgeneral',\r
  77                 'adminskinieexport',\r
  78                 'adminskinupdate',\r
  79                 'admintemplateupdate',\r
  80                 'admintemplatedeleteconfirm',\r
  81                 'admintemplatenew',\r
  82                 'admintemplateclone',\r
  83                 'blogsettingsupdate',\r
  84                 'settingsupdate',\r
  85                 'addnewlog2',\r
  86                 'additem',\r
  87                 'itemdeleteconfirm',\r
  88                 'itemupdate',\r
  89                 'changemembersettings',\r
  90                 'clearactionlog',\r
  91                 'memberedit'\r
  92                 );\r
  93 \r
  94                 static private $actions_needless_to_check = array(\r
  95                 'showlogin',\r
  96                 'login',\r
  97                 'overview',\r
  98                 'itemlist',\r
  99                 'blogcommentlist',\r
 100                 'bookmarklet',\r
 101                 'blogsettings',\r
 102                 'banlist',\r
 103                 'deleteblog',\r
 104                 'editmembersettings',\r
 105                 'browseownitems',\r
 106                 'browseowncomments',\r
 107                 'createitem',\r
 108                 'itemedit',\r
 109                 'itemmove',\r
 110                 'categoryedit',\r
 111                 'categorydelete',\r
 112                 'manage',\r
 113                 'actionlog',\r
 114                 'settingsedit',\r
 115                 'backupoverview',\r
 116                 'pluginlist',\r
 117                 'createnewlog',\r
 118                 'usermanagement',\r
 119                 'skinoverview',\r
 120                 'templateoverview',\r
 121                 'skinieoverview',\r
 122                 'itemcommentlist',\r
 123                 'commentedit',\r
 124                 'commentdelete',\r
 125                 'banlistnewfromitem',\r
 126                 'banlistdelete',\r
 127                 'itemdelete',\r
 128                 'manageteam',\r
 129                 'teamdelete',\r
 130                 'banlistnew',\r
 131                 'memberedit',\r
 132                 'memberdelete',\r
 133                 'pluginhelp',\r
 134                 'pluginoptions',\r
 135                 'plugindelete',\r
 136                 'skinedittype',\r
 137                 'skinremovetype',\r
 138                 'skindelete',\r
 139                 'skinedit',\r
 140                 'templateedit',\r
 141                 'templatedelete',\r
 142                 'activate',\r
 143                 'systemoverview',\r
 144                 'activatesetpwd',\r
 145         );\r
 146         \r
 147         static public function initialize()\r
 148         {\r
 149                 global $CONF, $DIR_LIBS;\r
 150                 \r
 151                 /* NOTE: 1. decide which skinid to use */\r
 152                 $skinid = $CONF['AdminSkin'];\r
 153                 /*\r
 154                  * NOTE: this is temporary escaped because not implemented yet\r
 155                 if (isset($member) && $member->isLoggedIn())\r
 156                 {\r
 157                         $memskin = $member->getAdminSkin();\r
 158                         if ( $memskin )\r
 159                         {\r
 160                                 $skinid = $memskin;\r
 161                         }\r
 162                 }\r
 163                 */\r
 164                 \r
 165                 /* NOTE: 2. make an instance of skin object */\r
 166                 if ( !Skin::existsID($skinid) )\r
 167                 {\r
 168                         return FALSE;\r
 169                 }\r
 170                 \r
 171                 /* NOTE: 3. initializing each members */\r
 172                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 173                 self::$action           = '';\r
 174                 self::$extrahead        = '';\r
 175                 self::$passvar          = '';\r
 176                 self::$headMess         = '';\r
 177                 self::$aOptions         = '';\r
 178                 return TRUE;\r
 179         }\r
 180         \r
 181         /**\r
 182          * Admin::action()\r
 183          * Executes an action\r
 184          *\r
 185          * @param       string  $action action to be performed\r
 186          * @return      void\r
 187          */\r
 188         static public function action($action)\r
 189         {\r
 190                 global $CONF, $DIR_LIBS, $manager, $member;\r
 191                 \r
 192                 /* 1. decide action name */\r
 193                 $customAction = postvar('customaction');\r
 194                 if ( !empty($customAction) )\r
 195                 {\r
 196                         $alias = array(\r
 197                                 'login' => $customAction,\r
 198                                 ''              => $customAction\r
 199                         );\r
 200                 }\r
 201                 else\r
 202                 {\r
 203                         $alias = array(\r
 204                                 'login' => 'overview',\r
 205                                 ''              => 'overview'\r
 206                         );\r
 207                 }\r
 208                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 209                 {\r
 210                         $action = $alias[$action];\r
 211                 }\r
 212                 $methodName = "action_{$action}";\r
 213                 self::$action = strtolower($action);\r
 214                 \r
 215                 /* 2. check the action */\r
 216                 $synonimActions = array(\r
 217                         'banlistnewfromitem',\r
 218                         'memberedit',\r
 219                         'login',\r
 220                 );\r
 221                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 222                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 223                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 224                 {\r
 225                         if (!$manager->checkTicket())\r
 226                         {\r
 227                                 self::error(_ERROR_BADTICKET);\r
 228                         }\r
 229                 }\r
 230 \r
 231                 /* 3. parse according to the action */\r
 232                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 233                 {\r
 234                         /* TODO: what is this?\r
 235                         self::action_parseSpecialskin();\r
 236                         */\r
 237                 }\r
 238                 elseif ( method_exists('Admin', $methodName) )\r
 239                 {\r
 240                         call_user_func(array(__CLASS__, $methodName));\r
 241                 }\r
 242                 else if ( self::existsSkinContents('adminerrorpage') )\r
 243                 {\r
 244                         self::error(_BADACTION . ENTITY::hsc($action));\r
 245                 }\r
 246                 elseif ( $id != $CONF['AdminSkin'] )\r
 247                 {\r
 248                         self::$skin = new Skin($CONF['AdminSkin']);\r
 249                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 250                         {\r
 251                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 252                         }\r
 253                 }\r
 254                 else\r
 255                 {\r
 256                         self::error(_BADACTION . ENTITY::hsc($action));\r
 257                 }\r
 258                 exit;\r
 259         }\r
 260         \r
 261         /**\r
 262          * Action::existsSkinContents()\r
 263          * Check skin contents\r
 264          *\r
 265          * @param       string  $action action type\r
 266          * @return      boolean\r
 267          */\r
 268         static private function existsSkinContents($action)\r
 269         {\r
 270                 $in_array  = in_array($action, self::$skinless_actions);\r
 271                 \r
 272                 if ( $in_array )\r
 273                 {\r
 274                         return $in_array;\r
 275                 }\r
 276                 else\r
 277                 {\r
 278                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 279                         /* TODO: skinid should be a default */\r
 280                         if ( !is_object(self::$skin) )\r
 281                         {\r
 282                                 global $CONF;\r
 283                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 284                         }\r
 285                         else\r
 286                         {\r
 287                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 288                         }\r
 289                 }\r
 290                 return;\r
 291         }\r
 292         \r
 293         /**\r
 294          * Action::specialActionsAllow()\r
 295          * Check exists specialskinparts\r
 296          *\r
 297          * @param       string  $action action type\r
 298          * @return boolean\r
 299          */\r
 300         static private function specialActionsAllow($action)\r
 301         {\r
 302                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 303                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 304                 return DB::getValue($query);\r
 305         }\r
 306         \r
 307         /**\r
 308          * Action::action_showlogin()\r
 309          * \r
 310          * @param       void\r
 311          * @return      void\r
 312          */\r
 313         static private function action_showlogin()\r
 314         {\r
 315                 global $error;\r
 316                 self::action_login($error);\r
 317                 return;\r
 318         }\r
 319         \r
 320         /**\r
 321          * Action::action_login()\r
 322          * \r
 323          * @param       string  $msg            message for pageheader\r
 324          * @param       integer $passvars       ???\r
 325          */\r
 326         static private function action_login($msg = '', $passvars = 1)\r
 327         {\r
 328                 global $member;\r
 329                 \r
 330                 // skip to overview when allowed\r
 331                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 332                 {\r
 333                         self::action_overview();\r
 334                         exit;\r
 335                 }\r
 336                 \r
 337                 /* TODO: needless variable??? */\r
 338                 self::$passvar = $passvars;\r
 339                 if ( $msg )\r
 340                 {\r
 341                         self::$headMess = $msg;\r
 342                 }\r
 343                 \r
 344                 self::$skin->parse('showlogin');\r
 345         }\r
 346         \r
 347         /**\r
 348          * Action::action_overview()\r
 349          * provides a screen with the overview of the actions available\r
 350          * \r
 351          * @param       string  $msg    message for pageheader\r
 352          * @return      void\r
 353          */\r
 354         static private function action_overview($msg = '')\r
 355         {\r
 356                 if ( $msg )\r
 357                 {\r
 358                         self::$headMess = $msg;\r
 359                 }\r
 360                 \r
 361                 self::$skin->parse('overview');\r
 362                 return;\r
 363         }\r
 364         \r
 365         /**\r
 366          * Admin::action_manage()\r
 367          * \r
 368          * @param       string  $msg    message for pageheader\r
 369          * @retrn       void\r
 370          */\r
 371         static private function action_manage($msg = '')\r
 372         {\r
 373                 global $member;\r
 374                 \r
 375                 if ( $msg )\r
 376                 {\r
 377                         self::$headMess = $msg;\r
 378                 }\r
 379                 $member->isAdmin() or self::disallow();\r
 380                 \r
 381                 self::$skin->parse('manage');\r
 382                 return;\r
 383         }\r
 384         \r
 385         /**\r
 386          * Action::action_itemlist()\r
 387          * \r
 388          * @param       integer id for weblod\r
 389          * @return      void\r
 390          */\r
 391         static private function action_itemlist($blogid = '')\r
 392         {\r
 393                 global $member, $manager, $CONF;\r
 394                 \r
 395                 if ( $blogid == '' )\r
 396                 {\r
 397                         $blogid = intRequestVar('blogid');\r
 398                 }\r
 399                 \r
 400                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 401                 \r
 402                 self::$skin->parse('itemlist');\r
 403                 return;\r
 404         }\r
 405         \r
 406         /**\r
 407          * Action::action_batchitem()\r
 408          * \r
 409          * @param       void\r
 410          * @return      void\r
 411          */\r
 412         static private function action_batchitem()\r
 413         {\r
 414                 global $member, $manager;\r
 415                 \r
 416                 $member->isLoggedIn() or self::disallow();\r
 417                 \r
 418                 $selected       = requestIntArray('batch');\r
 419                 $action         = requestVar('batchaction');\r
 420                 \r
 421                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 422                 {\r
 423                         self::error(_BATCH_NOSELECTION);\r
 424                 }\r
 425                 \r
 426                 // On move: when no destination blog/category chosen, show choice now\r
 427                 $destCatid = intRequestVar('destcatid');\r
 428                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 429                 {\r
 430                         self::batchMoveSelectDestination('item', $selected);\r
 431                 }\r
 432                 \r
 433                 // On delete: check if confirmation has been given\r
 434                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 435                 {\r
 436                         self::batchAskDeleteConfirmation('item', $selected);\r
 437                 }\r
 438                 \r
 439                 self::$skin->parse('batchitem');\r
 440                 return;\r
 441         }\r
 442         \r
 443         /**\r
 444          * Action::action_batchcomment()\r
 445          * \r
 446          * @param       void\r
 447          * @return      void\r
 448          */\r
 449         static private function action_batchcomment()\r
 450         {\r
 451                 global $member;\r
 452                 \r
 453                 $member->isLoggedIn() or self::disallow();\r
 454                 \r
 455                 $selected       = requestIntArray('batch');\r
 456                 $action         = requestVar('batchaction');\r
 457                 \r
 458                 // Show error when no items were selected\r
 459                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 460                 {\r
 461                         self::error(_BATCH_NOSELECTION);\r
 462                 }\r
 463                 \r
 464                 // On delete: check if confirmation has been given\r
 465                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 466                 {\r
 467                         self::batchAskDeleteConfirmation('comment', $selected);\r
 468                 }\r
 469                 \r
 470                 self::$skin->parse('batchcomment');\r
 471                 return;\r
 472         }\r
 473         \r
 474         /**\r
 475          * Admin::setAdminAction()\r
 476          *\r
 477          * @param       string  $action\r
 478          * @return      void\r
 479          */\r
 480         static public function setAdminAction($action)\r
 481         {\r
 482                 self::$action = $action;\r
 483                 return;\r
 484         }\r
 485         \r
 486         /**\r
 487          * Admin::action_batchmember()\r
 488          * \r
 489          * @param       void\r
 490          * @return      void\r
 491          */\r
 492         static private function action_batchmember()\r
 493         {\r
 494                 global $member;\r
 495                 \r
 496                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 497                 \r
 498                 $selected       = requestIntArray('batch');\r
 499                 $action         = requestVar('batchaction');\r
 500                 \r
 501                 // Show error when no members selected\r
 502                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 503                 {\r
 504                         self::error(_BATCH_NOSELECTION);\r
 505                 }\r
 506                 \r
 507                 // On delete: check if confirmation has been given\r
 508                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 509                 {\r
 510                         self::batchAskDeleteConfirmation('member',$selected);\r
 511                 }\r
 512                 \r
 513                 self::$skin->parse('batchmember');\r
 514                 return;\r
 515         }\r
 516         \r
 517         /**\r
 518          * Admin::action_batchteam()\r
 519          * \r
 520          * @param       void\r
 521          * @return      void\r
 522          */\r
 523         static private function action_batchteam()\r
 524         {\r
 525                 global $member;\r
 526                 \r
 527                 $blogid = intRequestVar('blogid');\r
 528                 \r
 529                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 530                 \r
 531                 $selected       = requestIntArray('batch');\r
 532                 $action         = requestVar('batchaction');\r
 533                 \r
 534                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 535                 {\r
 536                         self::error(_BATCH_NOSELECTION);\r
 537                 }\r
 538                 \r
 539                 // On delete: check if confirmation has been given\r
 540                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 541                 {\r
 542                         self::batchAskDeleteConfirmation('team',$selected);\r
 543                 }\r
 544                 \r
 545                 self::$skin->parse('batchteam');\r
 546                 return;\r
 547         }\r
 548         \r
 549         /**\r
 550          * Admin::action_batchcategory()\r
 551          * \r
 552          * @param       void\r
 553          * @return      void\r
 554          */\r
 555         static private function action_batchcategory()\r
 556         {\r
 557                 global $member, $manager;\r
 558                 \r
 559                 $member->isLoggedIn() or self::disallow();\r
 560                 \r
 561                 $selected       = requestIntArray('batch');\r
 562                 $action         = requestVar('batchaction');\r
 563                 \r
 564                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 565                 {\r
 566                         self::error(_BATCH_NOSELECTION);\r
 567                 }\r
 568                 \r
 569                 // On move: when no destination blog chosen, show choice now\r
 570                 $destBlogId = intRequestVar('destblogid');\r
 571                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 572                 {\r
 573                         self::batchMoveCategorySelectDestination('category', $selected);\r
 574                 }\r
 575                 \r
 576                 // On delete: check if confirmation has been given\r
 577                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 578                 {\r
 579                         self::batchAskDeleteConfirmation('category', $selected);\r
 580                 }\r
 581                 \r
 582                 self::$skin->parse('batchcategory');\r
 583                 return;\r
 584         }\r
 585         \r
 586         /**\r
 587          * Admin::batchMoveSelectDestination()\r
 588          * \r
 589          * @param       string  $type   type of batch action\r
 590          * @param       integer $ids    needless???\r
 591          * @return      void\r
 592          * \r
 593          * TODO: remove needless argument\r
 594          */\r
 595         static private function batchMoveSelectDestination($type, $ids)\r
 596         {\r
 597                 $_POST['batchmove'] = $type;\r
 598                 self::$skin->parse('batchmove');\r
 599                 return;\r
 600         }\r
 601         \r
 602         /**\r
 603          * Admin::batchMoveCategorySelectDestination()\r
 604          * \r
 605          * @param       string  $type   type of batch action\r
 606          * @param       integer $ids    needless???\r
 607          * @return      void\r
 608          * \r
 609          * TODO: remove needless argument\r
 610          */\r
 611         static private function batchMoveCategorySelectDestination($type, $ids)\r
 612         {\r
 613                 $_POST['batchmove'] = $type;\r
 614                 global $manager;\r
 615                 self::$skin->parse('batchmovecat');\r
 616                 return;\r
 617         }\r
 618         \r
 619         /**\r
 620          * Admin::batchAskDeleteConfirmation()\r
 621          * \r
 622          * @param       string  $type   type of batch action\r
 623          * @param       integer $ids    needless???\r
 624          * @return      void\r
 625          * \r
 626          * TODO: remove needless argument\r
 627          */\r
 628         static private function batchAskDeleteConfirmation($type, $ids)\r
 629         {\r
 630                 self::$skin->parse('batchdelete');\r
 631                 return;\r
 632         }\r
 633         \r
 634         /**\r
 635          * Admin::selectBlogCategory()\r
 636          * Inserts a HTML select element with choices for all categories to which the current\r
 637          * member has access\r
 638          *\r
 639          * @see function selectBlog\r
 640          * @param       string  $name                           name of weblod\r
 641          * @param       integer $selected                       \r
 642          * @param       integer $tabindex                       \r
 643          * @param       integer $showNewCat                     \r
 644          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 645          * @return      void\r
 646          *\r
 647          * NOTE: callback from AdminAction\r
 648          */\r
 649         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 650         {\r
 651                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 652                 return;\r
 653         }\r
 654         \r
 655         /**\r
 656          * Admin::selectBlog()\r
 657          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 658          *      mode = 'blog' => shows blognames and values are blogids\r
 659          *      mode = 'category' => show category names and values are catids\r
 660          *\r
 661          * @param       string  $name                           name of weblod\r
 662          * @param       string  $mode                           \r
 663          * @param       integer $selected                       \r
 664          * @param       integer $tabindex                       \r
 665          * @param       integer $showNewCat                     \r
 666          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 667          * @param $iForcedBlogInclude\r
 668          *      ID of a blog that always needs to be included, without checking if the\r
 669          *      member is on the blog team (-1 = none)\r
 670          * @return      void\r
 671          */\r
 672         static public function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 673         {\r
 674                 global $member, $CONF;\r
 675                 \r
 676                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 677                 $aBlogIds = array();\r
 678                 if ( $iForcedBlogInclude != -1 )\r
 679                 {\r
 680                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 681                 }\r
 682                 \r
 683                 if ( $member->isAdmin() && array_key_exists('ShowAllBlogs', $CONF) && $CONF['ShowAllBlogs'] )\r
 684                 {\r
 685                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 686                         $query = sprintf($query, sql_table('blog'));\r
 687                 }\r
 688                 else\r
 689                 {\r
 690                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 691                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 692                 }\r
 693                 \r
 694                 $rblogids = DB::getResult($query);\r
 695                 foreach ( $rblogids as $row )\r
 696                 {\r
 697                         if ( $row['bnumber'] != $iForcedBlogInclude )\r
 698                         {\r
 699                                 $aBlogIds[] = intval($row['bnumber']);\r
 700                         }\r
 701                 }\r
 702                 \r
 703                 if ( count($aBlogIds) == 0 )\r
 704                 {\r
 705                         return;\r
 706                 }\r
 707                 \r
 708                 /* TODO: we should consider to use the other way instead of this */\r
 709                 $_REQUEST['selectData'] = array(\r
 710                         'name'                  => $name,\r
 711                         'tabindex'              => $tabindex,\r
 712                         'mode'                  => $mode,\r
 713                         'selected'              => $selected,\r
 714                         'showNewCat'    => $showNewCat,\r
 715                         'aBlogIds'              => $aBlogIds,\r
 716                 );\r
 717                 self::$skin->parse('blogselectbox');\r
 718                 return;\r
 719         }\r
 720         \r
 721         /**\r
 722          * Admin::action_browseownitems()\r
 723          * \r
 724          * @param       void\r
 725          * @return      void\r
 726          */\r
 727         static private function action_browseownitems()\r
 728         {\r
 729                 global $member, $manager, $CONF;\r
 730                 \r
 731                 self::$skin->parse('browseownitems');\r
 732                 return;\r
 733         }\r
 734         \r
 735         /**\r
 736          * Admin::action_itemcommentlist()\r
 737          * Show all the comments for a given item\r
 738          * \r
 739          * @param       integer $itemid ID for item\r
 740          * @return      void\r
 741          */\r
 742         static private function action_itemcommentlist($itemid = '')\r
 743         {\r
 744                 global $member, $manager, $CONF;\r
 745                 \r
 746                 if ( $itemid == '' )\r
 747                 {\r
 748                         $itemid = intRequestVar('itemid');\r
 749                 }\r
 750                 \r
 751                 /* TODO: we consider to use the other way insterad of this */\r
 752                 $_REQUEST['itemid'] = $itemid;\r
 753                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 754                 \r
 755                 // only allow if user is allowed to alter item\r
 756                 $member->canAlterItem($itemid) or self::disallow();\r
 757                 \r
 758                 $blogid = getBlogIdFromItemId($itemid);\r
 759                 \r
 760                 self::$skin->parse('itemcommentlist');\r
 761                 return;\r
 762         }\r
 763         \r
 764         /**\r
 765          * Admin::action_browseowncomments()\r
 766          * Browse own comments\r
 767          * \r
 768          * @param       void\r
 769          * @return      void\r
 770          */\r
 771         static private function action_browseowncomments()\r
 772         {\r
 773                 self::$skin->parse('browseowncomments');\r
 774                 return;\r
 775         }\r
 776         \r
 777         /**\r
 778          * Admin::action_blogcommentlist()\r
 779          * Browse all comments for a weblog\r
 780          * \r
 781          * @param       integer $blogid ID for weblog\r
 782          * @return      void\r
 783          */\r
 784         static private function action_blogcommentlist($blogid = '')\r
 785         {\r
 786                 global $member, $manager, $CONF;\r
 787                 \r
 788                 if ( $blogid == '' )\r
 789                 {\r
 790                         $blogid = intRequestVar('blogid');\r
 791                 }\r
 792                 else\r
 793                 {\r
 794                         $blogid = intval($blogid);\r
 795                 }\r
 796                 \r
 797                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 798                 \r
 799                 /* TODO: we consider to use the other way insterad of this */\r
 800                 $_REQUEST['blogid'] = $blogid;\r
 801                 \r
 802                 self::$skin->parse('blogcommentlist');\r
 803                 return;\r
 804         }\r
 805         \r
 806         /**\r
 807          * Admin::action_createitem()\r
 808          * Provide a page to item a new item to the given blog\r
 809          * \r
 810          * @param       void\r
 811          * @return      void\r
 812          */\r
 813         static private function action_createitem()\r
 814         {\r
 815                 global $member, $manager;\r
 816                 \r
 817                 $blogid = intRequestVar('blogid');\r
 818                 \r
 819                 // check if allowed\r
 820                 $member->teamRights($blogid) or self::disallow();\r
 821                 \r
 822                 $memberid = $member->getID();\r
 823                 \r
 824                 $blog =& $manager->getBlog($blogid);\r
 825                 \r
 826                 self::$skin->parse('createitem');\r
 827                 return;\r
 828         }\r
 829         \r
 830         /**\r
 831          * Admin::action_itemedit()\r
 832          * \r
 833          * @param       void\r
 834          * @return      void\r
 835          */\r
 836         static private function action_itemedit()\r
 837         {\r
 838                 global $member, $manager;\r
 839                 \r
 840                 $itemid = intRequestVar('itemid');\r
 841                 \r
 842                 // only allow if user is allowed to alter item\r
 843                 $member->canAlterItem($itemid) or self::disallow();\r
 844                 \r
 845                 $itemid = intRequestVar('itemid');\r
 846                 $blogid = getBlogIDFromItemID($itemid);\r
 847                 $item   =& $manager->getItem($itemid, 1, 1);\r
 848                 $manager->notify(\r
 849                                 'PrepareItemForEdit',\r
 850                                 array(\r
 851                                                 'item' => &$item\r
 852                                 )\r
 853                 );\r
 854                 \r
 855                 self::$skin->parse('itemedit');\r
 856                 return;\r
 857         }\r
 858         \r
 859         /**\r
 860          * Admin::action_itemupdate()\r
 861          * \r
 862          * @param       void\r
 863          * @return      void\r
 864          */\r
 865         static private function action_itemupdate()\r
 866         {\r
 867                 global $member, $manager, $CONF;\r
 868                 \r
 869                 $itemid = intRequestVar('itemid');\r
 870                 $catid  = postVar('catid');\r
 871                 \r
 872                 // only allow if user is allowed to alter item\r
 873                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 874                 \r
 875                 $actiontype = postVar('actiontype');\r
 876                 \r
 877                 // delete actions are handled by itemdelete (which has confirmation)\r
 878                 if ( $actiontype == 'delete' )\r
 879                 {\r
 880                         self::action_itemdelete();\r
 881                         return;\r
 882                 }\r
 883                 \r
 884                 $body           = postVar('body');\r
 885                 $title          = postVar('title');\r
 886                 $more           = postVar('more');\r
 887                 $closed         = intPostVar('closed');\r
 888                 $draftid        = intPostVar('draftid');\r
 889                 \r
 890                 // default action = add now\r
 891                 if ( !$actiontype )\r
 892                 {\r
 893                         $actiontype='addnow';\r
 894                 }\r
 895                 \r
 896                 // create new category if needed\r
 897                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 898                 {\r
 899                         // get blogid\r
 900                         list($blogid) = sscanf($catid,"newcat-%d");\r
 901                         \r
 902                         // create\r
 903                         $blog =& $manager->getBlog($blogid);\r
 904                         $catid = $blog->createNewCategory();\r
 905                         \r
 906                         // show error when sth goes wrong\r
 907                         if ( !$catid )\r
 908                         {\r
 909                                 self::doError(_ERROR_CATCREATEFAIL);\r
 910                         }\r
 911                 }\r
 912                 \r
 913                 /*\r
 914                         set some variables based on actiontype\r
 915 \r
 916                         actiontypes:\r
 917                                 draft items -> addnow, addfuture, adddraft, delete\r
 918                                 non-draft items -> edit, changedate, delete\r
 919 \r
 920                         variables set:\r
 921                                 $timestamp: set to a nonzero value for future dates or date changes\r
 922                                 $wasdraft: set to 1 when the item used to be a draft item\r
 923                                 $publish: set to 1 when the edited item is not a draft\r
 924          */\r
 925                 $blogid =  getBlogIDFromItemID($itemid);\r
 926                 $blog   =& $manager->getBlog($blogid);\r
 927                 \r
 928                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 929                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 930                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 931                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 932                 {\r
 933                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 934                 }\r
 935                 else\r
 936                 {\r
 937                         $timestamp =0;\r
 938                 }\r
 939                 \r
 940                 // edit the item for real\r
 941                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 942                 \r
 943                 self::updateFuturePosted($blogid);\r
 944                 \r
 945                 if ( $draftid > 0 )\r
 946                 {\r
 947                         // delete permission is checked inside Item::delete()\r
 948                         Item::delete($draftid);\r
 949                 }\r
 950                 \r
 951                 if ( $catid != intPostVar('catid') )\r
 952                 {\r
 953                         self::action_categoryedit(\r
 954                                 $catid,\r
 955                                 $blog->getID(),\r
 956                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 957                         );\r
 958                 }\r
 959                 else\r
 960                 {\r
 961                         // TODO: set start item correctly for itemlist\r
 962                         $item = Item::getItem($itemid, 0, 0);\r
 963                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 964                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 965                         $cnt  = DB::getValue($query);\r
 966                         $_REQUEST['start'] = $cnt + 1;\r
 967                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 968                 }\r
 969                 return;\r
 970         }\r
 971         \r
 972         /**\r
 973          * Admin::action_itemdelete()\r
 974          * Delete item\r
 975          * \r
 976          * @param       Void\r
 977          * @return      Void\r
 978          */\r
 979         static private function action_itemdelete()\r
 980         {\r
 981                 global $member, $manager;\r
 982                 \r
 983                 $itemid = intRequestVar('itemid');\r
 984                 \r
 985                 // only allow if user is allowed to alter item\r
 986                 $member->canAlterItem($itemid) or self::disallow();\r
 987                 \r
 988                 if ( !$manager->existsItem($itemid,1,1) )\r
 989                 {\r
 990                         self::error(_ERROR_NOSUCHITEM);\r
 991                 }\r
 992                 \r
 993                 self::$skin->parse('itemdelete');\r
 994                 return;\r
 995         }\r
 996         \r
 997         /**\r
 998          * Admin::action_itemdeleteconfirm()\r
 999          * \r
1000          * @param       void\r
1001          * @return      void\r
1002          */\r
1003         static private function action_itemdeleteconfirm()\r
1004         {\r
1005                 global $member;\r
1006                 \r
1007                 $itemid = intRequestVar('itemid');\r
1008                 \r
1009                 // only allow if user is allowed to alter item\r
1010                 $member->canAlterItem($itemid) or self::disallow();\r
1011                 \r
1012                 // get blogid first\r
1013                 $blogid = getBlogIdFromItemId($itemid);\r
1014                 \r
1015                 // delete item (note: some checks will be performed twice)\r
1016                 self::deleteOneItem($itemid);\r
1017                 \r
1018                 self::action_itemlist($blogid);\r
1019                 return;\r
1020         }\r
1021         \r
1022         /**\r
1023          * Admin::deleteOneItem()\r
1024          * Deletes one item and returns error if something goes wrong\r
1025          * \r
1026          * @param       integer $itemid ID for item\r
1027          * @return      void\r
1028          */\r
1029         static public function deleteOneItem($itemid)\r
1030         {\r
1031                 global $member, $manager;\r
1032                 \r
1033                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1034                 if ( !$member->canAlterItem($itemid) )\r
1035                 {\r
1036                         return _ERROR_DISALLOWED;\r
1037                 }\r
1038                 \r
1039                 // need to get blogid before the item is deleted\r
1040                 $blogid = getBlogIDFromItemId($itemid);\r
1041                 \r
1042                 $manager->loadClass('ITEM');\r
1043                 Item::delete($itemid);\r
1044                 \r
1045                 // update blog's futureposted\r
1046                 self::updateFuturePosted($blogid);\r
1047                 return;\r
1048         }\r
1049         \r
1050         /**\r
1051          * Admin::updateFuturePosted()\r
1052          * Update a blog's future posted flag\r
1053          * \r
1054          * @param integer $blogid\r
1055          * @return      void\r
1056          */\r
1057         static private function updateFuturePosted($blogid)\r
1058         {\r
1059                 global $manager;\r
1060                 \r
1061                 $blogid                 =  intval($blogid);\r
1062                 $blog                   =& $manager->getBlog($blogid);\r
1063                 $currenttime    =  $blog->getCorrectTime(time());\r
1064                 \r
1065                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1066                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1067                 $result = DB::getResult($query);\r
1068                 \r
1069                 if ( $result->rowCount() > 0 )\r
1070                 {\r
1071                                 $blog->setFuturePost();\r
1072                 }\r
1073                 else\r
1074                 {\r
1075                                 $blog->clearFuturePost();\r
1076                 }\r
1077                 return;\r
1078         }\r
1079 \r
1080         /**\r
1081          * Admin::action_itemmove()\r
1082          * \r
1083          * @param       void\r
1084          * @return      void\r
1085          */\r
1086         static private function action_itemmove()\r
1087         {\r
1088                 global $member, $manager;\r
1089                 \r
1090                 $itemid = intRequestVar('itemid');\r
1091                 \r
1092                 $member->canAlterItem($itemid) or self::disallow();\r
1093                 \r
1094                 self::$skin->parse('itemmove');\r
1095                 return;\r
1096         }\r
1097         \r
1098         /**\r
1099          * Admin::action_itemmoveto()\r
1100          * \r
1101          * @param       void\r
1102          * @return      void\r
1103          */\r
1104         static private function action_itemmoveto()\r
1105         {\r
1106                 global $member, $manager;\r
1107                 \r
1108                 $itemid = intRequestVar('itemid');\r
1109                 $catid = requestVar('catid');\r
1110                 \r
1111                 // create new category if needed\r
1112                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1113                 {\r
1114                         // get blogid\r
1115                         list($blogid) = sscanf($catid,'newcat-%d');\r
1116                         \r
1117                         // create\r
1118                         $blog =& $manager->getBlog($blogid);\r
1119                         $catid = $blog->createNewCategory();\r
1120                         \r
1121                         // show error when sth goes wrong\r
1122                         if ( !$catid )\r
1123                         {\r
1124                                 self::doError(_ERROR_CATCREATEFAIL);\r
1125                         }\r
1126                 }\r
1127                 \r
1128                 // only allow if user is allowed to alter item\r
1129                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1130                 \r
1131                 $old_blogid = getBlogIDFromItemId($itemid);\r
1132                 \r
1133                 Item::move($itemid, $catid);\r
1134                 \r
1135                 // set the futurePosted flag on the blog\r
1136                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1137                 \r
1138                 // reset the futurePosted in case the item is moved from one blog to another\r
1139                 self::updateFuturePosted($old_blogid);\r
1140                 \r
1141                 if ( $catid != intRequestVar('catid') )\r
1142                 {\r
1143                         self::action_categoryedit($catid, $blog->getID());\r
1144                 }\r
1145                 else\r
1146                 {\r
1147                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1148                 }\r
1149                 return;\r
1150         }\r
1151         \r
1152         /**\r
1153          * Admin::moveOneItem()\r
1154          * Moves one item to a given category (category existance should be checked by caller)\r
1155          * errors are returned\r
1156          * \r
1157          * @param       integer $itemid         ID for item\r
1158          * @param       integer $destCatid      ID for category to which the item will be moved\r
1159          * @return      void\r
1160          */\r
1161         static public function moveOneItem($itemid, $destCatid)\r
1162         {\r
1163                 global $member;\r
1164                 \r
1165                 // only allow if user is allowed to move item\r
1166                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1167                 {\r
1168                         return _ERROR_DISALLOWED;\r
1169                 }\r
1170                 \r
1171                 Item::move($itemid, $destCatid);\r
1172                 return;\r
1173         }\r
1174         \r
1175         /**\r
1176          * Admin::action_additem()\r
1177          * Adds a item to the chosen blog\r
1178          * \r
1179          * @param       void\r
1180          * @return      void\r
1181          */\r
1182         static private function action_additem()\r
1183         {\r
1184                 global $manager, $CONF;\r
1185                 \r
1186                 $manager->loadClass('ITEM');\r
1187                 \r
1188                 $result = Item::createFromRequest();\r
1189                 \r
1190                 if ( $result['status'] == 'error' )\r
1191                 {\r
1192                         self::error($result['message']);\r
1193                 }\r
1194                 \r
1195                 $itemid = (integer) $result['itemid'];\r
1196                 \r
1197                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1198                 \r
1199                 if ( $result['status'] == 'newcategory' )\r
1200                 {\r
1201                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1202                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1203                 }\r
1204                 else\r
1205                 {\r
1206                         $methodName = 'action_itemlist';\r
1207                         self::action_itemlist($blogid);\r
1208                 }\r
1209                 return;\r
1210         }\r
1211         \r
1212         /**\r
1213          * Admin::action_commentedit()\r
1214          * Allows to edit previously made comments\r
1215          * \r
1216          * @param       void\r
1217          * @return      void\r
1218          */\r
1219         static private function action_commentedit()\r
1220         {\r
1221                 global $member, $manager;\r
1222                 \r
1223                 $commentid = intRequestVar('commentid');\r
1224                 \r
1225                 $member->canAlterComment($commentid) or self::disallow();\r
1226                 \r
1227                 self::$skin->parse('commentedit');\r
1228                 return;\r
1229         }\r
1230         \r
1231         /**\r
1232          * Admin::action_commentupdate()\r
1233          * \r
1234          * @param       void\r
1235          * @return      void\r
1236          */\r
1237         static private function action_commentupdate()\r
1238         {\r
1239                 global $member, $manager;\r
1240                 \r
1241                 $commentid = intRequestVar('commentid');\r
1242                 \r
1243                 $member->canAlterComment($commentid) or self::disallow();\r
1244                 \r
1245                 $url    = postVar('url');\r
1246                 $email  = postVar('email');\r
1247                 $body   = postVar('body');\r
1248                 \r
1249                 // intercept words that are too long\r
1250                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1251                 {\r
1252                         self::error(_ERROR_COMMENT_LONGWORD);\r
1253                 }\r
1254                 \r
1255                 // check length\r
1256                 if ( i18n::strlen($body) < 3 )\r
1257                 {\r
1258                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1259                 }\r
1260                 \r
1261                 if ( i18n::strlen($body) > 5000 )\r
1262                 {\r
1263                         self::error(_ERROR_COMMENT_TOOLONG);\r
1264                 }\r
1265                 \r
1266                 // prepare body\r
1267                 $body = Comment::prepareBody($body);\r
1268                 \r
1269                 // call plugins\r
1270                 $data = array(\r
1271                         'body' => &$body\r
1272                 );\r
1273                 $manager->notify('PreUpdateComment', $data);\r
1274                 \r
1275                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1276                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1277                 DB::execute($query);\r
1278                 \r
1279                 // get itemid\r
1280                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1281                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1282                 \r
1283                 $itemid = DB::getValue($query);\r
1284                 \r
1285                 if ( $member->canAlterItem($itemid) )\r
1286                 {\r
1287                         self::action_itemcommentlist($itemid);\r
1288                 }\r
1289                 else\r
1290                 {\r
1291                         self::action_browseowncomments();\r
1292                 }\r
1293                 return;\r
1294         }\r
1295         \r
1296         /**\r
1297          * Admin::action_commentdelete()\r
1298          * Update comment\r
1299          * \r
1300          * @param       void\r
1301          * @return      void\r
1302          */\r
1303         static private function action_commentdelete()\r
1304         {\r
1305                 global $member, $manager;\r
1306                 \r
1307                 $commentid = intRequestVar('commentid');\r
1308                 $member->canAlterComment($commentid) or self::disallow();\r
1309                 \r
1310                 self::$skin->parse('commentdelete');\r
1311                 return;\r
1312         }\r
1313         \r
1314         /**\r
1315          * Admin::action_commentdeleteconfirm()\r
1316          * \r
1317          * @param       void\r
1318          * @return      void\r
1319          */\r
1320         static private function action_commentdeleteconfirm()\r
1321         {\r
1322                 global $member;\r
1323                 \r
1324                 $commentid = intRequestVar('commentid');\r
1325                 \r
1326                 // get item id first\r
1327                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1328                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1329                 \r
1330                 $itemid = DB::getValue($query);\r
1331                 \r
1332                 $error = self::deleteOneComment($commentid);\r
1333                 if ( $error )\r
1334                 {\r
1335                         self::doError($error);\r
1336                 }\r
1337                 \r
1338                 if ( $member->canAlterItem($itemid) )\r
1339                 {\r
1340                         self::action_itemcommentlist($itemid);\r
1341                 }\r
1342                 else\r
1343                 {\r
1344                         self::action_browseowncomments();\r
1345                 }\r
1346                 return;\r
1347         }\r
1348         \r
1349         /**\r
1350          * Admin::deleteOneComment()\r
1351          * \r
1352          * @param       integer $commentid      ID for comment\r
1353          * @return      void\r
1354          */\r
1355         static public function deleteOneComment($commentid)\r
1356         {\r
1357                 global $member, $manager;\r
1358                 \r
1359                 $commentid = (integer) $commentid;\r
1360                 \r
1361                 if ( !$member->canAlterComment($commentid) )\r
1362                 {\r
1363                         return _ERROR_DISALLOWED;\r
1364                 }\r
1365                 \r
1366                 $data = array(\r
1367                         'commentid' => $commentid\r
1368                 );\r
1369                 \r
1370                 $manager->notify('PreDeleteComment', $data);\r
1371                 \r
1372                 // delete the comments associated with the item\r
1373                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1374                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1375                 DB::execute($query);\r
1376                 \r
1377                 $data = array(\r
1378                         'commentid' => $commentid\r
1379                 );\r
1380                 \r
1381                 $manager->notify('PostDeleteComment', $data);\r
1382                 \r
1383                 return '';\r
1384         }\r
1385         \r
1386         /**\r
1387          * Admin::action_usermanagement()\r
1388          * Usermanagement main\r
1389          * \r
1390          * @param       void\r
1391          * @return      void\r
1392          */\r
1393         static private function action_usermanagement()\r
1394         {\r
1395                 global $member, $manager;\r
1396                 \r
1397                 // check if allowed\r
1398                 $member->isAdmin() or self::disallow();\r
1399                 \r
1400                 self::$skin->parse('usermanagement');\r
1401                 return;\r
1402         }\r
1403         \r
1404         /**\r
1405          * Admin::action_memberedit()\r
1406          * Edit member settings\r
1407          * \r
1408          * @param       void\r
1409          * @return      void\r
1410          */\r
1411         static private function action_memberedit()\r
1412         {\r
1413                 self::action_editmembersettings(intRequestVar('memberid'));\r
1414                 return;\r
1415         }\r
1416         \r
1417         /**\r
1418          * Admin::action_editmembersettings()\r
1419          * \r
1420          * @param       integer $memberid       ID for member\r
1421          * @return      void\r
1422          * \r
1423          */\r
1424         static private function action_editmembersettings($memberid = '')\r
1425         {\r
1426                 global $member, $manager, $CONF;\r
1427                 \r
1428                 if ( $memberid == '' )\r
1429                 {\r
1430                         $memberid = $member->getID();\r
1431                 }\r
1432                 \r
1433                 /* TODO: we should consider to use the other way insterad of this */\r
1434                 $_REQUEST['memberid'] = $memberid;\r
1435                 \r
1436                 // check if allowed\r
1437                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1438                 \r
1439                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1440                 \r
1441                 self::$skin->parse('editmembersettings');\r
1442                 return;\r
1443         }\r
1444         \r
1445         /**\r
1446          * Admin::action_changemembersettings()\r
1447          * \r
1448          * @param       void\r
1449          * @return      void\r
1450          */\r
1451         static private function action_changemembersettings()\r
1452         {\r
1453                 global $member, $CONF, $manager;\r
1454                 \r
1455                 $memberid = intRequestVar('memberid');\r
1456                 \r
1457                 // check if allowed\r
1458                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1459                 \r
1460                 $name                   = trim(strip_tags(postVar('name')));\r
1461                 $realname               = trim(strip_tags(postVar('realname')));\r
1462                 $password               = postVar('password');\r
1463                 $repeatpassword = postVar('repeatpassword');\r
1464                 $email                  = strip_tags(postVar('email'));\r
1465                 $url                    = strip_tags(postVar('url'));\r
1466                 $adminskin              = intPostVar('adminskin');\r
1467                 \r
1468                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1469                 if ( !preg_match('#^https?://#', $url) )\r
1470                 {\r
1471                         $url = 'http://' . $url;\r
1472                 }\r
1473                 \r
1474                 $admin          = postVar('admin');\r
1475                 $canlogin       = postVar('canlogin');\r
1476                 $notes          = strip_tags(postVar('notes'));\r
1477                 $locale         = postVar('locale');\r
1478                 \r
1479                 $mem = Member::createFromID($memberid);\r
1480                 \r
1481                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1482                 {\r
1483                         if ( !isValidDisplayName($name) )\r
1484                         {\r
1485                                 self::error(_ERROR_BADNAME);\r
1486                         }\r
1487                         \r
1488                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1489                         {\r
1490                                 self::error(_ERROR_NICKNAMEINUSE);\r
1491                         }\r
1492                         \r
1493                         if ( $password != $repeatpassword )\r
1494                         {\r
1495                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1496                         }\r
1497                         \r
1498                         if ( $password && (i18n::strlen($password) < 6) )\r
1499                         {\r
1500                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1501                         }\r
1502                                 \r
1503                         if ( $password )\r
1504                         {\r
1505                                 $pwdvalid = true;\r
1506                                 $pwderror = '';\r
1507                                 \r
1508                                 $data = array(\r
1509                                         'password'     => $password,\r
1510                                         'errormessage' => &$pwderror,\r
1511                                         'valid'        => &$pwdvalid\r
1512                                 );\r
1513                                 $manager->notify('PrePasswordSet', $data);\r
1514                                 \r
1515                                 if ( !$pwdvalid )\r
1516                                 {\r
1517                                         self::error($pwderror);\r
1518                                 }\r
1519                         }\r
1520                 }\r
1521                 \r
1522                 if ( !NOTIFICATION::address_validation($email) )\r
1523                 {\r
1524                         self::error(_ERROR_BADMAILADDRESS);\r
1525                 }\r
1526                 if ( !$realname )\r
1527                 {\r
1528                         self::error(_ERROR_REALNAMEMISSING);\r
1529                 }\r
1530                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1531                 {\r
1532                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1533                 }\r
1534                 \r
1535                 // check if there will remain at least one site member with both the logon and admin rights\r
1536                 // (check occurs when taking away one of these rights from such a member)\r
1537                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1538                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1539                         )\r
1540                 {\r
1541                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1542                         if ( $r->rowCount() < 2 )\r
1543                         {\r
1544                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1545                         }\r
1546                 }\r
1547                 \r
1548                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1549                 {\r
1550                         $mem->setDisplayName($name);\r
1551                         if ( $password )\r
1552                         {\r
1553                                 $mem->setPassword($password);\r
1554                         }\r
1555                 }\r
1556                 \r
1557                 $oldEmail = $mem->getEmail();\r
1558                 \r
1559                 $mem->setRealName($realname);\r
1560                 $mem->setEmail($email);\r
1561                 $mem->setURL($url);\r
1562                 $mem->setNotes($notes);\r
1563                 $mem->setLocale($locale);\r
1564                 \r
1565                 // only allow super-admins to make changes to the admin status\r
1566                 if ( $member->isAdmin() )\r
1567                 {\r
1568                         $mem->setAdmin($admin);\r
1569                         $mem->setCanLogin($canlogin);\r
1570                 }\r
1571                 \r
1572                 $autosave = postVar('autosave');\r
1573                 $mem->setAutosave($autosave);\r
1574                 \r
1575                 $mem->write();\r
1576                 \r
1577                 // store plugin options\r
1578                 $aOptions = requestArray('plugoption');\r
1579                 NucleusPlugin::apply_plugin_options($aOptions);\r
1580                 $data = array(\r
1581                         'context'  => 'member',\r
1582                         'memberid' => $memberid,\r
1583                         'member'   => &$mem\r
1584                 );\r
1585                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1586                 \r
1587                 // if email changed, generate new password\r
1588                 if ( $oldEmail != $mem->getEmail() )\r
1589                 {\r
1590                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1591                         // logout member\r
1592                         $mem->newCookieKey();\r
1593                         \r
1594                         // only log out if the member being edited is the current member.\r
1595                         if ( $member->getID() == $memberid )\r
1596                         {\r
1597                                 $member->logout();\r
1598                         }\r
1599                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1600                         return;\r
1601                 }\r
1602                 \r
1603                 if ( ($mem->getID() == $member->getID())\r
1604                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1605                 {\r
1606                         $mem->newCookieKey();\r
1607                         $member->logout();\r
1608                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1609                 }\r
1610                 else\r
1611                 {\r
1612                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1613                 }\r
1614                 return;\r
1615         }\r
1616 \r
1617         /**\r
1618          * Admin::action_memberadd()\r
1619          * \r
1620          * @param       void\r
1621          * @return      void\r
1622          * \r
1623          */\r
1624         static private function action_memberadd()\r
1625         {\r
1626                 global $member, $manager;\r
1627                 \r
1628                 // check if allowed\r
1629                 $member->isAdmin() or self::disallow();\r
1630                 \r
1631                 if ( postVar('password') != postVar('repeatpassword') )\r
1632                 {\r
1633                         self::error(_ERROR_PASSWORDMISMATCH);\r
1634                 }\r
1635                 \r
1636                 if ( i18n::strlen(postVar('password')) < 6 )\r
1637                 {\r
1638                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1639                 }\r
1640                 \r
1641                 $res = Member::create(\r
1642                         postVar('name'),\r
1643                         postVar('realname'),\r
1644                         postVar('password'),\r
1645                         postVar('email'),\r
1646                         postVar('url'),\r
1647                         postVar('admin'),\r
1648                         postVar('canlogin'),\r
1649                         postVar('notes')\r
1650                 );\r
1651                 \r
1652                 if ( $res != 1 )\r
1653                 {\r
1654                         self::error($res);\r
1655                 }\r
1656                 \r
1657                 // fire PostRegister event\r
1658                 $newmem = new Member();\r
1659                 $newmem->readFromName(postVar('name'));\r
1660                 $data = array(\r
1661                         'member' => &$newmem\r
1662                 );\r
1663                 $manager->notify('PostRegister', $data);\r
1664                 \r
1665                 self::action_usermanagement();\r
1666                 return;\r
1667         }\r
1668         \r
1669         /**\r
1670          * Admin::action_activate()\r
1671          * Account activation\r
1672          * \r
1673          * @param       void\r
1674          * @return      void\r
1675          */\r
1676         static private function action_activate()\r
1677         {\r
1678                 $key = getVar('key');\r
1679                 self::showActivationPage($key);\r
1680                 return;\r
1681         }\r
1682         \r
1683         /**\r
1684          * Admin::showActivationPage()\r
1685          * \r
1686          * @param       void\r
1687          * @return      void\r
1688          */\r
1689         static private function showActivationPage($key, $message = '')\r
1690         {\r
1691                 global $manager;\r
1692                 \r
1693                 // clean up old activation keys\r
1694                 Member::cleanupActivationTable();\r
1695                 \r
1696                 // get activation info\r
1697                 $info = Member::getActivationInfo($key);\r
1698                 \r
1699                 if ( !$info )\r
1700                 {\r
1701                         self::error(_ERROR_ACTIVATE);\r
1702                 }\r
1703                 \r
1704                 $mem = Member::createFromId($info->vmember);\r
1705                 \r
1706                 if ( !$mem )\r
1707                 {\r
1708                         self::error(_ERROR_ACTIVATE);\r
1709                 }\r
1710                 \r
1711                 /* TODO: we should consider to use the other way insterad of this */\r
1712                 $_POST['ackey']                                 = $key;\r
1713                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1714                 \r
1715                 self::$headMess = $message;\r
1716                 self::$skin->parse('activate');\r
1717                 return;\r
1718         }\r
1719         \r
1720         /**\r
1721          * Admin::action_activatesetpwd()\r
1722          * Account activation - set password part\r
1723          * \r
1724          * @param       void\r
1725          * @return      void\r
1726          */\r
1727         static private function action_activatesetpwd()\r
1728         {\r
1729                 global $manager;\r
1730                 $key = postVar('key');\r
1731                 \r
1732                 // clean up old activation keys\r
1733                 Member::cleanupActivationTable();\r
1734                 \r
1735                 // get activation info\r
1736                 $info = Member::getActivationInfo($key);\r
1737                 \r
1738                 if ( !$info || ($info->type == 'addresschange') )\r
1739                 {\r
1740                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1741                 }\r
1742                 \r
1743                 $mem = Member::createFromId($info->vmember);\r
1744                 \r
1745                 if ( !$mem )\r
1746                 {\r
1747                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1748                 }\r
1749                 \r
1750                 $password               = postVar('password');\r
1751                 $repeatpassword = postVar('repeatpassword');\r
1752                 \r
1753                 if ( $password != $repeatpassword )\r
1754                 {\r
1755                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1756                 }\r
1757                 \r
1758                 if ( $password && (i18n::strlen($password) < 6) )\r
1759                 {\r
1760                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1761                 }\r
1762                         \r
1763                 if ( $password )\r
1764                 {\r
1765                         $pwdvalid = true;\r
1766                         $pwderror = '';\r
1767                         \r
1768                         $data = array(\r
1769                                 'password'              => $password,\r
1770                                 'errormessage'  => &$pwderror,\r
1771                                 'valid'                 => &$pwdvalid\r
1772                         );\r
1773                         $manager->notify('PrePasswordSet', $data);\r
1774                         if ( !$pwdvalid )\r
1775                         {\r
1776                                 return self::showActivationPage($key,$pwderror);\r
1777                         }\r
1778                 }\r
1779                 \r
1780                 $error = '';\r
1781                 \r
1782                 $data = array(\r
1783                         'type'   => 'activation',\r
1784                         'member' => $mem,\r
1785                         'error'  => &$error\r
1786                 );\r
1787                 $manager->notify('ValidateForm', $data);\r
1788                 if ( $error != '' )\r
1789                 {\r
1790                         return self::showActivationPage($key, $error);\r
1791                 }\r
1792                 \r
1793                 // set password\r
1794                 $mem->setPassword($password);\r
1795                 $mem->write();\r
1796                 \r
1797                 // do the activation\r
1798                 Member::activate($key);\r
1799                 \r
1800                 self::$skin->parse('activatesetpwd');\r
1801                 return;\r
1802         }\r
1803         \r
1804         /**\r
1805          * Admin::action_manageteam()\r
1806          * Manage team\r
1807          * \r
1808          * @param       void\r
1809          * @return      void\r
1810          */\r
1811         static private function action_manageteam()\r
1812         {\r
1813                 global $member, $manager;\r
1814                 \r
1815                 $blogid = intRequestVar('blogid');\r
1816                 \r
1817                 // check if allowed\r
1818                 $member->blogAdminRights($blogid) or self::disallow();\r
1819                 \r
1820                 self::$skin->parse('manageteam');\r
1821                 return;\r
1822         }\r
1823         \r
1824         /**\r
1825          * Admin::action_teamaddmember()\r
1826          * Add member to team\r
1827          * \r
1828          * @param       void\r
1829          * @return      void\r
1830          */\r
1831         static private function action_teamaddmember()\r
1832         {\r
1833                 global $member, $manager;\r
1834                 \r
1835                 $memberid       = intPostVar('memberid');\r
1836                 $blogid         = intPostVar('blogid');\r
1837                 $admin          = intPostVar('admin');\r
1838                 \r
1839                 // check if allowed\r
1840                 $member->blogAdminRights($blogid) or self::disallow();\r
1841                 \r
1842                 $blog =& $manager->getBlog($blogid);\r
1843                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1844                 {\r
1845                         self::error(_ERROR_ALREADYONTEAM);\r
1846                 }\r
1847                 \r
1848                 self::action_manageteam();\r
1849                 return;\r
1850         }\r
1851         \r
1852         /**\r
1853          * Admin::action_teamdelete()\r
1854          * \r
1855          * @param       void\r
1856          * @return      void\r
1857          */\r
1858         static private function action_teamdelete()\r
1859         {\r
1860                 global $member, $manager;\r
1861                 \r
1862                 $memberid       = intRequestVar('memberid');\r
1863                 $blogid         = intRequestVar('blogid');\r
1864                 \r
1865                 // check if allowed\r
1866                 $member->blogAdminRights($blogid) or self::disallow();\r
1867                 \r
1868                 $teammem =  Member::createFromID($memberid);\r
1869                 $blog =& $manager->getBlog($blogid);\r
1870                 \r
1871                 self::$skin->parse('teamdelete');\r
1872                 return;\r
1873         }\r
1874         \r
1875         /**\r
1876          * Admin::action_teamdeleteconfirm()\r
1877          * \r
1878          * @param       void\r
1879          * @return      void\r
1880          */\r
1881         static private function action_teamdeleteconfirm()\r
1882         {\r
1883                 global $member;\r
1884                 \r
1885                 $memberid = intRequestVar('memberid');\r
1886                 $blogid = intRequestVar('blogid');\r
1887                 \r
1888                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1889                 if ( $error )\r
1890                 {\r
1891                         self::error($error);\r
1892                 }\r
1893                 self::action_manageteam();\r
1894                 return;\r
1895         }\r
1896         \r
1897         /**\r
1898          * Admin::deleteOneTeamMember()\r
1899          * \r
1900          * @param       void\r
1901          * @return      void\r
1902          */\r
1903         static public function deleteOneTeamMember($blogid, $memberid)\r
1904         {\r
1905                 global $member, $manager;\r
1906                 \r
1907                 $blogid   = intval($blogid);\r
1908                 $memberid = intval($memberid);\r
1909                 \r
1910                 // check if allowed\r
1911                 if ( !$member->blogAdminRights($blogid) )\r
1912                 {\r
1913                         return _ERROR_DISALLOWED;\r
1914                 }\r
1915                 \r
1916                 // check if: - there remains at least one blog admin\r
1917                 //           - (there remains at least one team member)\r
1918                 $tmem = Member::createFromID($memberid);\r
1919                 \r
1920                 \r
1921                 $data = array(\r
1922                         'member' => &$tmem,\r
1923                         'blogid' => $blogid\r
1924                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1925                 \r
1926                 if ( $tmem->isBlogAdmin($blogid) )\r
1927                 {\r
1928                         /* TODO: why we did double check? */\r
1929                         // check if there are more blog members left and at least one admin\r
1930                         // (check for at least two admins before deletion)\r
1931                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1932                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1933                         $r     = DB::getResult($query);\r
1934                         if ( $r->rowCount() < 2 )\r
1935                         {\r
1936                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1937                         }\r
1938                 }\r
1939                 \r
1940                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1941                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1942                 DB::execute($query);\r
1943                 \r
1944                 $data = array(\r
1945                         'member' => &$tmem,\r
1946                         'blogid' => $blogid\r
1947                 );\r
1948                 $manager->notify('PostDeleteTeamMember', $data);\r
1949                 \r
1950                 return '';\r
1951         }\r
1952         \r
1953         /**\r
1954          * Admin::action_teamchangeadmin()\r
1955          * \r
1956          * @param       void\r
1957          * @return      void\r
1958          */\r
1959         static private function action_teamchangeadmin()\r
1960         {\r
1961                 global $member;\r
1962                 \r
1963                 $blogid         = intRequestVar('blogid');\r
1964                 $memberid       = intRequestVar('memberid');\r
1965                 \r
1966                 // check if allowed\r
1967                 $member->blogAdminRights($blogid) or self::disallow();\r
1968                 \r
1969                 $mem = Member::createFromID($memberid);\r
1970                 \r
1971                 // don't allow when there is only one admin at this moment\r
1972                 if ( $mem->isBlogAdmin($blogid) )\r
1973                 {\r
1974                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1975                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1976                         $r = DB::getResult($query);\r
1977                         if ( $r->rowCount() == 1 )\r
1978                         {\r
1979                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
1980                         }\r
1981                 }\r
1982                 \r
1983                 if ( $mem->isBlogAdmin($blogid) )\r
1984                 {\r
1985                         $newval = 0;\r
1986                 }\r
1987                 else\r
1988                 {\r
1989                         $newval = 1;\r
1990                 }\r
1991                 \r
1992                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
1993                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
1994                 DB::execute($query);\r
1995                 \r
1996                 // only show manageteam if member did not change its own admin privileges\r
1997                 if ( $member->isBlogAdmin($blogid) )\r
1998                 {\r
1999                         self::action_manageteam();\r
2000                 }\r
2001                 else\r
2002                 {\r
2003                         self::action_overview(_MSG_ADMINCHANGED);\r
2004                 }\r
2005                 return;\r
2006         }\r
2007         \r
2008         /**\r
2009          * Admin::action_blogsettings()\r
2010          * \r
2011          * @param       void\r
2012          * @return      void\r
2013          */\r
2014         static private function action_blogsettings()\r
2015         {\r
2016                 global $member, $manager;\r
2017                 \r
2018                 $blogid = intRequestVar('blogid');\r
2019                 \r
2020                 // check if allowed\r
2021                 $member->blogAdminRights($blogid) or self::disallow();\r
2022                 \r
2023                 $blog =& $manager->getBlog($blogid);\r
2024                 \r
2025                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2026                 \r
2027                 self::$skin->parse('blogsettings');\r
2028                 return;\r
2029         }\r
2030         \r
2031         /**\r
2032          * Admin::action_categorynew()\r
2033          * \r
2034          * @param       void\r
2035          * @return      void\r
2036          */\r
2037         static private function action_categorynew()\r
2038         {\r
2039                 global $member, $manager;\r
2040                 \r
2041                 $blogid = intRequestVar('blogid');\r
2042                 \r
2043                 $member->blogAdminRights($blogid) or self::disallow();\r
2044                 \r
2045                 $cname = postVar('cname');\r
2046                 $cdesc = postVar('cdesc');\r
2047                 \r
2048                 if ( !isValidCategoryName($cname) )\r
2049                 {\r
2050                         self::error(_ERROR_BADCATEGORYNAME);\r
2051                 }\r
2052                 \r
2053                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2054                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2055                 $res = DB::getResult($query);\r
2056                 if ( $res->rowCount() > 0 )\r
2057                 {\r
2058                         self::error(_ERROR_DUPCATEGORYNAME);\r
2059                 }\r
2060                 \r
2061                 $blog           =& $manager->getBlog($blogid);\r
2062                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2063                 \r
2064                 self::action_blogsettings();\r
2065                 return;\r
2066         }\r
2067         \r
2068         /**\r
2069          * Admin::action_categoryedit()\r
2070          * \r
2071          * @param       void\r
2072          * @return      void\r
2073          */\r
2074         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2075         {\r
2076                 global $member, $manager;\r
2077                 \r
2078                 if ( $blogid == '' )\r
2079                 {\r
2080                         $blogid = intGetVar('blogid');\r
2081                 }\r
2082                 else\r
2083                 {\r
2084                         $blogid = intval($blogid);\r
2085                 }\r
2086                 if ( $catid == '' )\r
2087                 {\r
2088                         $catid = intGetVar('catid');\r
2089                 }\r
2090                 else\r
2091                 {\r
2092                         $catid = intval($catid);\r
2093                 }\r
2094                 \r
2095                 /* TODO: we should consider to use the other way insterad of this */\r
2096                 $_REQUEST['blogid']             = $blogid;\r
2097                 $_REQUEST['catid']              = $catid;\r
2098                 $_REQUEST['desturl']    = $desturl;\r
2099                 $member->blogAdminRights($blogid) or self::disallow();\r
2100                 \r
2101                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2102                 \r
2103                 self::$skin->parse('categoryedit');\r
2104                 return;\r
2105         }\r
2106         \r
2107         /**\r
2108          * Admin::action_categoryupdate()\r
2109          * \r
2110          * @param       void\r
2111          * @return      void\r
2112          */\r
2113         static private function action_categoryupdate()\r
2114         {\r
2115                 global $member, $manager;\r
2116                 \r
2117                 $blogid         = intPostVar('blogid');\r
2118                 $catid          = intPostVar('catid');\r
2119                 $cname          = postVar('cname');\r
2120                 $cdesc          = postVar('cdesc');\r
2121                 $desturl        = postVar('desturl');\r
2122                 \r
2123                 $member->blogAdminRights($blogid) or self::disallow();\r
2124                 \r
2125                 if ( !isValidCategoryName($cname) )\r
2126                 {\r
2127                         self::error(_ERROR_BADCATEGORYNAME);\r
2128                 }\r
2129                 \r
2130                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2131                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2132                 $res    = DB::getResult($query);\r
2133                 if ( $res->rowCount() > 0 )\r
2134                 {\r
2135                         self::error(_ERROR_DUPCATEGORYNAME);\r
2136                 }\r
2137                 \r
2138                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2139                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2140                 DB::execute($query);\r
2141                 \r
2142                 // store plugin options\r
2143                 $aOptions = requestArray('plugoption');\r
2144                 NucleusPlugin::apply_plugin_options($aOptions);\r
2145                 $data = array(\r
2146                         'context'       => 'category',\r
2147                         'catid'         => $catid\r
2148                 );\r
2149                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2150                 \r
2151                 if ( $desturl )\r
2152                 {\r
2153                         redirect($desturl);\r
2154                         exit;\r
2155                 }\r
2156                 else\r
2157                 {\r
2158                         self::action_blogsettings();\r
2159                 }\r
2160                 return;\r
2161         }\r
2162         \r
2163         /**\r
2164          * Admin::action_categorydelete()\r
2165          * \r
2166          * @param       void\r
2167          * @return      void\r
2168          */\r
2169         static private function action_categorydelete()\r
2170         {\r
2171                 global $member, $manager;\r
2172                 \r
2173                 $blogid = intRequestVar('blogid');\r
2174                 $catid  = intRequestVar('catid');\r
2175                 \r
2176                 $member->blogAdminRights($blogid) or self::disallow();\r
2177                 \r
2178                 $blog =& $manager->getBlog($blogid);\r
2179                 \r
2180                 // check if the category is valid\r
2181                 if ( !$blog->isValidCategory($catid) )\r
2182                 {\r
2183                         self::error(_ERROR_NOSUCHCATEGORY);\r
2184                 }\r
2185                 \r
2186                 // don't allow deletion of default category\r
2187                 if ( $blog->getDefaultCategory() == $catid )\r
2188                 {\r
2189                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2190                 }\r
2191                 \r
2192                 // check if catid is the only category left for blogid\r
2193                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2194                 $query = sprintf($query, sql_table('category'), $blogid);\r
2195                 $res = DB::getResult($query);\r
2196                 if ( $res->rowCount() == 1 )\r
2197                 {\r
2198                         self::error(_ERROR_DELETELASTCATEGORY);\r
2199                 }\r
2200                 \r
2201                 self::$skin->parse('categorydelete');\r
2202                 return;\r
2203         }\r
2204         \r
2205         /**\r
2206          * Admin::action_categorydeleteconfirm()\r
2207          * \r
2208          * @param       void\r
2209          * @return      void\r
2210          */\r
2211         static private function action_categorydeleteconfirm()\r
2212         {\r
2213                 global $member, $manager;\r
2214                 \r
2215                 $blogid = intRequestVar('blogid');\r
2216                 $catid  = intRequestVar('catid');\r
2217                 \r
2218                 $member->blogAdminRights($blogid) or self::disallow();\r
2219                 \r
2220                 $error = self::deleteOneCategory($catid);\r
2221                 if ( $error )\r
2222                 {\r
2223                         self::error($error);\r
2224                 }\r
2225                 \r
2226                 self::action_blogsettings();\r
2227                 return;\r
2228         }\r
2229         \r
2230         /**\r
2231          * Admin::deleteOneCategory()\r
2232          * Delete a category by its id\r
2233          * \r
2234          * @param       String  $catid  category id for deleting\r
2235          * @return      Void\r
2236          */\r
2237         static public function deleteOneCategory($catid)\r
2238         {\r
2239                 global $manager, $member;\r
2240                 \r
2241                 $catid  = intval($catid);\r
2242                 $blogid = getBlogIDFromCatID($catid);\r
2243                 \r
2244                 if ( !$member->blogAdminRights($blogid) )\r
2245                 {\r
2246                         return ERROR_DISALLOWED;\r
2247                 }\r
2248                 \r
2249                 // get blog\r
2250                 $blog =& $manager->getBlog($blogid);\r
2251                 \r
2252                 // check if the category is valid\r
2253                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2254                 {\r
2255                         return _ERROR_NOSUCHCATEGORY;\r
2256                 }\r
2257                 \r
2258                 $destcatid = $blog->getDefaultCategory();\r
2259                 \r
2260                 // don't allow deletion of default category\r
2261                 if ( $blog->getDefaultCategory() == $catid )\r
2262                 {\r
2263                         return _ERROR_DELETEDEFCATEGORY;\r
2264                 }\r
2265                 \r
2266                 // check if catid is the only category left for blogid\r
2267                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2268                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2269                 \r
2270                 $res = DB::getResult($query);\r
2271                 if ( $res->rowCount() == 1 )\r
2272                 {\r
2273                         return _ERROR_DELETELASTCATEGORY;\r
2274                 }\r
2275                 \r
2276                 $data = array('catid' => $catid);\r
2277                 $manager->notify('PreDeleteCategory', $data);\r
2278                 \r
2279                 // change category for all items to the default category\r
2280                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2281                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2282                 DB::execute($query);\r
2283                 \r
2284                 // delete all associated plugin options\r
2285                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2286                 \r
2287                 // delete category\r
2288                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2289                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2290                 DB::execute($query);\r
2291                 \r
2292                 $data = array('catid' => $catid);\r
2293                 $manager->notify('PostDeleteCategory', $data);\r
2294                 return;\r
2295         }\r
2296         \r
2297         /**\r
2298          * Admin::moveOneCategory()\r
2299          * Delete a category by its id\r
2300          * \r
2301          * @param       int     $catid          category id for move\r
2302          * @param       int     $destblogid     blog id for destination\r
2303          * @return      void\r
2304          */\r
2305         static public function moveOneCategory($catid, $destblogid)\r
2306         {\r
2307                 global $manager, $member;\r
2308                 $catid      = intval($catid);\r
2309                 $destblogid = intval($destblogid);\r
2310                 $blogid     = getBlogIDFromCatID($catid);\r
2311                 // mover should have admin rights on both blogs\r
2312                 if (!$member->blogAdminRights($blogid)) {\r
2313                         return _ERROR_DISALLOWED;\r
2314                 }\r
2315                 if (!$member->blogAdminRights($destblogid)) {\r
2316                         return _ERROR_DISALLOWED;\r
2317                 }\r
2318                 // cannot move to self\r
2319                 if ($blogid == $destblogid) {\r
2320                         return _ERROR_MOVETOSELF;\r
2321                 }\r
2322                 // get blogs\r
2323                 $blog     =& $manager->getBlog($blogid);\r
2324                 $destblog =& $manager->getBlog($destblogid);\r
2325                 // check if the category is valid\r
2326                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2327                         return _ERROR_NOSUCHCATEGORY;\r
2328                 }\r
2329                 // don't allow default category to be moved\r
2330                 if ($blog->getDefaultCategory() == $catid) {\r
2331                         return _ERROR_MOVEDEFCATEGORY;\r
2332                 }\r
2333                 $manager->notify(\r
2334                                 'PreMoveCategory',\r
2335                                 array(\r
2336                                                 'catid'      => &$catid,\r
2337                                                 'sourceblog' => &$blog,\r
2338                                                 'destblog'   => &$destblog\r
2339                                 )\r
2340                 );\r
2341                 // update comments table (cblog)\r
2342                 $query = 'SELECT '\r
2343                 . '    inumber '\r
2344                 . 'FROM '\r
2345                 .      sql_table('item') . ' '\r
2346                 . 'WHERE '\r
2347                 . '    icat = %d';\r
2348                 $items = sql_query(sprintf($query, $catid));\r
2349                 while ($oItem = sql_fetch_object($items)) {\r
2350                         $query = 'UPDATE '\r
2351                         .      sql_table('comment') . ' '\r
2352                         . 'SET '\r
2353                         . '    cblog = %d' . ' '\r
2354                         . 'WHERE '\r
2355                         . '    citem = %d';\r
2356                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2357                 }\r
2358         \r
2359                 // update items (iblog)\r
2360                 $query = 'UPDATE '\r
2361                 .      sql_table('item') . ' '\r
2362                 . 'SET '\r
2363                 . '    iblog = %d '\r
2364                 . 'WHERE '\r
2365                 . '    icat = %d';\r
2366                 sql_query(sprintf($query, $destblogid, $catid));\r
2367         \r
2368                 // move category\r
2369                 $query = 'UPDATE '\r
2370                 .      sql_table('category') . ' '\r
2371                 . 'SET '\r
2372                 . '    cblog = %d' . ' '\r
2373                 . 'WHERE '\r
2374                 . '    catid = %d';\r
2375                 sql_query(sprintf($query, $destblogid, $catid));\r
2376                 $manager->notify(\r
2377                                 'PostMoveCategory',\r
2378                                 array(\r
2379                                                 'catid'      => &$catid,\r
2380                                                 'sourceblog' => &$blog,\r
2381                                                 'destblog'   => $destblog\r
2382                                 )\r
2383                 );\r
2384                 return;\r
2385         }\r
2386 \r
2387         /**\r
2388          * Admin::action_blogsettingsupdate\r
2389          * Updating blog settings\r
2390          * \r
2391          * @param       Void\r
2392          * @return      Void\r
2393          */\r
2394         static private function action_blogsettingsupdate()\r
2395         {\r
2396                 global $member, $manager;\r
2397                 \r
2398                 $blogid = intRequestVar('blogid');\r
2399                 \r
2400                 $member->blogAdminRights($blogid) or self::disallow();\r
2401                 \r
2402                 $blog =& $manager->getBlog($blogid);\r
2403                 \r
2404                 $notify_address = trim(postVar('notify'));\r
2405                 $shortname              = trim(postVar('shortname'));\r
2406                 $updatefile             = trim(postVar('update'));\r
2407                 \r
2408                 $notifyComment  = intPostVar('notifyComment');\r
2409                 $notifyVote             = intPostVar('notifyVote');\r
2410                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2411                 \r
2412                 if ( $notifyComment == 0 )\r
2413                 {\r
2414                         $notifyComment = 1;\r
2415                 }\r
2416                 if ( $notifyVote == 0 )\r
2417                 {\r
2418                         $notifyVote = 1;\r
2419                 }\r
2420                 if ( $notifyNewItem == 0 )\r
2421                 {\r
2422                         $notifyNewItem = 1;\r
2423                 }\r
2424                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2425                 \r
2426                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2427                 {\r
2428                         self::error(_ERROR_BADNOTIFY);\r
2429                 }\r
2430                 \r
2431                 if ( !isValidShortName($shortname) )\r
2432                 {\r
2433                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2434                 }\r
2435                 \r
2436                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2437                 {\r
2438                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2439                 }\r
2440                 // check if update file is writable\r
2441                 if ( $updatefile && !is_writeable($updatefile) )\r
2442                 {\r
2443                         self::error(_ERROR_UPDATEFILE);\r
2444                 }\r
2445                 \r
2446                 $blog->setName(trim(postVar('name')));\r
2447                 $blog->setShortName($shortname);\r
2448                 $blog->setNotifyAddress($notify_address);\r
2449                 $blog->setNotifyType($notifyType);\r
2450                 $blog->setMaxComments(postVar('maxcomments'));\r
2451                 $blog->setCommentsEnabled(postVar('comments'));\r
2452                 $blog->setTimeOffset(postVar('timeoffset'));\r
2453                 $blog->setUpdateFile($updatefile);\r
2454                 $blog->setURL(trim(postVar('url')));\r
2455                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2456                 $blog->setDescription(trim(postVar('desc')));\r
2457                 $blog->setPublic(postVar('public'));\r
2458                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2459                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2460                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2461                 $blog->setSearchable(intPostVar('searchable'));\r
2462                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2463                 $blog->writeSettings();\r
2464                 \r
2465                 // store plugin options\r
2466                 $aOptions = requestArray('plugoption');\r
2467                 NucleusPlugin::apply_plugin_options($aOptions);\r
2468                 \r
2469                 $data = array(\r
2470                         'context' => 'blog',\r
2471                         'blogid'  => $blogid,\r
2472                         'blog'    => &$blog\r
2473                 );\r
2474                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2475                 \r
2476                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2477                 return;\r
2478         }\r
2479         \r
2480         /**\r
2481          * Admin::action_deleteblog()\r
2482          * \r
2483          * @param       void\r
2484          * @return      void\r
2485          */\r
2486         static private function action_deleteblog()\r
2487         {\r
2488                 global $member, $CONF, $manager;\r
2489                 \r
2490                 $blogid = intRequestVar('blogid');\r
2491                 \r
2492                 $member->blogAdminRights($blogid) or self::disallow();\r
2493                 \r
2494                 // check if blog is default blog\r
2495                 if ( $CONF['DefaultBlog'] == $blogid )\r
2496                 {\r
2497                         self::error(_ERROR_DELDEFBLOG);\r
2498                 }\r
2499                 \r
2500                 $blog =& $manager->getBlog($blogid);\r
2501                 \r
2502                 self::$skin->parse('deleteblog');\r
2503                 return;\r
2504         }\r
2505         \r
2506         /**\r
2507          * Admin::action_deleteblogconfirm()\r
2508          * Delete Blog\r
2509          * \r
2510          * @param       Void\r
2511          * @return      Void\r
2512          */\r
2513         static private function action_deleteblogconfirm()\r
2514         {\r
2515                 global $member, $CONF, $manager;\r
2516                 \r
2517                 $blogid = intRequestVar('blogid');\r
2518                 \r
2519                 $data = array('blogid' => $blogid);\r
2520                 $manager->notify('PreDeleteBlog', $data);\r
2521                 \r
2522                 $member->blogAdminRights($blogid) or self::disallow();\r
2523                 \r
2524                 // check if blog is default blog\r
2525                 if ( $CONF['DefaultBlog'] == $blogid )\r
2526                 {\r
2527                         self::error(_ERROR_DELDEFBLOG);\r
2528                 }\r
2529                 \r
2530                 // delete all comments\r
2531                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2532                 DB::execute($query);\r
2533                 \r
2534                 // delete all items\r
2535                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2536                 DB::execute($query);\r
2537                 \r
2538                 // delete all team members\r
2539                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2540                 DB::execute($query);\r
2541                 \r
2542                 // delete all bans\r
2543                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2544                 DB::execute($query);\r
2545                 \r
2546                 // delete all categories\r
2547                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2548                 DB::execute($query);\r
2549                 \r
2550                 // delete all associated plugin options\r
2551                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2552                 \r
2553                 // delete the blog itself\r
2554                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2555                 DB::execute($query);\r
2556                 \r
2557                 $data = array('blogid' => $blogid);\r
2558                 $manager->notify('PostDeleteBlog', $data);\r
2559                 \r
2560                 self::action_overview(_DELETED_BLOG);\r
2561                 return;\r
2562         }\r
2563         \r
2564         /**\r
2565          * Admin::action_memberdelete()\r
2566          * \r
2567          * @param       void\r
2568          * @return      void\r
2569          */\r
2570         static private function action_memberdelete()\r
2571         {\r
2572                 global $member, $manager;\r
2573                 \r
2574                 $memberid = intRequestVar('memberid');\r
2575                 \r
2576                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2577                 \r
2578                 $mem = Member::createFromID($memberid);\r
2579                 \r
2580                 self::$skin->parse('memberdelete');\r
2581                 return;\r
2582         }\r
2583         \r
2584         /**\r
2585          * Admin::action_memberdeleteconfirm()\r
2586          * \r
2587          * @param       void\r
2588          * @return      void\r
2589          */\r
2590         static private function action_memberdeleteconfirm()\r
2591         {\r
2592                 global $member;\r
2593                 \r
2594                 $memberid = intRequestVar('memberid');\r
2595                 \r
2596                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2597                 \r
2598                 $error = self::deleteOneMember($memberid);\r
2599                 if ( $error )\r
2600                 {\r
2601                         self::error($error);\r
2602                 }\r
2603                 \r
2604                 if ( $member->isAdmin() )\r
2605                 {\r
2606                         self::action_usermanagement();\r
2607                 }\r
2608                 else\r
2609                 {\r
2610                         self::action_overview(_DELETED_MEMBER);\r
2611                 }\r
2612                 return;\r
2613         }\r
2614         \r
2615         /**\r
2616          * Admin::deleteOneMember()\r
2617          * Delete a member by id\r
2618          * \r
2619          * @static\r
2620          * @params      Integer $memberid       member id\r
2621          * @return      String  null string or error messages\r
2622          */\r
2623         static public function deleteOneMember($memberid)\r
2624         {\r
2625                 global $manager;\r
2626                 \r
2627                 $memberid = intval($memberid);\r
2628                 $mem = Member::createFromID($memberid);\r
2629                 \r
2630                 if ( !$mem->canBeDeleted() )\r
2631                 {\r
2632                         return _ERROR_DELETEMEMBER;\r
2633                 }\r
2634                 \r
2635                 $data = array('member' => &$mem);\r
2636                 $manager->notify('PreDeleteMember', $data);\r
2637                 \r
2638                 /* unlink comments from memberid */\r
2639                 if ( $memberid )\r
2640                 {\r
2641                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2642                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2643                         DB::execute($query);\r
2644                 }\r
2645                 \r
2646                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2647                 DB::execute($query);\r
2648                 \r
2649                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2650                 DB::execute($query);\r
2651                 \r
2652                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2653                 DB::execute($query);\r
2654                 \r
2655                 // delete all associated plugin options\r
2656                 NucleusPlugin::delete_option_values('member', $memberid);\r
2657                 \r
2658                 $data = array('member' => &$mem);\r
2659                 $manager->notify('PostDeleteMember', $data);\r
2660                 \r
2661                 return '';\r
2662         }\r
2663         \r
2664         /**\r
2665          * Admin::action_createnewlog()\r
2666          * \r
2667          * @param       void\r
2668          * @return      void\r
2669          */\r
2670         static private function action_createnewlog()\r
2671         {\r
2672                 global $member, $CONF, $manager;\r
2673                 \r
2674                 // Only Super-Admins can do this\r
2675                 $member->isAdmin() or self::disallow();\r
2676                 \r
2677                 self::$skin->parse('createnewlog');\r
2678                 return;\r
2679         }\r
2680         \r
2681         /**\r
2682          * Admin::action_addnewlog()\r
2683          * \r
2684          * @param       void\r
2685          * @return      void\r
2686          */\r
2687         static private function action_addnewlog()\r
2688         {\r
2689                 global $member, $manager, $CONF;\r
2690                 \r
2691                 // Only Super-Admins can do this\r
2692                 $member->isAdmin() or self::disallow();\r
2693                 \r
2694                 $bname                  = trim(postVar('name'));\r
2695                 $bshortname             = trim(postVar('shortname'));\r
2696                 $btimeoffset    = postVar('timeoffset');\r
2697                 $bdesc                  = trim(postVar('desc'));\r
2698                 $bdefskin               = postVar('defskin');\r
2699                 \r
2700                 if ( !isValidShortName($bshortname) )\r
2701                 {\r
2702                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2703                 }\r
2704                 \r
2705                 if ( $manager->existsBlog($bshortname) )\r
2706                 {\r
2707                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2708                 }\r
2709                 \r
2710                 $data = array(\r
2711                         'name'        => &$bname,\r
2712                         'shortname'   => &$bshortname,\r
2713                         'timeoffset'  => &$btimeoffset,\r
2714                         'description' => &$bdesc,\r
2715                         'defaultskin' => &$bdefskin\r
2716                 );\r
2717                 $manager->notify('PreAddBlog', $data);\r
2718                 \r
2719                 // add slashes for sql queries\r
2720                 $bname                  = DB::quoteValue($bname);\r
2721                 $bshortname             = DB::quoteValue($bshortname);\r
2722                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2723                 $bdesc                  = DB::quoteValue($bdesc);\r
2724                 $bdefskin               = DB::quoteValue($bdefskin);\r
2725                 \r
2726                 // create blog\r
2727                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2728                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2729                 DB::execute($query);\r
2730                 \r
2731                 $blogid = DB::getInsertId();\r
2732                 $blog   =& $manager->getBlog($blogid);\r
2733                 \r
2734                 // create new category\r
2735                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2736                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2737                 \r
2738                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2739                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2740                 $catid = DB::getInsertId();\r
2741                 \r
2742                 // set as default category\r
2743                 $blog->setDefaultCategory($catid);\r
2744                 $blog->writeSettings();\r
2745                 \r
2746                 // create team member\r
2747                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2748                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2749                 DB::execute($query);\r
2750                 \r
2751                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2752                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2753                 \r
2754                 $blog->additem(\r
2755                         $blog->getDefaultCategory(),\r
2756                         $itemdeftitle,$itemdefbody,\r
2757                         '',\r
2758                         $blogid,\r
2759                         $member->getID(),\r
2760                         $blog->getCorrectTime(),\r
2761                         0,\r
2762                         0,\r
2763                         0\r
2764                 );\r
2765                 \r
2766                 $data = array('blog' => &$blog);\r
2767                 $manager->notify('PostAddBlog', $data);\r
2768                 \r
2769                 $data = array(\r
2770                         'blog'                  => &$blog,\r
2771                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2772                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2773                         'catid'                 => $catid\r
2774                 );\r
2775                 $manager->notify('PostAddCategory', $data);\r
2776                 \r
2777                 /* TODO: we should consider to use the other way insterad of this */\r
2778                 $_REQUEST['blogid'] = $blogid;\r
2779                 $_REQUEST['catid']  = $catid;\r
2780                 self::$skin->parse('addnewlog');\r
2781                 return;\r
2782         }\r
2783         \r
2784         /**\r
2785          * Admin::action_addnewlog2()\r
2786          * \r
2787          * @param       void\r
2788          * @return      void\r
2789          */\r
2790         static private function action_addnewlog2()\r
2791         {\r
2792                 global $member, $manager;\r
2793                 $blogid = intRequestVar('blogid');\r
2794                 \r
2795                 $member->blogAdminRights($blogid) or self::disallow();\r
2796                 \r
2797                 $burl = requestVar('url');\r
2798                 \r
2799                 $blog =& $manager->getBlog($blogid);\r
2800                 $blog->setURL(trim($burl));\r
2801                 $blog->writeSettings();\r
2802                 \r
2803                 self::action_overview(_MSG_NEWBLOG);\r
2804                 return;\r
2805         }\r
2806         \r
2807         /**\r
2808          * Admin::action_skinieoverview()\r
2809          * \r
2810          * @param       void\r
2811          * @return      void\r
2812          */\r
2813         static private function action_skinieoverview()\r
2814         {\r
2815                 global $member, $DIR_LIBS, $manager;\r
2816                 \r
2817                 $member->isAdmin() or self::disallow();\r
2818                 \r
2819                 include_once($DIR_LIBS . 'skinie.php');\r
2820                 \r
2821                 self::$skin->parse('skinieoverview');\r
2822                 return;\r
2823         }\r
2824         \r
2825         /**\r
2826          * Admin::action_skinieimport()\r
2827          * \r
2828          * @param       void\r
2829          * @return      void\r
2830          */\r
2831         static private function action_skinieimport()\r
2832         {\r
2833                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2834                 \r
2835                 $member->isAdmin() or self::disallow();\r
2836                 \r
2837                 // load skinie class\r
2838                 include_once($DIR_LIBS . 'skinie.php');\r
2839                 \r
2840                 $skinFileRaw    = postVar('skinfile');\r
2841                 $mode                   = postVar('mode');\r
2842                 \r
2843                 $importer = new SkinImport();\r
2844                 \r
2845                 // get full filename\r
2846                 if ( $mode == 'file' )\r
2847                 {\r
2848                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2849                         \r
2850                         /* TODO: remove this\r
2851                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2852                         if ( !file_exists($skinFile) )\r
2853                         {\r
2854                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2855                         }\r
2856                          */\r
2857                 }\r
2858                 else\r
2859                 {\r
2860                         $skinFile = $skinFileRaw;\r
2861                 }\r
2862                 \r
2863                 // read only metadata\r
2864                 $error = $importer->readFile($skinFile, 1);\r
2865                 \r
2866                 /* TODO: we should consider to use the other way insterad of this */\r
2867                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2868                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2869                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2870                 \r
2871                 // clashes\r
2872                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2873                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2874                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2875                 \r
2876                 /* TODO: we should consider to use the other way insterad of this */\r
2877                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2878                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2879                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2880                 \r
2881                 if ( $error )\r
2882                 {\r
2883                         self::error($error);\r
2884                 }\r
2885                 \r
2886                 self::$skin->parse('skinieimport');\r
2887                 return;\r
2888         }\r
2889         \r
2890         /**\r
2891          * Admin::action_skiniedoimport()\r
2892          * \r
2893          * @param       void\r
2894          * @return      void\r
2895          */\r
2896         static private function action_skiniedoimport()\r
2897         {\r
2898                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2899                 \r
2900                 $member->isAdmin() or self::disallow();\r
2901                 \r
2902                 // load skinie class\r
2903                 include_once($DIR_LIBS . 'skinie.php');\r
2904                 \r
2905                 $skinFileRaw    = postVar('skinfile');\r
2906                 $mode                   = postVar('mode');\r
2907                 \r
2908                 $allowOverwrite = intPostVar('overwrite');\r
2909                 \r
2910                 // get full filename\r
2911                 if ( $mode == 'file' )\r
2912                 {\r
2913                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2914                         \r
2915                         /* TODO: remove this\r
2916                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2917                         if ( !file_exists($skinFile) )\r
2918                         {\r
2919                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2920                         }\r
2921                         */\r
2922                 }\r
2923                 else\r
2924                 {\r
2925                         $skinFile = $skinFileRaw;\r
2926                 }\r
2927                 \r
2928                 $importer = new SkinImport();\r
2929                 \r
2930                 $error = $importer->readFile($skinFile);\r
2931                 \r
2932                 if ( $error )\r
2933                 {\r
2934                         self::error($error);\r
2935                 }\r
2936                 \r
2937                 $error = $importer->writeToDatabase($allowOverwrite);\r
2938                 \r
2939                 if ( $error )\r
2940                 {\r
2941                         self::error($error);\r
2942                 }\r
2943                 \r
2944                 /* TODO: we should consider to use the other way insterad of this */\r
2945                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2946                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2947                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2948                 \r
2949                 self::$skin->parse('skiniedoimport');\r
2950                 return;\r
2951         }\r
2952 \r
2953         /**\r
2954          * Admin::action_skinieexport()\r
2955          * \r
2956          * @param       void\r
2957          * @return      void\r
2958          */\r
2959         static private function action_skinieexport()\r
2960         {\r
2961                 global $member, $DIR_LIBS;\r
2962                 \r
2963                 $member->isAdmin() or self::disallow();\r
2964                 \r
2965                 // load skinie class\r
2966                 include_once($DIR_LIBS . 'skinie.php');\r
2967                 \r
2968                 $aSkins         = requestIntArray('skin');\r
2969                 $aTemplates     = requestIntArray('template');\r
2970                 \r
2971                 if ( !is_array($aTemplates) )\r
2972                 {\r
2973                         $aTemplates = array();\r
2974                 }\r
2975                 if ( !is_array($aSkins) )\r
2976                 {\r
2977                         $aSkins = array();\r
2978                 }\r
2979                 \r
2980                 $skinList               = array_keys($aSkins);\r
2981                 $templateList   = array_keys($aTemplates);\r
2982                 \r
2983                 $info = postVar('info');\r
2984                 \r
2985                 $exporter = new SkinExport();\r
2986                 foreach ( $skinList as $skinId )\r
2987                 {\r
2988                         $exporter->addSkin($skinId);\r
2989                 }\r
2990                 foreach ($templateList as $templateId)\r
2991                 {\r
2992                         $exporter->addTemplate($templateId);\r
2993                 }\r
2994                 $exporter->setInfo($info);\r
2995                 \r
2996                 $exporter->export();\r
2997                 return;\r
2998         }\r
2999         \r
3000         /**\r
3001          * Admin::action_templateoverview()\r
3002          * \r
3003          * @param       void\r
3004          * @return      void\r
3005          */\r
3006         static private function action_templateoverview()\r
3007         {\r
3008                 global $member, $manager;\r
3009                 \r
3010                 $member->isAdmin() or self::disallow();\r
3011                 \r
3012                 self::$skin->parse('templateoverview');\r
3013                 return;\r
3014         }\r
3015         \r
3016         /**\r
3017          * Admin::action_templateedit()\r
3018          * \r
3019          * @param       string  $msg    message for pageheader\r
3020          * @return      void\r
3021          */\r
3022         static private function action_templateedit($msg = '')\r
3023         {\r
3024                 global $member, $manager;\r
3025                 if ( $msg )\r
3026                 {\r
3027                         self::$headMess = $msg;\r
3028                 }\r
3029                 \r
3030                 $templateid = intRequestVar('templateid');\r
3031                 \r
3032                 $member->isAdmin() or self::disallow();\r
3033                 \r
3034                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3035                 Admin::$extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3036                 \r
3037                 self::$skin->parse('templateedit');\r
3038                 return;\r
3039         }\r
3040         \r
3041         /**\r
3042          * TODO: remove this\r
3043          *\r
3044         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3045                 static $count = 1;\r
3046                 if (!isset($template[$name])) $template[$name] = '';\r
3047         ?>\r
3048                 </tr><tr>\r
3049                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3050                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3051         <?php       $count++;\r
3052         }\r
3053         */\r
3054         \r
3055         /**\r
3056          * Admin::action_templateupdate()\r
3057          * \r
3058          * @param       void\r
3059          * @return      void\r
3060          */\r
3061         static private function action_templateupdate()\r
3062         {\r
3063                 global $member,$manager;\r
3064                 \r
3065                 $templateid = intRequestVar('templateid');\r
3066                 \r
3067                 $member->isAdmin() or self::disallow();\r
3068                 \r
3069                 $name = postVar('tname');\r
3070                 $desc = postVar('tdesc');\r
3071                 \r
3072                 if ( !isValidTemplateName($name) )\r
3073                 {\r
3074                         self::error(_ERROR_BADTEMPLATENAME);\r
3075                 }\r
3076                 \r
3077                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3078                 {\r
3079                         self::error(_ERROR_DUPTEMPLATENAME);\r
3080                 }\r
3081                 \r
3082                 // 1. Remove all template parts\r
3083                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3084                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3085                 DB::execute($query);\r
3086                 \r
3087                 // 2. Update description\r
3088                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3089                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3090                 DB::execute($query);\r
3091                 \r
3092                 // 3. Add non-empty template parts\r
3093                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3094                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3095                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3096                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3097                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3098                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3099                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3100                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3101                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3102                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3103                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3104                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3105                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3106                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3107                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3108                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3109                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3110                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3111                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3112                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3113                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3114                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3115                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3116                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3117                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3118                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3119                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3120                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3121                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3122                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3123                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3124                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3125                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3126                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3127                 \r
3128                 $data = array('fields' => array());\r
3129                 $manager->notify('TemplateExtraFields', $data);\r
3130                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3131                 {\r
3132                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3133                         {\r
3134                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3135                         }\r
3136                 }\r
3137                 \r
3138                 // jump back to template edit\r
3139                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3140                 return;\r
3141         }\r
3142         \r
3143         /**\r
3144          * Admin::addToTemplate()\r
3145          * \r
3146          * @param       Integer $id     ID for template\r
3147          * @param       String  $partname       parts name\r
3148          * @param       String  $content        template contents\r
3149          * @return      Integer record index\r
3150          * \r
3151          */\r
3152         static private function addToTemplate($id, $partname, $content)\r
3153         {\r
3154                 // don't add empty parts:\r
3155                 if ( !trim($content) )\r
3156                 {\r
3157                         return -1;\r
3158                 }\r
3159                 \r
3160                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3161                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3162                 if ( DB::execute($query) === FALSE )\r
3163                 {\r
3164                         $err = DB::getError();\r
3165                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3166                 }\r
3167                 return DB::getInsertId();\r
3168         }\r
3169         \r
3170         /**\r
3171          * Admin::action_templatedelete()\r
3172          * \r
3173          * @param       void\r
3174          * @return      void\r
3175          */\r
3176         static private function action_templatedelete()\r
3177         {\r
3178                 global $member, $manager;\r
3179                 \r
3180                 $member->isAdmin() or self::disallow();\r
3181                 \r
3182                 $templateid = intRequestVar('templateid');\r
3183                 // TODO: check if template can be deleted\r
3184                 \r
3185                 self::$skin->parse('templatedelete');\r
3186                 return;\r
3187         }\r
3188         \r
3189         /**\r
3190          * Admin::action_templatedeleteconfirm()\r
3191          * \r
3192          * @param       void\r
3193          * @return      void\r
3194          */\r
3195         static private function action_templatedeleteconfirm()\r
3196         {\r
3197                 global $member, $manager;\r
3198                 \r
3199                 $templateid = intRequestVar('templateid');\r
3200                 \r
3201                 $member->isAdmin() or self::disallow();\r
3202                 \r
3203                 $data = array('templateid' => $templateid);\r
3204                 $manager->notify('PreDeleteTemplate', $data);\r
3205                 \r
3206                 // 1. delete description\r
3207                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3208                 \r
3209                 // 2. delete parts\r
3210                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3211                 \r
3212                 \r
3213                 $data = array('templateid' => $templateid);\r
3214                 $manager->notify('PostDeleteTemplate', $data);\r
3215                 \r
3216                 self::action_templateoverview();\r
3217                 return;\r
3218         }\r
3219         \r
3220         /**\r
3221          * Admin::action_templatenew()\r
3222          * \r
3223          * @param       void\r
3224          * @return      void\r
3225          */\r
3226         static private function action_templatenew()\r
3227         {\r
3228                 global $member;\r
3229                 \r
3230                 $member->isAdmin() or self::disallow();\r
3231                 \r
3232                 $name = postVar('name');\r
3233                 $desc = postVar('desc');\r
3234                 \r
3235                 if ( !isValidTemplateName($name) )\r
3236                 {\r
3237                         self::error(_ERROR_BADTEMPLATENAME);\r
3238                 }\r
3239                 \r
3240                 if ( Template::exists($name) )\r
3241                 {\r
3242                         self::error(_ERROR_DUPTEMPLATENAME);\r
3243                 }\r
3244                 \r
3245                 $newTemplateId = Template::createNew($name, $desc);\r
3246                 \r
3247                 self::action_templateoverview();\r
3248                 return;\r
3249         }\r
3250         \r
3251         /**\r
3252          * Admin::action_templateclone()\r
3253          * \r
3254          * @param       void\r
3255          * @return      void\r
3256          */\r
3257         static private function action_templateclone()\r
3258         {\r
3259                 global $member;\r
3260                 \r
3261                 $templateid = intRequestVar('templateid');\r
3262                 \r
3263                 $member->isAdmin() or self::disallow();\r
3264                 \r
3265                 // 1. read old template\r
3266                 $name = Template::getNameFromId($templateid);\r
3267                 $desc = Template::getDesc($templateid);\r
3268                 \r
3269                 // 2. create desc thing\r
3270                 $name = "cloned" . $name;\r
3271                 \r
3272                 // if a template with that name already exists:\r
3273                 if ( Template::exists($name) )\r
3274                 {\r
3275                         $i = 1;\r
3276                         while (Template::exists($name . $i))\r
3277                         {\r
3278                                 $i++;\r
3279                         }\r
3280                         $name .= $i;\r
3281                 }\r
3282                 \r
3283                 $newid = Template::createNew($name, $desc);\r
3284                 \r
3285                 // 3. create clone\r
3286                 // go through parts of old template and add them to the new one\r
3287                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3288                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3289                 \r
3290                 $res = DB::getResult($query);\r
3291                 foreach ( $res as $row)\r
3292                 {\r
3293                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3294                 }\r
3295                 \r
3296                 self::action_templateoverview();\r
3297                 return;\r
3298         }\r
3299         \r
3300         /**\r
3301          * Admin::action_admintemplateoverview()\r
3302          * \r
3303          * @param       void\r
3304          * @return      void\r
3305          */\r
3306         static private function action_admintemplateoverview()\r
3307         {\r
3308                 global $member, $manager;\r
3309                 $member->isAdmin() or self::disallow();\r
3310                 self::$skin->parse('admntemplateoverview');\r
3311                 return;\r
3312         }\r
3313         \r
3314         /**\r
3315          * Admin::action_admintemplateedit()\r
3316          * \r
3317          * @param       string  $msg    message for pageheader\r
3318          * @return      void\r
3319          */\r
3320         static private function action_admintemplateedit($msg = '')\r
3321         {\r
3322                 global $member, $manager;\r
3323                 if ( $msg )\r
3324                 {\r
3325                         self::$headMess = $msg;\r
3326                 }\r
3327                 $member->isAdmin() or self::disallow();\r
3328                 \r
3329                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3330                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3331                 \r
3332                 self::$skin->parse('admintemplateedit');\r
3333                 return;\r
3334         }\r
3335         \r
3336         /**\r
3337          * Admin::action_admintemplateupdate()\r
3338          * \r
3339          * @param       void\r
3340          * @return      void\r
3341          */\r
3342         static private function action_admintemplateupdate()\r
3343         {\r
3344                 global $member, $manager;\r
3345                 $templateid = intRequestVar('templateid');\r
3346                 $member->isAdmin() or self::disallow();\r
3347                 $name = postVar('tname');\r
3348                 $desc = postVar('tdesc');\r
3349                 \r
3350                 if ( !isValidTemplateName($name) )\r
3351                 {\r
3352                         self::error(_ERROR_BADTEMPLATENAME);\r
3353                 }\r
3354                 \r
3355                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3356                 {\r
3357                         self::error(_ERROR_DUPTEMPLATENAME);\r
3358                 }\r
3359                 \r
3360                 // 1. Remove all template parts\r
3361                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3362                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3363                 DB::execute($query);\r
3364                 \r
3365                 // 2. Update description\r
3366                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3367                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3368                 DB::execute($query);\r
3369                 \r
3370                 // 3. Add non-empty template parts\r
3371                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3372                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3373                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3376                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3377                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3378                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3379                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3380                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3381                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3382                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3383                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3384                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3385                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3386                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3387                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3388                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3389                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3390                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3391                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3392                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3393                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3394                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3395                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3396                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3397                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3398                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3399                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3472                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3473                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3474                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3475                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3476                 \r
3477                 $data = array('fields' => array());\r
3478                 $manager->notify('TemplateExtraFields', $data);\r
3479                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3480                 {\r
3481                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3482                         {\r
3483                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3484                         }\r
3485                 }\r
3486                 \r
3487                 // jump back to template edit\r
3488                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3489                 return;\r
3490         }\r
3491         \r
3492         /**\r
3493          * Admin::addToAdminTemplate()\r
3494          * \r
3495          * @param       integer $id                     ID for template\r
3496          * @param       string  $partname       name of part for template\r
3497          * @param       void    $contents       content for part of template\r
3498          * @return      integer ID for newly inserted Template\r
3499          */\r
3500         static private function addToAdminTemplate($id, $partname, $content)\r
3501         {\r
3502                 // don't add empty parts:\r
3503                 if ( !trim($content) )\r
3504                 {\r
3505                         return -1;\r
3506                 }\r
3507                 \r
3508                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3509                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3510                 if ( DB::execute($query) === FALSE )\r
3511                 {\r
3512                         $err = DB::getError();\r
3513                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3514                 }\r
3515                 return DB::getInsertId();\r
3516         }\r
3517         \r
3518         /**\r
3519          * Admin::action_admintemplatedelete()\r
3520          * \r
3521          * @param       void\r
3522          * @return      void\r
3523          */\r
3524         static private function action_admintemplatedelete()\r
3525         {\r
3526                 global $member, $manager;\r
3527                 $member->isAdmin() or self::disallow();\r
3528                 \r
3529                 // TODO: check if template can be deleted\r
3530                 self::$skin->parse('admintemplatedelete');\r
3531                 return;\r
3532         }\r
3533         \r
3534         /**\r
3535          * Admin::action_admintemplatedeleteconfirm()\r
3536          * \r
3537          * @param       void\r
3538          * @return      void\r
3539          */\r
3540         static private function action_admintemplatedeleteconfirm()\r
3541         {\r
3542                 global $member, $manager;\r
3543                 \r
3544                 $templateid = intRequestVar('templateid');\r
3545                 $member->isAdmin() or self::disallow();\r
3546                 \r
3547                 $data = array('templateid' => $templateid);\r
3548                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3549                 \r
3550                 // 1. delete description\r
3551                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3552                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3553                 DB::execute($query);\r
3554                 \r
3555                 // 2. delete parts\r
3556                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3557                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3558                 DB::execute($query);\r
3559                 \r
3560                 $data = array('templateid' => $templateid);\r
3561                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3562                 \r
3563                 self::action_admintemplateoverview();\r
3564                 return;\r
3565         }\r
3566         \r
3567         /**\r
3568          * Admin::action_admintemplatenew()\r
3569          * \r
3570          * @param       void\r
3571          * @return      void\r
3572          */\r
3573         static private function action_admintemplatenew()\r
3574         {\r
3575                 global $member;\r
3576                 $member->isAdmin() or self::disallow();\r
3577                 $name = postVar('name');\r
3578                 $desc = postVar('desc');\r
3579                 \r
3580                 if ( !isValidTemplateName($name) )\r
3581                 {\r
3582                         self::error(_ERROR_BADTEMPLATENAME);\r
3583                 }\r
3584                 else if ( !preg_match('#^admin/#', $name) )\r
3585                 {\r
3586                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3587                 }\r
3588                 else if ( Template::exists($name) )\r
3589                 {\r
3590                         self::error(_ERROR_DUPTEMPLATENAME);\r
3591                 }\r
3592                 \r
3593                 $newTemplateId = Template::createNew($name, $desc);\r
3594                 self::action_admintemplateoverview();\r
3595                 return;\r
3596         }\r
3597         \r
3598         /**\r
3599          * Admin::action_admintemplateclone()\r
3600          * \r
3601          * @param       void\r
3602          * @return      void\r
3603          */\r
3604         static private function action_admintemplateclone()\r
3605         {\r
3606                 global $member;\r
3607                 $templateid = intRequestVar('templateid');\r
3608                 $member->isAdmin() or self::disallow();\r
3609                 \r
3610                 // 1. read old template\r
3611                 $name = Template::getNameFromId($templateid);\r
3612                 $desc = Template::getDesc($templateid);\r
3613                 \r
3614                 // 2. create desc thing\r
3615                 $name = $name . "cloned";\r
3616                 \r
3617                 // if a template with that name already exists:\r
3618                 if ( Template::exists($name) )\r
3619                 {\r
3620                         $i = 1;\r
3621                         while ( Template::exists($name . $i) )\r
3622                         {\r
3623                                 $i++;\r
3624                         }\r
3625                         $name .= $i;\r
3626                 }\r
3627                 \r
3628                 $newid = Template::createNew($name, $desc);\r
3629                 \r
3630                 // 3. create clone\r
3631                 // go through parts of old template and add them to the new one\r
3632                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3633                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3634                 \r
3635                 $res = DB::getResult($query);\r
3636                 foreach ( $res as $row )\r
3637                 {\r
3638                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3639                 }\r
3640                 \r
3641                 self::action_admintemplateoverview();\r
3642                 return;\r
3643         }\r
3644 \r
3645         /**\r
3646          * Admin::action_skinoverview()\r
3647          * \r
3648          * @param       void\r
3649          * @return      void\r
3650          */\r
3651         static private function action_skinoverview()\r
3652         {\r
3653                 global $member, $manager;\r
3654                 \r
3655                 $member->isAdmin() or self::disallow();\r
3656                 \r
3657                 self::$skin->parse('skinoverview');\r
3658                 return;\r
3659         }\r
3660         \r
3661         /**\r
3662          * Admin::action_skinnew()\r
3663          * \r
3664          * @param       void\r
3665          * @return      void\r
3666          */\r
3667         static private function action_skinnew()\r
3668         {\r
3669                 global $member;\r
3670                 \r
3671                 $member->isAdmin() or self::disallow();\r
3672                 \r
3673                 $name = trim(postVar('name'));\r
3674                 $desc = trim(postVar('desc'));\r
3675                 \r
3676                 if ( !isValidSkinName($name) )\r
3677                 {\r
3678                         self::error(_ERROR_BADSKINNAME);\r
3679                 }\r
3680                 \r
3681                 if ( SKIN::exists($name) )\r
3682                 {\r
3683                         self::error(_ERROR_DUPSKINNAME);\r
3684                 }\r
3685                 \r
3686                 $newId = SKIN::createNew($name, $desc);\r
3687                 \r
3688                 self::action_skinoverview();\r
3689                 return;\r
3690         }\r
3691         \r
3692         /**\r
3693          * Admin::action_skinedit()\r
3694          * \r
3695          * @param       void\r
3696          * @return      void\r
3697          */\r
3698         static private function action_skinedit()\r
3699         {\r
3700                 global $member, $manager;\r
3701                 \r
3702                 $member->isAdmin() or self::disallow();\r
3703                 \r
3704                 self::$skin->parse('skinedit');\r
3705                 return;\r
3706         }\r
3707         \r
3708         /**\r
3709          * Admin::action_skineditgeneral()\r
3710          * \r
3711          * @param       void\r
3712          * @return      void\r
3713          */\r
3714         static private function action_skineditgeneral()\r
3715         {\r
3716                 global $member;\r
3717                 \r
3718                 $skinid = intRequestVar('skinid');\r
3719                 \r
3720                 $member->isAdmin() or self::disallow();\r
3721                 \r
3722                 $name           = postVar('name');\r
3723                 $desc           = postVar('desc');\r
3724                 $type           = postVar('type');\r
3725                 $inc_mode       = postVar('inc_mode');\r
3726                 $inc_prefix     = postVar('inc_prefix');\r
3727                 \r
3728                 $skin = new Skin($skinid);\r
3729                 \r
3730                 // 1. Some checks\r
3731                 if ( !isValidSkinName($name) )\r
3732                 {\r
3733                         self::error(_ERROR_BADSKINNAME);\r
3734                 }\r
3735                 \r
3736                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3737                 {\r
3738                         self::error(_ERROR_DUPSKINNAME);\r
3739                 }\r
3740                 \r
3741                 if ( !$type )\r
3742                 {\r
3743                         $type = 'text/html';\r
3744                 }\r
3745                 if ( !$inc_mode )\r
3746                 {\r
3747                         $inc_mode = 'normal';\r
3748                 }\r
3749                 \r
3750                 // 2. Update description\r
3751                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3752                 \r
3753                 self::action_skinedit();\r
3754                 return;\r
3755         }\r
3756         \r
3757         static private function action_skinedittype($msg = '')\r
3758         {\r
3759                 global $member, $manager;\r
3760                 \r
3761                 $member->isAdmin() or self::disallow();\r
3762                 \r
3763                 if ( $msg )\r
3764                 {\r
3765                         self::$headMess = $msg;\r
3766                 }\r
3767                 \r
3768                 $skinid = intRequestVar('skinid');\r
3769                 $type   = requestVar('type');\r
3770                 $type   = trim($type);\r
3771                 $type   = strtolower($type);\r
3772                 \r
3773                 if ( !isValidShortName($type) )\r
3774                 {\r
3775                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3776                 }\r
3777                 \r
3778                 self::$skin->parse('skinedittype');\r
3779                 return;\r
3780         }\r
3781         \r
3782         /**\r
3783          * Admin::action_skinupdate()\r
3784          * \r
3785          * @param       void\r
3786          * @return      void\r
3787          */\r
3788         static private function action_skinupdate()\r
3789         {\r
3790                 global $member;\r
3791                 \r
3792                 $skinid = intRequestVar('skinid');\r
3793                 $content = trim(postVar('content'));\r
3794                 $type = postVar('type');\r
3795                 \r
3796                 $member->isAdmin() or self::disallow();\r
3797                 \r
3798                 $skin = new SKIN($skinid);\r
3799                 $skin->update($type, $content);\r
3800                 \r
3801                 self::action_skinedittype(_SKIN_UPDATED);\r
3802                 return;\r
3803         }\r
3804         \r
3805         /**\r
3806          * Admin::action_skindelete()\r
3807          * \r
3808          * @param       void\r
3809          * @return      void\r
3810          */\r
3811         static private function action_skindelete()\r
3812         {\r
3813                 global $member, $manager, $CONF;\r
3814                 \r
3815                 $skinid = intRequestVar('skinid');\r
3816                 \r
3817                 $member->isAdmin() or self::disallow();\r
3818                 \r
3819                 // don't allow default skin to be deleted\r
3820                 if ( $skinid == $CONF['BaseSkin'] )\r
3821                 {\r
3822                         self::error(_ERROR_DEFAULTSKIN);\r
3823                 }\r
3824                 \r
3825                 // don't allow deletion of default skins for blogs\r
3826                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3827                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3828                 \r
3829                 $name = DB::getValue($query);\r
3830                 if ( $name )\r
3831                 {\r
3832                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3833                 }\r
3834                 \r
3835                 self::$skin->parse('skindelete');\r
3836                 return;\r
3837         }\r
3838         \r
3839         /**\r
3840          * Admin::action_skindeleteconfirm()\r
3841          * \r
3842          * @param       void\r
3843          * @return      void\r
3844          */\r
3845         static private function action_skindeleteconfirm()\r
3846         {\r
3847                 global $member, $CONF, $manager;\r
3848                 \r
3849                 $skinid = intRequestVar('skinid');\r
3850                 \r
3851                 $member->isAdmin() or self::disallow();\r
3852                 \r
3853                 // don't allow default skin to be deleted\r
3854                 if ( $skinid == $CONF['BaseSkin'] )\r
3855                 {\r
3856                         self::error(_ERROR_DEFAULTSKIN);\r
3857                 }\r
3858                 \r
3859                 // don't allow deletion of default skins for blogs\r
3860                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3861                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3862                 \r
3863                 $name = DB::getValue($query);\r
3864                 if ( $name )\r
3865                                 {\r
3866                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3867                 }\r
3868                 \r
3869                 $data = array('skinid' => $skinid);\r
3870                 $manager->notify('PreDeleteSkin', $data);\r
3871                 \r
3872                 // 1. delete description\r
3873                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3874                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3875                 DB::execute($query);\r
3876                 \r
3877                 // 2. delete parts\r
3878                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3879                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3880                 DB::execute($query);\r
3881                 \r
3882                 $data = array('skinid' => $skinid);\r
3883                 $manager->notify('PostDeleteSkin', $data);\r
3884                 \r
3885                 self::action_skinoverview();\r
3886                 return;\r
3887         }\r
3888         \r
3889         /**\r
3890          * Admin::action_skinremovetype()\r
3891          * \r
3892          * @param       void\r
3893          * @return      void\r
3894          */\r
3895         static private function action_skinremovetype()\r
3896         {\r
3897                 global $member, $manager, $CONF;\r
3898                 \r
3899                 $member->isAdmin() or self::disallow();\r
3900                 \r
3901                 $skinid = intRequestVar('skinid');\r
3902                 $skintype = requestVar('type');\r
3903                 \r
3904                 if ( !isValidShortName($skintype) )\r
3905                 {\r
3906                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3907                 }\r
3908                 \r
3909                 // don't allow default skinparts to be deleted\r
3910                 /* TODO: this array should be retrieved from Action class */\r
3911                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3912                 {\r
3913                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3914                 }\r
3915                 \r
3916                 self::$skin->parse('skinremovetype');\r
3917                 return;\r
3918         }\r
3919         \r
3920         /**\r
3921          * Admin::action_skinremovetypeconfirm()\r
3922          * \r
3923          * @param       void\r
3924          * @return      void\r
3925          */\r
3926         static private function action_skinremovetypeconfirm()\r
3927         {\r
3928                 global $member, $CONF, $manager;\r
3929                 \r
3930                 $member->isAdmin() or self::disallow();\r
3931                 \r
3932                 $skinid = intRequestVar('skinid');\r
3933                 $skintype = requestVar('type');\r
3934                 \r
3935                 if ( !isValidShortName($skintype) )\r
3936                 {\r
3937                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3938                 }\r
3939                 \r
3940                 // don't allow default skinparts to be deleted\r
3941                 /* TODO: this array should be retrieved from Action class */\r
3942                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3943                 {\r
3944                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3945                 }\r
3946                 \r
3947                 $data = array(\r
3948                         'skinid'   => $skinid,\r
3949                         'skintype' => $skintype\r
3950                 );\r
3951                 $manager->notify('PreDeleteSkinPart', $data);\r
3952                 \r
3953                 // delete part\r
3954                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3955                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3956                 DB::execute($query);\r
3957                 \r
3958                 $data = array(\r
3959                         'skinid'   => $skinid,\r
3960                         'skintype' => $skintype\r
3961                 );\r
3962                 $manager->notify('PostDeleteSkinPart', $data);\r
3963                 \r
3964                 self::action_skinedit();\r
3965                 return;\r
3966         }\r
3967 \r
3968         /**\r
3969          * Admin::action_skinclone()\r
3970          * \r
3971          * @param       void\r
3972          * @return      void\r
3973          */\r
3974         static private function action_skinclone()\r
3975         {\r
3976                 global $member;\r
3977                 \r
3978                 $member->isAdmin() or self::disallow();\r
3979                 \r
3980                 $skinid = intRequestVar('skinid');\r
3981                 \r
3982                 // 1. read skin to clone\r
3983                 $skin = new Skin($skinid);\r
3984                 \r
3985                 $name = "{$skin->getName()}_clone";\r
3986                 \r
3987                 // if a skin with that name already exists:\r
3988                 if ( Skin::exists($name) )\r
3989                 {\r
3990                         $i = 1;\r
3991                         while ( Skin::exists($name . $i) )\r
3992                         {\r
3993                                 $i++;\r
3994                         }\r
3995                         $name .= $i;\r
3996                 }\r
3997                 \r
3998                 // 2. create skin desc\r
3999                 $newid = Skin::createNew(\r
4000                         $name,\r
4001                         $skin->getDescription(),\r
4002                         $skin->getContentType(),\r
4003                         $skin->getIncludeMode(),\r
4004                         $skin->getIncludePrefix()\r
4005                 );\r
4006                 \r
4007                 // 3. clone\r
4008                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4009                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4010                 \r
4011                 $res = DB::getResult($query);\r
4012                 foreach ( $res as $row )\r
4013                 {\r
4014                         self::skinclonetype($skin, $newid, $row['stype']);\r
4015                 }\r
4016                 \r
4017                 self::action_skinoverview();\r
4018                 return;\r
4019         }\r
4020         \r
4021         /**\r
4022          * Admin::skinclonetype()\r
4023          * \r
4024          * @param       String  $skin   Skin object\r
4025          * @param       Integer $newid  ID for this clone\r
4026          * @param       String  $type   type of skin\r
4027          * @return      Void\r
4028          */\r
4029         static private function skinclonetype($skin, $newid, $type)\r
4030         {\r
4031                 $newid = intval($newid);\r
4032                 $content = $skin->getContentFromDB($type);\r
4033                 \r
4034                 if ( $content )\r
4035                 {\r
4036                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4037                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4038                         DB::execute($query);\r
4039                 }\r
4040                 return;\r
4041         }\r
4042         \r
4043         /**\r
4044          * Admin::action_adminskinoverview()\r
4045          * \r
4046          * @param       void\r
4047          * @return      void\r
4048          */\r
4049         static private function action_adminskinoverview()\r
4050         {\r
4051                 global $member, $manager;\r
4052                 \r
4053                 $member->isAdmin() or self::disallow();\r
4054                 \r
4055                 self::$skin->parse('adminskinoverview');\r
4056                 return;\r
4057         }\r
4058         \r
4059         /**\r
4060          * Admin::action_adminskinnew()\r
4061          * \r
4062          * @param       void\r
4063          * @return      void\r
4064          */\r
4065         static private function action_adminskinnew()\r
4066         {\r
4067                 global $member;\r
4068                 $member->isAdmin() or self::disallow();\r
4069                 $name = trim(postVar('name'));\r
4070                 $desc = trim(postVar('desc'));\r
4071                 \r
4072                 if ( !isValidSkinName($name) )\r
4073                 {\r
4074                         self::error(_ERROR_BADSKINNAME);\r
4075                 }\r
4076                 else if ( !preg_match('#^admin/#', $name) )\r
4077                 {\r
4078                         self::error(_ERROR_BADADMINSKINNAME);\r
4079                 }\r
4080                 else if ( Skin::exists($name) )\r
4081                 {\r
4082                         self::error(_ERROR_DUPSKINNAME);\r
4083                 }\r
4084                 /* TODO: $newId is not reused... */\r
4085                 $newId = Skin::createNew($name, $desc);\r
4086                 self::action_adminskinoverview();\r
4087                 return;\r
4088         }\r
4089         \r
4090         /**\r
4091          * Admin::action_adminskinedit()\r
4092          * \r
4093          * @param       void\r
4094          * @return      void\r
4095          */\r
4096         static private function action_adminskinedit()\r
4097         {\r
4098                 global $member, $manager;\r
4099                 \r
4100                 $member->isAdmin() or self::disallow();\r
4101                 self::$skin->parse('adminskinedit');\r
4102                 return;\r
4103         }\r
4104         \r
4105         /**\r
4106          * Admin::action_adminskineditgeneral()\r
4107          * \r
4108          * @param       void\r
4109          * @return      void\r
4110          */\r
4111         static private function action_adminskineditgeneral()\r
4112         {\r
4113                 global $member;\r
4114                 \r
4115                 $skinid = intRequestVar('skinid');\r
4116                 \r
4117                 $member->isAdmin() or self::disallow();\r
4118                 \r
4119                 $name           = postVar('name');\r
4120                 $desc           = postVar('desc');\r
4121                 $type           = postVar('type');\r
4122                 $inc_mode       = postVar('inc_mode');\r
4123                 $inc_prefix     = postVar('inc_prefix');\r
4124                 \r
4125                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4126                 \r
4127                 // 1. Some checks\r
4128                 if ( !isValidSkinName($name) )\r
4129                 {\r
4130                         self::error(_ERROR_BADSKINNAME);\r
4131                 }\r
4132                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4133                 {\r
4134                         self::error(_ERROR_DUPSKINNAME);\r
4135                 }\r
4136                 if ( !$type )\r
4137                 {\r
4138                         $type = 'text/html';\r
4139                 }\r
4140                 if ( !$inc_mode )\r
4141                 {\r
4142                         $inc_mode = 'normal';\r
4143                 }\r
4144                 // 2. Update description\r
4145                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4146                 self::action_adminskinedit();\r
4147                 return;\r
4148         }\r
4149         \r
4150         /**\r
4151          * Admin::action_adminskinedittype()\r
4152          * \r
4153          * @param       string  $msg    message for pageheader\r
4154          * @return      void\r
4155          */\r
4156         static private function action_adminskinedittype($msg = '')\r
4157         {\r
4158                 global $member, $manager;\r
4159                 \r
4160                 $member->isAdmin() or self::disallow();\r
4161                 \r
4162                 if ( $msg )\r
4163                 {\r
4164                         self::$headMess = $msg;\r
4165                 }\r
4166                 $type = requestVar('type');\r
4167                 $type = trim($type);\r
4168                 $type = strtolower($type);\r
4169                 \r
4170                 if ( !isValidShortName($type) )\r
4171                 {\r
4172                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4173                 }\r
4174                 \r
4175                 self::$skin->parse('adminskinedittype');\r
4176                 return;\r
4177         }\r
4178         \r
4179         /**\r
4180          * Admin::action_adminskinupdate()\r
4181          * \r
4182          * @param       void\r
4183          * @return      void\r
4184          */\r
4185         static private function action_adminskinupdate()\r
4186         {\r
4187                 global $member;\r
4188                 $skinid         = intRequestVar('skinid');\r
4189                 $content        = trim(postVar('content'));\r
4190                 $type           = postVar('type');\r
4191                 \r
4192                 $member->isAdmin() or self::disallow();\r
4193                 \r
4194                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4195                 $skin->update($type, $content);\r
4196                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4197                 return;\r
4198         }\r
4199         \r
4200         /**\r
4201          * Admin::action_adminskindelete()\r
4202          * \r
4203          * @param       void\r
4204          * @return      void\r
4205          */\r
4206         static private function action_adminskindelete()\r
4207         {\r
4208                 global $member, $manager, $CONF;\r
4209                 $member->isAdmin() or self::disallow();\r
4210                 \r
4211                 /* TODO: needless variable $skinid... */\r
4212                 $skinid = intRequestVar('skinid');\r
4213                 self::$skin->parse('adminskindelete');\r
4214                 return;\r
4215         }\r
4216 \r
4217         /**\r
4218          * Admin::action_adminskindeleteconfirm()\r
4219          * \r
4220          * @param       void\r
4221          * @return      void\r
4222          */\r
4223         static private function action_adminskindeleteconfirm()\r
4224         {\r
4225                 global $member, $CONF, $manager;\r
4226                 \r
4227                 $member->isAdmin() or self::disallow();\r
4228                 $skinid = intRequestVar('skinid');\r
4229                 \r
4230                 // don't allow default skin to be deleted\r
4231                 if ( $skinid == $CONF['AdminSkin'] )\r
4232                 {\r
4233                         self::error(_ERROR_DEFAULTSKIN);\r
4234                 }\r
4235                 \r
4236                 /*\r
4237                  * TODO: NOT Implemented\r
4238                  *  don't allow deletion of default skins for members\r
4239                 $memberDefaults =  $member->getAdminSkin();\r
4240                 foreach ( $memberDefaults as $memID => $adminskin )\r
4241                 {\r
4242                         if ( $skinid == $adminskin )\r
4243                         {\r
4244                                 $mem = MEMBER::createFromID($memID);\r
4245                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4246                         }\r
4247                 }\r
4248                 */\r
4249                 \r
4250                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4251                 \r
4252                 // 1. delete description\r
4253                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4254                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4255                 DB::execute($query);\r
4256                 \r
4257                 // 2. delete parts\r
4258                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4259                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4260                 \r
4261                 DB::execute($query);\r
4262                 \r
4263                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4264                 self::action_adminskinoverview();\r
4265                 return;\r
4266         }\r
4267         \r
4268         /**\r
4269          * Admin::action_adminskinremovetype()\r
4270          * \r
4271          * @param       void\r
4272          * @return      void\r
4273          */\r
4274         static private function action_adminskinremovetype()\r
4275         {\r
4276                 global $member, $manager, $CONF;\r
4277 \r
4278                 $member->isAdmin() or self::disallow();\r
4279                 \r
4280                 $skinid         = intRequestVar('skinid');\r
4281                 $skintype       = requestVar('type');\r
4282                 \r
4283                 if ( !isValidShortName($skintype) )\r
4284                 {\r
4285                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4286                 }\r
4287                 \r
4288                 self::$skin->parse('adminskinremovetype');\r
4289                 return;\r
4290         }\r
4291         \r
4292         /**\r
4293          * Admin::action_adminskinremovetypeconfirm()\r
4294          * \r
4295          * @param       void\r
4296          * @return      void\r
4297          */\r
4298         static private function action_adminskinremovetypeconfirm()\r
4299         {\r
4300                 global $member, $CONF, $manager;\r
4301                 \r
4302                 $member->isAdmin() or self::disallow();\r
4303                 \r
4304                 $skinid         = intRequestVar('skinid');\r
4305                 $skintype       = requestVar('type');\r
4306                 \r
4307                 if ( !isValidShortName($skintype) )\r
4308                 {\r
4309                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4310                 }\r
4311                 \r
4312                 $data =array(\r
4313                         'skinid'        => $skinid,\r
4314                         'skintype'      => $skintype\r
4315                 );\r
4316                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4317                 \r
4318                 // delete part\r
4319                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4320                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4321                 DB::execute($query);\r
4322                 \r
4323                 $data = array(\r
4324                         'skinid'        => $skinid,\r
4325                         'skintype'      => $skintype\r
4326                 );\r
4327                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4328                 \r
4329                 self::action_adminskinedit();\r
4330                 return;\r
4331         }\r
4332 \r
4333         /**\r
4334          * Admin::action_adminskinclone()\r
4335          * \r
4336          * @param       void\r
4337          * @return      void\r
4338          */\r
4339         static private function action_adminskinclone()\r
4340         {\r
4341                 global $member;\r
4342                 \r
4343                 $member->isAdmin() or self::disallow();\r
4344                 \r
4345                 $skinid = intRequestVar('skinid');\r
4346                 \r
4347                 // 1. read skin to clone\r
4348                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4349                 $name = "{$skin->getName()}_clone";\r
4350                 \r
4351                 // if a skin with that name already exists:\r
4352                 if ( Skin::exists($name) )\r
4353                 {\r
4354                         $i = 1;\r
4355                         while ( Skin::exists($name . $i) )\r
4356                         {\r
4357                                 $i++;\r
4358                         }\r
4359                         $name .= $i;\r
4360                 }\r
4361                 \r
4362                 // 2. create skin desc\r
4363                 $newid = Skin::createNew(\r
4364                         $name,\r
4365                         $skin->getDescription(),\r
4366                         $skin->getContentType(),\r
4367                         $skin->getIncludeMode(),\r
4368                         $skin->getIncludePrefix()\r
4369                 );\r
4370                 \r
4371                 // 3. clone\r
4372                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4373                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4374                 \r
4375                 $res = DB::getResult($query);\r
4376                 foreach ( $res as $row )\r
4377                 {\r
4378                         self::skinclonetype($skin, $newid, $row['stype']);\r
4379                 }\r
4380                 self::action_adminskinoverview();\r
4381                 return;\r
4382         }\r
4383         \r
4384         /**\r
4385          * Admin::adminskinclonetype()\r
4386          * \r
4387          * @param       string  $skin   an instance of Skin class\r
4388          * @param       integer $newid  ID for new skin\r
4389          * @param       string  $type   skin type\r
4390          * @return      void\r
4391          */\r
4392         static private function adminskinclonetype($skin, $newid, $type)\r
4393         {\r
4394                 $content = $skin->getContentFromDB($type);\r
4395                 \r
4396                 if ( $content )\r
4397                 {\r
4398                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4399                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4400                         DB::execute($query);\r
4401                 }\r
4402                 return;\r
4403         }\r
4404         \r
4405         /**\r
4406          * Admin::action_adminskinieoverview()\r
4407          * \r
4408          * @param       void\r
4409          * @return      void\r
4410          */\r
4411         static private function action_adminskinieoverview()\r
4412         {\r
4413                 global $member, $DIR_LIBS, $manager;\r
4414                 \r
4415                 $member->isAdmin() or self::disallow();\r
4416                 \r
4417                 // load skinie class\r
4418                 include_once($DIR_LIBS . 'skinie.php');\r
4419                 \r
4420                 self::$skin->parse('adminskinieoverview');\r
4421                 return;\r
4422         }\r
4423 \r
4424         /**\r
4425          * Admin::action_adminskinieimport()\r
4426          * \r
4427          * @param       void\r
4428          * @return      void\r
4429          */\r
4430         static private function action_adminskinieimport()\r
4431         {\r
4432                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4433                 \r
4434                 $member->isAdmin() or self::disallow();\r
4435                 \r
4436                 // load skinie class\r
4437                 include_once($DIR_LIBS . 'skinie.php');\r
4438                 \r
4439                 $skinFileRaw    = postVar('skinfile');\r
4440                 $mode                   = postVar('mode');\r
4441                 \r
4442                 $importer = new SKINIMPORT();\r
4443                 \r
4444                 // get full filename\r
4445                 if ( $mode == 'file' )\r
4446                 {\r
4447                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4448                         \r
4449                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4450                         if ( !file_exists($skinFile) )\r
4451                         {\r
4452                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4453                         }\r
4454                 }\r
4455                 else\r
4456                 {\r
4457                         $skinFile = $skinFileRaw;\r
4458                 }\r
4459                 \r
4460                 // read only metadata\r
4461                 $error = $importer->readFile($skinFile, 1);\r
4462                 if ( $error )\r
4463                 {\r
4464                         self::error($error);\r
4465                 }\r
4466                 \r
4467                 /* TODO: we should consider to use the other way instead of this */\r
4468                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4469                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4470                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4471                 \r
4472                 // clashes\r
4473                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4474                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4475                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4476                 /* TODO: we should consider to use the other way instead of this */\r
4477                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4478                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4479                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4480                 \r
4481                 self::$skin->parse('adminskinieimport');\r
4482                 return;\r
4483         }\r
4484         \r
4485         /**\r
4486          * Admin::action_adminskiniedoimport()\r
4487          * \r
4488          * @param       void\r
4489          * @return      void\r
4490          */\r
4491         static private function action_adminskiniedoimport()\r
4492         {\r
4493                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4494                 \r
4495                 $member->isAdmin() or self::disallow();\r
4496                 \r
4497                 // load skinie class\r
4498                 include_once($DIR_LIBS . 'skinie.php');\r
4499                 \r
4500                 $skinFileRaw    = postVar('skinfile');\r
4501                 $mode                   = postVar('mode');\r
4502                 $allowOverwrite = intPostVar('overwrite');\r
4503                 \r
4504                 // get full filename\r
4505                 if ( $mode == 'file' )\r
4506                 {\r
4507                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4508                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4509                         if ( !file_exists($skinFile) )\r
4510                         {\r
4511                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4512                         }\r
4513                 }\r
4514                 else\r
4515                 {\r
4516                         $skinFile = $skinFileRaw;\r
4517                 }\r
4518                 \r
4519                 $importer = new SKINIMPORT();\r
4520                 \r
4521                 $error = $importer->readFile($skinFile);\r
4522                 if ( $error )\r
4523                 {\r
4524                         self::error($error);\r
4525                 }\r
4526                 \r
4527                 $error = $importer->writeToDatabase($allowOverwrite);\r
4528                 if ( $error )\r
4529                 {\r
4530                         self::error($error);\r
4531                 }\r
4532                 \r
4533                 /* TODO: we should consider to use the other way instead of this */\r
4534                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4535                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4536                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4537                 \r
4538                 self::$skin->parse('adminskiniedoimport');\r
4539                 return;\r
4540         }\r
4541 \r
4542         /**\r
4543          * Admin::action_adminskinieexport()\r
4544          * \r
4545          * @param       void\r
4546          * @return      void\r
4547          */\r
4548         static private function action_adminskinieexport()\r
4549         {\r
4550                 global $member, $DIR_PLUGINS;\r
4551                 \r
4552                 $member->isAdmin() or self::disallow();\r
4553                 \r
4554                 // load skinie class\r
4555                 $aSkins = requestIntArray('skin');\r
4556                 if (!is_array($aSkins)) {\r
4557                         $aSkins = array();\r
4558                 }\r
4559                 $skinList = array_keys($aSkins);\r
4560                 \r
4561                 $aTemplates = requestIntArray('template');\r
4562                 if (!is_array($aTemplates))\r
4563                 {\r
4564                         $aTemplates = array();\r
4565                 }\r
4566                 $templateList = array_keys($aTemplates);\r
4567                 \r
4568                 $info = postVar('info');\r
4569                 \r
4570                 include_libs('skinie.php');\r
4571                 $exporter = new SkinExport();\r
4572                 foreach ( $skinList as $skinId )\r
4573                 {\r
4574                         $exporter->addSkin($skinId);\r
4575                 }\r
4576                 foreach ( $templateList as $templateId )\r
4577                 {\r
4578                         $exporter->addTemplate($templateId);\r
4579                 }\r
4580                 $exporter->setInfo($info);\r
4581                 $exporter->export();\r
4582                 return;\r
4583         }\r
4584         \r
4585         /**\r
4586          * Admin::action_settingsedit()\r
4587          * \r
4588          * @param       Void\r
4589          * @return      Void\r
4590          */\r
4591         static private function action_settingsedit()\r
4592         {\r
4593                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4594                 \r
4595                 $member->isAdmin() or self::disallow();\r
4596                 \r
4597                 self::$skin->parse('settingsedit');\r
4598                 return;\r
4599         }\r
4600         \r
4601         /**\r
4602          * Admin::action_settingsupdate()\r
4603          * Update $CONFIG and redirect\r
4604          * \r
4605          * @param       void\r
4606          * @return      void\r
4607          */\r
4608         static private function action_settingsupdate()\r
4609         {\r
4610                 global $member, $CONF;\r
4611                 \r
4612                 $member->isAdmin() or self::disallow();\r
4613                 \r
4614                 // check if email address for admin is valid\r
4615                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4616                 {\r
4617                         self::error(_ERROR_BADMAILADDRESS);\r
4618                 }\r
4619                 \r
4620                 // save settings\r
4621                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4622                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4623                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4624                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4625                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4626                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4627                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4628                 self::updateConfig('Locale',                    postVar('Locale'));\r
4629                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4630                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4631                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4632                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4633                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4634                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4635                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4636                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4637                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4638                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4639                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4640                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4641                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4642                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4643                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4644                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4645                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4646                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4647                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4648                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4649                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4650                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4651                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4652                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4653                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4654                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4655                 \r
4656                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4657                 // note that when changing cookie settings, this redirect might cause the user\r
4658                 // to have to log in again.\r
4659                 getConfig();\r
4660                 redirect($CONF['AdminURL'] . '?action=manage');\r
4661                 return;\r
4662         }\r
4663         \r
4664         /**\r
4665          * Admin::action_systemoverview()\r
4666          * Output system overview\r
4667          * \r
4668          * @param       void\r
4669          * @return      void\r
4670          */\r
4671         static private function action_systemoverview()\r
4672         {\r
4673                 self::$skin->parse('systemoverview');\r
4674                 return;\r
4675         }\r
4676         \r
4677         /**\r
4678          * Admin::updateConfig()\r
4679          * \r
4680          * @param       string  $name   \r
4681          * @param       string  $val    \r
4682          * @return      integer return the ID in which the latest query posted\r
4683          */\r
4684         static private function updateConfig($name, $val)\r
4685         {\r
4686                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4687                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4688                 if ( DB::execute($query) === FALSE )\r
4689                 {\r
4690                         $err = DB::getError();\r
4691                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4692                 }\r
4693                 return DB::getInsertId();\r
4694         }\r
4695         \r
4696         /**\r
4697          * Admin::error()\r
4698          * Error message\r
4699          * \r
4700          * @param       string  $msg    message that will be shown\r
4701          * @return      void\r
4702          */\r
4703         static public function error($msg)\r
4704         {\r
4705                 self::$headMess = $msg;\r
4706                 self::$skin->parse('adminerrorpage');\r
4707                 return;\r
4708         }\r
4709         \r
4710         /**\r
4711          * Admin::disallow()\r
4712          * add error log and show error page \r
4713          * \r
4714          * @param       void\r
4715          * @return      void\r
4716          */\r
4717         static public function disallow()\r
4718         {\r
4719                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4720                 self::error(_ERROR_DISALLOWED);\r
4721                 return;\r
4722         }\r
4723         \r
4724         /**\r
4725          * Admin::PluninAdminPagehead()\r
4726          * Output pluginadmin page head\r
4727          *\r
4728          * @param       string  $extrahead\r
4729          * @return      void\r
4730          */\r
4731         static public function PluninAdminPagehead($extrahead = '')\r
4732         {\r
4733                 self::$extrahead .= $extrahead;\r
4734                 self::$skin->parse('pagehead');\r
4735                 return;\r
4736         }\r
4737         \r
4738         /**\r
4739          * Admin::PluninAdminPagefoot()\r
4740          * Output pluginadmin page foot\r
4741          *\r
4742          * @param       void\r
4743          * @return      void\r
4744          */\r
4745         static public function PluninAdminPagefoot()\r
4746         {\r
4747                 self::$skin->parse('pagefoot');\r
4748                 return;\r
4749         }\r
4750         \r
4751         /**\r
4752          * Admin::action_bookmarklet()\r
4753          * \r
4754          * @param       void\r
4755          * @return      void\r
4756          */\r
4757         static private function action_bookmarklet()\r
4758         {\r
4759                 global $member, $manager;\r
4760                 \r
4761                 $blogid = intRequestVar('blogid');\r
4762                 $member->teamRights($blogid) or self::disallow();\r
4763                 \r
4764                 self::$skin->parse('bookmarklet');\r
4765                 return;\r
4766         }\r
4767         \r
4768         /**\r
4769          * Admin::action_actionlog()\r
4770          * \r
4771          * @param       void\r
4772          * @return      void\r
4773          */\r
4774         static private function action_actionlog()\r
4775         {\r
4776                 global $member, $manager;\r
4777                 \r
4778                 $member->isAdmin() or self::disallow();\r
4779                 \r
4780                 self::$skin->parse('actionlog');\r
4781                 return;\r
4782         }\r
4783         \r
4784         /**\r
4785          * Admin::action_banlist()\r
4786          * \r
4787          * @param       void\r
4788          * @return      void\r
4789          */\r
4790         static private function action_banlist()\r
4791         {\r
4792                 global $member, $manager;\r
4793                 \r
4794                 $blogid = intRequestVar('blogid');\r
4795                 $member->blogAdminRights($blogid) or self::disallow();\r
4796                 \r
4797                 self::$skin->parse('banlist');\r
4798                 return;\r
4799         }\r
4800         \r
4801         /**\r
4802          * Admin::action_banlistdelete()\r
4803          * \r
4804          * @param       void\r
4805          * @return      void\r
4806          */\r
4807         static private function action_banlistdelete()\r
4808         {\r
4809                 global $member, $manager;\r
4810                 \r
4811                 $blogid = intRequestVar('blogid');\r
4812                 $member->blogAdminRights($blogid) or self::disallow();\r
4813                 \r
4814                 self::$skin->parse('banlistdelete');\r
4815                 return;\r
4816         }\r
4817         \r
4818         /**\r
4819          * Admin::action_banlistdeleteconfirm()\r
4820          * \r
4821          * @param       void\r
4822          * @return      void\r
4823          */\r
4824         static private function action_banlistdeleteconfirm()\r
4825         {\r
4826                 global $member, $manager;\r
4827                 \r
4828                 $blogid         = intPostVar('blogid');\r
4829                 $allblogs       = postVar('allblogs');\r
4830                 $iprange        = postVar('iprange');\r
4831                 \r
4832                 $member->blogAdminRights($blogid) or self::disallow();\r
4833                 \r
4834                 $deleted = array();\r
4835                 \r
4836                 if ( !$allblogs )\r
4837                 {\r
4838                         if ( Ban::removeBan($blogid, $iprange) )\r
4839                         {\r
4840                                 $deleted[] = $blogid;\r
4841                         }\r
4842                 }\r
4843                 else\r
4844                 {\r
4845                         // get blogs fot which member has admin rights\r
4846                         $adminblogs = $member->getAdminBlogs();\r
4847                         foreach ($adminblogs as $blogje)\r
4848                         {\r
4849                                 if ( Ban::removeBan($blogje, $iprange) )\r
4850                                 {\r
4851                                         $deleted[] = $blogje;\r
4852                                 }\r
4853                         }\r
4854                 }\r
4855                 \r
4856                 if ( sizeof($deleted) == 0 )\r
4857                 {\r
4858                         self::error(_ERROR_DELETEBAN);\r
4859                 }\r
4860                 \r
4861                 /* TODO: we should use other ways */\r
4862                 $_REQUEST['delblogs'] = $deleted;\r
4863                 \r
4864                 self::$skin->parse('banlistdeleteconfirm');\r
4865                 return;\r
4866         }\r
4867         \r
4868         /**\r
4869          * Admin::action_banlistnewfromitem()\r
4870          * \r
4871          * @param       void\r
4872          * @return      void\r
4873          */\r
4874         static private function action_banlistnewfromitem()\r
4875         {\r
4876                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
4877                 return;\r
4878         }\r
4879         \r
4880         /**\r
4881          * Admin::action_banlistnew()\r
4882          * \r
4883          * @param       integer $blogid ID for weblog\r
4884          * @return      void\r
4885          */\r
4886         static private function action_banlistnew($blogid = '')\r
4887         {\r
4888                 global $member, $manager;\r
4889                 \r
4890                 if ( $blogid == '' )\r
4891                 {\r
4892                         $blogid = intRequestVar('blogid');\r
4893                 }\r
4894                 \r
4895                 $ip = requestVar('ip');\r
4896                 \r
4897                 $member->blogAdminRights($blogid) or self::disallow();\r
4898                 \r
4899                 /* TODO: we should consider to use the other way instead of this */\r
4900                 $_REQUEST['blogid'] = $blogid;          \r
4901                 \r
4902                 self::$skin->parse('banlistnew');\r
4903                 \r
4904                 return;\r
4905         }\r
4906 \r
4907         /**\r
4908          * Admin::action_banlistadd()\r
4909          * \r
4910          * @param       void\r
4911          * @return      void\r
4912          */\r
4913         static private function action_banlistadd()\r
4914         {\r
4915                 global $member;\r
4916                 \r
4917                 $blogid         = intPostVar('blogid');\r
4918                 $allblogs       = postVar('allblogs');\r
4919                 $iprange        = postVar('iprange');\r
4920                 \r
4921                 if ( $iprange == "custom" )\r
4922                 {\r
4923                         $iprange = postVar('customiprange');\r
4924                 }\r
4925                 $reason   = postVar('reason');\r
4926                 \r
4927                 $member->blogAdminRights($blogid) or self::disallow();\r
4928                 \r
4929                 // TODO: check IP range validity\r
4930                 \r
4931                 if ( !$allblogs )\r
4932                 {\r
4933                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4934                         {\r
4935                                 self::error(_ERROR_ADDBAN);\r
4936                         }\r
4937                 }\r
4938                 else\r
4939                 {\r
4940                         // get blogs fot which member has admin rights\r
4941                         $adminblogs = $member->getAdminBlogs();\r
4942                         $failed = 0;\r
4943                         foreach ($adminblogs as $blogje)\r
4944                         {\r
4945                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4946                                 {\r
4947                                         $failed = 1;\r
4948                                 }\r
4949                         }\r
4950                         if ( $failed )\r
4951                         {\r
4952                                 self::error(_ERROR_ADDBAN);\r
4953                         }\r
4954                 }\r
4955                 self::action_banlist();\r
4956                 return;\r
4957         }\r
4958         \r
4959         /**\r
4960          * Admin::action_clearactionlog()\r
4961          * \r
4962          * @param       void\r
4963          * @return      void\r
4964          */\r
4965         static private function action_clearactionlog()\r
4966         {\r
4967                 global $member;\r
4968                 \r
4969                 $member->isAdmin() or self::disallow();\r
4970                 \r
4971                 ActionLog::clear();\r
4972                 \r
4973                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4974                 return;\r
4975         }\r
4976         \r
4977         /**\r
4978          * Admin::action_backupoverview()\r
4979          * \r
4980          * @param       void\r
4981          * @return      void\r
4982          */\r
4983         static private function action_backupoverview()\r
4984         {\r
4985                 global $member, $manager;\r
4986                 \r
4987                 $member->isAdmin() or self::disallow();\r
4988                 \r
4989                 self::$skin->parse('backupoverview');\r
4990                 return;\r
4991         }\r
4992 \r
4993         /**\r
4994          * Admin::action_backupcreate()\r
4995          * create file for backup\r
4996          * \r
4997          * @param               void\r
4998          * @return      void\r
4999          * \r
5000          */\r
5001         static private function action_backupcreate()\r
5002         {\r
5003                 global $member, $DIR_LIBS;\r
5004                 \r
5005                 $member->isAdmin() or self::disallow();\r
5006                 \r
5007                 // use compression ?\r
5008                 $useGzip = (integer) postVar('gzip');\r
5009                 \r
5010                 include($DIR_LIBS . 'backup.php');\r
5011                 \r
5012                 // try to extend time limit\r
5013                 // (creating/restoring dumps might take a while)\r
5014                 @set_time_limit(1200);\r
5015                 \r
5016                 Backup::do_backup($useGzip);\r
5017                 exit;\r
5018         }\r
5019         \r
5020         /**\r
5021          * Admin::action_backuprestore()\r
5022          * restoring from uploaded file\r
5023          * \r
5024          * @param               void\r
5025          * @return      void\r
5026          */\r
5027         static private function action_backuprestore()\r
5028         {\r
5029                 global $member, $DIR_LIBS;\r
5030                 \r
5031                 $member->isAdmin() or self::disallow();\r
5032                 \r
5033                 if ( intPostVar('letsgo') != 1 )\r
5034                 {\r
5035                         self::error(_ERROR_BACKUP_NOTSURE);\r
5036                 }\r
5037                 \r
5038                 include($DIR_LIBS . 'backup.php');\r
5039                 \r
5040                 // try to extend time limit\r
5041                 // (creating/restoring dumps might take a while)\r
5042                 @set_time_limit(1200);\r
5043                 \r
5044                 $message = Backup::do_restore();\r
5045                 if ( $message != '' )\r
5046                 {\r
5047                         self::error($message);\r
5048                 }\r
5049                 self::$skin->parse('backuprestore');\r
5050                 return;\r
5051         }\r
5052         \r
5053         /**\r
5054          * Admin::action_pluginlist()\r
5055          * output the list of installed plugins\r
5056          * \r
5057          * @param       void\r
5058          * @return      void\r
5059          * \r
5060          */\r
5061         static private function action_pluginlist()\r
5062         {\r
5063                 global $DIR_PLUGINS, $member, $manager;\r
5064                 \r
5065                 // check if allowed\r
5066                 $member->isAdmin() or self::disallow();\r
5067                 \r
5068                 self::$skin->parse('pluginlist');\r
5069                 return;\r
5070         }\r
5071         \r
5072         /**\r
5073          * Admin::action_pluginhelp()\r
5074          * \r
5075          * @param       void\r
5076          * @return      void\r
5077          */\r
5078         static private function action_pluginhelp()\r
5079         {\r
5080                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5081                 \r
5082                 // check if allowed\r
5083                 $member->isAdmin() or self::disallow();\r
5084                 \r
5085                 $plugid = intGetVar('plugid');\r
5086                 \r
5087                 if ( !$manager->pidInstalled($plugid) )\r
5088                 {\r
5089                         self::error(_ERROR_NOSUCHPLUGIN);\r
5090                 }\r
5091                 \r
5092                 self::$skin->parse('pluginhelp');\r
5093                 return;\r
5094         }\r
5095         \r
5096         /**\r
5097          * Admin::action_pluginadd()\r
5098          * \r
5099          * @param       Void\r
5100          * @return      Void\r
5101          * \r
5102          */\r
5103         static private function action_pluginadd()\r
5104         {\r
5105                 global $member, $manager, $DIR_PLUGINS;\r
5106                 \r
5107                 // check if allowed\r
5108                 $member->isAdmin() or self::disallow();\r
5109                 \r
5110                 $name = postVar('filename');\r
5111                 \r
5112                 if ( $manager->pluginInstalled($name) )\r
5113                 {\r
5114                         self::error(_ERROR_DUPPLUGIN);\r
5115                 }\r
5116                 \r
5117                 if ( !checkPlugin($name) )\r
5118                 {\r
5119                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5120                 }\r
5121                 \r
5122                 // get number of currently installed plugins\r
5123                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5124                 $numCurrent = $res->rowCount();\r
5125                 \r
5126                 // plugin will be added as last one in the list\r
5127                 $newOrder = $numCurrent + 1;\r
5128                 \r
5129                 $data = array('file' => &$name);\r
5130                 $manager->notify('PreAddPlugin', $data);\r
5131                 \r
5132                 // do this before calling getPlugin (in case the plugin id is used there)\r
5133                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5134                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5135                 DB::execute($query);\r
5136                 $iPid = DB::getInsertId();\r
5137                 \r
5138                 $manager->clearCachedInfo('installedPlugins');\r
5139                 \r
5140                 // Load the plugin for condition checking and instalation\r
5141                 $plugin =& $manager->getPlugin($name);\r
5142                 \r
5143                 // check if it got loaded (could have failed)\r
5144                 if ( !$plugin )\r
5145                 {\r
5146                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5147                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5148                         \r
5149                         DB::execute($query);\r
5150                         \r
5151                         $manager->clearCachedInfo('installedPlugins');\r
5152                         self::error(_ERROR_PLUGIN_LOAD);\r
5153                 }\r
5154                 \r
5155                 // check if plugin needs a newer Nucleus version\r
5156                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5157                 {\r
5158                         // uninstall plugin again...\r
5159                         self::deleteOnePlugin($plugin->getID());\r
5160                         \r
5161                         // ...and show error\r
5162                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5163                 }\r
5164                 \r
5165                 // check if plugin needs a newer Nucleus version\r
5166                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5167                 {\r
5168                         // uninstall plugin again...\r
5169                         self::deleteOnePlugin($plugin->getID());\r
5170                         \r
5171                         // ...and show error\r
5172                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5173                 }\r
5174                 \r
5175                 $pluginList = $plugin->getPluginDep();\r
5176                 foreach ( $pluginList as $pluginName )\r
5177                 {\r
5178                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5179                         if ($res->rowCount() == 0)\r
5180                         {\r
5181                                 // uninstall plugin again...\r
5182                                 self::deleteOnePlugin($plugin->getID());\r
5183                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5184                         }\r
5185                 }\r
5186                 \r
5187                 // call the install method of the plugin\r
5188                 $plugin->install();\r
5189                 \r
5190                 $data = array('plugin' => &$plugin);\r
5191                 $manager->notify('PostAddPlugin', $data);\r
5192                 \r
5193                 // update all events\r
5194                 self::action_pluginupdate();\r
5195                 return;\r
5196         }\r
5197         \r
5198         /**\r
5199          * ADMIN:action_pluginupdate():\r
5200          * \r
5201          * @param       Void\r
5202          * @return      Void\r
5203          * \r
5204          */\r
5205         static private function action_pluginupdate()\r
5206         {\r
5207                 global $member, $manager, $CONF;\r
5208                 \r
5209                 // check if allowed\r
5210                 $member->isAdmin() or self::disallow();\r
5211                 \r
5212                 // delete everything from plugin_events\r
5213                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5214                 \r
5215                 // loop over all installed plugins\r
5216                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5217                 foreach ( $res as $row )\r
5218                 {\r
5219                         $pid  =  $row['pid'];\r
5220                         $plug =& $manager->getPlugin($row['pfile']);\r
5221                         if ( $plug )\r
5222                         {\r
5223                                 $eventList = $plug->getEventList();\r
5224                                 foreach ( $eventList as $eventName )\r
5225                                 {\r
5226                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5227                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5228                                         DB::execute($query);\r
5229                                 }\r
5230                         }\r
5231                 }\r
5232                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5233                 return;\r
5234         }\r
5235         \r
5236         /**\r
5237          * Admin::action_plugindelete()\r
5238          * \r
5239          * @param       void\r
5240          * @return      void\r
5241          */\r
5242         static private function action_plugindelete()\r
5243         {\r
5244                 global $member, $manager;\r
5245                 \r
5246                 // check if allowed\r
5247                 $member->isAdmin() or self::disallow();\r
5248                 \r
5249                 $pid = intGetVar('plugid');\r
5250                 \r
5251                 if ( !$manager->pidInstalled($pid) )\r
5252                 {\r
5253                         self::error(_ERROR_NOSUCHPLUGIN);\r
5254                 }\r
5255                 \r
5256                 self::$skin->parse('plugindelete');\r
5257                 return;\r
5258         }\r
5259 \r
5260         /**\r
5261          * Admin::action_plugindeleteconfirm()\r
5262          * \r
5263          * @param       void\r
5264          * @return      void\r
5265          */\r
5266         static private function action_plugindeleteconfirm()\r
5267         {\r
5268                 global $member, $manager, $CONF;\r
5269                 \r
5270                 // check if allowed\r
5271                 $member->isAdmin() or self::disallow();\r
5272                 \r
5273                 $pid = intPostVar('plugid');\r
5274                 \r
5275                 $error = self::deleteOnePlugin($pid, 1);\r
5276                 if ( $error )\r
5277                 {\r
5278                         self::error($error);\r
5279                 }\r
5280                 \r
5281                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5282                 return;\r
5283         }\r
5284         \r
5285         /**\r
5286          * Admin::\r
5287          * \r
5288          * @param       void\r
5289          * @return      void\r
5290          */\r
5291         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5292         {\r
5293                 global $manager;\r
5294                 \r
5295                 $pid = intval($pid);\r
5296                 \r
5297                 if ( !$manager->pidInstalled($pid) )\r
5298                 {\r
5299                         return _ERROR_NOSUCHPLUGIN;\r
5300                 }\r
5301                 \r
5302                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5303                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5304                 $name = DB::getValue($query);\r
5305                 \r
5306                 // check dependency before delete\r
5307                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5308                 foreach ( $res as $row )\r
5309                 {\r
5310                         $plug =& $manager->getPlugin($row['pfile']);\r
5311                         if ( $plug )\r
5312                         {\r
5313                                 $depList = $plug->getPluginDep();\r
5314                                 foreach ( $depList as $depName )\r
5315                                 {\r
5316                                         if ( $name == $depName )\r
5317                                         {\r
5318                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5319                                         }\r
5320                                 }\r
5321                         }\r
5322                 }\r
5323                 \r
5324                 $data = array('plugid' => $pid);\r
5325                 $manager->notify('PreDeletePlugin', $data);\r
5326                 \r
5327                 // call the unInstall method of the plugin\r
5328                 if ( $callUninstall )\r
5329                 {\r
5330                         $plugin =& $manager->getPlugin($name);\r
5331                         if ( $plugin )\r
5332                         {\r
5333                                 $plugin->unInstall();\r
5334                         }\r
5335                 }\r
5336                 \r
5337                 // delete all subscriptions\r
5338                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5339                 \r
5340                 // delete all options\r
5341                 // get OIDs from plugin_option_desc\r
5342                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5343                 $aOIDs = array();\r
5344                 foreach ( $res as $row )\r
5345                 {\r
5346                         array_push($aOIDs, $row['oid']);\r
5347                 }\r
5348                 \r
5349                 // delete from plugin_option and plugin_option_desc\r
5350                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5351                 if (count($aOIDs) > 0)\r
5352                 {\r
5353                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5354                 }\r
5355                 \r
5356                 // update order numbers\r
5357                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5358                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5359                 \r
5360                 // delete row\r
5361                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5362                 \r
5363                 $manager->clearCachedInfo('installedPlugins');\r
5364                 $data = array('plugid' => $pid);\r
5365                 $manager->notify('PostDeletePlugin', $data);\r
5366                 \r
5367                 return '';\r
5368         }\r
5369         \r
5370         /**\r
5371          * Admin::action_pluginup()\r
5372          * \r
5373          * @param       void\r
5374          * @return      void\r
5375          */\r
5376         static private function action_pluginup()\r
5377         {\r
5378                 global $member, $manager, $CONF;\r
5379                 \r
5380                 // check if allowed\r
5381                 $member->isAdmin() or self::disallow();\r
5382                 \r
5383                 $plugid = intGetVar('plugid');\r
5384                 \r
5385                 if ( !$manager->pidInstalled($plugid) )\r
5386                 {\r
5387                         self::error(_ERROR_NOSUCHPLUGIN);\r
5388                 }\r
5389                 \r
5390                 // 1. get old order number\r
5391                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5392                 \r
5393                 // 2. calculate new order number\r
5394                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5395                 \r
5396                 // 3. update plug numbers\r
5397                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5398                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5399                 \r
5400                 //self::action_pluginlist();\r
5401                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5402                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5403                 return;\r
5404         }\r
5405         \r
5406         /**\r
5407          * Admin::action_plugindown()\r
5408          * \r
5409          * @param       void\r
5410          * @return      void\r
5411          */\r
5412         static private function action_plugindown()\r
5413         {\r
5414                 global $member, $manager, $CONF;\r
5415                 \r
5416                 // check if allowed\r
5417                 $member->isAdmin() or self::disallow();\r
5418                 \r
5419                 $plugid = intGetVar('plugid');\r
5420                 if ( !$manager->pidInstalled($plugid) )\r
5421                 {\r
5422                         self::error(_ERROR_NOSUCHPLUGIN);\r
5423                 }\r
5424                 \r
5425                 // 1. get old order number\r
5426                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5427                 \r
5428                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5429                 $maxOrder = $res->rowCount();\r
5430                 \r
5431                 // 2. calculate new order number\r
5432                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5433                 \r
5434                 // 3. update plug numbers\r
5435                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5436                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5437                 \r
5438                 //self::action_pluginlist();\r
5439                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5440                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5441                 return;\r
5442         }\r
5443         \r
5444         /**\r
5445          * Admin::action_pluginoptions()\r
5446          * \r
5447          * Output Plugin option page\r
5448          * \r
5449          * @access      public\r
5450          * @param       string $message message when fallbacked\r
5451          * @return      void\r
5452          * \r
5453          */\r
5454         static private function action_pluginoptions($message = '')\r
5455         {\r
5456                 global $member, $manager;\r
5457                 \r
5458                 // check if allowed\r
5459                 $member->isAdmin() or self::disallow();\r
5460                 \r
5461                 $pid = intRequestVar('plugid');\r
5462                 if ( !$manager->pidInstalled($pid) )\r
5463                 {\r
5464                         self::error(_ERROR_NOSUCHPLUGIN);\r
5465                 }\r
5466                 \r
5467                 if ( isset($message) )\r
5468                 {\r
5469                         self::$headMess = $message;\r
5470                 }\r
5471                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5472                 \r
5473                 self::$skin->parse('pluginoptions');\r
5474                 return;\r
5475         }\r
5476         \r
5477         /**\r
5478          * Admin::action_pluginoptionsupdate()\r
5479          * \r
5480          * Update plugin options and fallback to plugin option page\r
5481          * \r
5482          * @access      public\r
5483          * @param       void\r
5484          * @return      void\r
5485          */\r
5486         static private function action_pluginoptionsupdate()\r
5487         {\r
5488                 global $member, $manager;\r
5489                 \r
5490                 // check if allowed\r
5491                 $member->isAdmin() or self::disallow();\r
5492                 \r
5493                 $pid = intRequestVar('plugid');\r
5494                 \r
5495                 if ( !$manager->pidInstalled($pid) )\r
5496                 {\r
5497                         self::error(_ERROR_NOSUCHPLUGIN);\r
5498                 }\r
5499                 \r
5500                 $aOptions = requestArray('plugoption');\r
5501                 NucleusPlugin::apply_plugin_options($aOptions);\r
5502                 \r
5503                 $data = array(\r
5504                         'context'       => 'global',\r
5505                         'plugid'        => $pid\r
5506                 );\r
5507                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5508                 \r
5509                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5510                 return;\r
5511         }\r
5512         \r
5513         /**\r
5514          * Admin::insertPluginOptions()\r
5515          * \r
5516          * Output plugin option field\r
5517          * \r
5518          * @access      public\r
5519          * @param string        $context        plugin option context\r
5520          * @param integer       $contextid      plugin option context id\r
5521          * @return      void\r
5522          */\r
5523         static public function insertPluginOptions($context, $contextid = 0)\r
5524         {\r
5525                 global $manager;\r
5526                 \r
5527                 /* get current registered plugin option list in this context even if it's not used */\r
5528                 $query = "SELECT * FROM %s AS plugins, %s AS options LEFT OUTER JOIN %s AS added "\r
5529                        . "ON ( options.oid=added.oid AND options.ocontext=%s  AND added.ocontextid=%d) "\r
5530                        . "WHERE plugins.pid=options.opid "\r
5531                        . "ORDER BY options.oid ASC;";\r
5532                 $query = sprintf($query, sql_table('plugin'), sql_table('plugin_option_desc'), sql_table('plugin_option'), DB::quoteValue($context), DB::quoteValue($contextid));\r
5533                 \r
5534                 $res = DB::getResult($query);\r
5535                 \r
5536                 $options = array();\r
5537                 foreach ( $res as $row )\r
5538                 {\r
5539                         /* NOTE: to include translation file */\r
5540                         $manager->getPlugin($row['pfile']);\r
5541                         \r
5542                         $options[] = array(\r
5543                                 'pid'           => $row['pid'],\r
5544                                 'pfile'         => $row['pfile'],\r
5545                                 'oid'           => $row['oid'],\r
5546                                 'value'         => ( !$row['ovalue'] ) ? $row['odef'] : $row['ovalue'],\r
5547                                 'name'          => $row['oname'],\r
5548                                 'description' => $row['odesc'],\r
5549                                 'type'          => $row['otype'],\r
5550                                 'typeinfo'      => $row['oextra'],\r
5551                                 'contextid'     => $contextid,\r
5552                                 'extra'         => ''\r
5553                         );\r
5554                 }\r
5555                 \r
5556                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$options));\r
5557                 \r
5558                 self::$aOptions = $options;\r
5559                 self::$skin->parse('insertpluginoptions');\r
5560                 return;\r
5561         }\r
5562         \r
5563         /**\r
5564          * Admin::action_parseSpecialskin()\r
5565          * \r
5566          * @param       void\r
5567          * @return      void\r
5568          */\r
5569         static private function action_parseSpecialskin()\r
5570         {\r
5571                 self::$skin->parse(self::$action);\r
5572                 return;\r
5573         }\r
5574         \r
5575         /**\r
5576          * Admin::getAdminskinIDFromName()\r
5577          * \r
5578          * @param       string  $skinname       name of skin\r
5579          * @return      integer ID for skin\r
5580          */\r
5581         static private function getAdminskinIDFromName($skinname)\r
5582         {\r
5583                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5584                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5585                 $admnSknID      = DB::getValue($query);\r
5586                 return (integer) $adminSkinID;\r
5587         }\r
5588         \r
5589         /**\r
5590          * Admin::getAdminskinNameFromID()\r
5591          * \r
5592          * @param       integer $skinid ID for skin\r
5593          * @return      integer ID for skin\r
5594          */\r
5595         static private function getAdminskinNameFromID($skinid)\r
5596         {\r
5597                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5598                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5599                 $admnSknID      = DB::getValue($query);\r
5600                 return (integer) $adminSkinID;\r
5601         }\r
5602         \r
5603         /**\r
5604          * Admin::getAdminextrahead()\r
5605          */\r
5606         static public function getAdminextrahead()\r
5607         {\r
5608                 return self::$extrahead;\r
5609         }\r
5610         \r
5611         /**\r
5612          * Admin::getAdminpassvar()\r
5613          */\r
5614         static public function getAdminpassvar()\r
5615         {\r
5616                 return self::$passvar;\r
5617         }\r
5618         \r
5619         /**\r
5620          * Admin::getAdminAction()\r
5621          */\r
5622         static public function getAdminAction()\r
5623         {\r
5624                 return self::$action;\r
5625         }\r
5626         \r
5627         /**\r
5628          * Admin::getAdminaOption()\r
5629          */\r
5630         static public function getAdminaOption()\r
5631         {\r
5632                 return self::$aOptions;\r
5633         }\r
5634         \r
5635         /**\r
5636          * Admin::action_importAdmin()\r
5637          * \r
5638          * @param       void\r
5639          * @return      void\r
5640          */\r
5641         static private function action_importAdmin()\r
5642         {\r
5643                 global $DIR_ADMINSKINS, $action;\r
5644                 if ( $action == 'adminskinieimport' )\r
5645                 {\r
5646                         self::doAdminskinimport();\r
5647                 }\r
5648                 $skn = array();\r
5649                 if ( $action == 'showlogin' )\r
5650                 {\r
5651                         $skinName = 'showlogin';\r
5652                         $actnName = 'showlogin';\r
5653                 }\r
5654                 else\r
5655                 {\r
5656                         $skinName = 'defaultimporter';\r
5657                         $actnName = 'importAdmin';\r
5658                 }\r
5659                 \r
5660                 /* TODO: why??? */\r
5661                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5662                 $skn['id']                              = 0;\r
5663                 $skn['description']             = $skinName;\r
5664                 $skn['contentType']             = 'importAdmin';\r
5665                 $skn['includeMode']             = 'normal';\r
5666                 $skn['includePrefix']   = '';\r
5667                 $skn['name']                    = 'defaultinporter';\r
5668                 \r
5669                 self::$skin                             = (object) $skn;\r
5670                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5671                 \r
5672                 $parser = new PARSER($handler);\r
5673                 $parser->setSkin(self::$skin);\r
5674                 $parser->parse($contents);\r
5675                 \r
5676                 return;\r
5677         }\r
5678         \r
5679         /**\r
5680          * Admin::doAdminskinimport()\r
5681          * \r
5682          * @param       void\r
5683          * @return      void\r
5684          */\r
5685         static private function doAdminskinimport()\r
5686         {\r
5687                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5688                 \r
5689                 $member->isAdmin() or self::disallow();\r
5690                 \r
5691                 include_once($DIR_LIBS . 'Skinie.php');\r
5692                 $skinFileRaw    = postVar('skinfile');\r
5693                 $mode                   = postVar('mode');\r
5694                 $allowOverwrite = intPostVar('overwrite');\r
5695                 \r
5696                 if ( $mode == 'file' )\r
5697                 {\r
5698                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5699                 }\r
5700                 else\r
5701                 {\r
5702                         $skinFile = $skinFileRaw;\r
5703                 }\r
5704                 \r
5705                 $importer       = new SKINIMPORT();\r
5706                 $error          = $importer->readFile($skinFile);\r
5707                 if ( $error )\r
5708                 {\r
5709                         self::error($error);\r
5710                 }\r
5711                 $error = $importer->writeToDatabase($allowOverwrite);\r
5712                 if ( $error )\r
5713                 {\r
5714                         self::error($error);\r
5715                 }\r
5716                 \r
5717                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5718                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5719                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5720                 \r
5721                 header('Location: ' . $CONF['AdminURL']);\r
5722                 exit;\r
5723         }\r
5724 }\r