nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static private $action;\r
  31         static private $skin;\r
  32         static private $extrahead;\r
  33         static private $passvar;\r
  34         static private $headMess;\r
  35         static private $aOptions;\r
  36         \r
  37         /**\r
  38          * Admin::$edit_actions\r
  39          */\r
  40         static private $edit_actions = array(\r
  41                 'adminskinoverview',\r
  42                 'adminskinieoverview',\r
  43                 'adminskinedittype',\r
  44                 'adminskinremovetype',\r
  45                 'adminskindelete',\r
  46                 'adminskinedit',\r
  47                 'adminskinieimport',\r
  48                 'adminskiniedoimport',\r
  49                 'admintemplateedit',\r
  50                 'admintemplateoverview',\r
  51                 'admintemplatedelete'\r
  52         );\r
  53         \r
  54         /**\r
  55          * Admin::$skinless_actions\r
  56          */\r
  57         static private $skinless_actions = array(\r
  58                 'plugindeleteconfirm',\r
  59                 'pluginoptionsupdate',\r
  60                 'skinremovetypeconfirm',\r
  61                 'skinclone',\r
  62                 'skindeleteconfirm',\r
  63                 'skinnew',\r
  64                 'skineditgeneral',\r
  65                 'skinieexport',\r
  66                 'skinupdate',\r
  67                 'templateupdate',\r
  68                 'templatedeleteconfirm',\r
  69                 'templatenew',\r
  70                 'templateclone',\r
  71                 'adminskinremovetypeconfirm',\r
  72                 'adminskinclone',\r
  73                 'adminskindeleteconfirm',\r
  74                 'adminskinnew',\r
  75                 'adminskineditgeneral',\r
  76                 'adminskinieexport',\r
  77                 'adminskinupdate',\r
  78                 'admintemplateupdate',\r
  79                 'admintemplatedeleteconfirm',\r
  80                 'admintemplatenew',\r
  81                 'admintemplateclone',\r
  82                 'blogsettingsupdate',\r
  83                 'settingsupdate',\r
  84                 'addnewlog2',\r
  85                 'additem',\r
  86                 'itemdeleteconfirm',\r
  87                 'itemupdate',\r
  88                 'changemembersettings',\r
  89                 'clearactionlog',\r
  90                 'memberedit'\r
  91         );\r
  92         \r
  93         static private $actions_needless_to_check = array(\r
  94                 'showlogin',\r
  95                 'login',\r
  96                 'overview',\r
  97                 'itemlist',\r
  98                 'blogcommentlist',\r
  99                 'bookmarklet',\r
 100                 'blogsettings',\r
 101                 'banlist',\r
 102                 'deleteblog',\r
 103                 'editmembersettings',\r
 104                 'browseownitems',\r
 105                 'browseowncomments',\r
 106                 'createitem',\r
 107                 'itemedit',\r
 108                 'itemmove',\r
 109                 'categoryedit',\r
 110                 'categorydelete',\r
 111                 'manage',\r
 112                 'actionlog',\r
 113                 'settingsedit',\r
 114                 'backupoverview',\r
 115                 'pluginlist',\r
 116                 'createnewlog',\r
 117                 'usermanagement',\r
 118                 'skinoverview',\r
 119                 'templateoverview',\r
 120                 'skinieoverview',\r
 121                 'itemcommentlist',\r
 122                 'commentedit',\r
 123                 'commentdelete',\r
 124                 'banlistnewfromitem',\r
 125                 'banlistdelete',\r
 126                 'itemdelete',\r
 127                 'manageteam',\r
 128                 'teamdelete',\r
 129                 'banlistnew',\r
 130                 'memberedit',\r
 131                 'memberdelete',\r
 132                 'pluginhelp',\r
 133                 'pluginoptions',\r
 134                 'plugindelete',\r
 135                 'skinedittype',\r
 136                 'skinremovetype',\r
 137                 'skindelete',\r
 138                 'skinedit',\r
 139                 'templateedit',\r
 140                 'templatedelete',\r
 141                 'activate',\r
 142                 'systemoverview',\r
 143                 'activatesetpwd',\r
 144         );\r
 145         \r
 146         static public function initialize()\r
 147         {\r
 148                 global $CONF, $DIR_LIBS;\r
 149                 \r
 150                 /* NOTE: 1. decide which skinid to use */\r
 151                 $skinid = $CONF['DefaultAdminSkin'];\r
 152                 /*\r
 153                  * NOTE: this is temporary escaped because not implemented yet\r
 154                 if (isset($member) && $member->isLoggedIn())\r
 155                 {\r
 156                         $memskin = $member->getAdminSkin();\r
 157                         if ( $memskin )\r
 158                         {\r
 159                                 $skinid = $memskin;\r
 160                         }\r
 161                 }\r
 162                 */\r
 163                 \r
 164                 /* NOTE: 2. make an instance of skin object */\r
 165                 if ( !Skin::existsID($skinid) )\r
 166                 {\r
 167                         return FALSE;\r
 168                 }\r
 169                 \r
 170                 /* NOTE: 3. initializing each members */\r
 171                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 172                 self::$action           = '';\r
 173                 self::$extrahead        = '';\r
 174                 self::$passvar          = '';\r
 175                 self::$headMess         = '';\r
 176                 self::$aOptions         = '';\r
 177                 return TRUE;\r
 178         }\r
 179         \r
 180         /**\r
 181          * Admin::action()\r
 182          * Executes an action\r
 183          *\r
 184          * @param       string  $action action to be performed\r
 185          * @return      void\r
 186          */\r
 187         static public function action($action)\r
 188         {\r
 189                 global $CONF, $DIR_LIBS, $manager, $member;\r
 190                 \r
 191                 /* 1. decide action name */\r
 192                 $customAction = postvar('customaction');\r
 193                 if ( !empty($customAction) )\r
 194                 {\r
 195                         $alias = array(\r
 196                                 'login' => $customAction,\r
 197                                 ''              => $customAction\r
 198                         );\r
 199                 }\r
 200                 else\r
 201                 {\r
 202                         $alias = array(\r
 203                                 'login' => 'overview',\r
 204                                 ''              => 'overview'\r
 205                         );\r
 206                 }\r
 207                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 208                 {\r
 209                         $action = $alias[$action];\r
 210                 }\r
 211                 $methodName = "action_{$action}";\r
 212                 self::$action = strtolower($action);\r
 213                 \r
 214                 /* 2. check the action */\r
 215                 $synonimActions = array(\r
 216                         'banlistnewfromitem',\r
 217                         'memberedit',\r
 218                         'login',\r
 219                 );\r
 220                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 221                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 222                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 223                 {\r
 224                         if (!$manager->checkTicket())\r
 225                         {\r
 226                                 self::error(_ERROR_BADTICKET);\r
 227                         }\r
 228                 }\r
 229 \r
 230                 /* 3. parse according to the action */\r
 231                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 232                 {\r
 233                         /* TODO: what is this?\r
 234                         self::action_parseSpecialskin();\r
 235                         */\r
 236                 }\r
 237                 elseif ( method_exists('Admin', $methodName) )\r
 238                 {\r
 239                         call_user_func(array(self, $methodName));\r
 240                 }\r
 241                 else if ( self::existsSkinContents('adminerrorpage') )\r
 242                 {\r
 243                         self::error(_BADACTION . ENTITY::hsc($action));\r
 244                 }\r
 245                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 246                 {\r
 247                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 248                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 249                         {\r
 250                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 251                         }\r
 252                 }\r
 253                 else\r
 254                 {\r
 255                         self::error(_BADACTION . ENTITY::hsc($action));\r
 256                 }\r
 257                 exit;\r
 258         }\r
 259         \r
 260         /**\r
 261          * Action::existsSkinContents()\r
 262          * Check skin contents\r
 263          *\r
 264          * @param       string  $action action type\r
 265          * @return      boolean\r
 266          */\r
 267         static private function existsSkinContents($action)\r
 268         {\r
 269                 $in_array  = in_array($action, self::$skinless_actions);\r
 270                 \r
 271                 if ( $in_array )\r
 272                 {\r
 273                         return $in_array;\r
 274                 }\r
 275                 else\r
 276                 {\r
 277                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 278                         /* TODO: skinid should be a default */\r
 279                         if ( !is_object(self::$skin) )\r
 280                         {\r
 281                                 global $CONF;\r
 282                                 return quickQuery(sprintf($query, sql_table('skin'), $CONF['DefaultAdminSkin'], sql_real_escape_string($action)));\r
 283                         }\r
 284                         else\r
 285                         {\r
 286                                 return quickQuery(sprintf($query, sql_table('skin'), self::$skin->getID(), sql_real_escape_string($action)));\r
 287                         }\r
 288                 }\r
 289                 return;\r
 290         }\r
 291         \r
 292         /**\r
 293          * Action::specialActionsAllow()\r
 294          * Check exists specialskinparts\r
 295          *\r
 296          * @param       string  $action action type\r
 297          * @return boolean\r
 298          */\r
 299         static private function specialActionsAllow($action)\r
 300         {\r
 301                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 302                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 303                 return quickQuery($query);\r
 304         }\r
 305         \r
 306         /**\r
 307          * Action::action_showlogin()\r
 308          * \r
 309          * @param       void\r
 310          * @return      void\r
 311          */\r
 312         static private function action_showlogin()\r
 313         {\r
 314                 global $error;\r
 315                 self::action_login($error);\r
 316                 return;\r
 317         }\r
 318         \r
 319         /**\r
 320          * Action::action_login()\r
 321          * \r
 322          * @param       string  $msg            message for pageheader\r
 323          * @param       integer $passvars       ???\r
 324          */\r
 325         static private function action_login($msg = '', $passvars = 1)\r
 326         {\r
 327                 global $member;\r
 328                 \r
 329                 // skip to overview when allowed\r
 330                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 331                 {\r
 332                         self::$action_overview();\r
 333                         exit;\r
 334                 }\r
 335                 \r
 336                 /* TODO: needless variable??? */\r
 337                 self::$passvar = $passvars;\r
 338                 if ( $msg )\r
 339                 {\r
 340                         self::$headMess = $msg;\r
 341                 }\r
 342                 \r
 343                 self::pagehead();\r
 344                 self::$skin->parse('showlogin');\r
 345                 self::pagefoot();\r
 346         }\r
 347         \r
 348         /**\r
 349          * Action::action_overview()\r
 350          * provides a screen with the overview of the actions available\r
 351          * \r
 352          * @param       string  $msg    message for pageheader\r
 353          * @return      void\r
 354          */\r
 355         static private function action_overview($msg = '')\r
 356         {\r
 357                 if ( $msg )\r
 358                 {\r
 359                         self::$headMess = $msg;\r
 360                 }\r
 361                 \r
 362                 self::pagehead();\r
 363                 self::$skin->parse('overview');\r
 364                 self::pagefoot();\r
 365                 return;\r
 366         }\r
 367         \r
 368         /**\r
 369          * Admin::action_manage()\r
 370          * \r
 371          * @param       string  $msg    message for pageheader\r
 372          * @retrn       void\r
 373          */\r
 374         static private function action_manage($msg = '')\r
 375         {\r
 376                 global $member;\r
 377                 \r
 378                 if ( $msg )\r
 379                 {\r
 380                         self::$headMess = $msg;\r
 381                 }\r
 382                 $member->isAdmin() or self::disallow();\r
 383                 \r
 384                 self::pagehead();\r
 385                 self::$skin->parse('manage');\r
 386                 self::pagefoot();\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::pagehead();\r
 408                 self::$skin->parse('itemlist');\r
 409                 self::pagefoot();\r
 410                 return;\r
 411         }\r
 412         \r
 413         /**\r
 414          * Action::action_batchitem()\r
 415          * \r
 416          * @param       void\r
 417          * @return      void\r
 418          */\r
 419         static private function action_batchitem()\r
 420         {\r
 421                 global $member, $manager;\r
 422                 \r
 423                 $member->isLoggedIn() or self::disallow();\r
 424                 \r
 425                 $selected       = requestIntArray('batch');\r
 426                 $action         = requestVar('batchaction');\r
 427                 \r
 428                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 429                 {\r
 430                         self::error(_BATCH_NOSELECTION);\r
 431                 }\r
 432                 \r
 433                 // On move: when no destination blog/category chosen, show choice now\r
 434                 $destCatid = intRequestVar('destcatid');\r
 435                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 436                 {\r
 437                         self::batchMoveSelectDestination('item', $selected);\r
 438                 }\r
 439                 \r
 440                 // On delete: check if confirmation has been given\r
 441                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 442                 {\r
 443                         self::batchAskDeleteConfirmation('item', $selected);\r
 444                 }\r
 445                 \r
 446                 self::pagehead();\r
 447                 self::$skin->parse('batchitem');\r
 448                 self::pagefoot();\r
 449                 return;\r
 450         }\r
 451         \r
 452         /**\r
 453          * Action::action_batchcomment()\r
 454          * \r
 455          * @param       void\r
 456          * @return      void\r
 457          */\r
 458         static private function action_batchcomment()\r
 459         {\r
 460                 global $member;\r
 461                 \r
 462                 $member->isLoggedIn() or self::disallow();\r
 463                 \r
 464                 $selected       = requestIntArray('batch');\r
 465                 $action         = requestVar('batchaction');\r
 466                 \r
 467                 // Show error when no items were selected\r
 468                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 469                 {\r
 470                         self::error(_BATCH_NOSELECTION);\r
 471                 }\r
 472                 \r
 473                 // On delete: check if confirmation has been given\r
 474                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 475                 {\r
 476                         self::batchAskDeleteConfirmation('comment',$selected);\r
 477                 }\r
 478                 \r
 479                 self::pagehead();\r
 480                 self::$skin->parse('batchcomment');\r
 481                 self::pagefoot();\r
 482                 return;\r
 483         }\r
 484         \r
 485         /**\r
 486          * Admin::action_batchmember()\r
 487          * \r
 488          * @param       void\r
 489          * @return      void\r
 490          */\r
 491         static private function action_batchmember()\r
 492         {\r
 493                 global $member;\r
 494                 \r
 495                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 496                 \r
 497                 $selected       = requestIntArray('batch');\r
 498                 $action         = requestVar('batchaction');\r
 499                 \r
 500                 // Show error when no members selected\r
 501                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 502                 {\r
 503                         self::error(_BATCH_NOSELECTION);\r
 504                 }\r
 505                 \r
 506                 // On delete: check if confirmation has been given\r
 507                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 508                 {\r
 509                         self::batchAskDeleteConfirmation('member',$selected);\r
 510                 }\r
 511                 \r
 512                 self::pagehead();\r
 513                 self::$skin->parse('batchmember');\r
 514                 self::pagefoot();\r
 515                 return;\r
 516         }\r
 517         \r
 518         /**\r
 519          * Admin::action_batchteam()\r
 520          * \r
 521          * @param       void\r
 522          * @return      void\r
 523          */\r
 524         static private function action_batchteam()\r
 525         {\r
 526                 global $member;\r
 527                 \r
 528                 $blogid = intRequestVar('blogid');\r
 529                 \r
 530                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 531                 \r
 532                 $selected       = requestIntArray('batch');\r
 533                 $action         = requestVar('batchaction');\r
 534                 \r
 535                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 536                 {\r
 537                         self::error(_BATCH_NOSELECTION);\r
 538                 }\r
 539                 \r
 540                 // On delete: check if confirmation has been given\r
 541                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 542                 {\r
 543                         self::batchAskDeleteConfirmation('team',$selected);\r
 544                 }\r
 545                 \r
 546                 self::pagehead();\r
 547                 self::$skin->parse('batchteam');\r
 548                 self::pagefoot();\r
 549                 return;\r
 550         }\r
 551         \r
 552         /**\r
 553          * Admin::action_batchcategory()\r
 554          * \r
 555          * @param       void\r
 556          * @return      void\r
 557          */\r
 558         static private function action_batchcategory()\r
 559         {\r
 560                 global $member, $manager;\r
 561                 \r
 562                 $member->isLoggedIn() or self::disallow();\r
 563                 \r
 564                 $selected       = requestIntArray('batch');\r
 565                 $action         = requestVar('batchaction');\r
 566                 \r
 567                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 568                 {\r
 569                         self::error(_BATCH_NOSELECTION);\r
 570                 }\r
 571                 \r
 572                 // On move: when no destination blog chosen, show choice now\r
 573                 $destBlogId = intRequestVar('destblogid');\r
 574                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 575                 {\r
 576                         self::batchMoveCategorySelectDestination('category', $selected);\r
 577                 }\r
 578                 \r
 579                 // On delete: check if confirmation has been given\r
 580                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 581                 {\r
 582                         self::batchAskDeleteConfirmation('category', $selected);\r
 583                 }\r
 584                 \r
 585                 self::pagehead();\r
 586                 self::$skin->parse('batchcategory');\r
 587                 self::pagefoot();\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::pagehead();\r
 604                 self::$skin->parse('batchmove');\r
 605                 self::pagefoot();\r
 606                 return;\r
 607         }\r
 608         \r
 609         /**\r
 610          * Admin::batchMoveCategorySelectDestination()\r
 611          * \r
 612          * @param       string  $type   type of batch action\r
 613          * @param       integer $ids    needless???\r
 614          * @return      void\r
 615          * \r
 616          * TODO: remove needless argument\r
 617          */\r
 618         static private function batchMoveCategorySelectDestination($type, $ids)\r
 619         {\r
 620                 $_POST['batchmove'] = $type;\r
 621                 global $manager;\r
 622                 self::pagehead();\r
 623                 self::$skin->parse('batchmovecat');\r
 624                 self::pagefoot();\r
 625                 return;\r
 626         }\r
 627         \r
 628         /**\r
 629          * Admin::batchAskDeleteConfirmation()\r
 630          * \r
 631          * @param       string  $type   type of batch action\r
 632          * @param       integer $ids    needless???\r
 633          * @return      void\r
 634          * \r
 635          * TODO: remove needless argument\r
 636          */\r
 637         static private function batchAskDeleteConfirmation($type, $ids)\r
 638         {\r
 639                 self::pagehead();\r
 640                 self::$skin->parse('batchdelete');\r
 641                 self::pagefoot();\r
 642                 return;\r
 643         }\r
 644         \r
 645         /**\r
 646          * Admin::selectBlogCategory()\r
 647          * Inserts a HTML select element with choices for all categories to which the current\r
 648          * member has access\r
 649          *\r
 650          * @see function selectBlog\r
 651          * @param       string  $name                           name of weblod\r
 652          * @param       integer $selected                       \r
 653          * @param       integer $tabindex                       \r
 654          * @param       integer $showNewCat                     \r
 655          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 656          * @return      void\r
 657          *\r
 658          * NOTE: callback from AdminAction\r
 659          */\r
 660         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 661         {\r
 662                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 663                 return;\r
 664         }\r
 665         \r
 666         /**\r
 667          * Admin::selectBlog()\r
 668          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 669          *      mode = 'blog' => shows blognames and values are blogids\r
 670          *      mode = 'category' => show category names and values are catids\r
 671          *\r
 672          * @param       string  $name                           name of weblod\r
 673          * @param       string  $mode                           \r
 674          * @param       integer $selected                       \r
 675          * @param       integer $tabindex                       \r
 676          * @param       integer $showNewCat                     \r
 677          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 678          * @param $iForcedBlogInclude\r
 679          *      ID of a blog that always needs to be included, without checking if the\r
 680          *      member is on the blog team (-1 = none)\r
 681          * @return      void\r
 682          */\r
 683         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 684         {\r
 685                 global $member, $CONF;\r
 686                 \r
 687                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 688                 $aBlogIds = array();\r
 689                 if ( $iForcedBlogInclude != -1 )\r
 690                 {\r
 691                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 692                 }\r
 693                 \r
 694                 if ( ($member->isAdmin()) && ($CONF['ShowAllBlogs']) )\r
 695                 {\r
 696                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 697                         $query = sprintf($query, sql_table('blog'));\r
 698                 }\r
 699                 else\r
 700                 {\r
 701                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 702                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 703                 }\r
 704                 \r
 705                 $rblogids = sql_query($query);\r
 706                 while ($o = sql_fetch_object($rblogids))\r
 707                 {\r
 708                         if ( $o->bnumber != $iForcedBlogInclude )\r
 709                         {\r
 710                                 $aBlogIds[] = intval($o->bnumber);\r
 711                         }\r
 712                 }\r
 713                 \r
 714                 if ( count($aBlogIds) == 0 )\r
 715                 {\r
 716                         return;\r
 717                 }\r
 718                 \r
 719                 /* TODO: we should consider to use the other way instead of this */\r
 720                 $_REQUEST['selectData'] = array(\r
 721                         'name'                  => $name,\r
 722                         'tabindex'              => $tabindex,\r
 723                         'mode'                  => $mode,\r
 724                         'selected'              => $selected,\r
 725                         'showNewCat'    => $showNewCat,\r
 726                         'aBlogIds'              => $aBlogIds,\r
 727                 );\r
 728                 self::$skin->parse('blogselectbox');\r
 729                 return;\r
 730         }\r
 731         \r
 732         /**\r
 733          * Admin::action_browseownitems()\r
 734          * \r
 735          * @param       void\r
 736          * @return      void\r
 737          */\r
 738         static private function action_browseownitems()\r
 739         {\r
 740                 global $member, $manager, $CONF;\r
 741                 \r
 742                 self::pagehead();\r
 743                 self::$skin->parse('browseownitems');\r
 744                 self::pagefoot();\r
 745                 return;\r
 746         }\r
 747         \r
 748         /**\r
 749          * Admin::action_itemcommentlist()\r
 750          * Show all the comments for a given item\r
 751          * \r
 752          * @param       integer $itemid ID for item\r
 753          * @return      void\r
 754          */\r
 755         static private function action_itemcommentlist($itemid = '')\r
 756         {\r
 757                 global $member, $manager, $CONF;\r
 758                 \r
 759                 if ( $itemid == '' )\r
 760                 {\r
 761                         $itemid = intRequestVar('itemid');\r
 762                 }\r
 763                 \r
 764                 /* TODO: we consider to use the other way insterad of this */\r
 765                 $_REQUEST['itemid'] = $itemid;\r
 766                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 767                 \r
 768                 // only allow if user is allowed to alter item\r
 769                 $member->canAlterItem($itemid) or self::disallow();\r
 770                 \r
 771                 $blogid = getBlogIdFromItemId($itemid);\r
 772                 \r
 773                 self::pagehead();\r
 774                 self::$skin->parse('itemcommentlist');\r
 775                 self::pagefoot();\r
 776                 return;\r
 777         }\r
 778         \r
 779         /**\r
 780          * Admin::action_browseowncomments()\r
 781          * Browse own comments\r
 782          * \r
 783          * @param       void\r
 784          * @return      void\r
 785          */\r
 786         static private function action_browseowncomments()\r
 787         {\r
 788                 self::pagehead();\r
 789                 self::$skin->parse('browseowncomments');\r
 790                 self::pagefoot();\r
 791                 return;\r
 792         }\r
 793         \r
 794         /**\r
 795          * Admin::action_blogcommentlist()\r
 796          * Browse all comments for a weblog\r
 797          * \r
 798          * @param       integer $blogid ID for weblog\r
 799          * @return      void\r
 800          */\r
 801         static private function action_blogcommentlist($blogid = '')\r
 802         {\r
 803                 global $member, $manager, $CONF;\r
 804                 \r
 805                 if ( $blogid == '' )\r
 806                 {\r
 807                         $blogid = intRequestVar('blogid');\r
 808                 }\r
 809                 else\r
 810                 {\r
 811                         $blogid = intval($blogid);\r
 812                 }\r
 813                 \r
 814                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 815                 \r
 816                 /* TODO: we consider to use the other way insterad of this */\r
 817                 $_REQUEST['blogid'] = $blogid;\r
 818                 \r
 819                 self::pagehead();\r
 820                 self::$skin->parse('blogcommentlist');\r
 821                 self::pagefoot();\r
 822                 return;\r
 823         }\r
 824         \r
 825         /**\r
 826          * Admin::action_createitem()\r
 827          * Provide a page to item a new item to the given blog\r
 828          * \r
 829          * @param       void\r
 830          * @return      void\r
 831          */\r
 832         static private function action_createitem()\r
 833         {\r
 834                 global $member, $manager;\r
 835                 \r
 836                 $blogid = intRequestVar('blogid');\r
 837                 \r
 838                 // check if allowed\r
 839                 $member->teamRights($blogid) or self::disallow();\r
 840                 \r
 841                 $memberid = $member->getID();\r
 842                 \r
 843                 $blog =& $manager->getBlog($blogid);\r
 844                 \r
 845                 self::pagehead();\r
 846                 self::$skin->parse('createitem');\r
 847                 self::pagefoot();\r
 848                 return;\r
 849         }\r
 850         \r
 851         /**\r
 852          * Admin::action_itemedit()\r
 853          * \r
 854          * @param       void\r
 855          * @return      void\r
 856          */\r
 857         static private function action_itemedit()\r
 858         {\r
 859                 global $member, $manager;\r
 860                 \r
 861                 $itemid = intRequestVar('itemid');\r
 862                 \r
 863                 // only allow if user is allowed to alter item\r
 864                 $member->canAlterItem($itemid) or self::disallow();\r
 865                 \r
 866                 $itemid = intRequestVar('itemid');\r
 867                 $blogid = getBlogIDFromItemID($itemid);\r
 868                 $item   =& $manager->getItem($itemid, 1, 1);\r
 869                 $manager->notify(\r
 870                                 'PrepareItemForEdit',\r
 871                                 array(\r
 872                                                 'item' => &$item\r
 873                                 )\r
 874                 );\r
 875                 \r
 876                 self::pagehead();\r
 877                 self::$skin->parse('itemedit');\r
 878                 self::pagefoot();\r
 879                 return;\r
 880         }\r
 881         \r
 882         /**\r
 883          * Admin::action_itemupdate()\r
 884          * \r
 885          * @param       void\r
 886          * @return      void\r
 887          */\r
 888         static private function action_itemupdate()\r
 889         {\r
 890                 global $member, $manager, $CONF;\r
 891                 \r
 892                 $itemid = intRequestVar('itemid');\r
 893                 $catid  = postVar('catid');\r
 894                 \r
 895                 // only allow if user is allowed to alter item\r
 896                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 897                 \r
 898                 $actiontype = postVar('actiontype');\r
 899                 \r
 900                 // delete actions are handled by itemdelete (which has confirmation)\r
 901                 if ( $actiontype == 'delete' )\r
 902                 {\r
 903                         self::$action_itemdelete();\r
 904                         return;\r
 905                 }\r
 906                 \r
 907                 $body           = postVar('body');\r
 908                 $title          = postVar('title');\r
 909                 $more           = postVar('more');\r
 910                 $closed         = intPostVar('closed');\r
 911                 $draftid        = intPostVar('draftid');\r
 912                 \r
 913                 // default action = add now\r
 914                 if ( !$actiontype )\r
 915                 {\r
 916                         $actiontype='addnow';\r
 917                 }\r
 918                 \r
 919                 // create new category if needed\r
 920                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 921                 {\r
 922                         // get blogid\r
 923                         list($blogid) = sscanf($catid,"newcat-%d");\r
 924                         \r
 925                         // create\r
 926                         $blog =& $manager->getBlog($blogid);\r
 927                         $catid = $blog->createNewCategory();\r
 928                         \r
 929                         // show error when sth goes wrong\r
 930                         if ( !$catid )\r
 931                         {\r
 932                                 self::doError(_ERROR_CATCREATEFAIL);\r
 933                         }\r
 934                 }\r
 935                 \r
 936                 /*\r
 937                         set some variables based on actiontype\r
 938 \r
 939                         actiontypes:\r
 940                                 draft items -> addnow, addfuture, adddraft, delete\r
 941                                 non-draft items -> edit, changedate, delete\r
 942 \r
 943                         variables set:\r
 944                                 $timestamp: set to a nonzero value for future dates or date changes\r
 945                                 $wasdraft: set to 1 when the item used to be a draft item\r
 946                                 $publish: set to 1 when the edited item is not a draft\r
 947          */\r
 948                 $blogid =  getBlogIDFromItemID($itemid);\r
 949                 $blog   =& $manager->getBlog($blogid);\r
 950                 \r
 951                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 952                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 953                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 954                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 955                 {\r
 956                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 957                 }\r
 958                 else\r
 959                 {\r
 960                         $timestamp =0;\r
 961                 }\r
 962                 \r
 963                 // edit the item for real\r
 964                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 965                 \r
 966                 self::updateFuturePosted($blogid);\r
 967                 \r
 968                 if ( $draftid > 0 )\r
 969                 {\r
 970                         // delete permission is checked inside Item::delete()\r
 971                         Item::delete($draftid);\r
 972                 }\r
 973                 \r
 974                 if ( $catid != intPostVar('catid') )\r
 975                 {\r
 976                         self::$action_categoryedit(\r
 977                                 $catid,\r
 978                                 $blog->getID(),\r
 979                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 980                         );\r
 981                 }\r
 982                 else\r
 983                 {\r
 984                         // TODO: set start item correctly for itemlist\r
 985                         $item = Item::getItem($itemid, 0, 0);\r
 986                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 987                         $_REQUEST['start'] = $cnt + 1;\r
 988                         self::$action_itemlist(getBlogIDFromItemID($itemid));\r
 989                 }\r
 990                 return;\r
 991         }\r
 992         \r
 993         /**\r
 994          * Admin::action_itemdelete()\r
 995          * Delete item\r
 996          * \r
 997          * @param       Void\r
 998          * @return      Void\r
 999          */\r
1000         static private function action_itemdelete()\r
1001         {\r
1002                 global $member, $manager;\r
1003                 \r
1004                 $itemid = intRequestVar('itemid');\r
1005                 \r
1006                 // only allow if user is allowed to alter item\r
1007                 $member->canAlterItem($itemid) or self::disallow();\r
1008                 \r
1009                 if ( !$manager->existsItem($itemid,1,1) )\r
1010                 {\r
1011                         self::error(_ERROR_NOSUCHITEM);\r
1012                 }\r
1013                 \r
1014                 self::pagehead();\r
1015                 self::$skin->parse('itemdelete');\r
1016                 self::pagefoot();\r
1017                 return;\r
1018         }\r
1019         \r
1020         /**\r
1021          * Admin::action_itemdeleteconfirm()\r
1022          * \r
1023          * @param       void\r
1024          * @return      void\r
1025          */\r
1026         static private function action_itemdeleteconfirm()\r
1027         {\r
1028                 global $member;\r
1029                 \r
1030                 $itemid = intRequestVar('itemid');\r
1031                 \r
1032                 // only allow if user is allowed to alter item\r
1033                 $member->canAlterItem($itemid) or self::disallow();\r
1034                 \r
1035                 // get blogid first\r
1036                 $blogid = getBlogIdFromItemId($itemid);\r
1037                 \r
1038                 // delete item (note: some checks will be performed twice)\r
1039                 self::deleteOneItem($itemid);\r
1040                 \r
1041                 self::$action_itemlist($blogid);\r
1042                 return;\r
1043         }\r
1044         \r
1045         /**\r
1046          * Admin::deleteOneItem()\r
1047          * Deletes one item and returns error if something goes wrong\r
1048          * \r
1049          * @param       integer $itemid ID for item\r
1050          * @return      void\r
1051          */\r
1052         static private function deleteOneItem($itemid)\r
1053         {\r
1054                 global $member, $manager;\r
1055                 \r
1056                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1057                 if ( !$member->canAlterItem($itemid) )\r
1058                 {\r
1059                         return _ERROR_DISALLOWED;\r
1060                 }\r
1061                 \r
1062                 // need to get blogid before the item is deleted\r
1063                 $blogid = getBlogIDFromItemId($itemid);\r
1064                 \r
1065                 $manager->loadClass('ITEM');\r
1066                 Item::delete($itemid);\r
1067                 \r
1068                 // update blog's futureposted\r
1069                 self::updateFuturePosted($blogid);\r
1070                 return;\r
1071         }\r
1072         \r
1073         /**\r
1074          * Admin::updateFuturePosted()\r
1075          * Update a blog's future posted flag\r
1076          * \r
1077          * @param integer $blogid\r
1078          * @return      void\r
1079          */\r
1080         static private function updateFuturePosted($blogid)\r
1081         {\r
1082                 global $manager;\r
1083                 \r
1084                 $blogid                 =  intval($blogid);\r
1085                 $blog                   =& $manager->getBlog($blogid);\r
1086                 $currenttime    =  $blog->getCorrectTime(time());\r
1087                 \r
1088                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1089                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1090                 $result = sql_query($query);\r
1091                 \r
1092                 if ( sql_num_rows($result) > 0 )\r
1093                 {\r
1094                                 $blog->setFuturePost();\r
1095                 }\r
1096                 else\r
1097                 {\r
1098                                 $blog->clearFuturePost();\r
1099                 }\r
1100                 return;\r
1101         }\r
1102 \r
1103         /**\r
1104          * Admin::action_itemmove()\r
1105          * \r
1106          * @param       void\r
1107          * @return      void\r
1108          */\r
1109         static private function action_itemmove()\r
1110         {\r
1111                 global $member, $manager;\r
1112                 \r
1113                 $itemid = intRequestVar('itemid');\r
1114                 \r
1115                 $member->canAlterItem($itemid) or self::disallow();\r
1116                 \r
1117                 self::pagehead();\r
1118                 self::$skin->parse('itemmove');\r
1119                 self::pagefoot();\r
1120                 return;\r
1121         }\r
1122         \r
1123         /**\r
1124          * Admin::action_itemmoveto()\r
1125          * \r
1126          * @param       void\r
1127          * @return      void\r
1128          */\r
1129         static private function action_itemmoveto()\r
1130         {\r
1131                 global $member, $manager;\r
1132                 \r
1133                 $itemid = intRequestVar('itemid');\r
1134                 $catid = requestVar('catid');\r
1135                 \r
1136                 // create new category if needed\r
1137                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1138                 {\r
1139                         // get blogid\r
1140                         list($blogid) = sscanf($catid,'newcat-%d');\r
1141                         \r
1142                         // create\r
1143                         $blog =& $manager->getBlog($blogid);\r
1144                         $catid = $blog->createNewCategory();\r
1145                         \r
1146                         // show error when sth goes wrong\r
1147                         if ( !$catid )\r
1148                         {\r
1149                                 self::doError(_ERROR_CATCREATEFAIL);\r
1150                         }\r
1151                 }\r
1152                 \r
1153                 // only allow if user is allowed to alter item\r
1154                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1155                 \r
1156                 $old_blogid = getBlogIDFromItemId($itemid);\r
1157                 \r
1158                 Item::move($itemid, $catid);\r
1159                 \r
1160                 // set the futurePosted flag on the blog\r
1161                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1162                 \r
1163                 // reset the futurePosted in case the item is moved from one blog to another\r
1164                 self::updateFuturePosted($old_blogid);\r
1165                 \r
1166                 if ( $catid != intRequestVar('catid') )\r
1167                 {\r
1168                         self::$action_categoryedit($catid, $blog->getID());\r
1169                 }\r
1170                 else\r
1171                 {\r
1172                         self::$action_itemlist(getBlogIDFromCatID($catid));\r
1173                 }\r
1174                 return;\r
1175         }\r
1176         \r
1177         /**\r
1178          * Admin::moveOneItem()\r
1179          * Moves one item to a given category (category existance should be checked by caller)\r
1180          * errors are returned\r
1181          * \r
1182          * @param       integer $itemid         ID for item\r
1183          * @param       integer $destCatid      ID for category to which the item will be moved\r
1184          * @return      void\r
1185          */\r
1186         static private function moveOneItem($itemid, $destCatid)\r
1187         {\r
1188                 global $member;\r
1189                 \r
1190                 // only allow if user is allowed to move item\r
1191                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1192                 {\r
1193                         return _ERROR_DISALLOWED;\r
1194                 }\r
1195                 \r
1196                 Item::move($itemid, $destCatid);\r
1197                 return;\r
1198         }\r
1199         \r
1200         /**\r
1201          * Admin::action_additem()\r
1202          * Adds a item to the chosen blog\r
1203          * \r
1204          * @param       void\r
1205          * @return      void\r
1206          */\r
1207         static private function action_additem()\r
1208         {\r
1209                 global $manager, $CONF;\r
1210                 \r
1211                 $manager->loadClass('ITEM');\r
1212                 \r
1213                 $result = Item::createFromRequest();\r
1214                 \r
1215                 if ( $result['status'] == 'error' )\r
1216                 {\r
1217                         self::error($result['message']);\r
1218                 }\r
1219                 \r
1220                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1221                 $blog           =& $manager->getBlog($blogid);\r
1222                 $btimestamp     =  $blog->getCorrectTime();\r
1223                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1224                 \r
1225                 if ( $result['status'] == 'newcategory' )\r
1226                 {\r
1227                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1228                         self::$action_categoryedit($result['catid'], $blogid, $distURI);\r
1229                 }\r
1230                 else\r
1231                 {\r
1232                         $methodName = 'action_itemList';\r
1233                         call_user_func(array(&$this, $methodName), $blogid);\r
1234                 }\r
1235                 return;\r
1236         }\r
1237         \r
1238         /**\r
1239          * Admin::action_commentedit()\r
1240          * Allows to edit previously made comments\r
1241          * \r
1242          * @param       void\r
1243          * @return      void\r
1244          */\r
1245         static private function action_commentedit()\r
1246         {\r
1247                 global $member, $manager;\r
1248                 \r
1249                 $commentid = intRequestVar('commentid');\r
1250                 \r
1251                 $member->canAlterComment($commentid) or self::disallow();\r
1252                 \r
1253                 self::pagehead();\r
1254                 self::$skin->parse('commentedit');\r
1255                 self::pagefoot();\r
1256                 return;\r
1257         }\r
1258         \r
1259         /**\r
1260          * Admin::action_commentupdate()\r
1261          * \r
1262          * @param       void\r
1263          * @return      void\r
1264          */\r
1265         static private function action_commentupdate()\r
1266         {\r
1267                 global $member, $manager;\r
1268                 \r
1269                 $commentid = intRequestVar('commentid');\r
1270                 \r
1271                 $member->canAlterComment($commentid) or self::disallow();\r
1272                 \r
1273                 $url    = postVar('url');\r
1274                 $email  = postVar('email');\r
1275                 $body   = postVar('body');\r
1276                 \r
1277                 // intercept words that are too long\r
1278                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1279                 {\r
1280                         self::error(_ERROR_COMMENT_LONGWORD);\r
1281                 }\r
1282                 \r
1283                 // check length\r
1284                 if ( i18n::strlen($body) < 3 )\r
1285                 {\r
1286                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1287                 }\r
1288                 \r
1289                 if ( i18n::strlen($body) > 5000 )\r
1290                 {\r
1291                         self::error(_ERROR_COMMENT_TOOLONG);\r
1292                 }\r
1293                 \r
1294                 // prepare body\r
1295                 $body = Comment::prepareBody($body);\r
1296                 \r
1297                 // call plugins\r
1298                 $data = array(\r
1299                         'body' => &$body\r
1300                 );\r
1301                 $manager->notify('PreUpdateComment', $data);\r
1302                 \r
1303                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1304                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1305                 sql_query($query);\r
1306                 \r
1307                 // get itemid\r
1308                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1309                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1310                 \r
1311                 $res    = sql_query($query);\r
1312                 $o              = sql_fetch_object($res);\r
1313                 $itemid = $o->citem;\r
1314                 \r
1315                 if ( $member->canAlterItem($itemid) )\r
1316                 {\r
1317                         self::$action_itemcommentlist($itemid);\r
1318                 }\r
1319                 else\r
1320                 {\r
1321                         self::$action_browseowncomments();\r
1322                 }\r
1323                 return;\r
1324         }\r
1325         \r
1326         /**\r
1327          * Admin::action_commentdelete()\r
1328          * Update comment\r
1329          * \r
1330          * @param       void\r
1331          * @return      void\r
1332          */\r
1333         static private function action_commentdelete()\r
1334         {\r
1335                 global $member, $manager;\r
1336                 \r
1337                 $commentid = intRequestVar('commentid');\r
1338                 $member->canAlterComment($commentid) or self::disallow();\r
1339                 \r
1340                 self::pagehead();\r
1341                 self::$skin->parse('commentdelete');\r
1342                 self::pagefoot();\r
1343                 return;\r
1344         }\r
1345         \r
1346         /**\r
1347          * Admin::action_commentdeleteconfirm()\r
1348          * \r
1349          * @param       void\r
1350          * @return      void\r
1351          */\r
1352         static private function action_commentdeleteconfirm()\r
1353         {\r
1354                 global $member;\r
1355                 \r
1356                 $commentid = intRequestVar('commentid');\r
1357                 \r
1358                 // get item id first\r
1359                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1360                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1361                 \r
1362                 $res = sql_query($query);\r
1363                 $o = sql_fetch_object($res);\r
1364                 $itemid = $o->citem;\r
1365                 \r
1366                 $error = self::deleteOneComment($commentid);\r
1367                 if ( $error )\r
1368                 {\r
1369                         self::doError($error);\r
1370                 }\r
1371                 \r
1372                 if ( $member->canAlterItem($itemid) )\r
1373                 {\r
1374                         self::$action_itemcommentlist($itemid);\r
1375                 }\r
1376                 else\r
1377                 {\r
1378                         self::$action_browseowncomments();\r
1379                 }\r
1380                 return;\r
1381         }\r
1382         \r
1383         /**\r
1384          * Admin::deleteOneComment()\r
1385          * \r
1386          * @param       integer $commentid      ID for comment\r
1387          * @return      void\r
1388          */\r
1389         static private function deleteOneComment($commentid)\r
1390         {\r
1391                 global $member, $manager;\r
1392                 \r
1393                 $commentid = (integer) $commentid;\r
1394                 \r
1395                 if ( !$member->canAlterComment($commentid) )\r
1396                 {\r
1397                         return _ERROR_DISALLOWED;\r
1398                 }\r
1399                 \r
1400                 $data = array(\r
1401                         'commentid' => $commentid\r
1402                 );\r
1403                 \r
1404                 $manager->notify('PreDeleteComment', $data);\r
1405                 \r
1406                 // delete the comments associated with the item\r
1407                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1408                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1409                 sql_query($query);\r
1410                 \r
1411                 $data = array(\r
1412                         'commentid' => $commentid\r
1413                 );\r
1414                 \r
1415                 $manager->notify('PostDeleteComment', $data);\r
1416                 \r
1417                 return '';\r
1418         }\r
1419         \r
1420         /**\r
1421          * Admin::action_usermanagement()\r
1422          * Usermanagement main\r
1423          * \r
1424          * @param       void\r
1425          * @return      void\r
1426          */\r
1427         static private function action_usermanagement()\r
1428         {\r
1429                 global $member, $manager;\r
1430                 \r
1431                 // check if allowed\r
1432                 $member->isAdmin() or self::disallow();\r
1433                 \r
1434                 self::pagehead();\r
1435                 self::$skin->parse('usermanagement');\r
1436                 self::pagefoot();\r
1437                 return;\r
1438         }\r
1439         \r
1440         /**\r
1441          * Admin::action_memberedit()\r
1442          * Edit member settings\r
1443          * \r
1444          * @param       void\r
1445          * @return      void\r
1446          */\r
1447         static private function action_memberedit()\r
1448         {\r
1449                 self::$action_editmembersettings(intRequestVar('memberid'));\r
1450                 return;\r
1451         }\r
1452         \r
1453         /**\r
1454          * Admin::action_editmembersettings()\r
1455          * \r
1456          * @param       integer $memberid       ID for member\r
1457          * @return      void\r
1458          * \r
1459          */\r
1460         static private function action_editmembersettings($memberid = '')\r
1461         {\r
1462                 global $member, $manager, $CONF;\r
1463                 \r
1464                 if ( $memberid == '' )\r
1465                 {\r
1466                         $memberid = $member->getID();\r
1467                 }\r
1468                 \r
1469                 /* TODO: we should consider to use the other way insterad of this */\r
1470                 $_REQUEST['memberid'] = $memberid;\r
1471                 \r
1472                 // check if allowed\r
1473                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1474                 \r
1475                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1476                 self::pagehead($extrahead);\r
1477                 self::$skin->parse('editmembersettings');\r
1478                 self::pagefoot();\r
1479                 return;\r
1480         }\r
1481         \r
1482         /**\r
1483          * Admin::action_changemembersettings()\r
1484          * \r
1485          * @param       void\r
1486          * @return      void\r
1487          */\r
1488         static private function action_changemembersettings()\r
1489         {\r
1490                 global $member, $CONF, $manager;\r
1491                 \r
1492                 $memberid = intRequestVar('memberid');\r
1493                 \r
1494                 // check if allowed\r
1495                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1496                 \r
1497                 $name                   = trim(strip_tags(postVar('name')));\r
1498                 $realname               = trim(strip_tags(postVar('realname')));\r
1499                 $password               = postVar('password');\r
1500                 $repeatpassword = postVar('repeatpassword');\r
1501                 $email                  = strip_tags(postVar('email'));\r
1502                 $url                    = strip_tags(postVar('url'));\r
1503                 $adminskin              = intPostVar('adminskin');\r
1504                 \r
1505                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1506                 if ( !preg_match('#^https?://#', $url) )\r
1507                 {\r
1508                         $url = 'http://' . $url;\r
1509                 }\r
1510                 \r
1511                 $admin          = postVar('admin');\r
1512                 $canlogin       = postVar('canlogin');\r
1513                 $notes          = strip_tags(postVar('notes'));\r
1514                 $locale         = postVar('locale');\r
1515                 \r
1516                 $mem = Member::createFromID($memberid);\r
1517                 \r
1518                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1519                 {\r
1520                         if ( !isValidDisplayName($name) )\r
1521                         {\r
1522                                 self::error(_ERROR_BADNAME);\r
1523                         }\r
1524                         \r
1525                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1526                         {\r
1527                                 self::error(_ERROR_NICKNAMEINUSE);\r
1528                         }\r
1529                         \r
1530                         if ( $password != $repeatpassword )\r
1531                         {\r
1532                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1533                         }\r
1534                         \r
1535                         if ( $password && (i18n::strlen($password) < 6) )\r
1536                         {\r
1537                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1538                         }\r
1539                                 \r
1540                         if ( $password )\r
1541                         {\r
1542                                 $pwdvalid = true;\r
1543                                 $pwderror = '';\r
1544                                 \r
1545                                 $data = array(\r
1546                                         'password'     => $password,\r
1547                                         'errormessage' => &$pwderror,\r
1548                                         'valid'        => &$pwdvalid\r
1549                                 );\r
1550                                 $manager->notify('PrePasswordSet', $data);\r
1551                                 \r
1552                                 if ( !$pwdvalid )\r
1553                                 {\r
1554                                         self::error($pwderror);\r
1555                                 }\r
1556                         }\r
1557                 }\r
1558                 \r
1559                 if ( !NOTIFICATION::address_validation($email) )\r
1560                 {\r
1561                         self::error(_ERROR_BADMAILADDRESS);\r
1562                 }\r
1563                 if ( !$realname )\r
1564                 {\r
1565                         self::error(_ERROR_REALNAMEMISSING);\r
1566                 }\r
1567                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1568                 {\r
1569                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1570                 }\r
1571                 \r
1572                 // check if there will remain at least one site member with both the logon and admin rights\r
1573                 // (check occurs when taking away one of these rights from such a member)\r
1574                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1575                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1576                         )\r
1577                 {\r
1578                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1579                         if ( sql_num_rows($r) < 2 )\r
1580                         {\r
1581                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1582                         }\r
1583                 }\r
1584                 \r
1585                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1586                 {\r
1587                         $mem->setDisplayName($name);\r
1588                         if ( $password )\r
1589                         {\r
1590                                 $mem->setPassword($password);\r
1591                         }\r
1592                 }\r
1593                 \r
1594                 $oldEmail = $mem->getEmail();\r
1595                 \r
1596                 $mem->setRealName($realname);\r
1597                 $mem->setEmail($email);\r
1598                 $mem->setURL($url);\r
1599                 $mem->setNotes($notes);\r
1600                 $mem->setLocale($locale);\r
1601                 \r
1602                 // only allow super-admins to make changes to the admin status\r
1603                 if ( $member->isAdmin() )\r
1604                 {\r
1605                         $mem->setAdmin($admin);\r
1606                         $mem->setCanLogin($canlogin);\r
1607                 }\r
1608                 \r
1609                 $autosave = postVar('autosave');\r
1610                 $mem->setAutosave($autosave);\r
1611                 \r
1612                 $mem->write();\r
1613                 \r
1614                 // store plugin options\r
1615                 $aOptions = requestArray('plugoption');\r
1616                 NucleusPlugin::apply_plugin_options($aOptions);\r
1617                 $data = array(\r
1618                         'context'  => 'member',\r
1619                         'memberid' => $memberid,\r
1620                         'member'   => &$mem\r
1621                 );\r
1622                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1623                 \r
1624                 // if email changed, generate new password\r
1625                 if ( $oldEmail != $mem->getEmail() )\r
1626                 {\r
1627                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1628                         // logout member\r
1629                         $mem->newCookieKey();\r
1630                         \r
1631                         // only log out if the member being edited is the current member.\r
1632                         if ( $member->getID() == $memberid )\r
1633                         {\r
1634                                 $member->logout();\r
1635                         }\r
1636                         self::$action_login(_MSG_ACTIVATION_SENT, 0);\r
1637                         return;\r
1638                 }\r
1639                 \r
1640                 if ( ($mem->getID() == $member->getID())\r
1641                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1642                 {\r
1643                         $mem->newCookieKey();\r
1644                         $member->logout();\r
1645                         self::$action_login(_MSG_LOGINAGAIN, 0);\r
1646                 }\r
1647                 else\r
1648                 {\r
1649                         self::$action_overview(_MSG_SETTINGSCHANGED);\r
1650                 }\r
1651                 return;\r
1652         }\r
1653 \r
1654         /**\r
1655          * Admin::action_memberadd()\r
1656          * \r
1657          * @param       void\r
1658          * @return      void\r
1659          * \r
1660          */\r
1661         static private function action_memberadd()\r
1662         {\r
1663                 global $member, $manager;\r
1664                 \r
1665                 // check if allowed\r
1666                 $member->isAdmin() or self::disallow();\r
1667                 \r
1668                 if ( postVar('password') != postVar('repeatpassword') )\r
1669                 {\r
1670                         self::error(_ERROR_PASSWORDMISMATCH);\r
1671                 }\r
1672                 \r
1673                 if ( i18n::strlen(postVar('password')) < 6 )\r
1674                 {\r
1675                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1676                 }\r
1677                 \r
1678                 $res = Member::create(\r
1679                         postVar('name'),\r
1680                         postVar('realname'),\r
1681                         postVar('password'),\r
1682                         postVar('email'),\r
1683                         postVar('url'),\r
1684                         postVar('admin'),\r
1685                         postVar('canlogin'),\r
1686                         postVar('notes')\r
1687                 );\r
1688                 \r
1689                 if ( $res != 1 )\r
1690                 {\r
1691                         self::error($res);\r
1692                 }\r
1693                 \r
1694                 // fire PostRegister event\r
1695                 $newmem = new Member();\r
1696                 $newmem->readFromName(postVar('name'));\r
1697                 $data = array(\r
1698                         'member' => &$newmem\r
1699                 );\r
1700                 $manager->notify('PostRegister', $data);\r
1701                 \r
1702                 self::$action_usermanagement();\r
1703                 return;\r
1704         }\r
1705         \r
1706         /**\r
1707          * Admin::action_activate()\r
1708          * Account activation\r
1709          * \r
1710          * @param       void\r
1711          * @return      void\r
1712          */\r
1713         static private function action_activate()\r
1714         {\r
1715                 $key = getVar('key');\r
1716                 self::showActivationPage($key);\r
1717                 return;\r
1718         }\r
1719         \r
1720         /**\r
1721          * Admin::showActivationPage()\r
1722          * \r
1723          * @param       void\r
1724          * @return      void\r
1725          */\r
1726         static private function showActivationPage($key, $message = '')\r
1727         {\r
1728                 global $manager;\r
1729                 \r
1730                 // clean up old activation keys\r
1731                 Member::cleanupActivationTable();\r
1732                 \r
1733                 // get activation info\r
1734                 $info = Member::getActivationInfo($key);\r
1735                 \r
1736                 if ( !$info )\r
1737                 {\r
1738                         self::error(_ERROR_ACTIVATE);\r
1739                 }\r
1740                 \r
1741                 $mem = Member::createFromId($info->vmember);\r
1742                 \r
1743                 if ( !$mem )\r
1744                 {\r
1745                         self::error(_ERROR_ACTIVATE);\r
1746                 }\r
1747                 \r
1748                 /* TODO: we should consider to use the other way insterad of this */\r
1749                 $_POST['ackey']                                 = $key;\r
1750                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1751                 \r
1752                 self::$headMess = $message;\r
1753                 self::pagehead();\r
1754                 self::$skin->parse('activate');\r
1755                 self::pagefoot();\r
1756                 return;\r
1757         }\r
1758         \r
1759         /**\r
1760          * Admin::action_activatesetpwd()\r
1761          * Account activation - set password part\r
1762          * \r
1763          * @param       void\r
1764          * @return      void\r
1765          */\r
1766         static private function action_activatesetpwd()\r
1767         {\r
1768                 global $manager;\r
1769                 $key = postVar('key');\r
1770                 \r
1771                 // clean up old activation keys\r
1772                 Member::cleanupActivationTable();\r
1773                 \r
1774                 // get activation info\r
1775                 $info = Member::getActivationInfo($key);\r
1776                 \r
1777                 if ( !$info || ($info->type == 'addresschange') )\r
1778                 {\r
1779                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1780                 }\r
1781                 \r
1782                 $mem = Member::createFromId($info->vmember);\r
1783                 \r
1784                 if ( !$mem )\r
1785                 {\r
1786                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1787                 }\r
1788                 \r
1789                 $password               = postVar('password');\r
1790                 $repeatpassword = postVar('repeatpassword');\r
1791                 \r
1792                 if ( $password != $repeatpassword )\r
1793                 {\r
1794                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1795                 }\r
1796                 \r
1797                 if ( $password && (i18n::strlen($password) < 6) )\r
1798                 {\r
1799                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1800                 }\r
1801                         \r
1802                 if ( $password )\r
1803                 {\r
1804                         $pwdvalid = true;\r
1805                         $pwderror = '';\r
1806                         \r
1807                         $data = array(\r
1808                                 'password'              => $password,\r
1809                                 'errormessage'  => &$pwderror,\r
1810                                 'valid'                 => &$pwdvalid\r
1811                         );\r
1812                         $manager->notify('PrePasswordSet', $data);\r
1813                         if ( !$pwdvalid )\r
1814                         {\r
1815                                 return self::showActivationPage($key,$pwderror);\r
1816                         }\r
1817                 }\r
1818                 \r
1819                 $error = '';\r
1820                 \r
1821                 $data = array(\r
1822                         'type'   => 'activation',\r
1823                         'member' => $mem,\r
1824                         'error'  => &$error\r
1825                 );\r
1826                 $manager->notify('ValidateForm', $data);\r
1827                 if ( $error != '' )\r
1828                 {\r
1829                         return self::showActivationPage($key, $error);\r
1830                 }\r
1831                 \r
1832                 // set password\r
1833                 $mem->setPassword($password);\r
1834                 $mem->write();\r
1835                 \r
1836                 // do the activation\r
1837                 Member::activate($key);\r
1838                 \r
1839                 self::pagehead();\r
1840                 self::$skin->parse('activatesetpwd');\r
1841                 self::pagefoot();\r
1842                 return;\r
1843         }\r
1844         \r
1845         /**\r
1846          * Admin::action_manageteam()\r
1847          * Manage team\r
1848          * \r
1849          * @param       void\r
1850          * @return      void\r
1851          */\r
1852         static private function action_manageteam()\r
1853         {\r
1854                 global $member, $manager;\r
1855                 \r
1856                 $blogid = intRequestVar('blogid');\r
1857                 \r
1858                 // check if allowed\r
1859                 $member->blogAdminRights($blogid) or self::disallow();\r
1860                 \r
1861                 self::pagehead();\r
1862                 self::$skin->parse('manageteam');\r
1863                 self::pagefoot();\r
1864                 return;\r
1865         }\r
1866         \r
1867         /**\r
1868          * Admin::action_teamaddmember()\r
1869          * Add member to team\r
1870          * \r
1871          * @param       void\r
1872          * @return      void\r
1873          */\r
1874         static private function action_teamaddmember()\r
1875         {\r
1876                 global $member, $manager;\r
1877                 \r
1878                 $memberid       = intPostVar('memberid');\r
1879                 $blogid         = intPostVar('blogid');\r
1880                 $admin          = intPostVar('admin');\r
1881                 \r
1882                 // check if allowed\r
1883                 $member->blogAdminRights($blogid) or self::disallow();\r
1884                 \r
1885                 $blog =& $manager->getBlog($blogid);\r
1886                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1887                 {\r
1888                         self::error(_ERROR_ALREADYONTEAM);\r
1889                 }\r
1890                 \r
1891                 self::$action_manageteam();\r
1892                 return;\r
1893         }\r
1894         \r
1895         /**\r
1896          * Admin::action_teamdelete()\r
1897          * \r
1898          * @param       void\r
1899          * @return      void\r
1900          */\r
1901         static private function action_teamdelete()\r
1902         {\r
1903                 global $member, $manager;\r
1904                 \r
1905                 $memberid       = intRequestVar('memberid');\r
1906                 $blogid         = intRequestVar('blogid');\r
1907                 \r
1908                 // check if allowed\r
1909                 $member->blogAdminRights($blogid) or self::disallow();\r
1910                 \r
1911                 $teammem =  Member::createFromID($memberid);\r
1912                 $blog =& $manager->getBlog($blogid);\r
1913                 \r
1914                 self::pagehead();\r
1915                 self::$skin->parse('teamdelete');\r
1916                 self::pagefoot();\r
1917                 return;\r
1918         }\r
1919         \r
1920         /**\r
1921          * Admin::action_teamdeleteconfirm()\r
1922          * \r
1923          * @param       void\r
1924          * @return      void\r
1925          */\r
1926         static private function action_teamdeleteconfirm()\r
1927         {\r
1928                 global $member;\r
1929                 \r
1930                 $memberid = intRequestVar('memberid');\r
1931                 $blogid = intRequestVar('blogid');\r
1932                 \r
1933                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1934                 if ( $error )\r
1935                 {\r
1936                         self::error($error);\r
1937                 }\r
1938                 self::$action_manageteam();\r
1939                 return;\r
1940         }\r
1941         \r
1942         /**\r
1943          * Admin::deleteOneTeamMember()\r
1944          * \r
1945          * @param       void\r
1946          * @return      void\r
1947          */\r
1948         static private function deleteOneTeamMember($blogid, $memberid)\r
1949         {\r
1950                 global $member, $manager;\r
1951                 \r
1952                 $blogid   = intval($blogid);\r
1953                 $memberid = intval($memberid);\r
1954                 \r
1955                 // check if allowed\r
1956                 if ( !$member->blogAdminRights($blogid) )\r
1957                 {\r
1958                         return _ERROR_DISALLOWED;\r
1959                 }\r
1960                 \r
1961                 // check if: - there remains at least one blog admin\r
1962                 //           - (there remains at least one team member)\r
1963                 $tmem = Member::createFromID($memberid);\r
1964                 \r
1965                 \r
1966                 $data = array(\r
1967                         'member' => &$tmem,\r
1968                         'blogid' => $blogid\r
1969                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1970                 \r
1971                 if ( $tmem->isBlogAdmin($blogid) )\r
1972                 {\r
1973                         /* TODO: why we did double check? */\r
1974                         // check if there are more blog members left and at least one admin\r
1975                         // (check for at least two admins before deletion)\r
1976                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1977                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1978                         $r     = sql_query($query);\r
1979                         if ( sql_num_rows($r) < 2 )\r
1980                         {\r
1981                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1982                         }\r
1983                 }\r
1984                 \r
1985                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1986                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1987                 sql_query($query);\r
1988                 \r
1989                 $data = array(\r
1990                         'member' => &$tmem,\r
1991                         'blogid' => $blogid\r
1992                 );\r
1993                 $manager->notify('PostDeleteTeamMember', $data);\r
1994                 \r
1995                 return '';\r
1996         }\r
1997         \r
1998         /**\r
1999          * Admin::action_teamchangeadmin()\r
2000          * \r
2001          * @param       void\r
2002          * @return      void\r
2003          */\r
2004         static private function action_teamchangeadmin()\r
2005         {\r
2006                 global $member;\r
2007                 \r
2008                 $blogid         = intRequestVar('blogid');\r
2009                 $memberid       = intRequestVar('memberid');\r
2010                 \r
2011                 // check if allowed\r
2012                 $member->blogAdminRights($blogid) or self::disallow();\r
2013                 \r
2014                 $mem = Member::createFromID($memberid);\r
2015                 \r
2016                 // don't allow when there is only one admin at this moment\r
2017                 if ( $mem->isBlogAdmin($blogid) )\r
2018                 {\r
2019                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2020                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2021                         $r = sql_query($query);\r
2022                         if ( sql_num_rows($r) == 1 )\r
2023                         {\r
2024                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2025                         }\r
2026                 }\r
2027                 \r
2028                 if ( $mem->isBlogAdmin($blogid) )\r
2029                 {\r
2030                         $newval = 0;\r
2031                 }\r
2032                 else\r
2033                 {\r
2034                         $newval = 1;\r
2035                 }\r
2036                 \r
2037                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2038                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2039                 sql_query($query);\r
2040                 \r
2041                 // only show manageteam if member did not change its own admin privileges\r
2042                 if ( $member->isBlogAdmin($blogid) )\r
2043                 {\r
2044                         self::$action_manageteam();\r
2045                 }\r
2046                 else\r
2047                 {\r
2048                         self::$action_overview(_MSG_ADMINCHANGED);\r
2049                 }\r
2050                 return;\r
2051         }\r
2052         \r
2053         /**\r
2054          * Admin::action_blogsettings()\r
2055          * \r
2056          * @param       void\r
2057          * @return      void\r
2058          */\r
2059         static private function action_blogsettings()\r
2060         {\r
2061                 global $member, $manager;\r
2062                 \r
2063                 $blogid = intRequestVar('blogid');\r
2064                 \r
2065                 // check if allowed\r
2066                 $member->blogAdminRights($blogid) or self::disallow();\r
2067                 \r
2068                 $blog =& $manager->getBlog($blogid);\r
2069                 \r
2070                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2071                 self::pagehead($extrahead);\r
2072                 self::$skin->parse('blogsettings');\r
2073                 self::pagefoot();\r
2074                 return;\r
2075         }\r
2076         \r
2077         /**\r
2078          * Admin::action_categorynew()\r
2079          * \r
2080          * @param       void\r
2081          * @return      void\r
2082          */\r
2083         static private function action_categorynew()\r
2084         {\r
2085                 global $member, $manager;\r
2086                 \r
2087                 $blogid = intRequestVar('blogid');\r
2088                 \r
2089                 $member->blogAdminRights($blogid) or self::disallow();\r
2090                 \r
2091                 $cname = postVar('cname');\r
2092                 $cdesc = postVar('cdesc');\r
2093                 \r
2094                 if ( !isValidCategoryName($cname) )\r
2095                 {\r
2096                         self::error(_ERROR_BADCATEGORYNAME);\r
2097                 }\r
2098                 \r
2099                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2100                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2101                 $res = sql_query($query);\r
2102                 if ( sql_num_rows($res) > 0 )\r
2103                 {\r
2104                         self::error(_ERROR_DUPCATEGORYNAME);\r
2105                 }\r
2106                 \r
2107                 $blog           =& $manager->getBlog($blogid);\r
2108                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2109                 \r
2110                 self::$action_blogsettings();\r
2111                 return;\r
2112         }\r
2113         \r
2114         /**\r
2115          * Admin::action_categoryedit()\r
2116          * \r
2117          * @param       void\r
2118          * @return      void\r
2119          */\r
2120         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2121         {\r
2122                 global $member, $manager;\r
2123                 \r
2124                 if ( $blogid == '' )\r
2125                 {\r
2126                         $blogid = intGetVar('blogid');\r
2127                 }\r
2128                 else\r
2129                 {\r
2130                         $blogid = intval($blogid);\r
2131                 }\r
2132                 if ( $catid == '' )\r
2133                 {\r
2134                         $catid = intGetVar('catid');\r
2135                 }\r
2136                 else\r
2137                 {\r
2138                         $catid = intval($catid);\r
2139                 }\r
2140                 \r
2141                 /* TODO: we should consider to use the other way insterad of this */\r
2142                 $_REQUEST['blogid']             = $blogid;\r
2143                 $_REQUEST['catid']              = $catid;\r
2144                 $_REQUEST['desturl']    = $desturl;\r
2145                 $member->blogAdminRights($blogid) or self::disallow();\r
2146                 \r
2147                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2148                 self::pagehead($extrahead);\r
2149                 self::$skin->parse('categoryedit');\r
2150                 self::pagefoot();\r
2151                 return;\r
2152         }\r
2153         \r
2154         /**\r
2155          * Admin::action_categoryupdate()\r
2156          * \r
2157          * @param       void\r
2158          * @return      void\r
2159          */\r
2160         static private function action_categoryupdate()\r
2161         {\r
2162                 global $member, $manager;\r
2163                 \r
2164                 $blogid         = intPostVar('blogid');\r
2165                 $catid          = intPostVar('catid');\r
2166                 $cname          = postVar('cname');\r
2167                 $cdesc          = postVar('cdesc');\r
2168                 $desturl        = postVar('desturl');\r
2169                 \r
2170                 $member->blogAdminRights($blogid) or self::disallow();\r
2171                 \r
2172                 if ( !isValidCategoryName($cname) )\r
2173                 {\r
2174                         self::error(_ERROR_BADCATEGORYNAME);\r
2175                 }\r
2176                 \r
2177                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2178                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2179                 $res    = sql_query($query);\r
2180                 if ( sql_num_rows($res) > 0 )\r
2181                 {\r
2182                         self::error(_ERROR_DUPCATEGORYNAME);\r
2183                 }\r
2184                 \r
2185                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2186                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2187                 sql_query($query);\r
2188                 \r
2189                 // store plugin options\r
2190                 $aOptions = requestArray('plugoption');\r
2191                 NucleusPlugin::apply_plugin_options($aOptions);\r
2192                 $data = array(\r
2193                         'context'       => 'category',\r
2194                         'catid'         => $catid\r
2195                 );\r
2196                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2197                 \r
2198                 if ( $desturl )\r
2199                 {\r
2200                         redirect($desturl);\r
2201                         exit;\r
2202                 }\r
2203                 else\r
2204                 {\r
2205                         self::$action_blogsettings();\r
2206                 }\r
2207                 return;\r
2208         }\r
2209         \r
2210         /**\r
2211          * Admin::action_categorydelete()\r
2212          * \r
2213          * @param       void\r
2214          * @return      void\r
2215          */\r
2216         static private function action_categorydelete()\r
2217         {\r
2218                 global $member, $manager;\r
2219                 \r
2220                 $blogid = intRequestVar('blogid');\r
2221                 $catid  = intRequestVar('catid');\r
2222                 \r
2223                 $member->blogAdminRights($blogid) or self::disallow();\r
2224                 \r
2225                 $blog =& $manager->getBlog($blogid);\r
2226                 \r
2227                 // check if the category is valid\r
2228                 if ( !$blog->isValidCategory($catid) )\r
2229                 {\r
2230                         self::error(_ERROR_NOSUCHCATEGORY);\r
2231                 }\r
2232                 \r
2233                 // don't allow deletion of default category\r
2234                 if ( $blog->getDefaultCategory() == $catid )\r
2235                 {\r
2236                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2237                 }\r
2238                 \r
2239                 // check if catid is the only category left for blogid\r
2240                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2241                 $query = sprintf($query, sql_table('category'), $blogid);\r
2242                 $res = sql_query($query);\r
2243                 if ( sql_num_rows($res) == 1 )\r
2244                 {\r
2245                         self::error(_ERROR_DELETELASTCATEGORY);\r
2246                 }\r
2247                 \r
2248                 self::pagehead();\r
2249                 self::$skin->parse('categorydelete');\r
2250                 self::pagefoot();\r
2251                 return;\r
2252         }\r
2253         \r
2254         /**\r
2255          * Admin::action_categorydeleteconfirm()\r
2256          * \r
2257          * @param       void\r
2258          * @return      void\r
2259          */\r
2260         static private function action_categorydeleteconfirm()\r
2261         {\r
2262                 global $member, $manager;\r
2263                 \r
2264                 $blogid = intRequestVar('blogid');\r
2265                 $catid  = intRequestVar('catid');\r
2266                 \r
2267                 $member->blogAdminRights($blogid) or self::disallow();\r
2268                 \r
2269                 $error = self::deleteOneCategory($catid);\r
2270                 if ( $error )\r
2271                 {\r
2272                         self::error($error);\r
2273                 }\r
2274                 \r
2275                 self::$action_blogsettings();\r
2276                 return;\r
2277         }\r
2278         \r
2279         /**\r
2280          * Admin::deleteOneCategory()\r
2281          * Delete a category by its id\r
2282          * \r
2283          * @param       String  $catid  category id for deleting\r
2284          * @return      Void\r
2285          */\r
2286         static private function deleteOneCategory($catid)\r
2287         {\r
2288                 global $manager, $member;\r
2289                 \r
2290                 $catid  = intval($catid);\r
2291                 $blogid = getBlogIDFromCatID($catid);\r
2292                 \r
2293                 if ( !$member->blogAdminRights($blogid) )\r
2294                 {\r
2295                         return ERROR_DISALLOWED;\r
2296                 }\r
2297                 \r
2298                 // get blog\r
2299                 $blog =& $manager->getBlog($blogid);\r
2300                 \r
2301                 // check if the category is valid\r
2302                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2303                 {\r
2304                         return _ERROR_NOSUCHCATEGORY;\r
2305                 }\r
2306                 \r
2307                 $destcatid = $blog->getDefaultCategory();\r
2308                 \r
2309                 // don't allow deletion of default category\r
2310                 if ( $blog->getDefaultCategory() == $catid )\r
2311                 {\r
2312                         return _ERROR_DELETEDEFCATEGORY;\r
2313                 }\r
2314                 \r
2315                 // check if catid is the only category left for blogid\r
2316                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2317                 $query = sprintf(sql_table('category'), (integer) $blogid);\r
2318                 \r
2319                 $res = sql_query($query);\r
2320                 if ( sql_num_rows($res) == 1 )\r
2321                 {\r
2322                         return _ERROR_DELETELASTCATEGORY;\r
2323                 }\r
2324                 \r
2325                 $data = array('catid' => $catid);\r
2326                 $manager->notify('PreDeleteCategory', $data);\r
2327                 \r
2328                 // change category for all items to the default category\r
2329                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2330                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2331                 sql_query($query);\r
2332                 \r
2333                 // delete all associated plugin options\r
2334                 NucleusPlugin::delete_option_values('category', $catid);\r
2335                 \r
2336                 // delete category\r
2337                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2338                 $query = sprintf($query, (integer) $catid);\r
2339                 sql_query($query);\r
2340                 \r
2341                 $data = array('catid' => $catid);\r
2342                 $manager->notify('PostDeleteCategory', $data);\r
2343                 return;\r
2344         }\r
2345         \r
2346         /**\r
2347          * Admin::action_blogsettingsupdate\r
2348          * Updating blog settings\r
2349          * \r
2350          * @param       Void\r
2351          * @return      Void\r
2352          */\r
2353         static private function action_blogsettingsupdate()\r
2354         {\r
2355                 global $member, $manager;\r
2356                 \r
2357                 $blogid = intRequestVar('blogid');\r
2358                 \r
2359                 $member->blogAdminRights($blogid) or self::disallow();\r
2360                 \r
2361                 $blog =& $manager->getBlog($blogid);\r
2362                 \r
2363                 $notify_address = trim(postVar('notify'));\r
2364                 $shortname              = trim(postVar('shortname'));\r
2365                 $updatefile             = trim(postVar('update'));\r
2366                 \r
2367                 $notifyComment  = intPostVar('notifyComment');\r
2368                 $notifyVote             = intPostVar('notifyVote');\r
2369                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2370                 \r
2371                 if ( $notifyComment == 0 )\r
2372                 {\r
2373                         $notifyComment = 1;\r
2374                 }\r
2375                 if ( $notifyVote == 0 )\r
2376                 {\r
2377                         $notifyVote = 1;\r
2378                 }\r
2379                 if ( $notifyNewItem == 0 )\r
2380                 {\r
2381                         $notifyNewItem = 1;\r
2382                 }\r
2383                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2384                 \r
2385                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2386                 {\r
2387                         self::error(_ERROR_BADNOTIFY);\r
2388                 }\r
2389                 \r
2390                 if ( !isValidShortName($shortname) )\r
2391                 {\r
2392                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2393                 }\r
2394                 \r
2395                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2396                 {\r
2397                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2398                 }\r
2399                 // check if update file is writable\r
2400                 if ( $updatefile && !is_writeable($updatefile) )\r
2401                 {\r
2402                         self::error(_ERROR_UPDATEFILE);\r
2403                 }\r
2404                 \r
2405                 $blog->setName(trim(postVar('name')));\r
2406                 $blog->setShortName($shortname);\r
2407                 $blog->setNotifyAddress($notify_address);\r
2408                 $blog->setNotifyType($notifyType);\r
2409                 $blog->setMaxComments(postVar('maxcomments'));\r
2410                 $blog->setCommentsEnabled(postVar('comments'));\r
2411                 $blog->setTimeOffset(postVar('timeoffset'));\r
2412                 $blog->setUpdateFile($updatefile);\r
2413                 $blog->setURL(trim(postVar('url')));\r
2414                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2415                 $blog->setDescription(trim(postVar('desc')));\r
2416                 $blog->setPublic(postVar('public'));\r
2417                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2418                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2419                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2420                 $blog->setSearchable(intPostVar('searchable'));\r
2421                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2422                 $blog->writeSettings();\r
2423                 \r
2424                 // store plugin options\r
2425                 $aOptions = requestArray('plugoption');\r
2426                 NucleusPlugin::apply_plugin_options($aOptions);\r
2427                 \r
2428                 $data = array(\r
2429                         'context' => 'blog',\r
2430                         'blogid'  => $blogid,\r
2431                         'blog'    => &$blog\r
2432                 );\r
2433                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2434                 \r
2435                 self::$action_overview(_MSG_SETTINGSCHANGED);\r
2436                 return;\r
2437         }\r
2438         \r
2439         /**\r
2440          * Admin::action_deleteblog()\r
2441          * \r
2442          * @param       void\r
2443          * @return      void\r
2444          */\r
2445         static private function action_deleteblog()\r
2446         {\r
2447                 global $member, $CONF, $manager;\r
2448                 \r
2449                 $blogid = intRequestVar('blogid');\r
2450                 \r
2451                 $member->blogAdminRights($blogid) or self::disallow();\r
2452                 \r
2453                 // check if blog is default blog\r
2454                 if ( $CONF['DefaultBlog'] == $blogid )\r
2455                 {\r
2456                         self::error(_ERROR_DELDEFBLOG);\r
2457                 }\r
2458                 \r
2459                 $blog =& $manager->getBlog($blogid);\r
2460                 \r
2461                 self::pagehead();\r
2462                 self::$skin->parse('deleteblog');\r
2463                 self::pagefoot();\r
2464                 return;\r
2465         }\r
2466         \r
2467         /**\r
2468          * Admin::action_deleteblogconfirm()\r
2469          * Delete Blog\r
2470          * \r
2471          * @param       Void\r
2472          * @return      Void\r
2473          */\r
2474         static private function action_deleteblogconfirm()\r
2475         {\r
2476                 global $member, $CONF, $manager;\r
2477                 \r
2478                 $blogid = intRequestVar('blogid');\r
2479                 \r
2480                 $data = array('blogid' => $blogid);\r
2481                 $manager->notify('PreDeleteBlog', $data);\r
2482                 \r
2483                 $member->blogAdminRights($blogid) or self::disallow();\r
2484                 \r
2485                 // check if blog is default blog\r
2486                 if ( $CONF['DefaultBlog'] == $blogid )\r
2487                 {\r
2488                         self::error(_ERROR_DELDEFBLOG);\r
2489                 }\r
2490                 \r
2491                 // delete all comments\r
2492                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2493                 sql_query($query);\r
2494                 \r
2495                 // delete all items\r
2496                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2497                 sql_query($query);\r
2498                 \r
2499                 // delete all team members\r
2500                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2501                 sql_query($query);\r
2502                 \r
2503                 // delete all bans\r
2504                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2505                 sql_query($query);\r
2506                 \r
2507                 // delete all categories\r
2508                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2509                 sql_query($query);\r
2510                 \r
2511                 // delete all associated plugin options\r
2512                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2513                 \r
2514                 // delete the blog itself\r
2515                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2516                 sql_query($query);\r
2517                 \r
2518                 $data = array('blogid' => $blogid);\r
2519                 $manager->notify('PostDeleteBlog', $data);\r
2520                 \r
2521                 self::$action_overview(_DELETED_BLOG);\r
2522                 return;\r
2523         }\r
2524         \r
2525         /**\r
2526          * Admin::action_memberdelete()\r
2527          * \r
2528          * @param       void\r
2529          * @return      void\r
2530          */\r
2531         static private function action_memberdelete()\r
2532         {\r
2533                 global $member, $manager;\r
2534                 \r
2535                 $memberid = intRequestVar('memberid');\r
2536                 \r
2537                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2538                 \r
2539                 $mem = Member::createFromID($memberid);\r
2540                 \r
2541                 self::pagehead();\r
2542                 self::$skin->parse('memberdelete');\r
2543                 self::pagefoot();\r
2544                 return;\r
2545         }\r
2546         \r
2547         /**\r
2548          * Admin::action_memberdeleteconfirm()\r
2549          * \r
2550          * @param       void\r
2551          * @return      void\r
2552          */\r
2553         static private function action_memberdeleteconfirm()\r
2554         {\r
2555                 global $member;\r
2556                 \r
2557                 $memberid = intRequestVar('memberid');\r
2558                 \r
2559                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2560                 \r
2561                 $error = self::deleteOneMember($memberid);\r
2562                 if ( $error )\r
2563                 {\r
2564                         self::error($error);\r
2565                 }\r
2566                 \r
2567                 if ( $member->isAdmin() )\r
2568                 {\r
2569                         self::$action_usermanagement();\r
2570                 }\r
2571                 else\r
2572                 {\r
2573                         self::$action_overview(_DELETED_MEMBER);\r
2574                 }\r
2575                 return;\r
2576         }\r
2577         \r
2578         /**\r
2579          * Admin::deleteOneMember()\r
2580          * Delete a member by id\r
2581          * \r
2582          * @static\r
2583          * @params      Integer $memberid       member id\r
2584          * @return      String  null string or error messages\r
2585          */\r
2586         static private function deleteOneMember($memberid)\r
2587         {\r
2588                 global $manager;\r
2589                 \r
2590                 $memberid = intval($memberid);\r
2591                 $mem = Member::createFromID($memberid);\r
2592                 \r
2593                 if ( !$mem->canBeDeleted() )\r
2594                 {\r
2595                         return _ERROR_DELETEMEMBER;\r
2596                 }\r
2597                 \r
2598                 $data = array('member' => &$mem);\r
2599                 $manager->notify('PreDeleteMember', $data);\r
2600                 \r
2601                 /* unlink comments from memberid */\r
2602                 if ( $memberid )\r
2603                 {\r
2604                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2605                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2606                         sql_query($query);\r
2607                 }\r
2608                 \r
2609                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2610                 sql_query($query);\r
2611                 \r
2612                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2613                 sql_query($query);\r
2614                 \r
2615                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2616                 sql_query($query);\r
2617                 \r
2618                 // delete all associated plugin options\r
2619                 NucleusPlugin::delete_option_values('member', $memberid);\r
2620                 \r
2621                 $data = array('member' => &$mem);\r
2622                 $manager->notify('PostDeleteMember', $data);\r
2623                 \r
2624                 return '';\r
2625         }\r
2626         \r
2627         /**\r
2628          * Admin::action_createnewlog()\r
2629          * \r
2630          * @param       void\r
2631          * @return      void\r
2632          */\r
2633         static private function action_createnewlog()\r
2634         {\r
2635                 global $member, $CONF, $manager;\r
2636                 \r
2637                 // Only Super-Admins can do this\r
2638                 $member->isAdmin() or self::disallow();\r
2639                 \r
2640                 self::pagehead();\r
2641                 self::$skin->parse('createnewlog');\r
2642                 self::pagefoot();\r
2643                 return;\r
2644         }\r
2645         \r
2646         /**\r
2647          * Admin::action_addnewlog()\r
2648          * \r
2649          * @param       void\r
2650          * @return      void\r
2651          */\r
2652         static private function action_addnewlog()\r
2653         {\r
2654                 global $member, $manager, $CONF;\r
2655                 \r
2656                 // Only Super-Admins can do this\r
2657                 $member->isAdmin() or self::disallow();\r
2658                 \r
2659                 $bname                  = trim(postVar('name'));\r
2660                 $bshortname             = trim(postVar('shortname'));\r
2661                 $btimeoffset    = postVar('timeoffset');\r
2662                 $bdesc                  = trim(postVar('desc'));\r
2663                 $bdefskin               = postVar('defskin');\r
2664                 \r
2665                 if ( !isValidShortName($bshortname) )\r
2666                 {\r
2667                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2668                 }\r
2669                 \r
2670                 if ( $manager->existsBlog($bshortname) )\r
2671                 {\r
2672                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2673                 }\r
2674                 \r
2675                 $data = array(\r
2676                         'name'        => &$bname,\r
2677                         'shortname'   => &$bshortname,\r
2678                         'timeoffset'  => &$btimeoffset,\r
2679                         'description' => &$bdesc,\r
2680                         'defaultskin' => &$bdefskin\r
2681                 );\r
2682                 $manager->notify('PreAddBlog', $data);\r
2683                 \r
2684                 // add slashes for sql queries\r
2685                 $bname                  = sql_real_escape_string($bname);\r
2686                 $bshortname             = sql_real_escape_string($bshortname);\r
2687                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2688                 $bdesc                  = sql_real_escape_string($bdesc);\r
2689                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2690                 \r
2691                 // create blog\r
2692                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2693                 $query = sprintf(sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2694                 sql_query($query);\r
2695                 \r
2696                 $blogid =  sql_insert_id();\r
2697                 $blog   =& $manager->getBlog($blogid);\r
2698                 \r
2699                 // create new category\r
2700                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2701                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2702                 \r
2703                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2704                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2705                 $catid = sql_insert_id();\r
2706                 \r
2707                 // set as default category\r
2708                 $blog->setDefaultCategory($catid);\r
2709                 $blog->writeSettings();\r
2710                 \r
2711                 // create team member\r
2712                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2713                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2714                 sql_query($query);\r
2715                 \r
2716                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2717                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2718                 \r
2719                 $blog->additem(\r
2720                         $blog->getDefaultCategory(),\r
2721                         $itemdeftitle,$itemdefbody,\r
2722                         '',\r
2723                         $blogid,\r
2724                         $member->getID(),\r
2725                         $blog->getCorrectTime(),\r
2726                         0,\r
2727                         0,\r
2728                         0\r
2729                 );\r
2730                 \r
2731                 $data = array('blog' => &$blog);\r
2732                 $manager->notify('PostAddBlog', $data);\r
2733                 \r
2734                 $data = array(\r
2735                         'blog'                  => &$blog,\r
2736                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2737                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2738                         'catid'                 => $catid\r
2739                 );\r
2740                 $manager->notify('PostAddCategory', $data);\r
2741                 \r
2742                 /* TODO: we should consider to use the other way insterad of this */\r
2743                 $_REQUEST['blogid'] = $blogid;\r
2744                 $_REQUEST['catid']  = $catid;\r
2745                 self::pagehead();\r
2746                 self::$skin->parse('addnewlog');\r
2747                 self::pagefoot();\r
2748                 return;\r
2749         }\r
2750         \r
2751         /**\r
2752          * Admin::action_addnewlog2()\r
2753          * \r
2754          * @param       void\r
2755          * @return      void\r
2756          */\r
2757         static private function action_addnewlog2()\r
2758         {\r
2759                 global $member, $manager;\r
2760                 $blogid = intRequestVar('blogid');\r
2761                 \r
2762                 $member->blogAdminRights($blogid) or self::disallow();\r
2763                 \r
2764                 $burl = requestVar('url');\r
2765                 \r
2766                 $blog =& $manager->getBlog($blogid);\r
2767                 $blog->setURL(trim($burl));\r
2768                 $blog->writeSettings();\r
2769                 \r
2770                 self::$action_overview(_MSG_NEWBLOG);\r
2771                 return;\r
2772         }\r
2773         \r
2774         /**\r
2775          * Admin::action_skinieoverview()\r
2776          * \r
2777          * @param       void\r
2778          * @return      void\r
2779          */\r
2780         static private function action_skinieoverview()\r
2781         {\r
2782                 global $member, $DIR_LIBS, $manager;\r
2783                 \r
2784                 $member->isAdmin() or self::disallow();\r
2785                 \r
2786                 include_once($DIR_LIBS . 'skinie.php');\r
2787                 \r
2788                 self::pagehead();\r
2789                 self::$skin->parse('skinieoverview');\r
2790                 self::pagefoot();\r
2791                 return;\r
2792         }\r
2793         \r
2794         /**\r
2795          * Admin::action_skinieimport()\r
2796          * \r
2797          * @param       void\r
2798          * @return      void\r
2799          */\r
2800         static private function action_skinieimport()\r
2801         {\r
2802                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2803                 \r
2804                 $member->isAdmin() or self::disallow();\r
2805                 \r
2806                 // load skinie class\r
2807                 include_once($DIR_LIBS . 'skinie.php');\r
2808                 \r
2809                 $skinFileRaw    = postVar('skinfile');\r
2810                 $mode                   = postVar('mode');\r
2811                 \r
2812                 $importer = new SkinImport();\r
2813                 \r
2814                 // get full filename\r
2815                 if ($mode == 'file')\r
2816                 {\r
2817                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2818                         \r
2819                         /* TODO: remove this\r
2820                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2821                         if ( !file_exists($skinFile) )\r
2822                         {\r
2823                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2824                         }\r
2825                          */\r
2826                 }\r
2827                 else\r
2828                 {\r
2829                         $skinFile = $skinFileRaw;\r
2830                 }\r
2831                 \r
2832                 // read only metadata\r
2833                 $error = $importer->readFile($skinFile, 1);\r
2834                 \r
2835                 /* TODO: we should consider to use the other way insterad of this */\r
2836                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2837                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2838                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2839                 \r
2840                 // clashes\r
2841                 $skinNameClashe                 = $importer->checkSkinNameClashes();\r
2842                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2843                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2844                 \r
2845                 /* TODO: we should consider to use the other way insterad of this */\r
2846                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2847                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2848                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2849                 \r
2850                 if ( $error )\r
2851                 {\r
2852                         self::error($error);\r
2853                 }\r
2854                 \r
2855                 self::pagehead();\r
2856                 self::$skin->parse('skinieimport');\r
2857                 self::pagefoot();\r
2858                 return;\r
2859         }\r
2860         \r
2861         /**\r
2862          * Admin::action_skiniedoimport()\r
2863          * \r
2864          * @param       void\r
2865          * @return      void\r
2866          */\r
2867         static private function action_skiniedoimport()\r
2868         {\r
2869                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2870                 \r
2871                 $member->isAdmin() or self::disallow();\r
2872                 \r
2873                 // load skinie class\r
2874                 include_once($DIR_LIBS . 'skinie.php');\r
2875                 \r
2876                 $skinFileRaw    = postVar('skinfile');\r
2877                 $mode                   = postVar('mode');\r
2878                 \r
2879                 $allowOverwrite = intPostVar('overwrite');\r
2880                 \r
2881                 // get full filename\r
2882                 if ( $mode == 'file' )\r
2883                 {\r
2884                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2885                         \r
2886                         /* TODO: remove this\r
2887                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2888                         if ( !file_exists($skinFile) )\r
2889                         {\r
2890                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2891                         }\r
2892                         */\r
2893                 }\r
2894                 else\r
2895                 {\r
2896                         $skinFile = $skinFileRaw;\r
2897                 }\r
2898                 \r
2899                 $importer = new SkinImport();\r
2900                 \r
2901                 $error = $importer->readFile($skinFile);\r
2902                 \r
2903                 if ( $error )\r
2904                 {\r
2905                         self::error($error);\r
2906                 }\r
2907                 \r
2908                 $error = $importer->writeToDatabase($allowOverwrite);\r
2909                 \r
2910                 if ( $error )\r
2911                 {\r
2912                         self::error($error);\r
2913                 }\r
2914                 \r
2915                 /* TODO: we should consider to use the other way insterad of this */\r
2916                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2917                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2918                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2919                 \r
2920                 self::pagehead();\r
2921                 self::$skin->parse('skiniedoimport');\r
2922                 self::pagefoot();\r
2923                 return;\r
2924         }\r
2925 \r
2926         /**\r
2927          * Admin::action_skinieexport()\r
2928          * \r
2929          * @param       void\r
2930          * @return      void\r
2931          */\r
2932         static private function action_skinieexport()\r
2933         {\r
2934                 global $member, $DIR_LIBS;\r
2935                 \r
2936                 $member->isAdmin() or self::disallow();\r
2937                 \r
2938                 // load skinie class\r
2939                 include_once($DIR_LIBS . 'skinie.php');\r
2940                 \r
2941                 $aSkins         = requestIntArray('skin');\r
2942                 $aTemplates     = requestIntArray('template');\r
2943                 \r
2944                 if ( !is_array($aTemplates) )\r
2945                 {\r
2946                         $aTemplates = array();\r
2947                 }\r
2948                 if ( !is_array($aSkins) )\r
2949                 {\r
2950                         $aSkins = array();\r
2951                 }\r
2952                 \r
2953                 $skinList               = array_keys($aSkins);\r
2954                 $templateList   = array_keys($aTemplates);\r
2955                 \r
2956                 $info = postVar('info');\r
2957                 \r
2958                 $exporter = new SkinExport();\r
2959                 foreach ( $skinList as $skinId )\r
2960                 {\r
2961                         $exporter->addSkin($skinId);\r
2962                 }\r
2963                 foreach ($templateList as $templateId)\r
2964                 {\r
2965                         $exporter->addTemplate($templateId);\r
2966                 }\r
2967                 $exporter->setInfo($info);\r
2968                 \r
2969                 $exporter->export();\r
2970                 return;\r
2971         }\r
2972         \r
2973         /**\r
2974          * Admin::action_templateoverview()\r
2975          * \r
2976          * @param       void\r
2977          * @return      void\r
2978          */\r
2979         static private function action_templateoverview()\r
2980         {\r
2981                 global $member, $manager;\r
2982                 \r
2983                 $member->isAdmin() or self::disallow();\r
2984                 \r
2985                 self::pagehead();\r
2986                 self::$skin->parse('templateoverview');\r
2987                 self::pagefoot();\r
2988                 return;\r
2989         }\r
2990         \r
2991         /**\r
2992          * Admin::action_templateedit()\r
2993          * \r
2994          * @param       string  $msg    message for pageheader\r
2995          * @return      void\r
2996          */\r
2997         static private function action_templateedit($msg = '')\r
2998         {\r
2999                 global $member, $manager;\r
3000                 if ( $msg )\r
3001                 {\r
3002                         self::$headMess = $msg;\r
3003                 }\r
3004                 \r
3005                 $templateid = intRequestVar('templateid');\r
3006                 \r
3007                 $member->isAdmin() or self::disallow();\r
3008                 \r
3009                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3010                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3011                 \r
3012                 self::pagehead($extrahead);\r
3013                 self::$skin->parse('templateedit');\r
3014                 self::pagefoot();\r
3015                 return;\r
3016         }\r
3017         \r
3018         /**\r
3019          * TODO: remove this\r
3020          *\r
3021         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3022                 static $count = 1;\r
3023                 if (!isset($template[$name])) $template[$name] = '';\r
3024         ?>\r
3025                 </tr><tr>\r
3026                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3027                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3028         <?php       $count++;\r
3029         }\r
3030         */\r
3031         \r
3032         /**\r
3033          * Admin::action_templateupdate()\r
3034          * \r
3035          * @param       void\r
3036          * @return      void\r
3037          */\r
3038         static private function action_templateupdate()\r
3039         {\r
3040                 global $member,$manager;\r
3041                 \r
3042                 $templateid = intRequestVar('templateid');\r
3043                 \r
3044                 $member->isAdmin() or self::disallow();\r
3045                 \r
3046                 $name = postVar('tname');\r
3047                 $desc = postVar('tdesc');\r
3048                 \r
3049                 if ( !isValidTemplateName($name) )\r
3050                 {\r
3051                         self::error(_ERROR_BADTEMPLATENAME);\r
3052                 }\r
3053                 \r
3054                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3055                 {\r
3056                         self::error(_ERROR_DUPTEMPLATENAME);\r
3057                 }\r
3058                 \r
3059                 $name = sql_real_escape_string($name);\r
3060                 $desc = sql_real_escape_string($desc);\r
3061                 \r
3062                 // 1. Remove all template parts\r
3063                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3064                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3065                 sql_query($query);\r
3066                 \r
3067                 // 2. Update description\r
3068                 $query = "UPDATE %s SET tdname='%s',tddesc='%s' WHERE tdnumber=%d;";\r
3069                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3070                 sql_query($query);\r
3071                 \r
3072                 // 3. Add non-empty template parts\r
3073                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3074                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3075                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3076                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3077                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3078                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3079                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3080                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3081                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3082                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3083                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3084                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3085                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3086                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3087                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3088                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3089                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3090                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3091                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3092                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3093                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3094                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3095                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3096                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3097                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3098                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3099                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3100                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3101                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3102                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3103                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3104                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3105                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3106                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3107                 \r
3108                 $data = array('fields' => array());\r
3109                 $manager->notify('TemplateExtraFields', $data);\r
3110                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3111                 {\r
3112                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3113                         {\r
3114                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3115                         }\r
3116                 }\r
3117                 \r
3118                 // jump back to template edit\r
3119                 self::$action_templateedit(_TEMPLATE_UPDATED);\r
3120                 return;\r
3121         }\r
3122         \r
3123         /**\r
3124          * Admin::addToTemplate()\r
3125          * \r
3126          * @param       Integer $id     ID for template\r
3127          * @param       String  $partname       parts name\r
3128          * @param       String  $content        template contents\r
3129          * @return      Integer record index\r
3130          * \r
3131          */\r
3132         static private function addToTemplate($id, $partname, $content)\r
3133         {\r
3134                 // don't add empty parts:\r
3135                 if ( !trim($content) )\r
3136                 {\r
3137                         return -1;\r
3138                 }\r
3139                 \r
3140                 $partname = sql_real_escape_string($partname);\r
3141                 $content  = sql_real_escape_string($content);\r
3142                 \r
3143                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3144                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3145                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3146                 return sql_insert_id();\r
3147         }\r
3148         \r
3149         /**\r
3150          * Admin::action_templatedelete()\r
3151          * \r
3152          * @param       void\r
3153          * @return      void\r
3154          */\r
3155         static private function action_templatedelete()\r
3156         {\r
3157                 global $member, $manager;\r
3158                 \r
3159                 $member->isAdmin() or self::disallow();\r
3160                 \r
3161                 $templateid = intRequestVar('templateid');\r
3162                 // TODO: check if template can be deleted\r
3163                 \r
3164                 self::pagehead();\r
3165                 self::$skin->parse('templatedelete');\r
3166                 self::pagefoot();\r
3167                 return;\r
3168         }\r
3169         \r
3170         /**\r
3171          * Admin::action_templatedeleteconfirm()\r
3172          * \r
3173          * @param       void\r
3174          * @return      void\r
3175          */\r
3176         static private function action_templatedeleteconfirm()\r
3177         {\r
3178                 global $member, $manager;\r
3179                 \r
3180                 $templateid = intRequestVar('templateid');\r
3181                 \r
3182                 $member->isAdmin() or self::disallow();\r
3183                 \r
3184                 $data = array('templateid' => $templateid);\r
3185                 $manager->notify('PreDeleteTemplate', $data);\r
3186                 \r
3187                 // 1. delete description\r
3188                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3189                 \r
3190                 // 2. delete parts\r
3191                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3192                 \r
3193                 \r
3194                 $data = array('templateid' => $templateid);\r
3195                 $manager->notify('PostDeleteTemplate', $data);\r
3196                 \r
3197                 self::$action_templateoverview();\r
3198                 return;\r
3199         }\r
3200         \r
3201         /**\r
3202          * Admin::action_templatenew()\r
3203          * \r
3204          * @param       void\r
3205          * @return      void\r
3206          */\r
3207         static private function action_templatenew()\r
3208         {\r
3209                 global $member;\r
3210                 \r
3211                 $member->isAdmin() or self::disallow();\r
3212                 \r
3213                 $name = postVar('name');\r
3214                 $desc = postVar('desc');\r
3215                 \r
3216                 if ( !isValidTemplateName($name) )\r
3217                 {\r
3218                         self::error(_ERROR_BADTEMPLATENAME);\r
3219                 }\r
3220                 \r
3221                 if ( Template::exists($name) )\r
3222                 {\r
3223                         self::error(_ERROR_DUPTEMPLATENAME);\r
3224                 }\r
3225                 \r
3226                 $newTemplateId = Template::createNew($name, $desc);\r
3227                 \r
3228                 self::$action_templateoverview();\r
3229                 return;\r
3230         }\r
3231         \r
3232         /**\r
3233          * Admin::action_templateclone()\r
3234          * \r
3235          * @param       void\r
3236          * @return      void\r
3237          */\r
3238         static private function action_templateclone()\r
3239         {\r
3240                 global $member;\r
3241                 \r
3242                 $templateid = intRequestVar('templateid');\r
3243                 \r
3244                 $member->isAdmin() or self::disallow();\r
3245                 \r
3246                 // 1. read old template\r
3247                 $name = Template::getNameFromId($templateid);\r
3248                 $desc = Template::getDesc($templateid);\r
3249                 \r
3250                 // 2. create desc thing\r
3251                 $name = "cloned" . $name;\r
3252                 \r
3253                 // if a template with that name already exists:\r
3254                 if ( Template::exists($name) )\r
3255                 {\r
3256                         $i = 1;\r
3257                         while (Template::exists($name . $i))\r
3258                         {\r
3259                                 $i++;\r
3260                         }\r
3261                         $name .= $i;\r
3262                 }\r
3263                 \r
3264                 $newid = Template::createNew($name, $desc);\r
3265                 \r
3266                 // 3. create clone\r
3267                 // go through parts of old template and add them to the new one\r
3268                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3269                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3270                 \r
3271                 $res = sql_query($query);\r
3272                 while ( $o = sql_fetch_object($res) )\r
3273                 {\r
3274                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3275                 }\r
3276                 \r
3277                 self::$action_templateoverview();\r
3278                 return;\r
3279         }\r
3280         \r
3281         /**\r
3282          * Admin::action_admintemplateoverview()\r
3283          * \r
3284          * @param       void\r
3285          * @return      void\r
3286          */\r
3287         static private function action_admintemplateoverview()\r
3288         {\r
3289                 global $member, $manager;\r
3290                 $member->isAdmin() or self::disallow();\r
3291                 self::pagehead();\r
3292                 self::$skin->parse('admntemplateoverview');\r
3293                 self::pagefoot();\r
3294                 return;\r
3295         }\r
3296         \r
3297         /**\r
3298          * Admin::action_admintemplateedit()\r
3299          * \r
3300          * @param       string  $msg    message for pageheader\r
3301          * @return      void\r
3302          */\r
3303         static private function action_admintemplateedit($msg = '')\r
3304         {\r
3305                 global $member, $manager;\r
3306                 if ( $msg )\r
3307                 {\r
3308                         self::$headMess = $msg;\r
3309                 }\r
3310                 $member->isAdmin() or self::disallow();\r
3311                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3312                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3313                 self::pagehead($extrahead);\r
3314                 self::$skin->parse('admintemplateedit');\r
3315                 self::pagefoot();\r
3316                 return;\r
3317         }\r
3318         \r
3319         /**\r
3320          * Admin::action_admintemplateupdate()\r
3321          * \r
3322          * @param       void\r
3323          * @return      void\r
3324          */\r
3325         static private function action_admintemplateupdate()\r
3326         {\r
3327                 global $member, $manager;\r
3328                 $templateid = intRequestVar('templateid');\r
3329                 $member->isAdmin() or self::disallow();\r
3330                 $name = postVar('tname');\r
3331                 $desc = postVar('tdesc');\r
3332                 \r
3333                 if ( !isValidTemplateName($name) )\r
3334                 {\r
3335                         self::error(_ERROR_BADTEMPLATENAME);\r
3336                 }\r
3337                 \r
3338                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3339                 {\r
3340                         self::error(_ERROR_DUPTEMPLATENAME);\r
3341                 }\r
3342                 $name = sql_real_escape_string($name);\r
3343                 $desc = sql_real_escape_string($desc);\r
3344                 \r
3345                 // 1. Remove all template parts\r
3346                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3347                 $query = sprintf($query, (integer) $templateid);\r
3348                 sql_query($query);\r
3349                 \r
3350                 // 2. Update description\r
3351                 $query = 'UPDATE %s SET tdname=%s tddesc=%s WHERE tdnumber=%d;';\r
3352                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3353                 sql_query($query);\r
3354                 \r
3355                 // 3. Add non-empty template parts\r
3356                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3357                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3358                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3359                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3360                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3361                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3362                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3363                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3364                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3365                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3366                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3367                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3368                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3369                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3370                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3371                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3372                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3373                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3374                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3375                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3376                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3377                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3378                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3379                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3380                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3381                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3382                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3383                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3384                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3385                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3386                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3387                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3388                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3389                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3390                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3391                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3392                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3393                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3394                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3395                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3396                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3397                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3457                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3458                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3459                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3460                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3461                 \r
3462                 $data = array('fields' => array());\r
3463                 $manager->notify('TemplateExtraFields', $data);\r
3464                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3465                 {\r
3466                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3467                         {\r
3468                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3469                         }\r
3470                 }\r
3471                 \r
3472                 // jump back to template edit\r
3473                 self::$action_admintemplateedit(_TEMPLATE_UPDATED);\r
3474                 return;\r
3475         }\r
3476         \r
3477         /**\r
3478          * Admin::addToAdminTemplate()\r
3479          * \r
3480          * @param       integer $id                     ID for template\r
3481          * @param       string  $partname       name of part for template\r
3482          * @param       void    $contents       content for part of template\r
3483          * @return      integer ID for newly inserted Template\r
3484          */\r
3485         static private function addToAdminTemplate($id, $partname, $content)\r
3486         {\r
3487                 // don't add empty parts:\r
3488                 if ( !trim($content) )\r
3489                 {\r
3490                         return -1;\r
3491                 }\r
3492                 \r
3493                 $query = "INSERT INTO (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3494                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($contents));\r
3495                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3496                 return sql_insert_id();\r
3497         }\r
3498         \r
3499         /**\r
3500          * Admin::action_admintemplatedelete()\r
3501          * \r
3502          * @param       void\r
3503          * @return      void\r
3504          */\r
3505         static private function action_admintemplatedelete()\r
3506         {\r
3507                 global $member, $manager;\r
3508                 $member->isAdmin() or self::disallow();\r
3509                 \r
3510                 // TODO: check if template can be deleted\r
3511                 self::pagehead();\r
3512                 self::$skin->parse('admintemplatedelete');\r
3513                 self::pagefoot();\r
3514                 return;\r
3515         }\r
3516         \r
3517         /**\r
3518          * Admin::action_admintemplatedeleteconfirm()\r
3519          * \r
3520          * @param       void\r
3521          * @return      void\r
3522          */\r
3523         static private function action_admintemplatedeleteconfirm()\r
3524         {\r
3525                 global $member, $manager;\r
3526                 \r
3527                 $templateid = intRequestVar('templateid');\r
3528                 $member->isAdmin() or self::disallow();\r
3529                 \r
3530                 $data = array('templateid' => $templateid);\r
3531                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3532                 \r
3533                 // 1. delete description\r
3534                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3535                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3536                 sql_query($query);\r
3537                 \r
3538                 // 2. delete parts\r
3539                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3540                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3541                 sql_query();\r
3542                 \r
3543                 $data = array('templateid' => $templateid);\r
3544                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3545                 \r
3546                 self::$action_admintemplateoverview();\r
3547                 return;\r
3548         }\r
3549         \r
3550         /**\r
3551          * Admin::action_admintemplatenew()\r
3552          * \r
3553          * @param       void\r
3554          * @return      void\r
3555          */\r
3556         static private function action_admintemplatenew()\r
3557         {\r
3558                 global $member;\r
3559                 $member->isAdmin() or self::disallow();\r
3560                 $name = postVar('name');\r
3561                 $desc = postVar('desc');\r
3562                 \r
3563                 if ( !isValidTemplateName($name) )\r
3564                 {\r
3565                         self::error(_ERROR_BADTEMPLATENAME);\r
3566                 }\r
3567                 if ( Template::exists($name) )\r
3568                 {\r
3569                         self::error(_ERROR_DUPTEMPLATENAME);\r
3570                 }\r
3571                 \r
3572                 $newTemplateId = Template::createNew($name, $desc);\r
3573                 self::$action_admintemplateoverview();\r
3574                 return;\r
3575         }\r
3576         \r
3577         /**\r
3578          * Admin::action_admintemplateclone()\r
3579          * \r
3580          * @param       void\r
3581          * @return      void\r
3582          */\r
3583         static private function action_admintemplateclone()\r
3584         {\r
3585                 global $member;\r
3586                 $templateid = intRequestVar('templateid');\r
3587                 $member->isAdmin() or self::disallow();\r
3588                 \r
3589                 // 1. read old template\r
3590                 $name = Template::getNameFromId($templateid);\r
3591                 $desc = Template::getDesc($templateid);\r
3592                 \r
3593                 // 2. create desc thing\r
3594                 $name = "cloned" . $name;\r
3595                 \r
3596                 // if a template with that name already exists:\r
3597                 if ( Template::exists($name) )\r
3598                 {\r
3599                         $i = 1;\r
3600                         while ( Template::exists($name . $i) )\r
3601                         {\r
3602                                 $i++;\r
3603                         }\r
3604                         $name .= $i;\r
3605                 }\r
3606                 \r
3607                 $newid = Template::admincreateNew($name, $desc);\r
3608                 \r
3609                 // 3. create clone\r
3610                 // go through parts of old template and add them to the new one\r
3611                 $query = "SELECT tpartname, tcontent FROM %sWHERE tdesc=%d;";\r
3612                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3613                 \r
3614                 $res = sql_query($query);\r
3615                 while ( $o = sql_fetch_object($res) )\r
3616                 {\r
3617                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3618                 }\r
3619                 \r
3620                 self::$action_admintemplateoverview();\r
3621                 return;\r
3622         }\r
3623 \r
3624         /**\r
3625          * Admin::action_skinoverview()\r
3626          * \r
3627          * @param       void\r
3628          * @return      void\r
3629          */\r
3630         static private function action_skinoverview()\r
3631         {\r
3632                 global $member, $manager;\r
3633                 \r
3634                 $member->isAdmin() or self::disallow();\r
3635                 \r
3636                 self::pagehead();\r
3637                 self::$skin->parse('skinoverview');\r
3638                 self::pagefoot();\r
3639                 return;\r
3640         }\r
3641         \r
3642         /**\r
3643          * Admin::action_skinnew()\r
3644          * \r
3645          * @param       void\r
3646          * @return      void\r
3647          */\r
3648         static private function action_skinnew()\r
3649         {\r
3650                 global $member;\r
3651                 \r
3652                 $member->isAdmin() or self::disallow();\r
3653                 \r
3654                 $name = trim(postVar('name'));\r
3655                 $desc = trim(postVar('desc'));\r
3656                 \r
3657                 if ( !isValidSkinName($name) )\r
3658                 {\r
3659                         self::error(_ERROR_BADSKINNAME);\r
3660                 }\r
3661                 \r
3662                 if ( SKIN::exists($name) )\r
3663                 {\r
3664                         self::error(_ERROR_DUPSKINNAME);\r
3665                 }\r
3666                 \r
3667                 $newId = SKIN::createNew($name, $desc);\r
3668                 \r
3669                 self::$action_skinoverview();\r
3670                 return;\r
3671         }\r
3672         \r
3673         /**\r
3674          * Admin::action_skinedit()\r
3675          * \r
3676          * @param       void\r
3677          * @return      void\r
3678          */\r
3679         static private function action_skinedit()\r
3680         {\r
3681                 global $member, $manager;\r
3682                 \r
3683                 $member->isAdmin() or self::disallow();\r
3684                 \r
3685                 self::pagehead();\r
3686                 self::$skin->parse('skinedit');\r
3687                 self::pagefoot();\r
3688                 return;\r
3689         }\r
3690         \r
3691         /**\r
3692          * Admin::action_skineditgeneral()\r
3693          * \r
3694          * @param       void\r
3695          * @return      void\r
3696          */\r
3697         static private function action_skineditgeneral()\r
3698         {\r
3699                 global $member;\r
3700                 \r
3701                 $skinid = intRequestVar('skinid');\r
3702                 \r
3703                 $member->isAdmin() or self::disallow();\r
3704                 \r
3705                 $name           = postVar('name');\r
3706                 $desc           = postVar('desc');\r
3707                 $type           = postVar('type');\r
3708                 $inc_mode       = postVar('inc_mode');\r
3709                 $inc_prefix     = postVar('inc_prefix');\r
3710                 \r
3711                 $skin = new Skin($skinid);\r
3712                 \r
3713                 // 1. Some checks\r
3714                 if ( !isValidSkinName($name) )\r
3715                 {\r
3716                         self::error(_ERROR_BADSKINNAME);\r
3717                 }\r
3718                 \r
3719                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3720                 {\r
3721                         self::error(_ERROR_DUPSKINNAME);\r
3722                 }\r
3723                 \r
3724                 if ( !$type )\r
3725                 {\r
3726                         $type = 'text/html';\r
3727                 }\r
3728                 if ( !$inc_mode )\r
3729                 {\r
3730                         $inc_mode = 'normal';\r
3731                 }\r
3732                 \r
3733                 // 2. Update description\r
3734                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3735                 \r
3736                 self::$action_skinedit();\r
3737                 return;\r
3738         }\r
3739         \r
3740         static private function action_skinedittype($msg = '')\r
3741         {\r
3742                 global $member, $manager;\r
3743                 \r
3744                 $member->isAdmin() or self::disallow();\r
3745                 \r
3746                 if ( $msg )\r
3747                 {\r
3748                         self::$headMess = $msg;\r
3749                 }\r
3750                 \r
3751                 $skinid = intRequestVar('skinid');\r
3752                 $type   = requestVar('type');\r
3753                 $type   = trim($type);\r
3754                 $type   = strtolower($type);\r
3755                 \r
3756                 if ( !isValidShortName($type) )\r
3757                 {\r
3758                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3759                 }\r
3760                 \r
3761                 self::pagehead();\r
3762                 self::$skin->parse('skinedittype');\r
3763                 self::pagefoot();\r
3764                 return;\r
3765         }\r
3766         \r
3767         /**\r
3768          * Admin::action_skinupdate()\r
3769          * \r
3770          * @param       void\r
3771          * @return      void\r
3772          */\r
3773         static private function action_skinupdate()\r
3774         {\r
3775                 global $member;\r
3776                 \r
3777                 $skinid = intRequestVar('skinid');\r
3778                 $content = trim(postVar('content'));\r
3779                 $type = postVar('type');\r
3780                 \r
3781                 $member->isAdmin() or self::disallow();\r
3782                 \r
3783                 $skin = new SKIN($skinid);\r
3784                 $skin->update($type, $content);\r
3785                 \r
3786                 self::$action_skinedittype(_SKIN_UPDATED);\r
3787                 return;\r
3788         }\r
3789         \r
3790         /**\r
3791          * Admin::action_skindelete()\r
3792          * \r
3793          * @param       void\r
3794          * @return      void\r
3795          */\r
3796         static private function action_skindelete()\r
3797         {\r
3798                 global $member, $manager, $CONF;\r
3799                 \r
3800                 $skinid = intRequestVar('skinid');\r
3801                 \r
3802                 $member->isAdmin() or self::disallow();\r
3803                 \r
3804                 // don't allow default skin to be deleted\r
3805                 if ( $skinid == $CONF['BaseSkin'] )\r
3806                 {\r
3807                         self::error(_ERROR_DEFAULTSKIN);\r
3808                 }\r
3809                 \r
3810                 // don't allow deletion of default skins for blogs\r
3811                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3812                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3813                 \r
3814                 $r = sql_query($query);\r
3815                 if ( $o = sql_fetch_object($r) )\r
3816                 {\r
3817                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3818                 }\r
3819                 \r
3820                 self::pagehead();\r
3821                 self::$skin->parse('skindelete');\r
3822                 self::pagefoot();\r
3823                 return;\r
3824         }\r
3825         \r
3826         /**\r
3827          * Admin::action_skindeleteconfirm()\r
3828          * \r
3829          * @param       void\r
3830          * @return      void\r
3831          */\r
3832         static private function action_skindeleteconfirm()\r
3833         {\r
3834                 global $member, $CONF, $manager;\r
3835                 \r
3836                 $skinid = intRequestVar('skinid');\r
3837                 \r
3838                 $member->isAdmin() or self::disallow();\r
3839                 \r
3840                 // don't allow default skin to be deleted\r
3841                 if ( $skinid == $CONF['BaseSkin'] )\r
3842                 {\r
3843                         self::error(_ERROR_DEFAULTSKIN);\r
3844                 }\r
3845                 \r
3846                 // don't allow deletion of default skins for blogs\r
3847                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3848                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3849                 \r
3850                 $r = sql_query($query);\r
3851                 if ( $o = sql_fetch_object($r) )\r
3852                 {\r
3853                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3854                 }\r
3855                 \r
3856                 $data = array('skinid' => $skinid);\r
3857                 $manager->notify('PreDeleteSkin', $data);\r
3858                 \r
3859                 // 1. delete description\r
3860                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3861                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3862                 sql_query($query);\r
3863                 \r
3864                 // 2. delete parts\r
3865                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3866                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3867                 sql_query($query);\r
3868                 \r
3869                 $data = array('skinid' => $skinid);\r
3870                 $manager->notify('PostDeleteSkin', $data);\r
3871                 \r
3872                 self::$action_skinoverview();\r
3873                 return;\r
3874         }\r
3875         \r
3876         /**\r
3877          * Admin::action_skinremovetype()\r
3878          * \r
3879          * @param       void\r
3880          * @return      void\r
3881          */\r
3882         static private function action_skinremovetype()\r
3883         {\r
3884                 global $member, $manager, $CONF;\r
3885                 \r
3886                 $member->isAdmin() or self::disallow();\r
3887                 \r
3888                 $skinid = intRequestVar('skinid');\r
3889                 $skintype = requestVar('type');\r
3890                 \r
3891                 if ( !isValidShortName($skintype) )\r
3892                 {\r
3893                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3894                 }\r
3895                 \r
3896                 // don't allow default skinparts to be deleted\r
3897                 /* TODO: this array should be retrieved from Action class */\r
3898                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3899                 {\r
3900                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3901                 }\r
3902                 \r
3903                 self::pagehead();\r
3904                 self::$skin->parse('skinremovetype');\r
3905                 self::pagefoot();\r
3906                 return;\r
3907         }\r
3908         \r
3909         /**\r
3910          * Admin::action_skinremovetypeconfirm()\r
3911          * \r
3912          * @param       void\r
3913          * @return      void\r
3914          */\r
3915         static private function action_skinremovetypeconfirm()\r
3916         {\r
3917                 global $member, $CONF, $manager;\r
3918                 \r
3919                 $member->isAdmin() or self::disallow();\r
3920                 \r
3921                 $skinid = intRequestVar('skinid');\r
3922                 $skintype = requestVar('type');\r
3923                 \r
3924                 if ( !isValidShortName($skintype) )\r
3925                 {\r
3926                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3927                 }\r
3928                 \r
3929                 // don't allow default skinparts to be deleted\r
3930                 /* TODO: this array should be retrieved from Action class */\r
3931                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3932                 {\r
3933                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3934                 }\r
3935                 \r
3936                 $data = array(\r
3937                         'skinid'   => $skinid,\r
3938                         'skintype' => $skintype\r
3939                 );\r
3940                 $manager->notify('PreDeleteSkinPart', $data);\r
3941                 \r
3942                 // delete part\r
3943                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3944                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3945                 sql_query($query);\r
3946                 \r
3947                 $data = array(\r
3948                         'skinid'   => $skinid,\r
3949                         'skintype' => $skintype\r
3950                 );\r
3951                 $manager->notify('PostDeleteSkinPart', $data);\r
3952                 \r
3953                 self::$action_skinedit();\r
3954                 return;\r
3955         }\r
3956 \r
3957         /**\r
3958          * Admin::action_skinclone()\r
3959          * \r
3960          * @param       void\r
3961          * @return      void\r
3962          */\r
3963         static private function action_skinclone()\r
3964         {\r
3965                 global $member;\r
3966                 \r
3967                 $member->isAdmin() or self::disallow();\r
3968                 \r
3969                 $skinid = intRequestVar('skinid');\r
3970                 \r
3971                 // 1. read skin to clone\r
3972                 $skin = new Skin($skinid);\r
3973                 \r
3974                 $name = "clone_{$skin->getName()}";\r
3975                 \r
3976                 // if a skin with that name already exists:\r
3977                 if ( Skin::exists($name) )\r
3978                 {\r
3979                         $i = 1;\r
3980                         while (Skin::exists($name . $i))\r
3981                                 $i++;\r
3982                         $name .= $i;\r
3983                 }\r
3984                 \r
3985                 // 2. create skin desc\r
3986                 $newid = Skin::createNew(\r
3987                         $name,\r
3988                         $skin->getDescription(),\r
3989                         $skin->getContentType(),\r
3990                         $skin->getIncludeMode(),\r
3991                         $skin->getIncludePrefix()\r
3992                 );\r
3993                 \r
3994                 // 3. clone\r
3995                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
3996                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3997                 \r
3998                 $res = sql_query($query);\r
3999                 while ( $row = sql_fetch_assoc($res) )\r
4000                 {\r
4001                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4002                 }\r
4003                 \r
4004                 self::$action_skinoverview();\r
4005                 return;\r
4006         }\r
4007         \r
4008         /**\r
4009          * Admin::skinclonetype()\r
4010          * \r
4011          * @param       String  $skin   Skin object\r
4012          * @param       Integer $newid  ID for this clone\r
4013          * @param       String  $type   type of skin\r
4014          * @return      Void\r
4015          */\r
4016         static private function skinclonetype($skin, $newid, $type)\r
4017         {\r
4018                 $newid = intval($newid);\r
4019                 $content = $skin->getContent($type);\r
4020                 \r
4021                 if ( $content )\r
4022                 {\r
4023                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4024                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4025                         sql_query($query);\r
4026                 }\r
4027                 return;\r
4028         }\r
4029         \r
4030         /**\r
4031          * Admin::action_adminskinoverview()\r
4032          * \r
4033          * @param       void\r
4034          * @return      void\r
4035          */\r
4036         static private function action_adminskinoverview()\r
4037         {\r
4038                 global $member, $manager;\r
4039                 \r
4040                 $member->isAdmin() or self::disallow();\r
4041                 \r
4042                 self::pagehead();\r
4043                 self::$skin->parse('adminskinoverview');\r
4044                 self::pagefoot();\r
4045                 return;\r
4046         }\r
4047         \r
4048         /**\r
4049          * Admin::action_adminskinnew()\r
4050          * \r
4051          * @param       void\r
4052          * @return      void\r
4053          */\r
4054         static private function action_adminskinnew()\r
4055         {\r
4056                 global $member;\r
4057                 $member->isAdmin() or self::disallow();\r
4058                 $name = trim(postVar('name'));\r
4059                 $desc = trim(postVar('desc'));\r
4060                 \r
4061                 if ( !isValidSkinName($name) )\r
4062                 {\r
4063                         self::error(_ERROR_BADSKINNAME);\r
4064                 }\r
4065                 if ( Skin::exists($name) )\r
4066                 {\r
4067                         self::error(_ERROR_DUPSKINNAME);\r
4068                 }\r
4069                 /* TODO: $newId is not reused... */\r
4070                 $newId = Skin::createNew($name, $desc);\r
4071                 self::$action_adminskinoverview();\r
4072                 return;\r
4073         }\r
4074         \r
4075         /**\r
4076          * Admin::action_adminskinedit()\r
4077          * \r
4078          * @param       void\r
4079          * @return      void\r
4080          */\r
4081         static private function action_adminskinedit()\r
4082         {\r
4083                 global $member, $manager;\r
4084                 \r
4085                 $member->isAdmin() or self::disallow();\r
4086                 self::pagehead();\r
4087                 self::$skin->parse('adminskinedit');\r
4088                 self::pagefoot();\r
4089                 return;\r
4090         }\r
4091         \r
4092         /**\r
4093          * Admin::action_adminskineditgeneral()\r
4094          * \r
4095          * @param       void\r
4096          * @return      void\r
4097          */\r
4098         static private function action_adminskineditgeneral()\r
4099         {\r
4100                 global $member;\r
4101                 \r
4102                 $skinid = intRequestVar('skinid');\r
4103                 \r
4104                 $member->isAdmin() or self::disallow();\r
4105                 \r
4106                 $name           = postVar('name');\r
4107                 $desc           = postVar('desc');\r
4108                 $type           = postVar('type');\r
4109                 $inc_mode       = postVar('inc_mode');\r
4110                 $inc_prefix     = postVar('inc_prefix');\r
4111                 \r
4112                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4113                 \r
4114                 // 1. Some checks\r
4115                 if ( !isValidSkinName($name) )\r
4116                 {\r
4117                         self::error(_ERROR_BADSKINNAME);\r
4118                 }\r
4119                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4120                 {\r
4121                         self::error(_ERROR_DUPSKINNAME);\r
4122                 }\r
4123                 if ( !$type )\r
4124                 {\r
4125                         $type = 'text/html';\r
4126                 }\r
4127                 if ( !$inc_mode )\r
4128                 {\r
4129                         $inc_mode = 'normal';\r
4130                 }\r
4131                 // 2. Update description\r
4132                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4133                 self::$action_adminskinedit();\r
4134                 return;\r
4135         }\r
4136         \r
4137         /**\r
4138          * Admin::action_adminskinedittype()\r
4139          * \r
4140          * @param       string  $msg    message for pageheader\r
4141          * @return      void\r
4142          */\r
4143         static private function action_adminskinedittype($msg = '')\r
4144         {\r
4145                 global $member, $manager;\r
4146                 \r
4147                 $member->isAdmin() or self::disallow();\r
4148                 \r
4149                 if ( $msg )\r
4150                 {\r
4151                         self::$headMess = $msg;\r
4152                 }\r
4153                 $type = requestVar('type');\r
4154                 $type = trim($type);\r
4155                 $type = strtolower($type);\r
4156                 \r
4157                 if ( !isValidShortName($type) )\r
4158                 {\r
4159                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4160                 }\r
4161                 \r
4162                 self::pagehead();\r
4163                 self::$skin->parse('adminskinedittype');\r
4164                 self::pagefoot();\r
4165                 return;\r
4166         }\r
4167         \r
4168         /**\r
4169          * Admin::action_adminskinupdate()\r
4170          * \r
4171          * @param       void\r
4172          * @return      void\r
4173          */\r
4174         static private function action_adminskinupdate()\r
4175         {\r
4176                 global $member;\r
4177                 $skinid         = intRequestVar('skinid');\r
4178                 $content        = trim(postVar('content'));\r
4179                 $type           = postVar('type');\r
4180                 \r
4181                 $member->isAdmin() or self::disallow();\r
4182                 \r
4183                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4184                 $skin->update($type, $content);\r
4185                 self::$action_adminskinedittype(_SKIN_UPDATED);\r
4186                 return;\r
4187         }\r
4188         \r
4189         /**\r
4190          * Admin::action_adminskindelete()\r
4191          * \r
4192          * @param       void\r
4193          * @return      void\r
4194          */\r
4195         static private function action_adminskindelete()\r
4196         {\r
4197                 global $member, $manager, $CONF;\r
4198                 $member->isAdmin() or self::disallow();\r
4199                 \r
4200                 /* TODO: needless variable $skinid... */\r
4201                 $skinid = intRequestVar('skinid');\r
4202                 self::pagehead();\r
4203                 self::$skin->parse('adminskindelete');\r
4204                 self::pagefoot();\r
4205                 return;\r
4206         }\r
4207 \r
4208         /**\r
4209          * Admin::action_adminskindeleteconfirm()\r
4210          * \r
4211          * @param       void\r
4212          * @return      void\r
4213          */\r
4214         static private function action_adminskindeleteconfirm()\r
4215         {\r
4216                 global $member, $CONF, $manager;\r
4217                 $member->isAdmin() or self::disallow();\r
4218                 $skinid = intRequestVar('skinid');\r
4219                 // don't allow default skin to be deleted\r
4220                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4221                 {\r
4222                         self::error(_ERROR_DEFAULTSKIN);\r
4223                 }\r
4224                 \r
4225                 // don't allow deletion of default skins for members\r
4226                 $memberDefaults =  $member->getAdminSkin();\r
4227                 foreach ( $memberDefaults as $memID => $adminskin )\r
4228                 {\r
4229                         if ( $skinid == $adminskin )\r
4230                         {\r
4231                                 $mem = MEMBER::createFromID($memID);\r
4232                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4233                         }\r
4234                 }\r
4235                 \r
4236                 $data = array('skinid' => (integer) $skinid);\r
4237                 $manager->notify('PreDeleteAdminSkin', $data);\r
4238                 \r
4239                 // 1. delete description\r
4240                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
4241                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
4242                 sql_query($query);\r
4243                 \r
4244                 // 2. delete parts\r
4245                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
4246                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
4247                 \r
4248                 sql_query($query);\r
4249                 \r
4250                 $data = array('skinid' => intval($skinid));\r
4251                 $manager->notify('PostDeleteAdminSkin', $data);\r
4252                 self::$action_adminskinoverview();\r
4253                 return;\r
4254         }\r
4255         \r
4256         /**\r
4257          * Admin::action_adminskinremovetype()\r
4258          * \r
4259          * @param       void\r
4260          * @return      void\r
4261          */\r
4262         static private function action_adminskinremovetype()\r
4263         {\r
4264                 global $member, $manager, $CONF;\r
4265 \r
4266                 $member->isAdmin() or self::disallow();\r
4267                 \r
4268                 $skinid         = intRequestVar('skinid');\r
4269                 $skintype       = requestVar('type');\r
4270                 \r
4271                 if ( !isValidShortName($skintype) )\r
4272                 {\r
4273                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4274                 }\r
4275                 \r
4276                 self::pagehead();\r
4277                 self::$skin->parse('adminskinremovetype');\r
4278                 self::pagefoot();\r
4279                 return;\r
4280         }\r
4281         \r
4282         /**\r
4283          * Admin::action_adminskinremovetypeconfirm()\r
4284          * \r
4285          * @param       void\r
4286          * @return      void\r
4287          */\r
4288         static private function action_adminskinremovetypeconfirm()\r
4289         {\r
4290                 global $member, $CONF, $manager;\r
4291                 \r
4292                 $member->isAdmin() or self::disallow();\r
4293                 \r
4294                 $skinid         = intRequestVar('skinid');\r
4295                 $skintype       = requestVar('type');\r
4296                 \r
4297                 if ( !isValidShortName($skintype) )\r
4298                 {\r
4299                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4300                 }\r
4301                 \r
4302                 $data =array(\r
4303                         'skinid'        => $skinid,\r
4304                         'skintype'      => $skintype\r
4305                 );\r
4306                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4307                 \r
4308                 // delete part\r
4309                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4310                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4311                 sql_query($query);\r
4312                 \r
4313                 $data = array(\r
4314                         'skinid'        => $skinid,\r
4315                         'skintype'      => $skintype\r
4316                 );\r
4317                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4318                 \r
4319                 self::$action_adminskinedit();\r
4320                 return;\r
4321         }\r
4322 \r
4323         /**\r
4324          * Admin::action_adminskinclone()\r
4325          * \r
4326          * @param       void\r
4327          * @return      void\r
4328          */\r
4329         static private function action_adminskinclone()\r
4330         {\r
4331                 global $member;\r
4332                 \r
4333                 $member->isAdmin() or self::disallow();\r
4334                 \r
4335                 $skinid = intRequestVar('skinid');\r
4336                 \r
4337                 // 1. read skin to clone\r
4338                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4339                 $name = "clone_{$skin->getName()}";\r
4340                 \r
4341                 // if a skin with that name already exists:\r
4342                 if ( Skin::exists($name) )\r
4343                 {\r
4344                         $i = 1;\r
4345                         while ( Skin::exists($name . $i) )\r
4346                         {\r
4347                                 $i++;\r
4348                         }\r
4349                         $name .= $i;\r
4350                 }\r
4351                 \r
4352                 // 2. create skin desc\r
4353                 $newid = Skin::createNew(\r
4354                         $name,\r
4355                         $skin->getDescription(),\r
4356                         $skin->getContentType(),\r
4357                         $skin->getIncludeMode(),\r
4358                         $skin->getIncludePrefix()\r
4359                 );\r
4360                 \r
4361                 $query = "SELECT stype %s FROM WHERE sdesc=%d;";\r
4362                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4363                 \r
4364                 $res = sql_query($query);\r
4365                 while ( $row = sql_fetch_assoc($res) )\r
4366                 {\r
4367                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4368                 }\r
4369                 self::$action_adminskinoverview();\r
4370                 return;\r
4371         }\r
4372         \r
4373         /**\r
4374          * Admin::adminskinclonetype()\r
4375          * \r
4376          * @param       string  $skin   an instance of Skin class\r
4377          * @param       integer $newid  ID for new skin\r
4378          * @param       string  $type   skin type\r
4379          * @return      void\r
4380          */\r
4381         static private function adminskinclonetype($skin, $newid, $type)\r
4382         {\r
4383                 $content = $skin->getContentFromDB($type);\r
4384                 \r
4385                 if ( $content )\r
4386                 {\r
4387                         $content        = sql_real_escape_string($content);\r
4388                         $type           = sql_real_escape_string($type);\r
4389                         \r
4390                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4391                         $query = sprintf(sql_table('skin'), (integer) $newid, $content, $type);\r
4392                         sql_query($query);\r
4393                 }\r
4394                 return;\r
4395         }\r
4396         \r
4397         /**\r
4398          * Admin::action_adminskinieoverview()\r
4399          * \r
4400          * @param       void\r
4401          * @return      void\r
4402          */\r
4403         static private function action_adminskinieoverview()\r
4404         {\r
4405                 global $member, $DIR_LIBS, $manager;\r
4406                 \r
4407                 $member->isAdmin() or self::disallow();\r
4408                 \r
4409                 // load skinie class\r
4410                 include_once($DIR_LIBS . 'skinie.php');\r
4411                 \r
4412                 self::pagehead();\r
4413                 self::$skin->parse('adminskinieoverview');\r
4414                 self::pagefoot();\r
4415                 return;\r
4416         }\r
4417 \r
4418         /**\r
4419          * Admin::action_adminskinieimport()\r
4420          * \r
4421          * @param       void\r
4422          * @return      void\r
4423          */\r
4424         static private function action_adminskinieimport()\r
4425         {\r
4426                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4427                 \r
4428                 $member->isAdmin() or self::disallow();\r
4429                 \r
4430                 // load skinie class\r
4431                 include_once($DIR_LIBS . 'skinie.php');\r
4432                 \r
4433                 $skinFileRaw    = postVar('skinfile');\r
4434                 $mode                   = postVar('mode');\r
4435                 \r
4436                 $importer = new SKINIMPORT();\r
4437                 \r
4438                 // get full filename\r
4439                 if ( $mode == 'file' )\r
4440                 {\r
4441                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4442                         \r
4443                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4444                         if ( !file_exists($skinFile) )\r
4445                         {\r
4446                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4447                         }\r
4448                 }\r
4449                 else\r
4450                 {\r
4451                         $skinFile = $skinFileRaw;\r
4452                 }\r
4453                 \r
4454                 // read only metadata\r
4455                 $error = $importer->readFile($skinFile, 1);\r
4456                 if ( $error )\r
4457                 {\r
4458                         self::error($error);\r
4459                 }\r
4460                 \r
4461                 /* TODO: we should consider to use the other way instead of this */\r
4462                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4463                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4464                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4465                 \r
4466                 // clashes\r
4467                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4468                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4469                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4470                 /* TODO: we should consider to use the other way instead of this */\r
4471                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4472                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4473                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4474                 \r
4475                 self::pagehead();\r
4476                 self::$skin->parse('adminskinieimport');\r
4477                 self::pagefoot();\r
4478                 return;\r
4479         }\r
4480         \r
4481         /**\r
4482          * Admin::action_adminskiniedoimport()\r
4483          * \r
4484          * @param       void\r
4485          * @return      void\r
4486          */\r
4487         static private function action_adminskiniedoimport()\r
4488         {\r
4489                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4490                 \r
4491                 $member->isAdmin() or self::disallow();\r
4492                 \r
4493                 // load skinie class\r
4494                 include_once($DIR_LIBS . 'skinie.php');\r
4495                 \r
4496                 $skinFileRaw    = postVar('skinfile');\r
4497                 $mode                   = postVar('mode');\r
4498                 $allowOverwrite = intPostVar('overwrite');\r
4499                 \r
4500                 // get full filename\r
4501                 if ( $mode == 'file' )\r
4502                 {\r
4503                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4504                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4505                         if ( !file_exists($skinFile) )\r
4506                         {\r
4507                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4508                         }\r
4509                 }\r
4510                 else\r
4511                 {\r
4512                         $skinFile = $skinFileRaw;\r
4513                 }\r
4514                 \r
4515                 $importer = new SKINIMPORT();\r
4516                 \r
4517                 $error = $importer->readFile($skinFile);\r
4518                 if ( $error )\r
4519                 {\r
4520                         self::error($error);\r
4521                 }\r
4522                 \r
4523                 $error = $importer->writeToDatabase($allowOverwrite);\r
4524                 if ( $error )\r
4525                 {\r
4526                         self::error($error);\r
4527                 }\r
4528                 \r
4529                 /* TODO: we should consider to use the other way instead of this */\r
4530                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4531                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4532                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4533                 \r
4534                 self::pagehead();\r
4535                 self::$skin->parse('adminskiniedoimport');\r
4536                 self::pagefoot();\r
4537                 return;\r
4538         }\r
4539 \r
4540         /**\r
4541          * Admin::action_adminskinieexport()\r
4542          * \r
4543          * @param       void\r
4544          * @return      void\r
4545          */\r
4546         static private function action_adminskinieexport()\r
4547         {\r
4548                 global $member, $DIR_PLUGINS;\r
4549                 \r
4550                 $member->isAdmin() or self::disallow();\r
4551                 \r
4552                 // load skinie class\r
4553                 $aSkins = requestIntArray('skin');\r
4554                 if (!is_array($aSkins)) {\r
4555                         $aSkins = array();\r
4556                 }\r
4557                 $skinList = array_keys($aSkins);\r
4558                 \r
4559                 $aTemplates = requestIntArray('template');\r
4560                 if (!is_array($aTemplates))\r
4561                 {\r
4562                         $aTemplates = array();\r
4563                 }\r
4564                 $templateList = array_keys($aTemplates);\r
4565                 \r
4566                 $info = postVar('info');\r
4567                 \r
4568                 $exporter = new SkinEXPORT();\r
4569                 foreach ( $skinList as $skinId )\r
4570                 {\r
4571                         $exporter->addSkin($skinId);\r
4572                 }\r
4573                 foreach ( $templateList as $templateId )\r
4574                 {\r
4575                         $exporter->addTemplate($templateId);\r
4576                 }\r
4577                 $exporter->setInfo($info);\r
4578                 $exporter->export();\r
4579                 return;\r
4580         }\r
4581         \r
4582         /**\r
4583          * Admin::action_settingsedit()\r
4584          * \r
4585          * @param       Void\r
4586          * @return      Void\r
4587          */\r
4588         static private function action_settingsedit()\r
4589         {\r
4590                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4591                 \r
4592                 $member->isAdmin() or self::disallow();\r
4593                 \r
4594                 self::pagehead();\r
4595                 self::$skin->parse('settingsedit');\r
4596                 self::pagefoot();\r
4597                 return;\r
4598         }\r
4599         \r
4600         /**\r
4601          * Admin::action_settingsupdate()\r
4602          * Update $CONFIG and redirect\r
4603          * \r
4604          * @param       void\r
4605          * @return      void\r
4606          */\r
4607         static private function action_settingsupdate()\r
4608         {\r
4609                 global $member, $CONF;\r
4610                 \r
4611                 $member->isAdmin() or self::disallow();\r
4612                 \r
4613                 // check if email address for admin is valid\r
4614                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4615                 {\r
4616                         self::error(_ERROR_BADMAILADDRESS);\r
4617                 }\r
4618                 \r
4619                 // save settings\r
4620                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4621                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4622                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4623                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4624                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4625                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4626                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4627                 self::updateConfig('Locale',                    postVar('Locale'));\r
4628                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4629                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4630                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4631                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4632                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4633                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4634                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4635                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4636                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4637                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4638                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4639                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4640                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4641                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4642                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4643                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4644                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4645                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4646                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4647                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4648                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4649                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4650                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4651                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4652                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4653                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4654                 \r
4655                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4656                 // note that when changing cookie settings, this redirect might cause the user\r
4657                 // to have to log in again.\r
4658                 getConfig();\r
4659                 redirect($CONF['AdminURL'] . '?action=manage');\r
4660                 return;\r
4661         }\r
4662         \r
4663         /**\r
4664          * Admin::action_systemoverview()\r
4665          * Output system overview\r
4666          * \r
4667          * @param       void\r
4668          * @return      void\r
4669          */\r
4670         static private function action_systemoverview()\r
4671         {\r
4672                 self::pagehead();\r
4673                 self::$skin->parse('systemoverview');\r
4674                 self::pagefoot();\r
4675                 return;\r
4676         }\r
4677         \r
4678         /**\r
4679          * Admin::updateConfig()\r
4680          * \r
4681          * @param       string  $name   \r
4682          * @param       string  $val    \r
4683          * @return      integer return the ID in which the latest query posted\r
4684          */\r
4685         static private function updateConfig($name, $val)\r
4686         {\r
4687                 $name = sql_real_escape_string($name);\r
4688                 $val = trim(sql_real_escape_string($val));\r
4689                 \r
4690                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4691                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4692                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4693                 return sql_insert_id();\r
4694         }\r
4695         \r
4696         /**\r
4697          * Admin::error()\r
4698          * Error message\r
4699          * \r
4700          * @param       string  $msg    message that will be shown\r
4701          * @return      void\r
4702          */\r
4703         static private function error($msg)\r
4704         {\r
4705                 self::pagehead();\r
4706                 self::$skin->parse('adminerrorpage');\r
4707                 self::pagefoot();\r
4708                 return;\r
4709         }\r
4710         \r
4711         /**\r
4712          * Admin::disallow()\r
4713          * add error log and show error page \r
4714          * \r
4715          * @param       void\r
4716          * @return      void\r
4717          */\r
4718         static private function disallow()\r
4719         {\r
4720                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4721                 self::error(_ERROR_DISALLOWED);\r
4722                 return;\r
4723         }\r
4724         \r
4725         /**\r
4726          * Admin::pagehead()\r
4727          * Output admin page head\r
4728          * \r
4729          * @param       void\r
4730          * @return      void\r
4731          */\r
4732         static private function pagehead($extrahead = '')\r
4733         {\r
4734                 global $member, $nucleus, $CONF, $manager;\r
4735 \r
4736                 if ( self::existsSkinContents('pagehead') )\r
4737                 {\r
4738                         if ( isset($extrahead) && !empty($extrahead) )\r
4739                         {\r
4740                         self::$extrahead = $extrahead;\r
4741                         }\r
4742                         self::$skin->parse('pagehead');\r
4743                 }\r
4744                 else\r
4745                 {\r
4746                         $data = array(\r
4747                                 'extrahead'     => &$extrahead,\r
4748                                 'action'        => self::$action\r
4749                         );\r
4750                         \r
4751                         $manager->notify('AdminPrePageHead', $data);\r
4752                         \r
4753                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4754                         \r
4755                         /*\r
4756                          * TODO: obsoleted\r
4757                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4758                         {\r
4759                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4760                                 $CONF['AdminCSS'] = 'original';\r
4761                         }\r
4762                         */\r
4763                         \r
4764                         /* HTTP 1.1 application for no caching */\r
4765                         header("Cache-Control: no-cache, must-revalidate");\r
4766                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4767                         \r
4768                         $root_element = 'html';\r
4769                         $charset = i18n::get_current_charset();\r
4770                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4771                         $xml_version_info = self::$xml_version_info;\r
4772                         $formal_public_identifier = self::$formal_public_identifier;\r
4773                         $system_identifier = self::$system_identifier;\r
4774                         $xhtml_namespace = self::$xhtml_namespace;\r
4775                         \r
4776                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4777                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4778                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4779                         echo "<head>\n";\r
4780                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4781                         /*\r
4782                          * TODO: obsoleted\r
4783                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4784                         */\r
4785                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4786                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4787                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4788                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4789                         echo "{$extrahead}\n";\r
4790                         echo "</head>\n\n";\r
4791                         echo "<body>\n";\r
4792                         echo "<div id=\"adminwrapper\">\n";\r
4793                         echo "<div class=\"header\">\n";\r
4794                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4795                         echo "</div>\n";\r
4796                         echo "<div id=\"container\">\n";\r
4797                         echo "<div id=\"content\">\n";\r
4798                         echo "<div class=\"loginname\">\n";\r
4799                         if ( $member->isLoggedIn() )\r
4800                         {\r
4801                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4802                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4803                         }\r
4804                         else\r
4805                         {\r
4806                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4807                         }\r
4808                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4809                         echo '(';\r
4810                         \r
4811                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4812                         {\r
4813                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4814                         }\r
4815                         else\r
4816                         {\r
4817                                 $codenamestring = '';\r
4818                         }\r
4819                         \r
4820                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4821                         {\r
4822                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4823                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4824                                 \r
4825                                 $newestVersion = getLatestVersion();\r
4826                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4827                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4828                                 \r
4829                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4830                                 {\r
4831                                         echo "<br />\n";\r
4832                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4833                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4834                                         echo "</a>";\r
4835                                 }\r
4836                         }\r
4837                         else\r
4838                         {\r
4839                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4840                         }\r
4841                         echo ')';\r
4842                         echo '</div>';\r
4843                 }\r
4844                 return;\r
4845         }\r
4846         \r
4847         /**\r
4848          * Admin::pagefoot()\r
4849          * Output admin page foot include quickmenu\r
4850          * \r
4851          * @param       void\r
4852          * @return      void\r
4853          */\r
4854         static private function pagefoot()\r
4855         {\r
4856                 global $action, $member, $manager;\r
4857                 \r
4858                 if ( self::existsSkinContents('pagefoot') )\r
4859                 {\r
4860                         self::$skin->parse('pagefoot');\r
4861                         exit;\r
4862                 }\r
4863                 else\r
4864                 {\r
4865                         $data = array(\r
4866                                 'action' => self::$action\r
4867                         );\r
4868                         \r
4869                         $manager->notify('AdminPrePageFoot', $data);\r
4870                         \r
4871                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4872                         {\r
4873                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4874                                 echo "<ul>\n";\r
4875                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4876                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4877                                 echo "</ul>\n";\r
4878                         }\r
4879                         \r
4880                         echo "<div class=\"foot\">\n";\r
4881                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4882                         echo '-';\r
4883                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4884                         echo "</div>\n";\r
4885                         \r
4886                         echo "<div id=\"quickmenu\">\n";\r
4887                         \r
4888                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4889                         {\r
4890                                 echo "<ul>\n";\r
4891                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4892                                 echo "</ul>\n";\r
4893                                 \r
4894                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4895                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4896                                 echo "<p>\n";\r
4897                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4898                                 \r
4899                                 $showAll = requestVar('showall');\r
4900                                 \r
4901                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4902                                 {\r
4903                                         // Super-Admins have access to all blogs! (no add item support though)\r
4904                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4905                                         $query = sprintf($query, sql_table('blog'));\r
4906                                 }\r
4907                                 else\r
4908                                 {\r
4909                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4910                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4911                                 }\r
4912                                 $template['name']               = 'blogid';\r
4913                                 $template['tabindex']   = 15000;\r
4914                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4915                                 $template['selected']   = -1;\r
4916                                 $template['shorten']    = 10;\r
4917                                 $template['shortenel']  = '';\r
4918                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4919                                 showlist($query, 'select', $template);\r
4920                                 \r
4921                                 echo "</p>\n";\r
4922                                 echo "</form>\n";\r
4923                                 \r
4924                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4925                                 echo "<ul>\n";\r
4926                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4927                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4928                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4929                                 echo "</ul>\n";\r
4930                                 \r
4931                                 if ( $member->isAdmin() )\r
4932                                 {\r
4933                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4934                                         echo "<ul>\n";\r
4935                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4936                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4937                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4938                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4939                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4940                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4941                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4942                                         echo "</ul>\n";\r
4943                                         \r
4944                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4945                                         echo "<ul>\n";\r
4946                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4947                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4948                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4949                                         echo "</ul>\n";\r
4950                                 }\r
4951                                 \r
4952                                 $data = array('options' => array());\r
4953                                 \r
4954                                 $manager->notify('QuickMenu', $data);\r
4955                                 \r
4956                                 if ( count($data['options']) > 0 )\r
4957                                 {\r
4958                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4959                                         echo "<ul>\n";\r
4960                                         foreach ( $data['options'] as $option )\r
4961                                         {\r
4962                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
4963                                         }\r
4964                                         echo "</ul>\n";\r
4965                                 }\r
4966                         }\r
4967                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
4968                         {\r
4969                         \r
4970                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
4971                         }\r
4972                         else\r
4973                         {\r
4974                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
4975                         }\r
4976                         \r
4977                         echo "<!-- quickmenu -->\n";\r
4978                         echo "</div>\n";\r
4979                         \r
4980                         echo "<!-- content -->\n";\r
4981                         echo "</div>\n";\r
4982                         \r
4983                         echo "<!-- container -->\n";\r
4984                         echo "</div>\n";\r
4985                         \r
4986                         echo "<!-- adminwrapper -->\n";\r
4987                         echo "</div>\n";\r
4988                         \r
4989                         echo "</body>\n";\r
4990                         echo "</html>\n";\r
4991                 }\r
4992                 return;\r
4993         }\r
4994         \r
4995         /**\r
4996          * Admin::action_bookmarklet()\r
4997          * \r
4998          * @param       void\r
4999          * @return      void\r
5000          */\r
5001         static private function action_bookmarklet()\r
5002         {\r
5003                 global $member, $manager;\r
5004                 \r
5005                 $member->teamRights($blogid) or self::disallow();\r
5006                 \r
5007                 $blogid = intRequestVar('blogid');\r
5008                 \r
5009                 self::pagehead();\r
5010                 self::$skin->parse('bookmarklet');\r
5011                 self::pagefoot();\r
5012                 return;\r
5013         }\r
5014         \r
5015         /**\r
5016          * Admin::action_actionlog()\r
5017          * \r
5018          * @param       void\r
5019          * @return      void\r
5020          */\r
5021         static private function action_actionlog()\r
5022         {\r
5023                 global $member, $manager;\r
5024                 \r
5025                 $member->isAdmin() or self::disallow();\r
5026                 \r
5027                 self::pagehead();\r
5028                 self::$skin->parse('actionlog');\r
5029                 self::pagefoot();\r
5030                 return;\r
5031         }\r
5032         \r
5033         /**\r
5034          * Admin::action_banlist()\r
5035          * \r
5036          * @param       void\r
5037          * @return      void\r
5038          */\r
5039         static private function action_banlist()\r
5040         {\r
5041                 global $member, $manager;\r
5042                 \r
5043                 $member->blogAdminRights($blogid) or self::disallow();\r
5044                 \r
5045                 $blogid = intRequestVar('blogid');\r
5046                 \r
5047                 self::pagehead();\r
5048                 self::$skin->parse('banlist');\r
5049                 self::pagefoot();\r
5050                 return;\r
5051         }\r
5052         \r
5053         /**\r
5054          * Admin::action_banlistdelete()\r
5055          * \r
5056          * @param       void\r
5057          * @return      void\r
5058          */\r
5059         static private function action_banlistdelete()\r
5060         {\r
5061                 global $member, $manager;\r
5062                 \r
5063                 $blogid = intRequestVar('blogid');\r
5064                 $member->blogAdminRights($blogid) or self::disallow();\r
5065                 \r
5066                 self::pagehead();\r
5067                 self::$skin->parse('banlistdelete');\r
5068                 self::pagefoot();\r
5069                 return;\r
5070         }\r
5071         \r
5072         /**\r
5073          * Admin::action_banlistdeleteconfirm()\r
5074          * \r
5075          * @param       void\r
5076          * @return      void\r
5077          */\r
5078         static private function action_banlistdeleteconfirm()\r
5079         {\r
5080                 global $member, $manager;\r
5081                 \r
5082                 $member->blogAdminRights($blogid) or self::disallow();\r
5083                 \r
5084                 $blogid         = intPostVar('blogid');\r
5085                 $allblogs       = postVar('allblogs');\r
5086                 $iprange        = postVar('iprange');\r
5087                 \r
5088                 $deleted = array();\r
5089                 \r
5090                 if ( !$allblogs )\r
5091                 {\r
5092                         if ( Ban::removeBan($blogid, $iprange) )\r
5093                         {\r
5094                                 array_push($deleted, $blogid);\r
5095                         }\r
5096                 }\r
5097                 else\r
5098                 {\r
5099                         // get blogs fot which member has admin rights\r
5100                         $adminblogs = $member->getAdminBlogs();\r
5101                         foreach ($adminblogs as $blogje)\r
5102                         {\r
5103                                 if ( Ban::removeBan($blogje, $iprange) )\r
5104                                 {\r
5105                                         array_push($deleted, $blogje);\r
5106                                 }\r
5107                         }\r
5108                 }\r
5109                 \r
5110                 if ( sizeof($deleted) == 0 )\r
5111                 {\r
5112                         self::error(_ERROR_DELETEBAN);\r
5113                 }\r
5114                 \r
5115                 self::pagehead();\r
5116                 self::$skin->parse('banlistdeleteconfirm');\r
5117                 self::pagefoot();\r
5118                 return;\r
5119         }\r
5120         \r
5121         /**\r
5122          * Admin::action_banlistnewfromitem()\r
5123          * \r
5124          * @param       void\r
5125          * @return      void\r
5126          */\r
5127         static private function action_banlistnewfromitem()\r
5128         {\r
5129                 self::$action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5130                 return;\r
5131         }\r
5132         \r
5133         /**\r
5134          * Admin::action_banlistnew()\r
5135          * \r
5136          * @param       integer $blogid ID for weblog\r
5137          * @return      void\r
5138          */\r
5139         static private function action_banlistnew($blogid = '')\r
5140         {\r
5141                 global $member, $manager;\r
5142                 \r
5143                 if ( $blogid == '' )\r
5144                 {\r
5145                         $blogid = intRequestVar('blogid');\r
5146                 }\r
5147                 \r
5148                 $ip = requestVar('ip');\r
5149                 \r
5150                 $member->blogAdminRights($blogid) or self::disallow();\r
5151                 \r
5152                 /* TODO: we should consider to use the other way instead of this */\r
5153                 $_REQUEST['blogid'] = $blogid;          \r
5154                 \r
5155                 self::pagehead();\r
5156                 self::$skin->parse('banlistnew');\r
5157                 self::pagefoot();\r
5158                 \r
5159                 return;\r
5160         }\r
5161 \r
5162         /**\r
5163          * Admin::action_banlistadd()\r
5164          * \r
5165          * @param       void\r
5166          * @return      void\r
5167          */\r
5168         static private function action_banlistadd()\r
5169         {\r
5170                 global $member;\r
5171                 \r
5172                 $blogid         = intPostVar('blogid');\r
5173                 $allblogs       = postVar('allblogs');\r
5174                 $iprange        = postVar('iprange');\r
5175                 \r
5176                 if ( $iprange == "custom" )\r
5177                 {\r
5178                         $iprange = postVar('customiprange');\r
5179                 }\r
5180                 $reason   = postVar('reason');\r
5181                 \r
5182                 $member->blogAdminRights($blogid) or self::disallow();\r
5183                 \r
5184                 // TODO: check IP range validity\r
5185                 \r
5186                 if ( !$allblogs )\r
5187                 {\r
5188                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5189                         {\r
5190                                 self::error(_ERROR_ADDBAN);\r
5191                         }\r
5192                 }\r
5193                 else\r
5194                 {\r
5195                         // get blogs fot which member has admin rights\r
5196                         $adminblogs = $member->getAdminBlogs();\r
5197                         $failed = 0;\r
5198                         foreach ($adminblogs as $blogje)\r
5199                         {\r
5200                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5201                                 {\r
5202                                         $failed = 1;\r
5203                                 }\r
5204                         }\r
5205                         if ( $failed )\r
5206                         {\r
5207                                 self::error(_ERROR_ADDBAN);\r
5208                         }\r
5209                 }\r
5210                 self::$action_banlist();\r
5211                 return;\r
5212         }\r
5213         \r
5214         /**\r
5215          * Admin::action_clearactionlog()\r
5216          * \r
5217          * @param       void\r
5218          * @return      void\r
5219          */\r
5220         static private function action_clearactionlog()\r
5221         {\r
5222                 global $member;\r
5223                 \r
5224                 $member->isAdmin() or self::disallow();\r
5225                 \r
5226                 ActionLog::clear();\r
5227                 \r
5228                 self::$action_manage(_MSG_ACTIONLOGCLEARED);\r
5229                 return;\r
5230         }\r
5231         \r
5232         /**\r
5233          * Admin::action_backupoverview()\r
5234          * \r
5235          * @param       void\r
5236          * @return      void\r
5237          */\r
5238         static private function action_backupoverview()\r
5239         {\r
5240                 global $member, $manager;\r
5241                 \r
5242                 $member->isAdmin() or self::disallow();\r
5243                 \r
5244                 self::pagehead();\r
5245                 self::$skin->parse('backupoverview');\r
5246                 self::pagefoot();\r
5247                 return;\r
5248         }\r
5249 \r
5250         /**\r
5251          * Admin::action_backupcreate()\r
5252          * create file for backup\r
5253          * \r
5254          * @param               void\r
5255          * @return      void\r
5256          * \r
5257          */\r
5258         static private function action_backupcreate()\r
5259         {\r
5260                 global $member, $DIR_LIBS;\r
5261                 \r
5262                 $member->isAdmin() or self::disallow();\r
5263                 \r
5264                 // use compression ?\r
5265                 $useGzip = (integer) postVar('gzip');\r
5266                 \r
5267                 include($DIR_LIBS . 'backup.php');\r
5268                 \r
5269                 // try to extend time limit\r
5270                 // (creating/restoring dumps might take a while)\r
5271                 @set_time_limit(1200);\r
5272                 \r
5273                 Backup::do_backup($useGzip);\r
5274                 exit;\r
5275         }\r
5276         \r
5277         /**\r
5278          * Admin::action_backuprestore()\r
5279          * restoring from uploaded file\r
5280          * \r
5281          * @param               void\r
5282          * @return      void\r
5283          */\r
5284         static private function action_backuprestore()\r
5285         {\r
5286                 global $member, $DIR_LIBS;\r
5287                 \r
5288                 $member->isAdmin() or self::disallow();\r
5289                 \r
5290                 if ( intPostVar('letsgo') != 1 )\r
5291                 {\r
5292                         self::error(_ERROR_BACKUP_NOTSURE);\r
5293                 }\r
5294                 \r
5295                 include($DIR_LIBS . 'backup.php');\r
5296                 \r
5297                 // try to extend time limit\r
5298                 // (creating/restoring dumps might take a while)\r
5299                 @set_time_limit(1200);\r
5300                 \r
5301                 $message = Backup::do_restore();\r
5302                 if ( $message != '' )\r
5303                 {\r
5304                         self::error($message);\r
5305                 }\r
5306                 self::pagehead();\r
5307                 self::$skin->parse('backuprestore');\r
5308                 self::pagefoot();\r
5309                 return;\r
5310         }\r
5311         \r
5312         /**\r
5313          * Admin::action_pluginlist()\r
5314          * output the list of installed plugins\r
5315          * \r
5316          * @param       void\r
5317          * @return      void\r
5318          * \r
5319          */\r
5320         static private function action_pluginlist()\r
5321         {\r
5322                 global $DIR_PLUGINS, $member, $manager;\r
5323                 \r
5324                 // check if allowed\r
5325                 $member->isAdmin() or self::disallow();\r
5326                 \r
5327                 self::pagehead();\r
5328                 self::$skin->parse('pluginlist');\r
5329                 self::pagefoot();\r
5330                 return;\r
5331         }\r
5332         \r
5333         /**\r
5334          * Admin::action_pluginhelp()\r
5335          * \r
5336          * @param       void\r
5337          * @return      void\r
5338          */\r
5339         static private function action_pluginhelp()\r
5340         {\r
5341                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5342                 \r
5343                 // check if allowed\r
5344                 $member->isAdmin() or self::disallow();\r
5345                 \r
5346                 $plugid = intGetVar('plugid');\r
5347                 \r
5348                 if ( !$manager->pidInstalled($plugid) )\r
5349                 {\r
5350                         self::error(_ERROR_NOSUCHPLUGIN);\r
5351                 }\r
5352                 \r
5353                 self::pagehead();\r
5354                 self::$skin->parse('pluginhelp');\r
5355                 self::pagefoot();\r
5356                 return;\r
5357         }\r
5358         \r
5359         /**\r
5360          * Admin::action_pluginadd()\r
5361          * \r
5362          * @param       Void\r
5363          * @return      Void\r
5364          * \r
5365          */\r
5366         static private function action_pluginadd()\r
5367         {\r
5368                 global $member, $manager, $DIR_PLUGINS;\r
5369                 \r
5370                 // check if allowed\r
5371                 $member->isAdmin() or self::disallow();\r
5372                 \r
5373                 $name = postVar('filename');\r
5374                 \r
5375                 if ( $manager->pluginInstalled($name) )\r
5376                 {\r
5377                         self::error(_ERROR_DUPPLUGIN);\r
5378                 }\r
5379                 \r
5380                 if ( !checkPlugin($name) )\r
5381                 {\r
5382                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5383                 }\r
5384                 \r
5385                 // get number of currently installed plugins\r
5386                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5387                 $numCurrent = sql_num_rows($res);\r
5388                 \r
5389                 // plugin will be added as last one in the list\r
5390                 $newOrder = $numCurrent + 1;\r
5391                 \r
5392                 $data = array('file' => &$name);\r
5393                 $manager->notify('PreAddPlugin', $data);\r
5394                 \r
5395                 // do this before calling getPlugin (in case the plugin id is used there)\r
5396                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5397                 $query = sprintf(sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5398                 sql_query($query);\r
5399                 $iPid = sql_insert_id();\r
5400                 \r
5401                 $manager->clearCachedInfo('installedPlugins');\r
5402                 \r
5403                 // Load the plugin for condition checking and instalation\r
5404                 $plugin =& $manager->getPlugin($name);\r
5405                 \r
5406                 // check if it got loaded (could have failed)\r
5407                 if ( !$plugin )\r
5408                 {\r
5409                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5410                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5411                         \r
5412                         sql_query($query);\r
5413                         \r
5414                         $manager->clearCachedInfo('installedPlugins');\r
5415                         self::error(_ERROR_PLUGIN_LOAD);\r
5416                 }\r
5417                 \r
5418                 // check if plugin needs a newer Nucleus version\r
5419                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5420                 {\r
5421                         // uninstall plugin again...\r
5422                         self::deleteOnePlugin($plugin->getID());\r
5423                         \r
5424                         // ...and show error\r
5425                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5426                 }\r
5427                 \r
5428                 // check if plugin needs a newer Nucleus version\r
5429                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5430                 {\r
5431                         // uninstall plugin again...\r
5432                         self::deleteOnePlugin($plugin->getID());\r
5433                         \r
5434                         // ...and show error\r
5435                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5436                 }\r
5437                 \r
5438                 $pluginList = $plugin->getPluginDep();\r
5439                 foreach ( $pluginList as $pluginName )\r
5440                 {\r
5441                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5442                         if (sql_num_rows($res) == 0)\r
5443                         {\r
5444                                 // uninstall plugin again...\r
5445                                 self::deleteOnePlugin($plugin->getID());\r
5446                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5447                         }\r
5448                 }\r
5449                 \r
5450                 // call the install method of the plugin\r
5451                 $plugin->install();\r
5452                 \r
5453                 $data = array('plugin' => &$plugin);\r
5454                 $manager->notify('PostAddPlugin', $data);\r
5455                 \r
5456                 // update all events\r
5457                 self::$action_pluginupdate();\r
5458                 return;\r
5459         }\r
5460         \r
5461         /**\r
5462          * ADMIN:action_pluginupdate():\r
5463          * \r
5464          * @param       Void\r
5465          * @return      Void\r
5466          * \r
5467          */\r
5468         static private function action_pluginupdate()\r
5469         {\r
5470                 global $member, $manager, $CONF;\r
5471                 \r
5472                 // check if allowed\r
5473                 $member->isAdmin() or self::disallow();\r
5474                 \r
5475                 // delete everything from plugin_events\r
5476                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5477                 \r
5478                 // loop over all installed plugins\r
5479                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5480                 while ( $o = sql_fetch_object($res) )\r
5481                 {\r
5482                         $pid  =  $o->pid;\r
5483                         $plug =& $manager->getPlugin($o->pfile);\r
5484                         if ( $plug )\r
5485                         {\r
5486                                 $eventList = $plug->getEventList();\r
5487                                 foreach ( $eventList as $eventName )\r
5488                                 {\r
5489                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5490                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5491                                         sql_query($query);\r
5492                                 }\r
5493                         }\r
5494                 }\r
5495                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5496                 return;\r
5497         }\r
5498         \r
5499         /**\r
5500          * Admin::action_plugindelete()\r
5501          * \r
5502          * @param       void\r
5503          * @return      void\r
5504          */\r
5505         static private function action_plugindelete()\r
5506         {\r
5507                 global $member, $manager;\r
5508                 \r
5509                 // check if allowed\r
5510                 $member->isAdmin() or self::disallow();\r
5511                 \r
5512                 $pid = intGetVar('plugid');\r
5513                 \r
5514                 if ( !$manager->pidInstalled($pid) )\r
5515                 {\r
5516                         self::error(_ERROR_NOSUCHPLUGIN);\r
5517                 }\r
5518                 \r
5519                 self::pagehead();\r
5520                 self::$skin->parse('plugindelete');\r
5521                 self::pagefoot();\r
5522                 return;\r
5523         }\r
5524 \r
5525         /**\r
5526          * Admin::action_plugindeleteconfirm()\r
5527          * \r
5528          * @param       void\r
5529          * @return      void\r
5530          */\r
5531         static private function action_plugindeleteconfirm()\r
5532         {\r
5533                 global $member, $manager, $CONF;\r
5534                 \r
5535                 // check if allowed\r
5536                 $member->isAdmin() or self::disallow();\r
5537                 \r
5538                 $pid = intPostVar('plugid');\r
5539                 \r
5540                 $error = self::deleteOnePlugin($pid, 1);\r
5541                 if ( $error )\r
5542                 {\r
5543                         self::error($error);\r
5544                 }\r
5545                 \r
5546                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5547                 return;\r
5548         }\r
5549         \r
5550         /**\r
5551          * Admin::\r
5552          * \r
5553          * @param       void\r
5554          * @return      void\r
5555          */\r
5556         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5557         {\r
5558                 global $manager;\r
5559                 \r
5560                 $pid = intval($pid);\r
5561                 \r
5562                 if ( !$manager->pidInstalled($pid) )\r
5563                 {\r
5564                         return _ERROR_NOSUCHPLUGIN;\r
5565                 }\r
5566                 \r
5567                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5568                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5569                 $name = quickQuery($query);\r
5570                 \r
5571                 // check dependency before delete\r
5572                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5573                 while ($o = sql_fetch_object($res))\r
5574                 {\r
5575                         $plug =& $manager->getPlugin($o->pfile);\r
5576                         if ( $plug )\r
5577                         {\r
5578                                 $depList = $plug->getPluginDep();\r
5579                                 foreach ( $depList as $depName )\r
5580                                 {\r
5581                                         if ( $name == $depName )\r
5582                                         {\r
5583                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5584                                         }\r
5585                                 }\r
5586                         }\r
5587                 }\r
5588                 \r
5589                 $data = array('plugid' => $pid);\r
5590                 $manager->notify('PreDeletePlugin', $data);\r
5591                 \r
5592                 // call the unInstall method of the plugin\r
5593                 if ( $callUninstall )\r
5594                 {\r
5595                         $plugin =& $manager->getPlugin($name);\r
5596                         if ( $plugin )\r
5597                         {\r
5598                                 $plugin->unInstall();\r
5599                         }\r
5600                 }\r
5601                 \r
5602                 // delete all subscriptions\r
5603                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5604                 \r
5605                 // delete all options\r
5606                 // get OIDs from plugin_option_desc\r
5607                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5608                 $aOIDs = array();\r
5609                 while ($o = sql_fetch_object($res))\r
5610                 {\r
5611                         array_push($aOIDs, $o->oid);\r
5612                 }\r
5613                 \r
5614                 // delete from plugin_option and plugin_option_desc\r
5615                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5616                 if (count($aOIDs) > 0)\r
5617                 {\r
5618                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5619                 }\r
5620                 \r
5621                 // update order numbers\r
5622                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5623                 $o = sql_fetch_object($res);\r
5624                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5625                 \r
5626                 // delete row\r
5627                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5628                 \r
5629                 $manager->clearCachedInfo('installedPlugins');\r
5630                 $data = array('plugid' => $pid);\r
5631                 $manager->notify('PostDeletePlugin', $data);\r
5632                 \r
5633                 return '';\r
5634         }\r
5635         \r
5636         /**\r
5637          * Admin::action_pluginup()\r
5638          * \r
5639          * @param       void\r
5640          * @return      void\r
5641          */\r
5642         static private function action_pluginup()\r
5643         {\r
5644                 global $member, $manager, $CONF;\r
5645                 \r
5646                 // check if allowed\r
5647                 $member->isAdmin() or self::disallow();\r
5648                 \r
5649                 $plugid = intGetVar('plugid');\r
5650                 \r
5651                 if ( !$manager->pidInstalled($plugid) )\r
5652                 {\r
5653                         self::error(_ERROR_NOSUCHPLUGIN);\r
5654                 }\r
5655                 \r
5656                 // 1. get old order number\r
5657                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5658                 $o = sql_fetch_object($res);\r
5659                 $oldOrder = $o->porder;\r
5660                 \r
5661                 // 2. calculate new order number\r
5662                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5663                 \r
5664                 // 3. update plug numbers\r
5665                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5666                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5667                 \r
5668                 //self::$action_pluginlist();\r
5669                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5670                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5671                 return;\r
5672         }\r
5673         \r
5674         /**\r
5675          * Admin::action_plugindown()\r
5676          * \r
5677          * @param       void\r
5678          * @return      void\r
5679          */\r
5680         static private function action_plugindown()\r
5681         {\r
5682                 global $member, $manager, $CONF;\r
5683                 \r
5684                 // check if allowed\r
5685                 $member->isAdmin() or self::disallow();\r
5686                 \r
5687                 $plugid = intGetVar('plugid');\r
5688                 if ( !$manager->pidInstalled($plugid) )\r
5689                 {\r
5690                         self::error(_ERROR_NOSUCHPLUGIN);\r
5691                 }\r
5692                 \r
5693                 // 1. get old order number\r
5694                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5695                 $o = sql_fetch_object($res);\r
5696                 $oldOrder = $o->porder;\r
5697                 \r
5698                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5699                 $maxOrder = sql_num_rows($res);\r
5700                 \r
5701                 // 2. calculate new order number\r
5702                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5703                 \r
5704                 // 3. update plug numbers\r
5705                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5706                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5707                 \r
5708                 //self::$action_pluginlist();\r
5709                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5710                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5711                 return;\r
5712         }\r
5713         \r
5714         /**\r
5715          * Admin::action_pluginoptions()\r
5716          * \r
5717          * Output Plugin option page\r
5718          * \r
5719          * @access      public\r
5720          * @param       string $message message when fallbacked\r
5721          * @return      void\r
5722          * \r
5723          */\r
5724         static private function action_pluginoptions($message = '')\r
5725         {\r
5726                 global $member, $manager;\r
5727                 \r
5728                 // check if allowed\r
5729                 $member->isAdmin() or self::disallow();\r
5730                 \r
5731                 $pid = intRequestVar('plugid');\r
5732                 if ( !$manager->pidInstalled($pid) )\r
5733                 {\r
5734                         self::error(_ERROR_NOSUCHPLUGIN);\r
5735                 }\r
5736                 \r
5737                 if ( isset($message) )\r
5738                 {\r
5739                         self::$headMess = $message;\r
5740                 }\r
5741                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5742                 self::pagehead($extrahead);\r
5743                 self::$skin->parse('pluginoptions');\r
5744                 self::pagefoot();\r
5745                 return;\r
5746         }\r
5747         \r
5748         /**\r
5749          * Admin::action_pluginoptionsupdate()\r
5750          * \r
5751          * Update plugin options and fallback to plugin option page\r
5752          * \r
5753          * @access      public\r
5754          * @param       void\r
5755          * @return      void\r
5756          */\r
5757         static private function action_pluginoptionsupdate()\r
5758         {\r
5759                 global $member, $manager;\r
5760                 \r
5761                 // check if allowed\r
5762                 $member->isAdmin() or self::disallow();\r
5763                 \r
5764                 $pid = intRequestVar('plugid');\r
5765                 \r
5766                 if ( !$manager->pidInstalled($pid) )\r
5767                 {\r
5768                         self::error(_ERROR_NOSUCHPLUGIN);\r
5769                 }\r
5770                 \r
5771                 $aOptions = requestArray('plugoption');\r
5772                 NucleusPlugin::apply_plugin_options($aOptions);\r
5773                 \r
5774                 $data = array(\r
5775                         'context'       => 'global',\r
5776                         'plugid'        => $pid\r
5777                 );\r
5778                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5779                 \r
5780                 self::$action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5781                 return;\r
5782         }\r
5783         \r
5784         /**\r
5785          * Admin::insertPluginOptions()\r
5786          * \r
5787          * Output plugin option field\r
5788          * \r
5789          * @access      public\r
5790          * @param string        $context        plugin option context\r
5791          * @param integer       $contextid      plugin option context id\r
5792          * @return      void\r
5793          */\r
5794         static public function insertPluginOptions($context, $contextid = 0)\r
5795         {\r
5796                 global $manager;\r
5797                 \r
5798                 // get all current values for this contextid\r
5799                 // (note: this might contain doubles for overlapping contextids)\r
5800                 $aIdToValue = array();\r
5801                 \r
5802                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5803                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5804                 \r
5805                 $res = sql_query($query);\r
5806                 while ( $object = sql_fetch_object($res) )\r
5807                 {\r
5808                         $aIdToValue[$object->oid] = $object->ovalue;\r
5809                 }\r
5810                 \r
5811                 // get list of oids per pid\r
5812                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5813                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5814                 $res    = sql_query($query);\r
5815                 \r
5816                 $aOptions = array();\r
5817                 while ( $object = sql_fetch_object($res) )\r
5818                 {\r
5819                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5820                         {\r
5821                                 $value = $object->odef;\r
5822                         }\r
5823                         else\r
5824                         {\r
5825                                 $value = $aIdToValue[$object->oid];\r
5826                         }\r
5827                         \r
5828                         array_push(\r
5829                                 $aOptions,\r
5830                                 array(\r
5831                                         'pid'                   => $object->pid,\r
5832                                         'pfile'                 => $object->pfile,\r
5833                                         'oid'                   => $object->oid,\r
5834                                         'value'                 => $value,\r
5835                                         'name'                  => $object->oname,\r
5836                                         'description'   => $object->odesc,\r
5837                                         'type'                  => $object->otype,\r
5838                                         'typeinfo'              => $object->oextra,\r
5839                                         'contextid'             => $contextid,\r
5840                                         'extra'                 => ''\r
5841                                 )\r
5842                         );\r
5843                 }\r
5844                 \r
5845                 $data = array(\r
5846                         'context'       =>  $context,\r
5847                         'contextid'     =>  $contextid,\r
5848                         'options'       =>& $aOptions\r
5849                 );\r
5850                 $manager->notify('PrePluginOptionsEdit', $data);\r
5851                 \r
5852                 self::$aOptions = $aOptions;\r
5853                 self::$skin->parse('insertpluginoptions');\r
5854                 return;\r
5855         }\r
5856         \r
5857         /**\r
5858          * Admin::action_parseSpecialskin()\r
5859          * \r
5860          * @param       void\r
5861          * @return      void\r
5862          */\r
5863         static private function action_parseSpecialskin()\r
5864         {\r
5865                 self::pagehead();\r
5866                 self::$skin->parse(self::$action);\r
5867                 self::pagefoot();\r
5868                 return;\r
5869         }\r
5870         \r
5871         /*\r
5872          * TODO: use Skin class instead of this\r
5873         static private function parse($type)\r
5874         {\r
5875                 global $manager, $CONF;\r
5876                 \r
5877                 if ( $type == 'pagehead' )\r
5878                 {\r
5879                         $data = array(\r
5880                                 'skin' => &self::$skin,\r
5881                                 'type' => $type\r
5882                         );\r
5883                         \r
5884                         $manager->notify('InitAdminSkinParse', $data);\r
5885                         sendContentType(self::$skin->getContentType(), 'skin', i18n::get_current_charset());\r
5886                 }\r
5887                 \r
5888                 $contents = self::$skin->getContentFromDB($type);\r
5889                 \r
5890                 if ( !$contents )\r
5891                 {\r
5892                         echo _ERROR_SKIN;\r
5893                         return;\r
5894                 }\r
5895                 \r
5896                 $actions = self::$skin->getAllowedActionsForType($type);\r
5897                 \r
5898                 if ( $type == 'pagehead' )\r
5899                 {\r
5900                         $data = array(\r
5901                                 'skin'          => &self::$skin,\r
5902                                 'type'          => $type,\r
5903                                 'contents'      => &$contents\r
5904                         );\r
5905                         \r
5906                         $manager->notify('PreAdminSkinParse', $data);\r
5907                 }\r
5908                 \r
5909                 PARSER::setProperty('IncludeMode', self::$skin->getIncludeMode());\r
5910                 PARSER::setProperty('IncludePrefix', self::$skin->getIncludePrefix());\r
5911                 \r
5912                 if ( $type == 'createitem' || $type == 'itemedit' )\r
5913                 {\r
5914                         // TODO: where is this class???\r
5915                         $handler = new Factory(intRequestVar('blogid'), $type, self::$skin, $this);\r
5916                         $actions = array_merge($actions, $handler->actions);\r
5917                 }\r
5918                 else\r
5919                 {\r
5920                         // TODO: why???\r
5921                         $actions = array_merge($actions, self::$skin->getAllowedActionsForType($type));\r
5922                 }\r
5923                 \r
5924                 $parser = new Parser($actions, $handler);\r
5925                 $handler->setParser($parser);\r
5926                 $handler->setSkin(self::$skin);\r
5927                 $parser->parse($contents);\r
5928                 \r
5929                 if ( $type == 'pagefoot' )\r
5930                 {\r
5931                         $data = array(\r
5932                                 'skin'  => &self::$skin,\r
5933                                 'type'  => $type,\r
5934                         );\r
5935                         \r
5936                         $manager->notify('PostAdminSkinParse', $data);\r
5937                 }\r
5938                 return;\r
5939         }\r
5940         */\r
5941         \r
5942         /**\r
5943          * Admin::getAdminskinIDFromName()\r
5944          * \r
5945          * @param       string  $skinname       name of skin\r
5946          * @return      integer ID for skin\r
5947          */\r
5948         static private function getAdminskinIDFromName($skinname)\r
5949         {\r
5950                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5951                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5952                 $admnSknID      = quickQuery($query);\r
5953                 return (integer) $adminSkinID;\r
5954         }\r
5955         \r
5956         /**\r
5957          * Admin::getAdminskinNameFromID()\r
5958          * \r
5959          * @param       integer $skinid ID for skin\r
5960          * @return      integer ID for skin\r
5961          */\r
5962         static private function getAdminskinNameFromID($skinid)\r
5963         {\r
5964                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5965                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5966                 $admnSknID      = quickQuery($query);\r
5967                 return (integer) $adminSkinID;\r
5968         }\r
5969         \r
5970         /**\r
5971          * Admin::getAdminextrahead()\r
5972          */\r
5973         static function getAdminextrahead()\r
5974         {\r
5975                 return self::$extrahead;\r
5976         }\r
5977         \r
5978         /**\r
5979          * Admin::getAdminpassvar()\r
5980          */\r
5981         static function getAdminpassvar()\r
5982         {\r
5983                 return self::$passvar;\r
5984         }\r
5985         \r
5986         /**\r
5987          * Admin::getAdminAction()\r
5988          */\r
5989         static function getAdminAction()\r
5990         {\r
5991                 return self::$action;\r
5992         }\r
5993         \r
5994         /**\r
5995          * Admin::getAdminaOption()\r
5996          */\r
5997         static function getAdminaOption()\r
5998         {\r
5999                 return self::$aOptions;\r
6000         }\r
6001         \r
6002         /**\r
6003          * Admin::action_importAdmin()\r
6004          * \r
6005          * @param       void\r
6006          * @return      void\r
6007          */\r
6008         static private function action_importAdmin()\r
6009         {\r
6010                 global $DIR_ADMINSKINS, $action;\r
6011                 if ( $action == 'adminskinieimport' )\r
6012                 {\r
6013                         self::doAdminskinimport();\r
6014                 }\r
6015                 $skn = array();\r
6016                 if ( $action == 'showlogin' )\r
6017                 {\r
6018                         $skinName = 'showlogin';\r
6019                         $actnName = 'showlogin';\r
6020                 }\r
6021                 else\r
6022                 {\r
6023                         $skinName = 'defaultimporter';\r
6024                         $actnName = 'importAdmin';\r
6025                 }\r
6026                 \r
6027                 /* TODO: why??? */\r
6028                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6029                 $skn['id']                              = 0;\r
6030                 $skn['description']             = $skinName;\r
6031                 $skn['contentType']             = 'importAdmin';\r
6032                 $skn['includeMode']             = 'normal';\r
6033                 $skn['includePrefix']   = '';\r
6034                 $skn['name']                    = 'defaultinporter';\r
6035                 \r
6036                 self::$skin                             = (object) $skn;\r
6037                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6038                 $actions = Skin::getAllowedActionsForType($actnName);\r
6039                 \r
6040                 $parser = new PARSER($actions, $handler);\r
6041                 $handler->setParser($parser);\r
6042                 $handler->setSkin(self::$skin);\r
6043                 $parser->parse($contents);\r
6044                 return;\r
6045         }\r
6046         \r
6047         /**\r
6048          * Admin::doAdminskinimport()\r
6049          * \r
6050          * @param       void\r
6051          * @return      void\r
6052          */\r
6053         static private function doAdminskinimport()\r
6054         {\r
6055                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6056                 \r
6057                 $member->isAdmin() or self::disallow();\r
6058                 \r
6059                 include_once($DIR_LIBS . 'Skinie.php');\r
6060                 $skinFileRaw    = postVar('skinfile');\r
6061                 $mode                   = postVar('mode');\r
6062                 $allowOverwrite = intPostVar('overwrite');\r
6063                 \r
6064                 if ( $mode == 'file' )\r
6065                 {\r
6066                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6067                 }\r
6068                 else\r
6069                 {\r
6070                         $skinFile = $skinFileRaw;\r
6071                 }\r
6072                 \r
6073                 $importer       = new SKINIMPORT();\r
6074                 $error          = $importer->readFile($skinFile);\r
6075                 if ( $error )\r
6076                 {\r
6077                         self::error($error);\r
6078                 }\r
6079                 $error = $importer->writeToDatabase($allowOverwrite);\r
6080                 if ( $error )\r
6081                 {\r
6082                         self::error($error);\r
6083                 }\r
6084                 \r
6085                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6086                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6087                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6088                 \r
6089                 header('Location: ' . $CONF['AdminURL']);\r
6090                 exit;\r
6091         }\r
6092 }\r