nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS, $manager;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                         );\r
 212                 }\r
 213                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 214                 {\r
 215                         $action = $alias[$action];\r
 216                 }\r
 217                 $methodName = "action_{$action}";\r
 218                 self::$action = strtolower($action);\r
 219                 \r
 220                 /* 2. check the action */\r
 221                 $synonimActions = array(\r
 222                         'banlistnewfromitem',\r
 223                         'memberedit',\r
 224                         'login',\r
 225                 );\r
 226                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 227                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 228                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 229                 {\r
 230                         if (!$manager->checkTicket())\r
 231                         {\r
 232                                 self::error(_ERROR_BADTICKET);\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                 }\r
 251                 elseif ( $id != $CONF['AdminSkin'] )\r
 252                 {\r
 253                         self::$skin =& $manager->getSkin($CONF['AdminSkin'], 'AdminActions');\r
 254                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 255                         {\r
 256                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 257                         }\r
 258                 }\r
 259                 else\r
 260                 {\r
 261                         self::error(_BADACTION . ENTITY::hsc($action));\r
 262                 }\r
 263                 exit;\r
 264         }\r
 265         \r
 266         /**\r
 267          * Action::existsSkinContents()\r
 268          * Check skin contents\r
 269          *\r
 270          * @param       string  $action action type\r
 271          * @return      boolean\r
 272          */\r
 273         static private function existsSkinContents($action)\r
 274         {\r
 275                 $in_array  = in_array($action, self::$skinless_actions);\r
 276                 \r
 277                 if ( $in_array )\r
 278                 {\r
 279                         return $in_array;\r
 280                 }\r
 281                 else\r
 282                 {\r
 283                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 284                         /* TODO: skinid should be a default */\r
 285                         if ( !is_object(self::$skin) )\r
 286                         {\r
 287                                 global $CONF;\r
 288                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 289                         }\r
 290                         else\r
 291                         {\r
 292                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 293                         }\r
 294                 }\r
 295                 return;\r
 296         }\r
 297         \r
 298         /**\r
 299          * Action::specialActionsAllow()\r
 300          * Check exists specialskinparts\r
 301          *\r
 302          * @param       string  $action action type\r
 303          * @return boolean\r
 304          */\r
 305         static private function specialActionsAllow($action)\r
 306         {\r
 307                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 308                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 309                 return DB::getValue($query);\r
 310         }\r
 311         \r
 312         /**\r
 313          * Action::action_showlogin()\r
 314          * \r
 315          * @param       void\r
 316          * @return      void\r
 317          */\r
 318         static private function action_showlogin()\r
 319         {\r
 320                 global $error;\r
 321                 self::action_login($error);\r
 322                 return;\r
 323         }\r
 324         \r
 325         /**\r
 326          * Action::action_login()\r
 327          * \r
 328          * @param       string  $msg            message for pageheader\r
 329          * @param       integer $passvars       ???\r
 330          */\r
 331         static private function action_login($msg = '', $passvars = 1)\r
 332         {\r
 333                 global $member;\r
 334                 \r
 335                 // skip to overview when allowed\r
 336                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 337                 {\r
 338                         self::action_overview();\r
 339                         exit;\r
 340                 }\r
 341                 \r
 342                 /* TODO: needless variable??? */\r
 343                 self::$passvar = $passvars;\r
 344                 if ( $msg )\r
 345                 {\r
 346                         self::$headMess = $msg;\r
 347                 }\r
 348                 \r
 349                 self::$skin->parse('showlogin');\r
 350         }\r
 351         \r
 352         /**\r
 353          * Action::action_overview()\r
 354          * provides a screen with the overview of the actions available\r
 355          * \r
 356          * @param       string  $msg    message for pageheader\r
 357          * @return      void\r
 358          */\r
 359         static private function action_overview($msg = '')\r
 360         {\r
 361                 if ( $msg )\r
 362                 {\r
 363                         self::$headMess = $msg;\r
 364                 }\r
 365                 \r
 366                 self::$skin->parse('overview');\r
 367                 return;\r
 368         }\r
 369         \r
 370         /**\r
 371          * Admin::action_manage()\r
 372          * \r
 373          * @param       string  $msg    message for pageheader\r
 374          * @retrn       void\r
 375          */\r
 376         static private function action_manage($msg = '')\r
 377         {\r
 378                 global $member;\r
 379                 \r
 380                 if ( $msg )\r
 381                 {\r
 382                         self::$headMess = $msg;\r
 383                 }\r
 384                 $member->isAdmin() or self::disallow();\r
 385                 \r
 386                 self::$skin->parse('manage');\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::$skin->parse('itemlist');\r
 408                 return;\r
 409         }\r
 410         \r
 411         /**\r
 412          * Action::action_batchitem()\r
 413          * \r
 414          * @param       void\r
 415          * @return      void\r
 416          */\r
 417         static private function action_batchitem()\r
 418         {\r
 419                 global $member, $manager;\r
 420                 \r
 421                 $member->isLoggedIn() or self::disallow();\r
 422                 \r
 423                 $selected       = requestIntArray('batch');\r
 424                 $action         = requestVar('batchaction');\r
 425                 \r
 426                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 427                 {\r
 428                         self::error(_BATCH_NOSELECTION);\r
 429                 }\r
 430                 \r
 431                 // On move: when no destination blog/category chosen, show choice now\r
 432                 $destCatid = intRequestVar('destcatid');\r
 433                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 434                 {\r
 435                         self::batchMoveSelectDestination('item', $selected);\r
 436                 }\r
 437                 \r
 438                 // On delete: check if confirmation has been given\r
 439                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 440                 {\r
 441                         self::batchAskDeleteConfirmation('item', $selected);\r
 442                 }\r
 443                 \r
 444                 self::$skin->parse('batchitem');\r
 445                 return;\r
 446         }\r
 447         \r
 448         /**\r
 449          * Action::action_batchcomment()\r
 450          * \r
 451          * @param       void\r
 452          * @return      void\r
 453          */\r
 454         static private function action_batchcomment()\r
 455         {\r
 456                 global $member;\r
 457                 \r
 458                 $member->isLoggedIn() or self::disallow();\r
 459                 \r
 460                 $selected       = requestIntArray('batch');\r
 461                 $action         = requestVar('batchaction');\r
 462                 \r
 463                 // Show error when no items were selected\r
 464                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 465                 {\r
 466                         self::error(_BATCH_NOSELECTION);\r
 467                 }\r
 468                 \r
 469                 // On delete: check if confirmation has been given\r
 470                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 471                 {\r
 472                         self::batchAskDeleteConfirmation('comment', $selected);\r
 473                 }\r
 474                 \r
 475                 self::$skin->parse('batchcomment');\r
 476                 return;\r
 477         }\r
 478         \r
 479         /**\r
 480          * Admin::setAdminAction()\r
 481          *\r
 482          * @param       string  $action\r
 483          * @return      void\r
 484          */\r
 485         static public function setAdminAction($action)\r
 486         {\r
 487                 self::$action = $action;\r
 488                 return;\r
 489         }\r
 490         \r
 491         /**\r
 492          * Admin::action_batchmember()\r
 493          * \r
 494          * @param       void\r
 495          * @return      void\r
 496          */\r
 497         static private function action_batchmember()\r
 498         {\r
 499                 global $member;\r
 500                 \r
 501                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 502                 \r
 503                 $selected       = requestIntArray('batch');\r
 504                 $action         = requestVar('batchaction');\r
 505                 \r
 506                 // Show error when no members selected\r
 507                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 508                 {\r
 509                         self::error(_BATCH_NOSELECTION);\r
 510                 }\r
 511                 \r
 512                 // On delete: check if confirmation has been given\r
 513                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 514                 {\r
 515                         self::batchAskDeleteConfirmation('member',$selected);\r
 516                 }\r
 517                 \r
 518                 self::$skin->parse('batchmember');\r
 519                 return;\r
 520         }\r
 521         \r
 522         /**\r
 523          * Admin::action_batchteam()\r
 524          * \r
 525          * @param       void\r
 526          * @return      void\r
 527          */\r
 528         static private function action_batchteam()\r
 529         {\r
 530                 global $member;\r
 531                 \r
 532                 $blogid = intRequestVar('blogid');\r
 533                 \r
 534                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 535                 \r
 536                 $selected       = requestIntArray('batch');\r
 537                 $action         = requestVar('batchaction');\r
 538                 \r
 539                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 540                 {\r
 541                         self::error(_BATCH_NOSELECTION);\r
 542                 }\r
 543                 \r
 544                 // On delete: check if confirmation has been given\r
 545                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 546                 {\r
 547                         self::batchAskDeleteConfirmation('team',$selected);\r
 548                 }\r
 549                 \r
 550                 self::$skin->parse('batchteam');\r
 551                 return;\r
 552         }\r
 553         \r
 554         /**\r
 555          * Admin::action_batchcategory()\r
 556          * \r
 557          * @param       void\r
 558          * @return      void\r
 559          */\r
 560         static private function action_batchcategory()\r
 561         {\r
 562                 global $member, $manager;\r
 563                 \r
 564                 $member->isLoggedIn() or self::disallow();\r
 565                 \r
 566                 $selected       = requestIntArray('batch');\r
 567                 $action         = requestVar('batchaction');\r
 568                 \r
 569                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 570                 {\r
 571                         self::error(_BATCH_NOSELECTION);\r
 572                 }\r
 573                 \r
 574                 // On move: when no destination blog chosen, show choice now\r
 575                 $destBlogId = intRequestVar('destblogid');\r
 576                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 577                 {\r
 578                         self::batchMoveCategorySelectDestination('category', $selected);\r
 579                 }\r
 580                 \r
 581                 // On delete: check if confirmation has been given\r
 582                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 583                 {\r
 584                         self::batchAskDeleteConfirmation('category', $selected);\r
 585                 }\r
 586                 \r
 587                 self::$skin->parse('batchcategory');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::$skin->parse('batchmove');\r
 604                 return;\r
 605         }\r
 606         \r
 607         /**\r
 608          * Admin::batchMoveCategorySelectDestination()\r
 609          * \r
 610          * @param       string  $type   type of batch action\r
 611          * @param       integer $ids    needless???\r
 612          * @return      void\r
 613          * \r
 614          * TODO: remove needless argument\r
 615          */\r
 616         static private function batchMoveCategorySelectDestination($type, $ids)\r
 617         {\r
 618                 $_POST['batchmove'] = $type;\r
 619                 global $manager;\r
 620                 self::$skin->parse('batchmovecat');\r
 621                 return;\r
 622         }\r
 623         \r
 624         /**\r
 625          * Admin::batchAskDeleteConfirmation()\r
 626          * \r
 627          * @param       string  $type   type of batch action\r
 628          * @param       integer $ids    needless???\r
 629          * @return      void\r
 630          * \r
 631          * TODO: remove needless argument\r
 632          */\r
 633         static private function batchAskDeleteConfirmation($type, $ids)\r
 634         {\r
 635                 self::$skin->parse('batchdelete');\r
 636                 return;\r
 637         }\r
 638         \r
 639         /**\r
 640          * Admin::action_browseownitems()\r
 641          * \r
 642          * @param       void\r
 643          * @return      void\r
 644          */\r
 645         static private function action_browseownitems()\r
 646         {\r
 647                 global $member, $manager, $CONF;\r
 648                 \r
 649                 self::$skin->parse('browseownitems');\r
 650                 return;\r
 651         }\r
 652         \r
 653         /**\r
 654          * Admin::action_itemcommentlist()\r
 655          * Show all the comments for a given item\r
 656          * \r
 657          * @param       integer $itemid ID for item\r
 658          * @return      void\r
 659          */\r
 660         static private function action_itemcommentlist($itemid = '')\r
 661         {\r
 662                 global $member, $manager, $CONF;\r
 663                 \r
 664                 if ( $itemid == '' )\r
 665                 {\r
 666                         $itemid = intRequestVar('itemid');\r
 667                 }\r
 668                 \r
 669                 // only allow if user is allowed to alter item\r
 670                 $member->canAlterItem($itemid) or self::disallow();\r
 671                 \r
 672                 $item =& $manager->getItem($itemid, 1, 1);\r
 673                 $_REQUEST['itemid'] = $item['itemid'];\r
 674                 $_REQUEST['blogid'] = $item['blogid'];\r
 675                 \r
 676                 self::$skin->parse('itemcommentlist');\r
 677                 return;\r
 678         }\r
 679         \r
 680         /**\r
 681          * Admin::action_browseowncomments()\r
 682          * Browse own comments\r
 683          * \r
 684          * @param       void\r
 685          * @return      void\r
 686          */\r
 687         static private function action_browseowncomments()\r
 688         {\r
 689                 self::$skin->parse('browseowncomments');\r
 690                 return;\r
 691         }\r
 692         \r
 693         /**\r
 694          * Admin::action_blogcommentlist()\r
 695          * Browse all comments for a weblog\r
 696          * \r
 697          * @param       integer $blogid ID for weblog\r
 698          * @return      void\r
 699          */\r
 700         static private function action_blogcommentlist($blogid = '')\r
 701         {\r
 702                 global $member, $manager, $CONF;\r
 703                 \r
 704                 if ( $blogid == '' )\r
 705                 {\r
 706                         $blogid = intRequestVar('blogid');\r
 707                 }\r
 708                 else\r
 709                 {\r
 710                         $blogid = intval($blogid);\r
 711                 }\r
 712                 \r
 713                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 714                 \r
 715                 /* TODO: we consider to use the other way insterad of this */\r
 716                 $_REQUEST['blogid'] = $blogid;\r
 717                 \r
 718                 self::$skin->parse('blogcommentlist');\r
 719                 return;\r
 720         }\r
 721         \r
 722         /**\r
 723          * Admin::action_createaccount()\r
 724          * \r
 725          * @param       void\r
 726          * @return      void\r
 727          */\r
 728         static private function action_createaccount()\r
 729         {\r
 730                 global $CONF;\r
 731                 \r
 732                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 733                 {\r
 734                         self::$skin->parse('createaccountdisable');\r
 735                         return;\r
 736                 }\r
 737                 \r
 738                 $name = '';\r
 739                 $realname ='';\r
 740                 $email = '';\r
 741                 $url = '';\r
 742                 \r
 743                 $contents = array(\r
 744                         'name'          => '',\r
 745                         'realname'      => '',\r
 746                         'email'         => '',\r
 747                         'url'           => ''\r
 748                 );\r
 749                 \r
 750                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 751                 {\r
 752                         $action = new Action();\r
 753                         $message = $action->createAccount();\r
 754                         if ( $message === 1 )\r
 755                         {\r
 756                                 self::$headMess = $message;\r
 757                                 self::$skin->parse('createaccountsuccess');\r
 758                                 return;\r
 759                         }\r
 760                         \r
 761                         /* TODO: validation */\r
 762                         if ( array_key_exists('name', $_POST) )\r
 763                         {\r
 764                                 $contents['name'] = $_POST['name'];\r
 765                         }\r
 766                         if ( array_key_exists('realname', $_POST) )\r
 767                         {\r
 768                                 $contents['realname'] = $_POST['realname'];\r
 769                         }\r
 770                         if ( array_key_exists('email', $_POST) )\r
 771                         {\r
 772                                 $contents['email'] = $_POST['email'];\r
 773                         }\r
 774                         if ( array_key_exists('url', $_POST) )\r
 775                         {\r
 776                                 $contents['url'] = $_POST['url'];\r
 777                         }\r
 778                         \r
 779                         self::$contents = $contents;\r
 780                         \r
 781                 }\r
 782                 \r
 783                 self::$skin->parse('createaccountinput');\r
 784                 return;\r
 785         }\r
 786         \r
 787         /**\r
 788          * Admin::action_createitem()\r
 789          * Provide a page to item a new item to the given blog\r
 790          * \r
 791          * @param       void\r
 792          * @return      void\r
 793          */\r
 794         static private function action_createitem()\r
 795         {\r
 796                 global $member, $manager;\r
 797                 \r
 798                 $blogid = intRequestVar('blogid');\r
 799                 \r
 800                 // check if allowed\r
 801                 $member->teamRights($blogid) or self::disallow();\r
 802                 \r
 803                 $blog =& $manager->getBlog($blogid);\r
 804                 $contents = array();\r
 805                 \r
 806                 $data = array(\r
 807                         'blog'          => &$blog,\r
 808                         'contents'      => &$contents\r
 809                 );\r
 810                 $manager->notify('PreAddItemForm', $data);\r
 811                 \r
 812                 if ( $blog->convertBreaks() )\r
 813                 {\r
 814                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 815                         {\r
 816                                 $contents['body'] = removeBreaks($contents['body']);\r
 817                         }\r
 818                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 819                         {\r
 820                                 $contents['more'] = removeBreaks($contents['more']);\r
 821                         }\r
 822                 }\r
 823                 \r
 824                 self::$blog = &$blog;\r
 825                 self::$contents = &$contents;\r
 826                 \r
 827                 self::$skin->parse('createitem');\r
 828                 return;\r
 829         }\r
 830         \r
 831         /**\r
 832          * Admin::action_itemedit()\r
 833          * \r
 834          * @param       void\r
 835          * @return      void\r
 836          */\r
 837         static private function action_itemedit()\r
 838         {\r
 839                 global $member, $manager;\r
 840                 \r
 841                 $itemid = intRequestVar('itemid');\r
 842                 \r
 843                 // only allow if user is allowed to alter item\r
 844                 $member->canAlterItem($itemid) or self::disallow();\r
 845                 \r
 846                 $item =& $manager->getItem($itemid, 1, 1);\r
 847                 $blog =& $manager->getBlog($item['blogid']);\r
 848                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 849                 \r
 850                 if ( $blog->convertBreaks() )\r
 851                 {\r
 852                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 853                         {\r
 854                                 $item['body'] = removeBreaks($item['body']);\r
 855                         }\r
 856                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 857                         {\r
 858                                 $item['more'] = removeBreaks($item['more']);\r
 859                         }\r
 860                 }\r
 861                 \r
 862                 self::$blog = &$blog;\r
 863                 self::$contents = &$item;\r
 864                 \r
 865                 self::$skin->parse('itemedit');\r
 866                 return;\r
 867         }\r
 868         \r
 869         /**\r
 870          * Admin::action_itemupdate()\r
 871          * \r
 872          * @param       void\r
 873          * @return      void\r
 874          */\r
 875         static private function action_itemupdate()\r
 876         {\r
 877                 global $member, $manager, $CONF;\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $catid  = postVar('catid');\r
 881                 \r
 882                 // only allow if user is allowed to alter item\r
 883                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 884                 \r
 885                 $actiontype = postVar('actiontype');\r
 886                 \r
 887                 // delete actions are handled by itemdelete (which has confirmation)\r
 888                 if ( $actiontype == 'delete' )\r
 889                 {\r
 890                         self::action_itemdelete();\r
 891                         return;\r
 892                 }\r
 893                 \r
 894                 $body           = postVar('body');\r
 895                 $title          = postVar('title');\r
 896                 $more           = postVar('more');\r
 897                 $closed         = intPostVar('closed');\r
 898                 $draftid        = intPostVar('draftid');\r
 899                 \r
 900                 // default action = add now\r
 901                 if ( !$actiontype )\r
 902                 {\r
 903                         $actiontype='addnow';\r
 904                 }\r
 905                 \r
 906                 // create new category if needed\r
 907                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 908                 {\r
 909                         // get blogid\r
 910                         list($blogid) = sscanf($catid,"newcat-%d");\r
 911                         \r
 912                         // create\r
 913                         $blog =& $manager->getBlog($blogid);\r
 914                         $catid = $blog->createNewCategory();\r
 915                         \r
 916                         // show error when sth goes wrong\r
 917                         if ( !$catid )\r
 918                         {\r
 919                                 self::doError(_ERROR_CATCREATEFAIL);\r
 920                         }\r
 921                 }\r
 922                 \r
 923                 /**\r
 924                  * set some variables based on actiontype\r
 925                  * \r
 926                  * actiontypes:\r
 927                  *      draft items -> addnow, addfuture, adddraft, delete\r
 928                  *      non-draft items -> edit, changedate, delete\r
 929                  * \r
 930                  * variables set:\r
 931                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 932                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 933                  *      $publish: set to 1 when the edited item is not a draft\r
 934                  */\r
 935                 $blogid =  getBlogIDFromItemID($itemid);\r
 936                 $blog =& $manager->getBlog($blogid);\r
 937                 \r
 938                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 939                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 940                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 941                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 942                 {\r
 943                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 944                 }\r
 945                 else\r
 946                 {\r
 947                         $timestamp =0;\r
 948                 }\r
 949                 \r
 950                 // edit the item for real\r
 951                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 952                 \r
 953                 self::updateFuturePosted($blogid);\r
 954                 \r
 955                 if ( $draftid > 0 )\r
 956                 {\r
 957                         // delete permission is checked inside Item::delete()\r
 958                         Item::delete($draftid);\r
 959                 }\r
 960                 \r
 961                 if ( $catid != intPostVar('catid') )\r
 962                 {\r
 963                         self::action_categoryedit(\r
 964                                 $catid,\r
 965                                 $blog->getID(),\r
 966                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 967                         );\r
 968                 }\r
 969                 else\r
 970                 {\r
 971                         // TODO: set start item correctly for itemlist\r
 972                         $item =& $manager->getitem($itemid, 1, 1);\r
 973                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 974                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 975                         $cnt  = DB::getValue($query);\r
 976                         $_REQUEST['start'] = $cnt + 1;\r
 977                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 978                 }\r
 979                 return;\r
 980         }\r
 981         \r
 982         /**\r
 983          * Admin::action_itemdelete()\r
 984          * Delete item\r
 985          * \r
 986          * @param       Void\r
 987          * @return      Void\r
 988          */\r
 989         static private function action_itemdelete()\r
 990         {\r
 991                 global $member, $manager;\r
 992                 \r
 993                 $itemid = intRequestVar('itemid');\r
 994                 \r
 995                 // only allow if user is allowed to alter item\r
 996                 $member->canAlterItem($itemid) or self::disallow();\r
 997                 \r
 998                 if ( !$manager->existsItem($itemid,1,1) )\r
 999                 {\r
1000                         self::error(_ERROR_NOSUCHITEM);\r
1001                 }\r
1002                 \r
1003                 self::$skin->parse('itemdelete');\r
1004                 return;\r
1005         }\r
1006         \r
1007         /**\r
1008          * Admin::action_itemdeleteconfirm()\r
1009          * \r
1010          * @param       void\r
1011          * @return      void\r
1012          */\r
1013         static private function action_itemdeleteconfirm()\r
1014         {\r
1015                 global $member, $manager;\r
1016                 \r
1017                 $itemid = intRequestVar('itemid');\r
1018                 \r
1019                 // only allow if user is allowed to alter item\r
1020                 $member->canAlterItem($itemid) or self::disallow();\r
1021                 \r
1022                 // get item first\r
1023                 $item =& $manager->getItem($itemid, 1, 1);\r
1024                 \r
1025                 // delete item (note: some checks will be performed twice)\r
1026                 self::deleteOneItem($item['itemid']);\r
1027                 \r
1028                 self::action_itemlist($item['blogid']);\r
1029                 return;\r
1030         }\r
1031         \r
1032         /**\r
1033          * Admin::deleteOneItem()\r
1034          * Deletes one item and returns error if something goes wrong\r
1035          * \r
1036          * @param       integer $itemid ID for item\r
1037          * @return      void\r
1038          */\r
1039         static public function deleteOneItem($itemid)\r
1040         {\r
1041                 global $member, $manager;\r
1042                 \r
1043                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1044                 if ( !$member->canAlterItem($itemid) )\r
1045                 {\r
1046                         return _ERROR_DISALLOWED;\r
1047                 }\r
1048                 \r
1049                 // need to get blogid before the item is deleted\r
1050                 $item =& $manager->getItem($itemid, 1, 1);\r
1051                 \r
1052                 $manager->loadClass('ITEM');\r
1053                 Item::delete($item['itemid']);\r
1054                 \r
1055                 // update blog's futureposted\r
1056                 self::updateFuturePosted($item['itemid']);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::updateFuturePosted()\r
1062          * Update a blog's future posted flag\r
1063          * \r
1064          * @param integer $blogid\r
1065          * @return      void\r
1066          */\r
1067         static private function updateFuturePosted($blogid)\r
1068         {\r
1069                 global $manager;\r
1070                 \r
1071                 $blogid                 =  intval($blogid);\r
1072                 $blog                   =& $manager->getBlog($blogid);\r
1073                 $currenttime    =  $blog->getCorrectTime(time());\r
1074                 \r
1075                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1076                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1077                 $result = DB::getResult($query);\r
1078                 \r
1079                 if ( $result->rowCount() > 0 )\r
1080                 {\r
1081                                 $blog->setFuturePost();\r
1082                 }\r
1083                 else\r
1084                 {\r
1085                                 $blog->clearFuturePost();\r
1086                 }\r
1087                 return;\r
1088         }\r
1089 \r
1090         /**\r
1091          * Admin::action_itemmove()\r
1092          * \r
1093          * @param       void\r
1094          * @return      void\r
1095          */\r
1096         static private function action_itemmove()\r
1097         {\r
1098                 global $member, $manager;\r
1099                 \r
1100                 $itemid = intRequestVar('itemid');\r
1101                 \r
1102                 $member->canAlterItem($itemid) or self::disallow();\r
1103                 \r
1104                 self::$skin->parse('itemmove');\r
1105                 return;\r
1106         }\r
1107         \r
1108         /**\r
1109          * Admin::action_itemmoveto()\r
1110          * \r
1111          * @param       void\r
1112          * @return      void\r
1113          */\r
1114         static private function action_itemmoveto()\r
1115         {\r
1116                 global $member, $manager;\r
1117                 \r
1118                 $itemid = intRequestVar('itemid');\r
1119                 $catid = requestVar('catid');\r
1120                 \r
1121                 // create new category if needed\r
1122                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1123                 {\r
1124                         // get blogid\r
1125                         list($blogid) = sscanf($catid,'newcat-%d');\r
1126                         \r
1127                         // create\r
1128                         $blog =& $manager->getBlog($blogid);\r
1129                         $catid = $blog->createNewCategory();\r
1130                         \r
1131                         // show error when sth goes wrong\r
1132                         if ( !$catid )\r
1133                         {\r
1134                                 self::doError(_ERROR_CATCREATEFAIL);\r
1135                         }\r
1136                 }\r
1137                 \r
1138                 // only allow if user is allowed to alter item\r
1139                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1140                 \r
1141                 $old_blogid = getBlogIDFromItemId($itemid);\r
1142                 \r
1143                 Item::move($itemid, $catid);\r
1144                 \r
1145                 // set the futurePosted flag on the blog\r
1146                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1147                 \r
1148                 // reset the futurePosted in case the item is moved from one blog to another\r
1149                 self::updateFuturePosted($old_blogid);\r
1150                 \r
1151                 if ( $catid != intRequestVar('catid') )\r
1152                 {\r
1153                         self::action_categoryedit($catid, $blog->getID());\r
1154                 }\r
1155                 else\r
1156                 {\r
1157                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1158                 }\r
1159                 return;\r
1160         }\r
1161         \r
1162         /**\r
1163          * Admin::moveOneItem()\r
1164          * Moves one item to a given category (category existance should be checked by caller)\r
1165          * errors are returned\r
1166          * \r
1167          * @param       integer $itemid         ID for item\r
1168          * @param       integer $destCatid      ID for category to which the item will be moved\r
1169          * @return      void\r
1170          */\r
1171         static public function moveOneItem($itemid, $destCatid)\r
1172         {\r
1173                 global $member;\r
1174                 \r
1175                 // only allow if user is allowed to move item\r
1176                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1177                 {\r
1178                         return _ERROR_DISALLOWED;\r
1179                 }\r
1180                 \r
1181                 Item::move($itemid, $destCatid);\r
1182                 return;\r
1183         }\r
1184         \r
1185         /**\r
1186          * Admin::action_additem()\r
1187          * Adds a item to the chosen blog\r
1188          * \r
1189          * @param       void\r
1190          * @return      void\r
1191          */\r
1192         static private function action_additem()\r
1193         {\r
1194                 global $manager, $CONF;\r
1195                 \r
1196                 $manager->loadClass('ITEM');\r
1197                 \r
1198                 $result = Item::createFromRequest();\r
1199                 \r
1200                 if ( $result['status'] == 'error' )\r
1201                 {\r
1202                         self::error($result['message']);\r
1203                 }\r
1204                 \r
1205                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1206                 \r
1207                 if ( $result['status'] == 'newcategory' )\r
1208                 {\r
1209                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1210                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1211                 }\r
1212                 else\r
1213                 {\r
1214                         $methodName = 'action_itemlist';\r
1215                         self::action_itemlist($item['blogid']);\r
1216                 }\r
1217                 return;\r
1218         }\r
1219         \r
1220         /**\r
1221          * Admin::action_commentedit()\r
1222          * Allows to edit previously made comments\r
1223          * \r
1224          * @param       void\r
1225          * @return      void\r
1226          */\r
1227         static private function action_commentedit()\r
1228         {\r
1229                 global $member, $manager;\r
1230                 \r
1231                 $commentid = intRequestVar('commentid');\r
1232                 \r
1233                 $member->canAlterComment($commentid) or self::disallow();\r
1234                 \r
1235                 $comment = COMMENT::getComment($commentid);\r
1236                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));\r
1237                 \r
1238                 Admin::$contents = $comment;\r
1239                 self::$skin->parse('commentedit');\r
1240                 return;\r
1241         }\r
1242         \r
1243         /**\r
1244          * Admin::action_commentupdate()\r
1245          * \r
1246          * @param       void\r
1247          * @return      void\r
1248          */\r
1249         static private function action_commentupdate()\r
1250         {\r
1251                 global $member, $manager;\r
1252                 \r
1253                 $commentid = intRequestVar('commentid');\r
1254                 \r
1255                 $member->canAlterComment($commentid) or self::disallow();\r
1256                 \r
1257                 $url    = postVar('url');\r
1258                 $email  = postVar('email');\r
1259                 $body   = postVar('body');\r
1260                 \r
1261                 // intercept words that are too long\r
1262                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1263                 {\r
1264                         self::error(_ERROR_COMMENT_LONGWORD);\r
1265                 }\r
1266                 \r
1267                 // check length\r
1268                 if ( i18n::strlen($body) < 3 )\r
1269                 {\r
1270                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1271                 }\r
1272                 \r
1273                 if ( i18n::strlen($body) > 5000 )\r
1274                 {\r
1275                         self::error(_ERROR_COMMENT_TOOLONG);\r
1276                 }\r
1277                 \r
1278                 // prepare body\r
1279                 $body = Comment::prepareBody($body);\r
1280                 \r
1281                 // call plugins\r
1282                 $data = array(\r
1283                         'body' => &$body\r
1284                 );\r
1285                 $manager->notify('PreUpdateComment', $data);\r
1286                 \r
1287                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1288                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1289                 DB::execute($query);\r
1290                 \r
1291                 // get itemid\r
1292                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1293                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1294                 \r
1295                 $itemid = DB::getValue($query);\r
1296                 \r
1297                 if ( $member->canAlterItem($itemid) )\r
1298                 {\r
1299                         self::action_itemcommentlist($itemid);\r
1300                 }\r
1301                 else\r
1302                 {\r
1303                         self::action_browseowncomments();\r
1304                 }\r
1305                 return;\r
1306         }\r
1307         \r
1308         /**\r
1309          * Admin::action_commentdelete()\r
1310          * Update comment\r
1311          * \r
1312          * @param       void\r
1313          * @return      void\r
1314          */\r
1315         static private function action_commentdelete()\r
1316         {\r
1317                 global $member, $manager;\r
1318                 \r
1319                 $commentid = intRequestVar('commentid');\r
1320                 $member->canAlterComment($commentid) or self::disallow();\r
1321                 \r
1322                 self::$skin->parse('commentdelete');\r
1323                 return;\r
1324         }\r
1325         \r
1326         /**\r
1327          * Admin::action_commentdeleteconfirm()\r
1328          * \r
1329          * @param       void\r
1330          * @return      void\r
1331          */\r
1332         static private function action_commentdeleteconfirm()\r
1333         {\r
1334                 global $member;\r
1335                 \r
1336                 $commentid = intRequestVar('commentid');\r
1337                 \r
1338                 // get item id first\r
1339                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1340                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1341                 \r
1342                 $itemid = DB::getValue($query);\r
1343                 \r
1344                 $error = self::deleteOneComment($commentid);\r
1345                 if ( $error )\r
1346                 {\r
1347                         self::doError($error);\r
1348                 }\r
1349                 \r
1350                 if ( $member->canAlterItem($itemid) )\r
1351                 {\r
1352                         self::action_itemcommentlist($itemid);\r
1353                 }\r
1354                 else\r
1355                 {\r
1356                         self::action_browseowncomments();\r
1357                 }\r
1358                 return;\r
1359         }\r
1360         \r
1361         /**\r
1362          * Admin::deleteOneComment()\r
1363          * \r
1364          * @param       integer $commentid      ID for comment\r
1365          * @return      void\r
1366          */\r
1367         static public function deleteOneComment($commentid)\r
1368         {\r
1369                 global $member, $manager;\r
1370                 \r
1371                 $commentid = (integer) $commentid;\r
1372                 \r
1373                 if ( !$member->canAlterComment($commentid) )\r
1374                 {\r
1375                         return _ERROR_DISALLOWED;\r
1376                 }\r
1377                 \r
1378                 $data = array(\r
1379                         'commentid' => $commentid\r
1380                 );\r
1381                 \r
1382                 $manager->notify('PreDeleteComment', $data);\r
1383                 \r
1384                 // delete the comments associated with the item\r
1385                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1386                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1387                 DB::execute($query);\r
1388                 \r
1389                 $data = array(\r
1390                         'commentid' => $commentid\r
1391                 );\r
1392                 \r
1393                 $manager->notify('PostDeleteComment', $data);\r
1394                 \r
1395                 return '';\r
1396         }\r
1397         \r
1398         /**\r
1399          * Admin::action_usermanagement()\r
1400          * Usermanagement main\r
1401          * \r
1402          * @param       void\r
1403          * @return      void\r
1404          */\r
1405         static private function action_usermanagement()\r
1406         {\r
1407                 global $member, $manager;\r
1408                 \r
1409                 // check if allowed\r
1410                 $member->isAdmin() or self::disallow();\r
1411                 \r
1412                 self::$skin->parse('usermanagement');\r
1413                 return;\r
1414         }\r
1415         \r
1416         /**\r
1417          * Admin::action_memberedit()\r
1418          * Edit member settings\r
1419          * \r
1420          * @param       void\r
1421          * @return      void\r
1422          */\r
1423         static private function action_memberedit()\r
1424         {\r
1425                 self::action_editmembersettings(intRequestVar('memberid'));\r
1426                 return;\r
1427         }\r
1428         \r
1429         /**\r
1430          * Admin::action_editmembersettings()\r
1431          * \r
1432          * @param       integer $memberid       ID for member\r
1433          * @return      void\r
1434          * \r
1435          */\r
1436         static private function action_editmembersettings($memberid = '')\r
1437         {\r
1438                 global $member, $manager, $CONF;\r
1439                 \r
1440                 if ( $memberid == '' )\r
1441                 {\r
1442                         $memberid = $member->getID();\r
1443                 }\r
1444                 \r
1445                 /* TODO: we should consider to use the other way insterad of this */\r
1446                 $_REQUEST['memberid'] = $memberid;\r
1447                 \r
1448                 // check if allowed\r
1449                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1450                 \r
1451                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1452                 \r
1453                 self::$skin->parse('editmembersettings');\r
1454                 return;\r
1455         }\r
1456         \r
1457         /**\r
1458          * Admin::action_changemembersettings()\r
1459          * \r
1460          * @param       void\r
1461          * @return      void\r
1462          */\r
1463         static private function action_changemembersettings()\r
1464         {\r
1465                 global $member, $CONF, $manager;\r
1466                 \r
1467                 $memberid = intRequestVar('memberid');\r
1468                 \r
1469                 // check if allowed\r
1470                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1471                 \r
1472                 $name                   = trim(strip_tags(postVar('name')));\r
1473                 $realname               = trim(strip_tags(postVar('realname')));\r
1474                 $password               = postVar('password');\r
1475                 $repeatpassword = postVar('repeatpassword');\r
1476                 $email                  = strip_tags(postVar('email'));\r
1477                 $url                    = strip_tags(postVar('url'));\r
1478                 $adminskin              = intPostVar('adminskin');\r
1479                 \r
1480                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1481                 if ( !preg_match('#^https?://#', $url) )\r
1482                 {\r
1483                         $url = 'http://' . $url;\r
1484                 }\r
1485                 \r
1486                 $admin          = postVar('admin');\r
1487                 $canlogin       = postVar('canlogin');\r
1488                 $notes          = strip_tags(postVar('notes'));\r
1489                 $locale         = postVar('locale');\r
1490                 \r
1491                 $mem =& $manager->getMember($memberid);\r
1492                 \r
1493                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1494                 {\r
1495                         if ( !isValidDisplayName($name) )\r
1496                         {\r
1497                                 self::error(_ERROR_BADNAME);\r
1498                         }\r
1499                         \r
1500                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1501                         {\r
1502                                 self::error(_ERROR_NICKNAMEINUSE);\r
1503                         }\r
1504                         \r
1505                         if ( $password != $repeatpassword )\r
1506                         {\r
1507                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1508                         }\r
1509                         \r
1510                         if ( $password && (i18n::strlen($password) < 6) )\r
1511                         {\r
1512                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1513                         }\r
1514                                 \r
1515                         if ( $password )\r
1516                         {\r
1517                                 $pwdvalid = true;\r
1518                                 $pwderror = '';\r
1519                                 \r
1520                                 $data = array(\r
1521                                         'password'     => $password,\r
1522                                         'errormessage' => &$pwderror,\r
1523                                         'valid'        => &$pwdvalid\r
1524                                 );\r
1525                                 $manager->notify('PrePasswordSet', $data);\r
1526                                 \r
1527                                 if ( !$pwdvalid )\r
1528                                 {\r
1529                                         self::error($pwderror);\r
1530                                 }\r
1531                         }\r
1532                 }\r
1533                 \r
1534                 if ( !NOTIFICATION::address_validation($email) )\r
1535                 {\r
1536                         self::error(_ERROR_BADMAILADDRESS);\r
1537                 }\r
1538                 if ( !$realname )\r
1539                 {\r
1540                         self::error(_ERROR_REALNAMEMISSING);\r
1541                 }\r
1542                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1543                 {\r
1544                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1545                 }\r
1546                 \r
1547                 // check if there will remain at least one site member with both the logon and admin rights\r
1548                 // (check occurs when taking away one of these rights from such a member)\r
1549                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1550                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1551                         )\r
1552                 {\r
1553                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1554                         if ( $r->rowCount() < 2 )\r
1555                         {\r
1556                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1557                         }\r
1558                 }\r
1559                 \r
1560                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1561                 {\r
1562                         $mem->setDisplayName($name);\r
1563                         if ( $password )\r
1564                         {\r
1565                                 $mem->setPassword($password);\r
1566                         }\r
1567                 }\r
1568                 \r
1569                 $oldEmail = $mem->getEmail();\r
1570                 \r
1571                 $mem->setRealName($realname);\r
1572                 $mem->setEmail($email);\r
1573                 $mem->setURL($url);\r
1574                 $mem->setNotes($notes);\r
1575                 $mem->setLocale($locale);\r
1576                 \r
1577                 // only allow super-admins to make changes to the admin status\r
1578                 if ( $member->isAdmin() )\r
1579                 {\r
1580                         $mem->setAdmin($admin);\r
1581                         $mem->setCanLogin($canlogin);\r
1582                 }\r
1583                 \r
1584                 $autosave = postVar('autosave');\r
1585                 $mem->setAutosave($autosave);\r
1586                 \r
1587                 $mem->write();\r
1588                 \r
1589                 // store plugin options\r
1590                 $aOptions = requestArray('plugoption');\r
1591                 NucleusPlugin::apply_plugin_options($aOptions);\r
1592                 $data = array(\r
1593                         'context'  => 'member',\r
1594                         'memberid' => $memberid,\r
1595                         'member'   => &$mem\r
1596                 );\r
1597                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1598                 \r
1599                 // if email changed, generate new password\r
1600                 if ( $oldEmail != $mem->getEmail() )\r
1601                 {\r
1602                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1603                         // logout member\r
1604                         $mem->newCookieKey();\r
1605                         \r
1606                         // only log out if the member being edited is the current member.\r
1607                         if ( $member->getID() == $memberid )\r
1608                         {\r
1609                                 $member->logout();\r
1610                         }\r
1611                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1612                         return;\r
1613                 }\r
1614                 \r
1615                 if ( ($mem->getID() == $member->getID())\r
1616                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1617                 {\r
1618                         $mem->newCookieKey();\r
1619                         $member->logout();\r
1620                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1621                 }\r
1622                 else\r
1623                 {\r
1624                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1625                 }\r
1626                 return;\r
1627         }\r
1628 \r
1629         /**\r
1630          * Admin::action_memberadd()\r
1631          * \r
1632          * @param       void\r
1633          * @return      void\r
1634          * \r
1635          */\r
1636         static private function action_memberadd()\r
1637         {\r
1638                 global $member, $manager;\r
1639                 \r
1640                 // check if allowed\r
1641                 $member->isAdmin() or self::disallow();\r
1642                 \r
1643                 if ( postVar('password') != postVar('repeatpassword') )\r
1644                 {\r
1645                         self::error(_ERROR_PASSWORDMISMATCH);\r
1646                 }\r
1647                 \r
1648                 if ( i18n::strlen(postVar('password')) < 6 )\r
1649                 {\r
1650                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1651                 }\r
1652                 \r
1653                 $res = Member::create(\r
1654                         postVar('name'),\r
1655                         postVar('realname'),\r
1656                         postVar('password'),\r
1657                         postVar('email'),\r
1658                         postVar('url'),\r
1659                         postVar('admin'),\r
1660                         postVar('canlogin'),\r
1661                         postVar('notes')\r
1662                 );\r
1663                 \r
1664                 if ( $res != 1 )\r
1665                 {\r
1666                         self::error($res);\r
1667                 }\r
1668                 \r
1669                 // fire PostRegister event\r
1670                 $newmem = new Member();\r
1671                 $newmem->readFromName(postVar('name'));\r
1672                 $data = array(\r
1673                         'member' => &$newmem\r
1674                 );\r
1675                 $manager->notify('PostRegister', $data);\r
1676                 \r
1677                 self::action_usermanagement();\r
1678                 return;\r
1679         }\r
1680         \r
1681         /**\r
1682          * Admin::action_forgotpassword()\r
1683          * \r
1684          * @param       void\r
1685          * @return      void\r
1686          */\r
1687         static private function action_forgotpassword()\r
1688         {\r
1689                 self::$skin->parse('forgotpassword');\r
1690                 return;\r
1691         }\r
1692         \r
1693         /**\r
1694          * Admin::action_activate()\r
1695          * Account activation\r
1696          * \r
1697          * @param       void\r
1698          * @return      void\r
1699          */\r
1700         static private function action_activate()\r
1701         {\r
1702                 $key = getVar('key');\r
1703                 self::showActivationPage($key);\r
1704                 return;\r
1705         }\r
1706         \r
1707         /**\r
1708          * Admin::showActivationPage()\r
1709          * \r
1710          * @param       void\r
1711          * @return      void\r
1712          */\r
1713         static private function showActivationPage($key, $message = '')\r
1714         {\r
1715                 global $manager;\r
1716                 \r
1717                 // clean up old activation keys\r
1718                 Member::cleanupActivationTable();\r
1719                 \r
1720                 // get activation info\r
1721                 $info = Member::getActivationInfo($key);\r
1722                 \r
1723                 if ( !$info )\r
1724                 {\r
1725                         self::error(_ERROR_ACTIVATE);\r
1726                 }\r
1727                 \r
1728                 $mem =& $manager->getMember($info->vmember);\r
1729                 \r
1730                 if ( !$mem )\r
1731                 {\r
1732                         self::error(_ERROR_ACTIVATE);\r
1733                 }\r
1734                 \r
1735                 /* TODO: we should consider to use the other way insterad of this */\r
1736                 $_POST['ackey']                                 = $key;\r
1737                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1738                 \r
1739                 self::$headMess = $message;\r
1740                 self::$skin->parse('activate');\r
1741                 return;\r
1742         }\r
1743         \r
1744         /**\r
1745          * Admin::action_activatesetpwd()\r
1746          * Account activation - set password part\r
1747          * \r
1748          * @param       void\r
1749          * @return      void\r
1750          */\r
1751         static private function action_activatesetpwd()\r
1752         {\r
1753                 global $manager;\r
1754                 $key = postVar('key');\r
1755                 \r
1756                 // clean up old activation keys\r
1757                 Member::cleanupActivationTable();\r
1758                 \r
1759                 // get activation info\r
1760                 $info = Member::getActivationInfo($key);\r
1761                 \r
1762                 if ( !$info || ($info->type == 'addresschange') )\r
1763                 {\r
1764                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1765                 }\r
1766                 \r
1767                 $mem =& $manager->getMember($info->vmember);\r
1768                 \r
1769                 if ( !$mem )\r
1770                 {\r
1771                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1772                 }\r
1773                 \r
1774                 $password               = postVar('password');\r
1775                 $repeatpassword = postVar('repeatpassword');\r
1776                 \r
1777                 if ( $password != $repeatpassword )\r
1778                 {\r
1779                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1780                 }\r
1781                 \r
1782                 if ( $password && (i18n::strlen($password) < 6) )\r
1783                 {\r
1784                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1785                 }\r
1786                         \r
1787                 if ( $password )\r
1788                 {\r
1789                         $pwdvalid = true;\r
1790                         $pwderror = '';\r
1791                         \r
1792                         $data = array(\r
1793                                 'password'              => $password,\r
1794                                 'errormessage'  => &$pwderror,\r
1795                                 'valid'                 => &$pwdvalid\r
1796                         );\r
1797                         $manager->notify('PrePasswordSet', $data);\r
1798                         if ( !$pwdvalid )\r
1799                         {\r
1800                                 return self::showActivationPage($key,$pwderror);\r
1801                         }\r
1802                 }\r
1803                 \r
1804                 $error = '';\r
1805                 \r
1806                 $data = array(\r
1807                         'type'   => 'activation',\r
1808                         'member' => $mem,\r
1809                         'error'  => &$error\r
1810                 );\r
1811                 $manager->notify('ValidateForm', $data);\r
1812                 if ( $error != '' )\r
1813                 {\r
1814                         return self::showActivationPage($key, $error);\r
1815                 }\r
1816                 \r
1817                 // set password\r
1818                 $mem->setPassword($password);\r
1819                 $mem->write();\r
1820                 \r
1821                 // do the activation\r
1822                 Member::activate($key);\r
1823                 \r
1824                 self::$skin->parse('activatesetpwd');\r
1825                 return;\r
1826         }\r
1827         \r
1828         /**\r
1829          * Admin::action_manageteam()\r
1830          * Manage team\r
1831          * \r
1832          * @param       void\r
1833          * @return      void\r
1834          */\r
1835         static private function action_manageteam()\r
1836         {\r
1837                 global $member, $manager;\r
1838                 \r
1839                 $blogid = intRequestVar('blogid');\r
1840                 \r
1841                 // check if allowed\r
1842                 $member->blogAdminRights($blogid) or self::disallow();\r
1843                 \r
1844                 self::$skin->parse('manageteam');\r
1845                 return;\r
1846         }\r
1847         \r
1848         /**\r
1849          * Admin::action_teamaddmember()\r
1850          * Add member to team\r
1851          * \r
1852          * @param       void\r
1853          * @return      void\r
1854          */\r
1855         static private function action_teamaddmember()\r
1856         {\r
1857                 global $member, $manager;\r
1858                 \r
1859                 $memberid       = intPostVar('memberid');\r
1860                 $blogid         = intPostVar('blogid');\r
1861                 $admin          = intPostVar('admin');\r
1862                 \r
1863                 // check if allowed\r
1864                 $member->blogAdminRights($blogid) or self::disallow();\r
1865                 \r
1866                 $blog =& $manager->getBlog($blogid);\r
1867                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1868                 {\r
1869                         self::error(_ERROR_ALREADYONTEAM);\r
1870                 }\r
1871                 \r
1872                 self::action_manageteam();\r
1873                 return;\r
1874         }\r
1875         \r
1876         /**\r
1877          * Admin::action_teamdelete()\r
1878          * \r
1879          * @param       void\r
1880          * @return      void\r
1881          */\r
1882         static private function action_teamdelete()\r
1883         {\r
1884                 global $member, $manager;\r
1885                 \r
1886                 $memberid       = intRequestVar('memberid');\r
1887                 $blogid         = intRequestVar('blogid');\r
1888                 \r
1889                 // check if allowed\r
1890                 $member->blogAdminRights($blogid) or self::disallow();\r
1891                 \r
1892                 $teammem =& $manager->getMember($memberid);\r
1893                 $blog =& $manager->getBlog($blogid);\r
1894                 \r
1895                 self::$skin->parse('teamdelete');\r
1896                 return;\r
1897         }\r
1898         \r
1899         /**\r
1900          * Admin::action_teamdeleteconfirm()\r
1901          * \r
1902          * @param       void\r
1903          * @return      void\r
1904          */\r
1905         static private function action_teamdeleteconfirm()\r
1906         {\r
1907                 global $member;\r
1908                 \r
1909                 $memberid = intRequestVar('memberid');\r
1910                 $blogid = intRequestVar('blogid');\r
1911                 \r
1912                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1913                 if ( $error )\r
1914                 {\r
1915                         self::error($error);\r
1916                 }\r
1917                 self::action_manageteam();\r
1918                 return;\r
1919         }\r
1920         \r
1921         /**\r
1922          * Admin::deleteOneTeamMember()\r
1923          * \r
1924          * @param       void\r
1925          * @return      void\r
1926          */\r
1927         static public function deleteOneTeamMember($blogid, $memberid)\r
1928         {\r
1929                 global $member, $manager;\r
1930                 \r
1931                 $blogid   = intval($blogid);\r
1932                 $memberid = intval($memberid);\r
1933                 \r
1934                 // check if allowed\r
1935                 if ( !$member->blogAdminRights($blogid) )\r
1936                 {\r
1937                         return _ERROR_DISALLOWED;\r
1938                 }\r
1939                 \r
1940                 // check if: - there remains at least one blog admin\r
1941                 //           - (there remains at least one team member)\r
1942                 $tmem =& $manager->getMember($memberid);\r
1943                 \r
1944                 \r
1945                 $data = array(\r
1946                         'member' => &$tmem,\r
1947                         'blogid' => $blogid\r
1948                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1949                 \r
1950                 if ( $tmem->isBlogAdmin($blogid) )\r
1951                 {\r
1952                         /* TODO: why we did double check? */\r
1953                         // check if there are more blog members left and at least one admin\r
1954                         // (check for at least two admins before deletion)\r
1955                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1956                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1957                         $r     = DB::getResult($query);\r
1958                         if ( $r->rowCount() < 2 )\r
1959                         {\r
1960                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1961                         }\r
1962                 }\r
1963                 \r
1964                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1965                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1966                 DB::execute($query);\r
1967                 \r
1968                 $data = array(\r
1969                         'member' => &$tmem,\r
1970                         'blogid' => $blogid\r
1971                 );\r
1972                 $manager->notify('PostDeleteTeamMember', $data);\r
1973                 \r
1974                 return '';\r
1975         }\r
1976         \r
1977         /**\r
1978          * Admin::action_teamchangeadmin()\r
1979          * \r
1980          * @param       void\r
1981          * @return      void\r
1982          */\r
1983         static private function action_teamchangeadmin()\r
1984         {\r
1985                 global $manager, $member;\r
1986                 \r
1987                 $blogid         = intRequestVar('blogid');\r
1988                 $memberid       = intRequestVar('memberid');\r
1989                 \r
1990                 // check if allowed\r
1991                 $member->blogAdminRights($blogid) or self::disallow();\r
1992                 \r
1993                 $mem =& $manager->getMember($memberid);\r
1994                 \r
1995                 // don't allow when there is only one admin at this moment\r
1996                 if ( $mem->isBlogAdmin($blogid) )\r
1997                 {\r
1998                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1999                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2000                         $r = DB::getResult($query);\r
2001                         if ( $r->rowCount() == 1 )\r
2002                         {\r
2003                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2004                         }\r
2005                 }\r
2006                 \r
2007                 if ( $mem->isBlogAdmin($blogid) )\r
2008                 {\r
2009                         $newval = 0;\r
2010                 }\r
2011                 else\r
2012                 {\r
2013                         $newval = 1;\r
2014                 }\r
2015                 \r
2016                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2017                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2018                 DB::execute($query);\r
2019                 \r
2020                 // only show manageteam if member did not change its own admin privileges\r
2021                 if ( $member->isBlogAdmin($blogid) )\r
2022                 {\r
2023                         self::action_manageteam();\r
2024                 }\r
2025                 else\r
2026                 {\r
2027                         self::action_overview(_MSG_ADMINCHANGED);\r
2028                 }\r
2029                 return;\r
2030         }\r
2031         \r
2032         /**\r
2033          * Admin::action_blogsettings()\r
2034          * \r
2035          * @param       void\r
2036          * @return      void\r
2037          */\r
2038         static private function action_blogsettings()\r
2039         {\r
2040                 global $member, $manager;\r
2041                 \r
2042                 $blogid = intRequestVar('blogid');\r
2043                 \r
2044                 // check if allowed\r
2045                 $member->blogAdminRights($blogid) or self::disallow();\r
2046                 \r
2047                 $blog =& $manager->getBlog($blogid);\r
2048                 \r
2049                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2050                 \r
2051                 self::$skin->parse('blogsettings');\r
2052                 return;\r
2053         }\r
2054         \r
2055         /**\r
2056          * Admin::action_categorynew()\r
2057          * \r
2058          * @param       void\r
2059          * @return      void\r
2060          */\r
2061         static private function action_categorynew()\r
2062         {\r
2063                 global $member, $manager;\r
2064                 \r
2065                 $blogid = intRequestVar('blogid');\r
2066                 \r
2067                 $member->blogAdminRights($blogid) or self::disallow();\r
2068                 \r
2069                 $cname = postVar('cname');\r
2070                 $cdesc = postVar('cdesc');\r
2071                 \r
2072                 if ( !isValidCategoryName($cname) )\r
2073                 {\r
2074                         self::error(_ERROR_BADCATEGORYNAME);\r
2075                 }\r
2076                 \r
2077                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2078                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2079                 $res = DB::getResult($query);\r
2080                 if ( $res->rowCount() > 0 )\r
2081                 {\r
2082                         self::error(_ERROR_DUPCATEGORYNAME);\r
2083                 }\r
2084                 \r
2085                 $blog           =& $manager->getBlog($blogid);\r
2086                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2087                 \r
2088                 self::action_blogsettings();\r
2089                 return;\r
2090         }\r
2091         \r
2092         /**\r
2093          * Admin::action_categoryedit()\r
2094          * \r
2095          * @param       void\r
2096          * @return      void\r
2097          */\r
2098         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2099         {\r
2100                 global $member, $manager;\r
2101                 \r
2102                 if ( $blogid == '' )\r
2103                 {\r
2104                         $blogid = intGetVar('blogid');\r
2105                 }\r
2106                 else\r
2107                 {\r
2108                         $blogid = intval($blogid);\r
2109                 }\r
2110                 if ( $catid == '' )\r
2111                 {\r
2112                         $catid = intGetVar('catid');\r
2113                 }\r
2114                 else\r
2115                 {\r
2116                         $catid = intval($catid);\r
2117                 }\r
2118                 \r
2119                 /* TODO: we should consider to use the other way insterad of this */\r
2120                 $_REQUEST['blogid']             = $blogid;\r
2121                 $_REQUEST['catid']              = $catid;\r
2122                 $_REQUEST['desturl']    = $desturl;\r
2123                 $member->blogAdminRights($blogid) or self::disallow();\r
2124                 \r
2125                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2126                 \r
2127                 self::$skin->parse('categoryedit');\r
2128                 return;\r
2129         }\r
2130         \r
2131         /**\r
2132          * Admin::action_categoryupdate()\r
2133          * \r
2134          * @param       void\r
2135          * @return      void\r
2136          */\r
2137         static private function action_categoryupdate()\r
2138         {\r
2139                 global $member, $manager;\r
2140                 \r
2141                 $blogid         = intPostVar('blogid');\r
2142                 $catid          = intPostVar('catid');\r
2143                 $cname          = postVar('cname');\r
2144                 $cdesc          = postVar('cdesc');\r
2145                 $desturl        = postVar('desturl');\r
2146                 \r
2147                 $member->blogAdminRights($blogid) or self::disallow();\r
2148                 \r
2149                 if ( !isValidCategoryName($cname) )\r
2150                 {\r
2151                         self::error(_ERROR_BADCATEGORYNAME);\r
2152                 }\r
2153                 \r
2154                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2155                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2156                 $res    = DB::getResult($query);\r
2157                 if ( $res->rowCount() > 0 )\r
2158                 {\r
2159                         self::error(_ERROR_DUPCATEGORYNAME);\r
2160                 }\r
2161                 \r
2162                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2163                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2164                 DB::execute($query);\r
2165                 \r
2166                 // store plugin options\r
2167                 $aOptions = requestArray('plugoption');\r
2168                 NucleusPlugin::apply_plugin_options($aOptions);\r
2169                 $data = array(\r
2170                         'context'       => 'category',\r
2171                         'catid'         => $catid\r
2172                 );\r
2173                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2174                 \r
2175                 if ( $desturl )\r
2176                 {\r
2177                         redirect($desturl);\r
2178                         exit;\r
2179                 }\r
2180                 else\r
2181                 {\r
2182                         self::action_blogsettings();\r
2183                 }\r
2184                 return;\r
2185         }\r
2186         \r
2187         /**\r
2188          * Admin::action_categorydelete()\r
2189          * \r
2190          * @param       void\r
2191          * @return      void\r
2192          */\r
2193         static private function action_categorydelete()\r
2194         {\r
2195                 global $member, $manager;\r
2196                 \r
2197                 $blogid = intRequestVar('blogid');\r
2198                 $catid  = intRequestVar('catid');\r
2199                 \r
2200                 $member->blogAdminRights($blogid) or self::disallow();\r
2201                 \r
2202                 $blog =& $manager->getBlog($blogid);\r
2203                 \r
2204                 // check if the category is valid\r
2205                 if ( !$blog->isValidCategory($catid) )\r
2206                 {\r
2207                         self::error(_ERROR_NOSUCHCATEGORY);\r
2208                 }\r
2209                 \r
2210                 // don't allow deletion of default category\r
2211                 if ( $blog->getDefaultCategory() == $catid )\r
2212                 {\r
2213                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2214                 }\r
2215                 \r
2216                 // check if catid is the only category left for blogid\r
2217                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2218                 $query = sprintf($query, sql_table('category'), $blogid);\r
2219                 $res = DB::getResult($query);\r
2220                 if ( $res->rowCount() == 1 )\r
2221                 {\r
2222                         self::error(_ERROR_DELETELASTCATEGORY);\r
2223                 }\r
2224                 \r
2225                 self::$skin->parse('categorydelete');\r
2226                 return;\r
2227         }\r
2228         \r
2229         /**\r
2230          * Admin::action_categorydeleteconfirm()\r
2231          * \r
2232          * @param       void\r
2233          * @return      void\r
2234          */\r
2235         static private function action_categorydeleteconfirm()\r
2236         {\r
2237                 global $member, $manager;\r
2238                 \r
2239                 $blogid = intRequestVar('blogid');\r
2240                 $catid  = intRequestVar('catid');\r
2241                 \r
2242                 $member->blogAdminRights($blogid) or self::disallow();\r
2243                 \r
2244                 $error = self::deleteOneCategory($catid);\r
2245                 if ( $error )\r
2246                 {\r
2247                         self::error($error);\r
2248                 }\r
2249                 \r
2250                 self::action_blogsettings();\r
2251                 return;\r
2252         }\r
2253         \r
2254         /**\r
2255          * Admin::deleteOneCategory()\r
2256          * Delete a category by its id\r
2257          * \r
2258          * @param       String  $catid  category id for deleting\r
2259          * @return      Void\r
2260          */\r
2261         static public function deleteOneCategory($catid)\r
2262         {\r
2263                 global $manager, $member;\r
2264                 \r
2265                 $catid  = intval($catid);\r
2266                 $blogid = getBlogIDFromCatID($catid);\r
2267                 \r
2268                 if ( !$member->blogAdminRights($blogid) )\r
2269                 {\r
2270                         return ERROR_DISALLOWED;\r
2271                 }\r
2272                 \r
2273                 // get blog\r
2274                 $blog =& $manager->getBlog($blogid);\r
2275                 \r
2276                 // check if the category is valid\r
2277                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2278                 {\r
2279                         return _ERROR_NOSUCHCATEGORY;\r
2280                 }\r
2281                 \r
2282                 $destcatid = $blog->getDefaultCategory();\r
2283                 \r
2284                 // don't allow deletion of default category\r
2285                 if ( $blog->getDefaultCategory() == $catid )\r
2286                 {\r
2287                         return _ERROR_DELETEDEFCATEGORY;\r
2288                 }\r
2289                 \r
2290                 // check if catid is the only category left for blogid\r
2291                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2292                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2293                 \r
2294                 $res = DB::getResult($query);\r
2295                 if ( $res->rowCount() == 1 )\r
2296                 {\r
2297                         return _ERROR_DELETELASTCATEGORY;\r
2298                 }\r
2299                 \r
2300                 $data = array('catid' => $catid);\r
2301                 $manager->notify('PreDeleteCategory', $data);\r
2302                 \r
2303                 // change category for all items to the default category\r
2304                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2305                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2306                 DB::execute($query);\r
2307                 \r
2308                 // delete all associated plugin options\r
2309                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2310                 \r
2311                 // delete category\r
2312                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2313                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2314                 DB::execute($query);\r
2315                 \r
2316                 $data = array('catid' => $catid);\r
2317                 $manager->notify('PostDeleteCategory', $data);\r
2318                 return;\r
2319         }\r
2320         \r
2321         /**\r
2322          * Admin::moveOneCategory()\r
2323          * Delete a category by its id\r
2324          * \r
2325          * @param       int     $catid          category id for move\r
2326          * @param       int     $destblogid     blog id for destination\r
2327          * @return      void\r
2328          */\r
2329         static public function moveOneCategory($catid, $destblogid)\r
2330         {\r
2331                 global $manager, $member;\r
2332                 $catid      = intval($catid);\r
2333                 $destblogid = intval($destblogid);\r
2334                 $blogid     = getBlogIDFromCatID($catid);\r
2335                 // mover should have admin rights on both blogs\r
2336                 if (!$member->blogAdminRights($blogid)) {\r
2337                         return _ERROR_DISALLOWED;\r
2338                 }\r
2339                 if (!$member->blogAdminRights($destblogid)) {\r
2340                         return _ERROR_DISALLOWED;\r
2341                 }\r
2342                 // cannot move to self\r
2343                 if ($blogid == $destblogid) {\r
2344                         return _ERROR_MOVETOSELF;\r
2345                 }\r
2346                 // get blogs\r
2347                 $blog     =& $manager->getBlog($blogid);\r
2348                 $destblog =& $manager->getBlog($destblogid);\r
2349                 // check if the category is valid\r
2350                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2351                         return _ERROR_NOSUCHCATEGORY;\r
2352                 }\r
2353                 // don't allow default category to be moved\r
2354                 if ($blog->getDefaultCategory() == $catid) {\r
2355                         return _ERROR_MOVEDEFCATEGORY;\r
2356                 }\r
2357                 $manager->notify(\r
2358                                 'PreMoveCategory',\r
2359                                 array(\r
2360                                                 'catid'      => &$catid,\r
2361                                                 'sourceblog' => &$blog,\r
2362                                                 'destblog'   => &$destblog\r
2363                                 )\r
2364                 );\r
2365                 // update comments table (cblog)\r
2366                 $query = 'SELECT '\r
2367                 . '    inumber '\r
2368                 . 'FROM '\r
2369                 .      sql_table('item') . ' '\r
2370                 . 'WHERE '\r
2371                 . '    icat = %d';\r
2372                 $items = sql_query(sprintf($query, $catid));\r
2373                 while ($oItem = sql_fetch_object($items)) {\r
2374                         $query = 'UPDATE '\r
2375                         .      sql_table('comment') . ' '\r
2376                         . 'SET '\r
2377                         . '    cblog = %d' . ' '\r
2378                         . 'WHERE '\r
2379                         . '    citem = %d';\r
2380                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2381                 }\r
2382         \r
2383                 // update items (iblog)\r
2384                 $query = 'UPDATE '\r
2385                 .      sql_table('item') . ' '\r
2386                 . 'SET '\r
2387                 . '    iblog = %d '\r
2388                 . 'WHERE '\r
2389                 . '    icat = %d';\r
2390                 sql_query(sprintf($query, $destblogid, $catid));\r
2391         \r
2392                 // move category\r
2393                 $query = 'UPDATE '\r
2394                 .      sql_table('category') . ' '\r
2395                 . 'SET '\r
2396                 . '    cblog = %d' . ' '\r
2397                 . 'WHERE '\r
2398                 . '    catid = %d';\r
2399                 sql_query(sprintf($query, $destblogid, $catid));\r
2400                 $manager->notify(\r
2401                                 'PostMoveCategory',\r
2402                                 array(\r
2403                                                 'catid'      => &$catid,\r
2404                                                 'sourceblog' => &$blog,\r
2405                                                 'destblog'   => $destblog\r
2406                                 )\r
2407                 );\r
2408                 return;\r
2409         }\r
2410 \r
2411         /**\r
2412          * Admin::action_blogsettingsupdate\r
2413          * Updating blog settings\r
2414          * \r
2415          * @param       Void\r
2416          * @return      Void\r
2417          */\r
2418         static private function action_blogsettingsupdate()\r
2419         {\r
2420                 global $member, $manager;\r
2421                 \r
2422                 $blogid = intRequestVar('blogid');\r
2423                 \r
2424                 $member->blogAdminRights($blogid) or self::disallow();\r
2425                 \r
2426                 $blog =& $manager->getBlog($blogid);\r
2427                 \r
2428                 $notify_address = trim(postVar('notify'));\r
2429                 $shortname              = trim(postVar('shortname'));\r
2430                 $updatefile             = trim(postVar('update'));\r
2431                 \r
2432                 $notifyComment  = intPostVar('notifyComment');\r
2433                 $notifyVote             = intPostVar('notifyVote');\r
2434                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2435                 \r
2436                 if ( $notifyComment == 0 )\r
2437                 {\r
2438                         $notifyComment = 1;\r
2439                 }\r
2440                 if ( $notifyVote == 0 )\r
2441                 {\r
2442                         $notifyVote = 1;\r
2443                 }\r
2444                 if ( $notifyNewItem == 0 )\r
2445                 {\r
2446                         $notifyNewItem = 1;\r
2447                 }\r
2448                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2449                 \r
2450                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2451                 {\r
2452                         self::error(_ERROR_BADNOTIFY);\r
2453                 }\r
2454                 \r
2455                 if ( !isValidShortName($shortname) )\r
2456                 {\r
2457                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2458                 }\r
2459                 \r
2460                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2461                 {\r
2462                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2463                 }\r
2464                 // check if update file is writable\r
2465                 if ( $updatefile && !is_writeable($updatefile) )\r
2466                 {\r
2467                         self::error(_ERROR_UPDATEFILE);\r
2468                 }\r
2469                 \r
2470                 $blog->setName(trim(postVar('name')));\r
2471                 $blog->setShortName($shortname);\r
2472                 $blog->setNotifyAddress($notify_address);\r
2473                 $blog->setNotifyType($notifyType);\r
2474                 $blog->setMaxComments(postVar('maxcomments'));\r
2475                 $blog->setCommentsEnabled(postVar('comments'));\r
2476                 $blog->setTimeOffset(postVar('timeoffset'));\r
2477                 $blog->setUpdateFile($updatefile);\r
2478                 $blog->setURL(trim(postVar('url')));\r
2479                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2480                 $blog->setDescription(trim(postVar('desc')));\r
2481                 $blog->setPublic(postVar('public'));\r
2482                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2483                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2484                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2485                 $blog->setSearchable(intPostVar('searchable'));\r
2486                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2487                 $blog->writeSettings();\r
2488                 \r
2489                 // store plugin options\r
2490                 $aOptions = requestArray('plugoption');\r
2491                 NucleusPlugin::apply_plugin_options($aOptions);\r
2492                 \r
2493                 $data = array(\r
2494                         'context' => 'blog',\r
2495                         'blogid'  => $blogid,\r
2496                         'blog'    => &$blog\r
2497                 );\r
2498                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2499                 \r
2500                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2501                 return;\r
2502         }\r
2503         \r
2504         /**\r
2505          * Admin::action_deleteblog()\r
2506          * \r
2507          * @param       void\r
2508          * @return      void\r
2509          */\r
2510         static private function action_deleteblog()\r
2511         {\r
2512                 global $member, $CONF, $manager;\r
2513                 \r
2514                 $blogid = intRequestVar('blogid');\r
2515                 \r
2516                 $member->blogAdminRights($blogid) or self::disallow();\r
2517                 \r
2518                 // check if blog is default blog\r
2519                 if ( $CONF['DefaultBlog'] == $blogid )\r
2520                 {\r
2521                         self::error(_ERROR_DELDEFBLOG);\r
2522                 }\r
2523                 \r
2524                 $blog =& $manager->getBlog($blogid);\r
2525                 \r
2526                 self::$skin->parse('deleteblog');\r
2527                 return;\r
2528         }\r
2529         \r
2530         /**\r
2531          * Admin::action_deleteblogconfirm()\r
2532          * Delete Blog\r
2533          * \r
2534          * @param       Void\r
2535          * @return      Void\r
2536          */\r
2537         static private function action_deleteblogconfirm()\r
2538         {\r
2539                 global $member, $CONF, $manager;\r
2540                 \r
2541                 $blogid = intRequestVar('blogid');\r
2542                 \r
2543                 $data = array('blogid' => $blogid);\r
2544                 $manager->notify('PreDeleteBlog', $data);\r
2545                 \r
2546                 $member->blogAdminRights($blogid) or self::disallow();\r
2547                 \r
2548                 // check if blog is default blog\r
2549                 if ( $CONF['DefaultBlog'] == $blogid )\r
2550                 {\r
2551                         self::error(_ERROR_DELDEFBLOG);\r
2552                 }\r
2553                 \r
2554                 // delete all comments\r
2555                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2556                 DB::execute($query);\r
2557                 \r
2558                 // delete all items\r
2559                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2560                 DB::execute($query);\r
2561                 \r
2562                 // delete all team members\r
2563                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2564                 DB::execute($query);\r
2565                 \r
2566                 // delete all bans\r
2567                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2568                 DB::execute($query);\r
2569                 \r
2570                 // delete all categories\r
2571                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2572                 DB::execute($query);\r
2573                 \r
2574                 // delete all associated plugin options\r
2575                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2576                 \r
2577                 // delete the blog itself\r
2578                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2579                 DB::execute($query);\r
2580                 \r
2581                 $data = array('blogid' => $blogid);\r
2582                 $manager->notify('PostDeleteBlog', $data);\r
2583                 \r
2584                 self::action_overview(_DELETED_BLOG);\r
2585                 return;\r
2586         }\r
2587         \r
2588         /**\r
2589          * Admin::action_memberdelete()\r
2590          * \r
2591          * @param       void\r
2592          * @return      void\r
2593          */\r
2594         static private function action_memberdelete()\r
2595         {\r
2596                 global $member, $manager;\r
2597                 \r
2598                 $memberid = intRequestVar('memberid');\r
2599                 \r
2600                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2601                 \r
2602                 $mem =& $manager->getMember($memberid);\r
2603                 \r
2604                 self::$skin->parse('memberdelete');\r
2605                 return;\r
2606         }\r
2607         \r
2608         /**\r
2609          * Admin::action_memberdeleteconfirm()\r
2610          * \r
2611          * @param       void\r
2612          * @return      void\r
2613          */\r
2614         static private function action_memberdeleteconfirm()\r
2615         {\r
2616                 global $member;\r
2617                 \r
2618                 $memberid = intRequestVar('memberid');\r
2619                 \r
2620                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2621                 \r
2622                 $error = self::deleteOneMember($memberid);\r
2623                 if ( $error )\r
2624                 {\r
2625                         self::error($error);\r
2626                 }\r
2627                 \r
2628                 if ( $member->isAdmin() )\r
2629                 {\r
2630                         self::action_usermanagement();\r
2631                 }\r
2632                 else\r
2633                 {\r
2634                         self::action_overview(_DELETED_MEMBER);\r
2635                 }\r
2636                 return;\r
2637         }\r
2638         \r
2639         /**\r
2640          * Admin::deleteOneMember()\r
2641          * Delete a member by id\r
2642          * \r
2643          * @static\r
2644          * @params      Integer $memberid       member id\r
2645          * @return      String  null string or error messages\r
2646          */\r
2647         static public function deleteOneMember($memberid)\r
2648         {\r
2649                 global $manager;\r
2650                 \r
2651                 $memberid = intval($memberid);\r
2652                 $mem =& $manager->getMember($memberid);\r
2653                 \r
2654                 if ( !$mem->canBeDeleted() )\r
2655                 {\r
2656                         return _ERROR_DELETEMEMBER;\r
2657                 }\r
2658                 \r
2659                 $data = array('member' => &$mem);\r
2660                 $manager->notify('PreDeleteMember', $data);\r
2661                 \r
2662                 /* unlink comments from memberid */\r
2663                 if ( $memberid )\r
2664                 {\r
2665                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2666                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2667                         DB::execute($query);\r
2668                 }\r
2669                 \r
2670                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2671                 DB::execute($query);\r
2672                 \r
2673                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2674                 DB::execute($query);\r
2675                 \r
2676                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2677                 DB::execute($query);\r
2678                 \r
2679                 // delete all associated plugin options\r
2680                 NucleusPlugin::delete_option_values('member', $memberid);\r
2681                 \r
2682                 $data = array('member' => &$mem);\r
2683                 $manager->notify('PostDeleteMember', $data);\r
2684                 \r
2685                 return '';\r
2686         }\r
2687         \r
2688         /**\r
2689          * Admin::action_createnewlog()\r
2690          * \r
2691          * @param       void\r
2692          * @return      void\r
2693          */\r
2694         static private function action_createnewlog()\r
2695         {\r
2696                 global $member, $CONF, $manager;\r
2697                 \r
2698                 // Only Super-Admins can do this\r
2699                 $member->isAdmin() or self::disallow();\r
2700                 \r
2701                 self::$skin->parse('createnewlog');\r
2702                 return;\r
2703         }\r
2704         \r
2705         /**\r
2706          * Admin::action_addnewlog()\r
2707          * \r
2708          * @param       void\r
2709          * @return      void\r
2710          */\r
2711         static private function action_addnewlog()\r
2712         {\r
2713                 global $member, $manager, $CONF;\r
2714                 \r
2715                 // Only Super-Admins can do this\r
2716                 $member->isAdmin() or self::disallow();\r
2717                 \r
2718                 $bname                  = trim(postVar('name'));\r
2719                 $bshortname             = trim(postVar('shortname'));\r
2720                 $btimeoffset    = postVar('timeoffset');\r
2721                 $bdesc                  = trim(postVar('desc'));\r
2722                 $bdefskin               = postVar('defskin');\r
2723                 \r
2724                 if ( !isValidShortName($bshortname) )\r
2725                 {\r
2726                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2727                 }\r
2728                 \r
2729                 if ( $manager->existsBlog($bshortname) )\r
2730                 {\r
2731                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2732                 }\r
2733                 \r
2734                 $data = array(\r
2735                         'name'        => &$bname,\r
2736                         'shortname'   => &$bshortname,\r
2737                         'timeoffset'  => &$btimeoffset,\r
2738                         'description' => &$bdesc,\r
2739                         'defaultskin' => &$bdefskin\r
2740                 );\r
2741                 $manager->notify('PreAddBlog', $data);\r
2742                 \r
2743                 // add slashes for sql queries\r
2744                 $bname                  = DB::quoteValue($bname);\r
2745                 $bshortname             = DB::quoteValue($bshortname);\r
2746                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2747                 $bdesc                  = DB::quoteValue($bdesc);\r
2748                 $bdefskin               = DB::quoteValue($bdefskin);\r
2749                 \r
2750                 // create blog\r
2751                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2752                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2753                 DB::execute($query);\r
2754                 \r
2755                 $blogid = DB::getInsertId();\r
2756                 $blog   =& $manager->getBlog($blogid);\r
2757                 \r
2758                 // create new category\r
2759                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2760                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2761                 \r
2762                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2763                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2764                 $catid = DB::getInsertId();\r
2765                 \r
2766                 // set as default category\r
2767                 $blog->setDefaultCategory($catid);\r
2768                 $blog->writeSettings();\r
2769                 \r
2770                 // create team member\r
2771                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2772                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2773                 DB::execute($query);\r
2774                 \r
2775                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2776                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2777                 \r
2778                 $blog->additem(\r
2779                         $blog->getDefaultCategory(),\r
2780                         $itemdeftitle,$itemdefbody,\r
2781                         '',\r
2782                         $blogid,\r
2783                         $member->getID(),\r
2784                         $blog->getCorrectTime(),\r
2785                         0,\r
2786                         0,\r
2787                         0\r
2788                 );\r
2789                 \r
2790                 $data = array('blog' => &$blog);\r
2791                 $manager->notify('PostAddBlog', $data);\r
2792                 \r
2793                 $data = array(\r
2794                         'blog'                  => &$blog,\r
2795                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2796                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2797                         'catid'                 => $catid\r
2798                 );\r
2799                 $manager->notify('PostAddCategory', $data);\r
2800                 \r
2801                 /* TODO: we should consider to use the other way insterad of this */\r
2802                 $_REQUEST['blogid'] = $blogid;\r
2803                 $_REQUEST['catid']  = $catid;\r
2804                 self::$skin->parse('addnewlog');\r
2805                 return;\r
2806         }\r
2807         \r
2808         /**\r
2809          * Admin::action_addnewlog2()\r
2810          * \r
2811          * @param       void\r
2812          * @return      void\r
2813          */\r
2814         static private function action_addnewlog2()\r
2815         {\r
2816                 global $member, $manager;\r
2817                 $blogid = intRequestVar('blogid');\r
2818                 \r
2819                 $member->blogAdminRights($blogid) or self::disallow();\r
2820                 \r
2821                 $burl = requestVar('url');\r
2822                 \r
2823                 $blog =& $manager->getBlog($blogid);\r
2824                 $blog->setURL(trim($burl));\r
2825                 $blog->writeSettings();\r
2826                 \r
2827                 self::action_overview(_MSG_NEWBLOG);\r
2828                 return;\r
2829         }\r
2830         \r
2831         /**\r
2832          * Admin::action_skinieoverview()\r
2833          * \r
2834          * @param       void\r
2835          * @return      void\r
2836          */\r
2837         static private function action_skinieoverview()\r
2838         {\r
2839                 global $member, $DIR_LIBS, $manager;\r
2840                 \r
2841                 $member->isAdmin() or self::disallow();\r
2842                 \r
2843                 include_once($DIR_LIBS . 'skinie.php');\r
2844                 \r
2845                 self::$skin->parse('skinieoverview');\r
2846                 return;\r
2847         }\r
2848         \r
2849         /**\r
2850          * Admin::action_skinieimport()\r
2851          * \r
2852          * @param       void\r
2853          * @return      void\r
2854          */\r
2855         static private function action_skinieimport()\r
2856         {\r
2857                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2858                 \r
2859                 $member->isAdmin() or self::disallow();\r
2860                 \r
2861                 // load skinie class\r
2862                 include_once($DIR_LIBS . 'skinie.php');\r
2863                 \r
2864                 $skinFileRaw    = postVar('skinfile');\r
2865                 $mode                   = postVar('mode');\r
2866                 \r
2867                 $importer = new SkinImport();\r
2868                 \r
2869                 // get full filename\r
2870                 if ( $mode == 'file' )\r
2871                 {\r
2872                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2873                         \r
2874                         /* TODO: remove this\r
2875                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2876                         if ( !file_exists($skinFile) )\r
2877                         {\r
2878                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2879                         }\r
2880                          */\r
2881                 }\r
2882                 else\r
2883                 {\r
2884                         $skinFile = $skinFileRaw;\r
2885                 }\r
2886                 \r
2887                 // read only metadata\r
2888                 $error = $importer->readFile($skinFile, 1);\r
2889                 \r
2890                 /* TODO: we should consider to use the other way insterad of this */\r
2891                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2892                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2893                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2894                 \r
2895                 // clashes\r
2896                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2897                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2898                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2899                 \r
2900                 /* TODO: we should consider to use the other way insterad of this */\r
2901                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2902                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2903                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2904                 \r
2905                 if ( $error )\r
2906                 {\r
2907                         self::error($error);\r
2908                 }\r
2909                 \r
2910                 self::$skin->parse('skinieimport');\r
2911                 return;\r
2912         }\r
2913         \r
2914         /**\r
2915          * Admin::action_skiniedoimport()\r
2916          * \r
2917          * @param       void\r
2918          * @return      void\r
2919          */\r
2920         static private function action_skiniedoimport()\r
2921         {\r
2922                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2923                 \r
2924                 $member->isAdmin() or self::disallow();\r
2925                 \r
2926                 // load skinie class\r
2927                 include_once($DIR_LIBS . 'skinie.php');\r
2928                 \r
2929                 $skinFileRaw    = postVar('skinfile');\r
2930                 $mode                   = postVar('mode');\r
2931                 \r
2932                 $allowOverwrite = intPostVar('overwrite');\r
2933                 \r
2934                 // get full filename\r
2935                 if ( $mode == 'file' )\r
2936                 {\r
2937                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2938                         \r
2939                         /* TODO: remove this\r
2940                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2941                         if ( !file_exists($skinFile) )\r
2942                         {\r
2943                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2944                         }\r
2945                         */\r
2946                 }\r
2947                 else\r
2948                 {\r
2949                         $skinFile = $skinFileRaw;\r
2950                 }\r
2951                 \r
2952                 $importer = new SkinImport();\r
2953                 \r
2954                 $error = $importer->readFile($skinFile);\r
2955                 \r
2956                 if ( $error )\r
2957                 {\r
2958                         self::error($error);\r
2959                 }\r
2960                 \r
2961                 $error = $importer->writeToDatabase($allowOverwrite);\r
2962                 \r
2963                 if ( $error )\r
2964                 {\r
2965                         self::error($error);\r
2966                 }\r
2967                 \r
2968                 /* TODO: we should consider to use the other way insterad of this */\r
2969                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2970                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2971                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2972                 \r
2973                 self::$skin->parse('skiniedoimport');\r
2974                 return;\r
2975         }\r
2976 \r
2977         /**\r
2978          * Admin::action_skinieexport()\r
2979          * \r
2980          * @param       void\r
2981          * @return      void\r
2982          */\r
2983         static private function action_skinieexport()\r
2984         {\r
2985                 global $member, $DIR_LIBS;\r
2986                 \r
2987                 $member->isAdmin() or self::disallow();\r
2988                 \r
2989                 // load skinie class\r
2990                 include_once($DIR_LIBS . 'skinie.php');\r
2991                 \r
2992                 $aSkins         = requestIntArray('skin');\r
2993                 $aTemplates     = requestIntArray('template');\r
2994                 \r
2995                 if ( !is_array($aTemplates) )\r
2996                 {\r
2997                         $aTemplates = array();\r
2998                 }\r
2999                 if ( !is_array($aSkins) )\r
3000                 {\r
3001                         $aSkins = array();\r
3002                 }\r
3003                 \r
3004                 $skinList               = array_keys($aSkins);\r
3005                 $templateList   = array_keys($aTemplates);\r
3006                 \r
3007                 $info = postVar('info');\r
3008                 \r
3009                 $exporter = new SkinExport();\r
3010                 foreach ( $skinList as $skinId )\r
3011                 {\r
3012                         $exporter->addSkin($skinId);\r
3013                 }\r
3014                 foreach ($templateList as $templateId)\r
3015                 {\r
3016                         $exporter->addTemplate($templateId);\r
3017                 }\r
3018                 $exporter->setInfo($info);\r
3019                 \r
3020                 $exporter->export();\r
3021                 return;\r
3022         }\r
3023         \r
3024         /**\r
3025          * Admin::action_templateoverview()\r
3026          * \r
3027          * @param       void\r
3028          * @return      void\r
3029          */\r
3030         static private function action_templateoverview()\r
3031         {\r
3032                 global $member, $manager;\r
3033                 \r
3034                 $member->isAdmin() or self::disallow();\r
3035                 \r
3036                 self::$skin->parse('templateoverview');\r
3037                 return;\r
3038         }\r
3039         \r
3040         /**\r
3041          * Admin::action_templateedit()\r
3042          * \r
3043          * @param       string  $msg    message for pageheader\r
3044          * @return      void\r
3045          */\r
3046         static private function action_templateedit($msg = '')\r
3047         {\r
3048                 global $member, $manager;\r
3049                 if ( $msg )\r
3050                 {\r
3051                         self::$headMess = $msg;\r
3052                 }\r
3053                 \r
3054                 $templateid = intRequestVar('templateid');\r
3055                 \r
3056                 $member->isAdmin() or self::disallow();\r
3057                 \r
3058                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3059                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3060                 \r
3061                 self::$skin->parse('templateedit');\r
3062                 return;\r
3063         }\r
3064         \r
3065         /**\r
3066          * Admin::action_templateupdate()\r
3067          * \r
3068          * @param       void\r
3069          * @return      void\r
3070          */\r
3071         static private function action_templateupdate()\r
3072         {\r
3073                 global $member,$manager;\r
3074                 \r
3075                 $templateid = intRequestVar('templateid');\r
3076                 \r
3077                 $member->isAdmin() or self::disallow();\r
3078                 \r
3079                 $name = postVar('tname');\r
3080                 $desc = postVar('tdesc');\r
3081                 \r
3082                 if ( !isValidTemplateName($name) )\r
3083                 {\r
3084                         self::error(_ERROR_BADTEMPLATENAME);\r
3085                 }\r
3086                 \r
3087                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3088                 {\r
3089                         self::error(_ERROR_DUPTEMPLATENAME);\r
3090                 }\r
3091                 \r
3092                 // 1. Remove all template parts\r
3093                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3094                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3095                 DB::execute($query);\r
3096                 \r
3097                 // 2. Update description\r
3098                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3099                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3100                 DB::execute($query);\r
3101                 \r
3102                 // 3. Add non-empty template parts\r
3103                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3104                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3105                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3106                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3107                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3108                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3109                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3110                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3111                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3114                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3115                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3116                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3117                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3118                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3119                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3120                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3121                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3122                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3123                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3124                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3125                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3126                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3127                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3128                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3129                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3130                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3131                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3132                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3133                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3134                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3135                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3136                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3137                 \r
3138                 $data = array('fields' => array());\r
3139                 $manager->notify('TemplateExtraFields', $data);\r
3140                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3141                 {\r
3142                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3143                         {\r
3144                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3145                         }\r
3146                 }\r
3147                 \r
3148                 // jump back to template edit\r
3149                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3150                 return;\r
3151         }\r
3152         \r
3153         /**\r
3154          * Admin::addToTemplate()\r
3155          * \r
3156          * @param       Integer $id     ID for template\r
3157          * @param       String  $partname       parts name\r
3158          * @param       String  $content        template contents\r
3159          * @return      Integer record index\r
3160          * \r
3161          */\r
3162         static private function addToTemplate($id, $partname, $content)\r
3163         {\r
3164                 // don't add empty parts:\r
3165                 if ( !trim($content) )\r
3166                 {\r
3167                         return -1;\r
3168                 }\r
3169                 \r
3170                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3171                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3172                 if ( DB::execute($query) === FALSE )\r
3173                 {\r
3174                         $err = DB::getError();\r
3175                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3176                 }\r
3177                 return DB::getInsertId();\r
3178         }\r
3179         \r
3180         /**\r
3181          * Admin::action_templatedelete()\r
3182          * \r
3183          * @param       void\r
3184          * @return      void\r
3185          */\r
3186         static private function action_templatedelete()\r
3187         {\r
3188                 global $member, $manager;\r
3189                 \r
3190                 $member->isAdmin() or self::disallow();\r
3191                 \r
3192                 $templateid = intRequestVar('templateid');\r
3193                 // TODO: check if template can be deleted\r
3194                 \r
3195                 self::$skin->parse('templatedelete');\r
3196                 return;\r
3197         }\r
3198         \r
3199         /**\r
3200          * Admin::action_templatedeleteconfirm()\r
3201          * \r
3202          * @param       void\r
3203          * @return      void\r
3204          */\r
3205         static private function action_templatedeleteconfirm()\r
3206         {\r
3207                 global $member, $manager;\r
3208                 \r
3209                 $templateid = intRequestVar('templateid');\r
3210                 \r
3211                 $member->isAdmin() or self::disallow();\r
3212                 \r
3213                 $data = array('templateid' => $templateid);\r
3214                 $manager->notify('PreDeleteTemplate', $data);\r
3215                 \r
3216                 // 1. delete description\r
3217                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3218                 \r
3219                 // 2. delete parts\r
3220                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3221                 \r
3222                 \r
3223                 $data = array('templateid' => $templateid);\r
3224                 $manager->notify('PostDeleteTemplate', $data);\r
3225                 \r
3226                 self::action_templateoverview();\r
3227                 return;\r
3228         }\r
3229         \r
3230         /**\r
3231          * Admin::action_templatenew()\r
3232          * \r
3233          * @param       void\r
3234          * @return      void\r
3235          */\r
3236         static private function action_templatenew()\r
3237         {\r
3238                 global $member;\r
3239                 \r
3240                 $member->isAdmin() or self::disallow();\r
3241                 \r
3242                 $name = postVar('name');\r
3243                 $desc = postVar('desc');\r
3244                 \r
3245                 if ( !isValidTemplateName($name) )\r
3246                 {\r
3247                         self::error(_ERROR_BADTEMPLATENAME);\r
3248                 }\r
3249                 \r
3250                 if ( Template::exists($name) )\r
3251                 {\r
3252                         self::error(_ERROR_DUPTEMPLATENAME);\r
3253                 }\r
3254                 \r
3255                 $newTemplateId = Template::createNew($name, $desc);\r
3256                 \r
3257                 self::action_templateoverview();\r
3258                 return;\r
3259         }\r
3260         \r
3261         /**\r
3262          * Admin::action_templateclone()\r
3263          * \r
3264          * @param       void\r
3265          * @return      void\r
3266          */\r
3267         static private function action_templateclone()\r
3268         {\r
3269                 global $member;\r
3270                 \r
3271                 $templateid = intRequestVar('templateid');\r
3272                 \r
3273                 $member->isAdmin() or self::disallow();\r
3274                 \r
3275                 // 1. read old template\r
3276                 $name = Template::getNameFromId($templateid);\r
3277                 $desc = Template::getDesc($templateid);\r
3278                 \r
3279                 // 2. create desc thing\r
3280                 $name = "cloned" . $name;\r
3281                 \r
3282                 // if a template with that name already exists:\r
3283                 if ( Template::exists($name) )\r
3284                 {\r
3285                         $i = 1;\r
3286                         while (Template::exists($name . $i))\r
3287                         {\r
3288                                 $i++;\r
3289                         }\r
3290                         $name .= $i;\r
3291                 }\r
3292                 \r
3293                 $newid = Template::createNew($name, $desc);\r
3294                 \r
3295                 // 3. create clone\r
3296                 // go through parts of old template and add them to the new one\r
3297                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3298                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3299                 \r
3300                 $res = DB::getResult($query);\r
3301                 foreach ( $res as $row)\r
3302                 {\r
3303                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3304                 }\r
3305                 \r
3306                 self::action_templateoverview();\r
3307                 return;\r
3308         }\r
3309         \r
3310         /**\r
3311          * Admin::action_admintemplateoverview()\r
3312          * \r
3313          * @param       void\r
3314          * @return      void\r
3315          */\r
3316         static private function action_admintemplateoverview()\r
3317         {\r
3318                 global $member;\r
3319                 $member->isAdmin() or self::disallow();\r
3320                 self::$skin->parse('admntemplateoverview');\r
3321                 return;\r
3322         }\r
3323         \r
3324         /**\r
3325          * Admin::action_admintemplateedit()\r
3326          * \r
3327          * @param       string  $msg    message for pageheader\r
3328          * @return      void\r
3329          */\r
3330         static private function action_admintemplateedit($msg = '')\r
3331         {\r
3332                 global $member, $manager;\r
3333                 if ( $msg )\r
3334                 {\r
3335                         self::$headMess = $msg;\r
3336                 }\r
3337                 $member->isAdmin() or self::disallow();\r
3338                 \r
3339                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3340                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3341                 \r
3342                 self::$skin->parse('admintemplateedit');\r
3343                 return;\r
3344         }\r
3345         \r
3346         /**\r
3347          * Admin::action_admintemplateupdate()\r
3348          * \r
3349          * @param       void\r
3350          * @return      void\r
3351          */\r
3352         static private function action_admintemplateupdate()\r
3353         {\r
3354                 global $member, $manager;\r
3355                 $templateid = intRequestVar('templateid');\r
3356                 $member->isAdmin() or self::disallow();\r
3357                 $name = postVar('tname');\r
3358                 $desc = postVar('tdesc');\r
3359                 \r
3360                 if ( !isValidTemplateName($name) )\r
3361                 {\r
3362                         self::error(_ERROR_BADTEMPLATENAME);\r
3363                 }\r
3364                 \r
3365                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3366                 {\r
3367                         self::error(_ERROR_DUPTEMPLATENAME);\r
3368                 }\r
3369                 \r
3370                 // 1. Remove all template parts\r
3371                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3372                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3373                 DB::execute($query);\r
3374                 \r
3375                 // 2. Update description\r
3376                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3377                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3378                 DB::execute($query);\r
3379                 \r
3380                 // 3. Add non-empty template parts\r
3381                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3382                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3383                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3384                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3385                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3386                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3387                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3388                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3389                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3390                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3391                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3392                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3393                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3394                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3395                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3396                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3397                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3399                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3400                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3401                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3402                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3403                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3404                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3405                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3406                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3482                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3483                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3484                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3485                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3486                 \r
3487                 $data = array('fields' => array());\r
3488                 $manager->notify('AdminTemplateExtraFields', $data);\r
3489                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3490                 {\r
3491                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3492                         {\r
3493                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3494                         }\r
3495                 }\r
3496                 \r
3497                 // jump back to template edit\r
3498                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3499                 return;\r
3500         }\r
3501         \r
3502         /**\r
3503          * Admin::addToAdminTemplate()\r
3504          * \r
3505          * @param       integer $id                     ID for template\r
3506          * @param       string  $partname       name of part for template\r
3507          * @param       void    $contents       content for part of template\r
3508          * @return      integer ID for newly inserted Template\r
3509          */\r
3510         static private function addToAdminTemplate($id, $partname, $content)\r
3511         {\r
3512                 // don't add empty parts:\r
3513                 if ( !trim($content) )\r
3514                 {\r
3515                         return -1;\r
3516                 }\r
3517                 \r
3518                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3519                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3520                 if ( DB::execute($query) === FALSE )\r
3521                 {\r
3522                         $err = DB::getError();\r
3523                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3524                 }\r
3525                 return DB::getInsertId();\r
3526         }\r
3527         \r
3528         /**\r
3529          * Admin::action_admintemplatedelete()\r
3530          * \r
3531          * @param       void\r
3532          * @return      void\r
3533          */\r
3534         static private function action_admintemplatedelete()\r
3535         {\r
3536                 global $member, $manager;\r
3537                 $member->isAdmin() or self::disallow();\r
3538                 \r
3539                 // TODO: check if template can be deleted\r
3540                 self::$skin->parse('admintemplatedelete');\r
3541                 return;\r
3542         }\r
3543         \r
3544         /**\r
3545          * Admin::action_admintemplatedeleteconfirm()\r
3546          * \r
3547          * @param       void\r
3548          * @return      void\r
3549          */\r
3550         static private function action_admintemplatedeleteconfirm()\r
3551         {\r
3552                 global $member, $manager;\r
3553                 \r
3554                 $templateid = intRequestVar('templateid');\r
3555                 $member->isAdmin() or self::disallow();\r
3556                 \r
3557                 $data = array('templateid' => $templateid);\r
3558                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3559                 \r
3560                 // 1. delete description\r
3561                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3562                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3563                 DB::execute($query);\r
3564                 \r
3565                 // 2. delete parts\r
3566                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3567                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3568                 DB::execute($query);\r
3569                 \r
3570                 $data = array('templateid' => $templateid);\r
3571                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3572                 \r
3573                 self::action_admintemplateoverview();\r
3574                 return;\r
3575         }\r
3576         \r
3577         /**\r
3578          * Admin::action_admintemplatenew()\r
3579          * \r
3580          * @param       void\r
3581          * @return      void\r
3582          */\r
3583         static private function action_admintemplatenew()\r
3584         {\r
3585                 global $member;\r
3586                 $member->isAdmin() or self::disallow();\r
3587                 $name = postVar('name');\r
3588                 $desc = postVar('desc');\r
3589                 \r
3590                 if ( !isValidTemplateName($name) )\r
3591                 {\r
3592                         self::error(_ERROR_BADTEMPLATENAME);\r
3593                 }\r
3594                 else if ( !preg_match('#^admin/#', $name) )\r
3595                 {\r
3596                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3597                 }\r
3598                 else if ( Template::exists($name) )\r
3599                 {\r
3600                         self::error(_ERROR_DUPTEMPLATENAME);\r
3601                 }\r
3602                 \r
3603                 $newTemplateId = Template::createNew($name, $desc);\r
3604                 self::action_admintemplateoverview();\r
3605                 return;\r
3606         }\r
3607         \r
3608         /**\r
3609          * Admin::action_admintemplateclone()\r
3610          * \r
3611          * @param       void\r
3612          * @return      void\r
3613          */\r
3614         static private function action_admintemplateclone()\r
3615         {\r
3616                 global $member;\r
3617                 $templateid = intRequestVar('templateid');\r
3618                 $member->isAdmin() or self::disallow();\r
3619                 \r
3620                 // 1. read old template\r
3621                 $name = Template::getNameFromId($templateid);\r
3622                 $desc = Template::getDesc($templateid);\r
3623                 \r
3624                 // 2. create desc thing\r
3625                 $name = $name . "cloned";\r
3626                 \r
3627                 // if a template with that name already exists:\r
3628                 if ( Template::exists($name) )\r
3629                 {\r
3630                         $i = 1;\r
3631                         while ( Template::exists($name . $i) )\r
3632                         {\r
3633                                 $i++;\r
3634                         }\r
3635                         $name .= $i;\r
3636                 }\r
3637                 \r
3638                 $newid = Template::createNew($name, $desc);\r
3639                 \r
3640                 // 3. create clone\r
3641                 // go through parts of old template and add them to the new one\r
3642                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3643                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3644                 \r
3645                 $res = DB::getResult($query);\r
3646                 foreach ( $res as $row )\r
3647                 {\r
3648                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3649                 }\r
3650                 \r
3651                 self::action_admintemplateoverview();\r
3652                 return;\r
3653         }\r
3654 \r
3655         /**\r
3656          * Admin::action_skinoverview()\r
3657          * \r
3658          * @param       void\r
3659          * @return      void\r
3660          */\r
3661         static private function action_skinoverview()\r
3662         {\r
3663                 global $member, $manager;\r
3664                 \r
3665                 $member->isAdmin() or self::disallow();\r
3666                 \r
3667                 self::$skin->parse('skinoverview');\r
3668                 return;\r
3669         }\r
3670         \r
3671         /**\r
3672          * Admin::action_skinnew()\r
3673          * \r
3674          * @param       void\r
3675          * @return      void\r
3676          */\r
3677         static private function action_skinnew()\r
3678         {\r
3679                 global $member;\r
3680                 \r
3681                 $member->isAdmin() or self::disallow();\r
3682                 \r
3683                 $name = trim(postVar('name'));\r
3684                 $desc = trim(postVar('desc'));\r
3685                 \r
3686                 if ( !isValidSkinName($name) )\r
3687                 {\r
3688                         self::error(_ERROR_BADSKINNAME);\r
3689                 }\r
3690                 \r
3691                 if ( SKIN::exists($name) )\r
3692                 {\r
3693                         self::error(_ERROR_DUPSKINNAME);\r
3694                 }\r
3695                 \r
3696                 $newId = SKIN::createNew($name, $desc);\r
3697                 \r
3698                 self::action_skinoverview();\r
3699                 return;\r
3700         }\r
3701         \r
3702         /**\r
3703          * Admin::action_skinedit()\r
3704          * \r
3705          * @param       void\r
3706          * @return      void\r
3707          */\r
3708         static private function action_skinedit()\r
3709         {\r
3710                 global $member, $manager;\r
3711                 \r
3712                 $member->isAdmin() or self::disallow();\r
3713                 \r
3714                 self::$skin->parse('skinedit');\r
3715                 return;\r
3716         }\r
3717         \r
3718         /**\r
3719          * Admin::action_skineditgeneral()\r
3720          * \r
3721          * @param       void\r
3722          * @return      void\r
3723          */\r
3724         static private function action_skineditgeneral()\r
3725         {\r
3726                 global $manager, $member;\r
3727                 \r
3728                 $skinid = intRequestVar('skinid');\r
3729                 \r
3730                 $member->isAdmin() or self::disallow();\r
3731                 \r
3732                 $name           = postVar('name');\r
3733                 $desc           = postVar('desc');\r
3734                 $type           = postVar('type');\r
3735                 $inc_mode       = postVar('inc_mode');\r
3736                 $inc_prefix     = postVar('inc_prefix');\r
3737                 \r
3738                 $skin =& $manager->getSkin($skinid);\r
3739                 \r
3740                 // 1. Some checks\r
3741                 if ( !isValidSkinName($name) )\r
3742                 {\r
3743                         self::error(_ERROR_BADSKINNAME);\r
3744                 }\r
3745                 \r
3746                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3747                 {\r
3748                         self::error(_ERROR_DUPSKINNAME);\r
3749                 }\r
3750                 \r
3751                 if ( !$type )\r
3752                 {\r
3753                         $type = 'text/html';\r
3754                 }\r
3755                 if ( !$inc_mode )\r
3756                 {\r
3757                         $inc_mode = 'normal';\r
3758                 }\r
3759                 \r
3760                 // 2. Update description\r
3761                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3762                 \r
3763                 self::action_skinedit();\r
3764                 return;\r
3765         }\r
3766         \r
3767         static private function action_skinedittype($msg = '')\r
3768         {\r
3769                 global $member, $manager;\r
3770                 \r
3771                 $member->isAdmin() or self::disallow();\r
3772                 \r
3773                 if ( $msg )\r
3774                 {\r
3775                         self::$headMess = $msg;\r
3776                 }\r
3777                 \r
3778                 $skinid = intRequestVar('skinid');\r
3779                 $type   = requestVar('type');\r
3780                 $type   = trim($type);\r
3781                 $type   = strtolower($type);\r
3782                 \r
3783                 if ( !isValidShortName($type) )\r
3784                 {\r
3785                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3786                 }\r
3787                 \r
3788                 self::$skin->parse('skinedittype');\r
3789                 return;\r
3790         }\r
3791         \r
3792         /**\r
3793          * Admin::action_skinupdate()\r
3794          * \r
3795          * @param       void\r
3796          * @return      void\r
3797          */\r
3798         static private function action_skinupdate()\r
3799         {\r
3800                 global $manager, $member;\r
3801                 \r
3802                 $skinid = intRequestVar('skinid');\r
3803                 $content = trim(postVar('content'));\r
3804                 $type = postVar('type');\r
3805                 \r
3806                 $member->isAdmin() or self::disallow();\r
3807                 \r
3808                 $skin =& $manager->getSKIN($skinid);\r
3809                 $skin->update($type, $content);\r
3810                 \r
3811                 self::action_skinedittype(_SKIN_UPDATED);\r
3812                 return;\r
3813         }\r
3814         \r
3815         /**\r
3816          * Admin::action_skindelete()\r
3817          * \r
3818          * @param       void\r
3819          * @return      void\r
3820          */\r
3821         static private function action_skindelete()\r
3822         {\r
3823                 global $manager, $member, $CONF;\r
3824                 \r
3825                 $skinid = intRequestVar('skinid');\r
3826                 \r
3827                 $member->isAdmin() or self::disallow();\r
3828                 \r
3829                 // don't allow default skin to be deleted\r
3830                 if ( $skinid == $CONF['BaseSkin'] )\r
3831                 {\r
3832                         self::error(_ERROR_DEFAULTSKIN);\r
3833                 }\r
3834                 \r
3835                 // don't allow deletion of default skins for blogs\r
3836                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3837                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3838                 \r
3839                 $name = DB::getValue($query);\r
3840                 if ( $name )\r
3841                 {\r
3842                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3843                 }\r
3844                 \r
3845                 self::$skin->parse('skindelete');\r
3846                 return;\r
3847         }\r
3848         \r
3849         /**\r
3850          * Admin::action_skindeleteconfirm()\r
3851          * \r
3852          * @param       void\r
3853          * @return      void\r
3854          */\r
3855         static private function action_skindeleteconfirm()\r
3856         {\r
3857                 global $member, $CONF, $manager;\r
3858                 \r
3859                 $skinid = intRequestVar('skinid');\r
3860                 \r
3861                 $member->isAdmin() or self::disallow();\r
3862                 \r
3863                 // don't allow default skin to be deleted\r
3864                 if ( $skinid == $CONF['BaseSkin'] )\r
3865                 {\r
3866                         self::error(_ERROR_DEFAULTSKIN);\r
3867                 }\r
3868                 \r
3869                 // don't allow deletion of default skins for blogs\r
3870                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3871                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3872                 \r
3873                 $name = DB::getValue($query);\r
3874                 if ( $name )\r
3875                                 {\r
3876                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3877                 }\r
3878                 \r
3879                 $data = array('skinid' => $skinid);\r
3880                 $manager->notify('PreDeleteSkin', $data);\r
3881                 \r
3882                 // 1. delete description\r
3883                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3884                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3885                 DB::execute($query);\r
3886                 \r
3887                 // 2. delete parts\r
3888                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3889                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3890                 DB::execute($query);\r
3891                 \r
3892                 $data = array('skinid' => $skinid);\r
3893                 $manager->notify('PostDeleteSkin', $data);\r
3894                 \r
3895                 self::action_skinoverview();\r
3896                 return;\r
3897         }\r
3898         \r
3899         /**\r
3900          * Admin::action_skinremovetype()\r
3901          * \r
3902          * @param       void\r
3903          * @return      void\r
3904          */\r
3905         static private function action_skinremovetype()\r
3906         {\r
3907                 global $member, $manager, $CONF;\r
3908                 \r
3909                 $member->isAdmin() or self::disallow();\r
3910                 \r
3911                 $skinid = intRequestVar('skinid');\r
3912                 $skintype = requestVar('type');\r
3913                 \r
3914                 if ( !isValidShortName($skintype) )\r
3915                 {\r
3916                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3917                 }\r
3918                 \r
3919                 // don't allow default skinparts to be deleted\r
3920                 /* TODO: this array should be retrieved from Action class */\r
3921                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3922                 {\r
3923                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3924                 }\r
3925                 \r
3926                 self::$skin->parse('skinremovetype');\r
3927                 return;\r
3928         }\r
3929         \r
3930         /**\r
3931          * Admin::action_skinremovetypeconfirm()\r
3932          * \r
3933          * @param       void\r
3934          * @return      void\r
3935          */\r
3936         static private function action_skinremovetypeconfirm()\r
3937         {\r
3938                 global $member, $CONF, $manager;\r
3939                 \r
3940                 $member->isAdmin() or self::disallow();\r
3941                 \r
3942                 $skinid = intRequestVar('skinid');\r
3943                 $skintype = requestVar('type');\r
3944                 \r
3945                 if ( !isValidShortName($skintype) )\r
3946                 {\r
3947                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3948                 }\r
3949                 \r
3950                 // don't allow default skinparts to be deleted\r
3951                 /* TODO: this array should be retrieved from Action class */\r
3952                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3953                 {\r
3954                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3955                 }\r
3956                 \r
3957                 $data = array(\r
3958                         'skinid'   => $skinid,\r
3959                         'skintype' => $skintype\r
3960                 );\r
3961                 $manager->notify('PreDeleteSkinPart', $data);\r
3962                 // delete part\r
3963                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3964                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3965                 DB::execute($query);\r
3966                 \r
3967                 $data = array(\r
3968                         'skinid'   => $skinid,\r
3969                         'skintype' => $skintype\r
3970                 );\r
3971                 $manager->notify('PostDeleteSkinPart', $data);\r
3972                 \r
3973                 self::action_skinedit();\r
3974                 return;\r
3975         }\r
3976 \r
3977         /**\r
3978          * Admin::action_skinclone()\r
3979          * \r
3980          * @param       void\r
3981          * @return      void\r
3982          */\r
3983         static private function action_skinclone()\r
3984         {\r
3985                 global $manager, $member;\r
3986                 \r
3987                 $member->isAdmin() or self::disallow();\r
3988                 \r
3989                 $skinid = intRequestVar('skinid');\r
3990                 \r
3991                 // 1. read skin to clone\r
3992                 $skin =& $manager->getSkin($skinid);\r
3993                 \r
3994                 $name = "{$skin->getName()}_clone";\r
3995                 \r
3996                 // if a skin with that name already exists:\r
3997                 if ( Skin::exists($name) )\r
3998                 {\r
3999                         $i = 1;\r
4000                         while ( Skin::exists($name . $i) )\r
4001                         {\r
4002                                 $i++;\r
4003                         }\r
4004                         $name .= $i;\r
4005                 }\r
4006                 \r
4007                 // 2. create skin desc\r
4008                 $newid = Skin::createNew(\r
4009                         $name,\r
4010                         $skin->getDescription(),\r
4011                         $skin->getContentType(),\r
4012                         $skin->getIncludeMode(),\r
4013                         $skin->getIncludePrefix()\r
4014                 );\r
4015                 \r
4016                 // 3. clone\r
4017                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4018                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4019                 \r
4020                 $res = DB::getResult($query);\r
4021                 foreach ( $res as $row )\r
4022                 {\r
4023                         self::skinclonetype($skin, $newid, $row['stype']);\r
4024                 }\r
4025                 \r
4026                 self::action_skinoverview();\r
4027                 return;\r
4028         }\r
4029         \r
4030         /**\r
4031          * Admin::skinclonetype()\r
4032          * \r
4033          * @param       String  $skin   Skin object\r
4034          * @param       Integer $newid  ID for this clone\r
4035          * @param       String  $type   type of skin\r
4036          * @return      Void\r
4037          */\r
4038         static private function skinclonetype($skin, $newid, $type)\r
4039         {\r
4040                 $newid = intval($newid);\r
4041                 $content = $skin->getContentFromDB($type);\r
4042                 \r
4043                 if ( $content )\r
4044                 {\r
4045                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4046                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4047                         DB::execute($query);\r
4048                 }\r
4049                 return;\r
4050         }\r
4051         \r
4052         /**\r
4053          * Admin::action_adminskinoverview()\r
4054          * \r
4055          * @param       void\r
4056          * @return      void\r
4057          */\r
4058         static private function action_adminskinoverview()\r
4059         {\r
4060                 global $member, $manager;\r
4061                 \r
4062                 $member->isAdmin() or self::disallow();\r
4063                 \r
4064                 self::$skin->parse('adminskinoverview');\r
4065                 return;\r
4066         }\r
4067         \r
4068         /**\r
4069          * Admin::action_adminskinnew()\r
4070          * \r
4071          * @param       void\r
4072          * @return      void\r
4073          */\r
4074         static private function action_adminskinnew()\r
4075         {\r
4076                 global $member;\r
4077                 $member->isAdmin() or self::disallow();\r
4078                 $name = trim(postVar('name'));\r
4079                 $desc = trim(postVar('desc'));\r
4080                 \r
4081                 if ( !isValidSkinName($name) )\r
4082                 {\r
4083                         self::error(_ERROR_BADSKINNAME);\r
4084                 }\r
4085                 else if ( !preg_match('#^admin/#', $name) )\r
4086                 {\r
4087                         self::error(_ERROR_BADADMINSKINNAME);\r
4088                 }\r
4089                 else if ( Skin::exists($name) )\r
4090                 {\r
4091                         self::error(_ERROR_DUPSKINNAME);\r
4092                 }\r
4093                 /* TODO: $newId is not reused... */\r
4094                 $newId = Skin::createNew($name, $desc);\r
4095                 self::action_adminskinoverview();\r
4096                 return;\r
4097         }\r
4098         \r
4099         /**\r
4100          * Admin::action_adminskinedit()\r
4101          * \r
4102          * @param       void\r
4103          * @return      void\r
4104          */\r
4105         static private function action_adminskinedit()\r
4106         {\r
4107                 global $member, $manager;\r
4108                 \r
4109                 $member->isAdmin() or self::disallow();\r
4110                 self::$skin->parse('adminskinedit');\r
4111                 return;\r
4112         }\r
4113         \r
4114         /**\r
4115          * Admin::action_adminskineditgeneral()\r
4116          * \r
4117          * @param       void\r
4118          * @return      void\r
4119          */\r
4120         static private function action_adminskineditgeneral()\r
4121         {\r
4122                 global $manager, $member;\r
4123                 \r
4124                 $skinid = intRequestVar('skinid');\r
4125                 \r
4126                 $member->isAdmin() or self::disallow();\r
4127                 \r
4128                 $name           = postVar('name');\r
4129                 $desc           = postVar('desc');\r
4130                 $type           = postVar('type');\r
4131                 $inc_mode       = postVar('inc_mode');\r
4132                 $inc_prefix     = postVar('inc_prefix');\r
4133                 \r
4134                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4135                 \r
4136                 // 1. Some checks\r
4137                 if ( !isValidSkinName($name) )\r
4138                 {\r
4139                         self::error(_ERROR_BADSKINNAME);\r
4140                 }\r
4141                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4142                 {\r
4143                         self::error(_ERROR_DUPSKINNAME);\r
4144                 }\r
4145                 if ( !$type )\r
4146                 {\r
4147                         $type = 'text/html';\r
4148                 }\r
4149                 if ( !$inc_mode )\r
4150                 {\r
4151                         $inc_mode = 'normal';\r
4152                 }\r
4153                 // 2. Update description\r
4154                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4155                 self::action_adminskinedit();\r
4156                 return;\r
4157         }\r
4158         \r
4159         /**\r
4160          * Admin::action_adminskinedittype()\r
4161          * \r
4162          * @param       string  $msg    message for pageheader\r
4163          * @return      void\r
4164          */\r
4165         static private function action_adminskinedittype($msg = '')\r
4166         {\r
4167                 global $member, $manager;\r
4168                 \r
4169                 $member->isAdmin() or self::disallow();\r
4170                 \r
4171                 if ( $msg )\r
4172                 {\r
4173                         self::$headMess = $msg;\r
4174                 }\r
4175                 $type = requestVar('type');\r
4176                 $type = trim($type);\r
4177                 $type = strtolower($type);\r
4178                 \r
4179                 if ( !isValidShortName($type) )\r
4180                 {\r
4181                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4182                 }\r
4183                 \r
4184                 self::$skin->parse('adminskinedittype');\r
4185                 return;\r
4186         }\r
4187         \r
4188         /**\r
4189          * Admin::action_adminskinupdate()\r
4190          * \r
4191          * @param       void\r
4192          * @return      void\r
4193          */\r
4194         static private function action_adminskinupdate()\r
4195         {\r
4196                 global $manager, $member;\r
4197                 \r
4198                 $skinid = intRequestVar('skinid');\r
4199                 $content = trim(postVar('content'));\r
4200                 $type = postVar('type');\r
4201                 \r
4202                 $member->isAdmin() or self::disallow();\r
4203                 \r
4204                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4205                 $skin->update($type, $content);\r
4206                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4207                 return;\r
4208         }\r
4209         \r
4210         /**\r
4211          * Admin::action_adminskindelete()\r
4212          * \r
4213          * @param       void\r
4214          * @return      void\r
4215          */\r
4216         static private function action_adminskindelete()\r
4217         {\r
4218                 global $member, $manager, $CONF;\r
4219                 $member->isAdmin() or self::disallow();\r
4220                 \r
4221                 /* TODO: needless variable $skinid... */\r
4222                 $skinid = intRequestVar('skinid');\r
4223                 self::$skin->parse('adminskindelete');\r
4224                 return;\r
4225         }\r
4226 \r
4227         /**\r
4228          * Admin::action_adminskindeleteconfirm()\r
4229          * \r
4230          * @param       void\r
4231          * @return      void\r
4232          */\r
4233         static private function action_adminskindeleteconfirm()\r
4234         {\r
4235                 global $member, $CONF, $manager;\r
4236                 \r
4237                 $member->isAdmin() or self::disallow();\r
4238                 $skinid = intRequestVar('skinid');\r
4239                 \r
4240                 // don't allow default skin to be deleted\r
4241                 if ( $skinid == $CONF['AdminSkin'] )\r
4242                 {\r
4243                         self::error(_ERROR_DEFAULTSKIN);\r
4244                 }\r
4245                 \r
4246                 /*\r
4247                  * TODO: NOT Implemented\r
4248                  *  don't allow deletion of default skins for members\r
4249                 $memberDefaults =  $member->getAdminSkin();\r
4250                 foreach ( $memberDefaults as $memID => $adminskin )\r
4251                 {\r
4252                         if ( $skinid == $adminskin )\r
4253                         {\r
4254                                 $mem =& $manager->getMember($memID);\r
4255                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4256                         }\r
4257                 }\r
4258                 */\r
4259                 \r
4260                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4261                 \r
4262                 // 1. delete description\r
4263                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4264                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4265                 DB::execute($query);\r
4266                 \r
4267                 // 2. delete parts\r
4268                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4269                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4270                 \r
4271                 DB::execute($query);\r
4272                 \r
4273                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4274                 self::action_adminskinoverview();\r
4275                 return;\r
4276         }\r
4277         \r
4278         /**\r
4279          * Admin::action_adminskinremovetype()\r
4280          * \r
4281          * @param       void\r
4282          * @return      void\r
4283          */\r
4284         static private function action_adminskinremovetype()\r
4285         {\r
4286                 global $member, $manager, $CONF;\r
4287 \r
4288                 $member->isAdmin() or self::disallow();\r
4289                 \r
4290                 $skinid         = intRequestVar('skinid');\r
4291                 $skintype       = requestVar('type');\r
4292                 \r
4293                 if ( !isValidShortName($skintype) )\r
4294                 {\r
4295                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4296                 }\r
4297                 \r
4298                 self::$skin->parse('adminskinremovetype');\r
4299                 return;\r
4300         }\r
4301         \r
4302         /**\r
4303          * Admin::action_adminskinremovetypeconfirm()\r
4304          * \r
4305          * @param       void\r
4306          * @return      void\r
4307          */\r
4308         static private function action_adminskinremovetypeconfirm()\r
4309         {\r
4310                 global $member, $CONF, $manager;\r
4311                 \r
4312                 $member->isAdmin() or self::disallow();\r
4313                 \r
4314                 $skinid         = intRequestVar('skinid');\r
4315                 $skintype       = requestVar('type');\r
4316                 \r
4317                 if ( !isValidShortName($skintype) )\r
4318                 {\r
4319                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4320                 }\r
4321                 \r
4322                 $data =array(\r
4323                         'skinid'        => $skinid,\r
4324                         'skintype'      => $skintype\r
4325                 );\r
4326                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4327 \r
4328                 // delete part\r
4329                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4330                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4331                 DB::execute($query);\r
4332                 \r
4333                 $data = array(\r
4334                         'skinid'        => $skinid,\r
4335                         'skintype'      => $skintype\r
4336                 );\r
4337                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4338                 \r
4339                 self::action_adminskinedit();\r
4340                 return;\r
4341         }\r
4342 \r
4343         /**\r
4344          * Admin::action_adminskinclone()\r
4345          * \r
4346          * @param       void\r
4347          * @return      void\r
4348          */\r
4349         static private function action_adminskinclone()\r
4350         {\r
4351                 global $manager, $member;\r
4352                 \r
4353                 $member->isAdmin() or self::disallow();\r
4354                 \r
4355                 $skinid = intRequestVar('skinid');\r
4356                 \r
4357                 // 1. read skin to clone\r
4358                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4359                 $name = "{$skin->getName()}_clone";\r
4360                 \r
4361                 // if a skin with that name already exists:\r
4362                 if ( Skin::exists($name) )\r
4363                 {\r
4364                         $i = 1;\r
4365                         while ( Skin::exists($name . $i) )\r
4366                         {\r
4367                                 $i++;\r
4368                         }\r
4369                         $name .= $i;\r
4370                 }\r
4371                 \r
4372                 // 2. create skin desc\r
4373                 $newid = Skin::createNew(\r
4374                         $name,\r
4375                         $skin->getDescription(),\r
4376                         $skin->getContentType(),\r
4377                         $skin->getIncludeMode(),\r
4378                         $skin->getIncludePrefix()\r
4379                 );\r
4380                 \r
4381                 // 3. clone\r
4382                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4383                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4384                 \r
4385                 $res = DB::getResult($query);\r
4386                 foreach ( $res as $row )\r
4387                 {\r
4388                         self::skinclonetype($skin, $newid, $row['stype']);\r
4389                 }\r
4390                 self::action_adminskinoverview();\r
4391                 return;\r
4392         }\r
4393         \r
4394         /**\r
4395          * Admin::adminskinclonetype()\r
4396          * \r
4397          * @param       string  $skin   an instance of Skin class\r
4398          * @param       integer $newid  ID for new skin\r
4399          * @param       string  $type   skin type\r
4400          * @return      void\r
4401          */\r
4402         static private function adminskinclonetype($skin, $newid, $type)\r
4403         {\r
4404                 $content = $skin->getContentFromDB($type);\r
4405                 \r
4406                 if ( $content )\r
4407                 {\r
4408                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4409                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4410                         DB::execute($query);\r
4411                 }\r
4412                 return;\r
4413         }\r
4414         \r
4415         /**\r
4416          * Admin::action_adminskinieoverview()\r
4417          * \r
4418          * @param       void\r
4419          * @return      void\r
4420          */\r
4421         static private function action_adminskinieoverview()\r
4422         {\r
4423                 global $member, $DIR_LIBS, $manager;\r
4424                 \r
4425                 $member->isAdmin() or self::disallow();\r
4426                 \r
4427                 // load skinie class\r
4428                 include_once($DIR_LIBS . 'skinie.php');\r
4429                 \r
4430                 self::$skin->parse('adminskinieoverview');\r
4431                 return;\r
4432         }\r
4433 \r
4434         /**\r
4435          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4436          * Admin::action_adminskinieimport()\r
4437          * \r
4438          * @param       void\r
4439          * @return      void\r
4440          */\r
4441         static private function action_adminskinieimport()\r
4442         {\r
4443                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4444                 \r
4445                 $member->isAdmin() or self::disallow();\r
4446                 \r
4447                 // load skinie class\r
4448                 include_once($DIR_LIBS . 'skinie.php');\r
4449                 \r
4450                 $skinFileRaw    = postVar('skinfile');\r
4451                 $mode                   = postVar('mode');\r
4452                 \r
4453                 $importer = new SKINIMPORT();\r
4454                 \r
4455                 // get full filename\r
4456                 if ( $mode == 'file' )\r
4457                 {\r
4458                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4459                         \r
4460                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4461                         if ( !file_exists($skinFile) )\r
4462                         {\r
4463                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4464                         }\r
4465                 }\r
4466                 else\r
4467                 {\r
4468                         $skinFile = $skinFileRaw;\r
4469                 }\r
4470                 \r
4471                 // read only metadata\r
4472                 $error = $importer->readFile($skinFile, 1);\r
4473                 if ( $error )\r
4474                 {\r
4475                         self::error($error);\r
4476                 }\r
4477                 \r
4478                 /* TODO: we should consider to use the other way instead of this */\r
4479                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4480                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4481                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4482                 \r
4483                 // clashes\r
4484                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4485                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4486                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4487                 /* TODO: we should consider to use the other way instead of this */\r
4488                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4489                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4490                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4491 \r
4492                 if ( !is_object(self::$skin) )\r
4493                 {\r
4494                         self::action_adminskiniedoimport();\r
4495                 }\r
4496                 else\r
4497                 {\r
4498                         self::$skin->parse('adminskinieimport');\r
4499                 }\r
4500                 return;\r
4501         }\r
4502         \r
4503         /**\r
4504          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4505          * Admin::action_adminskiniedoimport()\r
4506          * \r
4507          * @param       void\r
4508          * @return      void\r
4509          */\r
4510         static private function action_adminskiniedoimport()\r
4511         {\r
4512                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4513                 \r
4514                 $member->isAdmin() or self::disallow();\r
4515                 \r
4516                 // load skinie class\r
4517                 include_once($DIR_LIBS . 'skinie.php');\r
4518                 \r
4519                 $skinFileRaw    = postVar('skinfile');\r
4520                 $mode                   = postVar('mode');\r
4521                 $allowOverwrite = intPostVar('overwrite');\r
4522                 \r
4523                 // get full filename\r
4524                 if ( $mode == 'file' )\r
4525                 {\r
4526                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4527                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4528                         if ( !file_exists($skinFile) )\r
4529                         {\r
4530                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4531                         }\r
4532                 }\r
4533                 else\r
4534                 {\r
4535                         $skinFile = $skinFileRaw;\r
4536                 }\r
4537                 \r
4538                 $importer = new SKINIMPORT();\r
4539                 \r
4540                 $error = $importer->readFile($skinFile);\r
4541                 if ( $error )\r
4542                 {\r
4543                         self::error($error);\r
4544                 }\r
4545                 \r
4546                 $error = $importer->writeToDatabase($allowOverwrite);\r
4547                 if ( $error )\r
4548                 {\r
4549                         self::error($error);\r
4550                 }\r
4551                 \r
4552                 /* TODO: we should consider to use the other way instead of this */\r
4553                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4554                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4555                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4556                 \r
4557                 if ( !is_object(self::$skin) )\r
4558                 {\r
4559                         global $DIR_SKINS;\r
4560                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4561                         $query  = sprintf($query, sql_table('skin_desc'));\r
4562                         $res    = intval(DB::getValue($query));\r
4563                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4564                         $query  = sprintf($query, sql_table('config'), $res);\r
4565                         DB::execute($query);\r
4566                         $skin   =& $manager->Skin(0, 'AdminActions', 'AdminSkin');\r
4567                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4568                 }\r
4569                 else\r
4570                 {\r
4571                         self::$skin->parse('adminskiniedoimport');\r
4572                 }\r
4573                 return;\r
4574         }\r
4575 \r
4576         /**\r
4577          * Admin::action_adminskinieexport()\r
4578          * \r
4579          * @param       void\r
4580          * @return      void\r
4581          */\r
4582         static private function action_adminskinieexport()\r
4583         {\r
4584                 global $member, $DIR_PLUGINS;\r
4585                 \r
4586                 $member->isAdmin() or self::disallow();\r
4587                 \r
4588                 // load skinie class\r
4589                 $aSkins = requestIntArray('skin');\r
4590                 if (!is_array($aSkins)) {\r
4591                         $aSkins = array();\r
4592                 }\r
4593                 $skinList = array_keys($aSkins);\r
4594                 \r
4595                 $aTemplates = requestIntArray('template');\r
4596                 if (!is_array($aTemplates))\r
4597                 {\r
4598                         $aTemplates = array();\r
4599                 }\r
4600                 $templateList = array_keys($aTemplates);\r
4601                 \r
4602                 $info = postVar('info');\r
4603                 \r
4604                 include_libs('skinie.php');\r
4605                 $exporter = new SkinExport();\r
4606                 foreach ( $skinList as $skinId )\r
4607                 {\r
4608                         $exporter->addSkin($skinId);\r
4609                 }\r
4610                 foreach ( $templateList as $templateId )\r
4611                 {\r
4612                         $exporter->addTemplate($templateId);\r
4613                 }\r
4614                 $exporter->setInfo($info);\r
4615                 $exporter->export();\r
4616                 return;\r
4617         }\r
4618         \r
4619         /**\r
4620          * Admin::action_settingsedit()\r
4621          * \r
4622          * @param       Void\r
4623          * @return      Void\r
4624          */\r
4625         static private function action_settingsedit()\r
4626         {\r
4627                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4628                 \r
4629                 $member->isAdmin() or self::disallow();\r
4630                 \r
4631                 self::$skin->parse('settingsedit');\r
4632                 return;\r
4633         }\r
4634         \r
4635         /**\r
4636          * Admin::action_settingsupdate()\r
4637          * Update $CONFIG and redirect\r
4638          * \r
4639          * @param       void\r
4640          * @return      void\r
4641          */\r
4642         static private function action_settingsupdate()\r
4643         {\r
4644                 global $member, $CONF;\r
4645                 \r
4646                 $member->isAdmin() or self::disallow();\r
4647                 \r
4648                 // check if email address for admin is valid\r
4649                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4650                 {\r
4651                         self::error(_ERROR_BADMAILADDRESS);\r
4652                 }\r
4653                 \r
4654                 // save settings\r
4655                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4656                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4657                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4658                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4659                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4660                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4661                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4662                 self::updateConfig('Locale',                    postVar('Locale'));\r
4663                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4664                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4665                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4666                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4667                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4668                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4669                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4670                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4671                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4672                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4673                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4674                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4675                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4676                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4677                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4678                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4679                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4680                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4681                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4682                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4683                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4684                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4685                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4686                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4687                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4688                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4689                 self::updateConfig('AdminSkin',                 postVar('adminskin'));\r
4690                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));\r
4691 \r
4692                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4693                 // note that when changing cookie settings, this redirect might cause the user\r
4694                 // to have to log in again.\r
4695                 getConfig();\r
4696                 redirect($CONF['AdminURL'] . '?action=manage');\r
4697                 return;\r
4698         }\r
4699         \r
4700         /**\r
4701          * Admin::action_systemoverview()\r
4702          * Output system overview\r
4703          * \r
4704          * @param       void\r
4705          * @return      void\r
4706          */\r
4707         static private function action_systemoverview()\r
4708         {\r
4709                 self::$skin->parse('systemoverview');\r
4710                 return;\r
4711         }\r
4712         \r
4713         /**\r
4714          * Admin::updateConfig()\r
4715          * \r
4716          * @param       string  $name   \r
4717          * @param       string  $val    \r
4718          * @return      integer return the ID in which the latest query posted\r
4719          */\r
4720         static private function updateConfig($name, $val)\r
4721         {\r
4722                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4723                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4724                 if ( DB::execute($query) === FALSE )\r
4725                 {\r
4726                         $err = DB::getError();\r
4727                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4728                 }\r
4729                 return DB::getInsertId();\r
4730         }\r
4731         \r
4732         /**\r
4733          * Admin::error()\r
4734          * Error message\r
4735          * \r
4736          * @param       string  $msg    message that will be shown\r
4737          * @return      void\r
4738          */\r
4739         static public function error($msg)\r
4740         {\r
4741                 self::$headMess = $msg;\r
4742                 self::$skin->parse('adminerrorpage');\r
4743                 return;\r
4744         }\r
4745         \r
4746         /**\r
4747          * Admin::disallow()\r
4748          * add error log and show error page \r
4749          * \r
4750          * @param       void\r
4751          * @return      void\r
4752          */\r
4753         static public function disallow()\r
4754         {\r
4755                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4756                 self::error(_ERROR_DISALLOWED);\r
4757                 return;\r
4758         }\r
4759 \r
4760         /**\r
4761          * Admin::action_PluginAdmin()\r
4762          * Output pluginadmin\r
4763          *\r
4764          * @param       string  $skinContents\r
4765          * @param       string  $extrahead\r
4766          * @return      void\r
4767          */\r
4768         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4769         {\r
4770                 self::$extrahead .= $extrahead;\r
4771                 self::$skin->parse('pluginadmin', $skinContents);\r
4772                 return;\r
4773         }\r
4774         \r
4775         /**\r
4776          * Admin::action_bookmarklet()\r
4777          * \r
4778          * @param       void\r
4779          * @return      void\r
4780          */\r
4781         static private function action_bookmarklet()\r
4782         {\r
4783                 global $member, $manager;\r
4784                 \r
4785                 $blogid = intRequestVar('blogid');\r
4786                 $member->teamRights($blogid) or self::disallow();\r
4787                 \r
4788                 self::$skin->parse('bookmarklet');\r
4789                 return;\r
4790         }\r
4791         \r
4792         /**\r
4793          * Admin::action_actionlog()\r
4794          * \r
4795          * @param       void\r
4796          * @return      void\r
4797          */\r
4798         static private function action_actionlog()\r
4799         {\r
4800                 global $member, $manager;\r
4801                 \r
4802                 $member->isAdmin() or self::disallow();\r
4803                 \r
4804                 self::$skin->parse('actionlog');\r
4805                 return;\r
4806         }\r
4807         \r
4808         /**\r
4809          * Admin::action_banlist()\r
4810          * \r
4811          * @param       void\r
4812          * @return      void\r
4813          */\r
4814         static private function action_banlist()\r
4815         {\r
4816                 global $member, $manager;\r
4817                 \r
4818                 $blogid = intRequestVar('blogid');\r
4819                 $member->blogAdminRights($blogid) or self::disallow();\r
4820                 \r
4821                 self::$skin->parse('banlist');\r
4822                 return;\r
4823         }\r
4824         \r
4825         /**\r
4826          * Admin::action_banlistdelete()\r
4827          * \r
4828          * @param       void\r
4829          * @return      void\r
4830          */\r
4831         static private function action_banlistdelete()\r
4832         {\r
4833                 global $member, $manager;\r
4834                 \r
4835                 $blogid = intRequestVar('blogid');\r
4836                 $member->blogAdminRights($blogid) or self::disallow();\r
4837                 \r
4838                 self::$skin->parse('banlistdelete');\r
4839                 return;\r
4840         }\r
4841         \r
4842         /**\r
4843          * Admin::action_banlistdeleteconfirm()\r
4844          * \r
4845          * @param       void\r
4846          * @return      void\r
4847          */\r
4848         static private function action_banlistdeleteconfirm()\r
4849         {\r
4850                 global $member, $manager;\r
4851                 \r
4852                 $blogid         = intPostVar('blogid');\r
4853                 $allblogs       = postVar('allblogs');\r
4854                 $iprange        = postVar('iprange');\r
4855                 \r
4856                 $member->blogAdminRights($blogid) or self::disallow();\r
4857                 \r
4858                 $deleted = array();\r
4859                 \r
4860                 if ( !$allblogs )\r
4861                 {\r
4862                         if ( Ban::removeBan($blogid, $iprange) )\r
4863                         {\r
4864                                 $deleted[] = $blogid;\r
4865                         }\r
4866                 }\r
4867                 else\r
4868                 {\r
4869                         // get blogs fot which member has admin rights\r
4870                         $adminblogs = $member->getAdminBlogs();\r
4871                         foreach ($adminblogs as $blogje)\r
4872                         {\r
4873                                 if ( Ban::removeBan($blogje, $iprange) )\r
4874                                 {\r
4875                                         $deleted[] = $blogje;\r
4876                                 }\r
4877                         }\r
4878                 }\r
4879                 \r
4880                 if ( sizeof($deleted) == 0 )\r
4881                 {\r
4882                         self::error(_ERROR_DELETEBAN);\r
4883                 }\r
4884                 \r
4885                 /* TODO: we should use other ways */\r
4886                 $_REQUEST['delblogs'] = $deleted;\r
4887                 \r
4888                 self::$skin->parse('banlistdeleteconfirm');\r
4889                 return;\r
4890         }\r
4891         \r
4892         /**\r
4893          * Admin::action_banlistnewfromitem()\r
4894          * \r
4895          * @param       void\r
4896          * @return      void\r
4897          */\r
4898         static private function action_banlistnewfromitem()\r
4899         {\r
4900                 global $manager;\r
4901                 \r
4902                 $itemid = intRequestVar('itemid');\r
4903                 $item =& $manager->getItem($itemid, 1, 1);\r
4904                 self::action_banlistnew($item['blogid']);\r
4905                 return;\r
4906         }\r
4907         \r
4908         /**\r
4909          * Admin::action_banlistnew()\r
4910          * \r
4911          * @param       integer $blogid ID for weblog\r
4912          * @return      void\r
4913          */\r
4914         static private function action_banlistnew($blogid = '')\r
4915         {\r
4916                 global $member, $manager;\r
4917                 \r
4918                 if ( $blogid == '' )\r
4919                 {\r
4920                         $blogid = intRequestVar('blogid');\r
4921                 }\r
4922                 \r
4923                 $ip = requestVar('ip');\r
4924                 \r
4925                 $member->blogAdminRights($blogid) or self::disallow();\r
4926                 \r
4927                 /* TODO: we should consider to use the other way instead of this */\r
4928                 $_REQUEST['blogid'] = $blogid;          \r
4929                 \r
4930                 self::$skin->parse('banlistnew');\r
4931                 \r
4932                 return;\r
4933         }\r
4934 \r
4935         /**\r
4936          * Admin::action_banlistadd()\r
4937          * \r
4938          * @param       void\r
4939          * @return      void\r
4940          */\r
4941         static private function action_banlistadd()\r
4942         {\r
4943                 global $member;\r
4944                 \r
4945                 $blogid         = intPostVar('blogid');\r
4946                 $allblogs       = postVar('allblogs');\r
4947                 $iprange        = postVar('iprange');\r
4948                 \r
4949                 if ( $iprange == "custom" )\r
4950                 {\r
4951                         $iprange = postVar('customiprange');\r
4952                 }\r
4953                 $reason   = postVar('reason');\r
4954                 \r
4955                 $member->blogAdminRights($blogid) or self::disallow();\r
4956                 \r
4957                 // TODO: check IP range validity\r
4958                 \r
4959                 if ( !$allblogs )\r
4960                 {\r
4961                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4962                         {\r
4963                                 self::error(_ERROR_ADDBAN);\r
4964                         }\r
4965                 }\r
4966                 else\r
4967                 {\r
4968                         // get blogs fot which member has admin rights\r
4969                         $adminblogs = $member->getAdminBlogs();\r
4970                         $failed = 0;\r
4971                         foreach ($adminblogs as $blogje)\r
4972                         {\r
4973                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4974                                 {\r
4975                                         $failed = 1;\r
4976                                 }\r
4977                         }\r
4978                         if ( $failed )\r
4979                         {\r
4980                                 self::error(_ERROR_ADDBAN);\r
4981                         }\r
4982                 }\r
4983                 self::action_banlist();\r
4984                 return;\r
4985         }\r
4986         \r
4987         /**\r
4988          * Admin::action_clearactionlog()\r
4989          * \r
4990          * @param       void\r
4991          * @return      void\r
4992          */\r
4993         static private function action_clearactionlog()\r
4994         {\r
4995                 global $member;\r
4996                 \r
4997                 $member->isAdmin() or self::disallow();\r
4998                 \r
4999                 ActionLog::clear();\r
5000                 \r
5001                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5002                 return;\r
5003         }\r
5004         \r
5005         /**\r
5006          * Admin::action_backupoverview()\r
5007          * \r
5008          * @param       void\r
5009          * @return      void\r
5010          */\r
5011         static private function action_backupoverview()\r
5012         {\r
5013                 global $member, $manager;\r
5014                 \r
5015                 $member->isAdmin() or self::disallow();\r
5016                 \r
5017                 self::$skin->parse('backupoverview');\r
5018                 return;\r
5019         }\r
5020 \r
5021         /**\r
5022          * Admin::action_backupcreate()\r
5023          * create file for backup\r
5024          * \r
5025          * @param               void\r
5026          * @return      void\r
5027          * \r
5028          */\r
5029         static private function action_backupcreate()\r
5030         {\r
5031                 global $member, $DIR_LIBS;\r
5032                 \r
5033                 $member->isAdmin() or self::disallow();\r
5034                 \r
5035                 // use compression ?\r
5036                 $useGzip = (integer) postVar('gzip');\r
5037                 \r
5038                 include($DIR_LIBS . 'backup.php');\r
5039                 \r
5040                 // try to extend time limit\r
5041                 // (creating/restoring dumps might take a while)\r
5042                 @set_time_limit(1200);\r
5043                 \r
5044                 Backup::do_backup($useGzip);\r
5045                 exit;\r
5046         }\r
5047         \r
5048         /**\r
5049          * Admin::action_backuprestore()\r
5050          * restoring from uploaded file\r
5051          * \r
5052          * @param               void\r
5053          * @return      void\r
5054          */\r
5055         static private function action_backuprestore()\r
5056         {\r
5057                 global $member, $DIR_LIBS;\r
5058                 \r
5059                 $member->isAdmin() or self::disallow();\r
5060                 \r
5061                 if ( intPostVar('letsgo') != 1 )\r
5062                 {\r
5063                         self::error(_ERROR_BACKUP_NOTSURE);\r
5064                 }\r
5065                 \r
5066                 include($DIR_LIBS . 'backup.php');\r
5067                 \r
5068                 // try to extend time limit\r
5069                 // (creating/restoring dumps might take a while)\r
5070                 @set_time_limit(1200);\r
5071                 \r
5072                 $message = Backup::do_restore();\r
5073                 if ( $message != '' )\r
5074                 {\r
5075                         self::error($message);\r
5076                 }\r
5077                 self::$skin->parse('backuprestore');\r
5078                 return;\r
5079         }\r
5080         \r
5081         /**\r
5082          * Admin::action_pluginlist()\r
5083          * output the list of installed plugins\r
5084          * \r
5085          * @param       void\r
5086          * @return      void\r
5087          * \r
5088          */\r
5089         static private function action_pluginlist()\r
5090         {\r
5091                 global $DIR_PLUGINS, $member, $manager;\r
5092                 \r
5093                 // check if allowed\r
5094                 $member->isAdmin() or self::disallow();\r
5095                 \r
5096                 self::$skin->parse('pluginlist');\r
5097                 return;\r
5098         }\r
5099         \r
5100         /**\r
5101          * Admin::action_pluginhelp()\r
5102          * \r
5103          * @param       void\r
5104          * @return      void\r
5105          */\r
5106         static private function action_pluginhelp()\r
5107         {\r
5108                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5109                 \r
5110                 // check if allowed\r
5111                 $member->isAdmin() or self::disallow();\r
5112                 \r
5113                 $plugid = intGetVar('plugid');\r
5114                 \r
5115                 if ( !$manager->pidInstalled($plugid) )\r
5116                 {\r
5117                         self::error(_ERROR_NOSUCHPLUGIN);\r
5118                 }\r
5119                 \r
5120                 self::$skin->parse('pluginhelp');\r
5121                 return;\r
5122         }\r
5123         \r
5124         /**\r
5125          * Admin::action_pluginadd()\r
5126          * \r
5127          * @param       Void\r
5128          * @return      Void\r
5129          * \r
5130          */\r
5131         static private function action_pluginadd()\r
5132         {\r
5133                 global $member, $manager, $DIR_PLUGINS;\r
5134                 \r
5135                 // check if allowed\r
5136                 $member->isAdmin() or self::disallow();\r
5137                 \r
5138                 $name = postVar('filename');\r
5139                 \r
5140                 if ( $manager->pluginInstalled($name) )\r
5141                 {\r
5142                         self::error(_ERROR_DUPPLUGIN);\r
5143                 }\r
5144                 \r
5145                 if ( !checkPlugin($name) )\r
5146                 {\r
5147                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5148                 }\r
5149                 \r
5150                 // get number of currently installed plugins\r
5151                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5152                 $numCurrent = $res->rowCount();\r
5153                 \r
5154                 // plugin will be added as last one in the list\r
5155                 $newOrder = $numCurrent + 1;\r
5156                 \r
5157                 $data = array('file' => &$name);\r
5158                 $manager->notify('PreAddPlugin', $data);\r
5159                 \r
5160                 // do this before calling getPlugin (in case the plugin id is used there)\r
5161                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5162                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5163                 DB::execute($query);\r
5164                 $iPid = DB::getInsertId();\r
5165                 \r
5166                 $manager->clearCachedInfo('installedPlugins');\r
5167                 \r
5168                 // Load the plugin for condition checking and instalation\r
5169                 $plugin =& $manager->getPlugin($name);\r
5170                 \r
5171                 // check if it got loaded (could have failed)\r
5172                 if ( !$plugin )\r
5173                 {\r
5174                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5175                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5176                         \r
5177                         DB::execute($query);\r
5178                         \r
5179                         $manager->clearCachedInfo('installedPlugins');\r
5180                         self::error(_ERROR_PLUGIN_LOAD);\r
5181                 }\r
5182                 \r
5183                 // check if plugin needs a newer Nucleus version\r
5184                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5185                 {\r
5186                         // uninstall plugin again...\r
5187                         self::deleteOnePlugin($plugin->getID());\r
5188                         \r
5189                         // ...and show error\r
5190                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5191                 }\r
5192                 \r
5193                 // check if plugin needs a newer Nucleus version\r
5194                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5195                 {\r
5196                         // uninstall plugin again...\r
5197                         self::deleteOnePlugin($plugin->getID());\r
5198                         \r
5199                         // ...and show error\r
5200                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5201                 }\r
5202                 \r
5203                 $pluginList = $plugin->getPluginDep();\r
5204                 foreach ( $pluginList as $pluginName )\r
5205                 {\r
5206                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5207                         if ($res->rowCount() == 0)\r
5208                         {\r
5209                                 // uninstall plugin again...\r
5210                                 self::deleteOnePlugin($plugin->getID());\r
5211                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5212                         }\r
5213                 }\r
5214                 \r
5215                 // call the install method of the plugin\r
5216                 $plugin->install();\r
5217                 \r
5218                 $data = array('plugin' => &$plugin);\r
5219                 $manager->notify('PostAddPlugin', $data);\r
5220                 \r
5221                 // update all events\r
5222                 self::action_pluginupdate();\r
5223                 return;\r
5224         }\r
5225         \r
5226         /**\r
5227          * ADMIN:action_pluginupdate():\r
5228          * \r
5229          * @param       Void\r
5230          * @return      Void\r
5231          * \r
5232          */\r
5233         static private function action_pluginupdate()\r
5234         {\r
5235                 global $member, $manager, $CONF;\r
5236                 \r
5237                 // check if allowed\r
5238                 $member->isAdmin() or self::disallow();\r
5239                 \r
5240                 // delete everything from plugin_events\r
5241                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5242                 \r
5243                 // loop over all installed plugins\r
5244                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5245                 foreach ( $res as $row )\r
5246                 {\r
5247                         $pid  =  $row['pid'];\r
5248                         $plug =& $manager->getPlugin($row['pfile']);\r
5249                         if ( $plug )\r
5250                         {\r
5251                                 $eventList = $plug->getEventList();\r
5252                                 foreach ( $eventList as $eventName )\r
5253                                 {\r
5254                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5255                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5256                                         DB::execute($query);\r
5257                                 }\r
5258                         }\r
5259                 }\r
5260                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5261                 return;\r
5262         }\r
5263         \r
5264         /**\r
5265          * Admin::action_plugindelete()\r
5266          * \r
5267          * @param       void\r
5268          * @return      void\r
5269          */\r
5270         static private function action_plugindelete()\r
5271         {\r
5272                 global $member, $manager;\r
5273                 \r
5274                 // check if allowed\r
5275                 $member->isAdmin() or self::disallow();\r
5276                 \r
5277                 $pid = intGetVar('plugid');\r
5278                 \r
5279                 if ( !$manager->pidInstalled($pid) )\r
5280                 {\r
5281                         self::error(_ERROR_NOSUCHPLUGIN);\r
5282                 }\r
5283                 \r
5284                 self::$skin->parse('plugindelete');\r
5285                 return;\r
5286         }\r
5287 \r
5288         /**\r
5289          * Admin::action_plugindeleteconfirm()\r
5290          * \r
5291          * @param       void\r
5292          * @return      void\r
5293          */\r
5294         static private function action_plugindeleteconfirm()\r
5295         {\r
5296                 global $member, $manager, $CONF;\r
5297                 \r
5298                 // check if allowed\r
5299                 $member->isAdmin() or self::disallow();\r
5300                 \r
5301                 $pid = intPostVar('plugid');\r
5302                 \r
5303                 $error = self::deleteOnePlugin($pid, 1);\r
5304                 if ( $error )\r
5305                 {\r
5306                         self::error($error);\r
5307                 }\r
5308                 \r
5309                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5310                 return;\r
5311         }\r
5312         \r
5313         /**\r
5314          * Admin::\r
5315          * \r
5316          * @param       void\r
5317          * @return      void\r
5318          */\r
5319         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5320         {\r
5321                 global $manager;\r
5322                 \r
5323                 $pid = intval($pid);\r
5324                 \r
5325                 if ( !$manager->pidInstalled($pid) )\r
5326                 {\r
5327                         return _ERROR_NOSUCHPLUGIN;\r
5328                 }\r
5329                 \r
5330                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5331                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5332                 $name = DB::getValue($query);\r
5333                 \r
5334                 // check dependency before delete\r
5335                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5336                 foreach ( $res as $row )\r
5337                 {\r
5338                         $plug =& $manager->getPlugin($row['pfile']);\r
5339                         if ( $plug )\r
5340                         {\r
5341                                 $depList = $plug->getPluginDep();\r
5342                                 foreach ( $depList as $depName )\r
5343                                 {\r
5344                                         if ( $name == $depName )\r
5345                                         {\r
5346                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5347                                         }\r
5348                                 }\r
5349                         }\r
5350                 }\r
5351                 \r
5352                 $data = array('plugid' => $pid);\r
5353                 $manager->notify('PreDeletePlugin', $data);\r
5354                 \r
5355                 // call the unInstall method of the plugin\r
5356                 if ( $callUninstall )\r
5357                 {\r
5358                         $plugin =& $manager->getPlugin($name);\r
5359                         if ( $plugin )\r
5360                         {\r
5361                                 $plugin->unInstall();\r
5362                         }\r
5363                 }\r
5364                 \r
5365                 // delete all subscriptions\r
5366                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5367                 \r
5368                 // delete all options\r
5369                 // get OIDs from plugin_option_desc\r
5370                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5371                 $aOIDs = array();\r
5372                 foreach ( $res as $row )\r
5373                 {\r
5374                         array_push($aOIDs, $row['oid']);\r
5375                 }\r
5376                 \r
5377                 // delete from plugin_option and plugin_option_desc\r
5378                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5379                 if (count($aOIDs) > 0)\r
5380                 {\r
5381                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5382                 }\r
5383                 \r
5384                 // update order numbers\r
5385                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5386                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5387                 \r
5388                 // delete row\r
5389                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5390                 \r
5391                 $manager->clearCachedInfo('installedPlugins');\r
5392                 $data = array('plugid' => $pid);\r
5393                 $manager->notify('PostDeletePlugin', $data);\r
5394                 \r
5395                 return '';\r
5396         }\r
5397         \r
5398         /**\r
5399          * Admin::action_pluginup()\r
5400          * \r
5401          * @param       void\r
5402          * @return      void\r
5403          */\r
5404         static private function action_pluginup()\r
5405         {\r
5406                 global $member, $manager, $CONF;\r
5407                 \r
5408                 // check if allowed\r
5409                 $member->isAdmin() or self::disallow();\r
5410                 \r
5411                 $plugid = intGetVar('plugid');\r
5412                 \r
5413                 if ( !$manager->pidInstalled($plugid) )\r
5414                 {\r
5415                         self::error(_ERROR_NOSUCHPLUGIN);\r
5416                 }\r
5417                 \r
5418                 // 1. get old order number\r
5419                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5420                 \r
5421                 // 2. calculate new order number\r
5422                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5423                 \r
5424                 // 3. update plug numbers\r
5425                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5426                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5427                 \r
5428                 //self::action_pluginlist();\r
5429                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5430                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5431                 return;\r
5432         }\r
5433         \r
5434         /**\r
5435          * Admin::action_plugindown()\r
5436          * \r
5437          * @param       void\r
5438          * @return      void\r
5439          */\r
5440         static private function action_plugindown()\r
5441         {\r
5442                 global $member, $manager, $CONF;\r
5443                 \r
5444                 // check if allowed\r
5445                 $member->isAdmin() or self::disallow();\r
5446                 \r
5447                 $plugid = intGetVar('plugid');\r
5448                 if ( !$manager->pidInstalled($plugid) )\r
5449                 {\r
5450                         self::error(_ERROR_NOSUCHPLUGIN);\r
5451                 }\r
5452                 \r
5453                 // 1. get old order number\r
5454                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5455                 \r
5456                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5457                 $maxOrder = $res->rowCount();\r
5458                 \r
5459                 // 2. calculate new order number\r
5460                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5461                 \r
5462                 // 3. update plug numbers\r
5463                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5464                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5465                 \r
5466                 //self::action_pluginlist();\r
5467                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5468                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5469                 return;\r
5470         }\r
5471         \r
5472         /**\r
5473          * Admin::action_pluginoptions()\r
5474          * \r
5475          * Output Plugin option page\r
5476          * \r
5477          * @access      public\r
5478          * @param       string $message message when fallbacked\r
5479          * @return      void\r
5480          * \r
5481          */\r
5482         static private function action_pluginoptions($message = '')\r
5483         {\r
5484                 global $member, $manager;\r
5485                 \r
5486                 // check if allowed\r
5487                 $member->isAdmin() or self::disallow();\r
5488                 \r
5489                 $pid = intRequestVar('plugid');\r
5490                 if ( !$manager->pidInstalled($pid) )\r
5491                 {\r
5492                         self::error(_ERROR_NOSUCHPLUGIN);\r
5493                 }\r
5494                 \r
5495                 if ( isset($message) )\r
5496                 {\r
5497                         self::$headMess = $message;\r
5498                 }\r
5499                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5500                 $plugin         = $manager->getPlugin($plugname);\r
5501                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5502                 \r
5503                 self::$skin->parse('pluginoptions');\r
5504                 return;\r
5505         }\r
5506         \r
5507         /**\r
5508          * Admin::action_pluginoptionsupdate()\r
5509          * \r
5510          * Update plugin options and fallback to plugin option page\r
5511          * \r
5512          * @access      public\r
5513          * @param       void\r
5514          * @return      void\r
5515          */\r
5516         static private function action_pluginoptionsupdate()\r
5517         {\r
5518                 global $member, $manager;\r
5519                 \r
5520                 // check if allowed\r
5521                 $member->isAdmin() or self::disallow();\r
5522                 \r
5523                 $pid = intRequestVar('plugid');\r
5524                 \r
5525                 if ( !$manager->pidInstalled($pid) )\r
5526                 {\r
5527                         self::error(_ERROR_NOSUCHPLUGIN);\r
5528                 }\r
5529                 \r
5530                 $aOptions = requestArray('plugoption');\r
5531                 NucleusPlugin::apply_plugin_options($aOptions);\r
5532                 \r
5533                 $data = array(\r
5534                         'context'       => 'global',\r
5535                         'plugid'        => $pid\r
5536                 );\r
5537                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5538                 \r
5539                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5540                 return;\r
5541         }\r
5542         \r
5543         /**\r
5544          * Admin::action_parseSpecialskin()\r
5545          * \r
5546          * @param       void\r
5547          * @return      void\r
5548          */\r
5549         static private function action_parseSpecialskin()\r
5550         {\r
5551                 self::$skin->parse(self::$action);\r
5552                 return;\r
5553         }\r
5554         \r
5555         /**\r
5556          * Admin::getAdminskinIDFromName()\r
5557          * \r
5558          * @param       string  $skinname       name of skin\r
5559          * @return      integer ID for skin\r
5560          */\r
5561         static private function getAdminskinIDFromName($skinname)\r
5562         {\r
5563                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5564                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5565                 $admnSknID      = DB::getValue($query);\r
5566                 return (integer) $adminSkinID;\r
5567         }\r
5568         \r
5569         /**\r
5570          * Admin::getAdminskinNameFromID()\r
5571          * \r
5572          * @param       integer $skinid ID for skin\r
5573          * @return      integer ID for skin\r
5574          */\r
5575         static private function getAdminskinNameFromID($skinid)\r
5576         {\r
5577                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5578                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5579                 $admnSknID      = DB::getValue($query);\r
5580                 return (integer) $adminSkinID;\r
5581         }\r
5582         \r
5583         /**\r
5584          * Admin::getAdminextrahead()\r
5585          */\r
5586         static public function getAdminextrahead()\r
5587         {\r
5588                 return self::$extrahead;\r
5589         }\r
5590         \r
5591         /**\r
5592          * Admin::getAdminpassvar()\r
5593          */\r
5594         static public function getAdminpassvar()\r
5595         {\r
5596                 return self::$passvar;\r
5597         }\r
5598         \r
5599         /**\r
5600          * Admin::getAdminAction()\r
5601          */\r
5602         static public function getAdminAction()\r
5603         {\r
5604                 return self::$action;\r
5605         }\r
5606         \r
5607         /**\r
5608          * Admin::getAdminaOption()\r
5609          */\r
5610         static public function getAdminaOption()\r
5611         {\r
5612                 return self::$aOptions;\r
5613         }\r
5614         \r
5615         /**\r
5616          * Admin::action_importAdmin()\r
5617          * \r
5618          * @param       void\r
5619          * @return      void\r
5620          */\r
5621         static private function action_importAdmin()\r
5622         {\r
5623                 global $DIR_ADMINSKINS, $action;\r
5624                 if ( $action == 'adminskinieimport' )\r
5625                 {\r
5626                         self::doAdminskinimport();\r
5627                 }\r
5628                 $skn = array();\r
5629                 if ( $action == 'showlogin' )\r
5630                 {\r
5631                         $skinName = 'showlogin';\r
5632                         $actnName = 'showlogin';\r
5633                 }\r
5634                 else\r
5635                 {\r
5636                         $skinName = 'defaultimporter';\r
5637                         $actnName = 'importAdmin';\r
5638                 }\r
5639                 \r
5640                 /* TODO: why??? */\r
5641                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5642                 $skn['id']                              = 0;\r
5643                 $skn['description']             = $skinName;\r
5644                 $skn['contentType']             = 'importAdmin';\r
5645                 $skn['includeMode']             = 'normal';\r
5646                 $skn['includePrefix']   = '';\r
5647                 $skn['name']                    = 'defaultinporter';\r
5648                 \r
5649                 self::$skin                             = (object) $skn;\r
5650                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5651                 \r
5652                 $parser = new PARSER($handler);\r
5653                 $parser->setSkin(self::$skin);\r
5654                 $parser->parse($contents);\r
5655                 \r
5656                 return;\r
5657         }\r
5658         \r
5659         /**\r
5660          * Admin::doAdminskinimport()\r
5661          * \r
5662          * @param       void\r
5663          * @return      void\r
5664          */\r
5665         static private function doAdminskinimport()\r
5666         {\r
5667                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5668                 \r
5669                 $member->isAdmin() or self::disallow();\r
5670                 \r
5671                 include_once($DIR_LIBS . 'Skinie.php');\r
5672                 $skinFileRaw    = postVar('skinfile');\r
5673                 $mode                   = postVar('mode');\r
5674                 $allowOverwrite = intPostVar('overwrite');\r
5675                 \r
5676                 if ( $mode == 'file' )\r
5677                 {\r
5678                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5679                 }\r
5680                 else\r
5681                 {\r
5682                         $skinFile = $skinFileRaw;\r
5683                 }\r
5684                 \r
5685                 $importer       = new SKINIMPORT();\r
5686                 $error          = $importer->readFile($skinFile);\r
5687                 if ( $error )\r
5688                 {\r
5689                         self::error($error);\r
5690                 }\r
5691                 $error = $importer->writeToDatabase($allowOverwrite);\r
5692                 if ( $error )\r
5693                 {\r
5694                         self::error($error);\r
5695                 }\r
5696                 \r
5697                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5698                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5699                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5700                 \r
5701                 header('Location: ' . $CONF['AdminURL']);\r
5702                 exit;\r
5703         }\r
5704 }\r